Magazine article American Banker

Viewpoint: Internal Auditing: Lots of Room for Upgrades

Magazine article American Banker

Viewpoint: Internal Auditing: Lots of Room for Upgrades

Article excerpt

Though banks spend millions of dollars a year on internal audit, many continually face control breaks, especially in the areas of compliance, Bank Secrecy Act, and anti-money-laundering.

Clearly, reform is needed.

I feel sympathy toward internal auditors - they have a tough job.

They face a daunting task and are responsible for checking the entire control mechanisms for complex financial systems. Their jobs can also be tedious and, at many financial services companies, command lower pay and less prestige than their business-line counterparts.

In the real world, auditors cannot be expected to catch every error. At the same time they form the crucial "third line of defense" for financial organizations. As banks become larger and more complex, the importance of internal audit becomes greater.

I am also sympathetic to senior bank managers who - under current rules - are kept separate from the internal audit function and must act through the board audit committee to enhance internal audit.

Though important reasons exist to keep internal audit as an independent function, there could be a risk of going too far - to a place where independence trumps auditor relevance.

Internal audit at "best-in-class" banks today is supposed to have only a limited dotted line to the chief executive officer - and none to any other senior manager.

But should this structure be more flexible so that the dotted line can also lead to a senior control officer of the bank, if the bank has someone playing this role?

To be sure, the internal audit function should have a complete, independent responsibility to report to the board audit committee, and appropriate safeguards could be adopted to mitigate concerns about potential conflicts.

There is an overriding virtue to internal audit having to keep internal senior risk and control people sufficiently in the loop that they are in a position to promptly bring to the audit committee's attention ways in which to enhance the internal audit function.

I have found internal audit programs most lacking in areas listed below. These areas, if upgraded, would markedly enhance a bank's control environment:

- Too often, banks do not have someone in internal audit with expertise in important areas of the business or on important laws with which the bank must comply.

Many banks' internal audit departments continue to treat compliance as a backwater, despite the unrelenting increase in banks' compliance risk. Ensuring that internal audit has appropriate expertise is important.

- Some internal auditors allow business lines too much slack to fix problems before bringing them to the audit committee for repair. It is important that the internal auditors and audit committees insist on prompt attention by business lines to negative audit findings.

- Internal audits have often been overly lenient on information system weaknesses.

In an increasingly complex and demanding environment, it is important that audit has the expertise to criticize weaknesses in banks' crucial technological infrastructure. …

Search by... Author
Show... All Results Primary Sources Peer-reviewed

Oops!

An unknown error has occurred. Please click the button below to reload the page. If the problem persists, please try again in a little while.