Explorer

For loans that the issuer assessed collectively for impairment the issuer estimated the ALL using a model that included loan charge-offs as inputs; these charge-offs were determined based in part on the fair value of the underlying assets. The following deficiencies were identified: · The firm selected for testing a control that consisted of the issuer's reviews of the fair values of the underlying assets. The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

For loans that the issuer assessed collectively for impairment the issuer estimated the ALL using a model that included loan charge-offs as inputs; these charge-offs were determined based in part on the fair value of the underlying assets. The following deficiencies were identified: · The firm's approach for substantively testing the ALL was to review and test management's process. The firm did not sufficiently evaluate the reasonableness of the ALL because the firm did not test certain information that the issuer used to determine the fair value of the underlying assets. (AS 2501.09 .10 and .11)

The firm selected for testing a control that consisted of the issuer's reviews of the ACL. The firm did not evaluate the specific review procedures that the control owners performed to assess the reasonableness of the ACL including the significant assumptions used. (AS 2201.42 and .44)

The firm did not identify and test any controls over the accuracy and completeness of certain data that the control owners used in the operation of the control. (AS 2201.39)

The firm selected for testing a control that consisted of the issuer's review of the appropriateness of the ACL but did not test the aspect of the control that addressed the accuracy and completeness of information that was included in an issuer-prepared memorandum that the control owners used in the operation of this control. (AS 2201.42 and .44)

The firm selected for testing controls that consisted of the issuer's review of (1) risk ratings assigned to certain commercial loans (2) loans that were identified as having higher risk characteristics and (3) the reasonableness of the ALL general reserve. The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The firm selected for testing controls that consisted of the issuer's review of (1) risk ratings assigned to certain commercial loans (2) loans that were identified as having higher risk characteristics and (3) the reasonableness of the ALL general reserve. With respect to the review of risk ratings control the firm did not consider the complexity of the control and the significance of the judgments made by the control owners in determining the sample size used to test this control. (AS 2201.46)

The firm did not identify and test any controls over the determination of the risk ratings for the remaining loans that were not subject to the review controls discussed above. (AS 2201.39)

The sample size the firm used in certain of its substantive procedures to test the ALL was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The issuer's general reserve of the ALL included a qualitative reserve component that was determined by applying basis points to each of the identified qualitative factors and applying the average of those rates to each loan segment. The firm did not evaluate whether the issuer had a reasonable basis for the significant assumptions related to the basis points and for its selection of assumptions from a range of potential assumptions. (AS 2501.16)

The issuer used an information-technology (IT) system to calculate the ACL. The firm selected for testing an IT-dependent management review control over the valuation of the ACL that was dependent upon (1) the effectiveness of IT general controls (ITGCs) over this system and (2) the accuracy and completeness of reports generated from this system used in the operation of the control. As a result of the deficiencies the firm's testing of this IT-dependent manual control was not sufficient. (AS 2201.46)

The issuer used an information-technology (IT) system to calculate the ACL. The firm selected for testing an IT-dependent management review control over the valuation of the ACL that was dependent upon (1) the effectiveness of IT general controls (ITGCs) over this system and (2) the accuracy and completeness of reports generated from this system used in the operation of the control. · The firm selected for testing a review control over user access. The firm did not evaluate the specific procedures that the control owners performed to determine whether the granted access continued to be appropriate. (AS 2201.42 and .44)

The issuer used an information-technology (IT) system to calculate the ACL. The firm selected for testing an IT-dependent management review control over the valuation of the ACL that was dependent upon (1) the effectiveness of IT general controls (ITGCs) over this system and (2) the accuracy and completeness of reports generated from this system used in the operation of the control. · The firm selected for testing a change management control. The firm did not test or test any controls over the completeness of the change management population used by the firm to select items for testing the change management control. (AS 1105.10)

The issuer used an information-technology (IT) system to calculate the ACL. The firm selected for testing an IT-dependent management review control over the valuation of the ACL that was dependent upon (1) the effectiveness of IT general controls (ITGCs) over this system and (2) the accuracy and completeness of reports generated from this system used in the operation of the control. · The firm did not identify and test any controls over the accuracy and completeness of the reports generated from this IT system used in the performance of the control. (AS 2201.39)

The issuer engaged a specialist to appraise the value of land that collateralized certain of the issuer's loans. The issuer applied adjustments for project percentage of completion and selling cost estimates to the appraised land value to determine the specific reserve to apply to these loans. The firm did not perform substantive procedures to test the aggregate appraisal value of the land securing the loans beyond obtaining and reading the valuation report prepared by the company's specialist. Further the firm did not perform any procedures to evaluate the work of the company's specialist. (AS 1105.A6 -.A10; AS 2501.16)

The issuer engaged a specialist to appraise the value of land that collateralized certain of the issuer's loans. The issuer applied adjustments for project percentage of completion and selling cost estimates to the appraised land value to determine the specific reserve to apply to these loans. The firm did not perform procedures to evaluate the reasonableness of the significant assumptions related to the estimates for percentages of completion for the construction projects and selling cost adjustments. (AS 2501.16)

For certain consumer loans the firm selected for testing a control that consisted of the issuer's quarterly review of its ALL assumptions and adjustments to the ALL including a review of any exceptions to the issuer's ALL methodology and whether quarterly changes to the ALL were reasonable. The firm did not evaluate certain criteria the control owners used to identify items for follow up related to the review of quarterly changes to the ALL. Further the firm did not evaluate the review procedures the control owners performed to determine whether certain items identified by the control owners for follow up were appropriately resolved. (AS 2201.42 and .44)

The issuer used loan charge-offs as inputs to the determination of the general reserve component of the ALL. The firm did not identify and test any controls over loan charge-offs for one type of these consumer loans. (AS 2201.39)

As part of the issuer's overall credit risk assessment for corporate loans collectively evaluated for impairment the issuer determined a loan risk rating for each loan based on loan information for each borrower including a borrower risk rating. The following deficiencies were identified: · The firm selected for testing controls that consisted of the independent reviews of the assigned loan risk ratings for corporate loans that met certain criteria. The firm did not identify and test any controls over the accuracy and completeness of the loan information that the control owners used to evaluate the assigned loan risk ratings. (AS 2201.39)

As part of the issuer's overall credit risk assessment for corporate loans collectively evaluated for impairment the issuer determined a loan risk rating for each loan based on loan information for each borrower including a borrower risk rating. The following deficiencies were identified: · The firm used this loan information in certain of its substantive procedures to evaluate the appropriateness of the issuer's loan risk ratings for these loans. The firm did not test or (as discussed above) test controls over the accuracy and completeness of this information. (AS 2501.11)

The firm selected for testing a control that consisted of the review of the issuer's risk assessment for graded loans. This review included the determination of which loans would be subject to an independent loan-grade review. The loan grades were an important factor in estimating the ALL. The firm did not evaluate the specific review procedures that the control owner performed to determine which loans would be subject to an independent loan-grade review. (AS 2201.42 and .44)

The issuer used a model in the valuation of the ALL that used various data including historical loan-loss data derived from the issuer's data warehouse systems. The firm did not identify and test any controls over the accuracy of the transfer of these data from the issuer's source systems to the data warehouse systems or test other controls that would have provided evidence over the accuracy of these data. (AS 2201.39)

The firm's approach for testing the ALL was to review and test management's process. The firm did not perform any substantive procedures to test or in the alternative identify and test any controls over the accuracy of the historical loan-loss data as discussed above. (AS 2501.11)

As part of the issuer's overall credit risk assessment for corporate loans collectively evaluated for impairment the issuer determined a loan risk rating for each loan based on loan information for each borrower including a borrower risk rating. The following deficiencies were identified: · The issuer used various models to determine the borrower risk ratings for certain corporate loans. The firm did not identify and test any controls over the issuer's evaluation of the appropriateness of these models. (AS 2201.39)

As part of the issuer's overall credit risk assessment for corporate loans collectively evaluated for impairment the issuer determined a loan risk rating for each loan based on loan information for each borrower including a borrower risk rating. The following deficiencies were identified: · The firm's approach for testing the ALL for these loans was to review and test management's process. The firm did not perform any procedures to test the calculations in these models. (AS 2501.11)

For loans that the issuer assessed collectively for impairment the issuer estimated the ALL using a model that included various loan data as inputs into the model. The issuer's independent loan review group identified numerous discrepancies in the loan data subject to its review during the year and reported these discrepancies to the issuer's ALL committee. The firm did not identify and test any controls that addressed the issuer's evaluation and resolution of these discrepancies. (AS 2201.39)

The sample size the firm used in certain of its substantive procedures to test the accuracy of the loan data input into the model was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiency in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

A portion of the issuer's loans had payment terms that allowed borrowers to make interest-only payments for a fixed period with the repayment of the outstanding principal balance due at a later date. The following deficiencies were identified: · The firm did not identify and test any controls that addressed the timely identification and evaluation of any indicators of deterioration in a borrower's ability to repay the principal associated with these loans. (AS 2201.39)

A portion of the issuer's loans had payment terms that allowed borrowers to make interest-only payments for a fixed period with the repayment of the outstanding principal balance due at a later date. The following deficiencies were identified: · The firm did not perform procedures to evaluate whether any impairment indicators existed for these loans beyond testing the collateral valuation for one loan. (AS 2301.08)

The firm selected for testing controls that consisted of the (1) review and validation at least annually of all models and (2) quarterly review of back testing results using historical loan information to assess the performance of certain models. The firm did not sufficiently test the first control because the firm's sample primarily consisted of models that the issuer had validated in the prior year which did not provide sufficient appropriate audit evidence as of the date of management's assessment of the effectiveness of the issuer's ICFR due to the (1) length of time that had passed between the instances of the control the firm tested and the date of management's assessment (2) higher risk associated with the control and (3) sensitivity and complexity of the models covered by the control. (AS 2201.46 and .52)

The firm selected for testing controls that consisted of the (1) review and validation at least annually of all models and (2) quarterly review of back testing results using historical loan information to assess the performance of certain models. For the second control the firm did not identify and test any controls over the accuracy and completeness of the historical loan information used in the operation of that control. (AS 2201.39)

The firm's approach for substantively testing the ALL was to review and test management's process. The firm did not sufficiently evaluate the reasonableness of the ALL because the firm did not perform procedures to test certain factors and assumptions the issuer developed in the prior year and used to determine the ALL in the current year. (AS 2501.09 .10 and .11)

The firm selected for testing two controls that included the issuer's validation of certain models that the issuer used to estimate the quantitative component of the ALL for loans collectively evaluated for impairment. The firm did not test the aspects of these controls related to the issuer's (1) evaluation of the mathematical logic of the models; (2) verification of the accuracy and completeness of certain data used in the operation of the controls and (3) tests of the models that included sensitivity analyses and benchmark comparisons to other models. (AS 2201.42 and .44)

The firm selected for testing a control that consisted of the issuer's review of the assumptions and qualitative adjustments used to estimate the ALL for loans collectively evaluated for impairment. The firm did not evaluate the specific review procedures that the control owners performed to assess the reasonableness of these assumptions and qualitative adjustments. (AS 2201.42 and .44)

For certain loans the quantitative and qualitative components of the issuer's ACL were calculated using models that relied upon certain current and historical loan data and forecasted macroeconomic scenarios. The following deficiencies were identified: · The issuer compiled the forecasted macroeconomic scenarios it developed into a spreadsheet and distributed the spreadsheet to various users who had access to make changes to the data in the spreadsheet. The firm did not identify and test any controls over the accuracy and completeness of any changes made by users to the data in the spreadsheet. (AS 2201.39)

For certain loans the quantitative and qualitative components of the issuer's ACL were calculated using models that relied upon certain current and historical loan data and forecasted macroeconomic scenarios. The following deficiencies were identified: · The firm identified and tested controls that consisted of the control owner's recalculation of the qualitative ACL for certain loans. The firm did not identify and test any controls over the accuracy and completeness of the forecasted macroeconomic scenarios used in the control owner's recalculation. (AS 2201.39)

For certain loans the quantitative and qualitative components of the issuer's ACL were calculated using models that relied upon certain current and historical loan data and forecasted macroeconomic scenarios. The following deficiencies were identified: · The firm identified and tested a control that consisted of the issuer's review of its ability to forecast the quantitative component of the issuer's ACL. The firm did not test the aspect of this control that addressed the accuracy and completeness of certain historical loan data and macroeconomic scenarios used in the operation of this control. (AS 2201.42 and .44)

The firm selected for testing a control that consisted of a committee's review of certain assumptions used to estimate the quantitative component of the ACL. The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The firm selected for testing a control that consisted of the review of the issuer's risk assessment for certain graded loans. This control included the issuer's assessment to determine which of these loans would be subject to an independent loan-grade review. The loan grades were an important factor in estimating the ACL. The firm did not identify that this control excluded certain loans from the issuer's assessment. (AS 2201.42)

The sample sizes the firm used in certain of its substantive procedures to test the ACL were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiency in the firm's loan-grading control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The firm identified a control deficiency related to the accuracy and completeness of loan information entered into the issuer's loan systems at origination and that was used in the estimation of the ACL for certain loans. The firm identified and tested three compensating controls that it believed mitigated this deficiency. The firm did not identify that the control owners used loan information in the performance of these compensating controls that was produced by the loan systems that were subject to the control deficiency. (AS 2201.68)

In determining whether the control deficiency represented a material weakness the firm did not sufficiently evaluate the magnitude of the potential misstatements because it did not consider the potential effects on the calculated ACL related to the deficiency described above. (AS 2201.62)

For loans that were collectively evaluated for impairment the issuer estimated the ALL using models and methodologies based on assumptions judgment and other data and applying certain post-model adjustments. The issuer determined post-model adjustments by comparing the model to a benchmark and/or considering data for each loan portfolio. The following deficiencies were identified: - The firm selected for testing a control that consisted of the issuer's review of the post-model adjustments for each loan portfolio. The firm did not evaluate the specific review procedures that the control owners performed to assess the appropriateness and reasonableness of certain post-model adjustments. (AS 2201.42 and .44)

For loans that were collectively evaluated for impairment the issuer estimated the ALL using models and methodologies based on assumptions judgment and other data and applying certain post-model adjustments. The issuer determined post-model adjustments by comparing the model to a benchmark and/or considering data for each loan portfolio. The following deficiencies were identified: - The firm selected for testing a control that consisted of the issuer's review of the post-model adjustments for each loan portfolio. The firm did not identify and test any controls over the (1) methods and assumptions used by the issuer to determine the benchmarks used in the operation of this control and (2) accuracy and completeness of certain data used in the operation of this control. (AS 2201.39)

For loans that were collectively evaluated for impairment the issuer estimated the ALL using models and methodologies based on assumptions judgment and other data and applying certain post-model adjustments. The issuer determined post-model adjustments by comparing the model to a benchmark and/or considering data for each loan portfolio. The following deficiencies were identified: - The firm selected for testing another control that consisted of the issuer's annual review of the appropriateness of the assumptions used in the model for each loan portfolio. The firm did not identify that this control was not designed to allow the issuer to evaluate whether certain factors would have an effect on the issuer's models due to the frequency and timing in which this control operated. (AS 2201.42)

For loans that were collectively evaluated for impairment the issuer estimated the ALL using models and methodologies based on assumptions judgment and other data and applying certain post-model adjustments. The issuer determined post-model adjustments by comparing the model to a benchmark and/or considering data for each loan portfolio. The following deficiencies were identified: - The firm's approach for substantively testing the ALL was to review and test management's process. The firm did not perform procedures to evaluate the reasonableness of the (1) methods and assumptions used by the issuer to determine the benchmarks and (2) assumptions used by the issuer to develop certain post-model adjustments both of which were used by the issuer to determine the ALL. (AS 2501.09 .10 and .11) [This citation refers to AS 2501 Auditing Accounting Estimates which was in effect for this audit. This standard was replaced by AS 2501 Auditing Accounting Estimates Including Fair Value Measurements which became effective for audits of financial statements ending on or after December 15 2020.]

The issuer used a service organization to estimate the quantitative component of the ACL. The firm obtained a service auditor's report and identified a complementary user control that the service auditor's report described as necessary. The firm did not perform any procedures to evaluate whether the issuer had implemented this control. (AS 2201.39 and .B22)

The firm selected for testing a control that consisted of the issuer's review of certain assumptions used to estimate the quantitative component of the allowance for credit losses (ACL) but did not identify and test any controls over the accuracy and completeness of an issuer-prepared analysis that the control owners used in the operation of this control. (AS 2201.39)

The firm identified and tested a control that consisted of the issuer's review of the allowance for credit losses (ACL) including a comparison of certain metrics between the issuer and its peers. The firm did not evaluate the specific review procedures that the control owner performed to determine which peers to select for comparison. (AS 2201.42 and .44)

The firm identified and tested a control that consisted of the issuer's review of the allowance for credit losses (ACL) including a comparison of certain metrics between the issuer and its peers. The firm did not test the aspects of this control that addressed the accuracy and completeness of the peer information that the control owner used in the operation of this control. (AS 2201.42 and .44)