Contact Information The Right Support Sal Inserra is a partner with Crowe Horwath LLP and can be reached at +1 404 442 1608 or sal.inserra@crowehorwath.com. Although it is management’s responsibility to establish processes and controls to manage risk, it is the audit committee’s responsibility to confirm that such processes and controls are established and monitored. The internal audit group, already charged with risk assessment and monitoring, can play an important role in satisfying this responsibility. This article was published by Bank Director in November 2015 and is reproduced with permission. As with the audit committee, the success of internal audit hinges on the training and experience of the team members and on the provision of necessary resources. The importance of these elements increases significantly when the bank’s management is responsible for reporting on the design and effectiveness of the internal controls over financial reporting, as is required of publicly traded companies, because management must attest that controls are well-designed and operating effectively and is held responsible if its attestation proves false. Bear in mind that a bank’s growth often is not mirrored in changes in internal audit. As a result, issues can go unidentified.

Even if new issues are appropriately identified, the review cycles will be prolonged if internal audit has insufficient personnel. When the board looks strategically at the organization, it must align the expansion of the business with the risk mitigation process—including internal audit resources. Even the most capable audit committee will prove ineffective without a well-armed internal audit team. The board also should recognize that its attitude and that of management toward internal audit frequently contributes to its success (or lack thereof).

Leadership should address findings on a timely basis, and the board and audit committee should monitor the responsiveness of corrective action, especially for those issues flagged as higher risk. If management is dismissive of findings, and the audit committee or board is disinterested in follow-up, the value of the internal audit role will erode quickly. The Right Approach Board members are elected to oversee the activities of their bank, and the audit committee is an integral part of that oversight. It is in the board’s—and the bank’s— best interest to provide both the audit committee and internal audit with the training and resources necessary to execute their responsibilities. www.crowehorwath.com In accordance with applicable professional standards, some firm services may not be available to attest clients. This material is for informational purposes only and should not be construed as financial or legal advice.

Please seek guidance specific to your organization from qualified advisers in your jurisdiction. © 2015 Crowe Horwath LLP, an independent member of Crowe Horwath International crowehorwath.com/disclosure FS-16003-149A .