I'm a one man show as far as compliance auditing, etc. goes at a community bank. Was on leave for a number of weeks late last year and my work just sat, with no one handling this internal auditing in my absence. I generally set up my audit schedule based on the compliance risk assessment completed (this is done at the beginning of the year - in Jan.) and audits are completed throughout the year, with a new audit schedule developed again the next Jan. Due to my leave and lack of anyone else handling this while I was gone, and the mountain of compliance changes we've been dealing with I have yet to get caught up on my work. I have discussed this with management and they suggest I revise my audit schedule.

Are there any issues I shoud be concerned about in amending the audit schedule? The amended audit schedule will be approved by the board, as the original schedule was.

My audit schedule is considered a "living document" that can be revised if necessary. I have had to change it in the past when new regs came out or we had a system update that was causing problems. We just finished our FDIC compliance exam and the examiner had no issues with audit schedule.

Ditto what VWgirl stated... it is a living moving document IMO, and I encourage my auditor to manage the schedule as needed.

For example, we might have thought we would focus on one area in the first quarter, but then learn the software will be replaced at the end of the quarter. Tt would not be useful to the bank to review a process that will be dramatically revamped shortly after our review, so then we may consider moving it to the third quarter, or split it up and do two smaller reviews. Perhaps review the portions in the first quarter that would not be affected by the software change, and the rest in the third quarter once they have learned the new program and worked the kinks out.

If you feel more comfortable documenting the reasoning for the change, your complaince risk assessment will be a great means for that (as ours drives our audit schedule) as ours is live document as well.

Thank you boht for the feedback, I really appreciate it.

Can either of you or anyone else tell me if there are any specific act or regulations that are required to reviewed once a year per regulatory requirements? Thanks!

For one, you will have to conduct your ACH audit this year. I believe the deadline is prior to December 1st (going off the top of my head).

The only push back I received from our examiners (OCC) regarding changing my audit schedule was that changes should be approved by the audit committee. To cover my bases I usually have the audit committee approve a blanket statement that basically says I have the authority/freedom to adjust the audit schedule as I see fit. I have that approved at the same time they approve the annual schedule. Then, if I do change the schedule during any give quarter I will bring that up in the quarterly audit committee meeting and note the discussion in the minutes.

I had to change mine last year to push some audits into 2011 that didn't get completed due to time constraints. We had our compliance committee approve the change. No comment or complaint from examiners (Fed).

I present my audit schedule at each Audit Committee Meeting. It is a standing agenda item. It has a column for audits in process, complete, etc. If I change a tentative date, I usually document why and make the change. This has never been a problem. You might want to consider presenting this dynamic document at each meeting. This keeps me from forgetting to get it approved each time I make a change.