Risk Management Manual of Examination Policies - FDIC

INTERNAL ROUTINE AND CONTROLS Section 4.2
Alternative External Auditing Programs
Alternatives to a financial statement audit by an
independent public accountant include:
• Reporting by an Independent Public Accountant on
an Institution's Internal Control Structure Over
Financial Reporting – This is an independent public
accountant's examination and report on management's
assertion on the effectiveness of the institution's
internal control over financial reporting. For a smaller
institution with less complex operations, this type of
engagement is likely to be less costly than a financial
statement or balance sheet audit. It would specifically
provide recommendations for improving internal
control, including suggestions for compensating
controls, to mitigate the risks due to staffing and
resource limitations. Since the lending and investment
securities activities generally present the most
significant risks that affect an institution's financial
reporting, management's assertion and the accountant's
attestation generally should cover those regulatory
report schedules.
• Balance Sheet Audit Performed by an Independent
Public Accountant – This is where the institution
engages an independent public accountant to examine
and report only on the balance sheet. As with the
financial statement audit, this audit is performed in
accordance with Generally Accepted Auditing
Standards (GAAS). The cost of a balance sheet audit
is likely to be less than a financial statement audit.
However, under this type of program, the accountant
does not examine or report on the fairness of the
presentation of the institution's income statement,
statement of changes in equity capital, or statement of
cash flows.
• Agreed-Upon Procedures State-Required
Examinations - Some state-chartered depository
institutions are required by State statute or regulation
to have specified procedures performed annually by
their directors or independent persons. Depending
upon the engagement’s scope, the cost of agreed-upon
procedures or a State-required examination may be
less than the cost of an audit. However, under this
type of program, the independent auditor does not
report on the fairness of the institution's financial
statements or attest to the effectiveness of the internal
control structure over financial reporting. The
procedures’ findings or results are usually presented to
the board or the audit committee so that they may
draw their own conclusions about the quality of the
financial reporting or the sufficiency of internal
control. When choosing this type of external auditing
program, the board or audit committee is responsible
for determining whether these procedures meet the
external auditing needs of the institution, considering
its size and the nature, scope, and complexity of its
business activities.
If the audit committee or board, after due consideration,
determines not to engage an independent public accountant
to conduct an annual audit of the financial statements, the
reason(s) for the conclusion to use one of the acceptable
alternatives or to have no external auditing program should
be documented in the written meeting minutes. Generally,
the board or audit committee should consider not only the
cost of an annual audit, but also the potential benefits. The
examiner should determine whether the alternative selected
by the bank adequately covers the bank’s high-risk areas
and is performed by a qualified auditor who is independent
of the bank. As with deficiencies in an internal auditing
program, any scope weaknesses in the bank's external
auditing program should be commented on in the
examination report.
If a bank chooses not to have a financial statement external
audit by an independent public accountant, the examiner
should strongly encourage the bank, at a minimum, to
engage an independent auditor to perform an external
auditing program for the bank. However, if high-risk areas
are not adequately covered, the examiner should
recommend that the additional procedures be performed in
the future and that any other deficiencies in the auditing
program be corrected to ensure that there is adequate
independent external auditing coverage of operational risk
areas.
If a bank has no external auditing program, the examiner
should review the minutes to determine the reasons for this
choice. A strong internal audit program is fundamental to
the safety and soundness of a bank, but it is usually not a
sufficient reason for the lack of an external auditing
program. One should complement the other, and typically
the external program tests and proves (or disproves) the
strength of the internal audit program. In such situations,
the bank should be strongly urged to reconsider its
decision.
External Auditors' Reports
Each state nonmember bank that undergoes any external
auditing work, regardless of the scope, is requested to
furnish a copy of any reports by the public accountant or
other external auditor, including any management letters,
to the appropriate FDIC Regional Office, as soon as
possible after receipt by the bank. A bank whose external
auditing program combines State-mandated requirements
Internal Routine and Controls (12-04) 4.2-8 DSC Risk Management Manual of Examination Policies
Federal Deposit Insurance Corporation