What is a Supervisory Committee?
One of the hottest topics I have seen National Credit Union Administration (NCUA) examiners focus on this past year is the performance of Supervisory Committees at Credit Unions – and rightfully so. The Supervisory Committee consists of three to five members of the Credit Union and is appointed by the Board of Directors. One of its members may also be a member of the Board.
The Committee, comprised of volunteers, is often referred to as the Audit Committee in larger Credit Unions. The primary tasks of the Committee are performing or selecting a third party to perform the annual audit, internal audit throughout the year, and member verification every other year. To repeat this is the responsibility of the Supervisory Committee – not the Board of Directors or the Chief Executive Officer of the Credit Union. I will cover member verifications in a later post.
Meetings and Training
The Committee should schedule periodic meetings with established agendas. The meetings should cover a review of all audit functions and internal or external reports issued. Minutes should be kept and document any audit findings and action items the Committee is required to take on the audit findings. The minutes should also document the results of the follow up on the action items. The Committee should also undergo annual training from a qualified third party to not only learn how to better perform their duties but to stay abreast of current trends and topics.
Annual Audit and Selection of Auditors
Credit Unions with assets greater than $500 million are required to have an annual Opinion Audit performed by a qualified CPA firm. Credit Unions with assets less than $500 million can have either an annual Opinion Audit or a Supervisory Committee (SC) Audit. An SC Audit is an agreed-upon procedure engagement. Since most members do not have the expertise to perform the SC Audit the Committee will engage a third party.
Years ago, the NCUA established the minimum procedures required to be performed to qualify as an SC Audit. However, Committees should meet with their selected third party prior to performing the SC Audit each year to determine if there are any factors internal (employee turnover, poor financial results, excessive charge-offs, etc.) or external (change in market conditions, current NCUA examiner trends, recent fraudulent activity at other Credit Unions, etc.) that would warrant performing additional procedures.
Our firm has been called in by NCUA to investigate many Credit Unions with fraudulent concerns. The result of these investigations forced me to develop additional procedures designed to give the Credit Union additional assurance on their controls and processes. Many of our Credit Unions have engaged us to perform these procedures and have been very pleased with the results.
Which brings me to the selection of your external auditors. There are a lot of CPA firms out there but there are not many Credit Union CPA firms. I highly recommend you select a firm that has a lot of experience working with Credit Unions. The majority of our audit staff worked at a Credit Union prior to working for
If your auditors cannot talk Credit Union talk nor have the experience, it could mean trouble. As an example, I have reviewed other CPA firms workpapers where the audit documentation on a workpaper stated that the outstanding ACH items all cleared within the next 30 to 45 days. Outstanding ACH items generally clear the following day. I have seen this documentation more than once and in two cases it was large, well-respected CPA firms and there was fraud present. Please choose your CPA firm wisely.
Internal Audit Plan and Risk Assessment
The Committee needs to determine the expertise they have to perform the monthly/quarterly internal audit procedures. Larger Credit Unions will have an internal auditor on staff but still may engage a third party to perform selected procedures. Smaller Credit Unions will engage a third party to perform some if not all the internal audit procedures.
When formulating the work plan for the year the Committee should assess their risk in each area. An easy way to assess your risk is to meet with your external auditor to not only review current trends but to determine what procedures the Committee believes it has the ability to perform (Cash counts as an example) and what procedures the Committee engages the external auditor to perform. By doing so the Committee has essentially performed their risk assessment by engaging the external auditor to perform the procedure. In other words, the procedures the Committee performs would have a low assessed risk and the procedures the external auditor would perform would have a medium to high assessed risk.
The NCUA Supervisory Committee Guide issued years ago offers a monthly work plan and the NCUA has recently issued minimum procedures to be performed. We have some additional procedures we like to perform for our Credit Unions. Each Credit Union is unique. I like to meet with our Credit Unions and tailor a quarterly work plan to meet their needs and then reach out to the Committee each quarter prior to performing the procedures to see if there have been any internal developments at the Credit Union that would require altering any procedures.
Pulling It Together
Since Credit Unions with assets greater than $500 million are required to have an opinion audit and will have an internal audit department, let us focus on Credit Unions with less than $500 million in assets.
Credit Unions smaller in size can benefit more from engaging a CPA firm to perform their annual SC Audit and quarterly internal audits than engaging that firm to perform an annual opinion audit. I understand as some Credit Unions reach a certain asset size the Committee feels the need to have an opinion audit – and we do this for many of our Credit Unions.
I often discuss with our Credit Unions – what is the end result you are looking for? To safeguard the assets of your members? In order to do so I recommend choosing a Credit Union CPA firm for your annual and internal needs. Whether you choose an opinion audit or SC audit I also recommend constant communication with your CPA firm. The Committee needs to meet regularly and document their findings and action plans, keep up to date on their training, and make every effort they can to safeguard the assets of their members.
Comments