Sometimes I encounter an instance that does not fall under any of the audits I perform at my bank. Usually, it's nothing major but I feel it needs to be addressed and documented. How do you handle/document these instances?

I assume you take a risk based audit approach. These things you are talking about should be on the low end of the sprectrum. You will not cover or identify every issue a bank may have. Management needs to understand this. If I discover an issue during an audit not related to the audit I am working on, I present it to management as an FYI issue.

I feel it needs to be documented so I'm thinking an email to management with a response will be sufficient.

not knowing your structure and the level of the issues it would be difficult to advise. Here if the issue is part of the review we just adjust the audit program to include the issue if it was important enough or we could write out as a workpaper comment if low severity. Other issues can be saved for the appropriate review. Some items are e-mailed to the appropriate Sr level manager if that was deemed appropriate(and noted in current review).

Another consideration is to have quarterly operations audits. They are smaller but we feel can include just about anything that comes up outside of formal audit findings. There is a basic structure to them and includes frontline related issues, customer service concerns, security concerns, regulatory head's up. Really anything that has created increased risk(s) to the bank, where it is more appropriate to elevate the info to management and the audit committee's attention in a timely manner is game for quarterly audit content.

Thank you all! Your responses have been very helpful.