A bank auditor needs to connect a balance or transaction to the process that produced it. A loan balance, for example, depends on sound approval and servicing controls, complete posting, and a supportable estimate of credit loss. This guide builds those connections across bank reporting, audit planning and evidence, U.S. compliance, and daily operations. Each concept uses a focused scenario so you can practice choosing a test, working through a variance, or interpreting a control failure. It is original preparation for the historical U.S. BAI Certified Bank Auditor credential. A current BAI syllabus and examination availability are unconfirmed, so the emphasis is on durable bank-audit methods rather than presumed current exam rules.
Bank accounting and reporting
1. Trace balances through the statements
Follow the economic event before following cash. When a bank earns interest under a loan agreement, it records a receivable and interest income even if the borrower has not paid. The receivable increases assets; income increases current earnings and, when earnings are closed, retained earnings. Collection later exchanges the receivable for cash without creating interest income again. A new loan advance works differently: cash falls and loans rise, with no immediate income merely because money moved. For each entry, identify the account debited and credited, then ask whether it changes assets, liabilities, or earnings. Check the reporting date as well as the amount. If collection becomes doubtful, assess whether the accrued receivable and income remain supportable under the applicable accounting treatment; an accurate original accrual can require a later adjustment.
Worked example: A bank earns $8,000 of loan interest in December and receives payment in January. In December it debits interest receivable $8,000 and credits interest income $8,000. Assets and December earnings each increase $8,000. In January it debits cash $8,000 and credits the receivable $8,000. Total assets do not change on collection, and January interest income does not increase from this payment.
Watch the distinction: Treating the January cash receipt as new income counts the same interest twice. The earning event created December income; collection only settles the receivable.
2. Choose the right reporting assertion
An assertion names the specific way a reported amount could be wrong. Existence asks whether a recorded asset is real; completeness asks whether all assets that should be recorded are included. Rights asks whether the bank owns or controls the recorded asset. Valuation tests its reported amount, while presentation tests classification and disclosure. Choose a test direction that matches the assertion: start with ledger entries and seek external support for existence, or start with independent source records and trace into the ledger for completeness. One document may address several assertions, but it rarely settles all of them. A custodian statement can support possession while a purchase agreement, pledge record, or account designation may still be needed to establish rights. State the suspected error first, then select evidence that could actually reveal it.
Worked example: The investment ledger lists a bond with $250,000 face value, but the custodian's direct statement omits it. Trace the trade, settlement, transfers, and ownership records. The immediate questions are whether the bond exists and whether the bank has rights to it. Separately, scan the custodian's full holdings list for bonds absent from the ledger; that reverse direction tests completeness.
Watch the distinction: Calling every unmatched record a completeness problem reverses the test. A ledger item missing from independent holdings raises existence and rights concerns first.
3. Test interest accruals
Interest testing starts with the signed terms, not the system's output. Identify the outstanding principal during the period, contractual rate, accrual dates, compounding terms, and stated day-count convention. For simple interest, multiply principal by the annual rate and by the fraction of a year represented by the accrual days. If principal or rate changes midperiod, split the calculation into intervals. Compare the result with the loan subledger, interest receivable, and income posting. Then inspect whether the entry belongs in the period tested, especially near month or year end. A difference can reflect a changed balance, a different day count, a fee classified as interest, or an error. Resolve those possibilities with transaction dates and source documents before proposing an adjustment.
Worked example: Assume a $100,000 principal balance remains unchanged for 30 days, earns 6% simple annual interest, and uses a 360-day basis. Interest is $100,000 × 0.06 × 30 ÷ 360 = $500. The bank posted $600, an excess of $100. Check for a documented rate or balance change; absent one, investigate and correct the $100 overaccrual.
Watch the distinction: Using 30 divided by 365 without checking the stated convention produces a different answer but does not prove the bank wrong. Establish the contractual method first.
4. Identify doubtful interest income
An interest entry can be mathematically correct yet economically unsupported when collection is doubtful. Examine payment history, borrower cash flows, covenant breaches, restructuring terms, and credible repayment sources. Determine when the facts crossed the bank's documented nonaccrual criteria, then compare treatment across similar loans. Test both current interest postings and interest receivable accumulated before the assessment. The accounting response depends on the applicable policy and facts, so do not assume that every late payment requires identical treatment. If an accrued amount is judged uncollectible, the auditor should trace the reversal or other required adjustment through receivables and earnings. Also check whether later borrower payments are allocated consistently with the bank's treatment. The central question is whether reported income represents an amount the bank can reasonably expect to realize.
Worked example: A borrower's main customer fails, cash inflows collapse, and the loan meets the scenario's nonaccrual criteria. The bank has accrued $12,000 of current-period interest that it now judges uncollectible. Reversing it debits interest income $12,000 and credits interest receivable $12,000. Both current earnings and assets fall $12,000; the auditor checks the effective date and similar loans.
Watch the distinction: A signed loan contract does not make every accrued dollar collectible. Once repayment evidence deteriorates, test recognition and receivable value separately from interest arithmetic.
5. Challenge a credit-loss estimate
A credit-loss estimate combines a complete population with supportable expectations about future collections. First reconcile the loans covered by the estimate to the lending records and general ledger. Then examine whether loans grouped together share meaningful risk characteristics; a troubled commercial loan should not disappear inside a broad low-risk average. Challenge historical loss experience, current borrower information, economic conditions, and any forecast or adjustment used in the model. Recompute selected inputs and inspect overrides for approval and evidence. In a simplified probability-times-severity example, expected loss equals exposure multiplied by default probability and loss severity, but actual accounting models can require different cash-flow and timing treatments. Audit the logic and data lineage as well as arithmetic. A correct multiplication cannot rescue an incomplete loan population or assumptions that ignore changed conditions.
Worked example: A hypothetical pool contains $1,000,000 of exposure. Assume a 2% expected default probability and 40% loss severity on defaulted balances. Estimated loss is $1,000,000 × 0.02 × 0.40 = $8,000. If the pool omits a troubled $100,000 loan, the $8,000 figure may be understated even though the calculation itself is correct.
Watch the distinction: Reperforming a spreadsheet formula alone does not validate an allowance. Missing loans, unsuitable groupings, or stale assumptions can dominate a small arithmetic difference.
6. Separate charge-offs from recoveries
A charge-off removes a loan amount judged uncollectible from recorded loans and reduces the allowance under the assumed accounting process. It is distinct from the estimate that built the allowance earlier. A later recovery records cash received on an amount previously charged off; it should not be disguised as a new loan advance or ordinary interest. Trace the original approval, charge-off entry, collection evidence, and recovery posting by borrower and account. Reconcile the remaining legal claim, if any, separately from the recorded receivable: a bank may pursue a debt after removing it from accounting records. Check that a later receipt is not applied twice, once as a recovery and again as a reduction of a live loan balance. This sequence helps detect overstated loans, duplicated income, and concealed collection activity.
Worked example: Assume a $20,000 recorded loan is charged off in full against an available allowance. The entry reduces loans and allowance by $20,000. The borrower later pays $3,000, which the bank records as a recovery under the stated process. Cash received is $3,000 and the unpaid claim is $17,000, but the bank does not restore a $20,000 loan receivable.
Watch the distinction: A recovery does not undo the entire charge-off. Restoring the original receivable after a partial payment would overstate recorded loans by the unpaid amount.
7. Evaluate collateral-dependent values
When repayment depends mainly on selling collateral, an appraisal is a starting point for estimating proceeds, not cash already available to the bank. Confirm the appraised property matches the pledged asset, assess the valuation date and assumptions, and consider market changes. Determine whether selling costs should be deducted under the applicable measurement approach. Also inspect lien priority, title, insurance, and any limits on the bank's ability to realize the asset. A junior lien can make an apparently strong appraisal poor support for recovery. Compare supported net proceeds with the recorded loan exposure, including relevant accrued amounts where the scenario requires them. The difference is a signal for credit-loss analysis, not automatically the final accounting adjustment. Other credible repayment sources and the applicable accounting method may change the measured loss.
Worked example: Assume a troubled $600,000 loan will be repaid solely through sale of collateral appraised at $500,000. Estimated selling costs are $30,000, with no senior liens in this scenario. Expected net proceeds are $500,000 − $30,000 = $470,000. The $600,000 − $470,000 = $130,000 shortfall needs loss-estimate analysis; the appraisal alone does not support full repayment.
Watch the distinction: Comparing the gross appraisal directly with the loan ignores costs and legal priority. Confirm what the bank could actually collect before estimating a shortfall.
8. Assess security fair values
A fair-value estimate is strongest when it uses an unadjusted price for the identical instrument in an active market at the measurement date. An illiquid security may instead require comparable trades, yield curves, credit spreads, prepayment assumptions, or a model. Those inputs create estimation risk even if a dealer supplied the number. Identify the exact security, price date, unit of quotation, accrued-interest treatment, and any adjustment from a comparable instrument. Seek independent market evidence and investigate stale prices or large differences among sources. Where a model is used, challenge inputs that materially change the result and test calculations and approvals. A clean trade confirmation proves what the bank paid, not necessarily its reporting-date fair value. Separate evidence of ownership from evidence of value.
Worked example: A dealer quotes an illiquid bond at 98 per $100 of face value using comparable bonds and a credit-spread adjustment. For $500,000 face value, the indicated price is $490,000 before any separately treated accrued interest. Because 98 is an adjusted estimate, inspect the comparable trades, spread, and an independent price source rather than calling it an identical active-market quote.
Watch the distinction: A dealer quote is not automatically a direct market price. Ask whether the same instrument traded actively or whether assumptions produced the quoted value.
9. Distinguish debt-security classifications
Debt-security classification affects measurement and where value changes appear in financial reporting. Trading securities generally carry fair-value changes through earnings. Available-for-sale debt securities are measured at fair value, with qualifying unrealized changes generally reported in other comprehensive income, subject to the applicable credit-loss treatment. Held-to-maturity classification depends on documented intent and ability to hold to maturity and normally uses amortized cost, again with relevant loss assessment. Inspect purchase approval, portfolio strategy, funding plans, sales history, and later changes in circumstances. A label entered in the investment system is not sufficient evidence of intent. Reconcile cost, amortization, fair value, and the financial-statement line receiving each change. If management proposes reclassification, examine its basis and the accounting consequences; avoiding an unfavorable reported change is not a valid standalone reason.
Worked example: Assume an available-for-sale bond has a $1,000,000 amortized cost and $970,000 reporting-date fair value, with no credit-loss component in this simplified scenario. The unrealized decline is $1,000,000 − $970,000 = $30,000, reflected according to that classification's reporting treatment. Simply relabeling the bond held-to-maturity to hide the decline lacks support from intent and ability evidence.
Watch the distinction: Held-to-maturity is not a convenient escape from fair-value movement. The classification requires substantive support, and credit-loss analysis can still apply.
10. Tie deposits to the general ledger
Customer account records provide the detailed composition of the deposit liability; the general-ledger control account summarizes it. Reconcile totals at the same cutoff date and identify every reconciling item by batch, account, amount, and posting status. A subledger amount awaiting ledger posting differs from a customer balance missing from the subledger: the former is a control-account timing issue, while the latter may affect the customer's actual record. Trace selected account transactions in both directions and inspect whether old items clear promptly. Review who can post adjustments and who independently approves the reconciliation. The FDIC internal-controls reference places deposit and control-account work within bank control review. A reconciliation that balances only after an unsupported plug entry does not establish accurate liabilities.
Worked example: At month end, customer deposit accounts total $2,000,000 and the general-ledger control account shows $1,995,000. A verified $5,000 deposit batch reached the account records before cutoff but did not post to the ledger. Posting that batch raises the ledger liability to $2,000,000. Confirm the batch's transaction date and later posting, then check for other unmatched items.
Watch the distinction: Forcing the ledger to equal the subledger with an unexplained adjustment hides the cause. Each difference needs a transaction-level explanation and evidence.
11. Reconcile correspondent cash
A due-from correspondent account records the bank's claim on another bank. Its ledger balance may differ temporarily from the correspondent's statement because transactions are recorded on different dates. Begin with the statement balance, add verified deposits sent but not yet credited, and subtract payments recorded by the bank but not yet cleared by the correspondent. The adjusted figure should equal the bank's ledger balance at the same cutoff. Inspect bank-generated and correspondent evidence for each item, including subsequent clearing. Investigate old or recurring entries, unusual manual adjustments, and items that move between periods without resolution. The preparer should not be able to initiate and conceal transactions through the same reconciliation. A mathematical tie is useful, but independence, timing, and the authenticity of reconciling items make it persuasive.
Worked example: At cutoff, the correspondent statement reports $97,000. The bank has a documented $5,000 deposit in transit and $2,000 of outstanding checks. Adjusted correspondent cash is $97,000 + $5,000 − $2,000 = $100,000, matching the bank's due-from ledger. Verify that the deposit was later credited and the checks later cleared.
Watch the distinction: Treating every difference as ordinary float can conceal a missing or unauthorized payment. Trace each reconciling item through subsequent settlement.
12. Investigate suspense balances
A suspense account temporarily holds entries that cannot yet be classified or matched. Its usefulness depends on prompt resolution, clear ownership, and an audit trail to the original transaction. Obtain the item-level listing and age it by original date, not merely by the latest journal date. For each significant item, inspect the source document, counterparty, intended account, and reason it was parked. A clearance entry should identify the correct destination and show that the underlying issue was resolved. Watch for repeated reversal and reposting that makes an old balance appear new. Compare suspense activity near reporting dates with later entries for signs of income smoothing or concealment. An unexplained balance is not made acceptable by being small or by offsetting another suspense item.
Worked example: A $10,000 suspense debit consists of a $6,000 customer payment and a $4,000 unexplained entry. Source records establish which customer loan should receive the $6,000, so that amount can be reclassified and the loan record checked. The $4,000 remains unresolved; its age, origin, and possible reporting effect still require investigation.
Watch the distinction: Clearing all suspense items to miscellaneous expense makes the account zero but may misstate earnings and leave a customer transaction uncorrected.
13. Test period-end cutoffs
Cutoff testing asks which reporting period contains the underlying event, not simply which date appears on a journal entry. For loans, distinguish approval, execution of terms, funding, and later servicing. An approval may create an authorized commitment without creating a funded-loan asset. Inspect agreements, disbursement instructions, settlement records, borrower account credits, and system timestamps around period end. Select transactions both before and after cutoff so early and late postings can be found. Consider the corresponding entry: recording a loan prematurely also affects cash, a payable, or another account depending on how the bank booked the transaction. If a transaction was reversed after year end, determine whether that reversal corrects a prior-period error. A period-end balance can reconcile perfectly yet still contain transactions belonging to January.
Worked example: A loan is approved on December 31, but its agreement says funds are first advanced on January 2. The bank records a $400,000 funded loan on December 31 against a payable. At year end, both loans and the payable are overstated by $400,000 under these facts. The January funding record supports recognition in January, while the December commitment is assessed separately.
Watch the distinction: Approval date alone does not establish a funded loan. Test when the contractual advance occurred and follow the related balance-sheet entry.
14. Reconcile regulatory reports
A regulatory report translates accounting records into prescribed reporting categories. Reconcile its source balances to the general ledger, then inspect the mapping rules and adjustments that move amounts between categories. A report can balance overall while placing loans, securities, or liabilities in the wrong line. For each material difference, identify the transaction, effective date, accounting entry, and report instruction used. Review changes to mapping tables and manual overrides, especially near filing dates. Confirm that the same item is not omitted from one category and counted in another. An auditor should distinguish a genuine sale or transfer from a reporting-only adjustment; the former needs evidence that the underlying accounting event occurred. The report's control totals are a starting check, not a substitute for category-level accuracy and completeness.
Worked example: Mapped loan-ledger accounts total $5.0 million, while a reporting schedule shows $4.8 million. Management points to a $200,000 loan sale before cutoff. Verify the sale agreement, settlement date, and ledger derecognition: $5.0 million − $0.2 million = $4.8 million only if the source total or reporting bridge properly reflects that sale. Otherwise the difference remains unexplained.
Watch the distinction: A balanced report can still misclassify assets. Reconcile the line-item mapping and supporting adjustments, not just assets against liabilities and equity.
15. Interpret a capital ratio
A risk-based capital ratio compares a defined capital measure with risk-weighted assets, which reflect prescribed treatment of different exposures. For common equity tier 1, divide eligible common equity tier 1 capital by the applicable risk-weighted-asset denominator. Audit both sides: trace capital components and deductions, and reconcile asset balances, off-balance-sheet exposures, and risk weights into the denominator. Check unit consistency before dividing. A ratio may change because capital falls, exposures grow, or risk weights change even when total assets remain stable. Arithmetic accuracy alone does not establish compliance; the institution's applicable requirements, buffers, and other capital measures must be evaluated separately. Avoid importing a threshold from an old handbook into a current decision. For study purposes, state hypothetical inputs and interpret only what they support.
Worked example: Assume common equity tier 1 capital of $120 million and risk-weighted assets of $1,000 million. The ratio is $120 million ÷ $1,000 million = 0.12, or 12%. If risk-weighted assets rise to $1,200 million with capital unchanged, it becomes 10%. Neither calculation alone proves that all applicable capital requirements are met.
Watch the distinction: Dividing capital by total assets answers a different question. A risk-based ratio uses the specified risk-weighted denominator and eligible capital numerator.
Audit principles, risk and evidence
16. Locate assurance responsibilities
Control responsibility follows who creates and manages the risk. A lending unit owns its approvals, records, and exception handling. A separate risk or compliance function can set standards, monitor patterns, and challenge the unit's decisions. Internal audit independently tests whether both sets of activities work and reports its conclusions through appropriate governance channels. This division helps the board receive assurance without making auditors operators of the controls they later assess. The OCC audit handbook describes these roles and the board's oversight of the audit function. In practice, map each control to an owner, reviewer, and assurance provider. If a role is unclear, ask who can authorize an exception, who detects misuse, and who evaluates the entire process independently.
Worked example: A lending manager approves a pricing exception; credit risk reviews exception trends each month; internal audit samples approvals and tests credit risk's monitoring. If audit begins approving individual exceptions, it becomes part of the process it must later assess. Reassign those approvals to management and preserve audit's independent testing role.
Watch the distinction: Calling audit the owner of a weak control does not fix accountability. The business must operate it; audit can test and report whether it works.
17. Build a risk-based audit plan
A risk-based plan starts with an audit universe: the bank's significant products, processes, entities, systems, and outsourced activities. Assess each area using exposure, transaction volume, complexity, change, known control weaknesses, and prior findings. Then allocate more frequent or deeper work to areas with greater residual concern while retaining suitable coverage of quieter activities. Distinguish a plan from a permanent ranking: a new product launch, system conversion, or control failure should trigger reassessment. Record why scope and timing were chosen, and bring material plan changes through the bank's audit governance process. The same planning logic is studied more broadly in the Certified Internal Auditor guide. For a bank, connect that logic to customer funds, credit exposures, reporting, compliance, and operational dependencies.
Worked example: A new payment platform processes 50,000 transactions monthly and has untested access controls. A mature branch processes 2,000 transactions monthly and has no recent findings. Audit schedules a detailed platform review first, covering access, settlement, and exception handling, then a narrower branch review later. Volume and change justify priority; the branch remains in the audit universe.
Watch the distinction: A lower-risk rating does not mean an activity disappears from coverage. Set its timing and depth deliberately, then revisit the rating when conditions change.
18. Separate inherent and residual risk
Inherent risk describes exposure before considering controls. Residual risk describes what remains after controls that are actually designed and operating effectively. For wire transfers, inherent exposure may be high because funds move quickly and can be difficult to recover. Independent approval, beneficiary verification, limits, and monitoring can reduce that exposure, but an undocumented screen or untested procedure should receive little credit. When using a scoring model, define each factor and the meaning of a control reduction so ratings are comparable. Scores are planning aids rather than measured probabilities unless the model explicitly supports that interpretation. Test the underlying controls before changing the residual rating, and consider whether concentration, new channels, or fraud patterns have raised the starting exposure. A low residual score unsupported by evidence can misdirect audit coverage.
Worked example: An illustrative model assigns wire-transfer inherent risk a score of 20 points. Tested dual approval and beneficiary verification justify a 50% reduction under the model, leaving 20 × (1 − 0.50) = 10 points. If approval is merely displayed on a screen and has not been tested, retaining 20 is more defensible until evidence supports a reduction.
Watch the distinction: Subtracting a control benefit because a procedure exists on paper confuses design with effectiveness. Residual risk depends on controls that demonstrably operate.
19. Judge materiality in context
Materiality concerns whether an error could affect a user's judgment or an audit conclusion. Begin with the amount and aggregate errors that affect the same reporting measure. Then examine nature: intentional concealment, a regulatory-report category, a related-party transaction, or repeated control failure can matter even when the amount is modest. Determine whether errors share a cause; several small mispostings from one defective rule may point to a larger population problem. A review threshold in an exercise is a trigger for investigation, not an automatic conclusion that every item below it is acceptable. Separate factual errors from estimates and sampling projections, and document how each was evaluated. For control findings, consider potential exposure as well as realized loss. The decision sequence is quantify, aggregate, investigate cause, assess context, and communicate the supported conclusion.
Worked example: Three confirmed overstatements are $2,000, $3,000, and $4,000. Their total is $9,000, exceeding a hypothetical $8,000 review threshold by $1,000, so investigate their common cause and reporting effect. Separately, a manager's intentional $1,000 entry merits attention despite being below the threshold because concealment changes the risk assessment.
Watch the distinction: A small entry is not automatically harmless. Intent, repeated failures, and the affected disclosure can make its significance greater than its dollar amount.
20. Test design and operation separately
Control design asks whether a procedure, if performed as intended, could prevent or detect the identified error in time. Operating effectiveness asks whether it actually ran, on the right transactions, by an authorized and independent person, with evidence of review. For a transfer approval, inspect the rule and system configuration first: which transfers qualify, can users bypass it, and does approval precede release? Then define a complete population and select transactions across relevant dates, channels, and staff. Compare timestamps and approver identities with the release log. Investigate exceptions for system routes or emergency procedures rather than simply counting missing signatures. A well-designed rule that frequently fails in practice does not reduce residual risk as expected. Conversely, consistent execution cannot compensate for a rule that excludes the risky transactions.
Worked example: A bank's internal rule requires a second approver before transfers above its stated limit are released. The configured rule covers the intended transactions, so its design appears suitable. In a sample of 25 qualifying releases, four lack timely second approval: 4 ÷ 25 = 16% of sampled items. Operation is deficient; determine whether a bypass route or user practice caused the exceptions.
Watch the distinction: A written approval rule is evidence of design, not proof of operation. Inspect actual releases and approval timing before concluding that the control works.
21. Walk through one transaction
A walkthrough follows one real loan through the people, records, and systems that create its reported balance. Start with the application and supporting credit information, then inspect approval, signed terms, funding instructions, servicing setup, and general ledger posting. At each handoff, ask what could go wrong, who could prevent it, and what record would reveal it later. Approval controls address unauthorized credit; independent verification of payment details addresses diversion of proceeds; reconciliation addresses inaccurate recording. Interviewing staff helps locate controls, but trace the actual documents and system logs to see what happened. A single walkthrough clarifies process design and identifies tests for a wider population. It cannot, by itself, establish that a control operated consistently throughout the period.
Worked example: A commercial borrower requests $400,000. The credit committee approves it, and the signed agreement matches the booking record. Before funding, one employee changes the destination account and releases the $400,000. The loan ledger then shows a $400,000 balance. The accounting entry may be accurate, but the walkthrough reveals that no independent person verified the changed destination before disbursement.
Watch the distinction: A correct loan balance does not prove the proceeds reached the borrower. Trace the destination change and release authorization; diversion can leave the ledger apparently balanced.
22. Select a defensible sample
Sampling begins with a defined population tied to the audit objective. For a test of wire approvals, specify the period, transaction types, and whether canceled items belong; then reconcile the extract count and totals to reliable source records. Select from that complete list using a method that does not favor easy-to-find files. A systematic sample uses a random start within an interval and takes every interval-th item. It spreads selections across the ordered list, but a recurring pattern in that order can distort coverage. Consider separate selection of unusually large or high-risk items when they matter to the objective; document those separately from the representative sample. Record selection rules before inspecting outcomes, and preserve the population extract so another auditor can reproduce the selections. Information systems audit study provides related context for testing system-generated populations.
Worked example: An approved transaction extract contains exactly 500 consecutively numbered items, and the plan calls for 25 systematic selections. The interval is 500 ÷ 25 = 20. A random start of 7 gives 7, 27, 47, and so on; the twenty-fifth is 7 + 24 × 20 = 487. Check the extract against source counts before relying on those selections.
Watch the distinction: Selecting every twentieth transaction from an incomplete export does not create a sound sample. Population completeness is a separate prerequisite that the interval calculation cannot repair.
23. Interpret sampled errors
A sample error rate describes what was observed, while projection estimates what similar errors might mean for the population. For monetary-unit reasoning in a simple, reasonably comparable pool, divide sampled misstatement by sampled recorded value, then apply that proportion to the population value. Keep favorable and unfavorable errors visible rather than silently netting them; an offset may hide distinct causes. Investigate whether errors cluster by branch, employee, product, or date, because a nonrandom pattern can make a single proportional projection misleading. Also consider the uncertainty created by testing only part of the population and any separately tested large items. The decision is whether the evidence is sufficient for the audit objective, not whether a point estimate falls just below a chosen review level. Expand work when causes or uncertainty remain material.
Worked example: A $300,000 sample from a $3,000,000 comparable loan-fee population contains $6,000 of overstatements. The observed rate is $6,000 ÷ $300,000 = 2%. A simple projection is 2% × $3,000,000 = $60,000, equivalently $6,000 × 10. This is an estimate, not a proven population total; investigate how the errors arose and assess sampling uncertainty.
Watch the distinction: The $6,000 found is not the maximum possible error in a $3 million population. Untested items may contain similar errors, so evaluate projection and uncertainty.
24. Rank audit evidence
Evidence is useful only when it addresses the assertion being tested. A custodian statement can support whether a security is held; it may not establish the bank's carrying value or that every holding was recorded. Reliability improves when evidence comes directly from an independent source, covers the relevant date, and can be tied to a specific account or instrument. Internally prepared reports can be valuable, but their completeness, access controls, and underlying data need examination. Reconcile conflicting evidence instead of automatically choosing the source that supports management's position. Consider whether a document could have been altered and whether it was created before or after the event under review. Combine records, confirmations, recalculations, and observation when no single item resolves the assertion. Document the conflict and the steps that resolved it.
Worked example: The bank's spreadsheet lists a $2 million bond at a custodian on December 31, but a statement obtained directly from that custodian omits it. Match the bond identifier, account number, and settlement date. If a dated sale confirmation shows settlement on December 30, the spreadsheet's holding claim is wrong. If settlement occurred January 2, obtain the relevant year-end custody record before concluding.
Watch the distinction: A polished spreadsheet is not automatically stronger evidence than a direct third-party record. Investigate dates, identifiers, and source controls before deciding which record answers the assertion.
25. Use confirmations purposefully
A confirmation asks an outside party to provide evidence about a stated assertion, such as a borrower's outstanding principal or a custodian's holdings. The auditor should control the request and response channel so bank staff cannot substitute an answer. Choose the information requested to match the risk: a stated balance tests agreement with the record, while an open request may reveal obligations omitted from it. A difference is a lead for reconciliation, not immediate proof of bank error, because payments, advances, or timing can explain it. Inspect dated supporting records and determine which balance is correct at the audit date. For a nonresponse, perform alternative procedures such as subsequent cash tracing and agreement inspection when appropriate; silence supplies no affirmative evidence. Evaluate unresolved differences together for patterns and possible misstatement.
Worked example: At December 31, the bank records a $1,000,000 loan; the borrower directly confirms $950,000. The difference is $50,000. A $50,000 payment receipt dated December 30 and bank posting dated January 2 suggest a cutoff issue. Trace the payment's receipt and application terms, then determine whether December 31 principal should be $950,000 and whether interest also needs correction.
Watch the distinction: A borrower who does not respond has not agreed with the bank's balance. Use suitable alternative evidence and record the limitation if the assertion remains untested.
26. Turn analytics into tests
Analytics identify relationships or values that deserve testing. Build an expected range from product terms, approved pricing grids, market conditions, and customer characteristics before labeling an item unusual. Check the data extract's population, dates, and rate definitions; a promotional rate or a fee-inclusive measure may not be comparable with standard contract rates. Sort outliers by branch, approver, related party, and effective date to see whether they share a cause. Then inspect signed agreements, approval records, system rate tables, and actual interest postings. A documented exception may make a low rate authorized, though it can still expose a policy or profitability issue. A rate outside the range is a selection cue, not an audit conclusion. Extend testing if the same unexplained mechanism affects other accounts.
Worked example: Most new commercial loans in a comparable pool carry 6% to 9% contractual rates, but five related accounts show 2%. Signed terms confirm 2% for two loans with approved exceptions. For three, the agreements specify 7% while servicing applies 2%. On a hypothetical $100,000 balance for one year, the simple interest difference per loan is $5,000; test dates and balances before quantifying the actual error.
Watch the distinction: Calling every 2% loan a misstatement confuses an unusual rate with an unauthorized one. Compare contract terms, approved exceptions, and posting behavior first.
27. Recognize check-kiting signals
Check kiting exploits the delay between crediting a deposited check and collecting funds from the bank on which it is drawn. Related accounts can exchange checks so each appears funded while neither has enough collected money to cover the outgoing items. Look for frequent round-dollar checks, similar daily debits and credits, deposits from commonly controlled accounts, large uncollected funds, and persistently low collected balances. Trace both sides through check images, deposit dates, presentment, and actual clearing. The critical distinction is ledger balance versus collected balance at the time payments were honored. Repeated exchanges are suspicious but may have a legitimate explanation, so test the source of real funds and the timing. Quantify any uncovered exposure and examine whether holds, overdraft controls, and exception reviews operated.
Worked example: Accounts A and B are commonly controlled and each has $2,000 collected cash. A deposits a $100,000 check drawn on B, and B deposits a $100,000 check drawn on A the same day. Their ledger balances may each appear to rise by $100,000 before collection, but neither has $100,000 collected to cover its check. Trace clearing and any payments released against the provisional credits.
Watch the distinction: Equal deposits and withdrawals do not themselves prove kiting. The key question is whether payment relied on uncollected checks rather than genuine available funds.
Reference: [3]
28. Protect audit independence
Internal audit needs enough independence to challenge management and enough access to report significant findings. An auditor who designs, approves, or operates a control later risks assessing their own work. Advisory input can be useful, but management must own the decision and implementation; audit leadership should evaluate whether later assurance can be objective. Reporting lines also matter: operational managers should not be able to suppress scope, change findings, or determine the auditor's compensation solely because a review is unfavorable. When a threat appears, disclose it promptly, assign an unaffected reviewer, and escalate unresolved restrictions through the audit leader to the board or audit committee. Record the safeguard and its rationale. Independence does not mean avoiding operational knowledge; it means retaining freedom to form and communicate an evidence-based conclusion.
Worked example: An auditor mapped the new loan-approval workflow and chose its exception rules. Six months later, that auditor is assigned to test whether those rules are effective. The audit leader documents the design role and gives assurance testing to another qualified auditor. The original auditor may explain the system, but does not select samples, judge exceptions, or sign the conclusion on their own design.
Watch the distinction: A manager's confidence in an auditor does not remove a self-review threat. Prior design responsibility affects objectivity even when the auditor acted competently and honestly.
29. Write an actionable finding
An actionable finding connects five elements. The criterion states the required control or approved procedure. The condition describes what testing actually found, including population, period, and exceptions. The cause explains why it happened, based on evidence rather than guesswork. The effect states the resulting exposure or demonstrated loss without implying that every exception caused fraud. The recommendation targets the cause, names a responsible owner, and calls for evidence that the fix works. Discuss facts with process owners and preserve their response, but keep the audit conclusion grounded in workpapers. Distinguish a one-off processing lapse from a configurable bypass that could affect many transactions. Severity should reflect transaction value, compensating controls, recurrence, and potential harm. A precise finding lets management fix the process and lets audit later validate the change.
Worked example: The wire procedure requires approval by a second employee before release. Eight of 40 sampled releases lacked that approval, an observed exception rate of 8 ÷ 40 = 20%. Configuration logs show a bypass role assigned to operators. Report the sampled condition and unauthorized-payment exposure; assign operations and system owners to remove the bypass, review prior releases, and demonstrate effective approval in retesting.
Watch the distinction: Reporting only 'eight exceptions' leaves management without a cause or remedy. Link the exceptions to the bypass mechanism and specify how the corrected control will be tested.
30. Validate remediation
Closing a finding requires evidence that the cause was addressed and the revised control operates. First compare management's proposed fix with the original condition: a new reminder will not resolve a system role that permits bypassing approval. Inspect change records, current configuration, user entitlements, and the effective date. Then select transactions processed after the fix and test whether approval occurred before release, including routes that previously failed. A clean sample supports improvement within its tested period and scope; it is not a guarantee against every future failure. If an exception remains, determine whether it came through the old route, a new route, or a logging gap. Record residual risk and the owner of further action. Communicate closure only when the evidence supports the specific finding's resolution.
Worked example: Management says a wire-approval bypass was removed on June 1. Audit verifies the setting and tests 20 releases dated June 2 through June 30. Nineteen show timely second approval; one was released through an emergency role without it. The observed exception rate is 1 ÷ 20 = 5%. Keep the finding open, trace that role's permissions, and retest after correction.
Watch the distinction: A completed change ticket proves that someone recorded a change, not that the risky route disappeared. Test transactions after deployment and investigate any remaining bypass.
Bank laws and regulatory compliance
31. Determine which rules apply
Compliance scoping starts with the legal entity and its activities. Record the bank's charter, relevant supervisory relationships, locations, products, delivery channels, and customer types. Then map each obligation to the activity and entity it governs. A rule may differ across consumer and business credit, deposit and lending products, or national and state-chartered institutions. Testing the wrong entity against a checklist can produce both false findings and missed requirements. For each applicable rule, identify the operational point where it should be met: account opening, disclosure, transaction processing, monitoring, or reporting. Check how management translated that requirement into procedures and system controls, then test actual transactions. Escalate genuine interpretive uncertainty to qualified compliance or legal personnel while continuing to examine facts. A supervisor's audit handbook supplies useful control concepts, but its audience and scope must be respected.
Worked example: Bank A is nationally chartered; Bank B is state-chartered. Both offer consumer checking accounts. An auditor first records each bank's entity, product terms, operating states, and supervisory relationships, then maps relevant deposit requirements and local procedures. A checklist written for Bank A may identify useful questions for Bank B, but the auditor verifies applicability before calling any difference a violation.
Watch the distinction: Similar products do not make two banks legally identical. Confirm the entity, activity, and governing requirement before using another institution's examination checklist as a criterion.
32. Track regulatory change
A regulatory change is implemented only when customers and staff experience the revised process, not when a policy document is approved. Trace the change from authoritative text and effective scope to an interpretation, impact inventory, policy revision, system requirement, template change, training, and monitoring plan. Identify all channels that produce the affected output, including branches, online flows, and service providers. Test versions and dates so a new rule is applied to the right transactions. Compare a live or controlled test output with the approved requirement and inspect whether exception monitoring catches old language after deployment. Where a vendor owns the template, the bank still needs evidence that the vendor released the correct version. Record defects, affected population, customer impact, and remediation evidence rather than relying on project status alone.
Worked example: A hypothetical disclosure change applies to new accounts opened from July 1. Policy and staff training were updated, but an August 15 online test account still receives the old template. Branch output is correct. The implementation gap is therefore channel-specific: inspect online version history, count affected openings from July 1, correct the template, and test a new account after release.
Watch the distinction: A signed policy update does not show that customer-facing systems changed. Test actual outputs in every affected channel and match them to the applicable effective period.
33. Test customer identification
Customer identification testing separates data collection from verification. A completed form may contain a name, address, and identification number, yet the bank may not have performed the verification steps its written program calls for. Map the onboarding path, including remote openings, business entities, exceptions, and system overrides. For sampled accounts, trace required fields to original records or electronic results, check the verification outcome, and inspect what happened when information could not be verified. Pay attention to timing and restrictions: an account opened under an allowed exception may need controlled use while the issue is resolved. Review who approved an exception and whether the decision was documented. An auditor tests whether the bank followed its applicable program and whether exceptions were controlled; a blank verification log is evidence of a gap, not by itself proof of a false identity.
Worked example: A business account file contains owner names and an identification number, but its verification-result field is blank. A system log shows the verification request failed, while the account was opened and could send payments. Inspect the bank's exception rules and approval record. If no approved exception or restriction exists, report an onboarding control failure and determine how many accounts followed the same path.
Watch the distinction: Entered identity fields are not evidence that identity was verified. Inspect the verification result, exception handling, and account permissions before concluding onboarding was complete.
Reference: [2]
34. Assess customer due diligence
Customer due diligence uses information about ownership, control, purpose, and expected activity to establish a basis for monitoring. Collecting names alone does not tell the bank whether later behavior fits the customer. Test whether the bank documented a plausible business purpose, anticipated transaction types and scale, and risk factors relevant to its program. Then compare actual activity with that profile and inspect how unusual changes were reviewed. A sharp increase may have a legitimate cause, such as a new contract; evidence of that cause can support an updated profile. Without investigation, simply changing the expected amount to match actual transactions defeats the monitoring control. Inspect review dates, supporting records, escalation decisions, and whether new ownership or activity information reaches the monitoring system. The auditor evaluates the process and evidence, not the customer's guilt.
Worked example: An entity's profile expects $20,000 in monthly receipts; one month shows $2,000,000, or 100 times the expected amount. The file lists owners but no review of the increase. A signed acquisition contract might explain the change, yet staff must verify and document the explanation, assess whether the activity is consistent, and update the profile through the bank's authorized process.
Watch the distinction: A complete owner list is not a complete activity assessment. Monitoring must use the profile, investigate meaningful departures, and document supported updates rather than overwrite expectations.
Reference: [2]
35. Evaluate suspicious-activity escalation
An alert is the start of an investigation, not a conclusion that activity is suspicious. Test whether monitoring captures relevant transactions, routes alerts to trained personnel, and preserves enough detail for a reasoned disposition. An analyst should compare the pattern with customer history, known business purpose, counterparties, transaction sequence, and any prior alerts. A closure should explain why the observed activity is expected or otherwise resolved; a referral should identify the facts requiring authorized review. Check whether cases are escalated consistently and whether decisions, supporting records, and subsequent monitoring are retained. Audit should evaluate the quality of the analysis and process without substituting its own unsupported filing decision. Sampling both closed and escalated cases helps detect weak investigations and unnecessary referrals. Where alert volume overwhelms reviewers, assess whether backlogs or poor data quality impair the control.
Worked example: A customer receives five $18,000 transfers and withdraws most funds in cash shortly afterward. The analyst closes the alert with 'normal activity' but gives no source-of-funds or business-purpose analysis. Audit compares the $90,000 incoming total with the profile, reviews counterparties and prior activity, and refers the unsupported closure for authorized reassessment; the pattern alone does not establish a filing outcome.
Watch the distinction: An alert closure label is not evidence of investigation. The case needs facts and reasoning that explain the transaction pattern and support the authorized decision.
Reference: [2]
36. Review sanctions screening
Sanctions screening compares parties and transactions with applicable restrictions, but a name match is only a starting signal. Coverage depends on complete and accurate names, identifiers, payment fields, list updates, and the points at which the bank screens. Investigate a possible match using available identifiers such as date of birth, location, entity details, and account information. Document why the candidate is a false match or escalate a plausible true match to authorized specialists. The applicable sanctions program and transaction facts determine the required response, which may involve blocking, rejecting, licensing analysis, or another action. Do not release a payment merely because one identifier differs without assessing the full record. Test that held transactions cannot bypass review and that dispositions are retained. The Office of Foreign Assets Control publishes sanctions resources for this U.S. context.
Worked example: A $75,000 payment beneficiary shares a listed person's name, but the payment record shows a different birth date and country. The reviewer checks the list entry, supporting customer identifiers, and documented decision. If the identity difference is reliable, the candidate may be cleared. If other details point to a true match, hold the payment and route it for the applicable sanctions decision.
Watch the distinction: A similar name does not automatically require the same outcome as a confirmed match. Resolve identifiers carefully, document the decision, and escalate credible matches before release.
Reference: [4]
37. Aggregate cash activity
Cash-monitoring tests begin with the bank's applicable rules and the transaction universe. Link activity by person, account, date, and direction, using teller and system records that capture all relevant locations and channels. An internal review trigger may deliberately flag broad combined activity; a legal reporting decision can use different definitions and aggregation rules. In particular, cash received and cash paid out should not be casually netted or treated as one direction solely because they involve the same person. Examine whether transactions were split, whether staff recognized related activity, and whether the case received documented review. Reconcile the extract to cash journals so omitted branches or reversals do not distort totals. When a pattern prompts review, establish the transaction facts and escalate the legal filing determination through the bank's designated process.
Worked example: A person deposits $6,000 cash in the morning and withdraws $5,000 cash that afternoon. Under a hypothetical $9,000 internal trigger for combined activity, $6,000 + $5,000 = $11,000, so review is required. The $6,000 cash-in and $5,000 cash-out amounts remain distinct for any applicable reporting analysis; this example does not decide whether a filing is required.
Watch the distinction: Netting the deposit and withdrawal to $1,000 conceals $11,000 of gross activity. Adding them for internal review also does not, by itself, establish a legal reporting duty.
38. Compare lending decisions fairly
Fair-lending testing compares applicants who are genuinely comparable on legitimate credit factors. Define the product, time period, channel, risk grade, loan size, term, collateral, and documented pricing discretion before pairing files. Differences in verified income, credit history, collateral, or approved concessions may explain different outcomes, but explanations should be supported by records created during the decision process. Compare applications, underwriting outputs, rate sheets, exception approvals, and communications. Look for patterns across many decisions as well as individual unexplained differences. A matched pair is a diagnostic tool, not proof of discrimination by itself; omitted factors and data quality can change the comparison. Escalate a material unexplained difference for deeper review and assess whether the bank's control over discretion worked. Regulation B covers discrimination in credit transactions.
Worked example: Two applicants seek the same 60-month product on the same date. Their documented risk grade, collateral, and approved loan size match, yet one receives 7% and the other 8%. The difference is 1 percentage point. Audit checks the rate sheet and exception logs. If no supported pricing factor explains it, investigate the decision, affected files, and approval controls; one pair alone does not establish the reason.
Watch the distinction: Different rates are not automatically unfair treatment. First confirm that relevant underwriting and pricing factors match, then investigate any difference left unexplained by contemporaneous records.
Reference: [5]
39. Check adverse-action reasons
An adverse-action notice should communicate reasons connected to the actual credit decision. Trace the decision from application data through underwriting output, reviewer notes, final approval or denial, and the reason codes sent to the applicant. A plausible reason is insufficient if it was not a principal reason for the action taken. Automated systems can create mismatches when the denial engine and notice template use different fields or when a manual override fails to update the notice. Test both the completeness of decision records and the accuracy of customer communications. If a mismatch appears, determine whether it is isolated or caused by a reusable mapping problem, identify affected notices, and route correction through authorized compliance processes. Keep the analysis tied to the applicable product and rule; Regulation B's adverse-action provisions establish the topic.
Worked example: A consumer application is denied because verified monthly income is $2,500 against an underwriting requirement stated in this hypothetical file as $3,000. The decision record cites insufficient verified income, but the notice says excessive debt. Audit confirms the $500 income shortfall and finds no debt-based denial reason. The notice does not reflect the actual decision; inspect reason-code mapping and other notices.
Watch the distinction: A notice reason need not merely sound reasonable. It must correspond to the decision actually made, so reconcile notice codes with underwriting evidence and overrides.
Reference: [5]
40. Test credit-cost disclosures
Credit-cost disclosure testing starts by identifying the charges that belong in the calculation for the particular covered transaction. Compare the agreement, fee schedule, closing or origination records, and disclosure engine inputs. A charge's label is less important than its treatment under the applicable rule and scenario facts. Recalculate the finance-charge inputs, then test whether the disclosed annual percentage rate and payment terms follow from the correct amounts, timing, and payment schedule. A missing charge can affect several disclosed figures; the dollar omission alone is not the APR error because APR requires cash-flow timing. Inspect system configuration and sample other loans using the same fee code if an input is omitted. Regulation Z addresses consumer-credit cost disclosures, while product-specific requirements still need to be mapped.
Worked example: For a hypothetical covered loan, $100 interest and a required $50 origination charge are both finance charges under the stated facts. The disclosure engine includes only $100. Correct finance-charge inputs total $100 + $50 = $150, so the input is short by $50. Recalculate the disclosure using the loan's amount, payment dates, and term; those details are needed to determine the corrected APR.
Watch the distinction: Adding the missing $50 directly to the APR confuses dollars with an annualized rate. Correct the finance-charge input, then recompute APR from amount and payment timing.
Reference: [6]
41. Reconcile mortgage servicing records
A mortgage servicer's records should tell one consistent story about what the borrower paid, how the payment was allocated, what left escrow, and what the borrower was told. Start with the payment receipt and trace it to the loan and escrow ledgers. Then work backward from the general ledger and borrower statement to the underlying transactions, which helps detect both omitted and invented entries. For an escrow disbursement, compare the ledger date and amount with the tax or insurance bill, payment instruction, and evidence of settlement. A difference may affect the escrow balance, a subsequent analysis, or a borrower notice. Distinguish a recording error from a payment that actually went to the wrong recipient. Mortgage servicing is among the subjects addressed by Regulation Z, but the audit conclusion must follow the transaction evidence and the requirements applicable to that account.
Worked example: Assume an escrow account begins at $1,000 with no other activity. The servicer records a $300 property-tax payment, leaving $700, but settlement evidence shows only $250 paid. The supported balance is $1,000 minus $250, or $750. The ledger understates escrow by $50. Trace the payment recipient, correct the entry, and check whether a borrower statement or escrow analysis used the $700 figure.
Watch the distinction: A paid tax bill does not prove the escrow ledger is accurate. The amount that cleared, the amount recorded, and the resulting borrower balance must agree.
42. Review electronic-transfer disputes
An unauthorized electronic-transfer claim has two linked audit trails: the customer's financial position and the bank's investigation. Identify the covered account and transaction, record when and how the claim arrived, and trace the case through evidence gathering, any account credit, decision, and customer communication. Compare the disputed amount with the ledger adjustment and look for duplicate reversals or later removal of a temporary credit. Device data, authentication records, merchant details, and the customer's account history may help establish what happened, but a system label such as “authenticated” is not a complete finding by itself. Test whether the investigator considered relevant evidence and documented a reasoned outcome under Regulation E and the bank's applicable process. A credit can repair the balance while an inadequate investigation leaves the dispute control untested.
Worked example: A customer disputes a $400 debit, and the bank credits $400. The ledger now reverses the immediate loss, assuming no other adjustments. The file contains no device review, transaction details, or explanation of the decision. Treat the financial correction as supported but the investigation as incomplete; obtain the missing records and verify the final determination and customer communication.
Watch the distinction: Crediting the account does not establish that the claim was properly resolved. Audit the decision record and communications as well as the amount posted.
43. Test deposit-funds availability
A check hold changes when deposited funds can be withdrawn; it does not decide whether the check ultimately pays. Test the deposit date, check type, account status, hold reason, amount affected, customer notice, and actual release date as separate facts. Regulation CC has availability schedules, exceptions, and disclosure rules, so the correct path depends on the transaction rather than the teller's choice of a code. Start with the deposited item and receipt, then compare the system's calculated release with the applicable category and any documented exception. Inspect the notice for the reason and availability information required in the circumstances. Finally, use account history to confirm when funds actually became available. An authorized exception can still be implemented incorrectly if the system holds too much money or releases it later than the supported date.
Worked example: A teller applies an exception hold to a $2,000 check, but the file has neither a documented reason nor a notice. The hold code alone proves only that access was restricted. Inspect the check and account history, establish the applicable funds-availability rule, and compare the required release with the system date. Record the unsupported reason or communication as distinct exceptions.
Watch the distinction: A check's possible return does not justify any hold length. The bank needs a supported availability category, a correctly calculated release, and applicable communication.
44. Assess customer-information protection
Customer-information protection begins by asking what data a task needs and who can reach it. Map the information's path through collection, storage, use, sharing, and disposal; then test access at each point. Role-based permissions should limit users to the records and fields needed for their duties, while approval and periodic review catch privileges that outlast a project. Logging helps detect unusual downloads, but a log is useful only when someone reviews and investigates it. For a contractor, compare contractual work, approved access, actual permissions, and transfer channels. Also determine whether sensitive fields can be masked and whether incidents can be detected, contained, and escalated. Evidence of excess access is a control weakness even when there is no evidence of disclosure. The audit should distinguish exposure from a confirmed data loss.
Worked example: A contractor verifies customer account counts using masked identifiers, yet an export role permits downloading 10,000 full customer records. The required task uses zero unmasked records. Compare the role approval with the assignment, remove the excess permission through the bank's process, and review export logs for actual downloads. Report unnecessary exposure; do not claim a leak without evidence.
Watch the distinction: No reported breach does not make unrestricted access acceptable. A permission can create avoidable exposure before anyone uses it, so approval and activity need separate testing.
45. Audit community reinvestment evidence
Community reinvestment analysis depends on accurate loan and service data placed in the right geographic and institutional context. The Community Reinvestment Act concerns how an insured depository institution helps meet credit needs across its community, including low- and moderate-income areas, consistent with safe and sound operations. An auditor should first identify the reporting period, assessment areas, products, and data fields used in the bank's analysis. Reconcile reported loans to source systems, validate addresses and geocoding, and test whether excluded or duplicated records have a documented basis. Then examine the distribution with denominators and relevant context, such as where the bank operates and what products it offers. A corrected count may change a percentage without, by itself, proving a compliance outcome. Keep data-quality findings distinct from any broader judgment about the bank's community record.
Worked example: A report counts 40 loans in an assessment area. Address validation places five outside it, and no other records change. The corrected count is 40 minus 5, or 35 loans, a 12.5% reduction from the original count. Recalculate any distribution that used 40 as its denominator and review the five addresses before interpreting the CRA evidence.
Watch the distinction: A high loan count is not self-explanatory evidence of community coverage. Incorrect geography or an unsuitable denominator can distort the distribution and its interpretation.
Bank operations and business audit practice
46. Control deposit-account changes
Ownership and signer changes alter who can control a deposit account, so the audit trail must establish authority before the change takes effect. For openings, compare the application, identity and entity documents, account agreement, and system setup. For later changes, determine who requested the amendment, whether that person could authorize it, and whether staff verified the request through an appropriate channel. Compare the approved request with the account master file, signature records, and effective date. Independent review is particularly useful when one employee can both edit access and enable withdrawals. Test a population of changes from system logs, including reversals and after-hours edits, so unfiled requests are not missed. Follow a sample through the first transaction after each change; this reveals whether a flawed authorization became an actual access route.
Worked example: An employee adds a signer at 10:00 and enables withdrawals at 10:05. The file contains a customer request but no evidence that the requester had authority or that a second employee approved the change. Match both log events to the agreement and verification record. If approval is absent, flag the access-control failure and inspect withdrawals after 10:05 for exposure.
Watch the distinction: A signed form does not necessarily authorize the person who submitted it. Confirm authority, identity, system entry, and independent review before treating the change as valid.
Reference: [3]
47. Safeguard teller and vault cash
Joint custody protects physical cash while a reconciliation checks whether records reflect the cash on hand. These controls answer different questions. Observe whether separate custodians retain their own keys or combinations, participate in opening and counting, and sign the count contemporaneously. Then compare the verified count with vault tickets, teller transfers, cash shipments, and the general ledger at the same cutoff time. A reconciling item needs an originating document, date, direction, and later clearance; a plug entry hides the cause. Trace selected movements both from tickets to the ledger and from the ledger to tickets. Surprise counts can reveal shortages that a scheduled count gives staff time to conceal. If a difference persists, secure the evidence and assess whether it reflects timing, recording error, or possible loss.
Worked example: Two custodians count $1,000,000 in a vault at close, while the ledger reports $995,000 at the same cutoff. The physical excess is $1,000,000 minus $995,000, or $5,000. Dual signatures support the count, but do not explain the difference. Trace the day's transfers and shipment tickets, confirm cutoff, and reconcile the ledger before closing the exception.
Watch the distinction: Two signatures on a cash count do not make the books correct. Custody reduces unauthorized access; reconciliation detects whether recorded movements match the cash.
Reference: [3]
48. Protect dormant accounts
An inactive account offers a fraud opportunity because its owner may not notice changes quickly. Review how the bank identifies dormancy, restricts transactions, and authorizes reactivation. For each sampled account, place contact-detail changes, hold removal, reactivation, and withdrawals on a timeline. Verify customer instructions using evidence independent of the newly changed contact channel; a callback to a freshly substituted phone number proves little. Compare the employee who entered changes with the employee who approved them, and inspect exception reports for unusual sequences. Search the system population for reactivations followed soon by payments, rather than sampling only documented requests. The sequence matters because several individually plausible actions can combine into a takeover. For related fraud-investigation methods, the fraud examiner guide provides useful additional practice.
Worked example: A dormant account's phone number changes on Monday, its hold is removed Tuesday, and $20,000 leaves Wednesday. The transfer is 100% of the stated $20,000 withdrawal exposure. Check the original customer instruction, independent approval, old-contact verification, and release log. If staff relied only on the new number, the verification route is compromised even if the payment had a valid system approval.
Watch the distinction: A successful callback is weak evidence when it goes to contact information changed moments earlier. Verify the customer through an independent, established channel.
Reference: [3]
49. Enforce lending authority
Delegated lending authority sets who may commit the bank and under what conditions. Audit the authority schedule effective on the approval date, the proposed exposure, related borrower obligations, approval conditions, and the person or committee that acted. Separate approval from funding: a correct credit decision cannot cure a disbursement made before required approval. Test system controls that prevent an officer from approving beyond a limit, then examine overrides and committee minutes to see whether the limit worked in practice. Consider whether a transaction was split into smaller pieces to avoid a higher approval level. A later ratification may address governance, but it does not turn the original funding sequence into a timely approval. Collateral quality and repayment prospects affect credit risk; they do not increase an officer's delegated authority.
Worked example: Under a hypothetical delegation, an officer may approve up to $300,000. The officer alone approves and funds a $400,000 loan. The excess is $400,000 minus $300,000, or $100,000. Review the effective authority schedule and timestamps. Unless another authorized approval preceded funding, report an authority breach even if the $400,000 exposure is well secured.
Watch the distinction: Strong collateral does not expand an officer's limit. Approval authority governs who may bind the bank, while collateral bears on potential recovery.
Reference: [3]
50. Verify collateral rights
A collateral file can contain a valid promise of security without showing that the bank has completed the steps needed to protect its interest against others. Identify the collateral type, debtor, governing agreement, and method required in the scenario to establish and perfect the interest. Then compare the signed security agreement with filing, possession, control, title, or recording evidence as applicable. Check names, descriptions, jurisdictions, dates, expiration or continuation records, and prior liens. The audit question is whether the bank has the rights it assumed when approving and valuing the loan. A search result may reveal competing claims even when the bank's own filing exists. Separate a documentation deficiency from a calculated loss: unsecured exposure raises recovery risk, but the amount of loss still depends on borrower condition and other sources of repayment.
Worked example: A $250,000 equipment loan has a signed security agreement. The scenario requires a filing to perfect the bank's interest, but the file has no filing receipt or search result. The unsupported secured amount is up to $250,000, subject to other repayment sources. Search the filing record and dates; if no effective filing exists, escalate the collateral defect and reassess recovery assumptions.
Watch the distinction: Possessing a signed agreement does not always establish priority against other claimants. The required perfection step and competing interests must be checked separately.
Reference: [3]
51. Test loan-payment allocation
A loan payment must be applied according to the agreement and the bank's accounting treatment. Recalculate interest through the payment's effective date using the correct principal, rate, and day-count convention, then identify any authorized charges and the remainder for principal. Compare the calculated split with the servicing system, customer statement, and general ledger. A wrong split changes future interest because the outstanding principal becomes wrong, even if today's cash receipt is recorded accurately. When testing, distinguish scheduled payments, partial payments, prepayments, and payments on delinquent or nonaccrual loans; they may have different allocation rules under the stated terms. Investigate whether staff could manually override the system and whether exception reports detect unusual all-interest postings. Trace corrected allocations into subsequent periods to confirm the error has stopped propagating.
Worked example: Under the stated terms, a $1,000 receipt covers $200 accrued interest and $800 principal. The bank posts all $1,000 to interest. Cash is correct, but interest income is overstated by $800 and principal remains $800 too high. Reallocate $800 from interest to loan principal and recalculate later interest that was based on the overstated balance.
Watch the distinction: Matching the total receipt is insufficient. A payment can be fully collected yet misstate income and the remaining loan balance through an incorrect allocation.
Reference: [3]
52. Separate trading and settlement
A securities trade passes through authorization, execution, confirmation, settlement, custody, and accounting. Each stage should supply evidence independent enough to challenge the previous one. Start with the investment mandate and delegated limits, then compare the trader's ticket with a counterparty confirmation obtained through an approved channel. Match security identifier, side, quantity, price, trade date, settlement date, and accrued interest where relevant. Follow the cash movement to the settlement statement and confirm custody or beneficial ownership afterward. A booked asset does not prove the bank received the bond; a cash payment does not prove the agreed price was fair or authorized. Inspect cancellations and amendments because they can conceal an off-limit trade. Reconcile positions and income after settlement to catch duplicate or missing entries.
Worked example: A trader books a $2 million bond purchase. The ticket states $2 million, but no independent confirmation is on file. Cash settlement shows $2 million left the bank, proving payment but not the bond's terms or receipt. Obtain the counterparty confirmation and custodian position, match identifier and quantity, and reconcile any difference before accepting the investment balance.
Watch the distinction: A trade ticket is created by the party whose execution is being tested. It cannot replace independent confirmation, settlement evidence, and custody verification.
53. Measure a funding-stress buffer
A funding-stress buffer estimates what remains after assumed cash needs are met over a defined horizon. Begin with cash and assets that can actually be converted to cash within that horizon, net of pledges, settlement delays, and haircuts. Then subtract projected deposit withdrawals, maturing obligations, collateral calls, and other cash uses without counting the same outflow twice. The residual is a scenario result, not a guarantee. Audit the source balances, runoff assumptions, contingent commitments, and legal or operational access to liquidity. Compare the stress horizon with the timing of inflows; a bond sale expected after the peak need cannot cover an earlier shortfall. Run sensitivities for concentrated depositors and market disruption. A positive number can be fragile if it depends on untested lines or assets whose value falls in stress.
Worked example: Assume usable liquidity within the scenario horizon is $20 million, deposit runoff is $12 million, and margin calls are $5 million, with no overlap. The buffer is $20 million minus $12 million minus $5 million, or $3 million. If $4 million of the liquidity is pledged and cannot be released in time, usable liquidity falls to $16 million and the buffer becomes negative $1 million.
Watch the distinction: A positive headline buffer may rely on inaccessible assets. Test when cash can be obtained and whether stress has already reduced its usable value.
54. Interpret interest-rate sensitivity
Modified duration gives a first-order estimate of how an option-free bond's price responds to a small yield change: percentage price change is approximately negative modified duration times the yield change in decimal form. The negative sign reflects the usual inverse relationship between yield and price. Apply the estimate to the portfolio's relevant market value, not its original purchase cost, and keep the rate move in decimal units. Duration is local: larger moves require attention to convexity, and callable or prepayable instruments may change cash flows as rates move. For a bank audit, inspect the yield shock, portfolio composition, model inputs, and whether liabilities are included when management describes overall interest-rate exposure. A correct asset-price calculation alone cannot establish the effect on earnings or economic value of equity.
Worked example: Assume an option-free bond portfolio worth $10 million has modified duration of 3 years. A parallel yield rise of 1 percentage point is 0.01 in decimal form. Approximate change is negative 3 × 0.01 = negative 3%, or negative $300,000; estimated value is $9.7 million. Convexity means the actual price change may differ, especially for a larger shock.
Watch the distinction: One percentage point must enter the duration formula as 0.01, not 1. Also, bond duration alone says nothing conclusive about matching liabilities.
55. Authorize wire transfers
Wire controls should establish both that the customer authorized the payment and that the released instruction matches the authorized destination. Trace initiation, identity verification, beneficiary setup or change, independent approval, and release through system logs. When beneficiary details change, validate the new account through a trusted channel separate from the change request; approving only the amount leaves the destination unchecked. Compare the payment message with the approved instruction, including beneficiary bank, account, currency, and effective date. Look for one person who can create a beneficiary and release the wire, as well as overrides, after-hours activity, and returned wires. A second approval is meaningful only if the approver sees the relevant changed fields and acts before release. Follow a sampled wire to settlement and any recall attempt or exception investigation.
Worked example: A $500,000 wire is approved for the correct amount, but its beneficiary account was changed an hour earlier. The approval screen displayed only the amount. The full $500,000 is exposed to a destination error. Inspect the original instruction, independent callback or equivalent verification, change log, and release timestamp; the amount approval cannot substitute for validating the new account.
Watch the distinction: Two people touching a wire does not prove dual control. The second person must review the fields that create risk before the payment is released.
Reference: [3]
56. Analyze ACH exceptions
ACH return analysis begins with a complete population of originated entries and their later return or adjustment records. Calculate the return rate using a consistent numerator, denominator, and period, then divide returns by reason: insufficient funds, closed accounts, authorization disputes, and administrative errors imply different causes. Look for clusters by originator, customer, date, processor, or file version. Compare rates with the originator's prior periods and with the bank's own monitoring criteria; the rate alone does not prove misconduct. Trace selected returns to the original authorization and transaction, and confirm that adjustments reached customer accounts and the general ledger. Late or reversed returns can distort a snapshot, so state the observation window. Investigate whether recurring authorization returns prompted underwriting, monitoring, or access changes for the originator.
Worked example: An originator sends 1,000 debit entries, and 30 are returned during the defined review window. The return rate is 30 ÷ 1,000 = 3%. If 20 returns cite insufficient funds and 10 cite authorization, those are 2% and 1% of entries respectively. Review the ten authorization cases and compare prior periods before judging the originator's control quality.
Watch the distinction: A 3% return rate is not a diagnosis by itself. The reason codes and population period determine whether the issue concerns funds, authorization, or processing.
Reference: [3]
57. Oversee service providers
Outsourcing a bank process changes who performs the work, but management still needs to understand and oversee the resulting risk. Map the provider's tasks to customer, financial, compliance, and availability outcomes; identify which controls the provider operates and which remain at the bank. Examine the contract, service measures, incident reporting, and the control evidence management receives. A clean provider report may cover a different period, system, or service than the bank uses, so read its scope and exceptions. Reconcile provider output with bank records and customer complaints, and test how overdue cases are escalated. For a critical service, assess exit and recovery dependencies as well. Internal audit should evaluate management's oversight process, including whether someone with authority reviewed exceptions and drove correction, rather than merely filing the provider's reports.
Worked example: A processor handles debit-card disputes and reports 100 open cases. The bank's complaint log identifies 12 more cases absent from that report, so the apparent population could be at least 112 pending reconciliation. Match identifiers and dates to rule out duplicates. If the 12 are genuinely missing, investigate intake and reporting controls before accepting the provider's open-case count.
Watch the distinction: A provider's performance report is evidence to test, not proof of oversight. The bank must detect missing cases and act on exceptions affecting its customers.
58. Review privileged access
Privileged rights can change data, users, configurations, or logs, so an audit should test more than whether an account appears on an access list. Obtain a complete system-generated list of privileged identities, including service and emergency accounts. Compare each identity with current role, documented approval, permitted functions, and last use. Trace hires, transfers, and departures to provisioning and removal records; a transfer can leave obsolete rights even though the employee remains active. Inspect logs for sensitive actions and determine whether reviewers were independent of the administrator. Test shared accounts for accountability and emergency access for timely review. A periodic certification is weak if reviewers cannot see the privileges behind role names. The finding should identify the excess capability and whether it was used, while keeping those conclusions separate.
Worked example: A loan-operations employee moves to sales on June 1 but retains administrator rights on June 30. The excess access lasted at least 29 days after the move, assuming the transfer was effective June 1. Compare the new duties with the entitlement, inspect privileged actions during that period, and trace the missed removal through transfer and review records.
Watch the distinction: An active employee is not automatically entitled to old privileges. Access should follow current duties, and retained rights require approval and monitoring.
Reference: [3]
59. Control system changes
A completed change ticket shows that a workflow ended, not that the system change was safe. Reconstruct the change from business requirement through code or configuration, approval, test evidence, deployment, monitoring, and rollback capability. The test should use expected and boundary cases that could reveal a rate-table error, and its results should be reviewed before production release. Compare the deployed version with the approved and tested version; emergency changes need a traceable retrospective review. After deployment, reconcile a sample of affected loan outputs with contractual terms and quantify any customer or income effect. If many accounts are wrong, identify whether the defect lay in requirements, test coverage, migration, or deployment. Separate the defect's cause from the later failure to detect it so corrective actions address both.
Worked example: An approved ticket changes a rate table, but no test result exists. Fifty loans receive 7% instead of their contractual 6%. The difference is 1 percentage point per affected balance per year before timing adjustments; a dollar loss cannot be calculated without balances and durations. Identify the deployed table, correct rates, recalculate each affected loan, and test the replacement before closing the change.
Watch the distinction: Approval to make a change does not demonstrate that its output was tested. A ticket can be complete while production calculations remain wrong.
Reference: [3]
60. Test operational recovery
Operational recovery testing asks whether a critical service can return within the bank's stated objective and whether the restored service is usable. Define the service boundary and the recovery-time objective before the exercise. Record outage start, restoration milestones, full transaction capability, and any backlog clearance separately; a login screen appearing is not necessarily recovery. Compare observed times with the objective, then trace delays to dependencies such as vendor access, network links, credentials, replicated data, or manual workarounds. Verify that restored data are complete and accurate, since fast recovery with missing transactions is not success. Exercise results should produce an owned corrective action, revised procedures or capacity where needed, and a later test. Where several systems depend on one provider, assess whether the scenario realistically stresses that shared point of failure.
Worked example: A payment service has a hypothetical four-hour recovery objective. An exercise starts at 09:00 and restores full transaction processing at 15:00, taking six hours. The gap is six minus four, or two hours. If authentication was ready at 12:00 but vendor data arrived at 15:00, investigate the data dependency, assign a fix, and retest full processing.
Watch the distinction: Restoring a server is not the same as restoring a banking service. Measure when accurate transactions can resume against the stated objective.
Official references and further reading
- BAI 2015 course catalog: historical CBA identity only
- OCC Internal and External Audits: bank-audit reference, 2019 booklet with March 2025 amendments
- FDIC Internal Routine and Controls, Section 4.2: bank-control reference
- Home | Office of Foreign Assets Control
- 12 CFR Part 1002 - Equal Credit Opportunity Act (Regulation B)
- 12 CFR Part 1026 - Truth in Lending (Regulation Z)
- 12 CFR Part 1005: Electronic Fund Transfers (Regulation E)
- 12 CFR Part 229: Availability of Funds and Collection of Checks (Regulation CC)
- Community Reinvestment Act (CRA)