A call report audit program built from the examiners' own steps

A call report audit program is internal audit's written plan for testing the Call Report: which schedules and lines to sample, how to trace them to the general ledger and the systems behind it, which controls to test, how to grade a misstatement, and what to report. The best model for one is public. The OCC's Comptroller's Handbook booklet "Regulatory Reporting" sets out the expanded procedures its examiners use, from scoping to conclusions, and closes with an internal control questionnaire. The work is hard because the report is large, its figures pass through mapping software that few auditors can read, and the controls behind it are run by twenty or more people. Botminds' Regulatory Reporting Controls traces the top lines to their sources and re-performs key controls, so internal audit starts from evidence rather than from requests.

What is a call report audit program?

It is the part of the internal audit plan that covers regulatory reporting, written down so that someone else could run it. The OCC describes two kinds of audit that cover the Call Report: operational audits, which test the integrity of accounts and regulatory reports and the controls around them (some banks run a periodic Call Report audit of this kind, testing a sample of data and assessing controls), and information technology audits, which test the systems that produce the data, including the mapping software that feeds the report (OCC Comptroller's Handbook, "Regulatory Reporting," Audit Program).

The booklet states the audit function's job in one sentence: to test internal controls periodically so as to find unreliable financial and regulatory reporting, violations of law and departures from the bank's own policies. It also says: "An effective audit program substantially lessens the risk of a bank failing to detect potentially serious problems." A call report audit program is that job applied to one report, with the samples, tests and grading rules spelled out.

How do examiners test the Call Report?

In four stages: scope, testing of the quantity of risk, assessment of risk management, and conclusions. Scoping reads what already exists, including the bank's own audit reports and work papers, then looks for balances that moved and for anything that changed: requirements, systems, people, controls. Testing samples report schedules and their work papers, and, where the bank uses software to map accounts to lines, a sample of the coded items. Any misstatement found is graded for materiality. The risk management stage tests policies, processes, personnel and control systems, with the internal control questionnaire as a tool. The conclusions stage decides whether to require amended reports and how far back.

The procedures are flexible by design. The booklet says examiners "should consider work performed by internal and external auditors, independent risk management, and other examiners reviewing related areas", and adds: "Seldom is every objective or step of the expanded procedures necessary." Both sentences matter to internal audit. The first means a strong audit program can narrow the examiner's work. The second means an audit program built on the same steps should choose among them by risk, as the examiner does.

Step one: scope from the UBPR and from what changed

The examiner's first analytical step is the bank's Uniform Bank Performance Report: large increases or decreases in income statement or balance sheet accounts suggest which schedules to sample. Internal audit can do the same with the Call Report itself, ranking lines by size and by quarter-on-quarter and year-on-year change. A line that doubled is where a mapping error or a misclassification is most likely to sit.

Change is the second lens, and the more useful one for controls. The examiner asks management whether there have been significant changes in reporting requirements, policies and procedures, systems and software, personnel, control systems and management information. Each change is a candidate test: a new general ledger account that may not be mapped, a new mapping version that may not have been tested, a new preparer who may not know the instructions, a supplemental instruction that changed a definition.

Step two: sample schedules and trace line items to source

Pick a sample of schedules, then of line items, and trace each from the reported figure back to the general ledger and the work papers, and from the work papers to the source system. The examiner's procedures direct a review of the work papers behind each sampled line item and the supplementary schedules, with the Call Report instructions as the standard of what belongs on each line. Internal audit should use the same standard: a line that ties to the general ledger but contains items the instructions put elsewhere is still wrong.

Amendments deserve their own sample. The OCC's procedures ask whether the bank refiled any report without examiner direction, why, and whether processes now prevent a repeat; they direct a test of the amended schedules. An amended report is a control failure that has already been found, and its root cause is often still in place.

Step three: test the coding and the data flows behind each line

Where a bank uses mapping software, a correct general ledger and a correct report can still disagree because an account is coded to the wrong line. The examiner samples coded items and asks management for the list of item codes; internal audit should test the mapping table itself, including accounts added since the last audit. The OCC's booklet warns that automated systems reduce manual error but bring their own risks, and that failing to test the accuracy of data flows periodically can lead to inaccurate reports.

Testing data flows means tracing a line from the system where the data starts to the line where it ends, and naming the control on each hop. In the sample bank used throughout this series, Tessaly Community Bank (fictional, with fictional people and figures), loans and leases held for investment, Schedule RC item 4.b, passes through five hops: the core banking system's 18,412 loan accounts, the loan subledger, general ledger accounts 1400–1490, the regulatory reporting system's mapping rule, and the line. Each hop has a key control. In June the same trace on brokered deposits found a hop with none, and the bank added one.

Which controls stand behind each line, hop by hop

Step four: grade every misstatement the way an examiner would

A finding without a grade is half a finding. The OCC's procedures give six instructions for judging materiality, which group into the five tests below, and internal audit should write down how it applies each before fieldwork begins. The most important instruction is the last: "Examiners should assess each misstatement for materiality separately and in aggregate." Several small misstatements on lines that feed regulatory capital can together cross a threshold none crosses alone.

The grade decides what happens next. A material misstatement means an amended report and, in the examiner's view, a question about root cause and controls. A control failure that produced no misstatement is still a deficiency to be classified; how that is done, and who decides, is the subject of material weakness vs significant deficiency on a Call Report control.

What is the OCC internal control questionnaire?

It is a seven-question checklist examiners use to judge whether a bank's internal controls for regulatory reporting are strong, satisfactory, insufficient or weak. It is short enough to become the controls section of an audit program as it stands, with each question turned into a test.

Questions two and three deserve the most care, because separation of duties breaks one instance at a time and a sample can miss the instance that broke. The ways a break happens, and a matrix for testing it, are in separation of duties in accounting.

Build the audit program on the examiner's steps and the examiner's first question, what did internal audit find, already has an answer.

How often should the Call Report be audited?

As often as the bank's risk assessment says, and no rule sets a fixed cycle. The OCC asks examiners to look at the audit risk assessment of the business lines and functions tied to regulatory reporting, the audit plan and schedule, and the "scope, coverage, and frequency" of reviews. A practical pattern is a full audit of the Call Report process on a cycle set by risk, with quality assurance after every filing in between, and targeted tests whenever something material changes, such as a new mapping system or a new report form.

Part 363 adds an outside view for larger banks. An institution with $1 billion or more in assets needs an annual audit of its financial statements by an independent public accountant; at $5 billion or more, the accountant also attests to management's assessment of internal control, and the attestation report "must specifically include a statement as to regulatory reporting" (12 CFR 363, Appendix A, guideline 18). Internal audit's Call Report work is often what the accountant reads first.

What should the audit report say?

It should say what was tested, what was found, how each finding was graded, and what management will do. The OCC lists, among the things examiners assess: "The adequacy of audit reports, including whether reports discuss significant deficiencies, management action plans, and audit action plans", and to check the "adequacy and timeliness of follow-up". An audit report on the Call Report that lists exceptions without grades or owners fails the first test; one whose findings reappear unchanged next year fails the second.

Where Regulatory Reporting Controls helps internal audit, and where it stays out

The solution gives internal audit three things to start from: lineage of the top Call Report lines with the control on each hop and the mapping version read; re-performance of key controls with every figure cited; and one audit trail of what people and agents did, with reasons. Internal audit has its own lane: it reads everything, records its own tests and conclusions, and cannot sign, assign or revoke anything. In the sample quarter, internal audit tested six controls with its own samples and scheduled a re-test of the July loan reconciliation after its independent re-review.

What it does not do is audit. Its testing is management's testing, run on management's behalf, and an audit program that relied on it would lose the independence that gives internal audit its value. Used well, it moves internal audit's time from collecting evidence to testing the parts of the process the agents cannot see, and to checking the agents themselves on a sample of their work. The evidence it captures, and how long it is kept, is described in control evidence that holds up for examiners and auditors.

Questions people ask

What does internal audit test in the Call Report?

The accuracy of a sample of schedules and line items, traced to the general ledger and source systems; the mapping of accounts to lines; amendments and their causes; and the controls: separation of duties, quality control before filing, quality assurance after filing, signatures and attestation.

How do examiners use the UBPR?

As a starting point for choosing what to test. The OCC's procedures tell examiners to look in the bank's Uniform Bank Performance Report and analytical tools for large increases or decreases in balance sheet or income statement accounts, and to consider sampling the related schedules.

Can the Call Report audit be outsourced?

Yes. The OCC notes that a bank "may also engage a third party to perform an audit of the bank's regulatory reporting processes", and that such a relationship belongs in the bank's third-party risk management. The bank remains responsible for the report's accuracy.

What is the difference between quality control, quality assurance and audit?

Quality control is an independent check before filing; quality assurance is an independent check after filing that standards and processes were followed; audit periodically tests the controls themselves. The OCC treats all three as control systems and expects each to be independent of the preparer and reviewer.

Is the OCC regulatory reporting booklet current?

It is Version 1.0, September 2021, and is still the version on occ.gov in October 2026, with reputation-risk references struck through in March 2025. One footnote still describes the internal control attestation at $1 billion in assets; Part 363 moved it to $5 billion from January 1, 2026.