CMS Case Study

C loyd Bank and Trust Risk Assessment Summary 2020-2021

Audit Area

Call Report

Definition (score range)

Risk Factor

Score

High (21-30)

Moderate (11-20)

Low (0-10)

Rationale

Compliance

Regulatory requirements are limited to low-profile regulations and law issues that warrant action but have significantly lower levels of risk. Impact on accurate timely financial reporting is minimal. Likelihood of material financial reporting effect is negligible.

Significant regulatory requirements are evident; however, regulatory expectations are clear, seasoned, and considered routine. Violations, if any, will be technical in nature.

Potential violations of high profile regulations with potential fines, legal liability or costly corrective action are possible. Material financial misstatement is possible due to incorrect handling of infrequent, complex transactions or estimates. Critical management decisions may be based on these financial areas. Complex manual or automated systems are new, critical to management

The call report is prepared by the Accounting Department and reviewed by the Chief Financial Office r . Although subject to regulatory requirements, management who are responsible for the Call Report possess the necessary level of experience within the banking industry.

14

Nature of Transactions

Manual entries are required for certain line items on the Call Report as part of the Bank's consolidation process, this also increases the risk of error. However, the Call Report may be amended if an error is discovered. CRI noted that the Bank filed an amended Call Report for the 1Q2020 due to conditionally cancellable/unconditionally cancellable loans.

Material financial effect is possible; however, activity is routine and noncomplex and errors would be readily evident in normal operations.

15

Nature of Operations

Management possesses a strong background with many years of experience in the banking industry. Management also possesses experience with regulatory reporting. The Call Report is prepared using manual workpapers and entry into the Call Report software (CallReporter and Timesaver). The software has built in controls that provide certain checks prior to submission. The software automatically submits the Call Report to the regulators.

Noncomplex systems and operations are seasoned, with well established back up routines.

Seasoned and complex manual or automated systems are important to management decision making or product delivery; however, collaborating or alternative back-up systems exist. There is no basis for control assessment, or they are thought to be weak. Minor changes since last audit are anticipated this year.

13

decision making, or important to product delivery.

Internal Controls

Controls are strong or adequate.

As noted above, the Call Report is subjected to review prior to being filed. There have been no internal control issues in the past year regarding the Call Report.

Controls are nonexistent or known to be weak.

9

Changes to systems, processes, or procedures

No changes since last audit are planned this year.

No changes are expected in 2021. The Bank implemented the new COVID-19 related items on Schedule RC-C, Section 4013 (Loans and Leases) and Schedule RC-M.

Major changes since last audit are anticipated this year or not recently reviewed. Management lacks experience or places low priority on internal controls.

8

Management

Members of management have achieved their positions within the Bank because of their level of knowledge, demonstrated skills, and experience within the banking industry. A strong emphasis is placed on maintaining a sound control environment.

Management has average experience.

Management is experienced and has high priority on controls.

9

68

Risk Score

- 2 -