Internal Audit Process Credit Union Internal Auditing from

Internal Audit Process Credit Union Internal Auditing from the Ground Up Ø John Gallagher, Director Internal Audit Ø Ø SEFCU (New York) Barry Lucas, Internal Auditor Desco FCU (Ohio) Pat Richey, Director Internal Audit Finance Center FCU (Indiana) ACUIA Conference 6/14/2011 1

Serving Many Masters Internal Audit Definition Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. ACUIA Conference 6/14/2011 2

Serving Many Masters Role Independence and Objectivity q Assurance and Consulting q Add Value and Improve Services q Systematic and Disciplined q Reporting Structure q ACUIA Conference 6/14/2011 3

SEFCU Organizational Chart Members Board Committees (ALCO, Governance, CEO Compensation) Board of Directors (13 members) CUSOs Chief Administrative Officer Chief Financial Officer Supervisory Committee (4 Members) President/CEO Chief Banking Officer Internal Audit Chief Marketing Officer President Commercial Services Chief Technology Officer ORM Accounting Finance Branch Network Marketing Commercial Lending IT HR Collections Call Center e-Services Business Accounts Facilities Ops Support Lending CRM

ACUIA Conference 6/14/2011 5

ACUIA Conference 6/14/2011 6

Serving Many Masters Responsibilities o Internal Audit Charter o Supervisory/Audit Committee Charter o Job Descriptions o Audit Staff Structure ACUIA Conference 6/14/2011 7

Serving Many Masters Relationships and Politics v Management v Employees ACUIA Conference 6/14/2011 8

Serving Many Masters Relationships n Supervisory & Audit Committees n Board of Directors ACUIA Conference 6/14/2011 9

Serving Many Masters Relationships n External Auditors n Regulators ACUIA Conference 6/14/2011 10

Serving Many Masters QUESTIONS ? ACUIA Conference 6/14/2011 11

Performing Audit Work Where Do I Start? Risk Assessment Audit Universe Models Risk Priority ACUIA Conference 6/14/2011 12

Performing Audit Work Where Do I Start? • Business/Audit Plan ACUIA Conference 6/14/2011 13

Performing Audit Work Where Do I Start? • Audit Scheduling • Distractions – – Fraud Investigation New Products / Services Training / Vacations Turn over ACUIA Conference 6/14/2011 14

Performing Audit Work Objectives - broad statements - risks Scope - who - what - when - where ACUIA Conference 6/14/2011 15

Performing Audit Work Audit Program - written procedures - interview questions - collecting information - testing, sampling - analyzing - evaluation ACUIA Conference 6/14/2011 16

Performing Audit Workpapers - support findings - restricted access - retention - testing, sampling - analyzing - evaluation ACUIA Conference 6/14/2011 17

Performing Audit Work QUESTIONS ? ACUIA Conference 6/14/2011 18

Communications and Follow Up Audit Reports Management & Internal Audit need to agree up front • Findings • Recommendations • Report Structure • Who gets them? ACUIA Conference 6/14/2011 19

Communications and Follow-Up • Follow-up Audits • Monitoring results • Implementation of recommendations If you do not do this – Nothing happens! ACUIA Conference 6/14/2011 20

Communications and Follow-Up Supervisory / Audit Committee Meetings • Frequency • Structure • Agenda ACUIA Conference 6/14/2011 21

Communications and Follow-Up QUESTIONS ? ACUIA Conference 6/14/2011 22

Tools and Resources Technology § Paperless auditing § Internet tools § Analytical review using audit software ACUIA Conference 6/14/2011 23

Tools and Resources Basic Internal Controls - COSO n Credit Union Objectives - Operations - Financial Reporting - Compliance § Internal Control Components - Control Environment - Risk Assessment - Control Activities - Information and Communication - Monitoring ACUIA Conference 6/14/2011 24

Tools and Resources Enterprise Risk Mgmt - COSO n Credit Union Objectives - Operations - Financial Reporting - Compliance - Strategic §ERM Components - Internal Environment - Objective Setting - Event Identification - Risk Assessment - Risk Response - Control Activities - Information and Communication - Monitoring ACUIA Conference 6/14/2011 25

Tools and Resources International Standards for the Professional Practice of Internal Auditing - Attribute Standards - Performance Standards - Quality Assurance Review ACUIA Conference 6/14/2011 26

Tools and Resources Control Self-Assessment n n n Management Buy In Business Objectives Identify Risks Gather Best Practices Provide Documents ACUIA Conference 6/14/2011 27

Tools and Resources n Professional Journals - IIA, ACFE, ISACA n Professional Standards - COBIT - GTAGs n Current Issues of Internal Auditing – Governance n Websites - Credit union industry, regulatory, professional ACUIA Conference 6/14/2011 28

Audit Professionalism n Certification - CIA – Common Body of Knowledge - CFE - CUCE, NCCO - CISA - CPA - CFSA ACUIA Conference 6/14/2011 29

Audit Professionalism n Training - Conferences / Seminars - Local Chapters - Webinars / Teleseminars - Compliance Schools ACUIA Conference 6/14/2011 30

Audit Professionalism ACUIA ü Website ü Message Forum ü Membership Directory ü Audit Guide ü The Audit Report magazine ü Lending Library ü Conferences, seminars n ACUIA Conference 6/14/2011 31

Tools and Resources QUESTIONS ? ACUIA Conference 6/14/2011 32