FFIEC IT Examination Handbook AUD-02: Board of Directors and Senior Management (Audit)

The board and senior management are responsible for an internal control system that works, and the board or its audit committee provides an internal audit function able to evaluate IT controls, engages outside auditors to perform it, or combines both so that IT audit coverage is adequate; audit committee members understand why an independent audit function matters, public and larger institutions must have independent audit committees under Sarbanes-Oxley and 12 CFR 363 and others are expected to follow those as good practice; the board adopts written guidelines for conducting IT audits and assigns responsibility for the internal audit function.