I'm curious to see what the best approach for the following situation would be, as I may be a bit biased.

We recently had out internal audit, which we're now looking to provide our response to Senior Management and the Board prior to the DOB Examination. Within the audit, there were several issues that were verbal in regards to the processes that have changed since the retirement of two senior members of the department. There were also some issues that require a response that were isolated to the same individuals that have since retired.

My question would be what's the best way to go about the response? Obviously the external examiners are going to review all audit workpapers, and the department wants to show that the inefficiences identified were the result of said individuals, but professionalism would say to provide a response that says something to the effect of "effective (date after retirement), management transferred the process to (insert new individual's name), and reviewed the notations to increase efficiency going forward." To me, that would say that both parties were at fault, when truly that's not the case, and although anyone who puts 2+2 together would see that the dates of the incidents noted in the audit were prior to the transfer of the duty, but I feel as though that's assuming that whoever's reviewing it will make that connection. Certainly the goal wouldn't be to throw anyone under the bus, even though they're no longer employed by us, but it is what it is, right?

Further, the retirements removed a large number of years and experience in the field, so by showing the ability of those who remain to correctly perform a duty that was previously mishandled, we're essentially showing our efficiency despite lack of time spent in the field (it's my first audit, in my first year in the field, yikes!).

Curious to see what others have done in similar situations!

I have never liked audit responses that tried to pin the blame on anyone (fired, retired, or dead). If there is any blame to go around, it belongs squarely on the shoulders of management and the audit committee and the board of directors for letting it go on.

Unless these were major audit findings, why not just say that improved procedures have been implemented and management will be monitoring through improved internal controls. And then make sure that it happens.

Just because someone retired or quits does not give the bank an out. Be reasonable in your response and everyone should understand.

Thanks for the responses. I agree that the blame should have been with management in regards to the deficiencies, as they sort of fostered an extremely manual and outdated approach to perform the cited duties. I think anyone that reads the audit and then reviews the new procedures put in place would see a world of difference, so I think we'll be alright.

I suggest hanging your response on the new procedures.
On DATE, management implemented new procedures that address PAST ISSUE. We have not had a reoccurrence of ISSUE since that time.

I agree with the responses thus far. Use this as an opportunity to wipe the slate clean by fixing what needs fixing rather than placing blame. Regulators and auditors, quite frankly don't give a d**n who's to blame; just tell them what YOU are going to do about it. And the remaining executive mgt., senior mgt. and board need to ensure the circumstances that allowed these deficiencies to exist don't reoccur.

If you can demonstrate that problems were actually traceable to individuals, note that in addition to improvements in processes, yada, yada, changes in personnel had also taken place. Excuses don't cut it, but a spade is still a spade and I would want to at least allude to the real problem in case follow up conversations were necessary.

If you are forced to be candid at some point, then pointing to the individuals when you laid no foundation for that response is really going to sound like you are making excuses.

P.S. I admire the thought you are putting into this...

2 points - first you mention several verbal comments during the audit, those require no action unless they were committed to paper and included in the final audit report.

2nd - my opinion is never use names or positions in audit response; simply speak to procedures which have been changed/updated/eliminated/etc that address the audit comment, explain how what steps you've taken fixed it, how you validated it, and what date this was/will be put in place.

simple, to the point, and move on.

Thanks again everyone for the great feedback.

To speak to Ken's point, items included in the written response portion of the audit can absolutely be traceable to individuals, via an employee number linked to a function within an automated AML system as well as signing off on daily reports that were incomplete. In the event that there are follow up questions regarding these situations it may be impossible to avoid showing the root causes, but that will be another bridge to cross at a later date I'm sure.

I agree completely though the naming of names would certainly be viewed as making excuses for deficiencies, which was certainly never the intent. I think simply showing that the processes have changed and safeguards have been implemented to ensure that the written items identified in the audit will cease will be more than sufficient.