I'm looking for a sample of an IS internal audit work paper covering a small bank, outsourced environment. I don't see a sample under tools. Is there anyone willing to share?

Grist - the FFIEC has pretty good work programs for IS here

Check the fdic.gov website. Look under examinations. I think they post the examiner's manuals, which should include the checklists that they use. They have a 1996 FFIEC IS Exam Workprogram, but that covers in-house systems.

That works, thanks.

I am currently going thru the 1996 FFIEC workprogram and it has many questions for the serviced institution. So you may want to print that out also.

This just in! In my in basket, that is. FIL-118-2002 Oct. 9, 2002 entitled Information Technology Examination Procedures. This letter has two, count 'em, two new workprograms. The IT-MERIT and IT General work program. The letter says FDIC will no longer distinguish between "serviced", "turnkey" and "remote job entry" shops. Check your mail or go to fdic.gov to get the letter. I plan to use the old 1996 workprogram, then do the new one to see the differences.

Thanks, it was just dropped in my in-basket. The online version is at FDIC. My plan is to use it a my work paper on this subject with the responses ready when the FDIC arrives.