I'm looking for feedback from other FI's on how you handle internal audit report issuance, and who can receive or obtain a copy of an internal audit report. Currently audit reports are issued to members of audit committee, and has been identified that in some instances those reports are shared with department staff to which that audit report applies. This may include Teller Supervisors, Cash Management, Loan Administrators, etc. I believe the reports themselves remain confidential, with any findings shared with staff.

Why would an internal audit be confidential? It would be a Audit Committee decision to set the parameters.

We start by issuing a final report to executive management and department management. Each of these understand this report will be presented to the Audit Committee. How is management suppose to correct issues if they do not receive a copy of the report?

Well, I always started by sending executive management and department management a draft of the preliminary report, as we always required a management response to be included in the actual final report presented to the Audit Committee. From there, we created required follow-up tracking on the commitments for correction made by management for reporting at future AC meetings.

I've always provided audit reports to senior management, as well as management of whatever departments were the subject of the audit. They were free to share with their staff as they saw fit.

The final version of each report is shared with executive management, applicable department and the Audit committee.

My approach has been similar to rlcarey's, except that final reports addressing regulatory issues are also shared with regulatory affairs and compliance.

I believe part of this is infrastructure influenced but at the end of the day, who needs to know, and who is going to get any issues fixed?

I don't believe I ever went beyond a VP as VPs headed most areas and they were responsible for responses, corrective actions and to senior management. Senior management was always included when it was their area, the Audit Committee and my compliance committee. It went up to the board for information and that is part of compliance management.

As to confidentiality, ALL bank staff needs to understand that bank business is bank business, whether it be a customers balance, who is past due, or an eval report. Certainly not everyone needs to know, but they all need to know that.

On more than one occasion a member of management has informed me they learned something from an audit report not over their area. These have ranged from internal controls to process improvements. All of executive management receives our final audit reports.