Can you share the number of employees within your Internal Audit department and the asset size of your bank? I am trying to assess staffing based on asset size. Thanks for your feedback.

one but that does not matter as we have different risk levels as you are most likely in TN and I am in NY.

As edAudit indicates, trying to base audit staff on asset size alone is an exercise in futility.

Rick, I fully agree however my bank has consultants telling Executive Management that it does matter. I am trying to support my current staffing.

Then you need new consultants if they are so stupid to believe that audit needs are based on asset size. Audit is based on risk. Banks of equal size may exhibit extremely different levels of risk because of the activities in which they engage or not.

You don't even indicate what your audit charter says the audit department's function within your bank might be. Do you do all internal audits in-house, even the specialized ones?? How much is out-sourced?? Have you crossed the FDICIA level? Are you a holding company, do you have affiliates or subsidiaries, do you have a trust department, internally managed IT structures, the list goes on and on.......

There are way too many factors other than asset size to address the appropriate size for an audit department. If management wants to address whether risks are being properly mitigated effectively by audit within the bank is one thing. That should be a on-going process.

For management to listen to a consultant bloviate about audit department size based on asset size shows a thorough lack of understanding when it comes to management having a handle on managing risks.

TF: We went through this and management ended up asking our external auditors. Thankfully, they basically gave the above answer....it depends! They also tossed in the experience level of the current auditors. We have some depth on staff right now. When I lose my experienced loan reviewer, I will be feeling the strain with my current staffing.

I can only answer to audit committee as to whether or not I feel I have the staff to get done the tasks assigned. And as mentioned above....that is continually changing. We just keep talking about it at audit committee meetings. The hard part is going to committee and letting them know that we need to outsource some items next year due to (insert increased risk here.)

There are similarly sized banks in town with a third the staff I have. Another up the street from us has a bigger staff (if you include their loan review dept) but they need SOX staff and they do their own IT audit. Same asset size but bigger footprint and different services offered. Their staffing doesn't surprise me.

So hard to tell them it's like comparing apples and onions, isn't it?

That is where you (I) have an issue with your consultants, this should be a discussion with the CAE or audit committee and not executive management.

I am the CAE and they are not consulting with me. Only looking at metrics and benchmarks... It will be a nice discussion with my Audit Committee.

you should invite them over for a cup of coffee with your regulator. <evil smiley>

what is needed is to find out what "metrics and benchmarks" were used and find Skippy and Scooter used some type of risk assessment to determine staff size or just asset size.

They used Assets/Audit FTE and Bank FTE per Audit FTE, nothing based on the structure and risk profile of the bank, complexities, regulatory feedback, risk assessments, audit charter requirements, SOX 404 requirements, etc. Just generalizations and benchmarks...

Their metrics:
Average performance - 1 auditor FTE per $570MM
High Performance -1 auditor FTE per $925MM

If you can single handedly complete an audit plan of 4400 hours and manage the function for a $1 Billion asset bank with excellence with a staff of one (you), I will hire you.

How many weeks of vacation does that include?

These topics are always difficult when a consultant gets involved. As you know there are a lot of other variable involved in the size of an Audit Department.

Like I said, your bank has hired idiots as consultants.

You need to sit down with your audit committee pronto so they can help you straighten executive management out. Executive management, when it comes to audit, doesn't even have a dog in the hunt.

P.S. Glad to see a $450MM bank can do it with a part-time person Also, what is a CAE??

We need to delete this thread; I am wicked overstaffed!

Also, what is a CAE??

Chief Audit executive. the guy who reports to the board

We are 280 million in assets with 1 internal auditor. We do outsource IT and a few of the higher risk audits.