PPP internal audits: Your guide to risk management considerations

PPP Internal Audits: Your guide to risk management considerations

Were your internal audit processes bypassed in the rush of PPP? Here's how to identify and address risk hot spots and move forward to the forgiveness phase of the PPP process.

For many institutions, building, designing, and implementing a PPP solution to support their customers was frantic, to say the least. Given this pace, institutions might have made unintentional errors during the application process, including:

  • Borrower eligibility issues
  • Loan amount calculations off by as much as 50%
  • Loan boarding errors
  • Missing or incomplete customer identification documentation
  • Missing or incomplete customer attestations and disclosure forgiveness documents

Now is the time to adjust your internal audit plan to focus on the risks, which likely includes performing a risk assessment and an internal audit of your institution’s PPP loan program. This way, you can tackle any potential issues as the loan forgiveness process begins. The guide below recommends ways to help risk management and internal auditors evaluate what’s happened over the past few months and plan for the future.

1. Identify and assess risk in the PPP loan portfolio

1. Identify and assess risk in the PPP loan portfolio

  • Use a risk taxonomy and perform a risk assessment of your PPP loan portfolio and the processes that were rolled out to support the program.
  • Consider using data analytic techniques to help guide you in assessing risk.
  • Determine where the greatest risks exist.

2. Chart a course based on risk and SBA guidance

  • Develop a detailed scope that captures and addresses key areas of focus and highest risk.
  • Anticipate changing your approach based on further PPP guidance from the SBA.
  • Set expectations with key stakeholders, including risk committees of your board.
  • Consider the communication between management and borrowers, including potential issues or complaints.
2. Chart a course based on risk and SBA guidance
How you handle your PPP loan forgiveness experience could have a big impact on your institution. 
Learn how our PPP Loan Forgiveness Platform for Lenders can help 
3. Execute your audit plan

3. Execute your audit plan 

  • Create consistency by designing a PPP loan checklist to guide you and your team through individual loan review.
  • Design a sampling methodology that’s risk based and supports your approach.
  • Dial in the scope of your review based on problem areas.
  • Interview stakeholders to highlight key steps in the origination process, such as customer identification programs, Bank Secrecy Act and anti-money laundering processes, and preparation of loan documentation.

4. Evaluate the results of the internal audit

  • Conclude whether the risks identified during the initial-phase risk assessment process have been adequately addressed through testing and oversight.
  • Evaluate and draw conclusions about the level of risk associated with each observation and perform a root-cause analysis.
  • Work with key stakeholders to design short- and long-term remediation plans. 
  • Brainstorm other areas of the institution that may be impacted as a result of identified issues, such as long-term (back-end) operational demands of PPP servicing that could affect other areas of customer service.
4. Evaluate the results of the internal audit
5. Communicate and continue ongoing audits

5. Communicate and continue ongoing audits

  • Summarize results to provide key stakeholders a snapshot of the overall health of the PPP loan portfolio and related processes.
  • Develop a road map for continual auditing of the program as the PPP loan forgiveness process rolls out.

Contact us

Creating your internal audit approach and moving forward involves these and other key considerations. Looking for more help? Our team can work with you to design a custom audit plan for your PPP process. 
Ryan C. Luttenton
Partner, Consulting
Joshua Brown