A bank audit is built around two balance sheet captions: loans on the asset side and deposits on the liability side. Loans carry the largest estimate in the file, the allowance for credit losses. Deposits carry the largest population and the cleanest external evidence. Interest income and fee income follow from both.
This guide focuses on those three areas. For the regulatory reporting side, including Call Reports and holding company filings, see our post on bank holding company audits and FDICIA.
Which rules apply
Part 363 of the FDIC's rules applies to an insured depository institution when its consolidated total assets at the beginning of the fiscal year are $1 billion or more, as adjusted from time to time under 12 CFR 314.1 (12 CFR 363.1). Within Part 363, the management assessment of internal control over financial reporting and the accountant's attestation apply at $5 billion in assets, as adjusted (12 CFR 363.2(b)(3) and 363.3(b)). The accountant must follow the independence standards of the AICPA, the SEC and the PCAOB, using the stricter rule where they conflict, and must hold or be enrolled in an acceptable peer review before starting work (12 CFR 363.3(f) and (g)).
Smaller banks fall outside Part 363, but lenders, regulators and boards still expect audited statements, and the accounting is the same GAAP.
Loans: accounting that drives the audit
- Interest and fees. Interest accrues on the effective yield, and loan origination fees and costs are deferred and amortized as yield adjustments rather than taken into income at closing.
- Nonaccrual. The bank stops accruing interest when collection is in doubt under its written policy. The auditor tests that the policy matches regulatory reporting practice and is applied to every loan that meets it.
- Allowance. ASC 326 requires an allowance for expected credit losses over the life of the loan portfolio. Loans that share risk characteristics are evaluated collectively; loans that do not are evaluated individually. A loan cannot sit in both an individual assessment and a pool.
- Restructurings. ASU 2022-02 removed the troubled debt restructuring recognition and measurement guidance for creditors and added disclosure requirements for certain refinancings and restructurings when borrowers face financial difficulty.
The allowance: what regulators expect
The Federal Reserve, FDIC, NCUA and OCC issued an Interagency Policy Statement on Allowances for Credit Losses in May 2020 and revised it on April 21, 2023, to remove references to troubled debt restructurings. The statement describes how to measure expected credit losses under ASC 326 and how to account for impairment on available-for-sale debt securities. It takes effect when each institution adopts ASC Topic 326 and replaces the older allowance policy statements for adopters.
For the auditor, that gives a benchmark beyond the standard itself. The bank's methodology, governance and documentation should be consistent with that statement, and the Call Report allowance should agree to the financial statements.
For the model itself, PwC's guidance describes the building blocks: pools built on shared risk characteristics, a reasonable and supportable information set, and qualitative adjustments where historical data does not reflect current or forecast conditions. Our guides on CECL under ASC 326 and on validating CECL models and qualitative factors cover the method in depth.
Risk areas
- Allowance estimate. Management judgment, model risk and qualitative factors that move the number without evidence.
- Loan origination and underwriting. Exceptions to policy, stale appraisals and missing documentation.
- Concentrations. Commercial real estate, a single industry or a handful of borrowers.
- Nonaccrual and charge-off timing. Delay protects earnings and capital ratios.
- Related-party loans. Insider credit that does not follow the terms offered to others. See related-party transactions.
- Deposit completeness and cutoff. Account balances, accrued interest and dormant accounts.
- Management override. Journal entries to the allowance, loan fees and suspense accounts.
Typical audit procedures
Loans
- Reconcile the loan subledger to the general ledger and to the regulatory report.
- Select loans by risk, using size, risk rating, past due status and industry, and send positive confirmations for balance and terms where borrowers respond (see AU-C 505).
- For each selected loan, inspect the note, the credit file, the collateral documentation and the most recent borrower financial information, and reperform the risk rating.
- Test nonaccrual and charge-offs against the written policy, including whether loans past the policy trigger were handled as the policy requires.
- Recompute interest income on a sample, and test deferred fees and costs.
Allowance
- Obtain the methodology and the board or committee approval.
- Test the completeness and accuracy of the data fed to the model, and reperform the pool calculation.
- Challenge qualitative adjustments with support from delinquency, growth, concentration and economic data. Look for bias using the retrospective review in AU-C 540.
- Evaluate individually assessed loans, including collateral values and the date of the latest appraisal.
- Compare the allowance with the Call Report and the footnotes.
Deposits
- Reconcile the deposit system to the general ledger by product.
- Send confirmations on a sample of accounts, including a selection of large, dormant and officer accounts.
- Test accrued interest expense and the interest rates applied against the rate sheet.
- Test cutoff on the last days of the year, including wires, ACH and items in process.
- Review overdrafts and their reclassification as loans.
Worked example
A bank has a commercial real estate pool of $120,000,000, of which $30,000,000 is office property (illustrative numbers). The model produces a quantitative loss rate of 0.60% on the whole pool, and management adds a flat qualitative adjustment of 0.15% across the pool, citing rising office vacancy.
- Quantitative reserve: $120,000,000 x 0.60% = $720,000.
- Qualitative adjustment as booked: $120,000,000 x 0.15% = $180,000.
- Pool allowance as booked: $900,000.
The auditor tests the adjustment against its stated driver. Vacancy evidence supports an adjustment only for the $30,000,000 office sub-portfolio. If management's analysis supports an extra 0.50% on office alone, the adjustment is $30,000,000 x 0.50% = $150,000 and the pool allowance is $870,000. The $30,000 difference is an unsupported qualitative amount for the audit schedule of differences, and the file records the driver, the data and the reperformed computation.
PBC items
- Loan trial balance and reconciliation to the general ledger.
- Allowance methodology, model documentation, data and qualitative factor memo.
- Loan review reports and risk rating migration.
- Past due, nonaccrual and charge-off listings.
- Deposit trial balance by product and reconciliation.
- Board and committee minutes on credit approvals and allowance.
- Latest regulatory exam report, where the bank can share it.
Red flags
- Qualitative factors that always offset a quantitative decline.
- Loans renewed with new terms and no new credit analysis.
- Allowance that does not move when delinquency does.
- Large unreconciled differences between the subledger and general ledger.
- Insider loans on terms better than the policy allows.
Frequently asked questions
Does every bank audit fall under Part 363?
No. Part 363 applies at $1 billion in total assets as of the start of the fiscal year, as adjusted. Smaller banks follow GAAP and GAAS without that overlay.
What replaced the incurred loss allowance?
The expected credit loss model in ASC Topic 326, with the interagency policy statement as the regulators' reference for measurement and governance.
How do auditors get evidence on deposits?
Reconciliation of the deposit system, confirmations on selected accounts and testing of interest and cutoff.
Sources
- FDIC, FIL-17-2023, Revised Interagency Policy Statement on Allowances for Credit Losses (April 21, 2023)
- Federal Reserve, SR 20-12, Interagency Policy Statement on Allowances for Credit Losses
- 12 CFR 363.1, 363.2 and 363.3, Annual Independent Audits and Reporting Requirements, law.cornell.edu
- PwC Viewpoint, Loans and investments guide, section 7.3 Principles of the CECL model
- AICPA, AU-C Section 505, External Confirmations
Part of CORAA University · Specialized engagements: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error