Internal Control Questionnaires and Verification Procedures

Pre-Examination Planning

1. Review bank and OCC-generated reports. These may include: internal/external audit reports, internal control reports, internal risk assessment reports, previous reports of examination, examination analysis comments, periodic monitoring comments, Canary early warning benchmarks, correspondence files, and any other internal or external information deemed pertinent to the bank.

2. The EIC should discuss the intended scope of examination with bank management, and identify any significant changes in bank personnel, products, services, internal or external audit schedule or scope, and the local economy.

3. Based upon the preplanning analysis to date, determine if the scope of examination should be expanded. The scope should be expanded if substantive supervisory follow-up issues have surfaced. These may include:

   • Indications that the bank does not have a sound audit program or a satisfactory system of internal control.

   • Significant change in the bank’s business activities or rapid bank growth without implementation of appropriate risk management controls.

   • The existence of significant or unresolved deficiencies.

   • Risk management weaknesses.

4. If the examination is not expanded, finalize the scope of examination.

5. If the examination is to be expanded, revise the scope of examination and select appropriate expanded procedures from the booklets of the Comptroller’s Handbook, including ICQs and verification procedures.

   Expanded procedures should focus on the specific areas or items of concern noted in the preplanning analysis; be tailored to include a more thorough assessment of the risk management process; and include additional transaction testing, if appropriate.

6. Finalize the scope of examination.

Previous: Introduction Next: During the Examination