Are your compliance audits reported to the Audit Committee or another committee of the board that focuses on compliance?

As the auditor, I send all of my internal audit reports to the audit committee.

I know that my CO shares his reports and responses with our compliance committee (not a BOD committee) for the purposes of changing procedures and monitoring.

Currently, I am utilizing Audit Committee as well as presenting a summary directly to Board.

Directly to Audit Committee

We are entertaining the possibility of sending our compliance audits to a compliance risk committee of the board - with board members. That way compliance can get the focus it needs and we aren't expecting audit committee to understand compliance. However, I know that's not the traditional flow of audits so that's why I was asking.

Ours go to Compliance Committee (bank staff only) and to Audit Committee (board members only). A normal internal audit would not.

Well, I guess you need decide what these reports are and what they are going to be used for.

If they are audits, not going to the audit committee pretty much nullifies that statement.

If they are a portion of management's internal control function and the actual auditing is accomplished through other means, then the bank can do as they wish.

If a management committee wants to openly discuss true compliance audits in a management committee, that is purely up to them. The discussion should be limited to how they are going to respond. If these are true audits, only the audit committee drives the bus.

Oh and PS, don't repeat this statement in front of the regulators: "we aren't expecting audit committee to understand compliance."

Oh, the Audit Committee will be involved in compliance if you have an opion audit and have FHA lending.

So another question. Do you send ALL audit reports/findings
to the audit committee or do you use the committee purely as an escalation function for those critical items, audit reports with XX rating or issues in which the business line is not responding/remediating timely?

In all the organizations that I deal with all audit reports get presented to the audit committee. How else are they supposed to keep tabs on the audit function, progress, etc. Management responses are usually tracked, timelines are presented, past due responses are highlighted.

Does your audit committee not have a charter??

This is one of the big boys - but I think you will get the drift:

http://www.jpmorganchase.com/corporate/About-JPMC/audit-committee-charter.htm

All to the compliance committee

Agreed...all internal and external audit reports go to our committee. We discuss the exception tracking report (summary of all recommendations) in great detail.

The Audit Committee received the actual report issued. The report notes every exception identified during the audit along with management's response and/or corrective action. They are also presented with a list of outstanding exceptions not resolved by management.

I would not "dumb down your audit committee" just for compliance purposes. If the Audit Committee is not capable of handling compliance issues, maybe it is time for new members not a new committee.

Same here...they get every report with every exception and a tracking therof.

In the strongest terms possible- Every single audit report needs to be reported to the audit committee. No ifs, ands, or buts. If it didn't go to the audit committee you have violated IIA standards and you lack either independence or objectivity.

Our compliance audits go to the Risk Assessment Committee--only the financial audits go to the audit committee. Is this wrong?

I think your organization has to decide this. Is your Risk Assessment Committee made up of outside directors or strictly insiders? Also what is this committee's purpose and their influence over the organization?

We're all asking the same question

I think osucpa's point (and the point of several others up the thread) is that it doesn't matter what we call the committee. What matters is the intent of the committee and the intent of the report.

Who is on the committee, where is the committee on the food chain (who influences it and who does it influence?) and what are these reports (are they management testing, independent audits performed by an independent member of staff, or other?)

All of this should be addressed in the charters of the various committees and blessed by your regulators and external auditors