Does the annual BSA independent testing need to be done by a CPA? I'm new to this and the only internal auditor in the bank.

There's no requirement that it be performed by a CPA, however, the users of the report (your examiners, externals, board) may believe it has more credibility if it is done by one. CPAs are required to perform their work according to certain standards of practice. Just the same, a non-CPA consultant may very well follow the same standards, and may even be better qualified to perform this specific review. That is something you would have to determine when selecting the firm.

No, but it has to be done by someone who is qualified. My qualification requirements would include years of BSA experience and auditing.

I think if you are a quick learner than experience, certification, etc. is not needed. I think BSA is an easier audit than Rec CC, but be extremly careful. Your program/plan is critical and you want to perform extensive testing in high risk areas (CTR/Suspicious Activity). I have a program that was just reviewed by the examiners if you are interested. Email me @ jperello@iberiabank.com

P.S. - BSA is not required annually...some examiners do not know the reg.

jperello - I guess I have to disagree with you on a couple of points.

First, a BSA audit is not easier than a Reg CC audit and I have been doing this type of thing since they were first required. If you are to even come close to following the new BSA examination guidelines you are going to need a highly skilled individual.

Second - the examiners know exactly what they are doing. While there is no regulatory requirement, the new examination procedures page 26 indicates that an annual independent test is a "sound practice". Not doing one is the best way to get off on the wrong foot.

Then read steps 4 through 13 starting on page 175. If you want your regulators to look under every single rock in your institution - use an independent tester that doesn't at least attempt to meet all those steps.

If they have to start from scratch to do an examination rather than rely on all or parts of the independent audit - that is going to be another strike against you.

However, for a bank your size ($2.7B), I'm pleasantly surprised that you have been able to adjust your audit plan as quick as you did. Six weeks is not much time to fine tune a plan to a point that I would be comfortable in sharing it. Good job!

rlcarey- Are you an ex-examiner?

I guess it depends on who is performing the review, but Reg CC should not be as complicated as it is.

If the examiners “know” what they are doing, then why do they insist that the audit is required annually by Reg H? Why couldn’t they be straight forward and say that we should do one, but it’s not required? Another thing is that if I’m an examiner and my agency has made this a “top priority,” I’m not relying on the internal audit function to make sure the institution is in compliance with BSA.

Also, when practitioners request the program I make two disclaimers 1) Depending on the size and AML risk of the institution the program might need to changed and 2) Review the FINCEN BSA/AML examination manual.

Examiner speak - "Strongly suggested" = required (regardless of reg wording).

Also regardless of priority of the issue (the hot buttons constantly change) an examiner will use your audits as a basis for their exam. The amount of weight they put on it depends on their comfort level with your experience & work, your bank history with the agency (previous exams), and (being honest) the work ethic of the examiner.

Randy & I don't always agree, but he has given you good advice.

There's no requirement on being a CPA.

As a few others have mentioned, the regulators focus on the competency and independence of the individual conducting the review.

As many will tell you, the entire topic of Anti-Money Laundering has become somewhat complex and high-profile in the eyes of the examiners.

I believe it takes a few years of exposure to this topic to reach a point where you can competently audit it, though the smaller and less complicated the operations, the easier it is perform.

Having said this, a thorough study of the recently published AML examiner guidelines is a good starting point.

Hope this helps.

HOW DOES ONE QUALIFY AS AN INDEPENDENT AUDITOR

On what planet is a Reg CC audit easier than a BSA audit?

It would be one thing if all you're doing is auditing CTR's and monetary instrument logs, but the BSA audit is so much more these days. So much more........