Auditing Outsourced Functions

Posted By: ESK

Auditing Outsourced Functions - 01/05/07 06:53 PM

Fellow auditors, when you set your audit plan for the year, have you included in your audit schedule those bank functions that are outsourced?

If so, to what extent have you audited these functions -- objectives, scope, procedures, etc.?

Specifically in my case, our federal income tax management is outsourced and the overall income tax function came up relatively risky and auditable.

Any specifics on what you're doing would be appreciated...

Posted By: ESK

Re: Auditing Outsourced Functions - 01/08/07 06:27 PM

Anyone... Anyone... Bueller?
Posted By: blue

Re: Auditing Outsourced Functions - 01/17/07 06:00 PM

I have come across one area where this was very important to the function under audit. We requested a SAS 70. There isn't one so we are now working with the vendor to secure one or a SysTrust review.
Posted By: NotALawyer

Re: Auditing Outsourced Functions - 01/17/07 11:30 PM

We include outsourced activities in our audit plan based on the results of our annual risk assessment. This is the same as any area of the bank.

The overall approach is one of 'How does management ensure that activities are appropriately controlled'. If outsourced, what information is provided to and reviewed by management? Is there enough information for the bank to manage the vendor? Is the contract with the vendor adequate (specific obligations, problem escalation and resolution, compliance as applicable, right to audit, etc.) The same questions would apply to an affiliate vendor.

We request a copy of any outside reviews (SAS70, etc.) and review what is currently at the Bank. We can place reliance on these to the extent that they are in scope of the audit and any findings are satisfactory.

We work closely with management to ensure they understand they can outsource the function, but not the responsibility.
Posted By: ESK

Re: Auditing Outsourced Functions - 01/24/07 01:19 AM

Great stuff, thanks for the responses...