Explorer

During the year the issuer completed a business combination where the issuer's operations from before the transaction remained on the issuer's existing information systems (“legacy systems”) and continued to be recorded in these systems separately from the other company's operations. The issuer assigned certain loans a loan risk rating which was an important input in estimating the quantitative component of the ACL. The firm selected for testing a control that consisted of the issuer's review for a sample of loans of the loan risk ratings assigned to certain types of loans. The firm did not evaluate the criteria the control owners used to select loans for review. (AS 2201.42)

The firm selected for testing controls that consisted of the issuer's validation of the models it used to estimate the quantitative component of the ACL for loans and leases collectively evaluated for impairment. The issuer's validation included a comparison of the modeled results to the actual results that identified two types of errors and by design assessed one of these types of errors. In evaluating the design of these controls the firm did not evaluate the effect of the issuer not assessing one type of error on the controls' ability to effectively prevent or detect a material misstatement. (AS 2201.42)

The issuer developed the qualitative component of the general reserve of the ALL by applying certain qualitative factors to each of its classes of loans. The following deficiencies were identified: · The firm selected for testing a control that consisted of the issuer's review of the ALL including the development and review of the qualitative factors. In evaluating the design of this control the firm did not assess the effect of the same individuals both developing and reviewing the qualitative factors. (AS 2201.42)

The issuer used models to determine the general reserve component of the ALL for commercial loans collectively evaluated for impairment. These models used various data including a loan risk rating for each loan that were derived from the issuer's data warehouse system. The loan risk rating was an important input in estimating the ALL and determining whether a loan would be individually or collectively evaluated for impairment. The following deficiencies were identified: · The firm used only the work of the issuer's internal audit as evidence about the effectiveness of certain controls related to the issuer's reviews of the loan risk ratings. This approach did not provide sufficient appropriate audit evidence that these controls were designed and operating effectively because of the amount of subjectivity and judgment involved in evaluating the appropriateness of the loan risk ratings and determining any changes to these ratings. (AS 2201.19; AS 2605.20 and .21)

The issuer used models to determine the general reserve component of the ALL for commercial loans collectively evaluated for impairment. These models used various data including a loan risk rating for each loan that were derived from the issuer's data warehouse system. The loan risk rating was an important input in estimating the ALL and determining whether a loan would be individually or collectively evaluated for impairment. The following deficiencies were identified: · The issuer identified a deficiency related to one of the loan risk-rating controls discussed above. The firm identified and tested certain controls that it believed would mitigate this deficiency. The firm did not identify that these compensating controls did not address the risks of material misstatement related to inappropriate loan risk ratings. (AS 2201.68)

The issuer used models to determine the general reserve component of the ALL for commercial loans collectively evaluated for impairment. These models used various data including a loan risk rating for each loan that were derived from the issuer's data warehouse system. The loan risk rating was an important input in estimating the ALL and determining whether a loan would be individually or collectively evaluated for impairment. The following deficiencies were identified: · The firm did not identify and test any controls over the accuracy of the transfer of the loan risk ratings from the issuer's source systems to the data warehouse system or test other controls that would have provided evidence over the accuracy of the loan risk ratings in the data warehouse system. (AS 2201.39)

The issuer assigned a risk rating to each commercial loan. The loan risk rating was an important input in estimating the ACL for commercial loans collectively assessed for impairment. The following deficiencies were identified: · The firm identified a deficiency related to a control that consisted of the issuer's periodic review of loan risk ratings assigned to certain commercial loans. The firm tested various controls that it believed would compensate for this deficiency but did not identify that these controls did not address whether the risk ratings were reviewed and updated timely. (AS 2201.68)

The firm did not identify and test any controls over the issuer's ACL for certain loans. (AS 2201.39)

The firm concluded that a control over the loan officers' annual credit review (“ACR”) of the reasonableness of assigned loan grades was deficient because certain of the ACRs were not completed as of the end of the year for commercial loan relationships. The firm concluded that it represented a significant deficiency after determining the percentage of noncompliance of ACRs and identifying and testing two compensating controls that consisted of a credit monitoring (“CM”) control and an independent loan review over certain commercial loan relationships. The firm did not sufficiently evaluate the severity of the control deficiency due to the following: · The firm used the work of internal audit (“IA”) to test the CM control. The firm did not evaluate IA's identification of several instances in which borrower financial information obtained for use in the CM control was not analyzed by the control owners. (AS 2201.68)

The firm concluded that a control over the loan officers' annual credit review (“ACR”) of the reasonableness of assigned loan grades was deficient because certain of the ACRs were not completed as of the end of the year for commercial loan relationships. The firm concluded that it represented a significant deficiency after determining the percentage of noncompliance of ACRs and identifying and testing two compensating controls that consisted of a credit monitoring (“CM”) control and an independent loan review over certain commercial loan relationships. The firm did not sufficiently evaluate the severity of the control deficiency due to the following: · The firm selected loan relationships which had ACRs and independently tested the CM control. The firm did not perform procedures to determine whether the CM control operated for the selected loans after the ACRs were performed which would be the only way this compensating control could have mitigated the ACR deficiency identified. (AS 2201.68)

The firm concluded that a control over the loan officers' annual credit review (“ACR”) of the reasonableness of assigned loan grades was deficient because certain of the ACRs were not completed as of the end of the year for commercial loan relationships. The firm concluded that it represented a significant deficiency after determining the percentage of noncompliance of ACRs and identifying and testing two compensating controls that consisted of a credit monitoring (“CM”) control and an independent loan review over certain commercial loan relationships. The firm did not sufficiently evaluate the severity of the control deficiency due to the following: · The firm did not test whether the CM control operated effectively over the population of loans for which a required ACR was not performed. (AS 2201.68)

The firm selected for testing a control that the issuer intended to be an objective review of assigned loan grades. The firm concluded that this control was deficient because the control owners were not independent of the department responsible for assigning the loan grades. The firm identified other controls over the review of assigned loan grades that it believed would compensate for this control deficiency. The firm did not identify that the control owners for these controls also were not independent of the department responsible for assigning the loan grades. (AS 2201.68)

The issuer used various internally and externally developed models to estimate the quantitative component of the ACL for loans collectively evaluated for impairment. These models used various data and assumptions. The following deficiencies were identified: · The firm did not identify and test any controls over the issuer's validation of certain of these models. (AS 2201.39)

The issuer used certain data to determine the quantitative component of the ACL. The firm did not identify and test any controls over the accuracy and/or completeness of this data. (AS 2201.39) In addition the firm used this data to substantively test the ACL. The firm did not perform any procedures to test or (as discussed above) identify and test any controls over the accuracy of this data. (AS 2301.08)

The issuer's general reserve component of the ALL included a qualitative reserve component. In determining the qualitative reserve component the issuer used loan risk grades and basis point adjustments for qualitative factors. The following deficiencies were identified: - The firm identified and tested a control over the review of loan risk grades for loans that met certain criteria. The firm did not identify and test any controls over the review of loan risk grades for loans that did not meet the criteria. (AS 2201.39)