Fellow auditors, when you set your audit plan for the year, have you included in your audit schedule those bank functions that are outsourced?

If so, to what extent have you audited these functions -- objectives, scope, procedures, etc.?

Specifically in my case, our federal income tax management is outsourced and the overall income tax function came up relatively risky and auditable.

Any specifics on what you're doing would be appreciated...

Steve

Anyone... Anyone... Bueller?

I have come across one area where this was very important to the function under audit. We requested a SAS 70. There isn't one so we are now working with the vendor to secure one or a SysTrust review.

We include outsourced activities in our audit plan based on the results of our annual risk assessment. This is the same as any area of the bank.

The overall approach is one of 'How does management ensure that activities are appropriately controlled'. If outsourced, what information is provided to and reviewed by management? Is there enough information for the bank to manage the vendor? Is the contract with the vendor adequate (specific obligations, problem escalation and resolution, compliance as applicable, right to audit, etc.) The same questions would apply to an affiliate vendor.

We request a copy of any outside reviews (SAS70, etc.) and review what is currently at the Bank. We can place reliance on these to the extent that they are in scope of the audit and any findings are satisfactory.

We work closely with management to ensure they understand they can outsource the function, but not the responsibility.

Great stuff, thanks for the responses...