OCC 2

About AABD Mission Statement Leadership, Advisors,
and Staff AABD Committees

Subject Matter/Programs

Why Become A Member Criteria for Membership Top 10 Reasons Membership Application

Current Policy Positions Regulatory Burdens on Bank Directors Federal Banking Agencies Congress State Banking Agencies State Legislatures

AABD Major Publications Bank Director News Press Releases, Letters,
Articles, and Speeches Recommended Reading Pocket Guides for Directors Order Publications

Education Needs Institute For Bank
Director Education (IBDE) Bank Director Certification IBDE Course Guide

Appendix H: Board/Audit Committee Oversight Worksheet

The following worksheet is designed to help examiners assess the quality and extent of a bank’s audit committee (or board, if there is no audit committee) duties and responsibilities and the qualifications of committee members. Examiners may want to use the worksheet, or share it with the bank’s board or audit committee, to facilitate as a tool to facilitate general discussions with banks about audit committee (or board, if there is no audit committee) responsibilities. The worksheet can be used for national banks subject to 12CFR363 or those with securities registered with the OCC (i.e., subject to the periodic filing and reporting requirements of 12CFR11 and 12CFR16.20). It can also be used for banks that are not subject to the statutory requirements (i.e., most community banks). However, in doing the latter, examiners need to be cognizant of the bank’s size, operations, and risk profile, and temper such discussions accordingly. Use of this worksheet is not mandatory and it can be used at the discretion of the EIC.

Note: A response in a shaded answer block generally indicates an area examiners should discuss with the bank’s board of directors or its audit committee and, as appropriate, reach agreement on corrective measures. Examiners should explain any mitigating circumstances, particularly for smaller community banks, in the Comments column.

	Yes	No	N/A	Comments
General Responsibilities
Does the board of directors or its audit committee:
a. Review and approve audit strategies, policies, programs (including BSA compliance programs), and organizational structure?
b. Review and approve selection or termination of external auditors and outsourced internal audit vendors?
c. Meet regularly with internal and external auditors and outsourced internal audit vendors?
d. Ensure that internal and external auditors and outsourced internal audit vendors are independent and objective?
e. Ensure that comprehensive audit coverage is in place to meet risks and demands posed by current and planned activities?
f. Have significant input into hiring senior internal audit personnel, setting their compensation, and evaluating their performance?
g. Review and approve annual audit plans and schedules, and any changes thereto, for both internal and external audits?
h. Retain internal and external auditors and outsourced vendors qualified to audit the activities in which the bank is engaged?
i. Monitor and track significant control weaknesses and management’s progress toward corrective action?
j. Meet with examiners at least once each supervisory cycle to discuss audit review findings?

Is the committee responsible for risk management issues? If so, does it:
a. Communicate risk management concerns to the full board?
b. Ensure that risk management evaluation functions are independent?
c. Review risk management reports and information?

Audit Committee
Does the bank have an audit committee? (Required for 12CFR363 or OCC-registered banks)

Does the committee maintain minutes and other relevant records of their meetings and decisions? (Required for banks subject to 12CFR363)

Has the committee adopted and the board approved a written charter for the audit committee? (Required for OCC-registered banks)

If so, does the charter address:
a. The committee’s responsibilities and how they carry out those responsibilities (including structure, processes, and membership requirements)?
b. The committee’s review and discussion with IPAs of any relationships or services that may affect the IPA’s independence or objectivity? (SEC’s revised independence rule require OCC-registered bank audit committees to pre-approve all audit, review, attest, and non-prohibited non-audit services.)
c. The IPA’s accountability to the board and committee, and the board/committee’s authority and responsibility to select, evaluate, and (where appropriate) replace the IPA?

Are committee members independent of management? (Required for 12CFR363 and OCC-registered banks)

Is the committee a. Made up entirely of outside directors (Required for 12CFR363 and OCC-registered banks) or
b. A majority of outside directors?

Does the board of directors annually make a determination of committee member independence? (Required for 12CFR363 and OCC-registered banks)

If so, does the board’s determination consider whether members:
a. Are, or have been, an officer or employee of the bank or its affiliates?
b. Serve or have served as the bank’s or its affiliates’ consultant, advisor, promoter, underwriter, legal counsel, or trustee?
c. Are relatives of a bank’s or its affiliates’ officers or employees?
d. Hold or control, or did not hold or control within the preceding year, either directly or indirectly, a financial interest of 10% or more in the bank or its affiliates?
e. Have outstanding extensions of credit from the bank or its affiliates?
f. Whether any committee member is a large customer of the bank?

Are committee members:
a. Financially literate?
b. Do they have banking or related financial management expertise? (Required for banks subject to 12CFR363 and OCC registered banks)

Does the committee have access to its own counsel at its own discretion and without prior approval of the board or management? (Required for banks subject to 12CFR363 and OCC registered banks)

Does the committee perform all duties as determined by the board of directors, including reviewing, as applicable, with management and the IPA: (Required for 12CFR363 and OCC-registered banks)
a. The scope of services required by the external audit (i.e., IPA’s responsibilities under GAAS)?
b. The basis of Part 363 required reports?
c. Significant accounting policies?
d. Management judgments and accounting estimates?
e. Audit adjustments and passed or waived adjustments?
f. IPA’s judgment about the quality of the bank’s accounting principles?
g. Other information in documents containing audited financial statements?
h. Disagreements between the IPA and management?
i. Assessments of internal control adequacy and resolution of identified material internal control weaknesses and reportable conditions?
j. The institution’s compliance with laws and regulations?
k. Consultations with other accountants?
l. Major issues discussed with management prior to retention of the IPA?
m. Difficulties encountered in performing the audit?

Does the committee oversee the internal audit function? (Required for banks subject to 12CFR363)

Does the committee discuss with management the selection and termination of the IPA? (Required for 12CFR363 and OCC-registered banks)

Does the audit committee pre-approve all audit and permitted non-audit services provided by the IPA? (Required for OCC-registered banks)

Does the committee on an annual basis: (Required for OCC-registered banks)
a. Receive and review written disclosures from the IPA disclosing all relationships between the IPA and its related entities and the bank and its related entities that, in the IPA’s judgment, may reasonably bear on independence?
b. Review the above letter to ensure that the IPA confirms they are independent of the bank?
c. Discuss the IPA’s independence with the IPA?

Does the committee recommend to the board of directors that the audited financial statements be included in the bank’s annual report? (Required for OCC-registered banks)

Does the committee review the aggregate fees billed by the IPA for: (Required for OCC-registered banks)
a. The annual financial statement audit?
b. Other audit-related services?
c. Tax services?
d. All other products and services provided by the IPA for the most recent fiscal year?

Does the committee review the hours spent on the bank’s financial audit by persons other than the IPA’s full-time permanent employees? (Required for OCC-registered banks)

The bank’s board of directors may assign these to another committee or individual designated as responsible for overseeing the bank’s overall risk management functions.

National banks whose securities are registered with the OCC and file periodic reports under 12CFR11 and 12 CFR 16.20, and national banks subject to 12 CFR 363.

The required reports are: (1) management’s report and assertion on internal controls over financial reporting and compliance with designated laws, (2) independent public accountant’s audit and report on the bank’s financial statements, and (3) independent public accountant’s attestation report on management’s control assertion.

General Responsibilities

Audit Committee