Boar d o f Governor s o f th e Federa l Reserv e Syste m 

Supplementa l Polic y Statemen t o n th e 

Interna l Audi t Functio n an d It s Outsourcin g 

Januar y 23 , 201 3 

Pag e 1 o f 1 5 

PURPOS E 

Thi s polic y statemen t i s bein g issue d b y th e Federa l Reserv e t o supplemen t th e guidanc e 

i n th e 200 3 Interagenc y Polic y Statement on the Interna l Audi t Functio n an d it s Outsourcin g 

(referre d t o a s th e 200 3 Polic y Statement) . [Footnote 1 

-

 Refe r t o S R lette r 03-5 , "Amende d Interagenc y Guidanc e o n th e Interna l Audi t Functio n an d its Outsourcing. " End of Footnote 1.] 

A s a resul t o f th e supervisor y experienc e durin g an d 

followin g th e recen t financia l crisis , Federa l Reserv e staf f identifie d area s fo r improvin g 

regulate d institutions ' interna l audi t functions . Thi s supplementa l polic y statemen t addresse s th e 

characteristics , governance , an d operationa l effectivenes s o f a n institution' s interna l audi t 

function . Further , thi s statemen t reflect s certai n change s i n bankin g regulation s tha t hav e 

occurre d sinc e th e issuanc e o f th e 200 3 Polic y Statement . Th e Federa l Reserv e i s providin g thi s 

supplementa l guidanc e t o enhanc e regulate d institutions ' interna l audi t practice s an d t o 

encourag e the m t o adop t professiona l audi t standard s an d othe r authoritativ e guidance , includin g 

thos e issue d b y th e Institut e o f Interna l Auditor s (IIA) . [Footnote2 

- I n thi s guidance , reference s hav e bee n provide d t o th e IIA' s International Standards fo r the Professional Practice 

of Internal Auditing (Standards) . Refe r t o th e II A websit e a t https://na.theiia.org/standards -

guidance/pages/standards-and-guidance-ippf.asp x . End of Footnote 2.] 

Thi s statemen t applie s t o supervise d institution s wit h greate r tha n $1 0 billio n i n tota l 

consolidate d assets , includin g stat e membe r banks , domesti c ban k an d saving s an d loa n holdin g 

companies , an d U.S . operation s o f foreig n bankin g organizations . [Footnote3 

-

Sectio n 4 o f thi s document , however , clarifie s certai n change s t o th e Federa l Deposi t Insuranc e Corporatio n 

regulatio n (1 2 CF R par t 363 ) o n independenc e standard s fo r independen t publi c accountant s a t insure d depositor y 

institution s wit h tota l asset s o f $50 0 millio n o r more , whic h wer e adopte d pursuan t t o 200 9 amendment s t o Sectio n 

3 6 o f th e Federa l Deposi t Insuranc e Ac t (FD I Act) . End of Footnote 3.] 

Thi s supplementa l guidanc e 

i s als o consisten t wit h th e objective s o f th e Federa l Reserve' s consolidate d supervisio n 

framewor k fo r larg e financia l institution s wit h tota l consolidate d asset s o f $5 0 billio n o r more , 

whic h promote s a n independen t interna l audi t functio n a s a n essentia l elemen t fo r enhancin g th e 

resilienc y o f supervise d institutions . [Footnote4 

- Refe r t o S R lette r 12-1 7 / C A lette r 12-14 , "Consolidate d Supervisio n Framewor k fo r Larg e Financia l Institutions. " End of Footnote 4.] 

OVERVIE W 

T h e degre e t o whic h a n institutio n implement s th e interna l audi t practice s outline d i n thi s 

polic y statemen t wil l b e considere d i n th e Federa l Reserve' s supervisor y assessmen t o f th e 

effectivenes s o f a n institution' s interna l audi t functio n a s wel l a s it s safet y an d soundnes s an d 

complianc e wit h consume r law s an d regulations . Moreover , th e overal l effectivenes s o f a n 
Page 2 of 15 

institution's internal audit function will influence the ability of the Federal Reserve to rely upon 

the work of an institution's internal audit function. 

This supplemental policy statement builds upon the 2003 Policy Statement, which 

remains in effect, and follows the same organizational structure, with a new section entitled 

"Enhanced Internal Audit Practices" and updates to Parts I-IV of the 2003 Policy Statement, 

including: 

1. Enhanced Internal Audit Practices: This section is added to introduce enhanced 

practices that will improve the overall safety and soundness of institutions based on 

common observations on the effectiveness of internal audit functions during the recent 

financial crisis. 

2. The Internal Audit Function (Part I of the 2003 Policy Statement): This section 

encourages institutions to incorporate professional standards such as the IIA guidance 

into their overall internal audit architecture and provides additional internal audit 

guidance not specifically articulated in the IIA guidance. The additional guidance 

pertains to the characteristics, governance, and operational effectiveness of an 

institution's internal audit function. 

3. Internal Audit Outsourcing Arrangements (Part II of the 2003 Policy Statement): 

This section provides further clarification on the responsibilities of an institution's board 

of directors and senior management to oversee internal audit outsourcing (including cosourcing) arrangements and reemphasizes the need to utilize the same quality standards 

as if the institution maintained an in-house internal audit function. 

4. Independence Guidance for the Independent Public Accountant (Part III of the 

2003 Policy Statement): This section explains certain changes to Section 36 of the FDI 

Act [Footnote 5 

- Refer to 12 CFR part 363. End of Footnote 5.] 

promulgated since the issuance of the 2003 Policy Statement. The July 2009 

amendments to Section 36 of the FDI Act provide that independent public accountants, 

subject to the independence standards issued by the American Institute of Certified Public 

Accountants (AICPA), the Securities and Exchange Commission (SEC), and the Public 

Company Accounting Oversight Board (PCAOB), must comply with the more restrictive 

of the aforesaid standards. In March 2003, the SEC prohibited a registered public 

accounting firm that is responsible for furnishing an opinion on the consolidated or 

separate financial statements of an audit client from providing internal audit services to 

that same client. Therefore, by following the more restrictive independence rules, an 

institution's external auditor is precluded from performing internal audit services, either 

on a co-sourced or an outsourced basis, even if the institution is not a public company. 

5. Examination Guidance (Part IV of the 2003 Policy Statement): This section provides 

additional guidance on the Federal Reserve supervisory assessment of the overall 

effectiveness of an institution's internal audit function and considerations relating to the 

potential reliance by Federal Reserve examiners on an institution's internal audit work. 
Page 3 of 15 

SUPPLEMENTAL GUIDANCE 

1. Enhanced Internal Audit Practices 

An institution's internal audit function should incorporate the following enhanced 

practices into their overall processes: 

A. Risk Analysis 

Internal audit should analyze the effectiveness of all critical risk management functions 

both with respect to individual risk dimensions (for example, credit risk), and an institution's 

overall risk management function. The analysis should focus on the nature and extent of 

monitoring compliance with established policies and processes and applicable laws and 

regulations within the institution as well as whether monitoring processes are appropriate for the 

institution's business activities and the associated risks. 

B. Thematic Control Issues 

Internal audit should identify thematic macro control issues as part of its risk-assessment 

processes and determine the overall impact of such issues on the institution's risk profile. 

Additional audit coverage would be expected in business activities that present the highest risk to 

the institution. Internal audit coverage should reflect the identification of thematic macro control 

issues across the firm in all auditable areas. Internal audit should communicate thematic macro 

control issues to senior management and the audit committee. 

In addition, internal audit should identify patterns of thematic macro control issues, 

determine whether additional audit coverage is required, communicate such control deficiencies 

to senior management and the audit committee, and ensure management establishes effective 

remediation mechanisms. 

C. Challenging Management and Policy 

Internal audit should challenge management to adopt appropriate policies and procedures 

and effective controls. If policies, procedures, and internal controls are ineffective or insufficient 

in a particular line of business or activity, internal audit should report specific deficiencies to 

senior management and the audit committee with recommended remediation. Such 

recommendations may include restricting business activity in affected lines of business until 

effective policies, procedures, and controls are designed and implemented. Internal audit should 

monitor management's corrective action and conduct a follow-up review to confirm that the 

recommendations of both internal audit and the audit committee have been addressed. 

D. Infrastructure 

When an institution designs and implements infrastructure enhancements, internal audit 

should review significant changes and notify management of potential internal control issues. In 

particular, internal audit should ensure that existing, effective internal controls (for example, 

software applications and management information system reporting) are not rendered 
Page 4 of 15 

ineffective as a result of infrastructure changes unless those controls are compensated for by 

other improvements to internal controls. 

E. Risk Tolerance 

Internal audit should understand risks faced by the institution and confirm that the board 

of directors and senior management are actively involved in setting and monitoring compliance 

with the institution's risk tolerance limits. Internal audit should evaluate the reasonableness of 

established limits and perform sufficient testing to ensure that management is operating within 

these limits and other restrictions. 

F. Governance and Strategic Objectives 

Internal audit should evaluate governance at all management levels within the institution, 

including at the senior management level, and within all significant business lines. Internal audit 

should also evaluate the adequacy and effectiveness of controls to respond to risks within the 

organization's governance, operations, and information systems in achieving the organization's 

strategic objectives. Any concerns should be communicated by internal audit to the board of 

directors and senior management. 

2. Internal Audit Function (Part I of the 2003 Policy Statement) 

The primary objectives of the internal audit function are to examine, evaluate, and 

perform an independent assessment of the institution's internal control system, and report 

findings back to senior management and the institution's audit committee. An effective internal 

audit function within a financial institution is a vital means for an institution's board of directors 

to maintain the quality of the internal control environment and risk management systems. 

The guidance set forth in this section supplements the existing guidance in the 2003 

Policy Statement by strongly encouraging internal auditors to adhere to professional standards, 

such as the IIA guidance. Furthermore, this section clarifies certain aspects of the IIA guidance 

and provides practices intended to increase the safety and soundness of institutions. 

A. Attributes of Internal Audit 

Independence 

Internal audit is an independent function that supports the organization's business 

objectives and evaluates the effectiveness of risk management, control, and governance 

processes. The 2003 Policy Statement addressed the structure of an internal audit function, 

noting that it should be positioned so that an institution's board of directors has confidence that 

the internal audit function can be impartial and not unduly influenced by managers of day-to-day 

operations. Thus, the member of management responsible for the internal audit function 

(hereafter referred to as the chief audit executive or CAE) [Footnote 6 

- More recently, this title is used to refer to the person in charge of the internal audit function. An institution may 

not have a person at the management level of CAE and instead may have an internal audit manager. End of Footnote 6.] 

should have no responsibility for 
Page 5 of 15 

operating the system of internal control and should report functionally to the audit committee. A 

reporting arrangement may be used in which the CAE is functionally accountable and reports 

directly to the audit committee on internal audit matters (that is, the audit plan, audit findings, 

and the CAE's job performance and compensation) and reports administratively to another senior 

member of management who is not responsible for operational activities reviewed by internal 

audit. When there is an administrative reporting of the CAE to another member of senior 

management, the objectivity of internal audit is served best when the CAE reports 

administratively to the chief executive officer (CEO). 

If the CAE reports administratively to someone other than the CEO, the audit committee 

should document its rationale for this reporting structure, including mitigating controls available 

for situations that could adversely impact the objectivity of the CAE. In such instances, the audit 

committee should periodically (at least annually) evaluate whether the CAE is impartial and not 

unduly influenced by the administrative reporting line arrangement. Further, conflicts of interest 

for the CAE and all other audit staff should be monitored at least annually with appropriate 

restrictions placed on auditing areas where conflicts may occur. 

For foreign banking organizations (FBOs), the internal audit function for the U.S. 

operations of an FBO should have appropriate independent oversight for the total assets of U.S. 

operations. [Footnote 7 

- This is defined as the combined total assets of U.S. operations, net of all intercompany assets and claims on 

U.S.-domiciled affiliates. End of Footnote 7.] 

When there is a resident U.S. audit function, the CAE of the U.S. audit function 

should report directly to senior officials of the internal audit department at the head office such 

as the global CAE. If the FBO has separate U.S. subsidiaries, oversight may be provided by a 

U.S. based audit committee that meets U.S. public company standards for independence or by 

the foreign parent company's internal audit function. 

Professional Competence and Staffing 

Internal audit staff should have the requisite collective skill levels to audit all areas of the 

institution. Therefore, auditors should have a wide range of business knowledge, demonstrated 

through years of audit and industry-specific experience, educational background, professional 

certifications, training programs, committee participation, professional associations, and job 

rotational assignments. Internal audit should assign staff to audit assignments based on areas of 

expertise and, when feasible, rotate staff within the audit function. 

Internal audit management should perform knowledge gap assessments at least annually 

to evaluate whether current staff members have the knowledge and skills commensurate with the 

institution's strategy and operations. Management feedback surveys and internal or external 

quality assurance findings are useful tools to identify and assess knowledge gaps. Any identified 

knowledge gaps should be filled and may be addressed through targeted staff hires, training, 

business line rotation programs, and outsourcing arrangements. The internal audit function 

should have an effective staff training program to advance professional development and should 

have a process to evaluate and monitor the quality and appropriateness of training provided to 
Page 6 of 15 

each auditor. Internal auditors generally receive a minimum of forty hours of training in a given 

year. 

Objectivity and Ethics 

Internal auditors should be objective, which means performing assignments free from 

bias and interference. A major characteristic of objectivity is that the CAE and all internal audit 

professional staff avoid any conflicts of interest. [Footnote8 

- IIA standards define conflict of interest as a situation in which an internal auditor, who is in a position of trust, has 

a competing professional or personal interest. Such competing interests can make it difficult for the individual to 

fulfill his or her duties impartially. End of Footnote 8.] 

For their first year in the internal audit 

function, internally recruited internal auditors should not audit activities for which they were 

previously responsible. Moreover, compensation schemes should not provide incentives for 

internal auditors to act contrary to the attributes and objectives of the internal audit function. [Footnote 9 

- IIA standards have additional examples of "conflict of interest" for consideration. End of Footnote 9.] 

While an internal auditor may recommend internal control standards or review management's 

procedures before implementation, objectivity requires that the internal auditor not be 

responsible for the design, installation, procedures development, or operations of the institution's 

internal control systems. 

An institution's internal audit function should have a code of ethics that emphasizes the 

principles of objectivity, competence, confidentiality, and integrity, consistent with professional 

internal audit guidance such as the code of ethics established by the IIA. 

Internal Audit Charter 

Each institution should have an internal audit charter that describes the purpose, 

authority, and responsibility of the internal audit function. An audit charter should include the 

following critical components: 

• The objectives and scope of the internal audit function; 

• The internal audit function's management reporting position within the organization, 

as well as its authority and responsibilities; 

• The responsibility and accountability of the CAE; and 

• The internal audit function's responsibility to evaluate the effectiveness of the 

institution's risk management, internal controls, and governance processes. 

The charter should be approved by the audit committee of the institution's board of 

directors. The charter should provide the internal audit function with the authorization to access 

the institution's records, personnel, and physical properties relevant to the performance of 

internal audit procedures, including the authority to examine any activities or entities. 

Periodically, the CAE should evaluate whether the charter continues to be adequate, requesting 

the approval of the audit committee for any revisions. The charter should define the criteria for 

when and how the internal audit function may outsource some of its work to external experts. 
Page 7 of 15 

B. Corporate Governance Considerations 

Board of Directors and Senior Management Responsibilities 

The board of directors and senior management are responsible for ensuring that the 

institution has an effective system of internal controls. As indicated in the 2003 Policy 

Statement, this responsibility cannot be delegated to others within the institution or to external 

parties. Further, the board of directors and senior management are responsible for ensuring that 

internal controls are operating effectively. 

Audit Committee Responsibilities 

An institution's audit committee is responsible for establishing an appropriate internal 

audit function and ensuring that it operates adequately and effectively. The audit committee 

should be confident that the internal audit function addresses the risks and meets the demands 

posed by the institution's current and planned activities. Moreover, the audit committee is 

expected to retain oversight responsibility for any aspects of the internal audit function that are 

outsourced to a third party. 

The audit committee should provide oversight to the internal audit function. Audit 

committee meetings should be on a frequency that facilitates this oversight and generally should 

be held four times a year at a minimum, with additional meetings held by audit committees of 

larger financial institutions. Annually, the audit committee should review and approve internal 

audit's charter, budget and staffing levels, and the audit plan and overall risk-assessment 

methodology. The committee approves the CAE's hiring, annual performance evaluation, and 

compensation. 

The audit committee and its chairperson should have ongoing interaction with the CAE 

separate from formally scheduled meetings to remain current on any internal audit department, 

organizational, or industry concerns. In addition, the audit committee should have executive 

sessions with the CAE without members of senior management present as needed. 

The audit committee should receive appropriate levels of management information to 

fulfill its oversight responsibilities. At a minimum, the audit committee should receive the 

following data with respect to internal audit: 

• Audit results with a focus on areas rated less than satisfactory; 

• Audit plan completion status and compliance with report issuance timeframes; 

• Audit plan changes, including the rationale for significant changes; 

• Audit issue information, including aging, past-due status, root-cause analysis, and 

thematic trends; 

• Information on higher-risk issues indicating the potential impact, root cause, and 

remediation status; 

• Results of internal and external quality assurance reviews; 

• Information on significant industry and institution trends in risks and controls; 
Page 8 of 15 

• Reporting of significant changes in audit staffing levels; 

• Significant changes in internal audit processes, including a periodic review of key 

internal audit policies and procedures; 

• Budgeted audit hours versus actual audit hours; 

• Information on major projects; and 

• Opinion on the adequacy of risk management processes, including effectiveness of 

management's self-assessment and remediation of identified issues (at least annually). 

Role of the Chief Audit Executive 

In addition to communicating and reporting to the audit committee on audit-related 

matters, the CAE is responsible for developing and maintaining a quality assurance and 

improvement program that covers all aspects of internal audit activity, and for continuously 

monitoring the effectiveness of the audit function. The CAE and/or senior staff should 

effectively manage and monitor all aspects of audit work on an ongoing basis, including any 

audit work that is outsourced. [Footnote10 

- The ongoing review of audit work should include risk assessments of audit entities and elements, scope 

documents, audit programs, detailed audit procedures and steps (including sampling methodologies), audit work 

papers, audit findings, and monitoring of the timely and effective resolution of audit issues. End of Footnote 10.] 

C. The Adequacy of the Internal Audit Function's Processes 

Internal audit should have an understanding of the institution's strategy and operating 

processes as well as the potential impact of current market and macroeconomic conditions on the 

financial institution. Internal audit's risk-assessment methodology is an integral part of the 

evaluation of overall policies, procedures, and controls at the institution and the development of 

a plan to test those processes. 

Audit Methodology 

Internal audit should ensure that it has a well-developed risk-assessment methodology 

that drives its risk-assessment process. The methodology should include an analysis of crossinstitutional risk and thematic control issues and address its processes and procedures for 

evaluating the effectiveness of risk management, control, and governance processes. The 

methodology should also address the role of continuous monitoring in determining and 

evaluating risk, as well as internal audit's process for incorporating other risk identification 

techniques that the institution's management utilizes such as a risk and control self-assessment 

(RCSA). The components of an effective methodology should support the internal audit 

function's assessment of the control environment, beginning with an evaluation of the audit 

universe. 
Page 9 of 15 

Audit Universe 

Internal audit should have effective processes to identify all auditable entities within the 

audit universe. The number of auditable entities will depend upon whether entities are captured 

at individual department levels or at other aggregated organizational levels. Internal audit should 

use its knowledge of the institution to determine whether it has identified all auditable entities 

and may use the general ledger, cost centers, new product approval processes, organization 

charts, department listings, knowledge of the institution's products and services, major operating 

and application systems, significant laws and regulations, or other data. The audit universe 

should be documented and reviewed periodically as significant organizational changes occur or 

at least during the annual audit planning process. 

Internal Audit Risk Assessment 

A risk assessment should document the internal audit staff's understanding of the 

institution's significant business activities and the associated risks. These assessments typically 

analyze the risks inherent in a given business line or process, the mitigating control processes, 

and the resulting residual risk exposure to the institution. 

A comprehensive risk assessment should effectively analyze the key risks (and the 

critical risk management functions) within the institution and prioritize audit entities within the 

audit universe. The risk-assessment process should be well documented and dynamic, reflecting 

changes to the system of internal controls, infrastructure, work processes, and new or changed 

business lines or laws and regulations. The risk assessments should also consider thematic 

control issues, risk tolerance, and governance within the institution. Risk assessments should be 

revised in light of changing market conditions or laws and regulations and updated during the 

year as changes are identified in the business activities of the institution or observed in the 

markets in which the institution operates, but no less than annually. When the risk assessment 

indicates a change in risk, the audit plan should be reviewed to determine whether the planned 

audit coverage should be increased or decreased to address the revised assessment of risk. 

Risk assessments should be formally documented and supported with written analysis of 

the risks. [Footnote11 

- For example, risks include credit, market, operational, liquidity, compliance, IT, fraud, political, legal, regulatory, 

strategic, and reputational. End of Footnote 11.] 

There should be risk assessments for critical risk management functions within the 

institution. Risk assessments may be quantitative or qualitative and may include factors such as 

the date of the last audit, prior audit results, the impact and likelihood of an event occurring, and 

the status of external vendor relationships. A management RCSA, if performed, may be 

considered by the internal audit function in developing its independent risk assessment. The 

internal audit risk assessment should also include a specific rationale for the overall auditable 

entity risk score. The overall disposition of the risk assessment should be summarized with 

consideration given to key performance or risk indicators and prior audit results. A high-level 

summary or discussion of the risk-assessment results should be provided to the audit committee 

and include the most significant risks facing the institution as well as how these risks have been 

addressed in the internal audit plan. 
Pag e 1 0 o f 1 5 

Interna l Audi t Pla n 

Interna l audi t shoul d develo p an d periodicall y revis e it s comprehensiv e audi t pla n an d 

ensur e tha t audi t coverag e fo r al l identified , auditabl e entitie s withi n th e audi t univers e i s 

appropriat e fo r th e siz e an d complexit y o f th e institution' s activities . Thi s shoul d b e 

accomplishe d eithe r throug h a multi-yea r pla n approach , wit h th e pla n revise d annually , o r 

throug h a n approac h tha t utilize s a framewor k t o evaluat e risk s annuall y focusin g o n th e mos t 

significan t risks . I n th e latte r approach , ther e shoul d b e a mechanis m i n plac e t o identif y whe n a 

significan t ris k wil l no t b e audite d i n th e specifie d timefram e an d a requiremen t t o notif y th e 

audi t committe e an d see k it s approva l o f an y exceptio n t o th e framework . Generally , commo n 

practic e fo r institution s wit h define d audi t cycle s i s t o follo w eithe r a three - o r four-yea r audi t 

cycle ; high-ris k area s shoul d b e audite d a t leas t ever y twelv e t o eightee n months . [Footnote1 2 

- Regardles s o f th e institution' s practice , particula r car e shoul d b e take n t o ensur e tha t higher-ris k element s ar e 

reviewe d wit h a n appropriat e frequency , an d no t obscure d du e t o thei r inclusio n i n a lowe r risk-rate d audi t entity . End of Footnote 12.] 

T h e interna l audi t pla n shoul d conside r th e ris k assessmen t an d interna l audit' s approac h 

t o audi t coverag e shoul d b e appropriat e base d o n th e ris k assessment . A n effectiv e pla n cover s 

individua l busines s area s an d ris k discipline s a s wel l a s cross-functiona l an d cross-institutiona l 

areas . 

T h e audi t plannin g proces s shoul d b e dynamic , allowin g fo r chang e whe n necessary . Th e 

proces s shoul d includ e a proces s fo r modifyin g th e interna l audi t pla n t o incorporat e significan t 

change s tha t ar e identifie d eithe r throug h continuou s monitorin g o r durin g a n audit . An y 

significan t change s shoul d b e clearl y documente d an d include d i n quarterl y communication s t o 

t h e audi t committee . Critica l dat a t o b e reporte d t o th e audi t committe e shoul d includ e deferre d 

o r cancelle d audit s rate d high-ris k an d othe r significan t addition s o r deletions . Significan t 

change s t o audi t budget s an d timelines s fo r th e completio n o f audit s shoul d b e reporte d t o th e 

audi t committe e wit h documente d rationale . 

Interna l Audi t Continuous Monitorin g 

Interna l audi t i s encourage d t o utiliz e forma l continuou s monitorin g practice s a s par t o f 

t h e function' s risk-assessmen t processe s t o suppor t adjustment s t o th e audi t pla n o r univers e a s 

the y occur . Continuou s monitorin g ca n b e conducte d b y a n assigne d grou p o r individua l interna l 

auditors . A n effectiv e continuou s monitorin g proces s shoul d includ e writte n standard s t o ensur e 

consisten t applicatio n o f processe s throughou t th e organization . 

Continuou s monitorin g result s shoul d b e documente d throug h a combinatio n o f metrics , 

managemen t reporting , periodi c audi t summaries , an d update d ris k assessment s t o substantiat e 

tha t th e proces s i s operatin g a s designed . Critica l issue s identifie d throug h th e monitorin g 

proces s shoul d b e communicate d t o th e audi t committee . Computer-assiste d auditin g technique s 

a r e usefu l tool s t o highligh t issue s tha t warran t furthe r consideratio n withi n a continuou s 

monitorin g process . 
Page 11 of 15 

D. Internal Audit Performance and Monitoring Processes 

Performance 

Detailed guidance related to the performance of an internal audit should be documented 

in the audit manual [Footnote13 

- To facilitate effective, efficient, and consistent practice within the internal audit department, an institution should 

develop an audit manual that includes comprehensive policies and procedures and is made available to all internal 

audit staff. The manual should be updated as needed. End of Footnote 13.] 

and work programs to ensure that audit execution is consistent across the 

audit function. Internal audit policies and procedures should be designed to ensure that audits 

are executed in a high-quality manner, their results are appropriately communicated, and issues 

are monitored and appropriately resolved. In performing internal audit work, an institution 

should consider the following. 

• Internal Audit Scope: During the audit planning process, internal audit should 

analyze the auditable entity's specific risks, mitigating controls, and level of residual 

risk. The information gathered during the audit planning phase should be used to 

determine the scope and specific audit steps that should be performed to test the 

adequacy of the design and operating effectiveness of control processes. 

• Internal Audit Work Papers: Work papers document the work performed, 

observations and analyses made, and support for the conclusions and audit results. 

The work papers should contain sufficient information regarding any scope or audit 

program modifications and waiver of issues not included in the final report. Work 

papers also should document the specific sampling methodology, including minimum 

sample sizes, and the rationale for such methodology. The work papers should 

contain information that reflects all phases of the audit process including planning, 

fieldwork, reporting, and issues tracking and follow-up. On an ongoing basis, a 

comprehensive supervisory review should be performed on all audit work, including 

any outsourced internal audit procedures. [Footnote14 

- An experienced audit manager should perform this review. End of Footnote 14.] 

• Audit Report: Internal audit should have effective processes to ensure that issues are 

communicated throughout the institution and audit issues are addressed in a timely 

manner. The audit report should include an executive summary that describes the 

auditable area, audit's conclusions, the rationale for those conclusions, and key 

issues. Most audit reports also include management's action plans to address audit 

findings. To ensure that identified issues are addressed in a timely manner, reports 

should be issued to affected business areas, senior management, and the audit 

committee within an appropriate timeframe after the completion of field work. 

Compliance with issuance timeframes should be monitored and reported periodically 

to the audit committee. At a minimum, internal audit should ensure that management 

considers the level and significance of the risk when assigning resources to address 

and remediate issues. Management should appropriately document the action plans 

either within the audit report or separately. 
Page 12 of 15 

• Internal Audit Issues Tracking: Internal audit should have effective processes in 

place to track and monitor open audit issues and to follow-up on such issues. The 

timely remediation of open audit issues is an essential component of an organization's 

risk reduction efforts. Internal audit and the responsible management should discuss 

and agree to an appropriate resolution date, based on the level of work necessary to 

complete remediation processes. When an issue owner indicates that work to close an 

issue is completed, the internal audit function should perform validation work prior to 

closing the issue. The level of validation necessary may vary based on the issue's 

risk level. For higher-risk issues, internal audit should perform and document 

substantive testing to validate that the issue has been resolved. Issues should be 

tested over an appropriate period of time to ensure the sustainability of the 

remediation. 

Retrospective Review Processes 

When an adverse event occurs at an institution (for example, fraud or a significant loss), 

management should conduct a post-mortem and "lessons learned" analysis. In these situations, 

internal audit should ensure that such a review takes place and appropriate action is taken to 

remediate identified issues. The internal audit function should evaluate management's analysis 

of the reasons for the event and whether the adverse event was the result of a control breakdown 

or failure, and identify the measures that should be put in place to prevent a similar event from 

occurring in the future. In certain situations, the internal audit function should conduct its own 

post-mortem and a "lessons learned" analysis outlining the remediation procedures necessary to 

detect, correct, and/or prevent future internal control breakdowns (including improvements in 

internal audit processes). 

Quality Assurance and Improvement Program 

A well-designed, comprehensive quality assurance program should ensure that internal 

audit activities conform to the IIA's professional standards and the institution's internal audit 

policies and procedures. The program should include both internal and external quality 

assessments. 

The internal audit function should develop and document its internal assessment program 

to promote and assess the quality and consistency of audit work across all audit groups with 

respect to policies, procedures, audit performance, and work papers. The quality assurance 

review should be performed by someone independent of the audit work being reviewed. 

Conclusions reached and recommendations for appropriate improvement in internal audit process 

or staff training should be implemented by the CAE through the quality assurance and 

improvement program. Action plan progress should be monitored and subsequently closed after 

a period of sustainability. Each institution should conduct an internal quality assessment 

annually and the CAE should report the results and status of internal assessments to senior 

management and the audit committee at least annually. 

The IIA recommends that an external quality assessment of internal audit be performed 

by a qualified independent party at least once every five years. The review should address 

compliance with the IIA's definition of internal auditing, code of ethics, and standards, as well as 
Page 13 of 15 

with the internal audit function's charter, policies and procedures, and any applicable legislative 

and regulatory requirements. The CAE should communicate the results, planned actions, and 

status of remediation efforts to senior management and the audit committee. 

3. Internal Audit Outsourcing Arrangements (Part II of the 2003 Policy Statement) 

As stated in the 2003 Policy Statement, an institution's board of directors and senior 

management are charged with the overall responsibility for maintaining an effective system of 

internal controls. Responsibility for maintaining an effective system of internal controls cannot 

be delegated to a third party. An institution that chooses to outsource audit work should ensure 

that the audit committee maintains ownership of the internal audit function. The institution's 

audit committee and CAE should provide active and effective oversight of outsourced activities. 

Institutions should carefully consider the oversight responsibilities that are consequential to these 

types of arrangements in determining appropriate staffing levels. 

To distinguish its duties from those of the outsourcing vendor, the institution should have 

a written contract, which may take the form of an engagement letter or similar services 

agreement. Contracts between the institution and the vendor should include a provision stating 

that work papers and any related non-public confidential information and personal information 

must be handled by the vendor in accordance with applicable laws and regulations. An 

institution should periodically confirm that the vendor continues to comply with the agreed-upon 

confidentiality requirements, especially for long-term contracts. The audit committee should 

approve all significant aspects of outsourcing arrangements and should receive information on 

audit deficiencies in a manner consistent with that provided by the in-house audit department. 

A. Vendor Competence 

An institution should have appropriate policies and procedures governing the selection 

and oversight of internal audit vendors, including whether to continue with an existing 

outsourced arrangement. The audit committee and the CAE are responsible for the selection and 

retention of internal audit vendors and should be aware of factors that may impact vendors' 

competence and ability to deliver high-quality audit services. 

B. Contingency Planning 

An institution's contingency plan should take into consideration the extent to which the 

institution relies upon outsourcing arrangements. When an institution relies significantly on the 

resources of an internal audit service provider, the institution should have contingency 

procedures for managing temporary or permanent disruptions in the service in order to ensure 

that the internal audit function can meet its intended objectives. 

C. Quality of Audit Work 

The quality of audit work performed by the vendor should be consistent with the 

institution's standards of work expected to be performed by an in-house internal audit 

department. Further, information supplied by the vendor should provide the board of directors, 

its audit committee, and senior management with an accurate report on the control environment, 

including any changes necessary to enhance controls. 
Page 14 of 15 

4. Independence Guidance for the Independent Public Accountant (Part III of the 2003 

Policy Statement) 

The following discussion supplements the discussion in Part III of the 2003 Policy 

Statement and addresses additional requirements regarding auditor independence for depository 

institutions subject to Section 36 of the FDI Act (as amended in 2009). 

A. Depository Institutions Subject to the Annual Audit and Reporting 

Requirements of Section 36 of the FDI Act 

The July 2009 amendments to Section 36 of the FDI Act (applicable to insured 

depository institutions with total assets of $500 million or more) require an institution's external 

auditor to follow the more restrictive of the independence rules issued by the AICPA, SEC, and 

PCAOB. In March 2003, the SEC prohibited a registered public accounting firm that is 

responsible for furnishing an opinion on the consolidated or separate financial statements of an 

audit client from providing internal audit services to that same client. [Footnote15 

- See SEC Final Rule, Strengthening the Commission's Requirements Regarding Auditor Independence, at 

17 CFR parts 210, 240, 249 and 274. End of Footnote15.] 

Therefore, by following 

the more restrictive independence rules, a depository institution's external auditor is precluded 

from performing internal audit services, either on a co-sourced or an outsourced basis, even if the 

institution is not a public company. 

5. Examination Guidance (Part IV of the 2003 Policy Statement) 

The following discussion supplements the existing guidance in Part IV of the 2003 Policy 

Statement on examination guidance and discusses the overall effectiveness of an institution's 

internal audit function and the examiner's reliance on internal audit. 

A. Determining the Overall Effectiveness of Internal Audit 

An effective internal audit function is a vehicle to advance an institution's safety and 

soundness and compliance with consumer laws and regulations and is therefore considered as 

part of the supervisory review process. Federal Reserve examiners will make an overall 

determination as to whether the internal audit function and its processes are effective or 

ineffective and whether examiners can potentially rely upon internal audit's work as part of the 

supervisory review process. If internal audit's overall processes are deemed effective, examiners 

may be able to rely on the work performed by internal audit depending on the nature and risk of 

the functions subject to examination. 

The supervisory assessment of internal audit and its effectiveness will consider an 

institution's application of the 2003 Policy Statement and this supplemental guidance. An 

institution's internal audit function generally would be considered effective if the institution's 

internal audit function structure and practices are consistent with the 2003 Policy Statement and 

this guidance. 
Page 15 of 15 

Conversely, an institution's internal audit function that does not follow the enhanced 

practices and supplemental guidance outlined in this policy letter generally will be considered 

ineffective. In such a case, examiners will not rely on the institution's internal audit function. 

Examiners will inform the CAE as to whether the function is deemed to be effective or 

ineffective. Internal audit's overall processes could be deemed effective even though some 

aspects of the internal audit function may require enhancements or improvements such as 

additional documentation with respect to specific audit processes (for example, risk assessments 

or work papers). In these situations, the required enhancements or improvements generally 

should not be a critical part of the overall internal audit function, or the function should be 

deemed to be ineffective. 

B. Relying on the Work Performed by Internal Audit 

Examiners may rely on internal audit at supervised institutions if internal audit was 

deemed effective at the most recent examination of internal audit. In examining an institution's 

internal audit function, examiners will supplement their examination procedures through 

continuous monitoring and an assessment of key elements of internal audit, including: (i) the 

adequacy and independence of the audit committee; (ii) the independence, professional 

competence, and quality of the internal audit function; (iii) the quality and scope of the audit 

methodology, audit plan, and risk assessment; and (iv) the adequacy of audit programs and work 

paper standards. On at least an annual basis, examiners should review these key elements to 

determine whether there have been significant changes in the internal audit infrastructure or 

whether there are potential concerns regarding their adequacy. 

Examiners may choose to rely on the work of internal audit when internal audit's overall 

function and related processes are effective and when recent work was performed by internal 

audit in an area where examiners are performing examination procedures. For example, if an 

internal audit department performs internal audit work in an area where examiners might also 

review controls, examiners may evaluate whether they can rely on the work of internal audit (and 

either eliminate or reduce the testing scheduled as part of the regulatory examination processes). 

In high-risk areas, examiners will consider whether additional examination work is needed even 

where internal audit has been deemed effective and its work reliable.