Does anyone have a list or know the audits/reviews that are required by the FDIC?

I may be a little bitter...but I think they require you to look at everything - or else

Seriously, I thought there were a few audits that they wanted to see done...BSA, wire transfer, Allowance for Loan Losses. Are there others besides those three?

I agree w/Wendy...the examiners expect you to audit everything. They may ask to see your audit schedule as well as your workpapers depending on the scope of their examination....not to mention your resume and a list of training you've attended/completed since the last examination. Yes, BSA is and always will be a hot issue, in addition to e-banking (wires, internet banking, etc.), information security, privacy and whatever else is on the "hot list".

It's all about risk management. They will want to see an institution wide risk assessment and then an audit plan that's built around the degree of risk identified, including a frequency table for audits performed. You are correct that some areas that are high risk lend themselves to dictating at least annual audits, however, other areas may not be as frequent, but can't be ignored.

Actually, there are two different areas of audits with one Regulatory and the other Internal. Of course, Regulatory audits relate to regulations and you should go to the FDIC site to review their 'Compliance Examination' documentation with practically all the regs subject to examination for compliance. Internal auditing (suprprise cash counts, certifications, etc.) is up to each bank with regulators always encouraging banks to do more.

I would suggest going to the FDIC's website and taking a look at their examination manuals for compliance and safety & soundness. You can make a list of all the different areas of examination to begin your internal audit schedule. Some of the higher risk areas such as BSA, Information Security, ACH (not an FDIC requirement - a NACHA requirement), Trust, etc.. will require an annual audit. The rest of it you can plan to audit based off of your risk assessment. Simply, if you have conducted a Reg CC audit every year for the past year and have come up with minimal findings then maybe it could be set up on an 18 months audit schedule - on the other hand if you have found significant exceptions while conducting a flood insurance audit this may warrant at least a 12 month audit.

Most of us don't have unlimited time and resources so we have to assess how we are going to use the time we have. This is where conducting a Risk Assessment will come in handy. If you have never performed one, there are lots of discussion within this forum of how to do so. Also, on the Bankers Tools page - Andy Zavonia has a sample audit schedule that you could use as a guide.

Hope this helps!

Look at your regulator's safety & soundness examination manual and procedures under management / internal control / internal audit. You will generally find a listing of suggested topics for internal audit to cover. Here is an example from the OTS - the attached link references their internal audit questionnaire and lists areas that should be included in the scope of the institution's internal audit program - http://www.ots.treas.gov/docs/429098.pdf. I believe the OCC and FDIC have similar guidance / suggestions.