Bank Audit: What Community Banks and Credit Unions Must Know

A bank audit examines a financial institution’s financial statements, internal control environment, loan portfolio quality, investment holdings, and compliance with applicable banking regulations. Independent auditors test whether the institution’s books reflect actual financial position under generally accepted accounting principles (GAAP), and whether controls are strong enough to prevent and detect material misstatement or fraud. For community banks and credit unions in particular, the scope of a financial institution audit is shaped by asset size, charter type, and the regulator overseeing the institution.

What Does a Bank or Credit Union Audit Examine?

A financial institution audit covers five interconnected areas: the accuracy of the financial statements, the adequacy of the allowance for credit losses, the effectiveness of internal controls over financial reporting, compliance with laws and regulations, and the integrity of information technology systems that support financial reporting. Auditors gather evidence by testing a sample of loan files, confirming deposit balances with account holders, reviewing investment valuations, tracing interest income calculations, and evaluating management’s key accounting estimates. The goal is an independent opinion on whether the financial statements present fairly, in all material respects, the institution’s financial position and results of operations.

Who Regulates Bank and Credit Union Audits?

Federal Deposit Insurance Corporation: 12 CFR Part 363

For insured depository institutions, the primary federal audit mandate comes from Section 36 of the Federal Deposit Insurance Act and its implementing regulation, 12 CFR Part 363. The FDIC finalized significant threshold changes effective January 1, 2026:

• Annual independent financial statement audit: Institutions with $1 billion or more in consolidated total assets (raised from $500 million).
• Management assessment of internal control over financial reporting: Institutions with $5 billion or more in total assets (raised from $1 billion).
• Fully independent audit committee: The threshold rose from $3 billion to $5 billion in total assets. The rule also raised the compensation threshold used to gauge director independence from $100,000 to $120,000.

The final rule, approved by the FDIC on November 25, 2025 and effective January 1, 2026, also established an indexing methodology so these thresholds keep pace with inflation over time. The changes provide burden relief to institutions that fall below the updated thresholds, while still covering the large majority of industry assets. Smaller insured banks below the $1 billion threshold are not legally required to obtain a Part 363 audit, but regulators and boards of directors generally expect some form of independent assurance. Many choose a voluntary external audit, a balance-sheet-only audit, or an agreed-upon procedures engagement.

NCUA: 12 CFR Part 715 and Part 704

Credit unions operate under a parallel framework administered by the National Credit Union Administration. 12 CFR Part 715 requires every federally insured credit union to obtain an annual supervisory committee audit, conducted at least once per calendar year. Depending on asset size and charter type, that audit may be:

• A full financial statement audit performed by a licensed CPA under generally accepted auditing standards (GAAS), required for larger credit unions.
• An “Other Supervisory Committee Audit” using minimum procedures prescribed in Part 715, Appendix A, available to smaller credit unions that fall below the financial statement audit threshold.
• A verification of members’ accounts, confirming that records match member passbooks and statements.

Corporate credit unions are governed by the additional requirements of 12 CFR Part 704.15, which mandates financial statement audits and specific reporting to the NCUA board.

State-Chartered Institutions

State-chartered banks and credit unions may face additional audit and reporting requirements imposed by their state banking department. Requirements vary materially by state, so finance leaders at state-chartered institutions should confirm obligations with their primary regulator in addition to the federal baseline.

Core Areas of a Financial Institution Audit

Loan Portfolio and Allowance for Credit Losses

The loan portfolio is typically the largest asset on a bank’s or credit union’s balance sheet, and it carries the most estimation risk. Under the Current Expected Credit Loss (CECL) methodology, which replaced the incurred-loss model under ASC 326, institutions must estimate lifetime expected credit losses on loans measured at amortized cost at the time of origination. Auditors focus heavily on:

• Model validation. Is the institution’s CECL model conceptually sound, and does it use reasonable and supportable forecasts of economic conditions?
• Segmentation. Are loans grouped into pools with similar risk characteristics?
• Qualitative adjustments. Are management’s overlays to the quantitative output documented, supportable, and consistent with observable portfolio trends?
• Underwriting and credit risk management. Do written policies match actual practice? Is there evidence of exception tracking and escalation?

The NCUA’s 2026 supervisory priorities letter noted that overall delinquency and rolling 12-month loss rates in federally insured credit union loan portfolios are at their highest levels in more than a decade, making allowance adequacy a focal point for both examiners and external auditors this cycle.

Investment Portfolio and Valuation

Banks and credit unions typically hold significant investment securities portfolios classified as held-to-maturity, available-for-sale, or trading under ASC 320. Auditors test whether:

• Securities are properly classified based on management’s intent and ability.
• Fair values are determined using appropriate valuation inputs, with Level 1, 2, and 3 disclosures correctly applied under ASC 820.
• Unrealized losses are evaluated for credit-related impairment requiring recognition in earnings versus non-credit factors eligible for deferral in other comprehensive income.

Interest rate risk is a secondary but related audit consideration. The NCUA’s 2026 priorities explicitly called out the need for credit unions to maintain sound interest rate risk modeling and robust contingency funding plans, both of which also inform audit risk assessments around going concern and liquidity disclosures.

Deposits and Funding

Deposit liabilities represent the core funding base of any community bank or credit union. Auditors confirm deposit balances through direct confirmation with a sample of account holders. The AICPA’s Auditing Standards Board issued Statement on Auditing Standards No. 150, External Confirmations, in 2026, which strengthens confirmation procedures and adds a requirement to confirm cash and cash equivalents held by third parties. SAS No. 150 takes effect for audits of financial statements for periods ending on or after December 15, 2028, with early adoption permitted, so most institutions still follow the existing confirmation standard for now. Auditors also test accrued interest payable calculations, time deposit maturities, and the completeness of brokered deposit disclosures.

Internal Controls Over Financial Reporting

Even institutions below the Part 363 threshold for a formal internal control assessment benefit from an auditor’s evaluation of controls. Under GAAS, auditors at all institutions must obtain an understanding of internal controls relevant to the audit and assess whether control deficiencies represent material weaknesses, significant deficiencies, or other deficiencies requiring communication to management and the audit committee. Common control findings at community financial institutions include:

• Segregation of duties limitations, particularly in smaller back-office operations.
• Inadequate review controls over the loan origination-to-accounting workflow.
• IT general controls weaknesses, including access management and change management for core banking systems.

Regulatory Compliance

A financial statement audit under GAAS is not the same as a regulatory examination, but the two overlap. Auditors consider compliance with laws and regulations whose violation could have a material effect on the financial statements. For banks and credit unions, this typically includes Bank Secrecy Act and anti-money laundering program requirements, consumer protection laws such as the Truth in Lending Act and Equal Credit Opportunity Act, and capital adequacy rules. Material BSA violations, for example, can result in civil money penalties that constitute contingent liabilities requiring accrual or disclosure.

How the Audit Process Works

A typical bank or credit union audit unfolds in three phases:

1. Planning and risk assessment. The audit team gains an understanding of the institution, its operating environment, and significant changes during the year. Auditors identify areas of higher inherent risk, such as complex financial instruments, concentrated loan portfolios, or significant accounting estimates, and tailor their procedures accordingly.

1. Fieldwork. Auditors test controls (when relying on them to reduce substantive testing) and perform substantive procedures, including analytical procedures, transaction testing, and external confirmations. For community banks and credit unions, fieldwork often includes on-site visits to review loan files, examine collateral documentation, and interview key personnel.

1. Reporting. The engagement concludes with the audit opinion on the financial statements, any required communications to the audit committee or supervisory committee about significant findings, and, where required, a report on internal control over financial reporting.

Institutions subject to Part 363 must file their Part 363 Annual Report with the FDIC, their primary federal banking regulator, and any applicable state supervisor. The report is due within 90 days after fiscal year-end for a public institution or a subsidiary of a public holding company that meets the asset test, and within 120 days for other institutions. Any management letter or similar report from the independent accountant must be filed within 15 days of receipt.

The Difference Between an External Audit and a Regulatory Examination

Finance leaders sometimes conflate an independent audit with a regulatory examination conducted by the FDIC, the Federal Reserve, the OCC, or the NCUA. These are distinct processes with different purposes:

• An external audit is performed by an independent CPA firm, results in an audit opinion for use by management, boards, investors, and regulators, and is governed by GAAS (for non-public institutions) or PCAOB standards (for publicly traded banks).
• A regulatory examination is conducted by the institution’s primary regulator, focuses on safety and soundness, compliance, and capital adequacy, and results in a confidential CAMELS supervisory rating. Banks and credit unions both use the six-component CAMELS framework. The NCUA adopted CAMELS for federally insured credit unions effective April 1, 2022, adding the “S” for sensitivity to market risk to the former five-component CAMEL system.

Both processes are important, and audit findings can inform examiner focus and vice versa. A clean audit opinion does not guarantee a strong examination rating, nor does a satisfactory examination preclude audit findings.

Preparing for a Financial Institution Audit

Finance teams and supervisory committees can take concrete steps to reduce audit friction and timeline:

• Maintain complete, current loan files. Missing credit analyses, stale appraisals, and incomplete modification documentation are among the most common causes of audit delays.
• Document CECL model assumptions. Auditors expect to see written support for economic forecasts, loss rate lookback periods, and qualitative adjustments before fieldwork begins.
• Reconcile subsidiary ledgers to the general ledger monthly. Unexplained reconciling items discovered during the audit expand the scope of testing.
• Prepare a thorough prepared-by-client package. A well-organized PBC list with complete, clearly labeled schedules allows the engagement to move faster, reducing time and cost.
• Confirm audit committee or supervisory committee independence. Institutions at or near the new Part 363 thresholds should verify their committee composition meets current regulatory requirements.

Modus auditors work with financial institutions on audit and assurance engagements structured around these priorities, using source-linked workpapers and systematic PBC tracking to shorten turnaround and reduce back-and-forth with client teams. See also our broader financial services industry practice for context on how audit planning differs across institution types.

Related reading: Professional Services Accounting: WIP, Unbilled Revenue, and Partner Comp

Frequently Asked Questions

What is a bank audit?

A bank audit is an independent examination of a bank’s or credit union’s financial statements, internal controls, loan portfolio, investment holdings, and regulatory compliance. A licensed CPA firm performs the audit under generally accepted auditing standards and issues an opinion on whether the financial statements present fairly, in all material respects, the institution’s financial position.

Are all banks required to have an annual audit?

Not all banks face a mandatory external audit requirement, but most are expected to have some form of independent assurance. Under 12 CFR Part 363, insured depository institutions with $1 billion or more in consolidated total assets (as of the beginning of the fiscal year, effective January 1, 2026) must obtain an annual independent financial statement audit. Smaller institutions are not required to do so under federal law, but many choose voluntary audits to satisfy board expectations, investor requirements, or lender covenants.

What is the difference between an NCUA examination and a credit union audit?

An NCUA examination is conducted by federal agency staff and focuses on safety, soundness, and regulatory compliance, resulting in a confidential CAMELS rating (the NCUA adopted the six-component CAMELS system for credit unions in April 2022). A credit union audit is performed by an independent CPA or other qualified party, results in an auditor’s report on the financial statements or a supervisory committee audit report, and is available to the board, supervisory committee, and regulators. Both are required on a regular basis but serve different purposes.

What is CECL and why does it matter for a bank or credit union audit?

CECL stands for Current Expected Credit Loss, the accounting methodology under FASB ASC 326 that requires financial institutions to estimate lifetime expected credit losses on loans at origination rather than waiting for losses to become probable. CECL significantly expanded the use of management judgment and forward-looking economic forecasts in determining the allowance for credit losses, making it one of the most heavily scrutinized areas in a bank or credit union audit.

What triggers a material weakness in a community bank’s internal controls?

A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting that creates a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis. Common triggers at community banks include inadequate segregation of duties in the loan accounting function, insufficient management review of the CECL allowance model, and IT general control failures such as excessive user access privileges in the core banking system.

How long does a community bank or credit union audit take?

Timing varies by institution size and complexity. A community bank with under $500 million in assets might complete fieldwork in two to four weeks, with the full engagement from planning through report issuance spanning two to three months after fiscal year-end. Larger or more complex institutions, or those with significant accounting estimates or first-year audit challenges, may take longer. A well-prepared PBC package and responsive finance team are the most reliable ways to keep the timeline on track.