Tools and Techniques for Internal Auditors and Compliance Officers in External Evaluations CPA Gilberto Rivera, VP Compliance and Operational Risk at Reliable Financial Services, a subsidiary of Wells Fargo

Agenda Overview Compliance Officer & Internal Auditor Responsibilities Compliance Officer & Internal Auditor working together in external evaluations Tools and techniques to prepare external regulatory evaluations Conclusion Questions

Overview Understand functions of internal audit and compliance. Acquire tools and techniques to prepare and respond to external regulatory evaluations.

Compliance Officer & Internal Auditor Responsibilities Similarities: Perform risk assessment procedures to evaluate the effectiveness and efficiency of operations. Communicate findings and provide recommendations to Management to guarantee the compliance with the internal controls, policies, applicable laws and regulations. Perform on-going monitoring and follow-up to ensure remedial actions have been taken.

Compliance Officer & Internal Auditor Responsibilities Main Differences: Internal Auditor Reviews the reliability and integrity of financial reporting and internal controls Ensures the safeguarding of assets Reports directly with the Audit Committee or Board Must be independent from the operation Compliance Officer Focused on compliance with laws, regulations, and policies Obtains and/or establishes policies and procedures Reports directly to Management Liaison with external regulators and auditors Limited independence

Working Together in External Evaluations Both, Compliance Officers and Internal Auditors, collaborate as part of the lines of defense an entity should have. First line of defense (Operations) – is accountable for executing controls for regulatory compliance risks associated with business operations on a day to day basis. Second line of defense (Compliance) - is responsible for independent oversight of the first line of defense, by ensuring that regulatory compliance risks are properly identified, mitigated, tested and reported. Third line of defense (Internal Audit) - provides an independent assessment of the first and second lines of defense and reports directly to the Board of Directors or Audit Committee.

Working Together in External Evaluations Knowledge and awareness of the new standards and regulations, and assess the impact in the operations Understands well the high risk areas subject of the external evaluation Collaborate with external auditors or regulators - SAS 128 for internal auditors in regards to financial statements audits.

Tools and Techniques to Meet External Regulatory Evaluations

Tools and Techniques Know the inspection process in advance Understand well how the evaluation process is conducted. Obtain the examination manual or inspection checklist directly from the regulatory or governing agency. Industry associations and other groups may compliance and audit guidelines.

Tools and Techniques Self-assessments is essential for success It is essential to have a sound internal audit and compliance program. Companies should perform internal compliance audits regularly and proactively correct any deficiencies. Remember that outside auditors will look closely at the internal audit and compliance processes.

Tools and Techniques Consider using a subject matter expert Some entities may not have an in-house expert to handle specific business functions. Independent third-party compliance auditing firms, tax lawyers and others can help close any gap.

Tools and Techniques Be pro-active to changes in the industry “Static” is one of the biggest threats to compliance because compliance is not static, it's a "moving target“. External evaluations will probably tailor their inspection to ensure that any new regulations are accommodated.

Tools and Techniques Read the news Be alert of problems within your industry or business environment Read the news Subscribe to automatic alert services http://www.consumerfinance.gov/newsroom/ http://www.occ.gov/news-issuanances/index-news-issuances.html https://public.govdelivery.com/accounts/USCMS/subscriber/new?topic_id=USCMS_610 http://www.ocs.gobierno.pr/ocspr/ Share information with colleagues Some examples: Department of Justice decisions on any entity that was fined for inappropriate practices Class action suits settled

Tools and Techniques Demonstrate that you can keep compliance data secure Many regulations place security requirements on sensitive data, preventing unauthorized access and safeguarding the data against alteration or destruction. This may involve technologies like encryption and firewalls products. Inspectors will want to verify that aspects of these security requirements are in place and working properly. Have policies and procedures in place to address the scheduling of data destruction and storage.

Tools and Techniques Gather and furnish documentation quickly Provide documents quickly and this should be an important focus of your internal process. Maintain in a centralized manner the gathering and furnish of information in one or two team members.

Tools and Techniques Don't ignore the importance of a business continuity plan Be sure to have documented your important processes and systems in the business continuity plan. Examiners may want to see disaster recovery plans for business units/processes, technology and emergencies.

Tools and Techniques Bring known issues to the table Self-disclose any known issues to the external examiner along with a corresponding corrective action plan. Penalties for intentionally hiding issues tend to be higher than having a self-disclosed issue.

Conclusion Although similarities and differences exists in the compliance and internal audit functions, both can help Management achieve their goals within the regulatory and internal control boundaries. In facing the examiners the most important role of the compliance and internal functions is to work in collaboration with the external evaluator.

Questions

Reference Roles and Responsibilities – Corporate Compliance and Internal Audit”  by  Mark P. Ruppert, https://www.ahia.org/assets/Uploads/pdfUpload/WhitePapers/AuditComplia nce-RolesResp04052006.pdf