Explorer

The firm did not identify and test any controls over the issuer's identification of other loans with impairment indicators that had not already been placed in non-accrual status or identified as troubled debt restructurings. (AS 2201.39)

The firm selected for testing a control over the review of qualitative factors which are inputs used in determining the general reserve component of the ALL. The firm did not test the aspect of this control that addressed the accuracy of certain data used in the performance of this control. (AS 2201.42 and .44)

The issuer assigned certain loans a loan risk rating which was an important input in estimating the quantitative component of the ACL. The following deficiencies were identified: · The firm selected for testing a control that consisted of the issuer's review of the loan risk ratings assigned to certain loans. The firm did not assess whether the issuer's review was designed to occur with sufficient scope and frequency to address the risks of material misstatement. (AS 2201.42)

The issuer assigned certain loans a loan risk rating which was an important input in estimating the quantitative component of the ACL. The following deficiencies were identified: · The firm selected for testing a control that consisted of the issuer's comparison of loan risk ratings determined by an external loan reviewer to loan risk ratings determined by the issuer. The firm did not identify and test any controls that addressed the reasonableness of the loan risk ratings determined by the external loan reviewer. (AS 2201.39)

The firm selected for testing two review controls over the qualitative factors used in the calculation of the ALL. The firm did not evaluate the specific review procedure that the control owners performed to evaluate the reasonableness of the qualitative factors. (AS 2201.42 and .44)

The firm did not identify and test a control over certain assumptions used in the calculation of the ALL. (AS 2201.39)

The issuer's ACL included reserves for loans collectively evaluated for impairment and for loans individually evaluated for impairment. For loans that were collectively evaluated for impairment the issuer estimated quantitative qualitative and economic reserve components. The following deficiencies were identified: · The issuer assigned a loan risk rating to its commercial loans. The loan risk rating was an important input in estimating the ACL and determining whether a loan would be individually or collectively evaluated for impairment. The firm did not identify and test any controls over the assignment of the loan risk rating to a certain population of these loans. (AS 2201.39)

The firm selected for testing a control over the review of the adequacy of the ALL. The firm did not identify and test any controls over the appropriateness of the loan grades that were an important factor in estimating the ALL. (AS 2201.39)

The issuer used an information-technology (IT) system to initiate process and record loan-related transactions. The firm selected for testing certain controls over the issuer's review of user access to this IT system but did not evaluate the specific procedures that the control owners performed to determine whether to grant access to users or whether the granted access continued to be appropriate. (AS 2201.42 and .44)

The issuer assigned each loan a loan risk rating which was an important input in estimating the quantitative component of the ACL. The following deficiencies were identified: · The firm selected for testing a control that consisted of the issuer's review for a sample of loans of the loan risk ratings assigned to the loans. The firm identified deviations in the operation of this control but did not evaluate the effect of these deviations on the operating effectiveness of the control. (AS 2201.48)

The issuer assigned each loan a loan risk rating which was an important input in estimating the quantitative component of the ACL. The following deficiencies were identified: · The firm selected for testing a control that consisted of the issuer's review for a sample of loans of the loan risk ratings assigned to the loans. In its testing of the operating effectiveness of this control the firm excluded certain loans from its testing population. (AS 2201.44)

The issuer assigned a risk rating to each of its commercial loans. The loan risk rating was an important input in estimating the ACL for commercial loans collectively assessed for impairment. The firm selected for testing a control that consisted of the issuer's review for a sample of loans of the loan risk ratings assigned to certain commercial loans. The firm did not evaluate (1) the criteria the control owners used to select loans for review and (2) whether the sample of loans that were reviewed was sufficient to address the risks of material misstatement presented by the different risk characteristics inherent in the population of these loans. (AS 2201.42)

With respect to the allowance for loan losses (ALL) at one of the issuer's subsidiaries: The firm selected for testing a control that consisted of the issuer's review of the ALL. The firm did not identify and test any controls over the completeness of a manually prepared spreadsheet that was used in the operation of this control. (AS 2201.39)

The issuer used service organizations to host and/or maintain and manage various information technology (IT) systems that the issuer used to initiate process and record transactions related to the ALL and Investment Securities. The following deficiencies were identified: · The firm did not perform procedures beyond inquiring of management and reading certain related documentation to test that controls over program changes access to programs and computer operations were designed and operating effectively. (AS 2201.42 and .44)

The issuer used service organizations to host and/or maintain and manage various information technology (IT) systems that the issuer used to initiate process and record transactions related to the ALL and Investment Securities. The following deficiencies were identified: · The firm did not perform any procedures to evaluate whether the appropriate complementary user entity controls were implemented and operating effectively in order to achieve the control objectives stated in the service organizations' control reports. (AS 2201.B22)

Loan risk ratings were an important input in estimating the issuer's ALL. The firm selected for testing a control designed to validate loan risk ratings assigned by the issuer to certain categories of its loans. The issuer used internal loan reviewers (ILRs) and an external loan reviewer (ELR) in the operation of this control. The following deficiencies were identified: · The ELR reviewed loan risk ratings at an interim date. The firm did not identify and test any controls over the loans that were subject to review by the ELR from the interim date to the issuer's year end. (AS 2201.39)

Loan risk ratings were an important input in estimating the issuer's ALL. The firm selected for testing a control designed to validate loan risk ratings assigned by the issuer to certain categories of its loans. The issuer used internal loan reviewers (ILRs) and an external loan reviewer (ELR) in the operation of this control. The following deficiencies were identified: · The firm did not identify and test any controls over the reasonableness of loan risk ratings for loans that were not subject to this control. (AS 2201.39)

The firm identified deficiencies in certain of the issuer's other controls over the ALL it had selected for testing and concluded that these deficiencies in the aggregate represented a significant deficiency. The firm did not sufficiently evaluate whether the identified control deficiencies represented a material weakness because the firm did not evaluate the magnitude of the potential misstatements resulting from these control deficiencies. (AS 2201.62)

Loan risk grades were an important input in estimating the issuer's ALL. The firm selected for testing a control designed to validate loan risk grades assigned by the issuer to certain categories of loans. The control included the review of loan risk grades by the issuer's external loan reviewer (ELR). The following deficiencies were identified: · The ELR reviewed loan risk grades as of an interim date. The firm did not identify and test any controls over the loans that were subject to review by the ELR from the interim date to the issuer's year end. (AS 2201.39)

Loan risk grades were an important input in estimating the issuer's ALL. The firm selected for testing a control designed to validate loan risk grades assigned by the issuer to certain categories of loans. The control included the review of loan risk grades by the issuer's external loan reviewer (ELR). The following deficiencies were identified: · The firm did not identify and test any controls over the reasonableness of loan risk grades for loans that were not subject to this control. (AS 2201.39)

The issuer's ALL included loans individually evaluated for impairment. The firm did not identify and test any controls over the reasonableness of the fair value of the collateral used in the loan impairment calculation for certain individually evaluated loans. (AS 2201.39)

The issuer developed the ACL for loans collectively evaluated for impairment using various models that were maintained by a service organization. The firm obtained a service auditor's report for this service organization. The following deficiency was identified: • The firm did not identify and test any controls over the appropriateness of certain models that were not addressed by this service auditor's report. (AS 2201.39)

The issuer developed the ACL for loans collectively evaluated for impairment using various models that were maintained by a service organization. The firm obtained a service auditor's report for this service organization. The following deficiency was identified: • The firm identified certain complementary user controls related to the issuer's validation and review of the outputs of the service organization's models that the service auditor's report described as necessary. The firm selected for testing a control to address the complementary user controls but did not identify that this control was not designed to satisfy the control objectives of the complementary user controls. (AS 2201.42 and .B22)

The firm did not identify and test any or test aspects of controls over the accuracy and/or completeness of the loan delinquency data and certain other loan data that the issuer used in the operation of controls over the ACL the firm selected for testing. (AS 2201.39)

The firm selected for testing a control that consisted of the issuer's review of certain loans based on risk indicators including an identification of problem loans which operated during the first seven months of the year. The firm did not identify and test any controls over the issuer's review of loans for the last five months of the year. (AS 2201.39)

The issuer estimated the general reserve component of the ALL using the following significant assumptions: (1) loan segmentation (2) probability of default (“PD”) (3) loss given default (“LGD”) and (4) loan risk ratings (“LRR”). The issuer used a model to derive the PD and LGD assumptions using current and historical loan data (“loan data”) contained in two data warehouses. The following deficiencies were identified: · The firm did not identify and test any controls over the accuracy of the loan data contained in the two data warehouses. (AS 2201.39)

The issuer estimated the general reserve component of the ALL using the following significant assumptions: (1) loan segmentation (2) probability of default (“PD”) (3) loss given default (“LGD”) and (4) loan risk ratings (“LRR”). The issuer used a model to derive the PD and LGD assumptions using current and historical loan data (“loan data”) contained in two data warehouses. The following deficiencies were identified: · In addition the firm did not test the aspect of this control that addressed the appropriateness of the time frame established for the control for requiring updates to the LRRs. (AS 2201.42 and .44)

The issuer developed the qualitative component of the general reserve of the ALL by assigning risk-rating factors which it weighted using certain judgmental assumptions to qualitative considerations such as delinquency trends economic and business conditions and other external factors used in its calculation. The following deficiencies were identified: · With respect to controls over the qualitative component of the general reserve the firm selected for testing controls that consisted of reviews of trends in various qualitative considerations the issuer used to determine the risk-rating factors. The firm did not identify and test any controls that addressed the appropriateness of the risk-rating factors and weightings that were assigned to each of the qualitative considerations. (AS 2201.39)

With respect to the ALL for loans that the issuer assessed collectively for impairment: The firm selected for testing a control that consisted of the issuer's review of the assigned loan grades which included a review by senior management of the assigned loan grades for certain loans. The loan grades were an important factor in estimating this ALL. The firm did not perform procedures to test the aspect of the control related to senior management's review of the assigned loan grades beyond inspecting loan files for sign-off as evidence of review. (AS 2201.42 and .44)

With respect to the ALL for loans that the issuer assessed individually for impairment: The firm selected for testing a control that consisted of the issuer's review of appraisals used to determine the fair value of the underlying collateral for collateral-dependent loans that it had determined to be individually impaired. The firm used only the work of the issuer's internal audit as evidence of the operating effectiveness of the control. This approach did not provide sufficient appropriate audit evidence that the control was operating as designed because of the amount of subjectivity involved in reviewing the appraised collateral values. (AS 2201.19; AS 2605.20 and .21)

The issuer developed the quantitative reserve component of the ACL using a model that was maintained by a service organization. The following deficiencies were identified: · The firm obtained a service auditor's report but did not evaluate whether this auditor's report provided sufficient appropriate audit evidence because the firm did not assess certain controls that the service auditor tested and how those controls related to the issuer's controls over the quantitative component of the ACL. (AS 2201.B21)

The issuer developed the quantitative reserve component of the ACL using a model that was maintained by a service organization. The following deficiencies were identified: · The firm did not identify and test any controls over the issuer's ongoing assessment and monitoring of the predictability and effectiveness of this ACL model. (AS 2201.39)

The firm selected for testing a control that consisted of the control owner's reperformance of certain ACL calculations. The number of instances that the firm selected for testing this control did not provide sufficient appropriate audit evidence given the frequency with which this control operated. (AS 2201.46)

The issuer used loan risk ratings to estimate its ACL. The firm did not identify and test any controls that addressed the reasonableness of loan risk ratings. (AS 2201.39)

The issuer monitored loan delinquency and used that information to identify potential problem loans for impairment evaluation. The firm did not identify and test any controls over the identification and classification of past due loans within the issuer's loan system. (AS 2201.39)

The issuer reported an ACL that included both a quantitative and qualitative component. The issuer used certain qualitative factors including assigned loan risk grades to determine the qualitative component of the ACL. The following deficiency was identified: · The firm selected for testing a control that consisted of the issuer's review of loans including a review of the reasonableness of assigned loan risk grades. This control included a determination of which loans would be subject to a review of the assigned loan risk grades. The firm did not assess the effect of the issuer excluding certain loans from review of the assigned loan risk grades on the control's ability to effectively prevent or detect a material misstatement. (AS 2201.42)

The issuer used loan risk ratings to estimate its ACL. The firm did not identify and test any controls over the reasonableness of loan risk ratings. (AS 2201.39)

The issuer assigned each loan a loan risk rating which was an important input in estimating the quantitative component of the ACL. The firm selected for testing a control that included the issuer's reviews of loan risk ratings and tested the control at an interim date. The firm did not perform procedures to update the results of its testing from the interim date to year end. (AS 2201.55)

For loans that were collectively evaluated for impairment the issuer determined the qualitative reserve component of the ACL using certain qualitative factors. The firm's approach for substantively testing the qualitative component of the ACL was to test the issuer's process. The following deficiencies were identified: · The firm tested one of the issuer's controls over the determination of the ACL during an interim period. The firm did not perform procedures to update the results of its testing from the interim date to year end. (AS 2201.55)

The firm did not identify and test any controls over the determination of the risk ratings for the remaining loans that were not subject to the review controls discussed above. (AS 2201.39)

The issuer used loan charge-offs as inputs to the determination of the general reserve component of the ALL. The firm did not identify and test any controls over loan charge-offs for one type of these consumer loans. (AS 2201.39)

For loans that the issuer assessed collectively for impairment the issuer estimated the ALL using a model that included various loan data as inputs into the model. The issuer's independent loan review group identified numerous discrepancies in the loan data subject to its review during the year and reported these discrepancies to the issuer's ALL committee. The firm did not identify and test any controls that addressed the issuer's evaluation and resolution of these discrepancies. (AS 2201.39)

The firm selected for testing controls that consisted of the (1) review and validation at least annually of all models and (2) quarterly review of back testing results using historical loan information to assess the performance of certain models. The firm did not sufficiently test the first control because the firm's sample primarily consisted of models that the issuer had validated in the prior year which did not provide sufficient appropriate audit evidence as of the date of management's assessment of the effectiveness of the issuer's ICFR due to the (1) length of time that had passed between the instances of the control the firm tested and the date of management's assessment (2) higher risk associated with the control and (3) sensitivity and complexity of the models covered by the control. (AS 2201.46 and .52)

In determining whether the control deficiency represented a material weakness the firm did not sufficiently evaluate the magnitude of the potential misstatements because it did not consider the potential effects on the calculated ACL related to the deficiency described above. (AS 2201.62)

For loans that were collectively evaluated for impairment the issuer estimated the ALL using models and methodologies based on assumptions judgment and other data and applying certain post-model adjustments. The issuer determined post-model adjustments by comparing the model to a benchmark and/or considering data for each loan portfolio. The following deficiencies were identified: - The firm selected for testing another control that consisted of the issuer's annual review of the appropriateness of the assumptions used in the model for each loan portfolio. The firm did not identify that this control was not designed to allow the issuer to evaluate whether certain factors would have an effect on the issuer's models due to the frequency and timing in which this control operated. (AS 2201.42)

The issuer used a service organization to estimate the quantitative component of the ACL. The firm obtained a service auditor's report and identified a complementary user control that the service auditor's report described as necessary. The firm did not perform any procedures to evaluate whether the issuer had implemented this control. (AS 2201.39 and .B22)

The issuer used an internally developed model to estimate the quantitative component of the ACL for loans collectively evaluated for impairment. The following deficiencies were identified: · The firm selected for testing a control that consisted of the issuer's annual validation of this model as of an interim date. The firm did not evaluate whether this control's operation six months prior to year end was sufficient to address the risks of material misstatement at year end. (AS 2201.42)

The issuer reported loans receivable at two business units. The firm excluded from the scope of its audits the ACL related to one of these business units but did not evaluate whether the risks of material misstatement that the firm associated with the ACL subject to audit procedures also applied to the excluded ACL. (AS 2101.11 and .12; AS 2201.B10)

With respect to the ACL subject to audit procedures: · The firm identified and tested controls that consisted of the issuer's review of the quantitative component of the ACL but did not identify and test any controls over certain inputs the control owners used in the operation of those controls. (AS 2201.39)

With respect to the ACL subject to audit procedures: · The firm did not identify and test any controls over the qualitative component of the ACL. (AS 2201.39)