Good Afternoon! I am in the process of updating my branch audit procedures for 2008 and I am looking for some different procedures/items to look for when conducting a branch audit. Right now we look at cash, traveler's checks, cash items, vault opening procedures, night depository, safe deposit boxes, Medallion Stamp and emergency disclosures and I feel that the branches are getting too comfortable with our procedures and I am looking for different items to test or different tests to perform for the items noted above. If anyone has any suggestions please let me know!

Required signage (CRA, Reg CC, FDIC, etc)

Just my opinion, but the point of your audit should be to test that risks are appropriately controlled, not that your employees are less than "comfortable". If you are looking to see that you've identified all the risks inherent in the operations of a branch, good - but don't add procedures just so you can generate findings or keep staff on edge. Again, just my opinion.

How about security and their opening procedures?

Do your ATMS capture cards? If they do there is a risk there also.

Thanks, Jokerman! This is something I have always tried to get across to internal auditors - look for what is important and if we are doing it right, tell us "Good Job!" Instead there seems to be an undeterable drive to find something - anything - wrong where ever auditors go.

PS - I audit branches and back-office...so please don't think I am just picking on the audit people here!

I usually check for information security as well as keys and combinations during the branch reviews.

I used to also incorporate a compliance questionnaire that touched on some of the regs they were responsible for knowing.

I would suggest that you review your branch policy and procedures manual and create testing from there - make sure you perform testing on all types of services that are offered - cash advances, ATM machine control and proof, money orders, official checks, CTR reporting, teller and cash limits, check cashing authorities and limits, monetary instrument logs, proper reporting to branch admin, security or BSA dept's, is there documentation of staff meetings, training - create interview questions to ask each employee to ensure they are knowledgeable on BSA and CIP (will help you to determine if additional training is required) - testing of new accounts and closed accounts for BSA and CIP requirements - CD early withdrawal penalties properly applied - daily overdraft / uncollected approvals - wire transfer forms / approvals - etc.

This year I'm going to incorporate checking on lobby disclosures, the disclosures posted on ATMs and night deposits, checking the CRA file at branches. I actually drove 56 miles round trip to check the disclosures for Reg CC. We usually call, but I feel like they would just tell me what I want to hear so I decided to check it out myself. We also make copies of the Monetary Instrument Log, Hold Log, etc. and check them against the records held at the Main Office. I have a checklist if you would like a copy. Just send me your e-mail address.

Currently, we don't "score" branch audits. Simply, a summary is provided of what the findings were. Some branch managers have stated that at other banks they've been with, they were given a score or letter grade at each branch audit. They seem to wish that we had a scoring method in place (at least they wish that after the good audits). Does anyone have such a scoring model they'd be willing to share?

I didn't see anything here but operations. What about the other side of the house, looking at new accounts (e.g. compliance), any incentives paid out, early withdrawals, secured loans, adverse action notices, etc.

The only surprise in a branch audit should be when we are going to show up.

Beyond the branch logs and process reviews we try to get some additional frontline feedback.
We use a 20 question "open book" questionnaire for CSRs & tellers with true/false questions on pertinent regs and recent procedure changes or training. They give it back to us before we leave or send it with the courier the next day if they're busy.
Individual incorrect answers are marked on an Excel sheet with questions headings and if 4 of 6 missed the CTR question they get training. We return the questionnaires with the audit report to the managers. I saved a sample of each questionnaire and the Excel reports on a CD and got a few points for training with FDIC BSA and Compliance Examiners but I'm a very smooth talker.
It has shown us communication problems (CSRs won't ask a teller for an answer), training problems (what they heard in that meeting) and a lot of good conversation and discussion. There is no grade and managers may not use it for performance review but it sometimes shows where they need to coach or train. Side comments and scribbles on the sheets are always enlightning. They say they hate it but they always ask for one when we visit.

I do the same as GregS on my branch reviews. If you are doing a risk based audit, this format can be useful as well to determine what areas you might focus on based on the responses.

We also check their disaster recovery forms and make sure they have all the ones they need, manual listing of available accounts, most recent rate sheets, etc. In addition, we verify their gift card inventory, American Express checks and lobby signage. Probably wouldn't be a bad idea to make sure teller areas and clear and their drawers are in order and not over their limits. We do this on a monthly surprise audit by their supervisor but Audit can do it at any time as well.

Depending on your set-up, consider a review of system access, i.e. Teller system access; ensuring the limits in the system are the same as those assigned on the Teller Limit Sheets.

From an efficiency standpoint, ensure you are auditing where the actual control exists. Many of our controls are back office; branch audits are risk-based and only those controls assigned at the branch level are reviewed.