An audit universe is the inventory of everything an internal audit function could audit, each item (an auditable entity) rated for risk and assigned a cycle, so that the annual plan can be drawn from it and the board can see what is and is not covered. Every bank has one, examiners ask for it first, and almost none are published, because a universe describes an institution’s risk profile in detail. This guide publishes a complete one for a fictional but realistic bank: Lakeshore Bancorp, the $9 billion publicly traded regional bank holding company used in examples across this site, whose lead bank is supervised by the OCC and whose 22-person internal audit function appears throughout the banking guide.
The universe has 126 auditable entities in seven domains, each with a rating, the driver behind the rating, its audit cycle and the hours an audit takes. Around the table, the guide explains how the universe was built and the sources it was reconciled to, how granular an entity should be, how the second line and the mandated work are handled, the five-factor rating model, the cycle rules examiners expect and how they turn 126 entities into a plan of about 24,000 hours, the governance that keeps the universe current, how examiners test it, and the adjustments one supervisory cycle produced. The general method is in the audit universe and auditable entities guides; the risk assessment that rates the entities is in the annual risk assessment guide; and the plan guide shows the capacity model the universe feeds.
In this guide
- The bank, in brief
- How the universe was built
- Granularity: how big an entity should be
- The five-factor rating model
- Cycle rules
- The universe by domain
- The full universe: 126 entities
- Handling the second line and the mandated work
- From universe to plan: the capacity arithmetic
- Governance: keeping the universe current
- How examiners test a universe
- What one supervisory cycle changed
- Adapting the example to your bank
- Questions about bank audit universes
- Related guides
The bank, in brief
| Attribute | Lakeshore Bancorp | Why it matters to the universe |
|---|---|---|
| Size and structure | $9 billion in assets; publicly traded holding company; one national bank; equipment finance and insurance agency subsidiaries | Holding company reporting, subsidiary governance and SOX enter the universe |
| Regulators | OCC (lead bank), Federal Reserve (holding company); consumer compliance examined by the OCC below the $10 billion CFPB threshold; FDIC insured | Examination cycle and regulatory programs are standing entities |
| Business | Commercial and industrial and commercial real estate lending (about $4.1 billion commercial portfolio), consumer and mortgage lending, deposits of about $7.5 billion, treasury management, wealth and trust | Lines of business are the largest domain |
| Technology | Vendor core banking platform; digital banking platform; a hybrid cloud estate of 62 AWS accounts; core conversion program under way | Technology is the second-largest domain and the fastest-changing |
| Second line | Chief risk officer reporting to the board risk committee; compliance department of about 40; credit review; model risk management; operational risk function of six | Fourteen second-line entities, seven rated high |
| Internal audit | 22 in-house auditors in five teams; co-source for model validation review and specialist cyber; about 24,000 available hours a year | Capacity against which the cycle is tested |
| Recent history | Matters requiring attention on interest rate risk model assumptions and third-party inventory completeness; SOX program with 212 key controls; a High finding on deposit assumptions from the model risk audit | Ratings reflect open findings and examiner focus |
How the universe was built
The universe was last rebuilt in full three years ago and is reconciled annually. The rebuild started from six sources and reconciled them against each other until every item in each source had a home in the universe: the organization chart to the department level; the product and service list from the bank’s product governance committee; the general ledger’s business unit and cost center structure; the vendor inventory for outsourced processes; the application inventory for systems; and the regulatory map of mandated activities (FDICIA, SOX, BSA independent testing, the trust department audit, regulatory reporting). The reconciliation found the usual gaps: two products (the credit card agent program and the health savings accounts) that appeared in the product list but in no prior universe, an acquired equipment finance subsidiary carried as a single line, and eleven vendors performing processes the universe treated as the bank’s own. The function then grouped the items into entities by the rule described in the next section, assigned each to an owner on the management side and to one of its five audit teams, and rated every entity with the five-factor model. The result was presented to the audit committee as a universe of 126 entities, with the reconciliation evidence attached, and the committee approved it with the cycle rules. The auditable entities guide covers the general technique; the bank-specific lesson is that the second line and the regulatory programs must be entities in their own right, which the section below explains.
Granularity: how big an entity should be
| Rule | Reasoning | Example in the universe |
|---|---|---|
| An entity is a unit that can be audited in one engagement of 100 to 700 hours | Smaller units are combined; larger ones split, or the universe becomes a list of tasks or a list of divisions | Commercial lending split into origination, servicing and problem loans; five branch regions combined into one entity audited by rotation |
| An entity has one accountable owner | Findings need an owner; ratings need someone to challenge | Wire operations (operations) separate from the wire platform’s ITGCs (technology), with different owners |
| Processes and systems are separate entities | Process audits test business controls; ITGC audits test the platform; combining them produces engagements that do neither well | Core banking platform ITGCs is an entity; deposit operations is another |
| Second-line functions are entities | Internal audit must assure the risk and compliance functions themselves | Fourteen entities in the risk management domain |
| Mandated and regulatory work is in the universe | It consumes a large fixed share of hours and the committee should see it | Ten entities in the regulatory programs domain, including issue validation and the ICFR program |
| Outsourced processes stay in the universe | The bank owns the risk; the vendor runs the process | Lockbox services; printing and statement rendering vendor; courier and cash-in-transit vendor |
| Products with no distinct process are not entities | They are audited within the process that handles them | Certificates of deposit are inside deposit products; business checking inside treasury management services |
The five-factor rating model
Each entity is scored one to five on five weighted factors against written anchors; the weighted score maps to a high, moderate or low rating, with the chief audit executive permitted to override the computed rating in either direction with a documented reason (eleven overrides exist in the current universe, all upward). The model follows the structure in the annual risk assessment guide with bank-specific anchors: the regulatory factor carries more weight than in a non-bank model, and the scale of the financial factor is set by the bank’s capital rather than its revenue.
| Factor | Weight | Score 5 anchor | Score 1 anchor |
|---|---|---|---|
| Inherent risk: financial and balance sheet exposure | 25 percent | Entity controls or reports on exposures above 10 percent of Tier 1 capital, or processes payments above $1 billion a month | Exposure below 0.5 percent of Tier 1 capital; no payment processing |
| Regulatory and compliance intensity | 25 percent | Open supervisory finding; mandated audit; consumer protection or BSA content with penalty history in the industry | No specific regulation beyond general corporate law |
| Control environment and audit history | 20 percent | Prior High findings open or repeated; unsatisfactory last rating; new or recently changed controls untested | Satisfactory last two audits; no open findings |
| Change and complexity | 15 percent | New system, conversion, acquisition, new product or leadership change in the last year; model-dependent | Stable for three years; simple, manual-free process |
| Management and strategic concern | 15 percent | Board or audit committee has asked for coverage; strategic growth area; examiner focus signaled | No stakeholder concern expressed |
Cycle rules
| Rating | Cycle | Entities | Rule |
|---|---|---|---|
| High | Annual, or continuous for the mandated programs and issue validation | 31 | Every high entity has an engagement or a continuous program in every plan; no deferrals without audit committee approval |
| Moderate | Every two years | 52 | Half the moderate entities each year, scheduled so that related entities fall in the same year; a moderate entity may be advanced on a trigger |
| Low | Every three years | 43 | A third each year; cash counts and surprise audits run annually regardless; low entities may be covered by analytics or a limited review |
| Any rating | Triggered | A supervisory finding, a major incident, a system conversion or an acquisition advances the entity to the current plan |
The rules produce full coverage inside three years, which is the expectation the OCC and Federal Reserve examiners have expressed to this bank, and they are written into the audit committee’s approval of the plan so that a deferral is visibly a committee decision. The arithmetic of applying them to 126 entities is in the capacity section.
The universe by domain
| Domain | Entities | High | Moderate | Low | Average annual hours on cycle |
|---|---|---|---|---|---|
| Lines of business | 24 | 7 | 11 | 6 | 4,443 |
| Treasury and finance | 16 | 5 | 5 | 6 | 2,800 |
| Risk management (second line) | 14 | 7 | 6 | 1 | 3,760 |
| Operations | 22 | 3 | 10 | 9 | 2,637 |
| Technology | 22 | 6 | 11 | 5 | 3,860 |
| Governance and support | 18 | 0 | 5 | 13 | 1,253 |
| Regulatory programs, mandated audits and projects | 10 | 3 | 4 | 3 | 5,667 |
| Total | 126 | 31 | 52 | 43 | 24,420 |
The average annual hours column applies the cycle rules to each entity’s audit hours (all of a high entity’s hours each year, half of a moderate entity’s, a third of a low entity’s) and is the demand the plan must meet. Regulatory programs are the largest domain by hours despite having ten entities, because the ICFR program and issue validation are standing commitments; lines of business are the largest by entity count and the second by hours.
The full universe: 126 entities
Hours are the function’s budget for a full engagement of the entity at its current rating; rating drivers summarize the factor that most shaped the rating. Last-audited dates and owners are carried in the function’s working version and omitted here.
| Auditable entity | Rating | Cycle | Hours per audit | Rating driver |
|---|---|---|---|---|
| Lines of business (24 entities: 7 high, 11 moderate, 6 low) | ||||
| Commercial and industrial lending: origination and underwriting | High | Annual | 420 | Largest credit exposure; judgment-heavy |
| Commercial real estate lending: origination, underwriting and concentrations | High | Annual | 420 | Concentration limits; examiner focus |
| Commercial loan servicing, renewals and covenant monitoring | High | Annual | 360 | Prior MRA on covenant monitoring |
| Problem loan management, workouts and nonaccrual | Moderate | Two years | 320 | Grading accuracy; accounting |
| Consumer lending: indirect auto and home equity | Moderate | Two years | 300 | Volume; dealer channel |
| Mortgage origination and secondary marketing | High | Annual | 380 | Regulatory density; repurchase risk |
| Mortgage servicing and escrow | Moderate | Two years | 300 | Servicing rules; escrow accuracy |
| Small business and SBA lending | Moderate | Two years | 260 | Guaranty compliance |
| Equipment finance subsidiary | Moderate | Two years | 260 | Acquired unit; separate systems |
| Deposit products, pricing and account opening | Moderate | Two years | 240 | Disclosures; onboarding controls |
| Treasury management services: ACH origination, remote deposit, positive pay | High | Annual | 360 | Client payment fraud exposure |
| Wealth management and trust: fiduciary activities | High | Annual | 400 | Fiduciary duty; regulatory audit requirement |
| Private banking | Moderate | Two years | 220 | Concentrated relationships |
| Digital channels: online and mobile banking | High | Annual | 360 | Rapid growth; re-rated after examination |
| Branch network operations (five regions) | Moderate | Two years | 420 | Cash and dual control; rotation |
| Government and public funds banking | Moderate | Two years | 200 | Collateralization; concentration |
| Loan participations and syndications | Moderate | Two years | 220 | Purchased credit; documentation |
| Overdraft and NSF program | Moderate | Two years | 200 | Consumer compliance scrutiny |
| Credit card agent program | Low | Three years | 140 | Third-party issued |
| Merchant services (referral program) | Low | Three years | 120 | Referral only |
| Insurance agency subsidiary | Low | Three years | 160 | Small; state-licensed |
| Safe deposit and retail services | Low | Three years | 100 | Low value |
| Letters of credit and standby facilities | Low | Three years | 160 | Low volume; documentary |
| Lockbox services | Low | Three years | 140 | Outsourced processing |
| Treasury and finance (16 entities: 5 high, 5 moderate, 6 low) | ||||
| Asset-liability management and interest rate risk | High | Annual | 400 | EVE limit breach history; models |
| Liquidity and funding management | High | Annual | 360 | Post-2023 supervisory focus |
| Investment portfolio and securities accounting | Moderate | Two years | 280 | Unrealized losses; classification |
| Capital planning and stress testing | High | Annual | 340 | Board decisions depend on it |
| Allowance for credit losses (CECL) | High | Annual | 400 | Largest estimate; model-driven |
| Regulatory reporting: call report and holding company reports | High | Annual | 360 | Accuracy examined; penalties |
| Financial close and general ledger | Moderate | Two years | 300 | SOX reliance |
| Derivatives and hedge accounting | Moderate | Two years | 260 | Complex accounting |
| Brokered and wholesale funding | Moderate | Two years | 200 | Liquidity rules |
| Loan accounting and servicing systems | Moderate | Two years | 240 | System integrity |
| Accounts payable and expense management | Low | Three years | 180 | Routine |
| Fixed assets and premises | Low | Three years | 140 | Low change |
| Tax | Low | Three years | 160 | Outsourced preparation |
| Financial planning and management reporting | Low | Three years | 160 | Internal use |
| Bank-owned life insurance | Low | Three years | 120 | Static portfolio |
| Other real estate owned | Low | Three years | 140 | Low balances currently |
| Risk management (second line) (14 entities: 7 high, 6 moderate, 1 low) | ||||
| Enterprise risk management framework and appetite | High | Annual | 360 | Heightened expectations; board reliance |
| Credit review (loan review) function | High | Annual | 360 | Examiners test its accuracy |
| Model risk management framework | High | Annual | 420 | 2026 interagency guidance; vendor models |
| Operational risk management framework | High | Annual | 360 | RCSA and loss data quality |
| Compliance management system and regulatory change | High | Annual | 380 | CFPB threshold approaching |
| BSA/AML and OFAC sanctions program (independent testing) | High | Annual | 700 | Mandated annual independent test |
| Fair lending and UDAAP | Moderate | Two years | 320 | Statistical testing |
| Third-party risk management program | High | Annual | 360 | Open MRA on inventory completeness |
| Information security risk management (second line) | Moderate | Two years | 240 | Oversight of the CISO function |
| Fraud risk management program | Moderate | Two years | 260 | Rising external fraud |
| Business continuity and operational resilience program | Moderate | Two years | 300 | Resilience expectations |
| Complaint management | Moderate | Two years | 200 | Root-cause use |
| Risk data aggregation and reporting | Moderate | Two years | 240 | Board pack accuracy |
| Insurance program | Low | Three years | 120 | Annual renewal |
| Operations (22 entities: 3 high, 10 moderate, 9 low) | ||||
| Wire transfer operations | High | Annual | 360 | Highest-value payments; fraud |
| ACH operations and returns | High | Annual | 320 | Volume; NACHA rules |
| Trust operations and custody | High | Annual | 340 | Client assets |
| Deposit operations and exceptions | Moderate | Two years | 300 | Exception handling |
| Loan operations and documentation | Moderate | Two years | 300 | Collateral perfection |
| Item processing and check clearing | Moderate | Two years | 240 | Check fraud |
| ATM and cash management | Moderate | Two years | 240 | Cash controls |
| Card operations and disputes | Moderate | Two years | 240 | Regulation E timelines |
| Contact center | Moderate | Two years | 220 | Authentication; complaints |
| Fraud operations and investigations | Moderate | Two years | 260 | Case handling |
| Mortgage default servicing and foreclosure | Moderate | Two years | 260 | Consumer protection rules |
| Account reconciliations (operational) | Moderate | Two years | 240 | Suspense aging |
| Real estate appraisal management | Moderate | Two years | 200 | Independence rules |
| Records management and imaging | Low | Three years | 140 | Retention |
| Unclaimed property and escheatment | Low | Three years | 120 | State compliance |
| Collateral and vault management | Low | Three years | 140 | Dual control |
| Retirement and IRA accounts | Low | Three years | 140 | Tax reporting |
| Health savings accounts | Low | Three years | 120 | Small product |
| Gift cards and prepaid products | Low | Three years | 100 | Third-party program |
| Foreign exchange and international services (referral) | Low | Three years | 120 | Referral model |
| Courier and cash-in-transit vendor | Low | Three years | 100 | Vendor controls |
| Printing, mail and statement rendering vendor | Low | Three years | 120 | Data handling vendor |
| Technology (22 entities: 6 high, 11 moderate, 5 low) | ||||
| Core banking platform: ITGCs | High | Annual | 400 | Everything depends on it |
| Identity and access management | High | Annual | 360 | Leaver and privileged access findings |
| Change management and SDLC | High | Annual | 320 | Digital pipeline change volume |
| Cybersecurity program | High | Annual | 420 | Threat environment; board priority |
| Cloud services (AWS estate) | High | Annual | 360 | 62 accounts vs 48 known; prior findings |
| Digital banking platform ITGCs | High | Annual | 320 | Customer-facing; growth |
| Privileged access | Moderate | Two years | 260 | Follow-up on prior High |
| Vulnerability and patch management | Moderate | Two years | 260 | Metrics improving |
| Incident response and detection | Moderate | Two years | 240 | Plan exercised annually |
| Data governance and data quality | Moderate | Two years | 300 | Regulatory reporting dependency |
| Network and infrastructure | Moderate | Two years | 260 | Segmentation |
| Backup, recovery and disaster recovery | Moderate | Two years | 280 | Immutability confirmed |
| Payments systems ITGCs (wire and ACH platforms) | Moderate | Two years | 300 | Covered partly in wire audit |
| Technology third parties and SOC report review | Moderate | Two years | 240 | Core provider reliance |
| Project and program assurance (core conversion program) | Moderate | Two years | 300 | Multi-year program |
| IT governance and strategy | Moderate | Two years | 240 | Board reporting |
| End-user computing | Moderate | Two years | 200 | 212 EUCs; 31 Tier 1 |
| Email, collaboration and mobile device management | Low | Three years | 160 | Standard controls |
| Robotic process automation and workflow tools | Low | Three years | 160 | Small footprint |
| Physical and environmental security of data centers | Low | Three years | 140 | Co-located |
| Telecommunications and expense management | Low | Three years | 120 | Cost control |
| Social media, website and digital marketing | Low | Three years | 140 | Brand and disclosure |
| Governance and support (18 entities: 0 high, 5 moderate, 13 low) | ||||
| Incentive compensation and sales practices | Moderate | Two years | 300 | Conduct risk; regulatory guidance |
| Board and committee governance | Moderate | Two years | 240 | Charter conformance |
| Human resources and payroll | Moderate | Two years | 280 | Payroll vendor; access |
| Procurement and vendor payments | Moderate | Two years | 260 | Duplicate payments; approvals |
| Ethics, code of conduct and whistleblower program | Moderate | Two years | 200 | Hotline handling |
| Corporate governance of subsidiaries | Low | Three years | 160 | Few entities |
| Legal and litigation management | Low | Three years | 160 | Reserve adequacy |
| Marketing and advertising compliance | Low | Three years | 180 | Disclosure review |
| Corporate security and physical security | Low | Three years | 140 | Branch security |
| Facilities and leases | Low | Three years | 140 | Lease accounting |
| Internal audit's own QAIP (self-assessment) | Low | Three years | 120 | Annual self-assessment |
| Investor relations and public disclosures | Low | Three years | 160 | Disclosure committee |
| Employee benefit plans | Low | Three years | 160 | ERISA audit by external firm |
| Charitable foundation and community giving | Low | Three years | 100 | CRA-related |
| Corporate travel and expense | Low | Three years | 140 | Executive expenses |
| Interchange and card network compliance | Low | Three years | 120 | Network rules |
| Sustainability and ESG reporting | Low | Three years | 140 | Voluntary disclosures |
| Shareholder services and transfer agent oversight | Low | Three years | 120 | Outsourced |
| Regulatory programs, mandated audits and projects (10 entities: 3 high, 4 moderate, 3 low) | ||||
| Regulatory issue validation (MRAs and internal issues) | High | Annual | 1600 | Examiner reliance |
| FDICIA and SOX 404: ICFR testing program | High | Annual | 2400 | Mandated; 212 key controls |
| Trust department annual audit (regulatory) | High | Annual | 400 | Required annually |
| Examination management and request coordination | Moderate | Two years | 400 | Two examinations a year |
| Acquisition due diligence and integration | Moderate | Two years | 400 | Pipeline activity |
| Regulatory change readiness reviews | Moderate | Two years | 400 | Effective dates |
| Continuous auditing and analytics program | Moderate | Two years | 600 | Standing program |
| Advisory and special projects | Low | Three years | 600 | Committee requests |
| Branch cash counts and surprise audits | Low | Three years | 300 | Deterrence |
| Complaint and whistleblower investigations support | Low | Three years | 200 | As needed |
Handling the second line and the mandated work
Two design choices distinguish a bank universe. The second line appears as fourteen entities because supervisors expect internal audit to assure the risk and compliance functions themselves (the Federal Reserve’s supplemental policy statement and the OCC’s heightened standards are explicit, and the Basel Committee’s principles extend the expectation internationally), and because a framework audit of credit review, model risk management or the compliance management system is a different engagement from an audit of the processes those functions oversee. Seven of the fourteen are rated high, which reflects the bank’s size and recent findings rather than a rule; a smaller bank with a thin second line might carry five entities with two rated high. The programs for the main ones are on this site: model risk management, operational risk management, BSA/AML independent testing, third-party risk management and enterprise risk management. The mandated and regulatory work appears as ten entities in its own domain because it consumes 5,667 of the 24,420 cycle hours, about 23 percent, and the committee should see that share explicitly when it approves the plan; the ICFR program alone, at 2,400 hours, is the largest single commitment the function has, and the SOX scoping guide shows why. Issue validation at 1,600 hours reflects the open supervisory findings and the 61 internal issues validated in the last cycle, as the regulatory issue lifecycle guide describes.
From universe to plan: the capacity arithmetic
| Step | Figure | Note |
|---|---|---|
| Staff | 22 auditors | Including the CAE and two managers |
| Gross hours | 45,760 | 22 × 2,080 |
| Less leave, holidays, training, administration, quality program | −18,300 | About 40 percent; training is heavier in banks because of regulatory content |
| Less management and committee time | −3,460 | CAE and managers’ non-audit time |
| Available for the plan | 24,000 | Direct audit, validation and regulatory support |
| Cycle demand from the universe | 24,420 | From the domain table |
| Gap | −420 | Closed by stretching four low-risk entities to the following year with committee approval and by co-sourcing 300 hours of model validation review |
| Resulting plan | 46 engagements covering 71 entities (31 high, 26 moderate, 14 low) plus the continuous programs | Several small entities combined per engagement; fixed component 54 percent of hours |
The capacity model is the one in the plan guide with one bank-specific feature: the fixed component (mandated audits, issue validation, examination support) is computed first and the risk-based component is what remains, because the fixed work cannot be deferred. When the demand exceeds capacity, the committee chooses between stretching low-risk entities, adding co-source hours or adding staff, and the resource sufficiency statement the Standards require (and the annual agenda schedules in the fourth quarter) is where the choice is recorded.
Governance: keeping the universe current
| Trigger | Action | Owner |
|---|---|---|
| Annual risk assessment | Every entity re-rated; sources reconciled again; changes logged | Professional practices team; CAE approves; committee receives |
| New product approval | Product governance committee minutes reviewed quarterly; new products assigned to an entity or given one | Audit manager, lines of business |
| Acquisition or disposal | Acquired units added at closing with a provisional high rating until first audited | CAE |
| Vendor inventory change | New outsourced processes reviewed against the universe quarterly | Audit manager, operations and compliance |
| Application inventory change | New systems assigned to an ITGC entity or given one | Audit manager, technology |
| Supervisory finding or incident | Entity re-rated and advanced; change reported to the committee at the next meeting | CAE |
| Version control | Universe versioned with the plan; prior versions retained for examiners | Professional practices |
How examiners test a universe
Examiners ask for the universe at the start of every examination and test it in four ways. Completeness: they compare it with the organization chart, the product list, the vendor inventory and the application inventory they have obtained from management, and ask about anything missing; the two products found in the rebuild would have been examiner findings had they not been. Rating reasonableness: they read the rating drivers for the entities they know well and challenge ratings that seem out of step with the bank’s risk profile, as they did with the digital channels entity described below. Cycle adherence: they take the high entities and confirm each was audited in the last year, then sample moderate and low entities against their cycles, and read the committee minutes for any deferrals. And currency: they look for the last reconciliation and for the handling of changes since, especially acquisitions and conversions. A universe that passes these tests is the foundation of examiner reliance; one that fails them is a finding about the function regardless of the quality of its individual audits. The what regulators expect guide puts the test in the context of the whole examination.
What one supervisory cycle changed
| Change | Trigger | Effect on the universe and plan |
|---|---|---|
| Digital channels re-rated moderate to high | Examiner observation that the rating lagged the channel’s growth | Engagement added in-year; two low entities deferred with committee approval |
| Third-party risk management program confirmed high | Matter requiring attention on inventory completeness | Validation hours added; the program audit advanced to the first quarter |
| Asset-liability management rating driver updated | Matter requiring attention on deposit assumptions following the model risk audit’s High finding | Annual cycle confirmed; co-source hours for model review increased |
| Payments systems ITGCs created as a separate entity | Wire operations audit found platform access issues outside the operations scope | New moderate entity; 300 hours; first audit next year |
| Lockbox services and statement rendering vendor added | Vendor inventory reconciliation | Two low entities; audited through SOC report review and a limited test |
| Health savings accounts and credit card agent program added | Product list reconciliation | Two low entities |
| Equipment finance subsidiary split from a single line | Acquisition integration completed | One moderate entity with its own systems and owner |
Adapting the example to your bank
The 126 entities are Lakeshore’s; the structure transfers. A community bank of $1 billion with a three-person function will carry perhaps 50 to 60 entities, combining the lines of business into fewer units, carrying three or four second-line entities, and relying more on co-source for technology and BSA; its mandated share will be larger in proportion because FDICIA and BSA testing do not shrink with size. A $50 billion bank under heightened standards will carry 300 or more, splitting lines of business by product and geography, adding entities for the risk governance framework itself, for recovery and resolution planning and for each major model family, and will hold a universe owner as a full-time role. In every case the tests are the same: reconcile to the six sources, size entities to one engagement, keep processes and systems apart, put the second line and the mandated work in the universe, rate with written anchors and apply the cycle rules in the committee’s sight. A function starting from nothing can use the plan template alongside this universe; a function in a new institution should read the year-one plan guide first, because the first year’s universe is deliberately coarse.
Questions about bank audit universes
How many auditable entities should a bank’s universe have?
It depends on size and granularity: about 50 to 60 for a $1 billion community bank, 100 to 150 for a $5 to $15 billion regional bank, and 300 or more for a bank under heightened standards. The test is that each entity can be audited in one engagement and has one owner.
Should second-line functions be in the audit universe?
Yes, as entities in their own right. Supervisors expect internal audit to assure risk management, compliance, credit review and model risk management, and a framework audit of each is a different engagement from auditing the processes they oversee.
How often must each entity be audited?
Policy statements require a risk-based cycle; the common practice examiners accept for mid-size banks is high-risk entities annually, moderate every two years and low every three, with triggers that advance an entity when a finding, incident or change occurs.
How do I rate the entities?
With a weighted factor model against written anchors (the example uses five factors) and a documented override by the chief audit executive. In a bank the regulatory factor carries more weight and the financial factor is scaled to capital rather than revenue.
What do examiners look for in the universe?
Completeness against the organization chart, product list, vendor and application inventories; reasonable ratings; adherence to the cycle with deferrals approved by the committee; and currency after acquisitions, conversions and findings.
Should mandated audits be in the universe?
Yes. FDICIA and SOX testing, BSA independent testing, the trust audit and issue validation consume a large fixed share of hours, about 23 percent in the example, and the committee should see that share when it approves the plan.
Can the universe be a spreadsheet?
For a universe of this size, yes, with version control and the reconciliation evidence attached; audit management systems carry it natively and link it to the plan and the issue log, which the system selection guide covers.
Related guides
- Internal audit in banking: the complete guide — the hub this example belongs to.
- How to identify all key auditable entities — the general method.
- How to create a comprehensive audit universe — the companion guide.
- The annual internal audit risk assessment — the five-factor model.
- How to build the internal audit plan — the capacity model.
- Internal audit plan template — the document the universe feeds.
- Risk assessment matrix — calibrating the ratings.
- The lifecycle of regulatory issues — the issue validation entity.
- What regulators really expect — how examiners read the universe.
- How to audit model risk management — a second-line entity’s program.
- How to audit operational risk management — another.
- How to audit the BSA/AML program — the mandated independent test.
- Third-party risk management program — the entity with the open MRA.
- Auditing the ERM program — the framework entity.
- SOX scoping — the ICFR program’s size.
- Building the IT audit plan — the technology domain in depth.
- Audit management system selection — where the universe lives.
- The audit committee annual agenda — where the plan and resource statement are approved.
- The year-one audit plan — a deliberately coarse first universe.
- Auditing the Underwriting Process: A Credit Risk Program — policy versus practice, exceptions, authority, appraisals and covenants.
Leave a Reply