I am looking for guidance for internal control review of employee accounts. How often do you do this and is it a random account process or are all employee accounts reviewed on the same schedule? I was looking for some guidance in FDIC documentation but have not found any. Any suggestions would be greatly appreciated.

Employee Account Review

I have a list I get from HR of all employees and each day I review one. (Some days I skip) My ultimate goal is to review them all at least annually.

I have a list from HR of all employees (~150) I update it as the year goes on with adding new employees or deleting those who left. I review all of them at the beginning of each month for the previous months activity. We have a BSA/AML software which makes it easier to see all the activity for each employee across multiple accounts and then I also spot check their statements for anything unusual. Usually takes almost 8 hours to complete. Before the software, it was random who was reviewed monthly around 20 employees a month.

Twelve person-days a year - and what have you found so far??

I try to look at everyone twice a year & then I look at all of their accounts. If I deem someone as 'high risk' (gambling activity suspected, lots of cash deposits, significant (negative) change to their credit report) then I review them more often.

I look daily at reports for kiting, NSF, Large Transactions, Large ACH activity, insider transfers, etc. I used to look at statements but since a merge, there wasn't enough time for that anymore. If employees are on any of the reports, then a closer look is taken.

there wasn't enough time for that anymore.

This is the point that I was trying to make earlier. Necessary internal controls are not dictated by the amount of time it takes. Whether you have 10 employees or 10,000 employees, the risks are the same. Why would you reduce internal controls because there are more employees? Why would you increase controls for fewer employees. Perform your risk assessment and do what you determine you have to do - no more and no less.

Sorry for the late response. So far, I have found tellers transacting on their own accounts and I keep track of activity that's concerning: high cash ins or outs, employee accounts being overdrawn which is against our policy, etc. It is in our bank's policy that the auditor reviews employee accounts monthly too.