Community Bank Risk Advisory

A Directors' Examination is less rigorous than a full Financial Statement Audit. It's conducted on behalf of your board and provides independent oversight of the bank's balance sheet integrity through account verification and reconciliation validation as of a particular date, often tailored to meet your state's annual audit minimum requirements. An Outsourced Internal Audit goes further. It's an in-depth look at the critical functions and areas your bank identifies each year, focused not just on account balances but on how well your controls, policies, and procedures are actually working. You determine the areas of focus, usually based on an established audit risk assessment.

Outsourced Internal Audit engagements are tailored to your bank's risk profile and typically run on an annual cycle. Each engagement wraps with an exit meeting to walk management through the results, plus an internal audit report with a schedule of findings and recommendations. The cadence and scope of individual audits during the year follow the areas of greatest risk to your institution, generally guided by an established audit risk assessment that rates each area to be reviewed.

At certain asset sizes, FDICIA requirements start kicking in, and at the $5 billion threshold, internal controls over financial reporting (ICFR) become a major focus. As your bank approaches that size, we help identify key internal controls, build a testing plan, and test those controls for design and operating effectiveness. Because the external auditor must attest to management's ICFR assessment at $5 billion, we help you get there ahead of it: documentation that's auditor-ready, and any weaknesses found during testing communicated and addressed before they become a problem.

We work directly with your external auditors to align on scope, share relevant findings, and avoid duplicating effort. That coordination matters most in FDICIA engagements, where your external auditor will lean on our control testing as part of their year-end work.

It goes well beyond a basic checklist. Our review includes a full IT audit of hardware and software, vulnerability scanning, penetration testing, phishing and vishing testing, downstream testing, and an internal controls review. We also assess your business continuity plan, so you know how your bank would actually respond to a cyberattack or systems failure. The engagement wraps with practical recommendations across 25 key risk areas, giving leadership a clear, actionable picture of where the bank stands.