SPEAKING THE SAME LANGUAGE

You might not always think about it, but the 10 most commonly used words in the English language according to experts are: the, of, to, and, a, in, is, it, you & that. So, the thing we would say this morning is "If it is in you or us to think about that as you drink a cup of coffee and eat a muffin this morning - enjoy!" Ok, it isn't that easy to get them all into a single sentence perhaps, but you get the gist. Speaking of speech about this and that, we pick up again on the internal audit discussion of yesterday to add a few more components you might like to know. As indicated in the same report from the BIS we discussed yesterday, regulators expect internal audit teams (whether actually internal or hired to do the function) to be fully prepared before any process begins. In general, the internal audit team is expected to have "an independent and informed view of the risks faced by the bank." That is a lot to prepare for, but it points out how important this function is in the overall scheme of things. Regulators also expect banks to make sure audits are based on not only files and records; but also a deeper dive into data, a process of inquiry and a professional approach. Once audit teams have completed their review, regulators expect them to "discuss their views, findings and conclusions directly with the audit committee and the board of directors." This makes sure the integrity of the process is maintained, removes undue management influence and while it can sometimes put management and staff on edge, it is designed to serve and protect the bank. Such processes are common in banking. As audits unfold, teams will commonly seek answers to questions that surface from their discussions with staff or management. To ensure accuracy, anything of note that surfaces should be double-checked again to make sure nothing is misunderstood. This is the time when management or staff has an opportunity to respond or clarify things. All of this back and forth process is then incorporated and final results are provided to the audit committee of the board. Auditing is important and to make sure the process is thorough, fair and effective; it is also critical to make certain the function is independent of the audited activities. That sounds like common sense, but when expertise resides in one area and a community bank doesn't have extra people to throw around, it can be more complex than it seems at first blush. Community banks just don't have teams of experts lying around that are unused, so care must be taken to ensure the audit process is followed. In a community bank stretched for resources, it seems to make sense that the internal audit function should be able to design and implement processes to correct findings, but this should be avoided. There are simply too many potential conflicts that can arise, so the audit function must remain independent of operational management. Questions and discussion are common and helpful, but the audit team should not be directly involved in the development or implementation of internal controls. Finally, it is important to train your audit staff to keep them at the top of their game. Understanding where risks are coming from is important, but equally important is making sure the auditor has the understanding and training to handle the bank's situation. Here the report indicates auditors should have the "ability to collect and understand information, to examine and evaluate audit evidence and to communicate with stakeholders of the internal audit function." It makes sense to not only boost training for audit teams, but to share knowledge gained throughout the bank that is obtained as a result of the audit process. Doing so will help your bank maintain best practices, as risk management is further enhanced. No matter how you speak or what words you select, as a banker you intuitively know the internal audit function is important to the proper operation and risk management of the bank.