State Bank and Trust Company

Situation 
State Bank brought internal audit in-house, but it didn’t have a strategic way to manage the process.
Results 
  • Gained the ability to effectively manage audits in-house
  • Improved partnership with external auditors
  • Saved hours on each audit
  • Recaptured time to analyze and improve the overall audit process
Industries 

Growing pains are often a part of rapid growth. So it’s not surprising that the risk management team at State Bank and Trust Company based in Macon, Ga., experienced growing pains when the bank launched in 2010. State Bank was formed by combining 13 financial institutions throughout Georgia. “We didn’t grow to $4.1 billion, we catapulted to 4.1 billion in under 3 short years,” says Bradley Carroll, Senior Vice President, Director of Internal Audit at State Bank. Carroll’s focus is helping the audit committee fulfill their SEC responsibility to assess internal controls.

When the bank was established, it outsourced most of its initial risk management processes, including internal audit. After a few years, those processes were brought in-house first in a co-sourcing arrangement and then as solely internal functions.

When the bank took full control of the internal audit, the audit team didn’t own an electronic workpaper program to manage the process. Previously, State Bank used its contractor’s proprietary electronic workpaper program, but as Carroll refined the bank’s audit methodology, the program’s functionality couldn’t keep pace.

At the time, the bank’s SOX team was also looking for an online solution. So, the two teams agreed to try using the same governance, risk management, and compliance platform. The bank’s SEC team was successfully using Wdesk for financial reporting, so when Workiva rolled out Wdesk for SOX, the SOX team signed on too. A year later, the internal audit team added Wdesk for Audit.

Now, State Bank’s internal audit team uses Wdesk as an audit evidence repository and to manage the workflow of individual audits. The bank has 60 auditable entities—processes, products, and divisions—which are audited individually, or risk-rated individually, and then rolled into a combined audit. Carroll manages five auditors and brings in a handful of co-sourced subject matter experts (SME) to handle audits on specific topics including IT and derivatives.

The fact that Wdesk looks and feels like Microsoft® Word and Excel had an immediate, positive impact on the entire team. “The first thing we liked about Wdesk was that it looked familiar,” says Carroll. “When something looks and feels familiar at the user interface level, there’s less anxiety, acceptance is higher, and the learning curve is shortened.”

Rather than having his auditors follow a checklist of preplanned audit steps, Carroll prefers to have them learn the “why” behind each step in the audit to get a better understanding of the entire process. Then they can use that knowledge to find better ways to test it. “It’s important that my auditors see the risk we’ve identified, the control in place to mitigate the risk, and the test of the control,” explains Carroll. He says the design of Wdesk enables that understanding. “Wdesk gives me a great, one screen view—risk, control, audit, test.”

Based on the scope of work, each audit is assigned staff and a number of hours for completion. Carroll uses the Wdesk tasking feature to assign different parts of each audit to his team. Once a task is complete, the auditor signs off, so the auditor in charge can review the work. It’s all tracked in a Wdesk dashboard and summarized in an audit scorecard showing the audit status, accomplishments, and findings to date at a glance.

Wdesk also makes it easy for Carroll to quickly reassign auditors as needed. Recently, when an auditor left the company, Carroll was short-staffed with a deadline looming. He says Wdesk made up the difference. “Even being down one employee, we were able to complete our midyear SOX testing before the deadline using Wdesk.”

With the time saved using Wdesk, the team is able to do postmortems, questioning different approaches to audits and ways to improve them. “We’ve been talking about doing that for a few years—now we can,” he says.

The review process is more streamlined with Wdesk, as well. Users can hyperlink evidence to individual cells, eliminating the need to find workpaper references in Microsoft® Internet Explorer. “It doesn’t sound like a lot, but when you’re reviewing many workpapers, to be able to click on a hyperlink, open it, close it, and go on to the next one helps tremendously with our review,” he says. When Carroll has a question, he simply adds a comment, tags an auditor, and Wdesk sends them an email with the link to the exact cell in question. “With Wdesk, we’re picking up minutes everywhere. Those minutes turn in to hours.”

The bank’s external audit firm has access to Wdesk, so they can review reports and add their comments right into the Wdesk document. “With Wdesk, it’s a true, real-time partnership with our external auditors, and it’s much more efficient,” Carroll comments. He adds that his team is saving additional hours because they don’t have to wait while reports upload and download into the auditor’s portal. “We give them access to Wdesk and it’s all there for them.” How do the external auditors feel about Wdesk? “They’re loving it,” he says.

State Bank’s team appreciates its successful partnership with Workiva. “The Workiva support team has been responsive and eager to hear how we’re using Wdesk and what additional functionalities we need,” says Carroll. Many of the enhancements the State Bank team has requested have been quickly escalated and addressed. “Workiva has shown me that they value our input and take it seriously,” comments Carroll.

In just one year of using Wdesk for Audit, State Bank’s audit team has made great progress in improving its audit process. That’s why Carroll recommends it to other companies searching for a better way to handle their audits. “Wdesk is definitely something people need to take a look at when they’re evaluating moving to an automated workpaper plan,” says Carroll. He plans to expand his team’s use of Wdesk soon. “We’re going to use it at more of a macrolevel to look across the audit plan and get statistics on the process,” he says. Other groups at the bank are considering the solution for managing policy and operational risk scorecards.

Download case study

Excel, Word, and Internet Explorer are registered trademarks of Microsoft Corporation in the United States and/or other countries.

The information contained herein is proprietary to Workiva and cannot be copied, published, or distributed without the express prior written consent of Workiva. © 2017.

Read More