A credit union audit looks like a small bank audit with a different governance structure. Members own the institution, a supervisory committee carries the audit responsibility, and NCUA rules decide which audit type is required. The CPA's first job is to work out which engagement the credit union actually needs, and the second is to test the loan portfolio and allowance that drive capital.
Which audit does the credit union need
NCUA's rule on supervisory committee audits is 12 CFR Part 715. For federal credit unions, section 715.5 sets the requirement by asset size:
- $500 million or greater in total assets: an annual audit of the financial statements, performed under generally accepted auditing standards by an independent person licensed in the state or jurisdiction where the credit union is principally located (715.5(a)).
- Less than $500 million but more than $10 million: an annual supervisory committee audit under section 715.7, for a federal credit union that does not choose the financial statement audit (715.5(b)).
- $10 million or less: an annual supervisory committee audit under section 715.7 (715.5(c)).
Section 715.7 describes the "Other Supervisory Committee Audit," which the supervisory committee, its internal auditor or another qualified person may perform, including CPAs, league auditors and retired examiners, provided the performer meets the minimum requirements in Appendix A of Part 715. A qualified person who is not state-licensed cannot provide assurance services under that section.
Every federal credit union must also meet the other applicable requirements of Part 715 whatever audit it obtains (715.5(d)). Engagement planning should record which section the client relies on, who engaged the firm, and that the supervisory committee, not management, holds the relationship. The independence rules in AU-C 200 and the AICPA Code apply in the usual way.
Member account verification
Section 715.8 requires the supervisory committee to arrange verification of members' accounts at least once every two years. The committee compares member passbooks and other approved records against the treasurer's records. It may use:
- Controlled verification, covering 100% of members' share and loan accounts.
- Statistical sampling, with a sample large enough in number and scope to support conclusions about management's financial reporting objectives, and additional procedures when confirmations alone are insufficient.
- Non-statistical sampling, available when an independent person licensed by the state performs the verification, using methods consistent with GAAS and documented for the NCUA Board on request.
The committee keeps the verification records until the next verification is complete. In a financial statement audit, this work and the auditor's own share and loan confirmations overlap. The auditor still needs to design confirmation procedures under AU-C 505 and can use the committee's work only after evaluating its scope and reliability.
Accounting areas that matter
- Loans. Consumer and auto loans, first and second mortgages, member business loans and indirect lending through dealers. Test origination, nonaccrual, charge-offs and deferred fees and costs.
- Allowance for credit losses. ASC 326 applies. The Federal Reserve, FDIC, NCUA and OCC issued an Interagency Policy Statement on Allowances for Credit Losses in May 2020 and revised it in April 2023. It takes effect when a credit union adopts ASC Topic 326. For the allowance procedures, see our guides on CECL and on model validation and qualitative factors.
- Net worth. NCUA stated in its CECL FAQ letter (16-CU-13) that CECL may result in a decrease in net worth upon implementation for some credit unions and that it was training examiners to take this into account when evaluating capital adequacy. The allowance estimate therefore affects regulatory capital, which raises estimate risk.
- Shares and deposits. Member shares and certificates are the main liability. Test balances, dividends payable and dormant accounts.
- Investments. Classification between held to maturity and available for sale, fair value and impairment under ASC 326.
- Related parties. Loans to officials, committee members and employees.
Risk areas
- Allowance model that is too simple to capture the portfolio, or that relies on a single historical loss rate.
- Indirect auto loans where dealer reserves and rebates affect yield.
- Delinquency and charge-off timing that protects the net worth position.
- Member business loans and participations bought from other lenders.
- Weak segregation of duties in a small staff.
- A supervisory committee without the skills to oversee the audit.
- Share and loan subledger differences left unresolved.
Typical audit procedures
- Planning. Identify the audit type required, the engagement party, and whether the credit union reports under GAAP. Document independence and the supervisory committee's role.
- Loans. Reconcile the loan subledger to the general ledger and the NCUA call report. Select loans by size and risk, inspect the note, credit file and collateral, and test payment history and risk grade.
- Allowance. Obtain the methodology and board approval, test data inputs, reperform pooling and the calculation, challenge qualitative factors and evaluate individually assessed loans.
- Shares and certificates. Reconcile to the general ledger, confirm a sample, recompute dividends and test cutoff.
- Delinquency and charge-offs. Compare the delinquency report with the policy and test that charge-offs happen when the policy requires.
- Investments. Confirm holdings with custodians and agree prices to independent sources.
- Journal entries and unusual items. Review manual entries to the allowance, loan fees and suspense accounts.
- Supervisory committee. Read minutes and assess any verification work for use in the audit.
Worked example
A federal credit union has $180,000,000 in total assets (illustrative numbers), so the financial statement audit is not mandatory under 715.5(a), but the board chose one.
- The loan portfolio is $110,000,000. The allowance model applies a loss rate of 0.80% to the consumer pool of $60,000,000 and 0.40% to the mortgage pool of $50,000,000.
- Consumer pool reserve: $60,000,000 x 0.80% = $480,000.
- Mortgage pool reserve: $50,000,000 x 0.40% = $200,000.
- Total quantitative reserve: $680,000.
The credit union booked $640,000. The $40,000 shortfall against its own model is a misstatement, and it moves earnings and net worth. If the credit union has a net worth position close to a regulatory category, that effect matters beyond the financial statements, so the auditor discusses it with the supervisory committee and the board.
PBC items
- Engagement and Part 715 documentation showing the audit type and the engaging party.
- Loan and share trial balances and reconciliations.
- Allowance methodology, data and qualitative factor support.
- Delinquency, nonaccrual and charge-off reports.
- Supervisory committee minutes and the latest member account verification records.
- Investment statements and custodian confirmations.
- Latest NCUA exam report and call report.
- Board minutes covering loan policy and credit approvals.
Red flags
- The committee has not verified accounts within the last two years.
- Allowance below the credit union's own model without documented reasons.
- Charge-offs that cluster after year end.
- Unreconciled share or loan accounts.
- Loans to officials on unusual terms.
Frequently asked questions
Is a financial statement audit required for every credit union?
No. Under 715.5, it is required for federal credit unions with $500 million or more in total assets. Federal credit unions with less than $500 million obtain a supervisory committee audit under 715.7 unless they choose the financial statement audit.
How often must member accounts be verified?
At least once every two years under 715.8.
Who can do a supervisory committee audit?
The supervisory committee, its internal auditor, or another qualified person who meets Appendix A of Part 715.
Sources
- 12 CFR 715.5, 715.7 and 715.8, Supervisory Committee Audits and Verifications (Cornell LII)
- NCUA, Letter to Credit Unions 16-CU-13, Frequently Asked Questions on the New Accounting Standard on Financial Instruments, Credit Losses
- Federal Reserve, SR 20-12, Interagency Policy Statement on Allowances for Credit Losses (revised April 21, 2023)
- PwC Viewpoint, Loans and investments guide, section 7.3 Principles of the CECL model
- AICPA, AU-C Section 505, External Confirmations
CORAA prepares ready-to-review audit files for US CPA firms; see /us.
Part of CORAA University · Specialized engagements: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error