Internal Control issues

Posted By: Anonymous

Internal Control issues - 03/03/03 06:39 PM

I'm in the process of reviewing internal controls for the entire institution. I'm the very first internal auditor, and as such, have come across major road blocks with management. This institution is very small - approx. $165 million in assets, 2 branches, and 40 employees. So far, I have come across (what I believe to be) fundamental internal control weaknesses. Examples include no dual control over vault opening/closing, ATMs (for customer deposits and captured cards), or the night drop, and no supervisor approval for changing status on dormant/inactive accounts, or processing transactions on dormant accounts. Essentially, the only answer I receive is that the staff size is too small, and that is the reason these controls cannot be put into place. To complicate matters, they recently laid off approx. 8 employees. My reply has been that it does not matter what the staff size is - these are common control measures in place in huge institutions as well as small ones. Does anyone have an opinion on this? It's very hard for me to draw from experience, given that I've NEVER been an auditor before and I've only had 3 years experience in banking (only in the accounting department). I'm on the verge of resigning, not only because of these issues, but also because I'm not receving cooperation from the majority of management. None of the deadlines I place for them are ever met. They are always placed on the back burner because they don't have enough time. In addition, most times when I approach someone to ask them for assistance in interpreting something, they always seem extremely irritable. I feel a person with many years of auditing experience (in banking) should be in a job like this - starting up an audit department from scratch. Also, because this is such a small financial institution, there is practically no budget for training. The one manual I now have I had to beg and plead with the audit committee to purchase. The sad part is that I think I would like internal auditing, IF I was part of a team/department. Any thoughts/suggestions would be greatly appreciated.
Posted By: river rat

Re: Internal Control issues - 03/03/03 07:03 PM

Don't give up yet. 6 years ago I was hired to do auditing and compliance for a 125 million dollar/ 5 branch / 50 employee community bank. I had no banking experience and the bank's former compliance officer quit in a moment of anger. There had never been an internal auditor and I was ready to quit after day 2. Slowly and with patience it came together. The bank didn't have very many internal controls. As a matter of fact, the main branch where I was located still used 1 teller drawer and everyone had access. Being new to banking and reading everything I could find, I was sure the FDIC would shut us down. Everytime the state or FDIC or external auditors showed up in town I spent lots of time picking their brains. Turns out the examiners were more than happy to help suggest controls or just let me ask endless questions. It also turns out the main branch still uses 1 teller drawer. Main reason, no loss of any significance has ever occured in the 98 years the branch has been open. What a record!
REmember compensating controls can be just as effective as internal controls. Please don't quit. But this word of advice from someone who has been there....Don't go in saying this has to change and that has to change. Let it flow for awhile and you might be surprised as what you discover.
Posted By: MackenzieS

Re: Internal Control issues - 03/03/03 07:36 PM

Quote:

Please don't quit. But this word of advice from someone who has been there....Don't go in saying this has to change and that has to change. Let it flow for awhile and you might be surprised as what you discover.




I truly empathize with your situation. Being the internal auditor does not make you anyones best friend. I think the best words of advice I ever received was from a friend who had spent years as an auditor which was "It is only your job to perform the audit and make the recommendations, you cannot make them (nor should you) implement changes." It took hearing that a few times for it to really sink in.

They apparently felt that they needed an internal auditor or the regulators thought that it was best so here you are. Sometimes workings for a smaller institution can be more difficult because procedures are so ingrained within people "they have been doing it this way for years".

The best you can do is perform your audits, expain within your audit write ups why the control weaknesses present a risk. I have found that you can't just write up what the problem is, you have to explain what the consequences can be. For example, dormant accounts where mail is being returned: We have a procedure in place where once the account becomes dormant the signature cards are pulled from each location and placed under dual control in the vault. The reason this procedure was implemented is to reduce the risk that an employee could obtain the account information and possibly perform fraudulent transactions within the account with noone knowing about it because the statement is not going to the customer.

So maybe your finding would be: Lack of adequate internal controls to mitigate risk associated with possible internal fraud. Recommendation could be: A procedure should be developed for the security of signature cards when an account has obtained the status of dormant with mail being returned.

I do wish you the best of luck, there are a lot of us that have walked in your shoes, just remember this is a great group of peers if you ever need feedback or just need to rant.
Posted By: wlavoie

Re: Internal Control issues - 03/03/03 07:38 PM

Remember it is your job to make suggestions - not change things. As long as you document/report everything you see you have done your job. However, I do think you could GREATLY benefit from some training.
Posted By: Uncle_Milty

Re: Internal Control issues - 03/03/03 08:03 PM

If it's any help, we are 2 branches, 15 employees and $60 million. We have dual control on the vault opening/closing, ATMs, night drops, dormant/inactive, etc. We have complete management support - when there is a will there is a way.
Posted By: complyguy

Re: Internal Control issues - 03/03/03 08:18 PM

We're roughly the same size as your bank, and we've had to institute numerous dual controls in the past three years. And yes, sometimes it is a scramble trying to find the right combination of people to be able to something. We've had to watch our scheduling to make sure that both people with the same combination half (-ves) aren't out at the same time.

When I make the recommendations, they're often ignored. When the auditors cite the same thing, there's usually some kind of grudging response.

Hang in there - Rome wasn't rehab-ed in a day.
Posted By: DawgFan

Re: Internal Control issues - 03/03/03 08:19 PM

I am the first internal auditor that my bank has had as well, and I have also had to build a department from scratch and, like you, had no experience coming in. Two great points were made earlier, get training, and explain why you are commenting on the things you are commenting on. Explain it to management in terms that they can understand, namely, how it impacts their wallet. I would also build a rapport with your audit committee (explain to them the problems you are having and what can be done about them). Ideally, those on that committee should be outside directors. You need to get what's commonly called a charter- as statement from the board stating what your authority is, where it comes from, etc.
I am sorry that your first experience in audit is occuring in an environment that is hostile to audit. That's why you are getting irresponsible replies to your comments, late/no responses, etc. Sorry to come off so strongly, it just burns me up when auditors get treated this way . I think the best thing to do would be to build a rapport with your Audit Committee, ask lots of questions on BOL, find someone in your area who has audit experience to ask questions of, and also, check out www.auditnet.org (good audit resources). Best of luck!
Posted By: Walleye Woman

Re: Internal Control issues - 03/03/03 08:25 PM

Hang in there. I was hired by a $150MM/1 branch/31 employees bank after 15 years of experience in banking, most recently IA and Compliance. The bank was coming off two not-so-good exams and created the new position. However, the bank is a savings bank with the old savings and loan mentality. I met a lot of resistance and my first audit results meeting took 2 hours. All we were discussing were the controls over dormant accounts, returned mail and overdraft processing. I kept hearing that their procedures had never been a problem before. I just kept explaining that controls needed to be in place and that the findings would appear in my audit report. Reluctantly, procedures were changed and now everything is wonderful. If you need anything, even just moral support, feel free to contact me.
Posted By: c.a.r

Re: Internal Control issues - 03/03/03 08:39 PM

I am there with you. I am also new to IT/Compliance officer. Starting from scratch. Maybe we can help, talk or what ever to show others we have MOXIE
Posted By: Neytiri

Re: Internal Control issues - 03/03/03 09:32 PM

Sounds like someone told them they had to have an auditor and are not allocating sufficient resources and/or just paying lip service to the Audit Department. We are a $66M bank with 4 branches and 38 employees, and we manage to have all internal control requirements in place. If they just laid off employees and are short-handed, then they really need internal controls now! You need to keep reporting these findings and management responses. If there is an embezzlement or other disappearance of funds your bonding company and insurance company will be VERY interested in the bank's internal controls.

Do you report directly to the Audit Committee? The first thing examiners do is get copies of your audit reports. If there is no support from management or the BOD, it will be noted in your regulatory exam. Have you read past examination reports? I find it hard to believe that your examiners would not cite lack of internal controls. You probably can get some support from your EIC.

If the OCC is your regulator, go to their website and use the Internal Controls publication under "Safety and Soundness". I'm sure the other regulators have similar publications. At least you will have some ammunition to support your position.

Build up a good relationship with the Chairman of the Audit Committee, and explain what you are up against and get some feedback from him/her. Explain how important internal controls are and that you need training materials and seminars in order to do your job properly. I know what you are up against because I went through the same thing when I was starting out and probably a lot of us have.


Posted By: KYAuditor

Re: Internal Control issues - 03/04/03 02:30 PM

I can empathize with you. I came into a community bank where internal audit was not a priority in the past. Starting an internal audit program does not happen overnight. You have to hang in there and just keep working at it.

Since your bank management has trouble seeing the problem with the internal control issues you mention, make sure that you point out the potential issues/liabilities associated with them.

And, as others have posted, you can only recommend change and not enforce it. Make sure that the issues are covered in your audit reports to the Audit Committee or Board of Directors. This shows examiners that you are doing your job even though management is not responding in a satisfactory manner.
Posted By: Anonymous

Re: Internal Control issues - 03/04/03 04:30 PM

I am going to be the "odd" ball in response to you, but just like everyone else that has responded, it is from my heart. I truly understand where you are coming from. I have been in banking probably about 17 years now. Started as a teller, and worked my way through various positions including new accounts, staff accountant, lender, branch manager, branch administrator, etc. I have moved throughout the US three times in my career and have worked for two "big" banks that were tremendous (I am proud to say). When I moved to my new location about three years ago, I went to a work for a community bank that was in trouble. I did not care because I knew I had the experience to help them if they wanted to help themselves. it turned out they did not, so in two months I left that bank and went to work for the bank I am currently employed with. (By the way, we now own the original bank I went to work for) Both times the position was branch manager or branch administrator. After working here for a very short while, I was asked to implement an internal auditing/compliance department. I am always up for a challenge, so I agreed. In my new position as internal auditor/compliance officer, I found many weaknesses, in some cases a lack of cooperation such as you speak about, and learned of my own shortcomings. But I found many resources and helpful individuals through attending ABA compliance schools and Bankersonline. I can not begin to express my gratitude to everyone here. Many, many times I got frustrated with my own knowledge level, the cooperation I was receiving internally, and the progress we were making. But each time, the people from Bankersonline would help me through the process. I can't begin to tell you how much I have learned in the past two years. Two additional things I learned were about myself. I found I was strong enough to struggle through a process such as this and I also found I missed branch administration. Audit provides you the tool to identify something, but it does not provide you the tool to enjoy the correction process, or at least for me it did not. I get so much pleasure and growth from correcting rather than identifying. I guess in some institutions, audit may be part of the correcting process so an individual could have the best of both worlds, but for me it was not that way here. I love working with people so when the opportunity arised to switch positions again, back to branch administration, I jumped on it.

I guess what I am saying is only you know what you are happy doing and what you have fun with. Most of our lives are spent working so it should be something that is personally fulfilling for you. Every position has its frustrating times and challenges, but if you know there is sun for you at the end of the storm then stay with it. If not, look to what will bring you happiness.

By the way, even though I changed positions, I still depend on everyone's knowledge from Bankersonline to help me achieve my goals. I draw support form those I know and trust not only from within my institution but from external resources such as Bankersonline. There is no better way to be part of a team than from each other working together within an institution and not struggling with each other. I hope I prove to be the next auditor's ali not enemy since I understand where they are coming from.

Hope this helps you. I find praying helps me too! It provides me an "inner" strength through my "rough" times.

Opinions are mine not my employer.
Posted By: MackenzieS

Re: Internal Control issues - 03/04/03 04:42 PM

Well said.
Posted By: Maria

Re: Internal Control issues - 03/04/03 05:37 PM

[The original message was sent by me. I forgot to login, as usual. Sorry!] I am going to be the "odd" ball in response to you, but just like everyone else that has responded, it is from my heart.
Posted By: Anonymous

Re: Internal Control issues - 03/04/03 08:06 PM

Thanks to everyone for their comments. Until I find another job opportunity (which I hope will be soon), I will continue doing the best I can. I will continue to report my findings and make my recommendations. However, I feel that I am not a strong enough person to handle all of this on my own. I prosper in a team-oriented environment. I am not a confrontational person, especially when the confrontations are on a daily basis!

No one at this institution seems to have the time or the desire to help me (after numerous attempts at asking). Even "little things" (like a file cabinet for my office) was met with trepidation by the audit committee (which I directly report to). When I asked the CEO about it, his answer was "I have nothing to do with it - you don't work for me." Even when I began evaluating internal controls, his upfront response was "Be careful on what you report. You better make sure what you report is accurate, because if it's not, I'll make your life miserable!" I'm sorry, but I don't care if this was a 3-employee bank, that's completely inappropriate and rude. Especially when I took a $12,000 pay cut from my previous job.

It really makes me wonder why they wanted an internal auditor in the first place. Anyway, thank you all very much for your insight and support. Hopefully one day, I can find a job that better suits me, hopefully in internal auditing.
Posted By: complyguy

Re: Internal Control issues - 03/04/03 08:20 PM

Anon - "It really makes you wonder why they wanted an internal auditor in the first place." Window dressing. I'll bet there are many of us who were hired as mannequins for the benefit of the auditors/examiners.

Just keep repeating the line from "Rocky I": "He doesn't know it's a d**n show - he thinks it's a d**n fight!"
Posted By: Anonymous

Re: Internal Control issues - 03/04/03 09:59 PM

In response to your "why they wanted an internal auditor in the first place". It is a requirement and that is all for some! It does not make it right!

My advise to you is:

Stay focused. You know what is right and wrong.

Stay on course. Do not allow anyone to get you side tracked. Absorb the knowledge you are gaining through the process.

Take a stand and implement a change. It takes a stronger person to say no, I am not going to change me, but I will work on changing the system.

Just be consistent in you endeavors. Want it, crave it, do it, on a daily basis.

Dedicate yourself to your changes, so they become a part of your life even if it is not part of theirs.

And if you find happiness in auditing, then do not give it up because of someone else. Good working people are hard to find!

Opinions are mine not my employer.
Posted By: Maria

Re: Internal Control issues - 03/04/03 10:03 PM

[This post was me again. I keep getting logged out so it shows up as an anon instead of Maria. sorry!]

In response to your "why they wanted an internal auditor in the first place".
Posted By: Starky

Re: Internal Control issues - 03/04/03 10:59 PM

Hang in there. I was in a similar position six months ago and was ready to quit banking. They felt like they didn't need a compliance officer, even asked me once when I would be done with compliance so I could move on to something else. All this despite a poor compliance exam before hiring a compliance officer.

I found a job with another bank that takes compliance seriously and treats the position with respect and as part of management. This is the happiest I've been in a job in years. Took a lot of patience and a little luck.

Good Luck!
Posted By: TDW

Re: Internal Control issues - 03/05/03 01:36 PM

I just started last July, the lady before me left the department a total disaster. Policies hadn't been updated annually, policies were lacking, NO procedures for hardly anything except how to open a new account and even those were hardly what I would call procedures. She never trained on any of the required regs, her audit committee reports were very unorganized, I can't believe they kept her as long as they did! The funny thing is that I took over her position at another bank I worked for and she left that department worse off then she left this one!! Some people. I do have to say that the management at the bank I am working for now is great!! The support pretty much everything I present.
Posted By: c.a.r

Re: Internal Control issues - 03/06/03 03:27 AM

It is very hard being so new and very blind in this field. I work for a bank that now believes complance officer is not a part of management.. just keep the co in a closet. I under stand what is being said. Everything said about being new, no backing etc... I have also felt. I know I want to keep going here, to keep learning... however there are days when the front door looks very inviting. BOL has been very helpful. I don't ask much or say much, But I read a lot of what is here. My dept is a mess and I am a dept of one. Any help or advise is greatly needed. BOL Rocks!! Keep going!!
Posted By: Anonymous

Re: Internal Control issues - 03/06/03 10:30 PM

Pertaining to dormant accounts, has anyone required that supervisor approval be obtained on transactions to dormant accounts or on changing status from dormant to active?
Posted By: Walleye Woman

Re: Internal Control issues - 03/06/03 10:55 PM

We require a supervisor's approval to change the status on dormant account back to active. Our system is set up to require a supervisor override for both deposits and withdrawals.
Posted By: Anonymous

Re: Internal Control issues - 03/07/03 04:40 PM

Why do you think a supervisor override is necessary?
Posted By: Lestie G

Re: Internal Control issues - 03/07/03 04:43 PM

Quote:

Why do you think a supervisor override is necessary?




So someone in a position of authority is aware that the account has been activated, and can verify that it's customer activity that is activating it. This dual control is a deterrent to any employee who might consider using the account for 'less than honorable' purposes.
Posted By: TDW

Re: Internal Control issues - 03/07/03 05:15 PM

Quote:

My dept is a mess and I am a dept of one. Any help or advise is greatly needed. BOL Rocks!! Keep going!!



I am a dept. of one also and sometimes I get so overwhelmed I don't know how to accomplish everything I need to get accomplished, I try not to think about work at home but I do and it shouldn't be that way!!
Posted By: Anonymous

Re: Internal Control issues - 03/20/03 10:27 PM

I think all of us have been in this same situation. Management has from time to time made my life miserable. I learned a long time ago to report my findings, make my recommendations, and it's up to management to implement the changes. My job is to report to the Board. I implemented a tracking report of significant deficiencies where no action had been taken and you'd be surprised how I got their attention with that. I always include a short overview of the law and/or my reasons for citing the problem. This seems to get their attention. I also include a Board advisory when I feel it is necessary to really get their attention. Board oversight is very important. They can't ignore the report anymore like they used to. Especially when they realize it might hurt the bottom line or them personally.

However, keep in mind that the audit function has a lot of support from the regulatory agencies. I am more concerned about your CEO's comment. You should be working independently and threatening you in this way can get him into serious hot water. If you feel comfortable talking to someone in your regulatory agency's examination team about your concerns (confidentially), your should. In the end, your perforance will be under the gun as well. They expect results. The CEO needs to understand that you are there to help find the problems before they come back and bite him. You are there the ensure the Boards safety and soundness objectives are met. AND, geez, good controls and risk management can only help him and his Management team keep their jobs. It took our CEO several bad problems and bad exams to finally get the message. The internal audit function is a fairly new position for many banks and its tough getting started. Best wishes and don't give up
Posted By: yy2say

Re: Internal Control issues - 03/20/03 10:33 PM

We require a supervisor approval also and track re-activated accounts to make sure the proper documentation is on file. We learned the hard way with a loss of approximately $11,000. Also, may want to make sure that your supervisors are not "sharing" their override passwords with their staff
Posted By: Anonymous

Re: Internal Control issues - 05/19/04 08:21 PM

I pretty much went through the same things. No one as very cooperative and the answer was "we have been doing it this way for years" until a MAN was hired to oversee the department and say the same things I was saying, did anything even get started. I'm sticking with it and am not backing down.
Posted By: Anonymous

Re: Internal Control issues - 05/20/04 07:17 PM

I certainly can relate to opposition from management, however, you are hired to point out the weaknesses of the organization. A suggested resource might be your local chapter of the Institute of Internal Auditors. I am not sure what part of the country you are located in but it is a good source of networking with auditors in all industries and most chapters provide training resources as well. The national organization has a website at www.theiia.org which has a lot of good information also.