A long time ago in a galaxy far, far away, the dawn of the computer age occurred in the banking industry. It was the mid to late seventies when I entered the realm of banking, specifically, internal audit.

One of the first internal control procedures I was introduced to was the daily comparison of source documents to the computer generated File Maintenance journal. The purpose of this review being to verify the integrity of the data as well as to prevent/detect unauthorized activity. The reviewer would be someone independent of the transaction/data.

THE QUESTION: Does this process continue to be performed at your institution or has its value diminished and is no longer performed. The current thinking among management at my bank is that we should abandon this process and accept the associated risk. I say "not so fast."

we have a very strict change control process, and access to making these types of changes is restricted to very few personnel, and every change takes 2 independent users, with a long string of signoffs before changes are implemented or made.

when chages are made, autogenerated emails are sent to all with change access, as well as management within various areas of the bank.

this is, in our opinion, a better method than a daily review of files.

We definitely still do the daily review of changes to the computer-system-generated report of file maintenance. The examiners ask us to produce this each and every time. Never had a problem with our process, I believe strongly in its value, and we've identified unauthorized changes AND changes done incorrectly via this process. We won't be abandoning this any time soon.

We have 15 branches and were handling our maintenance in the same manner as "Low Profile". I have been in banking for 40 years, so I understand exactly where you are coming from. The maintenance requests came in from the branches to our operations dept., who made the change and then a second person verified the change the next day. All of our maintenance is now conducted at the initial point of contact (except maintenance done to account relationships. The following day the maintenance report is reviewed to ensure there are not changes being made that appear to be incorrect, etc. The bank is willing to accept the risk. We have not been audited yet, but one is coming up. Yikes - I am holding my breath.

I appreciate your responses. I would like to find out how others handle the daily process of reviewing file maintenance requests. Additional input would be greatly apreciated.

File Maintenance changes are completed and verified at the branches but the Compliance department reviews the reports generated against the file maintenance form completed.

but the Compliance department reviews

That means your compliance department is functioning as part of the business line. Most banks do not operate in that manner.

I have a question on the file maintenance source documents. How long do you have to keep them?

Define "file maintenance source documents". Maintenance is performed all the time. Depending on what specifically you are doing, source documents may need to become part of the permanent account record.

We started archiving all Retail documents last year and that has gone very well for us. It makes the review process much easier also.

We compare file maintenance change request source documents against the system to check that the changes are correct. We scan in all of our source documents to our system.