Comptroller of the Currency

Administrator of National Banks

Outsourcing Your Audit Function

Wednesday, April 3, 2002

11:00 a.m. -- 12:30 p.m. EST

Presented by:

John D. Hawke, Jr.

Zane D. Blackburn

Mark Blair

C. Scott Schainost

Robert T. Riordan

Wynne E. Baker

**Mr. Dalton**: Hello and welcome to today's virtual seminar sponsored
by the Comptroller of the Currency, Administrator of National Banks. I'm
John Dalton, and I'm coming to you from KRM's Virtual Seminar Services
Operation Center located in Eau Claire, Wisconsin, where we provide
production services for distance learning programs.

Today's program will be 90 minutes in length, and you will have several
opportunities to ask questions of today's speakers a little later on in
the program. I will instruct you on how to do that when we reach that
Q&A section. If you prefer to fax in a question as opposed to asking it
on the air, so to speak, you can jot that question down at any time. You
can fax it to 715-833-5469, and we will bring those questions up during
the Q&A section. Again that fax number for questions is 715-833-5469.
Also you will be asked several polling questions during today's program.
We will tell you how to respond when we get to our first poll question.
You need to know that your responses are totally anonymous.

Now this program is sponsored by the OCC. However, the views of the
outside presenter do not necessarily represent the views of the OCC.
Additionally, some handouts are given as examples only and are not
endorsed by the OCC. Now the audience is in a listen only mode
throughout the program, except when individual lines are opened up for
questions. So the speakers and other listeners cannot hear any audio
from your site during the seminar. If you are listening on a
speakerphone and if it has a mute or a mic-off button, it is usually a
good idea to press that button on your speakerphone. Some units will
clip off the incoming audio when they detect conversation or noise in
your room. If you inadvertently become disconnected during the program,
you can dial back immediately using the same PIN you used when you first
dialed in. I should also mention that today's program is being recorded.

Now before we begin I mentioned that we would conduct a few polling
questions. And we would like to conduct our first poll question now.
Using your touch-tone keypad, here is the question, "Would you be
willing to pay \$25 more per telephone seminar to use web conferencing?"
Examples of web conferencing capabilities include a speaker annotating
slides, working with a file and visiting a website while presenting
material or using a white board to illustrate a concept or display a
diagram. So again, "Would you be willing to pay \$25 more per telephone
seminar to use web conferencing?" We would like you to press 1 on your
touch-tone keypad if the answer is yes. We would like you to press 2 if
no. We would like you to press 3 if you have no opinion on that
question. Thanks for participating in our polling question.

Today's Comptroller of the Currency, Administrator of National Banks
seminar is Outsourcing Your Audit Function. Our faculty includes Zane
Blackburn, who is Chief Accountant of the OCC\'s Office of the Chief
Accountant; Wynne Baker, who is Chairman of the American Institute of
Certified Public Accountants; Mark Blair, who is a national bank
examiner in the OCC's West Virginia field office; Robert Riordan, who is
a national bank examiner and OCC district accountant; and Scott
Schainost, who is an assistant deputy comptroller at the Wichita field
office.

At this time, it is my pleasure to turn the program over to the
Comptroller of the Currency Jerry Hawke.

**Mr. Hawke**: Welcome to the latest in the OCC's continuing series of
telephone seminars. Those of you who have been with us before, welcome
back. Our goal of arranging these sessions is to deliver
up-to-the-minute state-of-the-art guidance on a wide variety of
supervisory issues. And to do it in a way that is most cost effective
and convenient for you. We have received positive feedback from hundreds
of participants in our previous telephone seminars, and I am confident
that this two-day session will turn out to be an equally rewarding
experience for you. I can scarcely think of a more timely topic than the
one at hand.

Although it is a common fallacy that bank examiners and independent
auditors do the same jobs, we do share some things in common, examiners
like auditors have generally worked out of the public eye. The
independence and integrity in that of the accounting profession have
always been assumed. Lately, however, the headlines have been full of
reminders of the importance of high auditing standards and rigorous
internal controls, especially for financial institutions. These are
challenging times and in such times a robust internal control structure
is crucial if banks are to avoid the kinds of problems that could
readily pose a threat to their viability. Strong internal controls are
essential to provide management with accurate assessments of a bank's
risk profile, and the internal audit function is a critical component of
an effective controls environment.

For community banks, the challenge is to create and maintain an
effective internal control regime within the resource constraints under
which such institutions typically operate. An increasing number of
community banks are contemplating outsourcing the internal audit
function or to a greater or lesser degree have already done so. Our
telephone seminar today is directed to both groups.

As many community banks have already discovered, outsourcing internal
audit can offer significant benefits. Outsourcing can provide technical
audit expertise in specific areas, such as online banking, merchant
processing, and fiduciary activities. In-house internal auditors do not
have to be experts in every area, if banks can purchase that expertise
externally. Turning to outside providers can also help community banks
manage sudden workload shifts in the audit area. Practices differ. At
some community banks, consultants perform all or the majority of the
internal audit work. At other institutions, outsiders supplement the
bank's own audit staff.

Either way through outsourcing, banks can maintain a more robust
internal audit capability than they can otherwise afford. Yet there are
pitfalls for banks using nonemployees to perform the internal audit
work. Our seminar will focus on these risks as well. There are the
obvious risks in using the same firm for both internal and external
audit. We have a strong predisposition against the outsourcing of the
internal audit function to the same firm that performs the external
audit, although we do recognize that some smaller community banks may
not have a great range of choices.

Controls must be put in place to ensure the independence of the overall
audit function, and an outsourced internal audit function must be
properly coordinated with the bank's ongoing risk management system. How
community banks can address these issues and ensure the reliability of
their internal audit and controls systems will be among the topics we
will cover in this seminar.

All of our telephone seminars have been predicated on the belief in the
importance of good communications between regulators and the industry.
Our common interest in a safe and sound banking system requires that we
understand each other's needs and perspectives. I believe that our
ability to exchange views and information in forums like this one
materially advances those goals. I wish you a successful seminar.

**Mr. Dalton**: Thanks, Jerry. I will now turn the program over to Zane
Blackburn who will give us an update on regulatory activities and
perspectives. Zane, welcome to the program.

**Mr. Blackburn**: Thank you, John. Good afternoon, I'm Zane Blackburn,
the OCC's Chief Accountant. It is a pleasure once again to welcome those
who participated in the previous sessions and those new participants
from all around the country to part three of the OCC's Audit Roundtable
series. The primary purpose of these Audit Roundtables is to reemphasize
the importance of strong audit and internal control programs. In light
of the recent events involving questions of auditor adequacy, auditor
independence, and costly fraud, this reemphasis has taken on a greater
importance. These sessions also seek to improve the lines of
communication between banks, examiners, and auditors in an effort to
obtain a better understanding of each other's audit approach. This is
due, in part, not only to the recognition of recent events, but also to
the fact that our examinations have identified an increasing number of
audit and internal control deficiencies at many national banks. The
previous sessions focused on risk assessment, internal controls, audit
work papers, and audit committee reporting. Today's Audit Roundtable
will focus on outsourcing a bank's audit function. Banks actually
outsource this function for a variety of reasons, but the two most
predominant are access to expertise and cost considerations. Both of
these are legitimate and often compelling reasons. However, management
and the board of directors must not lose sight of the fact that it is
their responsibility to ensure that the bank has an effective internal
control system and audit programs that are effective in safeguarding
assets, assisting in the timely detection of operational errors, and
producing accurate bank records and financial reports. Individuals and
firms outside the bank can assist management and the board in fulfilling
these responsibilities, but these responsibilities cannot be outsourced.
Our speakers today will focus on effective and efficient ways banks can
use outside firms to assist management and the board in accomplishing
their audit oversight responsibilities. This will include an overview of
the statutory audit requirements; OCC expectations of bank audit
functions, including those that are outsourced; factors used in
assessing the audit function; and many of our examination findings from
our audit reviews. They will also highlight initiatives undertaken and
available resources to best achieve assistance in outsourcing. Before I
begin I will provide some insight on potential changes that may affect
outsourcing arrangements resulting from the Enron situation. These
changes may take the form of revisions to the banking agency's policy on
internal audit, new federal legislation, and revised independence
requirements from the Securities and Exchange Commission or the
accounting profession. As many of you may be aware, the agency issued
our joint statement on internal audit, including guidance for
outsourcing arrangements in late 1997. This guidance, which is included
in your handouts, provides some characteristics of sound practices for
the internal audit function and the use of outsourcing vendors for audit
activities. In addition, it provides guidance on how these outsourcing
arrangements may affect an examiner's assessment of internal control.
This policy statement also provides specific guidance on internal audit
outsourcing when the outsourcing arrangement is to the bank's external
auditor. In these situations a question may arise about whether
performing both functions may compromise the external auditor's
independence. The accounting profession addresses potential problems
through the issuance of ethics rules by the AICPA. These rules were
referred for guidance in the agency's policy statement. However, in the
latter part of the year 2000 the Securities and Exchange Commission
issued new independence rules for public companies. These rules provided
for specific limitations in the percentage amount, 40 percent of
internal audit services, that could be provided by the institution's
external auditor without compromising the auditor's independence. The
rules did provide, however, an exception for institutions under \$200
million in assets. As a result of the SEC's independence rule changes,
the banking agencies have been drafting revisions to the agency's policy
statement on internal audit. These changes would have incorporated many
of the SEC's new rules. In light of the Enron situation, however,
additional changes to the policy statement are likely. As Jerry said,
the OCC has always discouraged the bank's from outsourcing internal
audit procedures to the bank's external auditors. We have done this
primarily for two reasons: one reason is the potential for compromise of
the external auditor's independence; secondly, the provision of an
additional check when different people and a different firm perform the
audit procedures. In the past, the OCC has not taken the next step by
actually prohibiting this practice, but that may change in the near
future. There are a number of bills before Congress that would actually
accomplish this.

Included in your handouts are summaries of two of these bills: one
introduced by Oxley and Baker; and the other by LaFalce and Gephardt.
Although the final law may be different from these bills, both share a
common provision. They prohibit the outsourcing of internal audit to the
institution's external auditor. Other entities are also working on
provisions to ensure the auditor's independence. The SEC is likely to
change its independence rules either voluntarily or as the result of new
laws. The AICPA has already indicated, it would not oppose similar
prohibitions. Wynne Baker will address the AICPA's response in more
detail.

For community banks, such a provision may create a hardship if applied
to their institutions. We recognize that many community banks under
\$500 million in assets are not required to have an external audit, yet
more than 70 percent actually do. Many of these institutions currently
outsource some of their internal audit procedures to their external
auditors. This may be due, in part, to the fact that more than one
qualified bank auditor is not available in their locality. Selecting a
qualified auditor from a different locality to perform one of the
functions may add considerable cost in comparison with one firm merely
performing both. Hence, this may put a bank into a dilemma of having to
eliminate either the external audit or the performance of many internal
audit procedures, if it does not have qualified staff. This is a dilemma
in which we prefer not to see banks, because we believe both functions
contribute to ensuring a bank's safety and soundness. Hence, any rules
we issue will attempt to overcome this potential dilemma.

In any event, once we complete our proposed revisions to the policy
statement, while recognizing any changes enacted by Congress, we will
certainly seek your comments through a public comment process.

Before our next speaker begins, let me thank all of you that have
participated in the previous calls and provided insightful comments
through the seminar evaluation form. As you will notice these comments
caused us to change this seminar call substantially and your further
comments will assist us in developing future seminars. Now let me turn
it back to John before Wynne Baker shares his perspective as an audit
practitioner and representative of the AICPA. John?

**Mr. Dalton**: Thanks, Zane. And we will take time now to do our second
polling question. And our second question is this, "Does your bank
currently outsource the internal audit function?" We would like you to
press 1 on your touch-tone keypad, if "No." We would like you to press 2
if, "Yes, but only partially." We would like you to press 3 if, "Yes,
entire function is outsourced." Again that question, "Does your bank
currently outsource the internal audit function?" Press 1, if "No."
Press 2 if, "Yes, but only partially." Press 3 if, "Yes, entire function
is outsourced."

And now I will turn the program over to Wynne Baker for the AICPA
perspective. Wynne?

**Mr. Baker**: Thank you, John. And thank you, Zane. It is my privilege
to be part of this. I'm Wynne Baker, banking partner of KraftCPAs in
Nashville, Tennessee. It is our privilege to represent the AICPA on this
important issue. To follow up on a point that Zane made earlier, the
AICPA, along with the SEC and others, are looking at independent rules.
The AICPA will not oppose anything that the SEC, the bank regulators, or
Congress do in the area of outsourcing to separate the function between
two firms. In our practice we've worked with a number of community banks
over the years for which we've done external and internal audits, and we
have never done external and internal for the same bank.

My handout for those of you who are following along is on page 13 of
your materials, and I will cover the potential benefits of outsourcing.
A couple of points in terms of dealing with outsourcing from our
perspective: we have always worked through management with a board or
the audit committees, but ultimately the audit committee is responsible.
We always have a contract of what we will do or not do. But I will try
to elaborate on several of the benefits that Zane mentioned earlier.
Economic efficiency is gained by using an outside firm to do
outsourcing. Payroll costs can be saved. Training costs can be saved,
plus you have a more flexible staff and a wider experience using
outsourcing to ensure that the bank has covered its needed area of
controls and audits. Also in using an external audit firm or some other
type of provider for the outsourcing, you pick up additional complex
expertise. Sometimes banks decide to go into Internet Banking or Trust
or do some type of an investment or an SPE, and they need expertise and
training that maybe the internal audit staff does not have. This is very
much of a benefit to be able to bring those additional expertises. The
workload for the internal auditor also sometimes increases, and maybe
the bank merges or acquires a business or a new segment that the
internal auditor may not have the staff to cover. This is a benefit for
the outsourcing provider, and maybe even the bank might consider having
a second outsourced provider to be able to do some expertise, plus one
of the other benefits is profiling and identifying the audit risks
involved. In using the outsourced firm, you may get a different
perspective of the risks as we go through and identify the high risks,
the medium risks, and the low risks. It is important to have a different
perspective and to make sure that those risks are appropriately
identified and that the audit committee and management cover those risks
so that they are focusing always on a risk assessment.

Again it is my privilege to be part of this, and I'm happy to be
involved in the Q&A at the end. John, I'll turn it back to you.

**Mr. Dalton**: Thanks, Wynne. We will now conduct our third poll
question. This question is, "If your bank currently outsources any of
the internal audit functions, do you use the same firm that conducts the
external audit?" We would like you to press 1, if "No." We would like
you to press 2, if "Yes." Again the question, "If your bank currently
outsources any of the internal audit functions, do you use the same firm
that conducts the external audit?" Again press 1, if "No." Press 2, if
"Yes."

I'll turn the program over to Rob for the objectives of the internal
audit. Rob?

**Mr. Riordan**: Thanks, John. Now we will get into some of the nuts and
bolts relating to internal audit from a regulatory perspective. We will
keep this short and sweet, but it is necessary to review in order to
ensure that we are all on the same page in terms of background and
expectations.

In the late 1980s Congress required the OCC to establish certain safety
and soundness standards that would be applicable to all national banks.
So the OCC developed a regulation in order to comply with this
congressional mandate. That regulation was 12 CFR 30. Now part of that
regulation deals with the internal audit system. I refer you to page 14
of your handouts that lists seven necessary elements for a functional
internal audit system. I won't detail each item, but essentially it
requires the internal audit function to be independent, have reasonable
testing and follow-up procedures, and include a reporting structure that
goes directly to the board of directors or the board's audit committee.
We have a whole host of guidance available to banks that further details
our expectations and hopefully clarify various questions that have
developed over time at our national banks. But please note that in all
of our guidance the expectations are within the context of the bank's
size, scope, and complexity of operations. We are not looking for, nor
suggesting, a cookie cutter approach to the internal audit process. We
do not expect smaller, less complicated banks to have the same processes
as the huge institutions. The primary guidance, to which I refer you, is
listed in the handout on page 14 underneath the heading "Available
Resources." It should help you understand our expectations and hopefully
address questions you might have relating to the structure and reporting
of the internal audit function.

I might mention four handbooks that you might find informative. For
instance in a community bank, the typical process an examiner may go
through is to first review the *Community Bank Supervision Handbook*. If
more detail is necessary to complete the program they would refer to the
*Internal/External Audit Handbook* or perhaps the *Internal Control
Handbook*. Now in addition to the handbooks, there are various issuances
and other sources of information available. The best quick and dirty
resource outside the handbooks is OCC Bulletin 98-1, to which Zane
referred, and Memorandum 2001-1, which provides clarifying guidance to
98-1. Now I might mention that 98-1 is the first item in the appendix of
your handouts on page 24. The 2001-1 issuance came about, because of the
number of questions that you as bankers had about our renewed emphasis
on audit and frankly because we examiners weren't sure ourselves. So the
DC policy folks decided to provide some further information. This is all
available through our website. The address for the website is on the
slide on page 14. Please look at these resources as tools for your use.
They are our first reference when we, as examiners, have questions, and
I believe they can be a valuable resource for you as well. As always,
feel free to contact the examiner who is portfolio manager of your bank.
He or she can help you with questions relating to your bank's specific
internal audit process. If the examiner cannot help you directly, he or
she has access to resources and expertise that should get you the answer
you need.

Now we will shift gears a little. And turn this over to Mark and Scott
to discuss the best practices that we see in examinations, common
findings, and some other areas. But before I do that, it is important to
us participating on this panel to deliver to you what we advertise. If
you get a chance, look over the brochures for this call, and if there is
anything that we don't address to your satisfaction during our prepared
comments, please ask us for a clarification during the Q&A session.
John, I believe I turn it over to you before moving on to Mark.

**Mr. Dalton**: That's correct because we have another polling question.
Our next question is this, "Does your bank plan to initiate a new, or
expand an existing, outsourcing program within the next two years?" We
would like you to press 1, if "No." Press 2, if "Yes." Again the
question, "Does your bank plan to initiate a new, or expand an existing,
outsourcing program within the next two years?" Press 1 on your
touch-tone keypad, if "No." Press 2, if "Yes." And now I will turn the
program over to Mark Blair to discuss an effective audit structure.
Mark?

**Mr. Blair**: Thank you, John. My name is Mark Blair and I'm a national
bank examiner who examines community and mid-sized banks. Both of the
banks I now supervise use outsourced internal audit functions. My topics
will include: how the OCC performs an assessment of the outsource
function; what we expect to see in an effective audit structure; the key
provisions of an outsourced audit; and finally, I wanted to mention a
new initiative where we perform centralized audit reviews. My slides on
all these topics start on page 15 of your handouts. I have personally
examined several banks with poor control environments that have resulted
ultimately in severe problems and in one case failure due to fraud. Many
of these banks have outsourced their internal audit. A common
characteristic in all these banks was the lack of involvement and proper
oversight by the board. We see too many cases where senior management
directs all audit activities. If there is one thing you can take away
from my presentation today, it is that the outsourced audit function
should be supervised no differently than an internal audit function. The
board or audit committee of the board must be actively involved and
supervise it.

First, I want to talk about OCC audit core assessments and some of the
things we focus on when we review audit. Our review of audit and the
control function is performed during every supervisory cycle. This will
normally be every 12 or 18 months depending on the size and complexity
of your bank. We attempt to conduct the review early in the supervisory
cycle as part of our preplanning efforts. During the onsite exams, we
evaluate the adequacy of the audit program primarily to ensure that
control weaknesses are assessed and deficiencies are corrected. Part of
our evaluation includes a review of selected work papers, typically of
high risk areas or new products. We also validate the follow-up on
findings by holding discussions with bank management and testing
transactions of impacted areas. This helps us leverage our resources and
limits reviews of other areas. On the other hand, if we find weak
controls we will increase testing as necessary. The findings will allow
us to form the basis for the overall assessment and audit rating. We
expect experienced examiners to perform these reviews because of the
judgment necessary to evaluate an adequate control structure. In the
mid-80s, we used to place a lot of emphasis on internal controls and
audit. In the last two years, the OCC has begun properly to reemphasize
the importance of audit and internal controls due to several recent bank
failures caused by fraud. I was talking to one of OCC's fraud experts
today, and it was interesting to note that half of the bank failures
from 1997 to 2000 had evidence of fraud. Since 2000, there was fraud in
more than one third of the bank failures.

Now let me describe what we typically see in an effective audit program.
First, there should be direct reporting to the board or audit committee
on a regular basis by an assigned internal audit manager. The
information should be in a format that directors can understand and can
use to monitor controls and to evaluate the audit's effectiveness. Last
year we had one community bank in which the internal audit reports were
sent directly to the CEO. This bank did not have an audit committee and
the board never asked for the reports. The audit reports disclosed
significant control weaknesses throughout the bank. When the board was
notified, the CEO was fired, and the bank remains under an
administrative action even today. In this case, if the board had more
expertise and was more actively involved, it could have prevented a
trouble situation.

Next, there should be a formal assessment of control risk. This
assessment should help establish the audit scope, audit cycles, and
allocate resources. Ideally, you should see a formal assessment of
various business activities and the identification of potential risk due
to control deficiencies. These plans should be updated to reflect
changes in work processes or to incorporate a new line of business. The
analysis would depend on the complexity and size of your bank. For
example, we had one bank in which both the internal loan review and the
audit firm thought the other party was verifying collateral. The bank
had a large construction loan secured by accounts receivable. The loan
officer did not monitor the credit adequately. There were prior liens on
the receivables that were unknown to bank management. The borrower grew
too fast, and many of the receivables were not collectible. Eventually,
the borrower declared bankruptcy, and there was a significant
charge-off. If this area was reviewed and audit had detected this
deficient bank\'s procedures, perhaps it could have saved this bank a
lot of money.

My point is the board must be involved and ensure that control risk is
identified. There should also be formal audit plans setting out the
timing and frequency of audit work. I had one bank that used a
co-sourced arrangement and would wait until the fourth quarter every
year to complete the higher risk audits. The audit manager did not
complete the audit plan until July of each year. As you can expect, the
plan should be done early in the year, monitored by the audit committee,
and updated as necessary. There should also be individual work programs
for each area audited that document audit objectives and scope, the
procedures used, the risk assessments, findings and conclusions.

Through my examinations, I have asked the OC of significant functional
areas to review the work papers, since they are most familiar with that
particular area. One of the common issues we find is lack of adequate
documentation that explains sampling methods. For example, if there were
weak controls, you would expect the sample sizes to increase. Overall,
the audit manager should certify to the board that they have reviewed
the work papers.

Audit reports should include purpose, scope, conclusions,
recommendations, and management's response. Some of the weaknesses we
see include the lack of an overall conclusion and inadequate management
responses. By responses we mean actions taken to correct deficiencies,
not explanations to mitigate the findings. In other words, the reports
should address the root causes and responses should not merely explain
away the deficiencies. The key that I have always found is the culture
of the organization and how the CEO and the board make employees
accountable. We would also expect to see follow-up audits to check the
progress of management's corrective actions in addressing any noted
weaknesses. It is important to note that we look to the board typically
through the audit committee to correct all material audit deficiencies.
We also think it is very important for the audit committee to track
follow-up for all regulatory deficiencies. These actions will promote
accountability and help ensure corrective action. For example, we have
one community bank that acquired another institution with significant
control weaknesses. The audit committee was very active. And the audit
committee chairman signed off on responses for management. In this case,
since the employees knew the directors were involved, they wanted to do
their best. This prompted corrective action by having the direct
involvement of a director.

Finally, the audit function should be supervised by a staff of qualified
people. We typically see a lack of understanding in the more complicated
areas, such as asset liability management and information technology. In
addition, it is difficult to find board members experienced in financial
matters, especially in our smaller community banks. The audit committee
needs to ensure the outsourced staff has the proper expertise to meet
the needs of the bank. The board also needs to ensure that the audit
committee members are accounting literate, so they can ask management
and the auditors the right questions.

In summary, the outsourced or co-sourced internal audit should encompass
these key provisions. Although a bank may prefer to outsource its
internal audit work, directors must maintain ownership of the overall
function. This is critical to have an effective process. In other words,
has the board approved appropriate plans, policies, programs, reporting
lines, and review processes? Are there management information systems in
place to monitor internal audit performance and timely corrective
actions on noted control weaknesses? Finally, is line management held
accountable if they do not follow-up on control weaknesses?

On page 41 of your appendix, I have included a handout entitled,
"Request for Proposal for Internal Audit Services." This provides you
with a good example of what kind of areas you should consider when
hiring the firm to perform outsourced services.

Next the internal audit manager should act as a point of contact between
the bank and the vendor. Ideally, this person should not have
operational responsibilities. For example, we have one bank that uses
the CFO as the audit manager. This is the situation that we discourage,
but many banks say that since there are no other employees with
sufficient experience, we expect the audit committee to closely
supervise these situations to ensure there is adequate independence.

On page 46 of the appendix, I have included a handout called internal
audit satisfaction survey. This form provides the audit manager or audit
committee feedback on the outsourced audit work. There also must be
clear reporting lines of responsibilities. The results of the outsourced
work must be well documented and promptly reported to the board or the
audit committee. We had one community bank in which the audit committee
was made up entirely of the controlling owners of the bank who were also
bank officers. The OCC issued letters outlining concerns about a
potential *Ponzi* scheme on one of their largest borrowers. These
letters were never furnished to the outside board members or to the
outsourced vendor, since the controlling owners were involved in the
scheme. The borrower ended up declaring bankruptcy, and there were large
loan losses. This is a clear example of how important the reporting
lines must be. You need experienced audit committee members, who are
independent of bank management, to oversee the process. We would also
expect to see due diligence by the audit committee or audit manager
regarding the qualifications, competence, and experience of the vendor
to do the job. On page 45 of the appendix, there is a handout entitled,
"Internal Audit Quality Review," which provides you with an excellent
example of what factors should be considered.

Another key provision is the independence of the vendor, especially if
it is an audit firm that also performs the bank's financial statement
audit. As Zane mentioned earlier, the OCC discourages banks from
outsourcing internal audit work to the same firm that performs the
financial statement audits. Unfortunately, due to cost and lack of
availability of qualified firms, this is a common occurrence in many
community banks. We were talking about this issue last week, and none of
us have ever seen where an external firm actually criticized the work of
the same firm who performed the internal audits.

The last important point is that all national banks, outsourcing
internal audit activities, must execute a written contract with the
outsource firm. The contract should outline the terms of the outsourcing
arrangement and specify the roles and responsibilities of both the bank
and the vendor. The specific requirements are outlined under OCC 98-1,
which is included on page 24 of the appendix in your handouts.

The contract should address two significant areas: the contract should
set the scope and the frequency of the audit firm's work and the
contract must give OCC examiners immediate and full access to all
outsourced audit reports, programs, and work papers. Generally, the
contracts have recently covered all the areas in our issuance. The most
common deficiency is the lack of a clearly defined scope.

My last topic is centralized audit reviews. The OCC has recently started
performing some centralized reviews of outsourced vendors. We expect
several benefits from conducting a centralized review. Primarily, the
OCC should be able to gain efficiencies by reducing the burden on the
bankers and third party vendors by doing a work paper review for several
banks for one time. In addition, our results should be more consistent,
since reviews will be conducted using one team of experienced examiners.
During these reviews, examiners will determine the reliability and
effectiveness of the outsourced audit activities, using the results to
help scope out the onsite examinations. These reviews will not be a
substitute for the work examiners must do at the onsite examination to
fully assess the audit function. In addition, it will not eliminate the
need to review sample work papers for each bank during every supervisory
cycle. Centralized audit procedures will be included in our revised
audit handbook. Now Scott will discuss best practices for outsourced
audit reviews. Scott?

**Mr. Schainost**: As the assistant deputy comptroller in Wichita,
Kansas, I supervise approximately 50 community banks in southern Kansas
and northern Oklahoma, along with 17 examiners. The total assets of the
banks under my supervision range from \$7 million to \$2 billion. Since
we primarily have community banks on the line, I would like first to
share some best practices we see in our banks regarding audits. These
comments are outlined in the slides beginning on page 18. The audit
structuring community banks can be grouped together in three general
categories, banks with assets under \$100 million, \$100-500 million,
and banks with assets of more than \$500 million. Let's start with the
smallest group and work up.

In our smaller community banks with strong audit programs, you generally
see full compliance with 12 CFR 30, as Rob outlined. These banks have
good internal controls completed by qualified employees. There is
segregation of duty, effective loan review, proven compliance management
systems, and periodic verification that internal controls are being
completed and remain effective. Actual internal audit programs that we
see in these smaller banks are usually limited. They consist more of
consolidating internal controls into one person rather than a
traditional audit program. Any outsourcing of an internal audit in these
banks is usually loan review or compliance. External audits consist of a
director's exam or a financial statement audit. Our banks with strong
audit programs have expanded the scopes of these external reviews to
include a review of insider transactions and an assessment of the
adequacy of internal controls. This assessment of internal controls is
what is required by FDICIA for banks with assets of more than \$500
million. The board, in its leadership role, normally addresses the
external audit findings and ensures timely follow-up on any weaknesses
noted.

Now once the bank reaches around \$100 million in assets, it usually
finds it can afford it's own internal auditor. In addition to good
internal controls we see in all banks with a strong audit program, the
internal auditor in these banks does a separate verification to ensure
that employees are following bank policies, that internal controls
remain effective, and that management is addressing noted weaknesses in
a timely manner. The internal auditors are qualified and report directly
to the board or an audit committee of the board. In some of our banks,
the consumer compliance management program in loan review also report to
the internal auditor, creating this overall independent risk assessment
center for the entire bank. We see banks at this level looking to
outsource part or all of their internal audit function to save money or
ensure expertise. In your handouts starting on page 37, you are provided
the "Outsourced Audit" section of our soon- to-be-released
*Comptroller's Handbook*. Although it is still in draft form, it answers
many questions on what an outsource engagement letter should contain and
provides good guidance on supervising the outsourced arrangement. We
frequently remind bank boards that, although outsourcing the audit work
is an option, they cannot outsource the responsibility or oversight. A
best practice we have seen is when the bank has outsourced some of the
audit work due to limited bank personnel or lack of expertise. The
outside firm provides its findings to the bank's internal auditor, who
incorporates them into an overall audit report to the board. Management
follow-up is monitored by the internal auditor. Even though these banks
are under \$500 million in assets, most voluntarily receive a full-blown
external audit that complies with 12 CFR 363. This means that most of
these banks have an external financial statement audit that is prepared
by an independent public accountant; follows AICPA and SEC independence
rules; and attests to the adequacy of internal controls. In this group
of banks we also see new products and new services being offered, while
it is seldom we see any real new nontraditional products, the new
products or services are new to the bank. Since we expect the bank to
have adequate measuring, monitoring, and controlling risk systems in
place prior to the actual offering of the new products, many banks have
used outsourced audit firms to help them set up appropriate risk
management controls. These outsourced firms should have the experience
and expertise to assess the risk in the new products and are frequently
different than the bank's current audit firm. We have had several banks
that have relied on their current outsourced internal auditors to assess
the bank's new trust department or Internet banking product, even though
the auditors had little to no experience reviewing these specialized
areas. After the bank experienced some losses from poor operational
controls, the bank discovered that a CPA designation alone doesn't mean
a person is qualified to audit all specialized areas of a bank. The best
practice that we see, as Mark mentioned, is when the bank performs
appropriate due diligence, reviews the auditor's experience, and spends
some time in selecting the right firm. In the Internet banking and
information technology areas, some firms have actually specialized in
certain software/hardware vendors.

Now, banks with total assets of more than \$500 million are required by
law to have adequate internal and external audits. Rob and Mark have
already discussed what we expect to see in these banks and our
expectations regarding board supervision over outsourced audits. The
slide on page 20 briefly outlines the requirements of the external
audit.

I would now like to touch on our examination conclusions regarding the
bank's audit program. Examiners assess overall audit systems as strong,
satisfactory, or weak. As previously noted, a small bank without an
internal audit program, but with a satisfactory or strong internal
control system, can be rated as satisfactory. Examination conclusions on
audit are factored in through our CAMELS ratings, especially the
composite and management component rating, into the specialty ratings,
such as information technology, consumer compliance, and asset
management, and into risk assessment system ratings primarily on
transaction risk and compliance risk. All reports of examination contain
some comment on the adequacy of audit. Comments may be short and sweet
if everything is okay, or maybe contained in a separate comment in some
reports. A matter requiring attention may be used, if there are
significant issues warranting the board\'s immediate attention.

On page 21, the two graphs indicate over the course of 2001 the total
number of audit and internal control matters requiring attention and
recommendations noted during our examinations. Exhibited is a steady
increasing trend with some leveling off over the third and fourth
quarters. Approximately 10 percent of our reports include a
recommendation or matters requiring attention to strengthen the bank's
audit program.

The next graph shows that most of the audit issues noted are so shaded
with audit scope or board oversight of the audit function. Scope issues
continue to center around insufficient or lack of review of information
technology, compliance or trust, or insufficient audit procedures for
assessing internal controls. Oversight issues center around board\'s or
audit committee\'s failure to follow up on internal reported weaknesses,
to establish an internal audit program or policy, and to oversee
properly the outsourced internal audit vendors and activities. Internal
control matters requiring attention continue to center around the
general areas of segregation of duty and reconciliations, with lending
and more transfer areas being routinely mentioned. I heard of one bank
that has more than \$200 million at risk, because of failure to
reconcile its different accounts over an extended period of time. They
only found out about a cashier that has been embezzling money over the
last three years to the unposted items. My point is that people are
still stealing money the old-fashioned way, and banks know the proper
controls to limit these risks. Unfortunately, many bank's audit programs
do not test to ensure that these basic internal controls remain in
place. Matters requiring attention issues are evenly split between banks
with in-house internal audits and banks that have outsourced their
internal audit activities. However, it is interesting to note that most
of the information technology audit deficiencies were cited for banks
that outsourced their information technology audits. Although improving
trends are noted, findings indicate the need for examiners to continue
to stress the importance of having strong audit and internal control
functions in our banks. In particular, we should focus on the
responsibilities and accountabilities of the bank's board of directors
and audit committee for proactively overseeing and managing internal
audit functions and activities, especially those outsourced to other
parties and those related to information technology.

Overall findings indicate a need for a more concerted effort on the part
of banks and vendors to become familiar with the issues Mark discussed
and to adhere to the guidance provided by our handbook and the
interagency policy statement on internal auditing and its outsourcing.

At this point I'll now turn the presentation back to Rob.

**Mr. Riordan**: Thanks, Scott and Mark. Now we will take a minute to
summarize the comments up to this point before we head into the Q&A
session.

Early in my examining career I had a manager who was good at helping us
younger examiners pull together wide-ranging issues from an examination
and funnel them down into a clear summary for presentations to the
boards of directors. This advice always stuck with us when he said to
leave the audience with no more than three primary things to remember.
Well, I must admit now, with the benefit of hindsight, that I realize he
was really telling us that we never had more than three interesting
things to say anyway. So here are the three things with which we would
like to make sure you leave this conference call.

We are on page 22 of the handout. Number one, a strong internal audit
system is essential to an effective overall risk management system.
Identifying and quantifying risk in your bank can be difficult and at
times an esoteric process. Effective financial and operational controls
combined with a robust internal audit system to validate those controls
are the foundational building blocks of a good risk management
structure. We encourage you to continually assess and improve these
building blocks to ensure the health and vibrancy of the entire bank.

Number two, outsourcing may be a valuable tool for enhancing the
internal audit system. Outsourcing is not a dirty word. We don't want to
leave you with any indication that the OCC is against the concept of
outsourcing. We believe that our experience with a variety of
institutions validates that banks can successfully outsource a part or
all of the internal audit function. We see many situations where banks
need efficiencies, technical expertise, and economies of scale in a
carefully crafted and closely monitored outsourcing program.

Finally, number three, best practices begin with the board of directors.
As Mark stressed in his comments, outsourced internal audit should be
supervised by the board or an audit committee of the board. The primary
reason for problems in outsourcing arrangements has been the lack of
proper oversight by the board. If the board or audit committee assigned
supervision duties to an internal audit manager, that person must be
competent and have clear reporting lines and responsibilities.

When I was examining in the mid-1980s, the compliance function was
beginning to take on a new prominence, and we were encouraging each bank
to designate a compliance officer to oversee the compliance function. In
reality what was happening at a many institutions was that a job was
being assigned to the most junior loan officer available. It came across
something like: \"Congratulations on being hired here at First National.
You are now an assistant vice president and a compliance officer.\"
Usually, there was no training and only a fuzzy job description. When we
would subsequently come in to examine compliance, we were lucky if the
poor guy, through no fault of his own, could even spell compliance let
alone know what the duties and responsibilities entailed. This can't be
the case for designating an audit manager. If you choose to have an
outsourcing program, that person has to have a decent financial
background, a strong understanding of what the duties entail and the
*gravitas*, if you will, to be able to manage the function and report
competently to the board.

So again, the three things are: A strong internal audit system is a
must; outsourcing may be an option to consider; and finally, the board
must take the leadership role.

Again, please do not hesitate to call your local OCC office, if we can
be of help. I believe that wraps up our prepared comments. I will turn
it back over to you, John, before we head into the Q&A session.

**Mr. Dalton**: Okay, thanks, Rob, and we do want to conduct one more
poll question before we do go to questions. We are curious about how
many people are listening in at your site today. Using your touch-tone
keypad, if you are the only one in the office listening to today's
program, simply press 1. If there are two of you in the room, press 2.
If there are three in the room, press 3. And so on up the line. If, by
chance, there were nine or more people listening in at your site today,
simply press 9. And thanks for participating in our last poll question.

Before we open it up for questions, we will give you the results of the
four prior poll questions.

On our first question, would you be willing to pay \$25 more per
telephone seminar to use web conferencing, 54 percent of our audience
voted "Yes" on that question. 26 percent voted "No," and 20 percent had
no opinion on that question.

On our second poll question, does your bank currently outsource the
internal audit function, 20 percent voted for "No." 30 percent voted for
"Yes, but only partially," and 50 percent voted "Yes, entire function is
outsourced."

On our third electronic poll question, if your bank currently outsources
any of the internal audit functions, do you use the same firm that
conducts the external audit, 42 percent voted "No," 58 percent voted
"Yes" on that question.

And the final electronic poll question, does your bank plan to initiate
a new or expand an existing outsourcing program within the next two
years, 62 percent voted "No" on that question and 38 percent voted
"Yes."

Okay, now we will open it up for questions. If you would like to ask a
question, you can do so simply by pressing the number 1 on your
touch-tone keypad. And this will put you into the queue. When your turn
comes up, we will call on you by city and first name. If you are
listening on a speakerphone, please pick up the handset when you ask
your question. We will be able to hear you much better that way. If your
question is answered while you are in line, you can press the #. This
will take you out of the queue. So if you do have a question go ahead
and press 1 now, and you can do this at any time during this Q&A
session. Again if your question is answered while you are in line,
pressing the \# will take you out of the queue before your turn comes
up. So press 1 to get in line, \# to get out of line. And if you joined
us late, the fax number, if you wanted to fax in questions is
715-833-5469. While we wait for people to queue up, we do have a fax
question here. It is a comment on loan review being outsourced to the
same firm doing the external audit. The question is: We are a community
bank of \$111 million in asset size, noncomplex status. The loan review
staff of the audit firm is a different exam audit team, do you see any
issue here? Do you see the value in a loan review if there are no loan
problems?

**Mr. Blackburn**: Scott, do you want to answer that?

**Mr. Schainost**: Yes, that's fine. We don't see a problem with that.
What we would expect is that you have certain controls in place so that
those loan review findings are reviewed by someone else, perhaps
directly by the board or the audit committee of the board. But I do not
see that we would be significantly concerned about that.

**Mr. Blackburn**: This is Zane. I think there can be some concerns, but
I think if those controls, as Scott is suggesting, are in place, I think
that can alleviate many of them. I think one of our concerns, in
particular, is when the external auditor is essentially/potentially
auditing his own work. If he or she is actually or obviously doing some
of the classification and then looking back through the examination of
the adequacy of the loan loss reserve, then I think we would in fact
have a concern there.

**Mr. Dalton**: Okay, we have five callers in the queue. We will go to
Abilene, Texas, for our first caller, which is Scott's location. Go
ahead.

**Texas**: Hi, on page 39 of the material, there is a comment on the
independence of the external and internal auditor. It is the second
sentence after the underlined sentence. It says, "When one firm performs
both jobs, the firm risks compromising its independence by being placed
in a position of appearing to or actually auditing its own work." My
question is: Can anybody on the line give me an example of when, in a
small community bank, you have an external auditor who also is doing the
internal audit function if neither one of those functions is involved in
the implementation of any recommendations made by either the external or
external audit function and there is no policy development by either one
of those two groups, even though they are in the same firm . Can you
give me an example of when there might be auditing of your own work
other than situations that Zane has talked about in loan reviews, but
I'm not really talking that?

**Mr. Blackburn**: This is Zane. I think that is probably the primary
example. I guess I can ask any of our other panelists here, and Wynne, I
think, might have some other indications.

**Mr. Baker**: This is Wynne. I think in this particular set-up, the
problem of most small firms is that you will wind up with the same staff
doing the internal and the external work. You will wind up looking at
the same work. My question is ultimately, how objective are you? I think
it is difficult in a small firm to wind up with separate staffs and to
really be objective. That is a concern of mine in the role that I have
with the AICPA talking to a number of folks about this issue.

**Mr. Blair**: This is Mark. We had a case where a bank used an
outsource firm, and they had a separate firm come in from a separate
division of the accounting firm from another area and that worked out
pretty well. That way they had different people looking at the
functions.

**Mr. Dalton**: Alright, we will move on to our next caller. It will be
Lynn's site in Suwani, Georgia. Go ahead.

**Georgia**: Yes, I would like to know if the banks will have any kind
of access to the OCC's review of audit work papers, the centralized
review?

**Mr. Blackburn**: Mark?

**Mr. Blair**: Well, we just started this program, and it is still being
implemented. If we have any issues with work papers, we will have a
discussion with the bank and the external auditing firm or the outsource
auditing firm. If there are any further issues, they will be brought out
in the report of examination. But at this point we really have only
started this process.

**Mr. Riordan**: This is Rob, and I think it is important to remember
that, as examiners, we don't want the bank to have any surprises. By the
time they get the report of examination, our goal is always to not have
any surprises for the board of directors, so that all of these issues
will have been discussed prior to you ever receiving a report.

**Mr. Blackburn**: Thanks, Rob. John?

**Mr. Dalton**: Okay, we will go to our next caller, which is Matt's
site in St. Paul. Go ahead.

**Minnesota**: Hi, we have got a question about the outsourcing
arrangement. If you should contract directly the audit committee or
board or if you should contract with the bank itself on a more complete
outsource arrangement?

**Mr. Blackburn**: Scott, in terms of best practices, can you respond to
that?

**Mr. Schainost**: I might ask Wynne. But I don't know with whom we
actually contract. We expect a reporting line to be with the board. But
whose name is actually on there, I think it would be the bank's.

**Mr. Baker**: Yes, this is Wynne. Typically, we work through the audit
committee. The audit committee hires us, and we work through them.
Management gets a secondary copy of the contract if it's involved in
helping set the risk process, in terms of the risk one knows, because of
the fact that often you are dealing with an unsophisticated audit
committee, but ultimately the audit committee has responsibility on
every one of our contracts, that is whom we deal with. It is always with
the audit committee or the board.

**Mr. Blackburn**: Thanks, Wynne. I think we would all agree with that.

**Mr. Dalton**: Okay, three callers left in the queue. Again press 1 to
get in line. We will to Redmond, Washington, to Keith's site. Go ahead.

**Washington**: Hi, I understand that currently, you obviously are
discouraging use of the same firm. What do you think the possibility is
that going forward you will prohibit these small community banks from
using the same firm to do both the internal audit and the external
audit?

**Mr. Blackburn**: This is Zane. I tried to indicate in my remarks that
we recognize that there are situations for the smaller institutions
where because of availability of a qualified auditor and his or her
locality, if nothing else, that prohibiting would put the institution in
the dilemma of having to choose between not having a full external audit
or cutting back on some or all of the internal audit procedures.

There are probably two considerations if we did prohibit that practice.
One consideration would be a specific size exception, such as the \$200
million currently provided by the SEC in its independence rule. There is
a question there from our perspective, since that still does not exempt
the institutions that are not necessarily required to have an audit.
Another consideration that we have is providing some specific approval
process through the examination function of actually allowing a look at
the circumstances of the institution and, if in fact we did, I
emphasize, if we did, a complete prohibition provides some exception
process. We would look, as I said, at specific situations. I think, at
this point, it is still somewhat early to suggest exactly what our final
position will be on this. I think there is a lot of concern, but there
is also the concern with respect to the smaller institutions.

**Mr. Dalton**: Alright, we will move on to our next caller, Gregory's
site in Paris, Illinois. Go ahead.

**Illinois**: Hi, I guess my question is somewhat related to the last
question. We are a \$180 million community bank. We have been
outsourcing both internal and external audits for this will be our
fourth year to the same firm, and we have received satisfactory exam
comments and results each of the three years. Again we are moving into
our fourth year. My question is, given the Enron situation and
everything that has been said here today, should we be looking around
for another firm to engage to do a separate internal audit function?
Part two of my question is, will we be under closer scrutiny, if we
continue this practice?

**Mr. Blackburn**: This is Zane again. Let me try to answer both your
questions. I think Scott might assist me and have some further views as
well. If you look at the SEC's rules currently, any institutions under
\$200 million are exempt from that sanctional requirement of the 40
percent limitation. So it sounds to me that your institution under
existing SEC rules, if in fact the banking agencies did apply those,
would be exempt. We say in your handout in the interagency policy on
internal audit in which we deal with outsourcing that a bank should have
a backup plan. In other words, if it is no longer feasible for one
reason or another for you to use that particular firm, we would not want
you to have any significant interruption in continuing those procedures.
So I think the only thing I would advise at this point, particularly
since we have not reached any conclusion, is to make sure you do have
that backup plan. There are some articles, and Chairman Pitt of the SEC
indicated that perhaps the SEC did not believe that additional
regulation was absolutely necessary nor were any additional changes
necessary in this particular area. On the other hand, we have seen
positions that Wynne talked about from the AICPA in terms of their
recognition that they would not object to some sort of ban on
outsourcing. We have also seen contrasting positions in the specific
legislation that we have looked at. So I think there is too much unknown
at this point in time, before we would suggest that you actually begin
to seek another firm. Whatever we do, and I think whatever the SEC or
Congress would do, I think we would ensure that there would be
sufficient time for institutions to make any orderly changes, if that
was necessary. Scott, did you have something to add?

**Mr. Schainost**: Just from the side that right now only by law, only
those banks that have more than \$500 million in assets are required to
have that external audit. So examiners in our community banks tend to
look at the audit function as one area. They do not distinguish between
the internal and the external, or especially if all audits are
outsourced. But we make a conclusion on the overall audit function. I
would ask your board if you're going to have an internal audit and
outsource an external audit, it sounds to me like the banks typically
want another review. So they have an internal audit that is outsourced,
and they want a second review through an external audit. If it is to the
same firm, it is difficult to see where they will get that second
opinion.

**Mr. Dalton**: Okay, about 20 minutes left in the program. Four other
callers are in the queue. We will go to David's site in Lexington,
Kentucky, with a question. Go ahead.

**Kentucky**: Yes, as a follow-up to one of the earlier questions, do
you think that if an outsourced internal audit to the same firm that
does the external audit is prohibited at some point, how do you see that
affecting outsourced loan review and compliance to the same firm?

**Mr. Blackburn**: Sorry, I actually pushed my mute button. This is Zane
Blackburn again. There are many questions as we are looking at this
potential of actual prohibiting. We recognize, for one, whether or not
this would be a recurring situation. In other words, we recognize that
at particular points in time that if a bank had a new product with which
it needed some assistance and because of its familiarity with its
external auditor, it might seek the auditor's assistance for expertise
and availability. I think we would be hesitant to prohibit something
like that. It is the kind of regular process of and all the benefits
come from our standpoint of the independence and two sets of eyes. But
we recognize that there are these other corollary issues that you raise
as well, and we will take those into consideration. Again, we have to
look closely as Scott was referring earlier to the controls, at the
separation there to ensure that the independence is not compromised.
Essentially, what we are really evaluating is how adequate is the work
actually being done. That is the primary factor that we are always
looking at as the first and the most important factor.

Anyone else? Okay, John, can we go to the next?

**Mr. Dalton**: We certainly can. Three other callers. Now we will go to
Hammond, Indiana, to Linda's site. Go ahead.

**Indiana**: Yes, I work for a \$675 million community bank here in
Hammond, and we are thinking of outsourcing. We currently have an
internal audit staff comprised of four individuals, and that totals
about 8,000 hours per year. The proposal at which we are looking for
outsourcing, these firms are estimating that they can perform the work
for us at 1,000 hours per year. We are thinking there would be some
efficiencies expected from outsourcing, but will the OCC consider this
drop in hours adequate coverage? Can we justify this through a risk
assessment?

**Mr. Riordan**: This is Rob. I think that is right. We do not typically
in our examination process go through and look at the number of hours.
We look at the quality of the work and the areas that were reviewed. I
am saying something like 1,000 hours per year, as an examiner, I think
that that is essentially irrelevant information. In terms of how we
assess that, we will go in and see what was conducted and whether it
meets the needs of your organization. As you mentioned, we would look
first at the risk assessment and how good is that risk assessment and
how does it relate to what we see in your bank.

**Mr. Blackburn**: Rob, I think if you saw the internal audit that was
previously being done internally, and you had 3,000 or 4,000 hours
difference you might be skeptical of such a dramatic change. Again the
most important factor is the quality of the work being done, and are the
risks being monitored and assessed properly.

**Mr. Dalton**: Alright, we will move on to Thomas' site in Wyomissing,
Pennsylvania. Hope I pronounced that right.

**Pennsylvania**: Yes, that's right. Thank you. My question is geared
actually from an outsourcing firm's perspective. I am curious about
opinions related to the structure of that. How would you view the
independence issue for an outsourcing firm, which is basically a
subsidiary of an independent public accounting firm, but is staffed by
individuals whose total backgrounds are in internal audit or
professional designations are internal audit. They are not CPAs and that
is not their forte, if you will. But you have situations where maybe the
subsidiary firm is providing internal audit services when the parent
firm is also providing the external audit services.

**Mr. Blackburn**: I think the little loop in there is the parent firm.

**Pennsylvania**: In other words, there is the independent public
accounting firm that has a subsidiary set up that is providing internal
audit services, and that is all that that subsidiary firm does. It is
staffed by people whose professional backgrounds are internal
audit-related, their professional certifications are CIA, CBAs, CFSAs,
etc. But there may be situations when the subsidiary firm may provide
internal audit services, while the parent company provides the external
audit services.

**Mr. Schainost**: This is Scott. I think it's similar to an issue that
Mark brought up, the way that one of his banks helped manage that risk
by having separate auditors actually reporting to a different partner.

**Pennsylvania**: Correct.

**Mr. Schainost**: So that is similar to what it sounds like you are
describing, actually a separate corporation, is not reporting to the
same people who are doing the external audit.

**Pennsylvania**: Correct.

**Mr. Schainost**: Having the firm's name the same is not the concern
that we have about outsourcing to the same firm. It is not so much the
name that is the same.

**Mr. Blackburn**: I think I would take a somewhat different view there.
I think merely because the firm has actually set up a separate entity,
it is still part of the firm. I think those concerns about independence
would still arise whether or not the external auditor was offering an
opinion ordered in the financial statements. I think what Scott and Mark
were both saying is if you have that separation at least there is a
significant improvement from our perspective. In my view, when you have
different people, and I think Wynne referred to it as well, looking at
the same data or the same information or the same risks that the
external auditor would be looking at as well, it certainly improves that
situation. Now having said that though, I think the independence issue
will still arise, if you are a \$650 million institution, and there
would be a prohibition or any narrowing of this 40 percent rule by the
SEC, I think you would certainly have to consider that. I will also go
back to re-examining your backup plans, because with FDICIA actually
mandating that audits must be done for institutions having more than
\$500 million, I think at least our initial plan when we were revising
the internal audit policy statement with respect to the SEC's new
independence rules, we would certainly include those, because
essentially in most instances they will be SEC registrants.

**Mr. Dalton**: Okay, we will move on to our next caller.

**Mr. Blackburn**: John, Mark just had one other comment.

**Mr. Dalton**: Yes, no problem. Go ahead.

**Mr. Blair**: Yes, I wanted to add one comment. One of the banks that I
supervise had a similar situation, and we told the board that we
discouraged the situation. We discouraged the fact that the same firm
was performing both the outsourced audit and the external audit. The
board ultimately decided to hire a new outsource firm. But basically we
did not prohibit it, but we did discourage the situation. Okay, John.

**Mr. Dalton**: Twelve minutes left in the program and again press 1, if
you do have any questions. Our last caller so far in the queue is Paul's
location in St. Peter, Minnesota. Go ahead.

**Minnesota**: Good afternoon. Our organization is two banks within a
holding company and one is \$115 million and the other one is \$110
million in assets. The question we have basically is that we perform an
annual audit of the holding company. We engage our accounting firm. It
would be an accounting firm organized similarly to that of the caller
right before me, in which the consulting services are performed for
compliance and internal audit, for example, loan review too, from the
consulting division. Can you comment on how we are doing it with respect
to the audit at the holding company level of the two banks?

**Mr. Blackburn**: This is Zane. I'll take a stab at it and ask Mark or
Scott to provide their perspective as well. I guess where I'm coming
from is that FDICIA right now basically says and our rules or
regulations say that if you are performing at the holding company level
that an opinion audit from that perspective is satisfactory for the
entire number of institutions within that holding company. In your
situation again, because you are not under FDICIA because of your size
limitations, you certainly would not have the same requirements.
Therefore, one of the questions with which we have been struggling is
whether this applies in those situations to institutions between \$200
million, which is the SEC's limitation, and \$500 million. Again, we
have not come to a conclusion yet for institutions in that size range.

**Mr. Blair**: This is Mark and that is not an unusual situation to see
an audit of the holding company. We see that in many of our banks, and
again you have to look at the independence issue for consolidating and
evaluating each separately. It's difficult to evaluate independence as
you know. We look at the engagement letter, and we look and see if they
are acting as management. From there, we try to evaluate it. But
basically we go by the guidance outlined in 98-1.

**Mr. Blackburn**: John, do we have any further questions?

**Mr. Dalton**: Yes, Debra's site in Waxford, Pennsylvania. Go ahead.

**Pennsylvania**: Yes, this question is for Mark and Zane. We are a CPA
firm that provides external audit and internal audit services, but we do
use separate and distinct groups for both. What we are seeing too in the
field is that field examiners seem to be discouraging the same firm as
Mark mentioned. But Zane, you mentioned that if they are separate and
distinct groups, the OCC does not necessarily have as much of a problem.
I was wondering if both could comment.

**Mr. Blackburn**: This is Zane. I was trying to indicate that in terms
of discouragement, not from the standpoint of independence, because I do
not think that the independence issue is resolved merely because you
have separate and distinct individuals as long as it is part of the
firm. But from the standpoint of the benefit of having a more objective
perspective from setting up some degree of a firewall, I would suggest
perhaps that there is a great deal of benefit. If you ask me the
question, would it make a difference in terms of which I would prefer, I
would certainly prefer the separate entities, even though they are part
of the same firm.

**Mr. Blair**: And this is Mark. You know this is a common occurrence as
we mentioned before. It is understandable given the cost and
efficiencies you gain. Again, we look at each situation and evaluate it
and make the best call we can. Generally it works out. But it is
difficult to evaluate independence outside the clear-cut situations.

**Mr. Blackburn**: I would go back and add what Rob has said earlier. We
do not look at outsourcing as a dirty word. We often found the outsource
firm has done a much better job than the previous internal audit staff.
So it is not a problem there. It is the problem there that you have
improved it by having a separate set of eyes look at the work and become
more objective. But when it comes to the independence I do not know how
you can actually ever separate that.

**Mr. Dalton**: Okay, and no further questions on this end. At this
time, Zane I'll turn it over to you for closing remarks.

**Mr. Blackburn**: Alright, thanks, John. I thought we had a few more
minutes. Were there any fax questions? I just wanted to check.

**Mr. Dalton**: Yes, as a matter of fact we do have one. Two questions,
actually. And we will take the time to use those. Can a bank's CFO be
designated the audit manager?

**Mr. Blackburn**: This is Zane. When you are trying to evaluate an
outsourced arrangement, you first and foremost evaluate the quality and
competence of the people involved. As Mark indicated, ideally we would
prefer that the audit manager does not have other operational
responsibilities, particularly those with the financial system in a
particular institution. On the other hand, we recognize that there are
the situations when the bank does not really have other qualified
people, the board of directors or the audit committee does not qualify.
You end up with the CFO as the only or the most qualified individual in
those situations. So ideally, we would rather not see that. But we
recognize that that is the most practical situation, because we are
looking for how well the quality, how well it is performed, how
knowledgeable the individual that can provide that oversight. But I
would return to Scott's remarks that what we still want to see is the
ultimate responsibility. If you have that situation, if it is the board
of directors or the audit committee that still must provide that
oversight, and we would ideally like to see the findings from the
outsourcer actually provided to and discussed with the audit committee
or the board of directors.

**Mr. Blair**: This is Mark. We have had this situation. We mentioned it
in the report, so that the board was aware of it and asked it to monitor
the situation. We also recommended that there should be joint reporting
by the outsource firm and the person, such as the CFO, for example. That
is how we addressed it in the report.

**Mr. Baker**: Zane, this is Wynne. We have this situation, since we do
a number of community banks. We have this situation or one really
similar to this position, and we tell the audit committees that we will
work with the CFO or whomever they designate, but that we want to make
sure that we meet with the audit committee quarterly. In addition, we
have an executive session with the audit committee separate from whoever
the management person is. One of our focuses is to make sure that
management is not impeding anything that we are doing in terms of the
audit and control. But in many community banks, there are not many
management people and so we have to work with the CFOs. We try to make
sure that the board and the audit committee understand that they are
ultimately responsible. And at the end of the day that's who we're going
to work with and that's who we're going to meet with. We always make
sure in our contracts that we will get time with the audit committee one
on one.

**Mr. Blackburn**: Okay, thank you, Wynne.

**Mr. Dalton**: Time for one more question. Back to Redmond, Washington,
to Keith's site. Go ahead.

**Washington**: I had a question. A comment was made earlier, that when
the same firm performs both the external and the internal audit, you
have never seen the external auditors critical of the work of the
internal audit. Out of curiosity, when you actually have two separate
firms performing that work, how often do you see the external firm being
critical of the internal audit work?

**Mr. Schainost**: This is Scott. It is really not uncommon for them to
address it more on the scope, not so much a competency thing. But we see
it in the audit findings where they criticize the internal audit for not
covering everything that should be covered. It is more of a scope issue.

**Mr. Dalton**: This is a question for Mark. Do you expect the
outsourced internal auditor to conclude that internal controls are
effective? Or should the audit committee make that conclusion?

**Mr. Blair**: Well, I think the audit committee should generally make
that conclusion after reviewing the results. That is a difficult
question to answer without more information. But generally you expect
the audit committee to make that conclusion.

**Mr. Dalton**: Okay, another faxed in general question here. Do you
foresee any restrictions, such as on loan reviews or IT reviews that are
provided by external audit firms.

**Mr. Blackburn**: This is Zane Blackburn. Let me try to answer that
question. I think there are still more questions in terms of what
actions the SEC or Congress might take in specific areas. At this point
in time, the agencies are really only focusing on revising our internal
audit outsourcing policy. I think those other issues are outside the
scope of that, and we would be consulting actually with both the AICPA
and the Securities and Exchange Commission before making any conclusions
in that particular area.

**Mr. Dalton**: Alright, we will go to some live calls. We have five
callers in the queue. Let us go to Toledo, Illinois, to Carol's site, go
ahead.

**Illinois**: Yes, I wanted to know, if you have an external audit done
totally, does anyone have an idea of the range of pricing it costs for a
total external audit. We are about a \$175 million company.

**Mr. Blackburn**: I could probably ask Wynne Baker to answer that
question.

**Mr. Baker**: You say, \$175 million, Carol?

**Illinois**: Yes.

**Mr. Baker**: \$175. Are you public or not public?

**Illinois**: Hello?

**Mr. Dalton**: Yes, go ahead.

**Illinois**: We are nonpublic.

**Mr. Baker**: My guess is that you are in the range of probably
\$20,000 to \$40,000, somewhere in that range.

**Illinois**: Okay, thank you.

**Mr. Dalton**: Alright. We will go to East Brunswick, New Jersey, to
Emit's site. Go ahead.

**New Jersey**: Yes, we have a couple of questions, but let me ask you
this first one. It is a little lengthy, so you may have to bear with me.
As a CPA firm that provides outsourced internal auditing to community
banks, we have observed a greater emphasis being placed by the
regulators in reviewing and evaluating the outsourced internal audit
function through the interview process and through the review of
relevant work papers. However, we have not observed similar attention by
the regulators in evaluating the external audit function. The question
is, does the OCC place a greater emphasis on the quality of the internal
audit function at an institution in evaluating the overall integrity of
the audit process at the bank?

**Mr. Blackburn**: This is Zane Blackburn, I think I can answer that. I
think it is an easy answer, and it is yes. We do place a greater
emphasis on the internal, because we think that that is really the focal
point in ensuring and testing those internal controls of the
institution. Obviously, we also recommend that an external auditor is
involved that essentially reviews the work of the internal auditor and,
when deficiencies are noted or when additional tests are necessary to
satisfy the external auditor\'s conclusions, that they would do that
additional work as well. But again when we are looking at the individual
institutions, the focus is on internal audit. External receives a more
secondary emphasis.

**Mr. Dalton**: Okay, was there a follow-up question there?

**New Jersey**: Well, actually we had a second question that relates to
the AICPA and perhaps Wynne Baker could address that. Many CPA firms
currently perform an outsourced internal audit function for community
banks. Is there any plan by the AICPA to develop comprehensive standards
similar to those currently provided by the Institute of Internal
Auditors with respect to this area for only the internal practice
itself?

**Mr. Baker**: This is Wynne Baker. Currently the AICPA does not plan
any procedures. I think the AICPA will wait and see what the agencies
do, and if there is a demand for that, obviously the AICPA will do that.
But at this point, the audit standards board who would have to set those
procedures does not have that on their agenda.

**Mr. Dalton**: Alright, we will move on to our next caller, which is
John's site in Atlanta. Go ahead.

**Atlanta**: Hi, does the OCC have a position on a bank\'s using Arthur
Anderson for the internal audit function at this time?

**Mr. Blackburn**: I think we have taken the same position as that taken
by the Securities and Exchange Commission, and we have actually
announced that on an interagency basis. There is a concern obviously in
a particular situation, i.e., the Enron situation as to the adequacy of
that audit, but in terms of questioning the quality of Arthur
Andersen\'s work and all their other engagements, we haven't reached a
conclusion on that. That suggests that that is in fact a kind of
firm-wide deficiency. One of the objectives that we ask our examination
staff to do that relates back to the earlier question, is that we look
at the entire audit function and evaluate it. Again the primary emphasis
is on an internal audit. Now there are other questions that, if in fact
there is some further legal action with respect to Arthur Andersen or if
Arthur Andersen\'s financial condition causes that firm to cease to
exist, we have adopted the SEC's provision to allow institutions that
are being audited by Arthur Andersen some additional time in those
particular kind of worst-case-scenario situations.

**Mr. Dalton**: Okay, we will move on to our next caller. We will stay
in Georgia to Thomasville, Georgia, to Holly's site with a question. Go
ahead.

**Georgia**: Hello, I believe this comment was made by Mark Blair in
choosing the appropriate person in the bank who would be the internal
audit manager, if you had your audit work outsourced. The comment was
that internal audit managers should not have operational
responsibilities, but that there could be exceptions. My question is:
When would it be acceptable for the person that will have that
responsibility as the internal audit manager to also be an operations
officer? What types of exceptions would be okay, because we have that
exception?

**Mr. Blair**: Well, this is a common issue in many of the smaller
banks, as you might guess, because of the lack of other competent people
to oversee the function. So we try primarily to look at the competence
level. If there is no other better person to do this job, we will
discourage that and tell the board to make sure that they oversee that
function closely when those audits are involved, and from there, if that
is the most qualified person, we generally live with it.

**Georgia**: As long as they are reporting adequately to the board,
would that be alright? I mean would that increase your confidence level?

**Mr. Blair**: Yes, what we recommend is that the outsource vendor
report that section of the audit to the board jointly with the audit
manager.

**Georgia**: Report jointly?

**Mr. Blair**: Yes.

**Georgia**: Okay, thank you very much.

**Mr. Blair**: You are welcome.

**Mr. Dalton**: Okay, four other callers in the queue, several fax
questions. We will break it up and take a fax question here. Question
is: We are a three-bank holding company, and we have a mortgage company.
Soon we will have a fourth bank. Our total asset size by yearend will be
much more than \$400 million. We currently outsource our internal audit
function. It works fairly well. Is there some point at which a company
becomes too large or too complex to outsource?

**Mr. Blackburn**: This is Zane Blackburn. I will certainly take a shot
at that. I don't think we have seen an instance when we have come to any
conclusions that it is too large. Actually we have seen instances for
large banks in the more than \$50 billion range that outsource a
significant amount of their internal audit work. In some instances, we
have had some concerns with the oversight of that with respect to what
Mark was referring. But on the other hand, we have actually seen
improvements in those areas, because, as Wynne had mentioned in his
remarks, the better ability for some expertise to which some of the
firms have access in their individual firms and their potential
flexibility. So I don't think there is a size limit. We do see that from
the other perspective that perhaps it is a more efficient practice in
many instances for the smaller institutions.

**Mr. Dalton**: Alright, we will move to Moorestown, New Jersey, to
John's site with a question. Go ahead.

**New Jersey**: Hi, we have a couple of questions relating to
independence. The first one is: If an outsourced internal audit firm,
and this would be a firm that does not do any external auditing, but has
separate divisions that provide compliance support and loan review
services when they provide all of these services to an institution, are
there any issues related to independence with which one would be
concerned?

**Mr. Baker**: This is Wynne. The current issue with the AICPA from that
perspective there are not issues. You must be careful about auditing
your own work. In many cases, Mark mentioned this earlier in his
remarks, trying to have folks from different sites or organizations, but
right now there is not anything from an independence issue. Zane? Scott?

**Mr. Schainost**: As much as I hate to say it. It depends. What we
would do is look at exactly what is loan review doing? We will raise the
independence issue if some of our banks have actually outsourced the
risk rating of the credit and the determining of the allowance of
loan/lease losses. If loan review is merely going in and verifying the
bank's risk rating system, making sure that bank policy is followed, and
maybe reviewing or signing off on the allowance that management
determines, the independence issue is not such a large concern in a
smaller bank. It really depends on whether you are outsourcing
management functions or whether they are only outsourcing the review,
the audit part.

**Mr. Blackburn**: This is Zane Blackburn again. Let me reemphasize
something that Scott had mentioned earlier. When we evaluate internal
audit, we are evaluating that function, not necessarily on whether it is
done internally or by an outside firm. So in terms of the independence
issues, those kinds of checks and balances, who does it and whether, as
Scott had indicated, there are some management functions that you're
looking at yourself, we will view them in the same way as if the audit
was done by the staff of the institution.

**Mr. Dalton**: Okay, we will move to Houston, Texas, to Denise's site
with a question. Go ahead. Denise, are you there?

**Texas**: Yes, my question relates to the day-to-day management of the
outsourced audit, what I will call the outsourced function. For example,
once we have agreed on the scope of the audit with the outsourced
vendor, as an audit manager would I look at their audit program to see
if it meets our requirement? Later, when they are finished, would I
review their work papers and their report draft and everything? How
intense is the involvement of the audit manager in terms of managing
day-to-day in the outsource function?

**Mr. Baker**: This is Wynne Baker. We do a lot of outsourcing and
typically we report through the outsourced manager within the
organization. They review all of our work. They go over our plan and our
scope, review all of the work papers, our findings, and recommendations.
Ultimately, that report goes to the audit committee. At some point in
the process, the audit committee excuses management, and we have an
executive session. But the audit manager is involved in the work that we
do in setting the scope and reviewing papers and the whole process.

**Mr. Blair**: Yes, this is Mark too. I have a bank, and it has its own
audit manager and that is all he does. He reviews the work papers in
depth and the scope. It is really very good. It is really what I
consider a best practice. Now, on the other hand, if you are a small
institution, it might be asking too much to review the work papers. In
that instance, we would expect you to at least look at the scope and do
the follow-up and overall managing of the process. But for all except
the smallest institutions, it would be a best practice to review the
work papers in addition to looking at all those other factors.

**Mr. Dalton**: Okay, another faxed in question. This one is for Mark.
Who should a small institution appoint who is qualified, competent, and
is operationally and managerially independent for areas being audited?
Why should this employee report directly to the audit committee if the
outsourced firm is already reporting directly to the audit committee?

**Mr. Blair**: Well, our entire handbook and all our policy reflect that
we expect the bank to manage the function. If that is the case, you
would have a lack of independence, but you do not want the audit firm
managing the entire audit activity. You can't just outsource the
responsibility to someone else. It is the board's responsibility to make
sure that there is adequate oversight over that function. So I think
that would be against our OCC policy. It would not be a good practice,
because you would not be responsible for the overall function. It would
not make any sense.

**Mr. Dalton**: Okay, five other callers in the queue. We will go to
Gary's site in Millbury, Massachusetts. Go ahead.

**Massachusetts**: Thank you. We are a small community bank, \$60
million, and we outsource both internal and external audit to the same
accounting firm. However, they have two distinct and separate divisions.
One for internal and one for external. What would be your opinion on
that situation?

**Mr. Schainost**: This is Scott. We would raise the independence
issues. Merely having two separate firms that have the same shareholders
or the same holding company does not make a big difference, when you
come down to the ultimate same shareholders. So we would be having a lot
of discussion with you on the independence issue.

**Mr. Blackburn**: This is Zane here. Let me add a little bit to that. I
think the independence issue is still a question mark. Now if you look
at the existing SEC rules, if there is a specific prohibition for banks
under \$200 million, we advocate that when you have those situations we
think it is an improvement if you actually have a separate organization
doing the internal audit outsourced work from the ones that are actually
doing the external. So that as Scott has indicated, the independence
issue is still there, but I think you have solved one of our concerns,
that of extra oversight. But as Mark had indicated in his prepared
remarks, the other thing that we have seen is that it is rare that we
ever observe the external auditor criticizing the work or the scope of
the work that is being done by the internal audit outsource entity, if
in fact it is owned by the same organization.

**Mr. Blair**: This is Mark, too. I wanted to mention a worksheet
entitled "Audit Committee Member and Responsibilities Worksheet." It has
all the AICPA and the SEC independence rules that really might be useful
for you to review. If you cannot find that, the local EIC will have that
information, and would provide it to you.

**Mr. Dalton**: Okay, about 15 minutes left in the program. We will go
to John's site in Dallas with a question. Go ahead.

**Texas**: Regarding the new rule on the 40 percent outsourcing for
large institutions, can you tell us what would fit into the category? I
mean when you are measuring that 40 percent, does that include loan
review, compliance review? What all would go into that calculation?

**Mr. Blackburn**: This is Zane Blackburn. That is an excellent
question. I wish I had the SEC on the line to answer it. Unfortunately
when the SEC provided or actually finalized that rule they did not and
have not provided additional guidance. What our plans are to do in the
interim, this will actually become effective in August of this year, is
to try to develop some better guidance for our institutions and our
examination staff to use in this area. And to consult with the SEC,
because we think this question comes up so frequently. We have seen a
variety of different things included or excluded in that particular area
and not having any consistency. So we think it is important to try to
either do it ourselves, but it is not our rule, it is really the
Securities and Exchange Commission's rule. But we recognize there is
that inconsistency, and there is a need for further guidance.

**Mr. Dalton**: Okay, another fax question here for Mark. The fact that
no external auditor has criticized its own firm's internal audit work is
not as important as whether such firms have improperly not criticized
deficient internal controls.

**Mr. Blair**: Well, personally I haven't seen that, but we have had
occasions when they have criticized the scope of the reviews, but I have
not seen them bring up the fact that there has been a deficiency in
terms of controls in my banks.

**Mr. Dalton**: Okay, and again press 1 to get in line for questions. We
will go back to Moorestown, New Jersey, to John's site. Go ahead.

**New Jersey**: Hi, we have run into a couple of situations lately where
banks have selected companies to perform outsourced internal audit
and/or information technology audits for what appear on the surface to
be very, very, very low fees. And since in the professional services
world, the level of effort is usually a function of the hours times the
rate, which gets you to the fee. As part of the examination by the OCC
of internal audit and/or IT audit, will you look at the reasonability of
fees and the resulting level of effort that might be applied by some of
these low-cost provider firms?

**Mr. Schainost**: This is Scott. We seldom really get into the fees,
obviously unless it is affecting the bank's overall earnings. But we
will look at the scope and the competency of the people, and not really
get into whether a firm is lowballing to get the business for a couple
years and then start increasing fees. We will look at and concentrate
our efforts on what is actually being done. We will probably not do a
whole lot with whether they are getting a great deal or not.

**Mr. Blair**: This is Mark too. I wanted to mention, we typically have
the IT expert look at the IT area, and we found a lot of issues with the
information technology exams. What happens is that the firms, typically,
do not have the expertise in information technology, and they will have
CPAs actually do that work. And the quality of the work is not very
good. What we have done is the IT examiner has met with the firm and
informed them of the deficiencies and tried to get that corrected.

**Mr. Dalton**: Alright, our next caller.

**Mr. Riordan**: This is Rob. John, do you mind if I add something
there?

**Mr. Dalton**: No.

**Mr. Riordan**: When we look at the internal audit, we generally first
go to the risk assessment. In the situation that you are describing in
which there would be little fees, I think you are right. It is based on
the number of hours times the fee. If we go in and see that there is not
much total time spent on internal audit, obviously our question would
be: Are they seeing the same risks that we are? How is that risk
assessment made? Who is involved in that? That is probably where we
would begin. As Scott said, we would not necessarily look at total
dollars on fees, but we would surely start with the risk assessment.

**Mr. Dalton**: Okay, two callers left in the queue. Ten minutes left in
the program. Neesha's site in Libby, Montana, with a question. Go ahead.

**Montana**: Thank you. We have had some problems with our outsourcers
not wanting to provide us with the work papers. They seem to approve of
our reviewing them, but not keeping them. What are your beliefs about
whether we should have copies of those work papers or not?

**Mr. Blackburn**: This is Zane Blackburn. Returning to the interagency
policy on internal audit, one of our statements, and I think we worked a
lot with the AICPA on this issue, is that if an outsourced firm is doing
the internal audit work, the agreement with that firm should have and
contain access, not only by the institution but by our examination staff
as well. Now there is a different situation when it comes to the work
papers for institutions for their external auditors. Generally, we have
a cooperative relationship with firms doing that. We usually are able to
gain access for institutions having more than \$500 million. FDICIA
actually requires that we have that access. But it is still access, not
so much possession. We are concerned that the banks and examiners have
access to the work papers, but to where they are actually physically
located. I have not seen too many banks that actually have copies of the
external work papers. As long as they have access to them, that is what
we are concerned about.

**Mr. Blair**: This is Mark. We generally have our banks actually pick
two or three different audits. Then the audit manager will talk to the
audit firm and request the work papers, and all will be sent to us for a
couple of weeks. Most of the audit work papers that I have seen now are
electronic. They will usually send the computer with it, and that way we
will have access to the audit programs and audit work papers.

**Mr. Baker**: This is Wynne. Let me add to this, because our firm does
a lot of outsourcing, and we have policies. Our policy is in accordance
with the interagency agreement that the bank will have access, and the
regulators will have access. They look at everything, but as far as
having a copy of the papers, our banks do not have a copy. But they
understand they can get anything they need, or the regulators can see
anything for their benefit.

**Mr. Dalton**: Alright, eight minutes left in the program. We will go
to Amashon's site in Washington D.C. Go ahead.

**D.C.**: Hi, we are a \$300 million bank in Washington, D.C., and we
outsource some of our internal audit activities. My question is: Should
the process of assessing risk be different when performed by the
outsourced audit group versus the internal? Is there some difference
there that we can apply?

**Mr. Riordan**: This is Rob. I would say no, that the process, the
goal, is still the same. Now the outsourced audit firm may have a
completely different process of determining that. But I think there
definitely needs to be an agreement between the internal, the audit
manager or the audit committee, and the outsourced CPA firm. Again, the
process is secondary to the result. We are looking for, at least as
examiners, a proper assessment of risk. Does that address your question?

**D.C.**: A little bit. I think I can take it from there.

**Mr. Riordan**: Thank you.

**D.C.**: Thank you.

**Mr. Dalton**: Alright, press 1 again, if you do have a question, we
have a few more minutes left. Here is another faxed question. This one
is for Scott. Are you seeing any changes at the community bank level as
a fallout from Enron?

**Mr. Schainost**: Based on the board meetings I have been attending, I
would say that directors are asking more questions on audit scope,
especially regarding auditing insider transactions. They are also asking
some different questions of the examiners, such as: "Are there any
issues or concerns that examiners have discussed with management and
have not discussed with the board?" So they are taking a little more
active interest even in the recommendations. They have also been asking:
\"How do the examiners feel about management's commitments for
corrective actions with regards to concerns brought up by examiners and
auditors? Are those management's commitments reasonable and timely?\"
So, yes, I think Enron has affected the community bank director's view
on his/her responsibility.

**Mr. Dalton**: Next caller is from Norberto's site in the Bronx, New
York. Go ahead.

**New York**: Yes, I have a question about the director's responsibility
to document his or her risk assessment views on different areas that are
being audited. Would you give me some specificity on that? What actually
is it that we are looking for them to say?

**Mr. Schainost**: This is Scott. I guess we see it in all sorts of
forms, whether they rank it 1 through 5 as far as a risk assessment.
Each bank is a little different depending on how many activities in that
specific area, or they will list a narrative, but we really see it in
all sorts of forms whether it is a rating and ranking system or a
narrative under each area. One of the biggest parts is identifying all
the risk areas that need an audit review and ranking them in priority
order  ranking the importance and the exposure to the bank as well as
the frequency of audit review.

**New York**: So you are asking the directors to set up the audit
program to rank importance or risk relative to the different programs
that will be done by either the internal or external auditor. But at the
end of the audit they are not making a statement or documenting a
statement relative to the risk assessment after the audit is taken?

**Mr. Schainost**: This is Scott. I think they should be doing that.

**New York**: They should be doing that? What form would that take? The
audit comes back, and the external auditor or internal auditor said the
audit was satisfactory. Now what is the board's comment to that audit?

**Mr. Baker**: This is Wynne. Let me fill in some spots here. Typically
what we see, and we do a world of community banks, and the audit
committee ought to have a charter in which they focus and discuss the
risk assessment. What we see and what we do in our contracts is we have
a risk assessment process. The audit committee expects us to make
findings and recommendations in every area that we investigate. I do not
think it is adequate to have an outsourcer come back to you and say
things are satisfactory. I do not think that is adequate. Typically what
happens is that we meet with our clients quarterly. We meet with audit
committees quarterly, and they assess what we have done. We give them a
report. They typically put those findings in the minutes. They document
those minutes, and those minutes are turned around and approved by the
overall board. They focus on the risk assessment, and we typically have
audit committees ask us to balance the risks in terms of looking at
high, medium, and low risks. But ultimately they sign off through the
minutes in terms of whether they are happy or not with the risk process.

**Mr. Blackburn**: Thanks, Wynne. I think we have pretty much run out of
time. This does conclude our final session of our Audit Roundtable
series. I really hope that you found the session on internal audit
outsourcing and the other sessions (for those of you who participated in
them) informative and useful in carrying out your responsibilities. We
want to thank all of you for your participation and excellent questions,
and our speakers for their insightful remarks.

If we did not get to all of your questions and you have additional ones,
please feel free to contact some member of the examination staff, or you
are certainly welcome to contact us here in Washington as well.

As a final note, we would appreciate you completing the conference
evaluation form to assist us in improving future seminars. Again, thank
you very much.

**Mr. Dalton**: Okay. Thanks to Zane and to all of our speakers for an
excellent presentation. To echo what Zane said, we do encourage you to
fill out and fax in your evaluation sheet. You should have found that
sheet in your materials. You will find the phone number listed at the
bottom of that form. Your comments and suggestions are important to us
and help us provide you with future quality programming. We would like
to thank you for joining us today. And this will end our call. You may
now disconnect.