Explorer

The firm selected for testing controls over the review of non-accrual loans and loans identified as troubled debt restructurings. The firm did not identify and test any controls over the accuracy and completeness of the reports that the control owners reviewed in the performance of these controls. (AS 2201.39)

The firm selected for testing a control that included a review of all loans to determine whether they should be put on non-accrual status. The firm did not identify and test any controls over the accuracy and completeness of a report used in the operation of this control. (AS 2201.39)

The issuer's ALLL included a reserve for loans collectively evaluated for impairment. This reserve included a component that was determined by using certain qualitative factors. The following deficiencies were identified: - The firm selected for testing controls that consisted of the issuer's reviews of the ALLL. The firm did not identify and test any controls over the accuracy and completeness of certain data and/or reports used in the operation of these controls. (AS 2201.39)

The issuer used a service organization to host maintain and manage the information technology (IT) system that the issuer used to initiate process and record transactions related to the ALL. The firm did not identify and test any complementary user entity controls to place reliance on or identify and test any other controls over the accuracy and completeness of data from the service organization that was used in the operation of controls. (AS 2201.39 and .B22)

The firm did not identify and test any controls over the accuracy and completeness of information the control owner obtained from other information systems and used in the operation of certain controls. (AS 2201.39)

The engagement team did not perform any substantive procedures to test or as discussed above sufficiently test controls over the accuracy and completeness of reports from the issuer's systems that the firm used as audit evidence in its substantive procedures. (AS 1105.10)

The issuer used a service organization to process and record transactions related to loans and for information it used to determine the ALL. In addition the issuer used data and reports from this service organization in the operation of certain controls the firm selected for testing. The firm did not evaluate whether the service auditor's report provided sufficient evidence because the firm did not assess the scope of the examination and applications covered the controls tested the way in which the tested controls related to the issuer's controls and the results for those tests of controls. (AS 2201.B21)

The issuer assigned loan grades to certain of its loans. The loan grades were an important input in determining whether a loan would be individually evaluated for impairment or considered as part of the general reserve. The following deficiencies were identified: · The firm selected for testing a control that consisted of the review of assigned loan grades for loans not subject to the ELR control discussed above. The firm did not test the aspect of this control that addressed the accuracy and completeness of the reports used in the operation of this control. (AS 2201.42 and 44)

The issuer determined the qualitative reserve component of the ACL using various qualitative factors. The following deficiencies were identified: · The firm selected for testing a control that included the issuer's reviews of these qualitative factors. The firm did not identify and test any controls over the accuracy and completeness of certain loan information that the control owners used in the operation of this control. (AS 2201.39)

The issuer assigned each loan a loan risk rating which was an important input in estimating the quantitative component of the ACL. The firm selected for testing a control that included the issuer's review of the risk ratings for certain loans. For this control and two other controls the firm selected for testing over the ACL the firm did not identify and test any controls over the accuracy and completeness of certain loan information used in the operation of these controls. (AS 2201.39)

The issuer assigned a risk rating to each of its commercial loans. The loan risk rating was an important input in estimating the ACL for commercial loans collectively assessed for impairment. The firm selected for testing a control that consisted of the issuer's review for a sample of loans of the loan risk ratings assigned to certain commercial loans. The firm did not identify and test any controls over the accuracy and completeness of certain loan information that the control owners used to select loans for review. (AS 2201.39)

The firm did not perform any substantive procedures to test or in the alternative test any controls over the accuracy and/or completeness of certain data and reports the firm used in its substantive testing of the ALL. (AS 1105.10)

Loan risk ratings were an important input in estimating the issuer's ALL. The firm selected for testing a control designed to validate loan risk ratings assigned by the issuer to certain categories of its loans. The issuer used internal loan reviewers (ILRs) and an external loan reviewer (ELR) in the operation of this control. The following deficiencies were identified: · The firm did not identify and test any controls over the accuracy and completeness of data the ILRs and ELR used in the performance of this control. (AS 2201.39)

On a periodic basis the issuer evaluates potential problem loans. The firm selected for testing a control that included the review of potential problem loans. The following deficiencies were identified: · The firm did not identify and test any controls over the accuracy and completeness of reports used by the control owners. (AS 2201.39)

The issuer developed the ACL for loans collectively evaluated for impairment using various models that were maintained by a service organization. The firm obtained a service auditor's report for this service organization. The following deficiency was identified: • The firm selected for testing a control that consisted of the issuer's review of the ACL. The firm did not identify and test any controls over the accuracy and completeness of a report produced by the service organization that was used in the operation of this control. (AS 2201.39)

The issuer's general reserve component of the ALL included a qualitative reserve that included two components based on qualitative adjustments. The firm's approach for substantively testing the ALL was to test the issuer's process. The firm did not perform any substantive procedures to test or in the alternative test any controls over the accuracy and completeness of certain internal data used in the calculation. (AS 1105.10)

The issuer used information from a service organization in developing its estimate of the ACL. The firm selected for testing certain controls that used data and reports from the service organization. The firm did not (1) perform any procedures to obtain evidence regarding the service organization's controls for the year under audit or (2) identify and test any other controls over the accuracy and completeness of the data and reports used in the performance of these controls. (AS 2201.39 and .B19)

The firm used certain of these data and reports in its substantive testing of the ACL but did not test or identify and test any controls over (as discussed above) the accuracy and/or completeness of these data and reports. (AS 2301.08 and .11)

The issuer's ALL included a general reserve which consisted primarily of a qualitative component. The firm's approach for substantively testing the ALL was to review and test management's process. The following deficiencies were identified: - The firm did not perform any procedures to test or in the alternative test any controls over the accuracy and completeness of certain historical loss information generated from the issuer's system and used to develop a portion of the qualitative reserve. (AS 1105.10)

The issuer assigned a risk rating to each loan. The loan risk ratings were an important input in estimating the ALL. The firm's approach for substantively testing the ALL was to review and test management's process. The firm did not sufficiently evaluate the appropriateness of the loan risk ratings because its procedures were limited to testing the risk ratings for a selection of loans originated in the current year and comparing loan risk ratings used in the ALL calculation for certain loans to issuer-prepared reports. (AS 2501.09 .10 and .11)

The firm selected for testing two controls over the issuer's determination of the ACL. The issuer used certain system-generated reports that it obtained from an application that was hosted by a service organization in the performance of these controls. The firm obtained the service auditor's report for this service organization and identified certain complementary user controls related to user access that the service auditor's report described as necessary. The firm identified control deficiencies in its testing of these complementary user controls and selected for testing a compensating control that consisted of the issuer's review of user access. The firm did not identify and test any controls over the accuracy and completeness of the user population used in the operation of this compensating control. (AS 2201.68)

The firm did not identify and test any controls over the accuracy and completeness of certain data that the control owners used in the operation of the control. (AS 2201.39)

The firm selected for testing a control that consisted of the issuer's review of the appropriateness of the ACL but did not test the aspect of the control that addressed the accuracy and completeness of information that was included in an issuer-prepared memorandum that the control owners used in the operation of this control. (AS 2201.42 and .44)

As part of the issuer's overall credit risk assessment for corporate loans collectively evaluated for impairment the issuer determined a loan risk rating for each loan based on loan information for each borrower including a borrower risk rating. The following deficiencies were identified: · The firm selected for testing controls that consisted of the independent reviews of the assigned loan risk ratings for corporate loans that met certain criteria. The firm did not identify and test any controls over the accuracy and completeness of the loan information that the control owners used to evaluate the assigned loan risk ratings. (AS 2201.39)

As part of the issuer's overall credit risk assessment for corporate loans collectively evaluated for impairment the issuer determined a loan risk rating for each loan based on loan information for each borrower including a borrower risk rating. The following deficiencies were identified: · The firm used this loan information in certain of its substantive procedures to evaluate the appropriateness of the issuer's loan risk ratings for these loans. The firm did not test or (as discussed above) test controls over the accuracy and completeness of this information. (AS 2501.11)

The firm selected for testing controls that consisted of the (1) review and validation at least annually of all models and (2) quarterly review of back testing results using historical loan information to assess the performance of certain models. For the second control the firm did not identify and test any controls over the accuracy and completeness of the historical loan information used in the operation of that control. (AS 2201.39)

The firm selected for testing two controls that included the issuer's validation of certain models that the issuer used to estimate the quantitative component of the ALL for loans collectively evaluated for impairment. The firm did not test the aspects of these controls related to the issuer's (1) evaluation of the mathematical logic of the models; (2) verification of the accuracy and completeness of certain data used in the operation of the controls and (3) tests of the models that included sensitivity analyses and benchmark comparisons to other models. (AS 2201.42 and .44)

For certain loans the quantitative and qualitative components of the issuer's ACL were calculated using models that relied upon certain current and historical loan data and forecasted macroeconomic scenarios. The following deficiencies were identified: · The issuer compiled the forecasted macroeconomic scenarios it developed into a spreadsheet and distributed the spreadsheet to various users who had access to make changes to the data in the spreadsheet. The firm did not identify and test any controls over the accuracy and completeness of any changes made by users to the data in the spreadsheet. (AS 2201.39)

For certain loans the quantitative and qualitative components of the issuer's ACL were calculated using models that relied upon certain current and historical loan data and forecasted macroeconomic scenarios. The following deficiencies were identified: · The firm identified and tested controls that consisted of the control owner's recalculation of the qualitative ACL for certain loans. The firm did not identify and test any controls over the accuracy and completeness of the forecasted macroeconomic scenarios used in the control owner's recalculation. (AS 2201.39)

For certain loans the quantitative and qualitative components of the issuer's ACL were calculated using models that relied upon certain current and historical loan data and forecasted macroeconomic scenarios. The following deficiencies were identified: · The firm identified and tested a control that consisted of the issuer's review of its ability to forecast the quantitative component of the issuer's ACL. The firm did not test the aspect of this control that addressed the accuracy and completeness of certain historical loan data and macroeconomic scenarios used in the operation of this control. (AS 2201.42 and .44)

The firm identified a control deficiency related to the accuracy and completeness of loan information entered into the issuer's loan systems at origination and that was used in the estimation of the ACL for certain loans. The firm identified and tested three compensating controls that it believed mitigated this deficiency. The firm did not identify that the control owners used loan information in the performance of these compensating controls that was produced by the loan systems that were subject to the control deficiency. (AS 2201.68)

For loans that were collectively evaluated for impairment the issuer estimated the ALL using models and methodologies based on assumptions judgment and other data and applying certain post-model adjustments. The issuer determined post-model adjustments by comparing the model to a benchmark and/or considering data for each loan portfolio. The following deficiencies were identified: - The firm selected for testing a control that consisted of the issuer's review of the post-model adjustments for each loan portfolio. The firm did not identify and test any controls over the (1) methods and assumptions used by the issuer to determine the benchmarks used in the operation of this control and (2) accuracy and completeness of certain data used in the operation of this control. (AS 2201.39)

The firm selected for testing a control that consisted of the issuer's review of certain assumptions used to estimate the quantitative component of the allowance for credit losses (ACL) but did not identify and test any controls over the accuracy and completeness of an issuer-prepared analysis that the control owners used in the operation of this control. (AS 2201.39)

The firm identified and tested a control that consisted of the issuer's review of the allowance for credit losses (ACL) including a comparison of certain metrics between the issuer and its peers. The firm did not test the aspects of this control that addressed the accuracy and completeness of the peer information that the control owner used in the operation of this control. (AS 2201.42 and .44)

During the year the issuer completed a business combination where the issuer's operations from before the transaction remained on the issuer's existing information systems (“legacy systems”) and continued to be recorded in these systems separately from the other company's operations. The firm used certain loan data from the legacy systems in its testing of the ACL but did not perform any procedures to test or test any controls over the accuracy and completeness of these data. (AS 1105.10)

The issuer used various qualitative factors to determine the qualitative component of the ALL. The firm's approach for testing the qualitative reserve was to test the issuer's process. The following deficiencies were identified: · The firm did not perform sufficient procedures to test or identify and test any controls over the accuracy and completeness of issuer-produced information that the issuer used to develop the significant assumptions related to the qualitative factors because it limited its procedures to inquiries and performing certain recalculations and comparisons of certain of the information to other issuer-prepared information. (AS 1105.10)

The issuer's ALL also included a specific reserve for impaired loans. The issuer engaged external specialists to determine the fair value of certain property that served as collateral for certain impaired loans. The firm's approach for substantively testing the specific reserve was to develop an independent expectation of the specific reserve that included use of the work of the company's specialists as audit evidence. The following deficiencies were identified: · The firm did not test the accuracy and completeness of issuer-produced information and evaluate the relevance and reliability of external information used by the company's specialists to determine the fair value of the properties used as collateral. (AS 1105.A8a)

The issuer used an information-technology (IT) system to initiate process and record loan-related transactions. The firm did not perform any procedures to test the accuracy and completeness of the data that it used to test controls related to user access and change management over this IT system. (AS 1105.10)

The issuer's ACL was comprised of various components including quantitative and complementary reserve components and the issuer used various models and assumptions to determine the individual components of the ACL. The firm's approach for substantively testing the ACL was to test the issuer's process. The following deficiency was identified: · The firm selected for testing a control that consisted of management's monitoring of customers' financial condition through the use of a color-coded monitoring system to identify economic groups that experienced a decline in credit quality. The firm did not identify and test any controls over the accuracy and completeness of the data used in the operation of this control. (AS 2201.39)

As part of the issuer's overall credit risk assessment for commercial loans collectively evaluated for impairment the issuer determined loan grades for each loan. These loan grades were an important factor in estimating the ALL for commercial loans. The following deficiencies were identified: · The issuer determined loan grades using loan scorecards that were prepared for each borrower. The firm selected for testing a control that consisted of the monthly review of a sample of loan scorecards to evaluate the accuracy and completeness of the loan information and numerous other key inputs. The firm did not test the review procedures the control owner performed to evaluate numerous inputs to the scorecard that were important in determining the loan grade. (AS 2201.42 and .44)

As part of the issuer's overall credit risk assessment for commercial loans collectively evaluated for impairment the issuer determined loan grades for each loan. These loan grades were an important factor in estimating the ALL for commercial loans. The following deficiencies were identified: · The firm used the loan scorecards in its substantive testing of the appropriateness of the assigned loan grades for commercial loans. The firm did not test or (as discussed above) sufficiently test controls over the accuracy and completeness of the loan information and other key inputs included in these scorecards. (AS 2501.11)

The firm selected for testing a control that consisted of a review of past-due loans performed by the issuer to determine whether these loans would be individually or collectively evaluated for impairment. The firm did not identify and test any controls over the accuracy and completeness of a report that was used in the operation of this control. (AS 2201.39)

The issuer used various internally and externally developed models to estimate the quantitative component of the ACL for loans collectively evaluated for impairment. These models used various data and assumptions. The following deficiencies were identified: · The firm selected for testing controls that consisted of the issuer's reviews of the operation of these models and the underlying inputs and assumptions. The firm did not identify and test any controls over the accuracy and completeness of the data that the control owners used in the operation of these controls. (AS 2201.39)

The issuer used various internally and externally developed models to estimate the quantitative component of the ACL for loans collectively evaluated for impairment. These models used various data and assumptions. The following deficiencies were identified: · The firm's approach for substantively testing the quantitative component of the ACL for loans collectively evaluated for impairment was to test the issuer's process and the firm used an auditor-employed specialist to evaluate certain significant assumptions the issuer used including the underlying models and assumptions. The firm did not sufficiently evaluate the reasonableness of these significant assumptions because it did not identify that the specialist's procedures were limited to inquiring of management and reading issuer-prepared reports and analyses. (AS 1201.C6 and .C7; AS 2501.16)

The issuer's ALL included a reserve for loans individually evaluated for impairment ('specific reserve') and a reserve for loans collectively evaluated for impairment ('collective reserve'). The issuer's collective reserve included a component that was determined by using certain qualitative factors ('qualitative component'). The following deficiencies were identified: · The firm selected for testing controls that consisted of the issuer's reviews of the ALL including the collective reserve. The firm did not identify and test any controls over the accuracy and completeness of certain data and/or reports used in the operation of these controls. (AS 2201.39)

The issuer's ALL included a reserve for loans individually evaluated for impairment ('specific reserve') and a reserve for loans collectively evaluated for impairment ('collective reserve'). The issuer's collective reserve included a component that was determined by using certain qualitative factors ('qualitative component'). The following deficiencies were identified: · The firm selected for testing controls that consisted of the issuer's reviews of its loan portfolio to identify potentially impaired loans for the specific reserve. The firm did not identify and test any controls over the accuracy and completeness of certain data and/or reports used in the operation of these controls. (AS 2201.39)

The firm's internal inspection program had inspected this audit and reviewed this area but did not identify the deficiencies below. The firm's approach to test ACL was to test management's process. The issuer engaged a specialist to prepare a model validation report over the issuer's model to estimate the quantitative component of the ACL. The firm did not test or test controls over the accuracy and completeness of the company-produced data used by the company's specialist in its model validation report. (AS 1105.A8a)

The issuer engaged valuation specialists to determine the fair value of the collateral for impaired loans. The following deficiency was identified: · The firm did not test the accuracy and completeness of certain issuer-produced data used by the company's specialists. (AS 1105.A8a)

The issuer's general reserve component of the ALL included a qualitative reserve component. In determining the qualitative reserve component the issuer used loan risk grades and basis point adjustments for qualitative factors. The following deficiencies were identified: - The firm did not identify and test any controls over the accuracy of a system-generated report used in the operation of a control. (AS 2201.39)