For our yearly ACH Originator audit, in a nutshell we:

1) Pull a random selection of 5 current year ACH entries to request agreements on 5 individuals or companies

2) For retention, we pull 3 random ACH entries that are 2 years old and request agreements

3) Calculate their average monthly and yearly ACH totals (off of reports, it's ridiculous)

4) Credit Risk each customer, often times requiring Tax Returns, Financial statements and underwriting them to determine credit worthiness

5) Request all of the above from the customer and then write up a report of all our findings, report any exceptions and make sure they clear those up before next audit.

6) Provide all ACH Originators with a copy of the NACHA Rules & Guidelines book.

We currently only have 22 clients originating ACH and this process is extremely time consuming, a lot of manual work and exhausting!

I've heard from many many clients that they NEVER got ACH Audited when they conducted ACH with other larger banks.
I just can't fathom what the larger banks do, how they can possibly keep track and audit their ACH Originators like we do.
There's only two of us in the "Electronic Banking" department and we handle everything else related to EB including customer service and this whole process seems over the top!

What do other banks do, seriously?? How do we remain in compliance but not kill ourselves doing it?

We have certain controls in place and set limits on customers.
We get an email alert anytime they send a file or if there are errors on files. We babysit all ACH origination on a daily basis and even require customers to CALL IN to verbally verify that we received their ACH File.

I just can't imagine every bank is doing the same?

Please give me your input! Are we doing the right thing or are we going a little overboard? What are the bigger guys doing? I can't imagine!


HALP!

I'm confused? You are trying to perform the required NACHA Appendix 8 annual ACH audit on yourself when you are responsible for ACH processing? There is more to an Appendix 8 audit than what you describe, so I don't think that is the driver.

What are the objectives of the audit and why isn't an independent third party performing it?

We are auditing our ACH Originators.
We do get an ACH Audit every year ourselves.

But don't other banks audit their actual originators to make sure they're ACH Rules compliant?

Wait wait...

Are we required to conduct this kind of audit to our ORIGINATORS? It's somewhat an audit like the auditors to with us.. checking our returns, NOC's, etc
Don't we need to do all those things I mentioned for our ACH Originators?

Oh gawd...

For ACH audit purposes we only perform the required NACHA steps.

I'm not sure why you would bother with steps one and two, unless you were receiving a high rate of unauthorized ACH returns.

Steps 3,4,5 should be an annual event for originators. Why would you risk rate and establish allowable ACH limits with credit analysis on a random basis? The ACH department should not be doing this, it is a function of credit risk.

Step 6, well everyone has to do that in one way or the other. Most banks send an annual reminder for the originators to download the rules from the website.

Well we do send a "packet" to our Credit Department so that they can run the credit analysis on them.
But steps 1&2 are very time consuming, having to pull reports, pull people at random and have the customer send us the agreements.
I guess it would suffice if we just work the ACH Returns for originators and make sure they're obtaining new agreements for NOC's.

I just want to simplify the process and perhaps I'm very unfamiliar with the "Required NACHA Steps" ??

*cringing* where would I find the required NACHA steps?

NACHA publishes the audit guide annually and other audit resources or check with your local ACH group that you belong too:

https://ams.nacha.org/eweb/DynamicPage.a...SearchFor=audit

For me, the NACHA Audit Requirements are straightforward and easy to follow. We purchase the audit guide from our ACH group, the audit workpapers are easy to follow.

It sounds like you are doing a lot of work that should probably be done by your internal audit department

I'm the internal auditor for our bank and I order the NACHA Audit every year for around $75-90? It has all the questions covering all the up to date changes. Covers Originators also.

Sorry to revive an old thread - but I'm only doing my second annual ACH audit. I have compared the guide I followed last year with the 2016 Operating Rules Appendix 8 (online on the NACHA site) and can't really see any change from last year. That wouldn't surprise me in a normal year but we just implemented our Same Day ACH so I'm alittle paranoid that I'm missing something big. We can afford to purchase the updated audit guide, I just want to be sure there's a good reason to this year. Any advice?