FCA Essential Practices for Information Technology 

Based on Industry Standards and FFIEC Examination Guidance 

Table of Contents 

Page 

Audit
 

Introduction.............................................................................................................................................. A - 1
 

Examination Objectives........................................................................................................................... A - 1
 

Examination Procedures ......................................................................................................................... A - 1
 

Essential Practice Statements................................................................................................................. A - 2
 

Risk Assessment............................................................................................................................... A - 2
 

Audit Plan.......................................................................................................................................... A - 2
 

Audit Resources................................................................................................................................ A - 2
 

Reporting........................................................................................................................................... A - 3
 
 

 

 

 

 

 

 

 

 

 

 

Audit 

Introduction: 

The board of directors and management are responsible for ensuring adequate management practices are in place for 

effective oversight and management of the institution’s IT environment. All institutions should adopt an effective audit 

and review program regardless of whether the technology services are provided internally or externally. FCA Regulation 

618.8430(b) requires the adoption of internal audit and control procedures that evidence responsibility for review and 

maintenance of comprehensive and effective internal controls. FCA Regulation 609.940 establishes additional 

requirements regarding internal systems and controls. Standard audit processes should be followed including developing 

an audit plan and establishing reporting requirements. Additional audit guidance is covered in the Internal Controls 

section of the FCA Examination Manual. 

Examination Objectives: 

Determine if the board and management have established and maintained an effective audit program. This is 

accomplished through the following examination objectives: 

• Board Direction and Oversight – Evaluate the board’s involvement in establishing IT audit scope and reporting 

requirements and ensuring the availability of competent IT audit resources. 

• Audit Program – Assess the quality and effectiveness of the IT audit program. This will assist the examiner in 

evaluating the adequacy of IT audit coverage and to what extent, if any, the examiner may rely upon the results 

of the audit program in determining the scope of the IT examination. 

Examination Procedures: 

Examination activities should be based on the criticality and complexity of the business functions present at the institution. 

The examination should begin with a review of audit results and the adequacy of corrective actions. At a minimum, the 

Essential Practices for IT Audit should be clearly documented and functioning within the internal control environment. 

More in-depth examination procedures (such as those found in the FFIEC Audit Booklet) should be evaluated and 

incorporated into the examination scope as an institution’s size, risk, and complexity increases. 

FCA Essential Practices for Information Technology A - 1 

Audit Section 
 

 

 

 

 

 

 

 

 

 

 

 

Conduct a risk assessment and identify risk exposures 

(e.g., that threaten data integrity, financial condition, 

financial performance, continuity of operations, regulatory 

compliance, and customer service). 

Reason: 

A risk assessment provides the internal auditor and the board 

with objective information to prioritize the allocation of audit 

resources properly. In assessing risk, consider the nature of 

the specific operation and related assets and liabilities, the 

existence of appropriate policies, the effectiveness of operating 

procedures and internal controls, and the potential materiality 

of errors and irregularities associated with the specific 

operation. A risk assessment: 

• Provides a foundation for the audit plan; 

• Promotes timely audit reporting on high-risk conditions; 

• Ensures that relevant information has been obtained 

from all management levels, including boards of 

directors, IT auditors, and functional area management; 

• Establishes a basis for managing the audit department 

effectively; and 

• Provides a summary of how the individual audit subject is 

related to the overall organization as well as to the 

business plans. 

Element 

Essential Practices Statement 

Risk Assessment 

COBIT: Control 

Objectives for 

Information and related 

Technology. ver. 4.1, 

PO9. 

Audit 

Industry Standard 

Reference 

Audit Booklet (Aug. 

2003), pp. 15-16. 

Business Continuity 

Planning Booklet 

(Mar. 2008), p. 4, 

Appendix H, H-2 

FFIEC IT 

Examination 

Handbook 

Reference 

Develop an IT audit plan based on the results of the risk 

assessment. 

Reason: 

The IT audit plan defines the IT scope, objectives and 

strategies. It establishes a balance between scope, 

timeframes, and staff days to ensure optimum use of 

resources. 

Audit Plan 

Audit Booklet (Aug. 

2003), p. 8-10. 

Management Booklet 

(Jun. 2004), P10 

Ensure audit resources are independent, competent, and 

have the necessary experience to accomplish the IT audit 

objectives. 

Reason: 

The ability of the internal audit function to achieve desired 

objectives depends largely on the independence of audit 

personnel. The auditor should report and be accountable to 

Audit Resources 

Audit Booklet (Aug. 

2003), pp. 8-10. 

Management Booklet 

(Jun. 2004), p. 10 

FCA Essential Practices for Information Technology A - 2 

Audit Section 
 

 

 

 

 

 

 

 

 

the board of directors or its designated committee. This 

accountability precludes the auditor from certain relationships 

that may compromise audit independence. The overall 

competence level required for an internal audit function 

depends upon the size and complexity of its operations and the 

responsibility delegated to the auditor. External sources can 

be used to supplement or perform the IT audit function if 

internal resources or expertise are not adequate. 

Element 

Essential Practices Statement 

Reporting 

Audit 

Industry Standard 

Reference 

FFIEC IT 

Examination 

Handbook 

Reference 

Prepare written reports for the board of directors or audit 

committee, which outline the results of each audit or 

review. Such reports include: 

• Description of scope and findings, 

• Underlying causes of weaknesses, 

• Conclusions, and 

• Recommendations for corrective action. 

Reason: 

Reports communicate audit findings to the board. They also 

assist management in evaluating the quality of its IT 

department and identifying methods for correcting or improving 

adverse conditions. 

FCA Examination 

Manual, Section 525, 

“Internal Controls.” 

Audit Booklet (Aug. 

2003), p. 12. 

FCA Essential Practices for Information Technology A - 3 

Audit Section