I was wondering what other audit depts do when management does not submit audit responses to audits performed? Do you request a second time, a third time, etc.?

What do you do if you never receive a response?

Requests are mine not my employer

The individuals responsible are given a time frame from 1 to 2 weeks to respond to the audit findings. If the responses are not received by 30 days following the initial due date the audit dept informs the President that they have not been received.

We do the same, and if we still don't have a response it goes to the committee without management response. That's never happened. Our philosophy is that management needs to comment, even if they totally disagree with the finding - they can say so - but we want a response and the Pres reinforces that position.

But how frequently do you have to notify the President? When is it enough. He or she have other things to do too and not just babysit.

Do you always give it to the President first or do you just say enough is enough and go to the Audit Committee with it?

Requests and opinions are mine not my employer

Management has always been given a specific time frame to repond and it is tracked on the Audit Committee's tickler list. Whoa be it for management not to have a response to the Board Audit Committee on time. Yes, we use to inform the President if the response was late, but we always made sure to call that to the attention of the Audit Committee also. Otherwise, the audit function really losses it's effectiveness.

Maria, I generally give management 10 calendar days to respond. I give them a little leeway, and my letter tells them to notify me if they need an extension. I had one manager, though, that didn't respond at all to one audit and when I came around the next time to do the audit, he dragged his feet on the response. (I tried to get a response from him on the first audit and he didn't send one). So I sent him a nicely worded letter (seriously) and informed him in no uncertain terms that if I did not recieve the response by the end of the week, I would submit the report (unanswered) to the Board (really the Audit Committee). Needless to say, I got my response.

Maria, I think it's a culture thing. The AC gets reports that address past due items. Around here if you're 90 days late on an item the AC gives you a due date if you don't meet it, they call the Pres and the manager in and blast them unless I have made a compelling case for the item being past due.

The other thing we don't have a lot of are repeat finding, the Pres has made it clear that once is OK, but once you've been told about it, and agreed to an action plan then it'd better not show up again.

I'm really lucky, I have an extremely supportive Pres regardless of whether it's an audit or compliance issue.

I report to the Board an a monthly basis. Management knows this and knows that I will sent it with or without the response. Since the particular manager would look bad in the eyes of the Board if no action has been taken they will usually comply. No major problems have arisen yet.

Call this a bad Friday rant....

At my institution, I am both compliance and audit. After an audit, I am reprimanded for being "too thorough" in my audits (read, "Why do the audit reports report problems? It embarases the manager."), reprimanded again for not having fixed the problem (as the compliance person) before doing the audit (as the audit person), assigned to fix the problems, and then reprimanded because the audit schedule is behind because I am spending time fixing the problems. The audit committee is aware only that I am behind on the audit schedule. I can't bring up the other issue as management attends the audit committee meetings with me. If I speak up, I'm out of a job.

Like I said, call it a Friday rant...(and yes, I am looking for a new job...)

Dear Anonymous,

How do your regulators feel about the fact that you are both the auditor and the compliance officer, i.e, audit and part of bank line management, at the same time. Does this not present a compromise to your objectivity during audits?

In addition, you should have access to the audit committee without management present. That's pretty basic audit committee/auditor protocol. May even be regulatory!

rlcary -

The regulators aren't concerned due to our small size.

lglover -

One committee meeting a year has an "executive session with compliance officer." There has only been one in my 1 1/2 years here. I did express concerns at the last one. Then the president spoke with the audit chair after the meeting and the result was that I was placed on formal probation for "lack of performance." Issue cited - behind on audit schedule.

I feel for you, I'm very lucky and have a great deal of support. I'm both compliance and internal audit but in our institution, compliance is a line responsibility, I'm there as a consultant and to help management understand complinace responsibilities and implement compliance processes - like the CID proposal.

My AC has an executive session after each committee meeting where they ask me if I have any issues with management and if I'm getting the support I need - or have had any undue pressure placed on me to change findings or ratings. (understanding that management doesn't like audit findings and always applies pressure to have them changed.)

Sounds like you are in a culture that doesn't understand the benefits of an active audit and compliance department. I sell myself to the AC (especially these days) as the individual who keeps them out of stripped suits - I believe that they appreciate my diligence.

I've never been a fan of one person functioning as auditor and compliance manager. Compliance is a part of managment, not a type of audit. Audit should be totally independent of managment--otherwise, you become Arthur Andersen.

Our Board has adopted a written Audit Policy which states that I (the auditor) am completely independent and that a written response to the auditor's findings/recommendations is generally due within calendar days from the close of the audit. I do keep track if they are late and will report it to the AC, however, I have had no major problems.

I present my reports to the Audit Committee with Management's response letter to my monthly reports. If an audit is not addressed, I present it to the Committee that way.

I am also curious how this is viewed as well. I currently do compliance but sr. management is looking to do more inhouse auditing besides compliance audits (internal control). They seem okay with me doing this, but I wonder how the separation and objectivity is achieved. (and it is finally Friday, can anybody give me an "Amen"?)

I too hold the beloved position of Auditor/Compliance Officer. This often happens in the smaller community banks where many of us wear several hats. In my experience, the regulators have never taken issue with the dual position. If they have a question that the "Auditor" should respond to then they ask, if they have a question that the "Compliance Officer" should respond to then they ask. Actually, in my capacity as being the contact and liason when we are going through a compliance exam, I find it beneficial to be able to have a thorough understanding of the regulations as well as first hand knowledge about the bank's level of compliance through the audits that I conduct. It's kind of like one stop shopping!

I also manage the compliance program and perform internal audits. Notice I said manage the compliance program. That is the key. When I first started this job I tried to keep the bank in compliance. The bank did not have an established compliance program and/or an internal audit program when I started this job. It took me much time and frustation to realize that I can not keep the bank in compliance. I learned this through ABA school. Now I give recommendations and review the internal compliance monitoring conducted by other employees. I can be independent when I conduct an internal audit. I think you must feel confident in what you do. If you do not feel good about it, then don't do it. Your reputation and standards are on the line.

Opinions are mine not my employer

I'm currently in the same position. Surprisingly examiners have not commented negatively on the fact that I hold both positions. They have voiced on concern that perhaps I don't have adequate time to implement both.

Anon- Many banks never discover your important observation: "It took me much time and frustation to realize that I can not keep the bank in compliance." Both C/Os and their managers expect the C/O to "whip things into shape" in time for exams. The "Compliance Officer" function is a support activity. Unless the C/O can walk into an operating unit and hire/fire/promote/compensate staff and set operating procedures, the C/O cannot possibly "achieve" any level of compliance. Results are only obtained when line managers choose to direct staff and resources toward that end. Beating on line managers never gets results and they will hate you.

I wonder about this also. My bank has been criticized by our regulator because they had me listed as the compliance officer. And you are right. It is very hard to remain objective when you are part of the decision making process...and whether we like to admit it or not, being a part of the compliance group does compromise us because it does involve us in line managing. As an auditor I really object to that. Besides it is getting tougher and tougher to do both jobs. I just don't believe it can be done anymore without being comprised. I hope someday all those involved in top-level management will see how really tough our jobs are and how we can do a much better job for them if we are not involved in these other duties.

I wonder about this also. My bank has been criticized by our regulator because they had me listed as the compliance officer. And you are right. It is very hard to remain objective when you are part of the decision making process...and whether we like to admit it or not, being a part of the compliance group does compromise us because it does involve us in line managing. As an auditor I really object to that. Besides it is getting tougher and tougher to do both jobs. I just don't believe it can be done anymore without being comprised. I hope someday all those involved in top-level management will see how really tough our jobs are and how we can do a much better job for them if we are not involved in these other duties. There I said it - venting is good for the soul. Maria you seem to really enjoy what you do. Your questions seem to open some really good discussions. I loooove this website.