1. Strong Internal Audit Association of International Bank Auditors – Regulatory Panel June 9, 2011 Carlos D. Henández International Banking Supervision Comptroller of the Currency Administrator of National Banks

2. Industry Landscape  Uncertain economic environment  Heightened compliance, reputation, and strategic risks  More complex regulatory environment  Increased cyber threats to bank systems and information security

3. Our Challenge Ensure that national banks and thrifts strengthen risk management and stress-testing processes to better identify, measure, monitor and mitigate build-ups in risks, including concentrations, at an early stage.

4. Areas of Heightened Expectations Elevating expectations for governance of large national banks in the following areas:  Board willingness to provide credible challenge,  Talent management and compensation,  Risk appetite – defining and communicating across the company,  Development and maintenance of strong audit and risk management functions

5. Definition of Internal Audit The primary role of internal audit (IA) is to independently and objectively review and evaluate bank activities to maintain or improve the efficiency and effectiveness of a bank’s risk management, internal controls, and corporate governance. Source: Comptroller’s Handbook for Internal and External Audits, April 2003

6. Key Expectation Internal auditors must understand a bank’s strategic direction, objectives, products, services, and processes to conduct these activities.

7. A Strong IA Function:  Is very proactive, highly anticipatory and systemically focused  Is highly successful in effecting change  Attains the highest level of respect and stature in the organization

8. Strong IA – Key Attributes  Robust Board and Audit Committee (Committee) Engagement/Oversight  Strong Audit Management  Highly Effective Audit Processes  Highly Effective Audit Reporting  Competent IA Staff

9. Expectations for Federal Branches  High Impact Branches* – Strong IA  All Other Branches – Sound IA  Gap Assessment and Tracking  Communication of Expectation and Timeframes