Creating, Managing

1
Creating, Managing Evaluating the Internal
Audit Function

• W. Samuel Capuano
• Manager of Internal Audit
• Sunmark FCU
• 518-347-3156
• scapuano_at_sunmarkfcu.org

2
Overview

• Creating the IA Function
• Managing the IA Function
• Evaluating the CAE

3
Enclosures

• ACUIA Internal Audit Shop Tools
• Audit Charter

4
Creating the IA Function

• Does the CU need an IA Dept.?
• NCUA SC Guide 6.01
• Large CUs/complex operations
• Benefits of IA to the CU
• Making the argument

5
Creating the IA Function

• Who to hire?
• NCUA SC Guide 6.05
• Sharing?
• Qualified Individual
• From within?
• Other FI Auditor
• External Auditor/Examiner

6
Creating the IA Function

• Candidate qualifications
• NCUA SC Guide 6.05
• Academic credentials and/or technical
  training/proficiency
• Commitment to CPE
• Well developed communication skills
• Independence

7
Creating the IA Function

• CAE on the Org Chart
• Independence Issue
• NCUA AIRES Q1
• Direct report to SC
• Free from BOD Mgmt. undue influence

8
Creating the IA Function

• CAE on the Org Chart, contd
• Functional report to SC
• Dotted (administrative) line to?
• Proper authority for CAE?
• Under managements thumb?

9
Creating the IA Function

• Audit Charter
• 1st order of business
• Document independence
• Document reporting structure
• Full, free, unrestricted access (to everything!)
• Confidentiality!

10
Creating the IA Function
11
Creating the IA Function

• Charter, contd
• CEO notification
• SC approval
• BOD meeting
• Both chairs signatures

12
Creating the IA Function

• Audit Plan
• CAE meetings with EMT
• Materiality determination

13
Creating the IA Function

• vvgg

VS.
14
Creating the IA Function

• Audit Program Sources
• ACUIA Interactive Audit Guide
• NCUA AIRES Checklists
• Subscription Services

15
Creating the IA Function

• Employee Relations
• CU existed before
• They may not like us
• SC assistance

16
Creating the IA Function
17
Creating the IA Function
18
Creating the IA Function

• First Audit!
• Prior CAE communication of process
• Audit Report format
• Grading system

19
Managing IA
20
Managing IA

• SC performing IA tasks?
• Duplication of efforts
• Transition out
• SCs decision

21
Managing IA

• SC Meetings
• Frequency
• (New?) Format
• Who sets agenda

22
Managing IA

• SC Monitoring
• CAE Goals
• SC CAE ongoing communication
• Open lines of communication

23
Managing IA

• Reports to SC
• IA Reports/Responses
• System Reports
• External Audits
• Others?

24
Managing IA

• RFPs
• External Financial Statement Audits
• System Vulnerability Assessments
• Other outsourced
• IA research
• SC approval

25
Evaluating IA
26
Evaluating IA

• CAE Performance Evaluation
• Whose responsibility
• Management input?
• Goals establishment
• NCUA/External Audit IA comments

27
Evaluating IA

• Status Updates
• Quarterly status of plan vs. actual
• Action item status

28
Evaluating IA

• Audit Plan
• Annual presentation to SC
• SC approval
• 4th quarter materiality assessment

29
Questions