Bank branch audit checklist: why a tick is not evidence

A branch audit checklist is the list of controls tested at a bank or credit union branch: cash and the vault, dual control, consigned items, samples of new-account, currency transaction and hold-notice files, record retention, and the branch's part of the security program. The checklist itself is easy to write, because the examiners publish theirs. The hard part is the evidence. "Vault log reviewed: yes" tells an internal auditor nothing they can check, so the auditor goes back to the branch, and the finding the branch thought it had cleared is written again. Botminds' Branch Self-Assessment exists to make each checklist item leave evidence behind: agents check the items that live in systems before the branch opens, the branch manager photographs the rest, and every verdict is stored with its source for internal audit to re-perform.

The checklist below is built from the FDIC's examination procedures for cash and the Federal Reserve's internal control questionnaire. The worked examples come from a fictional sample credit union in the solution, Norrell Federal Credit Union, whose people and numbers are sample data.

What is on a bank branch audit checklist?

A bank branch audit checklist covers cash, custody, files and security, and the most defensible version borrows its items from examiner procedures. The FDIC's expanded procedures for cash on hand run to 24 items, from whether "tellers, including relief tellers, have sole access to their cash supply and cash drawer" to whether "someone independent of the teller function controls the master teller-machine key" (FDIC RMS Manual, section 22.1). The same module adds the night depository, ATMs, cash items, proof and transit, deposit operations and official checks.

The Federal Reserve's internal control questionnaire for cash accounts covers the same ground in question form and adds detail on the vault. Item 26 asks: "is a register maintained which is signed by the individuals opening and closing the vault", and "are combinations changed periodically and every time there is a change in custodianship?" (CBEM 2310.4, item 26). A branch checklist that copies these lines word for word has an advantage beyond completeness: when an examiner asks why an item is on it, the answer is that the examiner's own manual put it there.

Around the cash core sit three more groups. File samples test what the branch opens and files: customer identification records, currency transaction reports, hold notices and records that must be kept for a set period. Notices and records check what the branch posts and how it stores member information. The security program checks the devices and procedures the Bank Protection Act rules require, which our guide to Bank Protection Act requirements sets out regulator by regulator.

Why a tick is not evidence

A tick records that someone says they looked; evidence lets someone else look again. The FDIC's description of an adequate internal audit program lists, among its elements, "Adequate documentation of tests, findings, and corrective actions" and "Verification and review of management's actions to address material weaknesses" (FDIC RMS Manual, section 4.2). A checklist of ticks documents neither the test nor what it found.

Adequate documentation of tests, findings, and corrective actions.

FDIC RMS Manual of Examination Policies, section 4.2, on what an internal audit program should provide for

The cost of a tick shows up twice. First, internal audit cannot rely on it, so it repeats the work at the branch, and the hours a self-assessment was meant to save are spent anyway. Second, a tick hides the one item that failed. In the sample credit union's vault log for 8 to 22 October, nine of ten openings carried two sets of initials. A reviewer skimming the page ticks "vault log reviewed". Only a transcription of every line shows that 9 October at 7:52 a.m. has one set, and only the security system shows that nobody else entered the branch until 8:31.

One checklist item with its evidence in Branch Self-Assessment: the vault access log, read line by line

What evidence is needed for a branch review?

Each item needs evidence that shows what was tested, on what date, by whom, with what result, in a form someone else can examine. In practice that means one of four things: a system extract (a teller platform balance, a security system event list, a core record), a photograph of a physical record (a log, a count sheet, a register, a posted notice), a sampled file with the field compared, or a count sheet signed by the people who counted.

Cash and the vault: the branch audit items examiners test first

Cash is where a branch audit checklist starts, because a cash control that fails costs money the same day. The FDIC's procedures ask whether daily procedures compare "each teller's cash, in aggregate, to an independent control from the proof or accounting control department", whether "each teller prepares and signs a daily proof sheet detailing currency, coin, consignment items, and cash items", and whether "cumulative over-and-short records are maintained for all persons who handle cash". The last item is the one a single day never shows; our sister series on teller and ATM balancing explains why in teller balancing and the cumulative over-and-short record.

The vault adds custody. Items 2, 19, 21 and 22 of the FDIC module ask whether duplicate keys and combinations are under dual control, whether vault opening and closing require it, whether the bank "maintains records showing amounts and denominations of vault cash", and whether currency shipments are counted under dual control when they leave and when they arrive (all of the dual-control items are taken one by one in dual control in banking). Item 20, a surprise count of all vault currency including strapped packets, deserves its own discussion, and has one in surprise cash count: when the branch knew it was coming.

Consigned items are cash by another name. Official checks, money orders and gift cards held at the branch are reconciled to the general ledger, and unissued stock is kept under joint custody. In the sample review the Cash agent reconciled the vault, four drawers, 212 official checks, 147 money orders and 38 gift cards to the teller platform and the general ledger before the branch opened, and accepts an exact match only.

Which files does a branch audit sample, and what rule does each test?

A branch audit samples the files the branch creates under rules with fixed requirements: customer identification records for new accounts, currency transaction reports, Regulation CC exception hold notices, and records with a retention period. Each sample tests one requirement that a person can check against the rule's own words.

Sampling by software changes what is practical. In the sample review the Sampling agent pulled five of 61 new memberships, three of nine CTRs, four of 27 hold notices and six retention records from document imaging and checked each against the core and the BSA reporting system before the branch opened. Seventeen passed. One membership opened on 14 September had no ID expiration date in the core while the imaged license showed 03/14/2029, the exact field the CIP rule names. The agent prepared the correction; a member service representative entered it, and the branch manager verified it against the image.

File samples checked against the core in Branch Self-Assessment, with the image beside the record

How do you document a branch audit so someone else can re-perform it?

Store the evidence, the verdict and the decision separately, and link them. The evidence is the photograph or the system extract as captured. The verdict is what the reader, a person or an agent, concluded from it, with the version of the procedure used. The decision is who agreed, who disagreed and why, and who signed. When the three are kept apart, internal audit can look at the evidence alone, reach its own verdict and record whether it agrees, which is exactly what re-performance means.

In Branch Self-Assessment the walk captures one photograph per step on the manager's phone, the agent's verdict sits beside it with its confidence, and the manager's agreement or reason code is recorded. When the regional manager signs, the sample review carried 22 photographs, 18 samples and 42 system checks, kept for the five years the sample credit union has set. An internal auditor re-performing a step sees the stored photograph without the agent's marks, then the original result, and records a conclusion next to it.

Which branch audit findings is the checklist built to catch?

The checklist is built to catch the failures examiners name: a teller without sole access, a vault opened by one person, a combination unchanged after someone left, a drawer over its limit, a difference not cleared, a file missing a required field, a notice not given. The FDIC's internal controls section lists the frauds these controls exist to stop, from lapping, where one day's shortage is covered with the next day's receipts, to outright theft and a run of over-and-short entries (FDIC RMS Manual, section 4.2; the full list, with four federal cases, is in how to prevent embezzlement at a bank branch).

The sample credit union's open exceptions at one point in its quarter show the pattern. Across 38 branches, three were repeats: a vault opened by one employee, a combination not changed after a departure, and a teller drawer over its $15,000 limit at close. None of the three is unusual, and each would pass a checklist that asked only whether the procedure exists. A repeat finding is the signal that matters, because it means the first correction did not hold; how to count repeats is part of what a branch scorecard should report.

How often should branches be audited?

No federal rule we know of sets a frequency for branch audits or branch self-assessments; the institution sets it by risk, and the board or its audit committee oversees the plan. What the rules do fix are the calendars the branch review feeds: the security officer's report to a bank's board at least annually, a credit union's annual certification under Part 748, and the retention periods above. One workable design combines an internal audit visit on a risk-based cycle with a more frequent self-assessment by the branch manager; the sample credit union reviews every branch every quarter, with one unannounced review per branch each year.

Frequency matters less than independence and evidence. A quarterly self-assessment that leaves ticks gives the auditor nothing to rely on; one that leaves photographs and system extracts lets the auditor test a sample of steps from the office and spend branch visits where the evidence is weakest. How a full quarterly review runs is told in one branch's quarterly self assessment, and the solution is at Branch Self-Assessment.

Questions people ask

What does an auditor check in a bank branch?

Cash and its custody first: sole access to drawers, dual control at the vault, daily proof against an independent control, cumulative over-and-short records, cash limits and surprise counts. Then consigned items, the night depository, file samples such as CIP records and CTRs, notices, record retention, and the security devices and procedures required by the Bank Protection Act rules.

Who performs a branch audit?

Internal audit performs the independent audit; the branch manager usually performs the self-assessment between audits, and a regional manager or operations officer reviews it. Examiners test the same controls during an examination, and the Federal Reserve's procedures scope that work partly on what internal or external auditors have already found.

What is the difference between a branch audit and a branch self-assessment?

A self-assessment is management checking its own controls; an audit is a test by someone independent of the branch. The banking agencies expect both, and warn against relying on self-assessment alone. A self-assessment with re-performable evidence lets internal audit test more of it without a visit.

Is there a standard bank branch audit checklist template?

There is no regulatory template, but the FDIC's examination modules and the Federal Reserve's internal control questionnaires are public and itemized. Building the checklist from them, then adding the institution's own policies, gives every item a source an examiner recognizes.

How long should branch audit evidence be kept?

The institution decides for the review itself; the records it samples have their own periods, such as five years for BSA records under 31 CFR 1010.430 and at least two years for Regulation CC compliance evidence under 12 CFR 229.21(g). Keeping review evidence at least until the next examination and internal audit cycle are complete is the practical floor.