Regulators issue internal audit paper.

Four federal banking agencies issued a policy statement on internal audits, including information on outsourcing the internal audit function. The statement emphasizes the importance of sound risk-management processes and internal controls, and it warns of certain risks related to outsourcing internal audits to vendors that also perform the financial statement audit or other services requiring independence.

"Federal regulators have had concerns over the independence of certain outsourcing arrangements," said Doris L. Marsh, examination specialist in the FDIC Division of Supervision. Marsh said there also were instances when the oversight agencies thought the number of staff was not sufficient to oversee the internal audit function. "We consider this a `best practices' paper," said Marsh.

The statement, Interagency Policy Statement on the Internal Audit Function and Its Outsourcing, was sent to the CEOs of all banks by their respective regulators. It was issued by the FDIC, the board of governors of the Federal Reserve System, the Office of the Comptroller of the Currency and the Office of Thrift Supervision.

The statement focuses on the sound practices necessary to manage effectively the internal audit function of insured depository institutions, bank holding companies and U.S. operations of foreign banking organizations. It also examines how outsourcing arrangements may affect an examiner's internal control assessment and discusses how certain outsourcing arrangements could affect the independence of an external auditor that is also providing internal audit services. The statement notes that an entity's board must select an external auditor that will satisfy the independence requirements established by the AICPA and relevant requirements of the SEC.

The statement is available on the FDIC Web site at www.fdic.gov and the Federal Reserve Board's Web site at wwwbog.frb.fed.us.