Internal audit in a bank is not internal audit with more acronyms. It is a function whose plan, risk assessment, workpapers, and issue log are read by people with the power to restrict the institution’s growth, and whose failures show up in enforcement actions by name: “the bank’s internal audit function failed to identify” is a sentence that has appeared in consent orders against institutions of every size. The examiners who read the audit committee minutes decide how much of their own examination they can skip because internal audit already looked, and that reliance decision is worth more to the institution than most audit budgets. The third line in financial services therefore has two audiences, the board and the regulator, and a set of expectations written down in guidance that the function is expected to know and to be able to show it meets.
This guide covers what is different about the third line in a regulated financial institution and then goes deep on the area regulators test hardest: the audit universe by risk stripe with typical engagements and frequencies, a regulator-expectation matrix for the OCC, the Federal Reserve, the FDIC, FINRA, and the state insurance regulators, a full BSA/AML independent-testing work program with populations and evidence, the AML findings that recur, an overview of consumer compliance audits, an MRA response playbook, and a three-year coverage cycle with hours for a $9 billion bank. It was rewritten in September 2026 to reflect the Global Internal Audit Standards, the interagency model risk guidance revised in April 2026, and current examination practice. The site’s Risk Library holds the guides on the individual risk stripes this one maps.
In this guide
- What is different about the third line in financial services
- The audit universe by risk stripe
- What each regulator expects of internal audit, and how examiners test it
- The BSA/AML independent-testing work program
- AML findings that recur
- Consumer compliance audits: the compliance management system
- The MRA response playbook
- A three-year coverage cycle with hours
- Common failures of financial services audit functions
- Adapting: credit unions, broker-dealers, insurers, fintech partners, and the UK
What is different about the third line in financial services
Five things. The function is a regulatory expectation rather than a governance choice: the interagency policy statement on the internal audit function (2003) and the Federal Reserve’s supplemental policy statement (SR 13-1, 2013, for institutions above $10 billion) describe what the function must look like, and the OCC’s heightened standards (12 CFR Part 30, Appendix D, for banks above $50 billion) require internal audit to assess the risk governance framework itself. The audit universe is organized around risk stripes the regulators define, so that examiners can map the plan to their own risk assessment; the OCC risk categories primer explains the stripes. Examiners rely on internal audit’s work to scope their own, which means workpapers are written for a reader who was not there and who may be hostile. Regulatory findings enter the issue log with a lifecycle of their own, and closing one requires validation the regulator will re-test; the regulatory issue lifecycle guide covers it. And the second line is mandated, independent, and itself an audit subject: the third line audits the risk function, the compliance function, and the model validation function, which requires a different kind of engagement from a process audit.
The consequence for the CAE is that the function’s own governance is examined. Examiners read the charter, the audit committee minutes, the risk assessment methodology, the plan and its changes, the staffing and skills inventory, the quality assurance program, and the issue log, and they form a view of whether the function is independent, competent, and comprehensive enough to be relied on. The QAIP guide covers the external assessment that examiners expect to see every five years; the Domain III and Domain IV guides cover the governance and management standards the examination maps onto.
The audit universe by risk stripe
The universe below is for a mid-size commercial bank; a broker-dealer, insurer, or credit union re-weights it. Frequencies are the practical norms examiners expect for a well-run function; higher-risk units within each stripe run annually and lower-risk ones on a two- or three-year cycle, with the annual risk assessment documenting the choice.
| Risk stripe | Typical engagements | Frequency | Site guide |
|---|---|---|---|
| Credit | Credit underwriting and approval; loan review function (or reliance on it); allowance for credit losses (CECL) process and model; problem loan and workout; collateral and appraisal; credit concentration reporting | Underwriting annually by portfolio; allowance annually; others 2-year | Credit risk for internal auditors |
| Interest rate and market | ALM process and ALCO governance; IRR measurement and model; investment portfolio; derivatives and hedging; capital planning and stress testing | ALM and IRR annually; investments and derivatives 2-year | IRR vs. IRRBB vs. SIRR |
| Liquidity | Liquidity risk management and contingency funding; liquidity stress testing; cash and wire operations; funding concentrations; Fed reporting (FR 2052a where applicable) | Annually | Liquidity risk |
| Operational | ORM framework; payments and wires; deposit operations; loan servicing; information technology and cybersecurity; third-party risk management; business continuity; fraud risk management | Framework 2-year; high-risk operations annually; IT annually with rotating depth | Operational risk; Cybersecurity program audit |
| Compliance: BSA/AML and sanctions | Independent testing of the BSA/AML program (below); OFAC sanctions program; transaction monitoring model validation coverage | Annually, or every 12 to 18 months for lower-risk institutions with documented rationale | This guide |
| Compliance: consumer and conduct | Compliance management system; fair lending; UDAAP; deposit regulations (E, CC, DD); lending regulations (Z, B, X, C/HMDA, flood); complaints management; privacy | CMS annually; regulations on a risk-based 2- to 3-year rotation with high-risk annually | Compliance risk |
| Model | Model risk management framework; validation function; specific model deep dives (allowance, IRR, AML monitoring, pricing) | Framework annually; deep dives rotating | Model risk audit |
| Strategic and reputation | Strategic planning process; new products and initiatives; mergers and integrations; complaints and social media monitoring as inputs | 2-year, or event-driven | Internal audit’s role in ERM |
| Governance and risk management | Risk governance framework (heightened standards); board and committee effectiveness; ERM; risk appetite; the second-line functions themselves; regulatory reporting (call report, other filings) | Annually for the framework and regulatory reporting | GRC framework |
| Financial reporting | ICFR support (SOX 404 for public institutions, FDICIA Part 363 for banks above $1 billion in assets); financial close; capital calculations | Annually | SOX 404 |
What each regulator expects of internal audit, and how examiners test it
| Regulator and source | What it expects of internal audit | How examiners test it |
|---|---|---|
| Interagency (OCC, Fed, FDIC): Policy Statement on the Internal Audit Function and Its Outsourcing (2003) | Independence with direct reporting to the audit committee; a risk-based plan approved by the committee; qualified staff; full access; a quality program; management of outsourced audit work with the institution retaining responsibility | Read the charter and committee minutes; interview the CAE and committee chair; compare the plan to their own risk view; review outsourcing contracts and the institution’s oversight of the vendor |
| Federal Reserve: SR 13-1 / CA 13-1 supplemental policy statement (2013; institutions above $10 billion) | Enterprise-wide risk assessment with a documented methodology; a dynamic plan revised as risk changes; audit of the risk management and compliance functions and of significant change initiatives; formal challenge of management; issue tracking with root cause; a strong quality program; the committee’s oversight of all of it | Trace plan changes to risk changes; sample engagements for challenge and root cause; test issue aging and escalation; assess whether audit covered the second line with rated conclusions |
| OCC: Heightened Standards, 12 CFR 30 Appendix D (banks above $50 billion) | Internal audit assesses whether the risk governance framework meets the standards and is being implemented; reports to the audit committee on the framework; maintains a risk universe covering front-line units, independent risk management, and the framework itself | Review the framework assessment and its evidence; test whether findings on the framework were rated and escalated; interview the audit committee on its understanding of the assessment |
| FDIC: Part 363 (banks above $500 million; ICFR attestation above $1 billion) | Audit committee independence; management’s ICFR assessment supported by testing, usually internal audit’s; the committee’s oversight of the external and internal audit functions | Review the annual report and the committee’s minutes; test the ICFR assessment’s support |
| FFIEC BSA/AML Examination Manual: independent testing | Testing of the BSA/AML program by internal audit or an independent party, risk-based, generally every 12 to 18 months, with scope covering the program’s components and transaction testing; testers must be independent of the BSA function | Read the audit scope and workpapers; compare coverage to the bank’s risk assessment; check whether transaction testing was performed; test whether findings were tracked to closure; assess the testers’ independence and qualifications |
| FINRA Rules 3110 and 3120 (broker-dealers) | A supervisory control system tested annually with a report to senior management; internal audit is commonly the tester; Rule 4530 reporting of internal conclusions of violations | Review the annual 3120 report and the testing behind it; sample supervisory reviews; test the 4530 filings against internal findings |
| State insurance regulators: NAIC Model Audit Rule (internal audit function requirement, effective 2020 for insurers above $500 million in premium) | An internal audit function independent of management, reporting to the audit committee, with a risk-based plan and the committee’s oversight | Review the charter, plan, and minutes during the financial examination |
| NCUA (credit unions): supervisory committee audit rules, Part 715 | An annual audit under the supervisory committee’s direction; internal audit where size warrants; the committee’s independence | Review the supervisory committee’s minutes and the audit scope |
The common thread is reliance. An examiner who concludes that internal audit is independent, competent, and comprehensive will use its work to reduce examination scope and will say so in the report of examination; one who does not will examine the areas audit covered as if audit did not exist, and will write about the function. Reliance is earned in the workpapers and lost in the issue log: examiners who find audit findings closed without validation stop relying on anything else in the file. The issue validation guide sets the standard examiners apply.
The BSA/AML independent-testing work program
Independent testing is one of the five pillars of a BSA/AML program under 31 CFR 1020.210 (internal controls, independent testing, a designated BSA officer, training, and customer due diligence), and it is the pillar internal audit owns. The examination manual expects the test to be risk-based, to cover every component of the program, and to include transaction testing, not only a review of policies; examiners read the audit report and workpapers and then perform their own transaction testing to see whether audit found what they found. The program below is sized at 400 to 600 hours for a mid-size bank with a monitoring system; sample sizes follow the site’s sampling guide with the high-risk populations tested at the larger end. Every procedure ends in a rated conclusion on the component.
| # | Component | Objective | Procedure | Population and sample | Evidence |
|---|---|---|---|---|---|
| 1 | Governance | Board oversight and BSA officer authority are real | Inspect board approval of the program and annual BSA training minutes; assess the BSA officer’s qualifications, reporting line, staffing, and budget against the bank’s risk profile; read four quarters of BSA committee minutes for decisions | All minutes in the period | Minutes; org chart; budget; job description |
| 2 | Risk assessment | The BSA/AML risk assessment reflects the bank’s products, customers, geographies, and channels | Test the assessment’s inputs to source data (customer counts by type, product volumes, high-risk geographies, cash intensity); compare to the prior year and to changes in the business; assess whether conclusions drive the program’s controls | All inputs; 25 data points traced | Risk assessment; source reports |
| 3 | Customer identification (CIP) | Identity is verified at account opening per the CIP | Test new accounts for identity documentation, verification, and record retention; test non-documentary verification and exceptions | All new accounts in the period; sample 40, weighted to non-face-to-face and business accounts | Account opening records; CIP exception log |
| 4 | Customer due diligence and beneficial ownership | Risk profiles and beneficial ownership are collected, current, and drive monitoring | Test legal-entity accounts for beneficial ownership certification (25 percent threshold and control person); test customer risk ratings against the methodology; test periodic refresh for high-risk customers | Legal-entity openings in the period, sample 40; high-risk customers, sample 40 | Certifications; risk rating records; refresh evidence |
| 5 | Enhanced due diligence | High-risk customers receive EDD per policy | For sampled high-risk customers (MSBs, cash-intensive businesses, PEPs, foreign correspondents, private banking), inspect EDD files, source-of-funds documentation, and periodic review at the policy frequency | High-risk population, sample 40 | EDD files; review dates |
| 6 | Transaction monitoring: coverage | The monitoring system covers the bank’s products, channels, and typologies | Map scenarios to the risk assessment’s typologies and to product lines; identify products or channels not monitored; test the data feeds into the system for completeness against source totals | All scenarios; all feeds; one month reconciled | Scenario inventory; feed reconciliations; the IPE method |
| 7 | Transaction monitoring: tuning and validation | Thresholds are risk-based and the model is validated | Inspect the last threshold tuning analysis and its approval; inspect the model validation under the model risk framework (the 2021 interagency statement applies model risk guidance to AML systems); test whether recommendations were implemented | All scenarios’ thresholds; the validation report | Tuning documentation; validation report; issue tracking |
| 8 | Alert dispositions | Alerts are worked timely, documented, and dispositioned reasonably | Test alerts for disposition within policy timeframes, documented rationale, escalation to case, and quality of the analyst’s work; re-perform the disposition decision | Alerts in the period; sample 60, stratified by scenario and analyst; oversample closed-as-not-suspicious | Alert records; case files |
| 9 | Case investigation and SAR decisioning | Cases are investigated fully and SAR decisions are supported and timely | Test cases for investigation depth, decision documentation, and SAR filing within 30 calendar days of initial detection (60 where no subject is identified); test decisions not to file for supportable rationale; read a sample of SAR narratives for completeness | Cases in the period; sample 40 filed, 25 not filed | Case files; SAR forms and acknowledgments; decision memos |
| 10 | Currency transaction reporting | CTRs are complete, accurate, and filed within 15 calendar days | Reconcile cash transactions over $10,000 (aggregated per business day) from teller and vault systems to CTRs filed; test CTRs for accuracy and timeliness; test the exemption list for eligibility and annual review; test structuring alerts | Full population reconciliation for one month; 25 CTRs; all exemptions | Cash reports; CTR filings; exemption records |
| 11 | Sanctions (OFAC) | Screening is complete, current, and dispositions are documented | Test screening coverage of customers, transactions, and parties (wires, ACH, trade); confirm list update frequency and the screening tool’s fuzzy-matching settings; test potential-match dispositions and any blocked or rejected transactions and their reporting | List updates in the period; potential matches, sample 40; all true hits | Screening configuration; disposition records; OFAC reports |
| 12 | Information sharing (314(a) and 314(b)) | 314(a) requests are searched and responded to within the two-week window; 314(b) sharing is registered and documented | Test 314(a) request logs for search completeness and response timeliness; inspect 314(b) registration and a sample of shared-information records | All 314(a) requests in the period | Request logs; search evidence; responses |
| 13 | Recordkeeping and the travel rule | Funds transfer records at $3,000 and above are complete and travel with the payment | Test wires for required originator and beneficiary information and retention; test monetary instrument logs ($3,000 to $10,000 cash purchases) | Wires in the period, sample 40; instrument log, one month | Wire records; logs |
| 14 | Training | Training is risk-based, current, and reaches the right people | Reconcile completion to the population of staff in BSA-relevant roles; inspect content for currency and role-tailoring; test board training | Full reconciliation of completion | Training records; content |
| 15 | Prior findings and regulatory issues | Prior audit, examination, and validation findings are remediated | Validate closure of all BSA findings open at the last test; test the issue log’s aging | All open and closed items | Issue log; validation evidence |
| 16 | Higher-risk lines (as applicable) | Correspondent banking, MSB customers, trade finance, crypto-related customers, and fintech partnerships have program coverage matching their risk | For each line present, test the specific controls the examination manual expects (due diligence on respondents, MSB registration and agent lists, trade document review, partner-program oversight) | Population by line; sample 25 each | Line-specific files |
Two design points. Transaction testing is not optional, and it must be audit’s own: reviewing the BSA department’s quality assurance results is a test of QA, not of transactions. And the monitoring system’s data feeds are the single point of failure examiners now go to first; a system that never receives the wire file monitors nothing, and the completeness reconciliation in procedure 6 is the test that finds it. The fraud red flags library carries the typologies that scenario coverage in procedure 6 is mapped against.
AML findings that recur
| Finding | How it is found | Root cause, usually | Typical rating and regulatory consequence |
|---|---|---|---|
| Monitoring data feeds incomplete: a product, channel, or subsidiary never reached the system | Feed reconciliation to source totals (procedure 6) | Interface built at go-live and never revisited when products were added | High; frequently an MRA and, if prolonged, a consent order element |
| Thresholds never tuned; scenarios inherited from the vendor’s defaults | Tuning documentation absent or older than three years | No model risk treatment of the monitoring system | High; examiners cite the 2021 interagency statement on model risk for AML |
| Alert backlog beyond policy timeframes | Alert aging report; disposition sample | Staffing not scaled to alert volume; volume not managed by tuning | High when backlog delays SARs; the SAR clock runs from detection |
| Alerts closed with boilerplate rationale | Disposition sample; re-performance disagrees | Productivity targets; weak QA | Medium to High depending on re-performance disagreement rate |
| SARs filed late or narratives incomplete | Case sample against the 30-day rule; narrative review | Investigation queue; no calendar control on detection date | High; late SARs are individually citable |
| Beneficial ownership not collected or not refreshed | Legal-entity sample | Account-opening workflow does not enforce; refresh not scheduled | Medium to High by volume |
| High-risk customers without EDD or with stale reviews | High-risk sample; review dates | Risk rating model under-identifies; EDD team under-resourced | High for MSBs and correspondents |
| CTR exemptions not reviewed annually or granted to ineligible customers | Exemption list test | Set-and-forget exemptions | Medium |
| OFAC screening gaps in a channel (ACH parties, trade documents, non-customer wires) | Coverage mapping | Screening tool licensed per channel; channel added later | High; sanctions violations carry strict liability |
| Risk assessment not driving the program: high-risk products identified with no corresponding scenario or EDD | Compare assessment conclusions to controls | Assessment written for the examiner, not for the program | Medium; becomes High when a product is unmonitored as a result |
| Independent testing itself deficient: no transaction testing, testers reporting to the BSA officer, scope copied year to year | Examiner’s review of audit’s work | Audit under-resourced or under-skilled in BSA | Cited against the audit function; ends reliance |
Consumer compliance audits: the compliance management system
Consumer compliance is audited at two levels. The compliance management system (CMS) audit tests the program: board and management oversight, the compliance program itself (policies, training, monitoring, and corrective action), the consumer complaint response, and the compliance audit function’s own coverage; examiners rate the CMS on those elements, and internal audit’s CMS engagement mirrors the structure so that the two views can be compared. The regulation-level audits test compliance with specific rules on a risk-based rotation: Regulation Z and TILA-RESPA disclosures for lending, Regulation B and fair lending across the credit lifecycle (with statistical analysis of pricing and underwriting outcomes where volumes allow), HMDA data integrity, flood insurance, Regulation E for electronic payments and error resolution, Regulations CC and DD for deposits, privacy under Regulation P and GLBA, and UDAAP as a lens over every product’s marketing, disclosure, and servicing. The complaint file is the audit’s best data source: complaints tagged by product and root cause show where the disclosures are failing before the regulation-level test finds it, and an audit that samples complaints for timeliness and resolution quality and then follows the pattern into the product has done more than one that tests disclosures alone. The compliance risk guide covers the compliance risk assessment that sets the rotation, and the issue log template the tracking of regulatory findings alongside audit’s.
The MRA response playbook
A Matter Requiring Attention (or Matter Requiring Immediate Attention, or the equivalent in other regulators’ vocabularies) is a supervisory finding the institution must remediate and the regulator will re-test. Internal audit has a defined part at each stage, and a function that plays it well shortens the institution’s time under the finding; the regulatory issue lifecycle guide covers the full cycle.
| Stage | Management | Internal audit | Timing | Pitfall |
|---|---|---|---|---|
| Receipt | Log the MRA in the regulatory issue register with the regulator’s exact language; assign an executive owner | Enter the MRA in the issue log with the regulatory flag; assess whether audit had covered the area and, if so, why it did not find the condition (a root-cause review of audit’s own work, reported to the committee) | Within 5 business days | Paraphrasing the regulator’s language into something narrower |
| Root cause and action plan | Root-cause analysis; an action plan with milestones, owners, dates, and the evidence that will show completion; submitted to the regulator | Review the plan for whether the actions address the regulator’s condition, not management’s restatement of it; challenge dates and evidence definitions; report the review to the committee | Per the regulator’s deadline, commonly 30 to 90 days | Actions that fix the symptom (the sample) rather than the cause (the process) |
| Remediation | Execute; report progress to the board and the regulator monthly or quarterly | Monitor milestones through the issue log; escalate slippage; do not perform the remediation | Per plan | Audit staff seconded to remediation, ending independence for the validation |
| Validation | Declare implementation with the evidence package | Validate against the regulator’s condition with the sustainability period examiners expect (typically two to three cycles of the control); write the validation report as a document the examiner will read: population, procedure, sample, results, conclusion, independence | After the minimum operating period; within the log’s service level | Validating the week after implementation |
| Closure request | Submit the closure package with audit’s validation | Attend the examiner’s closure discussion; make the workpapers available | Per the regulator | Requesting closure on management’s say-so |
| Post-closure | Sustain; report the control in ongoing monitoring | Re-test at the next engagement in the area; report any re-opening to the committee by name | Next cycle | The control lapses once attention moves |
A three-year coverage cycle with hours
Lakeshore Bancorp is a $9 billion regional bank with 60 branches, a mortgage company, a wealth unit, and a 14-person internal audit function with 18,000 available hours a year after administration, training, and reserve. The cycle below is how those hours cover the universe over three years; annual items appear each year and the rotation fills the rest. It is the document examiners ask for when they test whether the plan is risk-based and whether coverage is complete.
| Area | Year 1 hours | Year 2 hours | Year 3 hours | Basis |
|---|---|---|---|---|
| BSA/AML independent testing and sanctions | 550 | 550 | 550 | Annual; higher-risk lines (MSB customers, fintech partner program) tested every year |
| Consumer compliance: CMS and rotation | 900 (CMS, fair lending, Reg Z) | 900 (CMS, Reg E, HMDA, flood) | 900 (CMS, UDAAP, deposits, privacy) | CMS annual; regulations rotate with high-risk annual |
| Credit | 1,400 (commercial underwriting, allowance) | 1,400 (consumer and mortgage underwriting, allowance, workout) | 1,400 (CRE concentration, allowance, loan review function) | Allowance annual; portfolios rotate |
| ALM, IRR, liquidity, investments | 800 | 800 | 800 | Annual with rotating model deep dives |
| Operations and payments | 1,100 (wires, deposit operations, branch) | 1,100 (loan servicing, mortgage operations) | 1,100 (wealth operations, treasury management) | High-risk annually within each year’s set |
| IT, cybersecurity, and third-party | 1,600 | 1,600 | 1,600 | Annual with rotating depth; cybersecurity program every year under the Topical Requirement |
| Model risk management | 500 (framework, allowance model) | 500 (framework, AML monitoring model) | 500 (framework, IRR and pricing models) | Framework annual; deep dives rotate |
| ERM, risk governance, second-line functions | 700 | 700 | 700 | Annual; heightened-standards style assessment even below the threshold |
| Financial reporting and ICFR (FDICIA) | 2,200 | 2,200 | 2,200 | Annual |
| Regulatory reporting | 400 | 400 | 400 | Annual (call report and other filings) |
| Fraud, ethics, whistleblowing | 400 | 400 | 400 | Annual |
| Strategic, change, and integration | 600 | 600 | 600 | Event-driven; core system replacement in year 2 pulls hours from rotation |
| Issue validation and regulatory issue support | 1,900 | 1,900 | 1,900 | Quarterly validation windows; MRA validations as they fall due |
| Advisory and special requests | 800 | 800 | 800 | Capped; disclosed as advisory |
| QAIP, methodology, committee reporting | 750 | 750 | 750 | Annual; external assessment in year 3 |
| Reserve for emerging risk | 1,400 | 1,400 | 1,400 | Roughly 8 percent; drawn down by mid-year plan revisions the committee approves |
| Total | 18,000 | 18,000 | 18,000 |
Three features of that cycle answer examiner questions before they are asked. The validation line is large because the function treats validation as an engagement with hours, not as spare time, and the regulator sees a validation backlog as a control failure of the function. The reserve is explicit and its use is reported, which is the evidence that the plan is dynamic. And every annual item is annual because either a regulation or the bank’s risk assessment says so, with the reason written in the plan; the annual plan template carries that structure.
Common failures of financial services audit functions
| Failure | What it looks like | Why it matters | Fix |
|---|---|---|---|
| Auditing to the checklist | The AML audit tests policy existence and training completion; no transaction testing | Examiners find what audit did not, and stop relying on audit | Transaction testing in every component; conclusions rated |
| Not auditing the second line | Risk and compliance functions never receive a rated engagement | SR 13-1 and heightened standards expect it; the board’s assurance over the second line is missing | Annual engagements on the risk, compliance, and model validation functions with conclusions |
| Static plan | The plan approved in January is executed unchanged through a system conversion, an acquisition, and an MRA | The plan is not risk-based in fact | Quarterly plan review with documented changes and a reserve |
| Closing regulatory issues on management’s package | MRA closure requested with management’s evidence and no audit validation | The regulator re-tests, finds the control not sustained, and cites the function | Independent validation with a sustainability period; written as a report for the examiner |
| Skills gap in BSA, models, and IT | Generalist auditors testing transaction monitoring tuning | Findings are shallow; examiners assess competence | Specialists on staff or co-sourced under the function’s direction, with the skills inventory shown to the committee |
| Workpapers written for the team | Conclusions that assume the reader was in the room | Examiners cannot re-perform; reliance ends | Workpapers to the standard in the workpaper guide: a stranger can re-trace every conclusion |
| Reliance without evaluation | Audit relies on second-line testing or loan review without assessing its quality | Audit’s coverage claim rests on work it has not evaluated | Documented evaluation of the other provider each year; reliance stated in the plan |
| Committee kept comfortable | Reports rated Satisfactory across a year in which the regulator issued three MRAs | The committee learns the institution’s condition from the examiner | Ratings by published definitions; the CAE’s annual opinion reconciled to the regulator’s findings |
Adapting: credit unions, broker-dealers, insurers, fintech partners, and the UK
A credit union’s function reports to the supervisory committee and scales the universe to its products, with BSA testing and lending compliance dominant; the cycle above compresses to a third of the hours with the same annual items. A broker-dealer adds the FINRA Rule 3120 supervisory control testing and net capital and customer protection (Rule 15c3-3) to the annual set, and the AML program is tested against FINRA Rule 3310. An insurer under the Model Audit Rule builds the universe around underwriting, claims, reserving and the actuarial function, investments, and reinsurance, with the actuarial models under the model risk framework. Banks with fintech or banking-as-a-service partners have a universe within the universe: each partner program is a high-risk line whose BSA, consumer compliance, and third-party controls are tested every year, and the 2024 and 2025 enforcement actions against partner banks make the point about what happens when they are not; the Third-Party Topical Requirement now sets the minimum coverage. In the United Kingdom the Chartered IIA’s Internal Audit Code of Practice (2024 edition, covering financial services and now wider sectors) plays the role the US policy statements play, with the PRA and FCA expecting conformance; the substance of what the third line must cover is the same. Every guide on the site is indexed at All Guides, and the operational risk guide and model risk audit guide take two of the stripes above to full depth.
Related guides
- The OCC’s risk categories — the stripes the universe is organized around
- The lifecycle of regulatory issues — MRAs from identification to closure
- Issue validation — the standard examiners apply to closure
- Operational risk — the framework and its audit
- Model risk audit — including the AML monitoring model
- Compliance risk — the compliance risk assessment behind the rotation
- Liquidity risk — the liquidity stripe in depth
- Credit risk for internal auditors — the credit stripe
- QAIP and the external assessment — what examiners expect of the function’s own quality program
- The Risk Library — every risk stripe guide
- Conduct Risk Explained: Definition, Examples and Indicators — definition, drivers, indicators and how to audit it.
- Internal Audit in Banking: The Complete Guide — what makes bank audit different, the regulators, the universe and the career path
- BSA/AML Independent Testing: The Audit Program That Works — the pillars, the test program and what examiners expect from the independent test
- Compliance Risk Assessment: Method, Scoring, Worked Example — obligations inventory, exposure scoring and prioritization that regulators accept
- Internal Audit in Insurance: The Complete Guide — the complete guide to the function at insurers.
- Dark Towers by David Enrich: Summary and Lessons for Auditors — a bank whose growth outran its controls.
Leave a Reply