COLORADO DIVISION OF BANKING

INTERNAL CONTROL QUESTIONNAIRE

Charter No. Institution Name Examination As Of Date

INSTRUCTIONS: A management official of the institution should complete this questionnaire. Management must
provide the examiner with an adequate written explanation of all "No" answers, with an appropriate reference to
the question, and supply copies of applicable written procedures. If a question is not applicable to the institution,
respond with NA.

Verified
By
Examiner Yes No

INTERNAL AUDIT

1. Does the institution have an internal audit program?

2. Does the internal audit program contain written, specific instructions for audit
procedures for the internal auditor to perform?

3. Does the board of directors or the audit committee review internal audit reports?

4. Does the audit committee consist only of outside directors?

5. Do internal audit reports suggest actions to correct internal control or procedural

deficiencies?

6. Is there a subsequent review to ascertain that the institution implemented suggestions

for corrective actions?

7. Does the internal auditor report to or receive salary reviews by the audit committee or
board of directors?

8. Did the external auditor communicate any reportable conditions, either orally or in
writing, to management, the board of directors, or the audit committee?

9. Does the institution reconcile the following accounts to the general ledger at least daily
(if activity is minimal, weekly or monthly reconciliations may be appropriate)?
 Loans in process
 Suspense accounts
 Accounts out of balance

10. Does the institution reconcile the following accounts to the general ledger at least
monthly?
 Loans
 Investment securities
 Real estate owned
 Borrowings
 Checking and deposit accounts

11. Does a person not involved in general ledger entries perform the reconciliations?
 Person responsible.

internalcontrolquestionnaire-rev11/22 Page 1 of 13
 Verified
By
Examiner Yes No

12. Does a person not involved in the transactions periodically review and investigate
activity on exception and/or large items report(s)?
 Person responsible.

13. Does the institution perform a regular review of insider activity for unusual activity and
compliance with Regulation O?

14. Does the institution appropriately capitalize and expense all items?

15. Does the institution periodically review deferred asset and liability accounts?

16. Does the institution clearly show the nature and purpose of each entry to the deferred
asset and liability accounts?

17. What is the name and position of the person authorized to make entries to the
deferred asset and liability accounts?
 Person responsible.
 Position of person.

18. Does the institution balance and reconcile to third-party reports monthly any institution
assets that others service or hold in safekeeping?
 Person responsible.

CASH AND CASH ITEMS

19. Does the institution reject checks when the collected balance of the customer's
demand deposit account is not sufficient to cover the item?

20. Are all personnel who have cash approval and disbursement authority required to take
annual vacations of at least two consecutive weeks?

21. Does an independent officer review all overdraft activity?

 Person responsible.

22. Are controls in effect to prevent withdrawals of uncollected funds?

23. Does the institution promptly record on the books returned items previously
deposited?

24. Are procedures adequate to ensure that the institution monitors and clears uncollected
items?
 Person responsible.

25. If the institution maintains a petty cash fund, are all additions and withdrawals
documented?

26. Does the institution balance the petty cash fund periodically?

27. Does the institution have procedures that prevent the use of liquid assets of the
institution as compensating balances or collateral for personal loans of officers,
directors, or employees?

28. Does the institution record cash items appropriately in the general ledger?

internalcontrolquestionnaire-rev11/22 Page 2 of 13
 Verified
By
Examiner Yes No

29. Does the institution review teller and accounting system override reports and file
maintenance summaries for unusual activity on a regular basis?
 Person responsible for
accounting overrides.
 Person responsible for teller
overrides.

30. Are loan accounting systems included in the override reports?

31. Are personnel who have control over cash barred from performing overrides?

32. Do only designated personnel who have no control over cash approve and review
overrides?

33. Does the institution, at both home and branch offices, perform daily cash
reconciliations?

34. Does a person without teller responsibilities perform the daily cash counts?

35. Are overages and shortages properly recorded in a cash over and short account?

36. Does the institution maintain records showing the person involved in the cash over or
short situation?

37. Does the institution investigate and act upon all cash over and under amounts?

38. Does the institution have appropriate controls over unissued deposit certificates,
travelers' checks, savings bonds, food stamps, and other consigned items?
 Person responsible.

39. Does the institution periodically reconcile consigned items?

 Person responsible.

INSTITUTION (OFFICIAL) CHECKS

40. For checks signed by hand: Are two signatures (signer and approver) required on
institution (official) checks?
 Names of persons
authorized to sign.

41. For checks signed by hand: Are unsigned blank checks in the possession of an officer
or employee who does not have singular signature authority?
 Responsible officer or
employee.
 Position title.

42. For checks signed by stand-alone mechanical or electronic facsimile check signing
machines connected to computers: Is the inventory of unsigned blank checks
available verified daily and compared to the work of other positions that issue checks
during the day?
 Person(s) responsible.

43. For checks signed by stand-alone mechanical or electronic facsimile check signing
machines connected to computers: Is there an approval process for checks in excess
of a certain dollar amount?

internalcontrolquestionnaire-rev11/22 Page 3 of 13
  If so, what is the amount?

Verified
By
Examiner Yes No

44. For checks signed by stand-alone mechanical or electronic facsimile check signing
machines connected to a computer: Is the institution's copy of the check voucher
initialed by the persons preparing the check and, for those checks in excess of a
certain amount, initialed by a person authorized to approve?

45. Does the institution have controls in place to ensure that the employee fills out the
amount of the check and payee information before the signatures are on the checks?
 Person responsible.

46. Is the supply of unused checks periodically reconciled to the shipping invoice by
persons without signature authority?
 Person responsible.
 How often?

47. Does a person independent of the check writing function review the paid (canceled)
checks for proper signatures and reconcile the checks to vouchers?
 Person responsible.
 How often?

48. Does the institution periodically reconcile outstanding checks to vouchers and liability
accounts?

49. Does the institution periodically transfer all outstanding six-month old institution
checks to a liability account?

50. Does the institution keep the facsimile check writing machine under proper control?

DUE FROM BANKS

51. The institution receives bank statements:

Daily: Monthly: Quarterly:

52. Does the institution reconcile bank accounts on a regular and timely basis?

53. Are there any unreconciled bank accounts?

 If so, what is the date of the
latest reconciliation?

54. Are there any out of balance accounts?

 If so, what is the date the
institution expects them to
be reconciled?

55. Is the person who reconciles the bank statements independent of the deposit and
check writing process?
 Person responsible.

56. Do checks drawn on bank accounts need more than one signature?

57. Does a person who does not have signature authority periodically reconcile unsigned
checks to the shipping invoice?
 Person responsible.
 How often?

internalcontrolquestionnaire-rev11/22 Page 4 of 13
 Verified
By
Examiner Yes No

INVESTMENT AND SECURITIES

58. Is documentation supporting account entries, broker's advice, and journal entries
received and maintained by a person independent of the authorized trading officer?

59. Does the institution maintain an investment security ledger or worksheet that details
all securities held and all security transactions?

60. Are the security ledger totals for principal and accrued interest, balanced to the
general ledger at least monthly by an independent person?
 Person responsible.

61. Does the institution have procedures to ensure that they collect all income due on the
investment security portfolio promptly?

62. Does the institution have procedures that will indicate any relationship between
brokers who purchase securities for the institution and institution officers, directors, or
employees?

63. If the board of directors authorized an officer to have sole authority to purchase and
sell securities, is the authority limited to fixed dollar amounts, above which a second
officer must approve the transaction before its commitment?
 Authorized person(s).
 Limits.

64. Does the institution prohibit broker/dealers from having discretionary trading authority?

65. Does the institution place all orders only with broker/dealers not affiliated with
investment advisors retained by the institution?

66. Does the institution engage in reverse repurchase agreements and lending of
securities only with firms designated by the Federal Reserve Board as primary dealers
in government securities?

67. Does a person who does not execute or book transactions receive confirmations from
the broker/dealer?
 Person responsible.

68. Does a person without transaction authority receive monthly statements direct from
the brokerage firm indicating all transactions during the period?
 Person responsible.

69. Are all securities transactions for delivery versus payment?

70. Does the institution prohibit "free" deliveries in written contracts with depositories and
safekeeping agents unless approved by two senior officers?

71. Does the institution hold securities on the premises under dual control?

72. Is an independent party performing tests to determine that the yield on investments
actually received in line with the weighted average coupon of such assets?
 Name of the independent
party.
 How often.
 Date of last test.
 Period analyzed.

internalcontrolquestionnaire-rev11/22 Page 5 of 13
internalcontrolquestionnaire-rev11/22 Page 6 of 13
 Verified
By
Examiner Yes No

GENERAL LENDING

73. Does the institution have and adhere to a written schedule of fees and rates charged
on new loans?

74. Does the institution policy limit the number or amount of loans involving any individual
borrower or contractor?

75. Is there a procedure of internal review to ensure compliance with the above policy by
a person or persons who are independent of the loan approval process?

76. Are there procedures, and does staff follow the procedures, to periodically review and
document the adequacy of the ALLL?

77. Are the persons that periodically review and document the adequacy of the ALLL
independent of the loan approval function?

78. Does the institution defer loan fees in accordance with generally accepted accounting
principles (GAAP), and not recognize fees as current period income?

79. Are lending officers prohibited from authorizing loan disbursements?

80. Do persons independent of the loan officer obtain or verify credit information?

81. Are lending authorities, granted by the board of directors, setting tiered dollar limits for
individuals, co-approval limits for committees, and high limits for approval by the board
of directors?

82. Is there a record system that lists the total of outstanding credits and commitments
(direct and indirect) for each borrower?

CONSTRUCTION LENDING

83. Are inspectors rotated at least every third inspection and for final draws?

84. If the institution does not rotate inspectors, does the inspector's supervisor perform
review inspections?

85. Is there segregation of duties between inspection and disbursement functions?

86. Does the institution prohibit disbursing loans in cash or to third parties?

87. Does the institution compare paid bills and lien waivers with items listed for
disbursements?

88. Does the institution have safeguards to ensure that sufficient funds always remain
available to complete construction?

LOAN SERVICING AND RECORDKEEPING FUNCTIONS

89. Does the institution support advances by written evidence or reinspection of property?

90. Are all notes and other loan documents kept in a vault or fire-resistant cabinet and
under a sign-out control system?

internalcontrolquestionnaire-rev11/22 Page 7 of 13
 Verified
By
Examiner Yes No

91. If the institution holds additional collateral, do they safeguard it?

92. Does the institution maintain a record of such collateral?

93. Does the institution obtain written acknowledgment from the borrower for the pledging
of savings accounts or the assignment of life insurance policies?

94. Does the institution adequately control advance loan payments if they do not
immediately credit the advance to the loan account?

95. Does the institution test periodic adjustments to adjustable-rate mortgage loans for
compliance with the terms of the note?

96. Does the institution have written collection policies and procedures that the board of
directors approves?

97. Do collectors document the contact with borrowers and indicate promised action?

98. Are there procedures that ensure the maintenance of necessary hazard, flood, and
other insurance coverages throughout the life of the loan?

ACCRUED INTEREST RECEIVABLE

99. Does the institution perform tests to determine that it is receiving the appropriate
interest?

100. Does a person, independent of the cash receipt and bookkeeping for interest
receivable, perform and document an analysis to determine if the yield on mortgages
and investments actually received is in line with the weighted-average coupon rate of
such assets?

101. Are accounting entries for accrued interest receivable supported by proper
explanations evidencing the nature and purpose of each entry and signed by a
responsible individual?

ADVANCE PAYMENTS BY BORROWERS FOR TAXES AND INSURANCE

102. Is each escrow (impound) account analyzed at least once a year to ensure that the
payments will cover the disbursement(s)?

103. If this analysis results in a revision of monthly payments, is the revision made promptly
and the borrower notified?

104. Does the institution inform borrowers at least annually of the balance in their account
and the most recent years' transactions in that account?

105. Do statements indicate that borrower's disputes regarding the balances of their
escrow accounts be sent to internal audit or a department independent of escrow
transactions?

UNUSED LOAN COMMITMENTS

106. Are unused loan commitments reviewed periodically to determine whether the
institution makes disbursements on a timely basis and in accordance with the terms of
the loan agreements?

internalcontrolquestionnaire-rev11/22 Page 8 of 13
 Verified
By
Examiner Yes No

107. Are periodic tests conducted by personnel not responsible for the unfunded loan
accounts to determine propriety of disbursements?

COMMERCIAL LENDING

108. Does the institution update borrower's and guarantor's financial statements at least
annually?

109. Do qualified individuals evaluate the collateral?

110. Does the institution inspect collateral periodically to ensure maintenance of sufficient
value?

111. Does the institution release collateral only upon the approval of an officer or
committee having a lending limit greater than or equal to the value of the collateral the
institution is releasing?

112. If the institution releases collateral upon payment of the loan, do they release the
collateral only upon receipt of collected funds?

OTHER LOANS (UNSECURED, MOBILE HOMES, ETC.)

113. Are the institution's procedure adequate to ensure compliance with the requirements
of any government agency insuring or guaranteeing the loan?

114. Does the institution maintain an adequate loan register?

(At a minimum should contain the loan number, loan amount, date of loan or date of
purchase, dealer, recourse or repurchase provisions, interest rate, and term.)

115. Do personnel who do not handle cash process loan applications and initial the notes?

116. Do employees not connected with the granting or acquisition of loans collect and
process receipts, and prepare delinquency lists?

117. Are liens and other documents, including titles, promptly recorded?

118. Are there procedures that provide for board of directors approval of charge-offs and
subsequent recoveries?

119. If the institution holds additional or side collateral for unsecured loans, does the
institution also adequately document and safeguard the collateral and maintain a
proper record?

120. Does the institution reference the FHA publications that list companies and individuals
who have not properly performed under FHA programs?

121. Floor planning loans:

 Does the institution make unannounced inventory inspections on a rotating basis

at least every 30 days?

 Do the inventory inspections include, as a minimum, the following: serial number

verification of unit, inventory of equipment and furnishing, condition and location
of unit, and units sold out of trust or rented?

internalcontrolquestionnaire-rev11/22 Page 9 of 13
 Verified
By
Examiner Yes No

 Does the institution maintain records of floor plan inspections?

 Does the institution actually inspect demos at a subsequent date, if necessary?

 Does the institution rotate inspectors or have a supervisor or auditor accompany

them?

 Does the institution inspect and appraise trade-ins for wholesale value?

 Does the dealer submit financial and operating statements monthly?

 Does the institution retain title or lien control?

 Do floor plan agreements provide for periodic reductions (curtailments) in

outstanding unit loan balances?

122. For dealer financing, does the dealer application include the following:

 Business address and location of all sales and storage lots?

 Names of all manufacturers represented and general description of units

stocked?

 A statement as to whether each manufacturer subscribes to the Trust in Invoicing

Practices Statement adopted by the Manufactured Housing Institute?

 A statement as to the willingness of the dealer to sign recourse or repurchase

agreements?

 Name and percentage of ownership of all persons with interests in the

dealership?

CREDIT QUALITY REVIEW

123. Does the institution have a credit quality review program?

124. Does credit quality review include testing for compliance with regulation, institution
policy, officer lending limits, and institution underwriting standards?

125. Does credit quality review include classification or grading of assets?

126. Are the findings of the persons responsible for credit quality review reported directly to
the board of directors?

DEPOSIT ACCOUNT LOANS

127. Are sufficient controls in effect to prevent a loan approver from disbursing loan
proceeds?

128. Does the institution flag pledged deposit accounts to prevent collateral from
withdrawal?

129. Does withdrawal of pledged funds require a supervisory override?

130. Are procedures in effect to ensure that the total loan and accrued interest does not
exceed the balance amount of the deposit account?

internalcontrolquestionnaire-rev11/22 Page 10 of 13
internalcontrolquestionnaire-rev11/22 Page 11 of 13
 Verified
By
Examiner Yes No

131. Are procedures in effect for initial and periodic positive mail confirmations with deposit
loan customers?

132. Are periodic monitoring reports adequate for the review of savings deposit loan
activity?

OTHER REAL ESTATE OWNED AND OTHER REPOSSESSED ASSETS

133. Does the institution follow routine legal procedures that will result in a valid title to the
property and evidence of such title?

134. Does the institution promptly value real estate that it acquires?

135. Does the institution use a current valuation to establish the sales price of a property?

136. Does the institution physically inspect properties at periodic intervals?

137. Do such inspections indicate the condition of the property and occupancy status?

138. Are there maintenance procedures in effect to ensure that properties will retain their
market value?

139. Does the institution maintain separate subsidiary records for each parcel showing
items capitalized, expenses, rentals, etc.?

140. Does the institution balance subsidiary ledgers for the individual properties to the
general ledger at least monthly?

141. Does the institution maintain separate files for each parcel of real estate owned and
are such files complete?

142. Does the institution maintain controls over the receipt of rental income?

143. Does the institution's advertising for the sale or rental of real estate owned comply
with the provisions contained in the Department of Housing and Urban Development's
advertising guidelines?

144. Are agents who collect rents and manage properties bonded?

145. Are security deposits properly controlled?

146. Does the institution have procedures to ensure maintenance of hazard insurance?

FIXED AND OTHER ASSETS

147. Does the institution retain invoices in support of all additions to fixed asset accounts?

148. Does the institution ensure that the accounting department knows about any major
retirement of fixed assets?

149. Does the institution keep a detailed record of fixed assets?

150. Does the institution retain depreciation schedules supporting each asset or class of
assets?

151. Does the institution charge depreciation and amortization expenses at least quarterly?

internalcontrolquestionnaire-rev11/22 Page 12 of 13
 Verified
By
Examiner Yes No

152. Does the institution retain evidence of valid titles for all properties owned?

153. If the institution has rented space in its buildings, does it have adequate control over
the recording and collection of rental income and the control and recording of
expense?

154. Are there record keeping procedures to ensure that the institution maintains adequate
supporting documentation for other assets acquired?

155. Are journal entries prepared that show clearly the nature and purpose of each charge
to expense from deferred accounts and evidence of approval by authorized
personnel?

156. Does the institution have effective control procedures for all large disbursements to
ensure their propriety?

157. Does the institution maintain subsidiary records for the various other asset accounts?

DEPOSIT ACCOUNTS

158. Is there any limitation on the amount of withdrawal that employees may pay without
officer approval?
 If so, what is the amount?

159. Are procedures in effect to ensure the timely and accurate completion of the
appropriate signature cards upon the opening of deposit accounts?

160. Does the institution segregate duties so that persons opening new certificate accounts
do not have sole control over the receipt of cash, account data entry, and the
preparation of certificates or receipts?

161. Does the institution balance the deposit accounts before and after posting of interest
to ascertain correctness of total amount posted?

162. Does the institution maintain general ledger subsidiary accounts for each class of
accounts?

163. Is an analysis made periodically to determine the adequacy of accrued interest earned
and unpaid?

 Person responsible.
 Last as of date.

164. Does the person who performs the analysis have an account at the institution?

165. If so, who reviews the account of the person who performs the analysis?
 Person responsible.

166. Does the institution investigate and adjust differences between the accrual balance
and the interest paid?

167. Does the institution reasonably estimate accruals for reporting purposes?

168. Are policies in effect to maintain compliance with state escheat laws?

169. Does the institution flag dormant accounts so they can monitor activity?

170. Does the institution waive significant amounts of account fees?

internalcontrolquestionnaire-rev11/22 Page 13 of 13
internalcontrolquestionnaire-rev11/22 Page 14 of 13
 Verified
By
Examiner Yes No

171. Does the institution generate a demand deposit overdraft report?

172. Does the demand deposit overdraft report identify the name and position of the
person(s) responsible for approving overdrafts?

173. Does the demand deposit overdraft report identify large borrowers and insiders?

174. Do designated personnel review the demand deposit overdraft reports?

 Person responsible.
 Approval limits?

175. Does the institution generate a check-kiting report?

176. Is the check-kiting report prepared by an individual who does not have an account
with the financial institution or is the preparer's account independently reviewed?

177. Does the check-kiting report identify insiders and major borrowers?

178. Is the person responsible for reviewing check-kiting reports independent of the
preparation of the reports?
 Person responsible.

179. How often does the institution review check-kiting reports?

Daily: Monthly: Quarterly:

DEFERRED CREDITS

180. Does the institution maintain records supporting the recognition of profits resulting
from the sale of real estate owned?

181. Does the institution maintain records supporting loan acquisition credits, deferred and
earned, by semiannual periods?

182. Does the institution amortize loan origination fees in accordance with ASC 310-20?

OTHER LIABILITIES

183. Does the institution maintain a detailed inventory or subsidiary records for the various
other liability accounts?

184. Does a designated officer make periodic reviews of the activity in other liability
accounts?
 Designated officer.

CAPITAL RESERVES

185. Does management review and the board of directors approve all transfers to and from
the capital accounts?

186. Does the institution clearly explain and adequately document all transactions involving
the capital accounts?

187. Does the corporate officer designated in the bylaws or by the board of directors
control stockholder records?

internalcontrolquestionnaire-rev11/22 Page 15 of 13
 Verified
By
Examiner Yes No

188. Does the institution promptly cancel surrendered stock certificates to prevent their
reuse?

189. Does an officer designated in the bylaws or by the board of directors sign stock
certificates?

LETTERS OF CREDIT

190. Does the institution have any outstanding unexpired letters of credit?

191. Has the board of directors adopted a written letter of credit policy?

192. Does the board review the policy annually and note the review in the minutes?

193. Does the institution maintain a daily transaction journal that summarizes all
outstanding letters of credit?

194. Who is responsible for the preparation and posting of subsidiary records and
accounting for fee income?
 Person responsible.
 Title.

195. Has the institution made commitments on letters of credit that they have not issued
and for which the commitment period is unexpired?

196. Has the institution issued any letters of credit on behalf of directors, officers,
employees and their interest, or for other insiders?
 If so, please list:.

197. Has the institution issued or confirmed letters of credit to officers or directors of
another financial institution?

198. Does the institution's internal loan review process review letters of credit for adequacy
of underwriting, documentation, and credit quality?

199. Are letters of credit of questionable quality listed on the institution's problem asset list?

200. Has the institution had to pay a draft without receiving payment from a customer?

201. Has the institution extended any loans because of letters of credit?
 List all loans extended
because of letters of credit.

202. Are there any outstanding lawsuits because of letters of credit?

Prepared By: ______________________________

Verified By: ______________________________

TO EXAMINERS: If the institution lacks an effective system of internal audit or control, the examiner should verify appropriate
responses and initial in the verified column. The ""ed questions are the suggested minimum verifications.

internalcontrolquestionnaire-rev11/22 Page 16 of 13