Audit Compliance or Audit vs Compliance DAA and

Audit & Compliance or Audit vs. Compliance DAA and GEP Orlando 2008 1

Debbie Austin – CTCP, CFSA, VP Fiduciary Compliance Manager PNC Bank, Philadelphia, PA Gary Pelcak – CTA, CFSA, CFE Chief Audit Executive Central National Bank, Junction City, Ks DAA and GEP Orlando 2008 2

AGENDA • • Introduction Rules of Engagement Differences and Similarities Role of Audit and Compliance in today’s Environment • The relationship of continuous Auditing, Monitoring, and Assurance DAA and GEP Orlando 2008 3

• • • AGENDA (cont) Key Steps to Implementation Benefits of an Audit / Compliance Partnership Summary Questions Closing DAA and GEP Orlando 2008 4

• Differences and Similarities – Both considered part of the Risk Management Process – Audit Reports ultimately to the Board – Compliance reports to a joint risk committee – Compliance testing moved to IA DAA and GEP Orlando 2008 5

Some Definitions To Help Us Internal auditing is an independent, objective, assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. DAA and GEP Orlando 2008 6

Some Definitions to Help Us Compliance is a broad term routinely applied to a financial institution’s responsibility to adhere to state and federal laws and regulations, many of which are intended to protect consumers. DAA and GEP Orlando 2008 7

Audit and compliance together should: Add Value = Value is provided by improving opportunities to achieve organizational objectives, identifying operational improvement, and/or reducing risk exposure through both assurance and consulting services. DAA and GEP Orlando 2008 8

The audit function should provide Assurance Services = An objective examination of evidence for the purpose of providing an independent assessment on risk management, control, or governance processes for the organization. Examples include financial, performance, compliance, system security, and due diligence engagements. DAA and GEP Orlando 2008 9

and should work with compliance on Consulting Services = Advisory and related client service activities, the nature and scope of which are agreed with the client and are intended to add value improve an organization’s governance, risk management, and control processes without the internal auditor assuming management responsibility. Examples: counsel, advice, facilitation, training. DAA and GEP Orlando 2008 10

• Role of Audit and Compliance in today’s Environment – Today’s audit and compliance challenges • Regulatory compliance & controls • 12 CFR 9. 9(b) Continuous Audit - Audit of Fiduciary Activities • Internal audit value and independence • Availability of skilled resources • Determining appropriate technology solutions – Need for timely, on-going assurance over risk management and control systems DAA and GEP Orlando 2008 11

• Role of Audit and Compliance in today’s environment (cont) – Provide more frequent, more timely, analyses to better manage control deficiencies and risk. DAA and GEP Orlando 2008 12

• The relationship of continuous Auditing, Monitoring, and Assessment – Continuous Auditing • Method used to perform audit related activities on a continuous basis. • Includes control and risk assessment • Performed by internal audit DAA and GEP Orlando 2008 13

– Compliance Monitoring • IA Schedule and Compliance Schedule • Specific Requests to IA • Dashboard – conduct monthly “Where are we at? ” and “What are you seeing? ” meetings • On the same committees • Invited to all Entrance & Exit Meetings • Copied on all reports & memos DAA and GEP Orlando 2008 14

– Continuous Monitoring • Processes to ensure policies / processes are operating effectively and to assess adequacy / effectiveness of controls • Performed by operational / financial management; audit independently evaluates adequacy of management activities DAA and GEP Orlando 2008 15

– Continuous Assurance • Combination of continuous auditing and audit oversight of continuous monitoring DAA and GEP Orlando 2008 16

Relationship of Continuous Auditing/Monitoring/Assurance • Role of continuous auditing dependent on management’s role in continuous monitoring of controls – Inverse relationship: the greater the role of management, the less of a direct role of internal audit • True continuous assurance – Depends on effective monitoring by management of internal controls and Audit’s independent assessment of that function DAA and GEP Orlando 2008 17

Application Areas • Continuous control assessment – Identification of control deficiencies – Identification of fraud, waste, abuse • Continuous risk assessment – Examination of consistency of processes – Development of enterprise audit / compliance plan – Support to individual audits and compliance requests – Support / Follow-up on compliance recommendations DAA and GEP Orlando 2008 18

• Key Steps to Implementation – Establish the requirements for audit and compliance objectives – Gain executive – level support – Ascertain degree to which management is performing monitoring role – Select appropriate technology solutions – Identify information sources and gain access DAA and GEP Orlando 2008 19

• Key Steps to Implementation (cont) – Understand business processes and identify key controls and risks – Build audit and compliance skill set – Manage and report results DAA and GEP Orlando 2008 20

• Benefits of an Audit /Compliance Partnership – Increased scope of audit activities – Increased ability to mitigate risk – Reduced cost of internal control assessment – Increased confidence in financial results – Improvements to financial operations DAA and GEP Orlando 2008 21

• Benefits (cont) – Reduced financial errors and potential for fraud – Reduced revenue leakage for improved bottom – line results – Sustainable and cost effective means to support compliance DAA and GEP Orlando 2008 22

• Summary – Differences and Similarities – Role of Audit and Compliance in today’s Environment – The relationship of continuous Auditing, Monitoring, and Assurance – Key Steps to Implementation – Benefits of an Audit / Compliance Partnership DAA and GEP Orlando 2008 23