Banking Internal Controls Checklist: BSA, Vendors, and Audits

A banking internal controls checklist should track the same categories bank examiners and auditors evaluate: governance and financial reporting certifications, segregation of duties, Bank Secrecy Act filings, information systems and physical security, third-party risk, business continuity, and the documentation that proves each control actually works. Section 39 of the Federal Deposit Insurance Act requires every insured institution to maintain internal controls appropriate to its size and activities, and the items below map to the federal standards that drive supervisory reviews.¹

Governance and Financial Reporting

The first block of the checklist confirms that the board and senior management have signed off on the controls in writing. Federal law requires the chief executive officer and chief financial officer to sign an annual management report stating their responsibility for maintaining adequate internal controls over financial reporting and for complying with designated safety and soundness laws.²

Requirements scale with size. Institutions with $1 billion or more in consolidated total assets file an annual report with audited financial statements and the management responsibility statement. At $5 billion or more, management must also formally assess whether internal controls over financial reporting are effective, identify the evaluation framework used, and disclose any material weaknesses unremediated at year-end. An independent public accountant then issues a separate opinion on the effectiveness of those controls.³⁴

Confirm that the internal audit function reports directly to the board rather than to line management. That structure keeps department heads from pressuring auditors to soften findings about their own areas.

Segregation of Duties and Dual Control

The person who initiates a transaction should never be the same person who authorizes it or reconciles it afterward. Sample transactions to verify that the loan officer who approves a loan is not also disbursing the funds, and that a teller who processes deposits cannot post adjustments to those same accounts.

Dual control items to check:

Vault access requires two employees, each holding a separate combination or key.
Wire transfers, large cash shipments, and changes to customer account master files require two-person authorization.
Dormant account reactivations require supervisor authorization, and the person reviewing dormant account reports does not have authority to process transactions on those accounts.⁵
Reactivated accounts are evaluated for unusual follow-on activity such as new debit card requests, address changes, or online banking additions.

General ledger accounts should be reconciled daily. Suspense accounts holding unidentified or temporary funds need particular attention; while no single federal regulation prescribes a clearing deadline, items should be investigated and cleared as quickly as possible with reviews at least monthly.

Bank Secrecy Act and Anti-Money Laundering

BSA/AML is the area most likely to trigger enforcement actions when controls fail. Three obligations sit at the center of the checklist.

Currency Transaction Reports. A CTR is required for any transaction involving more than $10,000 in currency, whether a deposit, withdrawal, exchange, or transfer.⁶ Teller training and monitoring systems must flag patterns suggesting structuring, where a customer breaks transactions into smaller amounts to evade the threshold.

Suspicious Activity Reports. A SAR is required for any transaction of $5,000 or more that the bank knows or suspects involves illegal activity, is designed to evade BSA requirements, or has no apparent lawful purpose.⁷ Criminal violations involving insider abuse carry no dollar threshold. SARs must be filed within 30 calendar days of detecting suspicious activity, extending to 60 days when no suspect can be identified. Continuing SARs on ongoing activity are filed at least every 90 to 120 days.⁸

Customer due diligence. Banks must identify and verify beneficial owners of legal entity customers and keep records of that information.⁹ Confirm that transaction monitoring systems are calibrated, staff training is current, CTR and SAR filings are timely, and customer risk ratings are periodically reviewed.

Wire and ACH Recordkeeping

For funds transfers of $3,000 or more, the originating bank must collect and retain the sender’s name and address, the payment amount, the date, any payment instructions, and the beneficiary’s identifying information.¹⁰ Transfers governed by the Electronic Funds Transfer Act or made through ATMs and point-of-sale systems are exempt.¹¹

Nacha operating rules require annual ACH compliance audits. Beginning March 20, 2026, new fraud monitoring rules require originators, third-party senders, and both originating and receiving financial institutions to implement processes for identifying fraudulently initiated credit entries, using methods like velocity checks, anomaly detection, and pattern recognition.¹²

Information Systems and Physical Security

The Gramm-Leach-Bliley Act requires financial institutions to safeguard customer information through administrative, technical, and physical measures.¹³ The FFIEC IT Examination Handbook sets the standards examiners apply.

Least-privilege access items to verify:

User profiles align with job descriptions, and business owners define and approve those profiles.
Independent periodic reviews confirm access remains appropriate.¹⁴
Every employee has a unique user ID; shared credentials are eliminated.
Multi-factor authentication and password complexity requirements are enforced.

Employee offboarding is where access controls most often fail. The FFIEC calls for timely notification from human resources to security administrators to adjust access based on job changes, including terminations. Confirm that access is disabled on the employee’s last day, that involuntary terminations trigger disabling before the employee leaves the building, and that a lookback process compares actual termination dates against the dates accounts were disabled.

Physical safeguards to check include time-locked vaults, high-definition surveillance systems, restricted teller stations, and controlled access to server rooms. IT should maintain a current inventory of all hardware and software so rogue devices or unpatched applications can be identified.

Third-Party and Vendor Risk

The June 2023 interagency guidance from the OCC, FDIC, and Federal Reserve makes clear that the board retains ultimate oversight of third-party risk, and management must develop practices proportionate to each vendor relationship.¹⁵ Check that each critical vendor has documentation covering all five lifecycle stages:

Planning: risks were evaluated before the relationship began, including alignment with strategic goals and risk appetite.
Due diligence: the vendor’s financial condition, information security program, personnel qualifications, and legal and regulatory history were assessed.
Contract negotiation: the written agreement addresses performance expectations, audit rights, data ownership, business continuity, and termination provisions.
Ongoing monitoring: performance and risk are continuously assessed, at a depth proportionate to the risk involved.
Termination: a plan exists for transitioning activities, bringing them in-house, or winding them down.

Gaps in vendor oversight have been a consistent theme in recent enforcement actions, so examiners scrutinize this area closely.

Business Continuity and Disaster Recovery

The FFIEC IT Examination Handbook expects institutions to define recovery time objectives for each critical system, maintain backup arrangements capable of supporting normal transaction volumes for an extended period, and test those arrangements at intervals consistent with the risk involved.

Items to verify:

Backup sites are functionally independent from the primary site and geographically separated so a single event cannot take out both.
Trained staff are available at the backup location and are independent of the primary site’s team.
Tests validate whether recovery time objectives can actually be met, whether systems work at realistic transaction volumes, and whether manual workarounds function when automated systems are unavailable.
The bank participates in the testing programs of critical third-party service providers.

Documentation to Pull Before the Review

Incomplete records make a reliable conclusion impossible. Gather these before testing begins:

Daily general ledger reconciliations showing internal accounts tie to actual cash positions.
Wire transfer logs identifying the initiator, authorizer, beneficiary, amount, and date for each wire.
Current employee access lists from IT or HR, cross-referenced against job descriptions.
Override reports documenting every instance where a manager bypassed standard system limits, including who authorized the override and why.
SAR and CTR filing logs showing the dates activity was detected and the dates reports were submitted.
Vendor due diligence files for each critical third-party relationship, with completed assessments and ongoing monitoring records.

Every log entry should carry the date, time, and specific individuals involved. An override is not inherently a problem, but an override without a documented justification is a red flag examiners will pursue.

Running the Review

The review verifies that actual behavior matches written policy. Pull a random sample of transactions, commonly around five percent of wire transfers from the previous quarter, and check each against the operating manual and applicable regulations. A missing authorization signature, an unexplained override, or a wire log that does not identify the authorizer gets documented as a finding.

Classifying Findings

Findings fall into three tiers, and classification drives what happens next:

Control deficiency. The control’s design or operation does not allow employees to prevent or detect errors in the normal course of their work. It needs attention but may not require disclosure.
Significant deficiency. Less severe than a material weakness but important enough to warrant the attention of those overseeing financial reporting. A significant deficiency alone does not necessarily require public disclosure.
Material weakness. There is a reasonable possibility a material misstatement in financial statements will not be caught in time. Material weaknesses must be disclosed, and management cannot conclude that internal controls are effective if even one remains unremediated at year-end.⁴

There is no bright-line dollar threshold separating a significant deficiency from a material weakness; the judgment turns on the likelihood and magnitude of the potential misstatement. The consequences are concrete, though: a material weakness triggers an adverse opinion on internal controls in an integrated audit, while a significant deficiency is communicated to management and the audit committee without necessarily going public.

Reporting and Remediation

Compile findings into a formal report to the audit committee and senior management outlining each weakness, its potential risk, and a recommended corrective action. Management provides a written response with steps and a timeline. A follow-up review confirms the changes were implemented and are working.

What Happens When Controls Fail

Section 39 of the FDI Act requires federal banking agencies to prescribe standards for internal controls, information systems, and internal audit at every insured institution.¹⁶ The FDIC’s safety and soundness guidelines require clear lines of authority, effective risk assessment, timely and accurate reporting, adequate asset safeguards, and compliance with applicable laws.¹

Under Section 8(i)(2) of the FDI Act, the FDIC can assess civil money penalties in three tiers for violations of laws, regulations, final orders, or for unsafe and unsound practices. Penalties are paid to the U.S. Treasury.¹⁷ Beyond fines, regulators can issue formal enforcement actions requiring specific corrective measures, restrict an institution’s activities, or remove individual officers and directors.

1
eCFR. 12 CFR Part 364 – Standards for Safety and Soundness
2
Office of the Law Revision Counsel. 12 USC 1831m – Early Identification of Needed Improvements in Financial Management
3
Federal Deposit Insurance Corporation. Part 363 – Summary of Filing Requirements
4
eCFR. 12 CFR Part 363 – Annual Independent Audits and Reporting Requirements
5
National Credit Union Administration. Dormant Accounts – Examiners Guide
6
eCFR. 31 CFR 1010.311
7
eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions
8
FFIEC BSA/AML InfoBase. Suspicious Activity Reporting – Overview
9
Federal Register. Customer Due Diligence Requirements for Financial Institutions
10
FFIEC BSA/AML InfoBase. Funds Transfers Recordkeeping – Overview
11
Financial Crimes Enforcement Network. FinCEN Advisory – Funds Travel Regulations Questions and Answers
12
Nacha. Credit-Push Fraud Monitoring Resource Center
13
Federal Trade Commission. Gramm-Leach-Bliley Act
14
Federal Financial Institutions Examination Council. IT Examination Handbook – Information Security Booklet
15
Federal Register. Interagency Guidance on Third-Party Relationships Risk Management
16
Federal Deposit Insurance Corporation. Section 39 – Standards for Safety and Soundness
17
Federal Deposit Insurance Corporation. Restitution and Civil Money Penalties