Can I ask a question of the bank auditors who visit this Anonymous section? This is regarding how much time you give management to provide responses to audit findings.

Do you have one set of guidelines for how long managment has to respond to the findings in the audit report (regardless of whether they were high-risk findings or not), or do you allow for more time to respond to audit findings that are not high risk? So if you have an audit report with 4 findings, 1 of which is high risk and 3 of which are not, is there one deadline for submitting management responses, or do you have one deadline for the high-risk item, and another deadline for the other 3?

Keep in mind this isn't referring to completing the corrective action, just the response to the finding to indicate what the corrective action will be.

10 business days.

30 days for a written response.

If the findings are not corrected within that time, I ask for a completion date and then all pending findings are followed up on by me.

Most are corrected, though, before the actual report is issued (I keep the area being audited informed during the audit and we have a thorough exit interview), so the 30 day period is quite generous.

We allow 10 business days for management to submit their written corrective action to all findings. It doesn't matter if they are high risk findings or not. If we don't receive responses on time we contact the senior officer in the area.

Our (outsourced) internal auditors require a response in 30 calendar days, and incorporate management's response to the audit committee. They will note on their cover letter the response date and the date received. If the response is not provided on a timely basis, they will forward the audit to the Audit Committee with a notation that Management's response was not received by the deadline and accordingly their comments are not included in the report (worst than death!)

Our outsourced auditors expect responses to all findings within 3 weeks. They don't have two sets of deadlines for us.

If they don't receive responses from us by the deadline, or if our responses aren't satisfactory, they contact us and copy the president of the bank. They log everything and communicate it to the audit committee. The president has made it clear to us that we will send our responses timely.

We generally give department or division heads 7-10 days to issue a written response, depending on the complexity of the audit or the findings.