In my experience, you quickly become the "go to" guy for many reasons. First, by performing the audit function you will learn so much about the day to day operations of the bank that after a while people will begin to respect and rely upon your opinions. Second, which I think was said in an earlier post, in order to audit regulations (state or federal) you have to know your subject matter, therein lies your wisdom you will gain in regulatory compliance matters. I too wanted to make more of my department than JUST audit. I have begun a good, solid training program and I began writing a employee newsletter about once a quarter. As you get in the job, you will have the chance to evaluate the way that the position was previously handled and be able to form it to suit your management style.

But I too am the Compliance Officer so I still have PLENTY more to do!

IA is NOT stictly oversight. I have found it to be an excellent learning experience and each day learn more and more about the entire operations of the bank. I get involved in making constructive critcism and recommendations that will prevent problems later on. In other words, recommendations that may or should minimize risk, improve productivity, save the bank money, and develop good internal controls. You will first want to get the resources you need to organize your department well...from information resources to staffing. Put together a good plan and a sensible budget. If you are allowed staff assistance, you will want staff that understands the complexity of the position and has good banking experience along with accounting and regulatory skills. I learned a long time ago and this is what I always tell the line managers when I train - "A good leader surrounds himself/herself with qualified competent staff, provides ongoing training, and offers the tools and support necessary to do the job well. In the end, a job well done and a good support staff will certainly make you look good".

You must have a understanding with management and the board that in order for the audit program to have any value, you must work with some degree of independence and although you will be reporting your findings and recommendations to management, the most important report will be your reporting to the audit committee.

So your program will not be to simply to "police" but to ensure that the bank's internal policies and procedures are adequate enough to fit the bank's current environment and current with regulatory requirements. Above all, to see that these standards are being followed, specifically, that staff (including Sr. Management) have a clear understanding that not following these standards could serously impact the bank, i.e. jeopordize safety and soundness of the bank.

My first try at the audit/compliance person just landed me with egg on my face, even though I researched long and hard. I was shot down to the ground. I still think I am correct, I am learning the hard way someone will always want to find the loop holes.

What was your issue CAR? I find it helpful when people try and "But..." me, is to rattle of penalities for non-complaince. Also, don't ever buy the "So and So does it...so it much be legal" agruement. I get that all the time, despite the fact its such a childish arguement.

The issue was the cashing of business checks. I have knowledge of these type of teller issues. That does not seem to make a difference. Forget the risk involved. Well I just make a note and see what flys from there. I guess this has become a little rant session ... sorry!

C.A.R. - I posted this comment in the Operations Forum thread regarding cash-back on business checks:

Don't forget that in this day and age of heightened awareness of Anti-Money Laundering, the cashing of business checks will probably be viewed as a high risk activity.

A colleague told me after receiving a few subpoena's from the IRS for copies of checks CASHED (or where Cash-back was received) by a couple of businesses for a 2 year period, her bank put a STOP to the practice.

Think about this issue in light of USA PATRIOT, Anti-Money Laundering, BSA, etc., - does any bank want the obligation of researching that activity?

To further add emphasis, when you have a BSA exam, if the examiner finds out about this "check cashing" for busineses, I will predict that they will dig into this area, and that management will wish they had never entertained the idea.

You can go to www.bai.org or www.sheshunoff.com and browse around. I use Sheshunoff books for audit and compliance and have had no trouble with examiners for using them. Their book on Bank Internal Audit should be a valuable resource for you, has policies, programs, and audit procedures.

I hear that one a lot ! We are a relatively small bank that have, over the last couple of years, hired several folks from some of the BIG banks. They can't believe that the BIG banks could possilby be doing anything incorrectly.

Kevin,
I was reading over this old post and just wondered...did you get the job?

No. They want someone with a CPA, so I wasn't given an opportunity to interview. Oh well, such is life...I'm really not broken up about it.

I can tell you that from my own personal experience, a CPA certification does not make one a better internal auditor. There are enough significant distinctions between public accounting and internal auditing. CPA's are definitely much more effective at looking at financial controls. Where you want your internal auditor to focus is on operational controls. I'd much rather see them set a standard of having their internal auditor be a CIA (Certified Internal Auditor) or a CBA (Certified Bank Auditor). I would suppose they already have an external audit done that would address problems with the financial controls.

I'll second Jim's comment. Actually, there is no way to justify a CPA requirement, given that so many IA's are not a CPA. All one needs is expertise in bank accounting, gaining through courses, on-the-job, etc.

It's always a sad state of affairs when an unnecessary designation is added to a position that essentially disqualifies some real good people.

I agree, I doubt they are sticking to that requirement to try and stonewall me personally, I just don't think they know what an IA does...or better yet, what an IA should do.

I was hoping to get an interview at the very least, so I could hopefully express some ideas and concerns that would shift their perception. However, I’m starting to think they have an IA just to say, “Of course, we have one! Mr. Examiner” and I really don’t want to be that guy…

The interesting thing about this situation is that most CPA's would not even want to be an IA and the really smart CPA's are making a lot more than a bank, except big banks, pay an IA. So, you take that entire group out of the CPA pool of candidates and you end up with relatively few CPA's, and in most cases no CPA's, that are interested in the position. Logically, those CPA's that are interested may not have the required skill set.

But, you may be right, perhaps your bank just wants the CPA title next to the persons name to impress regulators.

In reply to:

---

But, you may be right, perhaps your bank just wants the CPA title next to the persons name to impress regulators.

---

The unfortunate thing is, is that it won't impress the regulators as much as they being able to sit down with a knowledgable and thoughtful internal auditor that is able to adequately articulate the risks that the bank is currently facing and the internal controls in place to mitigate those risks. CPA, CBA, XYZ, PDQ, is nice, but that's not what buys you a lick.

If they would seek input from your external audit firm regarding the position, I have found they generally support the fact that an individual with broad banking experience and more specifically one that is already familiar with the particular institutions mgmt style, controls already established, DP system, etc., are much more effective as I/A.

My previous employer already tried the direction of hiring a CPA, who was green, like Grist pointed out, and they were completely overwhelmed! They decided too much time would be spent holding their hand through several initial audits and finally realized the error of their ways.

I have a good working relationship with our external auditors and can get advice from them regarding financial accounting issues at any time. I have also helped them when they are faced with operational control issues related to financial accounting that go beyond the realm of CPA requirements. One issue in particual, they had a client that had found over $200M had been embezzled and concealed over a 3 year period from vault cash. I consulted with them on the best way to go back and find where it all began, actual cash vs. reported. They would readily admit that deferring to an individual with banking experience vs. a CPA designation is critical when it gets down to the "nitty gritty" of operational controls and issues.

I would stay tuned if I were you....

OK guys - let's not bash the CPA's too much...

I'm a CPA and an auditor. I started green and was overwhelmed, but I overcame. Been here a little over a year and made it through 2 regulatory audits. I put a program together from scratch - the bank had never had an auditor before. I think the reason they wanted a CPA was not because of the knowledge I had but because of the perserverance it took to make it through that test!

But I can say having the banking experience Kevin did would have given me a better knowledge base than what I learned from taking the CPA exam.

I don't know that there is any bashing going on per se, I think that the point of the discussion here is to look at the mistaken belief that an internal auditor has to be a CPA. No doubt, the perserverance and training that you have to go through is of use, but a good CPA doesn't necessarily make a good internal auditor. Internal auditors must understand the organization that they are auditing as a whole, and must be able to work within an organization on a day in, day out, basis.

I agree. It's just like saying I would be a good manager/supervisor because my degree is in Business Management. Been there, done that, not very good at it. I find I can manage myself very efficiently but if you add other personalities, I'm a failure. I make a much better Internal Auditor. You have to look beyond the qualifications and look at the person and their qualities. Isn't this what interviews are supposed to do?

Yes, but interviews are like dating. You always make an attempt to put your best foot forward and downplay your faults. It's not until you hire someone/get married that you find out what the person is really like (this comes from a single guy).

I am a CPA who started as an internal auditor just 5 months ago. I too have no predecessor - this is the first internal auditor they've had. I'm feeling extremely overwhelmed. I've worked in the accounting department of a bank previously (a different bank) for almost 3 years. This has helped me very little. I have no one else to brainstorm with, which is terrible for me because I work much better in a team environment. I'm also not getting any support from the Audit Committee - I've been rejected on purchasing audit manuals because the prices were too expensive. I've been told they only wanted a CPA - why I don't know. Like another person commented today, I feel like the only reason they hired me was to say to the examiners, "Yes, we have an internal auditor." I believe they're setting me up to fail. I really think I could like internal auditing if I was part of a department, and if I was making twice what I am now!

How large is your institution?

I feel bad for you. I am the only internal auditor at my bank, and have had to set up a department this year. There is no way I could have done it without input from BOL, schools, manuals, etc. I will mention, too, that CPAs have been helpful to me as well. External auditors see a lot of stuff, and they can bring you ideas from other places they have been. I hope that your Audit Committee wakes up and smells the proverbial coffee.

I'm with you on this one, it's when the rubber meets the road, e.g. when regulators sit down to talk to you during the visit, that everything happens or doesn't happen. The qualified person in IA may not have even gone to college. Interest and dedication, along with ongoing educational opportunities is all that is needed.

My institution is only $165 million in assets with approx. 50 employees. So, I'm glad I've started at a much smaller scale, but that still doesn't change the fact that I need guidance.