1. ABC BANK Audit Plan Presentation to Audit Committee (Date)

2. Table of Contents Introduction of Internal and External Audit Teams
Audit Risk Assessment Process and Audit Plan
Summary Comparison of Audit Effort in Prior Year
Versus Plan for the Current Year
Internal Audit Schedule
Sample Audit Committee Deliverable
Matrix for Evaluation of Audit Independence

3. Internal Audit Plan - Overview
The audit plan was developed using a risk based audit approach. Utilizing experience and understanding of the bank’s operations as well as industry knowledge, internal audit identified auditable areas, performed a risk assessment for each of these areas, and assigned each of these a risk rating of high, medium or low.
Internal audit considered the following factors, as well as knowledge of the bank, in determining the risk rating for each auditable area:
Discussions with bank management, which provided insight regarding issues and risks in the auditable areas
Potential impact that the auditable area may have on the financial position of the bank
Other environmental factors, such as past audit results, changes in personnel and operations, past and current emphasis by regulators, and future business strategies
This risk assessment process will be performed on an ongoing (at least annually) basis to ensure changing risk factors, including losses, operational changes or turnover, are continually monitored.
A cycling approach to the internal audit plan was used, whereby high-risk areas are audited on an annual basis, and medium- to low-risk areas are audited over a 18- to 24-month cycle.

4. Likelihood of control/process issues
Risk Map - ABC Bank
Medium Risks
High Risks
Low Risks
High
Low
Significance
Likelihood of control/process issues
Disaster Recovery
Commercial Lending
Finance
IT Applications
Community Reinvestment Act
Software Licensing
Logical Security/Security Admin.
IT Telecommunications
Operations Support
Small Business Lending
Local Area Network
Centralized Doc. Unit
Treasury/Investments/ALM
Central Services
Internet Conn./Firewall
New Product Development
Real Estate Lending
Commercial Business Lending
SBA Center II I
Branch Network
Loan Administration Dept.
Financial Products
Marketing/Promotions
Human Resources/Payroll
Credit Administration
Appraisal Department
Facilities
Risk assessment used to rank auditable areas by significance of risk, meaning, how much could the bank be affected if a control breakdown occurred in the area, and by likelihood, meaning, how likely is it that something could go wrong. Likelihood considers two components -- what is the inherent likelihood and what is the likelihood given the current environment at the Bank.
Coverage of auditable areas will therefore include any areas denoted as high or medium risk, and certain of those areas considered low risk generally, although management has concerns about these areas. All high and medium are covered, and the two low covered are branches and human resources. IV
III

5. Total Budgeted Audit Hours
Summary Audit Plan
Audit Area
Risk Assessment
Budgeted Hours
Treasury/Investments/ALM
High X
Real Estate Lending
Central Services
Commercial Business Lending
SBA Center
New Product Development
Internet Connectivity/Firewall
Centralized Documentation Unit
Medium
Logical Security & Security Admin
Local Area Networks
IT Telecommunications
Disaster Recovery Planning
Software Licensing
Finance/Accounting/Accts Payable
Operations Support
Community Reinvestment Act
Branch Network
Low
Human Resources/Payroll
Discretionary NA
Planning, Admin & Reporting to AC
Follow-Up on Prior Year Audit Plan
Total Budgeted Audit Hours
Key issues/risks communicated during our discussions with management:
Compliance risk, including Reg B -- inappropriate guarantees taken from spouses, Fair lending and CRA in SBLC
Operational risks, related to consistency of procedures, issues with fraud, monitoring of suspense accounts, efficiencies between branch offices. Other branch network issues include turnover issues, strength of management
Information technology risks -- web based activities,
Human Resource risks -- loss of credit people in Commercial Business centers
Lending risks -- anticipated growth in SBA, accounting for related fee income
New product development -- regulatory aspects, internal communications, reporting mechanisms. Alliances with investment and trust services
Our own assessments include the following:
Central services as high risk because of wire activity
Treasury/investments high risk because of nature of transactions conducted
SBA center because of growth focus in the area and certain complexities of accounting in the area
Lending in general because of marketplace
Internet connectivity -- security, firewall, customer information

6. Summary Focus of Audit Effort During Prior and Current Years
Hours
This is based on total plan hours of approximately 7,600 (3 staff plus Terry), of which 1,800 is non-chargeable hours (924 Admin for Nabors, approx. 320 for staff training, 100 unbudgeted, 120 sick, 200 special investigations). Therefore approximately 5,800 is chargeable hours. Inefficiencies spending 1600 hours on branches, versus 400 hours in our plan (diff of 1,200) gets to(5,800-1,200) 4,600. Our total plan hours are approximately 4,500.

7. Significant Changes in Audit Plan from Prior to Current Year
As is depicted on the preceding page, the following summarizes the most significant changes seen in the audit plan for this year versus last:
Greater emphasis on lending activities, including centralized documentation unit, based on risk assessment process
Significant re-allocation of time from branch network to centralized/back office operational activities based on our risk assessment process. For branch network, focus to be on high-risk activities, including branch losses, wire initiation, etc.
Increased discretionary time for special projects
Reduced administration time, as well as no allocation for training, vacation or sick leave

8. Internal Audit Schedule
= Planned
= In Process
= Completed

9. Internal Audit Schedule (Contd.)
= Planned
= In Process
= Completed

10. Internal Audit Schedule - Regulatory Compliance
Federal/state regulations reviewed as part of the audit plan
As part of our review of the identified business processes and retail branches, internal audit will integrate compliance testing of the following regulations:
Internal audit will coordinate with ABC Bank’s compliance officer when determining the scope and degree of work to be performed for compliance-related issues.