Anyone care to give me some career advice?

Recently our Internal Auditor position opened up, and I'd like to take a crack at applying, to me its window of opportunity for challenge and advancement. I think an IA is similar to what I do know as a Compliance Officer. However, I don't know much about what IA really do. The only thing I know our former IA did was go to meetings...

Anyone able to steer me in the direction of what IA's do? Or maybe some reference and resource material I can get to study up and familiarize myself with the job?

-Kevin Sherrell

How about a great big IT DEPENDS! The duties of a compliance officer, as you can tell from various other threads, vary greatly from bank to bank. It depends on the size of the institution, the complexity of their operations, the particular talents of the people in those positions, and in some cases the whims of that bank's regulator.

Generally - internal auditors are responsible for reviewing the operations and controls in the bank, including financial and accounting controls, physical security, IT, etc., etc. and identifying control weaknesses. They then report those findings to an audit committee, and track to see the resolution of each finding. They can suggest possible fixes, but they can't really put those fixes into place - that's the job of the line managers (one of the frustrating parts of auditing, IMO).

Compliance Officers, on the other hand, generally manage the compliance environment of the bank. They research, write policies, train, assist in product developement, and sometimes conduct audits of compliance functions. Most of the time, the duties of the two are intermingled to some degree.

I began my career as a staff auditor for a holding company audit department. Our banks were small for the most part, and operated pretty much autonomously - so I learned every basic facet of banking - an invaluable experience! IMO, both career paths have merits - there's demand for both types of professionals. You just have to evaluate what you like to do, and what your strengths and goals are!

Here's an Assistant Internal Auditor position description that may provide insight:

Position Summary

This position is responsible for working with the Internal Auditor to provide an independent assessment of holding company and affiliate banks 1) internal controls and safeguards, 2) accounting systems, 3) regulatory and legal compliance, 4) adherence to Board approved policies, and 5) compliance issues.

The employee will be expected to work independently of management and exercise professional skepticism. The employee will be expected to display a positive attitude and flexibility in accepting varied work assignments. The employee has access to extremely sensitive information and confidential data and is expected to exercise professionalism and confidentiality in all relevant matters.

The employee is responsible for annually conducting and reviewing risk profiles for each department and will provide annual training to bank personnel.

Work is performed within the framework of standard audit program guidelines; however, independent judgment and discretion is required in performing assigned tasks.

Description of Duties Performed

The employee is responsible for assisting the Internal Auditor in developing and adhering to an internal audit program for the holding company and its affiliates. The program will be approved by the audit committee and will be subject to periodic review by the committee. (The program will address all significant organizational activities over an appropriate time cycle. Significant activities include, but are not limited to: loan quality and administration review, trust review, investment security review, data processing review, consumer compliance review, mortgage servicing review, fair lending review, community reinvestment review, certificate of deposit review, fixed asset review, proof review, demand deposit review, savings review, funds management review, safe deposit review, official check review, other asset/other liability review, due from bank review, collections review, credit card processing review, credit card lending review, payroll review, ACH (automated clearing house) review, travelers check review, wire transfer review, savings bond review, external security review, capital review, floorplan review, negotiable collateral review, other income/other expense review, and abandoned property review.)

The employee will assist in internal audits of all books, records, properties, securities, and accounting procedures relating to banking and fiduciary activities at any time deemed appropriate.

The employee will assist in making recommendations to bank management from time to time regarding 1) internal controls and safeguards, 2) the bank's accounting system, 3) regulatory compliance and 4) adherence to policies and procedures.

The employee will be evaluated by and receive feedback from the Internal Auditor and Audit Committee regarding audit effectiveness and efficiency.

The employee will remain apprised of management objectives and audits will be conducted, insofar as possible, consistent with management objectives.

The employee will be available to holding company and affiliate staff for advice and opinions concerning bank control procedures and compliance issues.

The employee will provide assistance to external auditors in preparing schedules, conducting testwork, and gathering requested documents.

The employee will work with management and regulatory examiners to facilitate the examination process by providing audit reports and work papers and responding to examiners' questions, comments, and/or recommendations.

The employee will collect and evaluate risk profiles from each bank department and provide assistance to areas lacking adequate security procedures.

The employee will operate office and bank equipment (e.g., CRT terminal and printer, personal computer, calculator, typewriter, telephone, fax machine, copier, etc.)

The employee performs job related, day and overnight travel to facilitate the audit function.

The employee attends meetings, training seminars, conferences, etc.

The employee may be subpoenaed to testify in court.

The employee will perform training and monitor the bank’s performance regarding compliance issues and/or regulations. The employee will issue reports on compliance activities as needed.

The employee will perform other work-related duties, as assigned.

Knowledge's, Skills, and Abilities Required

Knowledge of bank regulations and compliance requirements.

Knowledge of accounting practices and principles.

Knowledge of auditing procedures.

Knowledge of bank operating policies and procedures.

Knowledge of the role of a holding company in bank operations and the rules and regulations that apply to same.

Knowledge of or ability to learn about compliance issues.

Skill in finding and documenting deficiencies in department operations via the internal audit program as detailed in the description of duties.

Ability to work closely with the Internal Auditor and Audit Committee and bank management personnel in the application and execution of the bank's mission and strategic plan.
Ability to work independently and be self-motivated.
Ability to deal with adverse and stressful working conditions in a professional manner.
Ability to have access to and deal with highly confidential information in a discretionary manner.
Ability to prepare and distribute complex forms, audit reports, correspondence, and memoranda.
Ability to communicate effectively.
Ability to write clear and concise documents.
Ability to conduct internal audits by reviewing all requisite documentation and interviewing appropriate bank personnel.
Ability to review findings of fact and make recommendations to Internal Auditor.
Ability to serve as an expert in the areas of accounting and auditing principles and procedures.
Ability to prioritize and organize internal audit function to maximize performance and cost effectiveness.
Ability to work closely with and serve as a liaison for external auditors and examiners.
Ability to think logically and resolve problems.
Ability to process detailed information regarding management objectives.
Ability to perform day and overnight job-related travel.
Ability to attend meetings, training seminars, conferences, etc.
Ability to make decisions and exercise discretionary authority necessary to successfully perform job duties.
Ability to operate office and bank equipment detailed in the description of duties.
Ability to testify in court.

Good grief yours does not even cover Compliance Manager so for us that do both, we definitely do not get paid enough!!!! We definitely never have enough of time to get it all done!!

By the way, Good Luck with your decision. I think it depends on if you just like compliance or would you like to deal with the operations of the bank, internal controls, risk management, general ledger functions, etc. They each are a challenge and provide opportunity for growth of knowledge, but whatever we do in our careers, we are always learning.

Opinions are mine and definitely not my employer!!

If I were the poster of this question, I'd stick with Compliance if that is an option. Internal Auditing isn't even a "skill" that is useful if you want to go into regulatory work as the regulators don't do virtually any internal auditing like they did in years past. Compliance Auditing, in my opinion is way more interesting and an open door to more opportunities down the road. Also, I think that Compliance Auditors have (and need) a bigger brain, generally, than Internal Auditors.

Grist, I guess it depends on the regulatory agency. Michigan recently did some early buyouts, and as a result a number of state compliance personnel left. The postings to fill their positions almost exclusively requested audit / CPA based qualifications.

So to the original poster, the question is "where do you want to go?" If a stint in the audit dept. would be a benefit, go get 'em. Personally, I don't think it could hurt - this from a guy with poor accounting skills...

Thanks for the advice.

In my company the Compliance Officer is subordinante to the Internal Auditor who is also the manager of my department, so becoming the IA would be an "promotion". I am also thinking long term in which I'd someday head in the CFO direction. And I think and IA could offer some good experience.

However, I enjoy compliance much more than I believe I would IA. So, I have decieded to stick with Complaince and hopefully expand the position and the department to a higher level.

Each path is different, but internal auditing is such a bore and you don't end up very popular - but, as you stated, any experience helps, but don't stay to long.

Well, I've been a CFO for years and Compliance is way more important than internal auditing. A CFO always has operating people that actually have the knowledge to complete tasks in a way that gives full consideration to documentation, policy, procedure - so internal auditors simply check on those people.

Technology, accounting, and writing skills are the most important skills to develop on a path to CFO.

If you have an opportunity, serve some time as an assistant to a Controller or CFO - start with accounts payable, etc. if necessary.

Gosh, Internal Auditors have a bad reputation all over!

Actually, I feel there is a whole different realm of auditing outside of compliance. It has been a terrific learning experience for me. It's okay not to be everyone favorite person. You don't get paid to be liked!

All of this makes me want to question why I just excepted the IA, Compliance job today. I thought it was an important area of the bank....
(don't count off for spelling)

I agree with you, but internal auditing is, at best, a good place to be from! You not only don't get paid to be liked, you don't get paid much at all. People that actually do the work get paid (well) with people that audit the work paid not so well. Compliance work requires a lot more brain power.

Just take a look at what has happened over the years in the regulatory arena. Internal audit tasks were eliminated years ago, compliance auditing appears to be a step down from Safety and Soundness auditing. The highest risk area is Safety and Soundness, so it follows that if you are an auditor, compliance/safety/soundness are the issues you should be looking to audit.

IF, I am understanding the new job, I will do IA, Compliance and SS... Along with of course my other duties (hhmm memo to self... talk about pay raise)

I think that your narrow opinion concerning internal auditors is an overblown simplification of the real world. I've worked in both capacities and I can tell you the job is what you make it in the organization that you work. I have had the opportunity to guide major policy decisions in banks through the internal auditor role simply due to the fact that I was well respected and able to present rational risk based opinions to management. Oh yeah, you have auditors that do nothing but check the checkers, but the role can and should be an integral part of developing a properly functioning organization. I could say the same things that you have mentioned about internal auditors and relate that to a half a dozen compliance officers that I have known. Meek, weak individuals that had absolutely no influence on management and only had the position so that management could point at them and say "yes, we have a compliance officer". Positions and jobs are what you make of them.

P.S. I have also been paid rather handily as the DIrector of Internal Audit - more than being the Veep in charge of compliance - you may want to consult some salary surveys.

IA and Complaince are a lot of work in themselves...start thinking of getting some assistants. You gonna need em

I could use all the help anyone is willing to give. I have to find training by this year end and an IA/Compliance audit sched. I feel a little nervous, I have BSA, OFAC etc training, But loan and other new stuff makes my head swim..

You sound like an extreme exception to the general rule.

It would be better to compare the pay of those who do the work, versus those who audit the work. Compliance/Audit salaries go all over the map and the fact that you are skillful enough to receive generous compensation does not result in generally sufficient pay for anyone in your field.

The bottomline is that your experience does not represent the norm.

The pay raise should have been built into the assignment of new tasks, or within a reasonable time thereafter.

By the way, take that "I am new so don't rely on my thoughts" off your signature, as this is an equal playing field and your thoughts are evaluated by each poster and valued by each poster as grist for the mill, not right or wrong.

Being an internal auditor certainly does not make you popular with the rest of the staff. However an auditor is supposed to work independently and most of the time the questions you ask, the recommendations you make and the audit findings will definately not open a path to being the best liked person in the bank. Boring, definately not. We look at things that no else does and know things no one else does. Confidentiality is important and knowing who and what to target is a skill. Knowing where to look and what to look for is a skill. Auditors must have know regulations, legal requirements, have accounting skills and more. A good auditor works closely with security officers and compliance officers. Yes I would say compliance officers are more skilled in regulatory compliance, that's their job, however, some us have to also audit regulatory compliance, so we have to be quite knowledgeable about it or else how can we do a thorough enough job of reviewing the bank's overall internal controls. There, I'v said it and I feel better. Don't knock the poor internal auditor, they keep the bank out of trouble and are a direct link to the Board of Directors. Sometimes we have to tell the Board things that will not make us popular with management. But, as our President once told the Board, "we may not like what she has to report, but it certainly helps us see things that we wouldn't have seen otherwise. It has certainly been a learning experience for me and frankly I'm glad she's here. If all she had to say was good, she wouldn't be doing her job." Can't beat that kind of support from Sr. Management and the Board. I was in compliance before becoming an auditor and the experience certainly has helped me. I was in operations before too. I had accounting skills and now I have auditing skills. Do I like my job? Not always, but I do believe that an internal auditor is very important to the organization. If you don't believe me, ask your Safety and Soundness examiner next time you see him. I say go for it and good luck. gg

The first thing to do is try not to get too overwhelmed. If you can't find the type of training before year end, there is a lot you can do yourself to prepare. When I became the Compliance Officer, I had only been an asst auditor for 9 mos and the Acctg Mgr for 9 mos. I knew I was not qualified for the job, but management felt that I had the potential. I am now the Compliance Officer and Internal Auditor so reading these posts is funny to me to see how one views the other. Since I was feeling inadequate and overwhelmed and I too had a time lag before they sent me to Compliance School, I printed off every reg and began to read. You have to first have the basic knowledge of what the regs say, then when you go to school you won't feel so intimidated by the lingo and feel like you know nothing. There is a ton of websites, including this one, where you can simply read and read and read on all subjects. Pick one and read the reg and then research it from a couple of different angles so you can understand the legalities of the reg. A lot of these regs do require interpretations and you will need some assistance. Anyway, this is just what I did to prepare myself until school, if you have questions, these threads are a great place to voice them, we have all been the "new guy" before so there is some compasion here where you might not find elsewhere. Good luck and I hope you enjoy your job, it is never a dull place to be!

Thanks for sharing your opinion. I share it as well. I enjoy being the auditor and feel that my position benefits the bank. I believe Internal Audit is an important function.

I feel every position is an important one, I just know this position is rapidly making me nervous. I guess I will take it one day at a time. Does anyone have a schedule of audit/compliance they would be willing to share?

I say go for it and good luck.

I hope that you are not talking to me. I have a personality, therefore, I'm not an internal auditor - never wanted to be - never will be, as I'd rather do the work that needs to be done. Don't get me wrong, internal auditors have a place of value within any organization, but the value is risk weighted, in my opinion, at a lower level then noted by you. With that said, a job well done by a "contributing" internal audit is a different ball game.

I'm glad the CFO at my first bank didn't have your opinion! I'd probably be in a completely different career now (I'm not an auditor any longer - I'm a Compliance Manager).

Attitudes toward Internal Audit (and Compliance, Loan Review, Loan Operations, any other support function) have a great deal to do with the personalities of the people in those functions - and management's attitude toward them. I think I'll email my CEO and tell him thanks, again, for having such a healthy attitude about the role Compliance, Audit, Loan Review, etc.

And, perhaps you would be better off in a different career. All I'm saying is that when you are starting out, look around at the players in the banking environment, personalities, skills, tasks, etc. Look up pay ranges covering seasoned people, look for real bottomline value based on contribution. There are stars in every setting, but when you make your bet, don't go with the game that has a house advantage, go with your level of drive to make things happen, not simply checking on what's happening.

As far as you are concerned, you sound happy with your work and that is a worthy goal to achieve that is not achieved by many people.

In reply to:

---

I have a personality, therefore, I'm not an internal auditor

---

You must really have a low opinion of internal auditors.

I've had some bad experiences relating to internal auditors that, at that time and years ago, were acting like traffic cops out to get a quota for the day. But in the final analysis, 50% of the group are more than likely hard working and helpful people, but given the original question, in my opinion, it's a field to avoid or, at best, only spend a short amount of time and move on.

As internal auditor and compliance manager, it depends on how I am treated. If I am treated fairly, as part of the team, and people are truly working to improve things, I am very much a part of their team and will offer my assistance. But on the other hand, if someone does not cooperate or is not trying, I will identify it and they can fix it themself.

I have said it before that I was previously a lender, branch manager, branch administrator, staff accountant, teller, etc so I know operations fairly well. I believe I am management's friend not their enemy. It is up to them how they choose to receive me. I understand what the people deal with everyday since I have been there.

Anyway what I am trying to say is have an open mind. Allow auditors to be part of the team. Yes we must be independent but we can add more value to the table if you let us. We are human too. and believe it or not I love people and I am a huggy person, currently I just happen to be an auditor too.

Opinions are mine not my employer

Well, mostly due to the responses here, I have submitted my application.

CAR, all the best to you in your new endeavor. In my opinion, internal auditing is more important now than ever before. Gone are the "bean counting" days of our predecessors. Internal Auditors are involved more and more in managing risk, helping achieve the goals of the organization. Auditors work to ensure that the CFO and CEO get to continue to sit in their big offices and make the decisions. Of course both Internal Auditors and Compliance types make less. That's really a no brainer. They're a cost center. Add that to the fact that banking has traditionally paid those who produce. That's the mortgage, consumer, and commercial lenders. IA and Compliance is not the most popular position in the bank. That's because we represent accountability, and the folks who swing the big sticks. As a general rule, people don't like that. If you want to be popular, go get a job as a movie star. If you want to learn the inner workings of an organization, become it's internal auditor. Study your craft well, and you'll find that it can be a step up to something bigger. You'll find that IA's and Compliance people are willing to help each other out, even from competing organizations. I enjoy the opportunities my job affords me. As an auditor, you have the opportunity to be a consultant. IMHO, a good auditor only needs to use the "big, bad wolf" tactic when he isn't getting the assistance he needs from staff. Creating an adversarial relationship only reduces your effectiveness. Well, that's all I have to say, I'm done preaching. Have a great weekend!

You sound like an auditor that I would not mind working with and perhaps my experience is not reflective of the current situation. Please see post above (from the original poster) - application is being submitted!

First, Good Luck to the original poster! If God sees it in His plans for your life, no doubt the job will be offered to you. I truly believe no matter what we do in life, we must let Him guide our decisions, then we should do our very best to make Him proud of us. And no doubt you will! This is just my personal opinion.

And Grist, thanks for your compliment, I am glad that we all help each other on Bankersonline to see things differently. Not only do we help each other with our daily "work" concerns, but so many times I have received the motivational support I need from the people that donate their time to BOL. Personally, I believe everyone throughout the organization should be recognized for the job they contribute to the organization. It takes all of us to make it work! Including the cleaning people. And since I attempt to do both audit and compliance, I see both of them as challenging experiences and they both take much brain power if I am trying to do a "good" job. But so did being a teller when I was one years ago. I try to have respect for every position.

Opinions are mine not my employer.

I was just browsing the posts on this thread and decided to chime in. First of all as stated previously both I/A and Compliance are a mind set. I have 19 yrs experience in all areas of banking and am currently in the I/A position and provide assistance in the Compliance area. Prior to moving into the audit position I was the network administrator for a period of 2 years. When I was asked to accept the I/A position I was told by another "tech" person that I would not like it because I wanted people to like me too much. However, I was ready to get away from computers and back to banking! I obviously took the position and I can honestly say that I had more people mad at me when I was in tech! Internal auditing can be very interesting. It has been the only position that has truly allowed me to apply the knowledge that I have gained in all of my years of banking, including compliance and tech. Although I do agree that there are some people placed in the audit position just to say "yes we have an auditor", if managment is committed to the true intent of the position, the individual has to know at least as much if not more than departmental mgrs to be able to evaluate the effectiveness and efficiency of controls and procedures they have implemented and to recognize unusual or suspicious activity . The key is acheiving and maintaining mutual respect with all employees. Do not come off as a "know it all", provide value-added recommendations and always keep an open mind. I believe in the teach (and learn) as you audit approach, explain and understand your position..do not dictate things that you yourself do not understand. And always try to listen and learn from others.

As for audit vs. compliance, both have challenging qualities, but I have found it is much easier to research compliance laws and regulations that I am less familiar with and obtain definitive answers. On the other hand, audit resolutions are very subjective and depend on the complexity, size and resources (people and monetary) of the organization. Most of the time there are no "stock" answers, therefore an auditor must be able to evaluate all of the above and use brain power to provide tailored recommendations that are both cost effective and efficient. Networking such as this does assist greatly with this challenge. Last, I do not believe that audit/compliance either one are cost centers. Although we do not provide tangible dollars to the bottom line, if we take our position seriously, we help mgmt avoid material losses and cmp's that might not have been avoided otherwise It is just too bad you can't prove a negative! Good luck and take pride in whatever comes your way!

Sorry to hear you've had bad experiences with IA's. I hate to see such low opinions about IA's. Frankly my popularity was worse when I was a Compliance Officer. AND, yes, believe it or not, I do have a personality, however, since my job is to work independently, I don't get too friendly with bank staff. I wish I could, but I can't. I am neither the old bean-counter type nor some big time "traffic cop" looking for my "daily quota" (whatever that means)nor do I get my kicks by looking to nail anyone. I feel that my job is to help keep the bank safe and sound. I look for the best in staff and, yes, sometimes for the worst, I note the weaknesses, I comment and make recommendations. I beleive that my experience is helpful to Sr. Management, so when possible I also help train staff, particularly the line managers. I have people from the CEO to the Teller ask for my help and glady give it when I can. I have helped train supervisors, organize departments and assisted management in developing written internal controls. My job is not just to sit on a-- and look for screw ups, I feel that I am a vital part to our organization, and if my knowledge and experience can be utilized to ensure that the assets of the bank are protected, I hope I can share in anyway that I can without getting too deeply involved in the Management of the bank. Perhaps if people took the recommendations less personal and more as a means for ensuring that a problem does not hurt the bank in anyway it would be less painful, that is unless the findings are/were serious enough to open some eyes. The Auditors may be considered by some CFO-types as non-income producing, however if we do our jobs well, we do help save banks big bucks in fines, fraud, legal fees, and more. Our recommendations, and being internal, many many times help the bank save at the bottom line. So although we don't get out and sell and get the big pats on the back including the big dollars (like the CFO-types), we do help. AND even though not noted by some people, we DO especially help the bottom line. As far as salary is concerned, I guess that depends on a lot of things. The better you are, the better the income. Mine is OK, however, as with any job, YES, I WANT MORE.

First, use paragraphs next time. Second, while my experience has not been good, I've occasionally had a good experience as well. The bottomline is the auditing approach.

Sorry that my writing here is not structuarly correct to suit you...just simply trying to save space. You know us audit-types,we never stop. AND you are absolutely right, in end the approach IS important (by all involved). All in all, my best to the original poster. Whatever career path you choose, keep in mind that it's what you make of it that counts.

Grist what I don't understand in your comment is your statement that compliance vs. i/a is more important. In your position, other than losses from a cmp, how does compliance even reconcile with the CFO position? I know compliance officers that know almost nothing about bank accounting issues, FASB, or SFAS (and don't really need to) Wouldn't your dependence be greater on that of a knowledgeable auditor and less on the compliance officer

Was your bad experience with an auditor that had the ID 10T syndrome or were you just difficult to deal with so they got an attitude?

Let us know if you get the job!

Grist, the tone of your posts here is coming off as very condescending to Internal Auditors. I don't know if that is your intention or not, but that's the way they read to me. You've offered a very one-sided perspective on the career field of internal audit.

As someone who has spent many years in both internal audit and compliance, I feel qualified to speak to this issue. I feel both areas have the potential to be very rewarding endeavors. And I've found that my compensation has been pretty consistent in both areas and very satisfactory to me.

To the original poster: While there are a lot of similarities between the professions, there are some differences too. Each can be rewarding in its own way and both I find to be very intellectually stimulating and challenging. Both areas provide you with opportunities to address new issues every day. Both areas allow you to contact broad areas of your institution and explore the work that is done in those areas, giving you a breadth of experience unmatched in almost any other specialization. However, I've found that both areas are somewhat stigmatized when it comes to a perception that you might be over-specialized. I've not had a hard time at finding opportunity for career advancement within the profession, but have found it difficult to break out of the profession into a higher level of management within the bank.

I started out in internal audit, then moved to a much smaller shop where I was both the internal audit director and the compliance officer. Did that at two different locations, then finally came to the point where I had to choose between the two for an opportunity presenting itself to me - the bank was recruiting me for either position but both were separate positions. I chose compliance, not because I liked it any better or worse, but rather because I saw the field as less crowded with talented professionals and felt that would give me more security and longevity options. Ultimately, though, it came full circle, and I wound up supervising both the Audit function and Compliance function at that institution after a few years. Then we were acquired and I assumed my current responsibilities for just compliance again. After 16 years I'm a Senior Vice President in a $7 billion bank with responsibilities for a compliance function that covers three separate states, so all in all my career path has not been that shabby even blackened the way it was with the level of internal audit time I spent.

If you decide to go the internal audit route, I would encourage you to contact your local chapter of the Institute of Internal Auditors . They can offer some great training courses and resource material. Also, I would suggest you contact the external auditing firm for your bank and ask them for some suggestions. They'll also be able to provide you with some good resources. I wish you success whichever direction you choose to follow.

First, regulatory concerns (safety, soundness, compliance) also have the highest level of concern at the CEO and board level. What is most important to the CEO and board gets my attention, big time. Therefore, although compliance issues do not normally produce losses, the possibility of potential fines, etc. along with putting the CEO and board members through an exit interview with regulatory examiners that is critical of the CEO and board is to be avoided at all costs.

Secondly, internal auditing in a new bank setting (my current setting) is non-existent, in that I either personally complete tasks or seasoned bankers have been employed to perform tasks, so although documentation is always being developed, the staff goes with experience and logic until: (1) volume needs to be supported by documentation and: (2) auditing of compliance with documentation. An outside CPA firm does some internal auditing, but only as it relates to financial issues. With that said, although no pure auditing tasks are being completed, certificates, review of large items, kite suspects, and a host of important tasks are completed each day by operating personnel – it’s just that there is no one, except for me occasionally, taking a second look.

So yes, compliance is more important, to me, than internal auditing in this setting.

As for your last point, I welcome auditors and examiners at all levels. It can be a learning experience, but some internal auditors have an agenda that is not aligned with logic and the goals of the institution.

I have a position, I stated that position, now you've posted your position - is life not wonderful!

I'll try to be more humble next time, but that is a real hard thing to do.

Good luck on your new job... I plan to truck ahead also. All others be prepared for a lot of questions

Thank you J! Grist, cutting you some slack since you're in a de novo setting..try not to stereotype next time. I have seen compliance officers who also do not keep in mind the logic and direction of the bank when making recommendations to ensure compliance. It is not the position, it is the individual in the position. Some people see black and white and some see several colors. I have found to be a successful auditor there are times when both are beneficial. Good Luck with your new institution, and as it grows I am sure you will find internal control/risk mgmt to be of as much concern to regulators and your board as compliance!

Don't cut me slack, idioms are not required in this setting.

In one of the banks I worked for, I came on board in response to a Cease and Desist Order the bank had been put under by the OTS - not for regulatory violations but because of a lack of internal control and an ineffective internal audit function. I can guarantee you that internal controls and internal audit had the attention and focus of that bank's CEO and Board, big time. So just because you have not personally experienced it doesn't mean it isn't so. My message to Kevin is that there are many financial institutions where internal audit is looked at as a very valuable piece of the bank management equation. It keeps them from becoming the next Enron or WorldCom.

What I've done is play the role of devils’ advocate on this thread to see if a thorough response could be gathered from posters. It worked!

Well, you had me going. I did think it seemed out of character for what I know of your posts on other topics for you to be so far on the extreme edge on this issue. But I guess I just didn't pick up on the fact that you were yanking our collective chain a little bit. Thanks then for leading a very thorough discussion of the benefits of internal audit.

Phew, you certainly yanked my chain. I am still steaming. However it was a good discussion and I hope the original poster benefited from it.

Thanks for opening the discussion, it worked. (paragraph?!?!?)

How about a shift in direction for this thread.

I have submitted my packet for the IA position, and I like to come up with strategic directions for the IA department. (with me at its head of course ). I'm sure you all would have some excellent ideas and experiences that I can draw from.

I'd like to make the IA department more of a benefit for the company, beyond just "policing". Is it common or even realistic to become the "go to guys" for Managments/BoD questions on where inefficiency and shortfall occur?, or is IA strictly oversight?

-Kevin

In my opinion one of the main objectives of I/A is evaluation of policy and procedure to identify "inefficiencies and shortfalls" and assist in preventing circumstances from occuring, reporting to mgmt when weakness, etc are found and providing recommendations to correct/improve. I/A should be proactive vs. reactive to be most effective and beneficial to the organization .

So many times mgmt wants to depend on audit to find/identify "problems" after they have occurred and then wants to evaluate what went wrong..Instead, audit should evaluate the current control environment and perform tests and reviews to make sure policy/procedures are the most effective to achieve it's objective and, of equal importance, that efficiency is maintained.
Simplified example, file maintenace review should not be performed by I/A..I/A should look at how file maintenance is monitored and determine, through periodic random testing, whether that procedure is effective and performed in the most efficient way. Sometimes, only by chance, would audit identify "suspicious activity" by recognition of certain red flags. In other words, your primary goal should not be for you to find fraud, embezzlement, etc., but, to evaluate procedures/controls to determine if they are effective in first preventing an occurence and second identifying an occurence in a timely manner.

In my experience, you quickly become the "go to" guy for many reasons. First, by performing the audit function you will learn so much about the day to day operations of the bank that after a while people will begin to respect and rely upon your opinions. Second, which I think was said in an earlier post, in order to audit regulations (state or federal) you have to know your subject matter, therein lies your wisdom you will gain in regulatory compliance matters. I too wanted to make more of my department than JUST audit. I have begun a good, solid training program and I began writing a employee newsletter about once a quarter. As you get in the job, you will have the chance to evaluate the way that the position was previously handled and be able to form it to suit your management style.

But I too am the Compliance Officer so I still have PLENTY more to do!

IA is NOT stictly oversight. I have found it to be an excellent learning experience and each day learn more and more about the entire operations of the bank. I get involved in making constructive critcism and recommendations that will prevent problems later on. In other words, recommendations that may or should minimize risk, improve productivity, save the bank money, and develop good internal controls. You will first want to get the resources you need to organize your department well...from information resources to staffing. Put together a good plan and a sensible budget. If you are allowed staff assistance, you will want staff that understands the complexity of the position and has good banking experience along with accounting and regulatory skills. I learned a long time ago and this is what I always tell the line managers when I train - "A good leader surrounds himself/herself with qualified competent staff, provides ongoing training, and offers the tools and support necessary to do the job well. In the end, a job well done and a good support staff will certainly make you look good".

You must have a understanding with management and the board that in order for the audit program to have any value, you must work with some degree of independence and although you will be reporting your findings and recommendations to management, the most important report will be your reporting to the audit committee.

So your program will not be to simply to "police" but to ensure that the bank's internal policies and procedures are adequate enough to fit the bank's current environment and current with regulatory requirements. Above all, to see that these standards are being followed, specifically, that staff (including Sr. Management) have a clear understanding that not following these standards could serously impact the bank, i.e. jeopordize safety and soundness of the bank.

My first try at the audit/compliance person just landed me with egg on my face, even though I researched long and hard. I was shot down to the ground. I still think I am correct, I am learning the hard way someone will always want to find the loop holes.

What was your issue CAR? I find it helpful when people try and "But..." me, is to rattle of penalities for non-complaince. Also, don't ever buy the "So and So does it...so it much be legal" agruement. I get that all the time, despite the fact its such a childish arguement.

The issue was the cashing of business checks. I have knowledge of these type of teller issues. That does not seem to make a difference. Forget the risk involved. Well I just make a note and see what flys from there. I guess this has become a little rant session ... sorry!

C.A.R. - I posted this comment in the Operations Forum thread regarding cash-back on business checks:

Don't forget that in this day and age of heightened awareness of Anti-Money Laundering, the cashing of business checks will probably be viewed as a high risk activity.

A colleague told me after receiving a few subpoena's from the IRS for copies of checks CASHED (or where Cash-back was received) by a couple of businesses for a 2 year period, her bank put a STOP to the practice.

Think about this issue in light of USA PATRIOT, Anti-Money Laundering, BSA, etc., - does any bank want the obligation of researching that activity?

To further add emphasis, when you have a BSA exam, if the examiner finds out about this "check cashing" for busineses, I will predict that they will dig into this area, and that management will wish they had never entertained the idea.

You can go to www.bai.org or www.sheshunoff.com and browse around. I use Sheshunoff books for audit and compliance and have had no trouble with examiners for using them. Their book on Bank Internal Audit should be a valuable resource for you, has policies, programs, and audit procedures.

I hear that one a lot ! We are a relatively small bank that have, over the last couple of years, hired several folks from some of the BIG banks. They can't believe that the BIG banks could possilby be doing anything incorrectly.

Kevin,
I was reading over this old post and just wondered...did you get the job?

No. They want someone with a CPA, so I wasn't given an opportunity to interview. Oh well, such is life...I'm really not broken up about it.

I can tell you that from my own personal experience, a CPA certification does not make one a better internal auditor. There are enough significant distinctions between public accounting and internal auditing. CPA's are definitely much more effective at looking at financial controls. Where you want your internal auditor to focus is on operational controls. I'd much rather see them set a standard of having their internal auditor be a CIA (Certified Internal Auditor) or a CBA (Certified Bank Auditor). I would suppose they already have an external audit done that would address problems with the financial controls.

I'll second Jim's comment. Actually, there is no way to justify a CPA requirement, given that so many IA's are not a CPA. All one needs is expertise in bank accounting, gaining through courses, on-the-job, etc.

It's always a sad state of affairs when an unnecessary designation is added to a position that essentially disqualifies some real good people.

I agree, I doubt they are sticking to that requirement to try and stonewall me personally, I just don't think they know what an IA does...or better yet, what an IA should do.

I was hoping to get an interview at the very least, so I could hopefully express some ideas and concerns that would shift their perception. However, I’m starting to think they have an IA just to say, “Of course, we have one! Mr. Examiner” and I really don’t want to be that guy…

The interesting thing about this situation is that most CPA's would not even want to be an IA and the really smart CPA's are making a lot more than a bank, except big banks, pay an IA. So, you take that entire group out of the CPA pool of candidates and you end up with relatively few CPA's, and in most cases no CPA's, that are interested in the position. Logically, those CPA's that are interested may not have the required skill set.

But, you may be right, perhaps your bank just wants the CPA title next to the persons name to impress regulators.

In reply to:

---

But, you may be right, perhaps your bank just wants the CPA title next to the persons name to impress regulators.

---

The unfortunate thing is, is that it won't impress the regulators as much as they being able to sit down with a knowledgable and thoughtful internal auditor that is able to adequately articulate the risks that the bank is currently facing and the internal controls in place to mitigate those risks. CPA, CBA, XYZ, PDQ, is nice, but that's not what buys you a lick.

If they would seek input from your external audit firm regarding the position, I have found they generally support the fact that an individual with broad banking experience and more specifically one that is already familiar with the particular institutions mgmt style, controls already established, DP system, etc., are much more effective as I/A.

My previous employer already tried the direction of hiring a CPA, who was green, like Grist pointed out, and they were completely overwhelmed! They decided too much time would be spent holding their hand through several initial audits and finally realized the error of their ways.

I have a good working relationship with our external auditors and can get advice from them regarding financial accounting issues at any time. I have also helped them when they are faced with operational control issues related to financial accounting that go beyond the realm of CPA requirements. One issue in particual, they had a client that had found over $200M had been embezzled and concealed over a 3 year period from vault cash. I consulted with them on the best way to go back and find where it all began, actual cash vs. reported. They would readily admit that deferring to an individual with banking experience vs. a CPA designation is critical when it gets down to the "nitty gritty" of operational controls and issues.

I would stay tuned if I were you....

OK guys - let's not bash the CPA's too much...

I'm a CPA and an auditor. I started green and was overwhelmed, but I overcame. Been here a little over a year and made it through 2 regulatory audits. I put a program together from scratch - the bank had never had an auditor before. I think the reason they wanted a CPA was not because of the knowledge I had but because of the perserverance it took to make it through that test!

But I can say having the banking experience Kevin did would have given me a better knowledge base than what I learned from taking the CPA exam.

I don't know that there is any bashing going on per se, I think that the point of the discussion here is to look at the mistaken belief that an internal auditor has to be a CPA. No doubt, the perserverance and training that you have to go through is of use, but a good CPA doesn't necessarily make a good internal auditor. Internal auditors must understand the organization that they are auditing as a whole, and must be able to work within an organization on a day in, day out, basis.

I agree. It's just like saying I would be a good manager/supervisor because my degree is in Business Management. Been there, done that, not very good at it. I find I can manage myself very efficiently but if you add other personalities, I'm a failure. I make a much better Internal Auditor. You have to look beyond the qualifications and look at the person and their qualities. Isn't this what interviews are supposed to do?

Yes, but interviews are like dating. You always make an attempt to put your best foot forward and downplay your faults. It's not until you hire someone/get married that you find out what the person is really like (this comes from a single guy).

I am a CPA who started as an internal auditor just 5 months ago. I too have no predecessor - this is the first internal auditor they've had. I'm feeling extremely overwhelmed. I've worked in the accounting department of a bank previously (a different bank) for almost 3 years. This has helped me very little. I have no one else to brainstorm with, which is terrible for me because I work much better in a team environment. I'm also not getting any support from the Audit Committee - I've been rejected on purchasing audit manuals because the prices were too expensive. I've been told they only wanted a CPA - why I don't know. Like another person commented today, I feel like the only reason they hired me was to say to the examiners, "Yes, we have an internal auditor." I believe they're setting me up to fail. I really think I could like internal auditing if I was part of a department, and if I was making twice what I am now!

How large is your institution?

I feel bad for you. I am the only internal auditor at my bank, and have had to set up a department this year. There is no way I could have done it without input from BOL, schools, manuals, etc. I will mention, too, that CPAs have been helpful to me as well. External auditors see a lot of stuff, and they can bring you ideas from other places they have been. I hope that your Audit Committee wakes up and smells the proverbial coffee.

I'm with you on this one, it's when the rubber meets the road, e.g. when regulators sit down to talk to you during the visit, that everything happens or doesn't happen. The qualified person in IA may not have even gone to college. Interest and dedication, along with ongoing educational opportunities is all that is needed.

My institution is only $165 million in assets with approx. 50 employees. So, I'm glad I've started at a much smaller scale, but that still doesn't change the fact that I need guidance.

I understand where you are coming from. We ar approx the same size, I am the new (2003)and only IA person, the new Compliance officer. I also am the accounts payable person and will be learnigg other duties in 2003. I have 12 years of banking, but mostly teller/deposit related. I get a lot of my answers from BOL. I hope to get the nerve to fly in March to attend the Compliance school in Indy. I am looking for an IA school also. The good thing is I am able to attend what is needed. Good Luck to all of us. Hang on it is going to be a bumpy ride.

When does a community bank reach the size where it needs a full-time IA? Is it based on $assets, #employees, #branches, or what?

Ross A - I am far from an expert, but what I have learned from the gurus on this forum is it is all of the above with your internal control structure mixed in. Your regulators will let you know when you need a full time IA. If you do a search of the threads you should find a lot of information/discussion on the subject.

Thanks.