Does anyone have the same problem as I do? Everytime something goes wrong in the bank, management points the finger at audit and asks " why didn't audit catch it and how did you resolve the issue?

Yes, I've experienced some of that.

I've heard that many times before. I always respond with "It's internal audit's job to evaluate the system of internal controls and processes that management has put in place". It is not internal audit's job to catch all errors.

You also have to look at when the audit was conducted. Was it before a process was changed or new reg implemented and Internal Audit has not had the opportunity to go back in yet? That was usually the case at my bank.

Agree with all statements. Also take a look at the bank's engagement letter with the external auditors - they specifically exclude catching fraud and mistakes, also look at what they charge and what they sign off to!

That sounds frustrating!

Audit's purpose is to provide reasonable assurance about the adequacy of controls and compliance. Audit is never going to be able to test 100% of transactions, so there could be something that slips through the cracks. Audit is just one of the many layers of risk operations in a bank. The entire company should contribute to compliance- Management's tone at the top, the compliance department, Bank wide training, risk assessments, audit department, etc..

On the other hand, when I've discovered that audit has missed a compliance issue, it is a good learning lesson for our group to figure out how we missed it and what we need to be doing. Is it a minor error that might not have been caught? Or is it a larger issue? Do we need to rethink the way we conduct a particular audit and increase the scope of testing?

Good luck!

I find that instead of auditing the control, I am the control (no one else is looking so I get to be the bad guy)...very frustrating!

I always tell banks (to their dismay many times) that it is the line of business's responsibility to make sure it is delivering quality work to its customers, internal and/or external. It is unacceptable to wait for audit to come around once a year or so to see if you are making mistakes. How does it make any sense to keep churning out garbage?

To add one other comment. I have battled this with examiners. The bank has a lot of control issues, audit has pointed most of them out, management has not taken action. The regulators want audit beefed up.

My comment: I already know the issues (with or without audit). I need management to beef up staff in the areas with the problems to fix the issues and implement controls (and to stop allowing staff to ignore policies and procedures). Auditing more frequently won't fix a thing if no action is taken!

Just about came to blows over that one at my last bank employer.

I can sympathize with you. One of things that really gets me sometimes is when a loan officer or processor states they have to prepare a document or perform a procedure for 'me'. I remind them they are not doing it for me, they are doing it for the bank.

Yes, Duchess Skittles, that is often how our people see it as well. They ask "is this what you wanted?" or "I wrote the procedures for you that you wanted" etc etc. I am always telling them that they aren't for me or my benefit. They are really for their benefit. It is frustrating to get everyone to see you as an asset to their job and how much help and support we can give them if they allow it.

I was told when I accepted the position of internal auditor that no one would sit next to me at the Christmas Party. I thought they were joking.....

That's all right. They don't want to sit next to risk, compliance or credit policy either. All jobs I have done. Make a few good friends at the bank and sit with them.

I have some great friends at the bank, but my skin isn't as thick as it used to be for the others.

It's a thankless job, that's for sure. I used to get the comments about fixing corrections so I would be happy. I started arming myself with regulations, guidances, etc and pointing out that it isn't me they need to please (although if the auditor ain't happy, ain't nobody happy!).

I agree with everything that everyone here has said. And don't forget, that we get to come here to commiserate with each other

A word of caution, though. I did as Sarah suggested, arming myself with laws, etc., and became quite versed in banking regs, so much so that I am now the Manager of both Audit AND compliance.

The same thing happened to me MamaBEAR! Last summer they told me I get to manage both the audit and the compliance functions.

I did both for about 10 years until examiners put an end to it. They said that I couldn't monitor/audit myself. Thank you examiners!!!

Same thing here! I just got compliance added to my function last week. That's what you get for actually reading the regulations! I won't be responsible to implement new compliance regulations, just review and advise.

I have had the "Why didn't audit catch this" at me before and I very calmly tell them the reason why.

Thankfully I don't have compliance, I did train for that also when we first made some big changes in the bank and bought 4 other branches, but I told them I liked audit better and someone else could take compliance.

Right now they are mad at me for having them read the Information SEcurity Policy...Safeguarding Customer Info and signing the last sheet acknowledging that they have read it.

Could someone tell me how you can handle audit and compliance both? I am currently in audit but I often end up doing a lot of compliance as well. Is it possible to do both? How do you handle that?

That's what happened to me. I am in audit, but I was constantly getting asked compliance questions. we cuurently have a compliance committee, made up of the various department heads. They are responsible for implementing any regulatory changes. My (and my department's) role is to advise and review. We can recommend changes that need to be made, then it is up to management to implement them. We also review to make sure other areas are in compliance. Again, we can make recommendations. But we cannot force management to implement those changes. But, if they choose not to implement the recommendation, I will have my recommendations in writing, and I will have management's response in writing. That way, it will be up to the department head to explain to the Board and/or the regulators why we are not in compliance.