Is it acceptable for Internal Audit to perform the only employee account reviews for suspicious activity? Or should say the security officer, HR director, or member of management perform this review, and then IA perform another reveiw, and in a sense review the review? IA and Mgt are debating about who should do this...mgt says its IA's job, IA says they should review mgt's review. Any input is much appreciated. THanks.

IA is probably right in theory. In practice, this is very often completed by IA. You could argue that IA's review is reviewed by examiners and external auditors.

Bank policy dictates acceptable auditing in most cases. However, one thing to remember, especially in small institutions where IA is a one person or nearly one person department; who will know if IA is the one with suspicious transactions? For this reason, it is best that this account type be reviewed by either an outside party or by multiple parties.

I am the IA for our institution. I review employee accounts and my accounts are reviewed by the President (small bank). This was suggested by the exmaminers.

Ditto--except the Security Officer reviews mine.

Currently IA is reviewing employee accounts, but kiting reports are reviewed daily by the security officer- so we hope to move the IA review completely.

I as the 1-woman compliance/audit department review employee statements. The EVP/CFO reviews my account statement on occasion.

I do the reviews and have the CFO do reviews of my statements. I agree, it should be done by internal audit because we are looking for different issues than management that may make us look into other areas like GL accounts, etc. that management may not think is a likely place to look. Our state code (OK) has included this area under the internal control program and the internal control officer is responsible for either doing the reviews or delegating the responsibility to someone else, so of course it stayed here. Our kiting reports are also reviewed by management too.

The solution would be to not have your account at the bank you work at! I know there are perks and all, but we (IA) have decided to keep our accounts elsewhere....especially since we don't want everyone seeing our pay every week.

The other thing I would like is to know teller offages so that I can see if there is any corresponding deposit when they have an offage. You would think they wouldn't be that obvious, but you never know.

I agree with Anonymous.

Wouldn't the Reg O/FDICIA audit be so simple if employees, directors, and other insiders were not allowed to maintain accounts at the bank where they work or are affiliated?

Original Anon poster...I decided to register
Who does this information get reported to? The Audit Committee? Senior Management? Thanks.

If something needs attention, I report it to senior management. I would only take it to the audit committee if management ignored something.

I do not complete a formal reporting of my review.

If something comes to my attention through reviewing statements, I typically go to the CFO/EVP of Operations and proceed from there.

I don't report anything unless something comes up. Then, it goes to management and the audit committee.

I am a compliance officer / HR / IA and I review the employee accounts. Occasionally our EVP will review them also. Any problems are reported to Sr. Mgmt.