Issues Tracking and the Internal Audit Function

By Patrick Holden

Many institutions continue to be challenged with implementing and maintaining comprehensive issues tracking routines, and these challenges are oftentimes cited by examiners in examination reports as matters requiring attention.

The board of directors is ultimately responsible for ensuring that a bank's operating standards and system of internal control functions operate effectively and are commensurate with the size and complexity of the institution. An important element in assessing the effectiveness of these systems is an internal audit function that works collaboratively with the board-appointed audit committee. As part of its responsibility, the audit committee should ensure that comprehensive standards exist for the tracking of all open issues in a consistent and timely manner. Just as important, though, is the validation of management's corrective actions prior to clearing issues from tracking reports. Periodically, the audit committee should assess whether management is prematurely removing internal control weaknesses and other exceptions from tracking reports. A review of several examination reports revealed the following shortcomings regarding financial institutions' issues tracking reports and routines:

  • Many issues tracking reports lacked the recommended periodic (i.e., quarterly) and timely review by the audit committee. For example, it was noted in numerous examination reports that the issues tracking report had not been reviewed by the audit committee for several quarters. In addition, some tracking reports had not been updated with current period issues or included past due items without explanations, while other tracking reports only included current year issues.
  • Many issues tracking reports did not provide a consolidated view or central repository of all issues facing the institution. It is incumbent upon internal auditors to independently maintain a comprehensive issues tracking database or report that is inclusive of all weaknesses across business lines (i.e., financial, operational, IT and compliance) noted by internal audit (including outsourced providers), independent accounting firms or bank regulators.
  • Many issues tracking reports seemingly omitted the following key information:
    • Whether the issue is a repeat concern
    • The severity or risk level of the finding
    • The date that the issue was noted
    • The expected date of completed action
    • The individual(s) responsible for corrective action
    • A brief description of planned corrective and sustainable action

In carrying out their responsibility for internal control, audit committees should foster forthright communication with senior management and, together, conduct a critical examination of issues in order to better understand the importance and severity of internal control weaknesses and issues. An effective audit committee takes a leading role in holding bank management accountable for repeat audit and examination findings. In this regard, audit committee minutes should reflect detailed discussion regarding control weaknesses, as well as important tasks such as the engagement of internal and external auditors, the approval of the annual audit plan and the offering of input regarding audit coverage of high-risk areas. In conclusion, examiners will routinely assess the effectiveness of an institution's issues tracking processes, which not only includes reviewing open items, but also assessing internal audit's efforts toward validating management's corrective action when closing issues.

Patrick Holden is a community and regional examiner for the Federal Reserve Bank of Richmond. He can be reached at

The analyses and conclusions set forth in this publication are those of the authors and do not necessarily indicate concurrence by the Board of Governors, the Federal Reserve Banks, or the members of their staffs. Although we strive to make the information in this publication as accurate as possible, it is made available for educational and informational purposes only. Accordingly, for purposes of determining compliance with any legal requirement, the statements and views expressed in this publication do not constitute an interpretation of any laws, rule or regulation by the Board or by the officials or employees of the Federal Reserve System.

Contact Us


Supervision, Regulation & Credit
(804) 697-8000