Can anyone recommend a good ACH Audit Program? Thanks!

NACHA has a good audit program. Go to www.nacha.org, go to Publications and then select Risk Management & Compliance. Scroll down and you will find the Audit 2005. $75 for members/$125 non-members. I have used this program for the past two years.

I always used to use the audit program in the NACHA ACH Operating Rules & Guidelines book, which just listed the procedures that were required and didn't give much guidance in completing them.

It's been at least a few years since I've done an ACH audit myself. I checked out the Audit book referenced by SarahH. If I would have known about this resource, the cost seems like it definitely would have been worth the extra time I always had to spend trying to interpret it all myself.

From the nacha website:
The updated ACH Audit Guide 2005 is offered for the first time this year as a spiral bound workbook with an included CD version of the guide. The CD version will allow users to enter their audit information electronically. This is a comprehensive, working ACH audit document with tools to enable you to more easily perform the annual ACH audit required by NACHA. ACH Audit 2005 is designed to specifically outline each exposure point financial institutions and third-party processors are required to test. The workbook can be completed by internal or external auditors, or ACH management. The guide includes instructions on how to complete the 2005 Audit, specific rules corresponding to each ACH requirement, and testing instructions for each specific exposure point. Each area of ACH is included for review: originating, receiving, exception item processing and Treasury issues. Examples are provided for easy understanding in the introduction of each section. The Guide also includes ACH terms and definitions for quick reference.

I use the book and CD from EPN (Electronic Payments Network). It is only $60 and not only gives you the procedures but explains how to test.

I have always used the self-audit guide published by our payment association. If you have originators, there is also a good ACH Risk Management book I purchased a few years ago. Spiral bound workbook would be a great improvement over recent years.

The OCC just told us (today) that the NACHA audit alone would be inadequate. We were told to we also needed to do an ACH Risk Assessment, review the revenue stream, risks associated and the information reported to managment on these areas. She advised looking at ACH Safety and Soundness...

Now what?

JLJ, All I can say is Holy Smokes! I guess I would check with NACHA on this because it is there requirement afterall. We just had an OCC exam in August and all I had was my NACHA audit program...geez, what next!!

JLJ,

NACHA's audit guidelines are meant to protect the integrity of the ACH system. The OCC wants to make sure the bank is protected as well (although those two goals are not conflicting).

Although I've never heard of this particular issue before, I would ask the OCC contact you spoke to for guidance on exactly what they want you to do, with references to written materials, such as the OCC handbooks, and also ask if they could tell you informally, without using names, what other banks do.

It was the EIC who mentioned this to our compliance officer. They're (the OCC) still here...I'll have her try and get more details.

Here's the OCC booklet that includes ACH risks:

http://www.occ.treas.gov/handbook/paymentsys1.pdf

Thank you for the information. We are an OCC bank also.

I am compliance officer that received the OCC examiner opinion. The OCC examiners disclaimed that the ACH Risk view was their individual opinions only. The information was based on a horizonal study completed with 24 mid-size and 4 community banks. This study was uniquely designed to look beyond the ACH NACHA annual audit and the "day-to-day" processing issues in ACH operations. They looked at Strategic, Credit, Reputation, and Compliance Risks associated with ACH Origination.

The examiners in question wanted to reiterate this was an overall approach in regards to the Risk Management Aspect of ACH Operations- is the Executive Management team and the Board of Directors truly aware what types of risks were associated with ACH Origination and whether a specific ACH Risk Assessment was completed?

These examiners felt the NACHA annual audit is one piece of the puzzle, obviously the most important due to rule requirements. But the point that was being stressed was that true safety and soundness risk can be associated with ACH operations. As banks move into more and more ACH origination and more revenue opportunities arise, all the risks must be fully evaluated, monitored and reported to Board.