We are a state non member bank and we have outsourced the internal audits in the past, but we are going to use an internal person do start doing these audits (follow up on previous internal control audits and do the minimum control elements for the state banking requirements). In our current internal control policy, the CFO is the Internal Control Officer and this person reports to the board (except on audits done by the external folks and they reported on that). Would the new person doing the audits not need to report directly to the board instead of to the CFO? I think this is a yes, but who should the internal control officer be in this case? Maybe they would just oversee the whole program and then the auditor would keep this person posted on the progress or deficiencies found in audits and then the auditor would report to the board too? I have looked in my state code and have not found a clear answer and I know you really smart folks know just what the answer is!

The way I read your post, in the past the (externally generated) "internal" audit report comes in, lands on the Internal Control Officer's desk, and he disseminates it to the appropriate managers for corrective action and then takes the report to the board. If you are going to go with an in-house internal audit, the Internal Auditor needs to issue the report to the manager of the area under audit and he also needs to be the person reporting to the board. Until your internal guy has proved himself to be competent, it is probably not a bad idea to have him report on his progress to the CFO or CEO. That way, you have someone on site that verifies that he's following schedule, working well with others (not behaving unprofessionally), etc. The reporting of audit results, and the actual audit work, however must be independent of management if you want some objectivity. Hope this helps.