Internal Audit
CBC’s internal audit function was inadequate. According to FDIC and state examination reports
from 1997 through 2001, the internal audit function lacked independence and effectiveness, and did
not comply with regulations. A strong internal audit function helps to ensure that proper internal
controls, policies, and procedures are continuously practiced.
According to Section 4.2 of the DSC Manual of Examination Policies, a strong internal auditing
function establishes the proper control environment and promotes accuracy and efficiency in the
bank's operations. The basic purpose of internal auditing is the safeguarding of assets and the
prevention and detection of problems before they result in losses. The auditor's role is to help
safeguard the bank's assets by performing tests and procedures establishing the validity and
reliability of operating systems, procedural controls, and resulting records. Auditors must have
complete independence in carrying out the audit program and should report their findings directly to
the bank's board of directors or a designated directors’ audit committee.
CBC’s internal auditors lacked independence: In July 1996, CBC contracted the internal audit
function to its external auditors. According to the FDIC's October 1997 examination report, the
external auditor's independence was impaired because the same audit team conducted both the
external and internal audits. In 1998, the FDIC considered independence between the internal and
external auditing functions restored because separate audit teams within the same firm were
performing the audits.12
According to documentation we reviewed in CBC's files and the March 2001 examination report,
CBC in 1998 appointed an employee who was serving as the Risk Manager as internal auditor.
As an auditor, he audited areas for which he had a role or responsibility in approving procedures
or making management decisions as the risk manager. Again, FDIC examiners noted the internal
audit function lacked independence.