ABC BANK Audit Plan Presentation to Audit Committee (Date)

Table of Contents Introduction of Internal and External Audit Teams Audit Risk Assessment Process and Audit Plan Summary Comparison of Audit Effort in Prior Year Versus Plan for the Current Year Internal Audit Schedule Sample Audit Committee Deliverable Matrix for Evaluation of Audit Independence

Internal Audit Plan - Overview The audit plan was developed using a risk based audit approach. Utilizing experience and understanding of the bank’s operations as well as industry knowledge, internal audit identified auditable areas, performed a risk assessment for each of these areas, and assigned each of these a risk rating of high, medium or low. Internal audit considered the following factors, as well as knowledge of the bank, in determining the risk rating for each auditable area: Discussions with bank management, which provided insight regarding issues and risks in the auditable areas Potential impact that the auditable area may have on the financial position of the bank Other environmental factors, such as past audit results, changes in personnel and operations, past and current emphasis by regulators, and future business strategies This risk assessment process will be performed on an ongoing (at least annually) basis to ensure changing risk factors, including losses, operational changes or turnover, are continually monitored. A cycling approach to the internal audit plan was used, whereby high-risk areas are audited on an annual basis, and medium- to low-risk areas are audited over a 18- to 24-month cycle.

Likelihood of control/process issues Risk Map - ABC Bank Medium Risks High Risks Low Risks High Low Significance Likelihood of control/process issues Disaster Recovery Commercial Lending Finance IT Applications Community Reinvestment Act Software Licensing Logical Security/Security Admin. IT Telecommunications Operations Support Small Business Lending Local Area Network Centralized Doc. Unit Treasury/Investments/ALM Central Services Internet Conn./Firewall New Product Development Real Estate Lending Commercial Business Lending SBA Center II I Branch Network Loan Administration Dept. Financial Products Marketing/Promotions Human Resources/Payroll Credit Administration Appraisal Department Facilities Risk assessment used to rank auditable areas by significance of risk, meaning, how much could the bank be affected if a control breakdown occurred in the area, and by likelihood, meaning, how likely is it that something could go wrong. Likelihood considers two components -- what is the inherent likelihood and what is the likelihood given the current environment at the Bank. Coverage of auditable areas will therefore include any areas denoted as high or medium risk, and certain of those areas considered low risk generally, although management has concerns about these areas. All high and medium are covered, and the two low covered are branches and human resources. IV III

Total Budgeted Audit Hours Summary Audit Plan Audit Area Risk Assessment Budgeted Hours Treasury/Investments/ALM High X Real Estate Lending Central Services Commercial Business Lending SBA Center New Product Development Internet Connectivity/Firewall Centralized Documentation Unit Medium Logical Security & Security Admin Local Area Networks IT Telecommunications Disaster Recovery Planning Software Licensing Finance/Accounting/Accts Payable Operations Support Community Reinvestment Act Branch Network Low Human Resources/Payroll Discretionary NA Planning, Admin & Reporting to AC Follow-Up on Prior Year Audit Plan Total Budgeted Audit Hours Key issues/risks communicated during our discussions with management: Compliance risk, including Reg B -- inappropriate guarantees taken from spouses, Fair lending and CRA in SBLC Operational risks, related to consistency of procedures, issues with fraud, monitoring of suspense accounts, efficiencies between branch offices. Other branch network issues include turnover issues, strength of management Information technology risks -- web based activities, Human Resource risks -- loss of credit people in Commercial Business centers Lending risks -- anticipated growth in SBA, accounting for related fee income New product development -- regulatory aspects, internal communications, reporting mechanisms. Alliances with investment and trust services Our own assessments include the following: Central services as high risk because of wire activity Treasury/investments high risk because of nature of transactions conducted SBA center because of growth focus in the area and certain complexities of accounting in the area Lending in general because of marketplace Internet connectivity -- security, firewall, customer information

Summary Focus of Audit Effort During Prior and Current Years Hours This is based on total plan hours of approximately 7,600 (3 staff plus Terry), of which 1,800 is non-chargeable hours (924 Admin for Nabors, approx. 320 for staff training, 100 unbudgeted, 120 sick, 200 special investigations). Therefore approximately 5,800 is chargeable hours. Inefficiencies spending 1600 hours on branches, versus 400 hours in our plan (diff of 1,200) gets to(5,800-1,200) 4,600. Our total plan hours are approximately 4,500.

Significant Changes in Audit Plan from Prior to Current Year As is depicted on the preceding page, the following summarizes the most significant changes seen in the audit plan for this year versus last: Greater emphasis on lending activities, including centralized documentation unit, based on risk assessment process Significant re-allocation of time from branch network to centralized/back office operational activities based on our risk assessment process. For branch network, focus to be on high-risk activities, including branch losses, wire initiation, etc. Increased discretionary time for special projects Reduced administration time, as well as no allocation for training, vacation or sick leave

Internal Audit Schedule = Planned = In Process = Completed

Internal Audit Schedule (Contd.) = Planned = In Process = Completed

Internal Audit Schedule - Regulatory Compliance Federal/state regulations reviewed as part of the audit plan As part of our review of the identified business processes and retail branches, internal audit will integrate compliance testing of the following regulations: Internal audit will coordinate with ABC Bank’s compliance officer when determining the scope and degree of work to be performed for compliance-related issues.