Miles Hitchcock

Director of Product Marketing

Banking internal controls checklist for operations & audits

If operations are the road, internal controls are the lines — keeping all activities within the bounds of security and compliance standards. A banking internal controls checklist is a tool for documenting those controls, one that’s increasingly critical given the many responsibilities banks have and the even longer list of risks they face.

From cash handling to record keeping, internal controls are a tool to manage risk. When banks get it right, they earn customer and shareholder trust by proving they take risk seriously. They also maintain an audit-ready culture that holds up to regulatory scrutiny. To help you develop the right checklist for your bank, this article will explain:

• What internal controls are in banking, and how they’re used
• Types of internal controls in banks
• What a bank internal audit includes
• Two types of banking internal controls checklists
• An internal controls management solution

What are internal controls in banking?

Internal controls in banking, like in any industry, are processes and policies that safeguard assets and data. Banks handle countless invaluable assets: their customers’ and employees’ personal information, cash, checks and countless other monetary assets.

Without internal controls — and an accompanying internal controls checklist — these become vulnerable to hacks and breaches.

Banking internal controls help:

• Manage risk
• Prevent fraud
• Uphold the bank’s reputation
• Comply with relevant regulations

Types of banking internal controls

There are two ways to understand the types of internal controls: the categories of internal controls and the processes those controls apply to.

Banking internal controls will typically fall into one of three categories: controls that prevent risk, controls that detect risk and controls that mitigate risk.

Within each of those categories, institutions should have a banking internal controls checklist that governs many different processes and procedures, including:

1. Cash receipts
2. Cash payments
3. Cash flow management
4. Business financing
5. Accessing systems and data
6. Payroll

What is included in a bank internal audit?

A bank internal audit evaluates how effective the banking internal controls are. To determine which controls exist and how successfully they prevent risk, an auditor might review:

• Control activities in high-risk areas
• How effectively those controls govern operations
• How closely employees follow those controls
• Areas of opportunity, including emerging technology
• In-depth assessment of the internal controls

A banking internal controls checklist is the source of truth for each of the above steps. Employees can use it to verify they’re complying with all policies, while auditors can use it to inform which processes they’re examining.

An effective checklist will not only help banks earn a clear audit report, but it’ll also facilitate a more comprehensive audit process — something risk-minded banks will welcome.

Why should an internal audit review bank internal controls?

Internal audits are designed to identify any internal controls weaknesses before hackers or bad actors exploit them. The inclusion of controls in internal audit is critical for several reasons:

• Independent assurance: Audits give banks an unbiased view of their internal controls. This helps banks turn an objective eye on their internal controls to ensure they are effective.
• Identification of weaknesses: Sometimes controls are poorly designed, but sometimes well-designed controls don’t function as intended. Internal audits can root out either deficiency and recommend a solution.
• Risk mitigation: Internal audit validates internal controls, ensuring they don’t fall short in the face of existing or emerging risks.
• Compliance: Banks are heavily regulated, and many of those regulations require internal controls. An internal audit allows banks to prove their compliance.

Banking internal controls checklist for operations

For controls to be audited, they must first be developed and documented. That’s what a banking internal controls checklist does concerning operations: document the exact policies and procedures all employees must follow.

An internal controls checklist for banks could cover anything from handling cash to processing and approving a loan request. It could include controls like:

Access controls

• Sensitive areas should have restricted access, like badges
• Systems access should require unique credentials for each employee
• Credentials should be updated periodically
• Access should be revoked upon termination of employment

Information security controls

• Customer and bank data should be encrypted
• Firewalls should be in place to protect all systems
• There should be a system history to validate any changes
• Employees should only have access to the data they need to do their job

Cash handling controls

• Cash should be secured
• Only a limited amount of cash should be on hand
• A limited number of people should have access to cash vaults and safe deposit boxes
• One employee should collect cash, and a different employee should reconcile the transaction

Internal controls checklist for bank audits

Once controls are documented in a checklist similar to the above, an internal audit steps in to regularly evaluate controls. These reviews should validate that controls are in place, are being followed and are successful.

An auditor can follow a banking internal controls checklist that includes:

• Checking balance sheets and financial statements
• Reconciling the bank’s ledgers
• Assessing internal controls over financial reporting
• Verifying regulatory compliance, like Know Your Customer and Anti-Money Laundering
• Reviewing lending operations
• Auditing the deposit process
• Validating all bank and customer transactions

Put banking internal controls on autopilot

A banking internal controls checklist could fill a binder with rigorous processes for employees to follow and controls for auditors to check. While banks do need to start somewhere, a manual list can quickly become unwieldy — to create, to utilize and to update.

Given how dynamic internal controls must be, automation can distinguish between successful internal controls and those that inadvertently expose the bank to risk. Internal controls management technology can do all the work of a banking internal controls checklist and more:

• Integrated and continuous control monitoring
• Real-time threat detection
• Streamlined control testing
• Visibility into compliance with regulations like SOX, UK SOX, and J-SOX

Learn more about Internal Controls Management from Diligent, or request a demo.