CMS Case Study

C loyd Bank and Trust Risk Assessment Summary 2020-2021

Audit Area

Accounting

Definition (score range)

Risk Factor

Score

High (21-30)

Moderate (11-20)

Low (0-10)

Rationale

Compliance

The accounting function is subject to regulatory requirements. Members of management with the responsibility for the accounting function possess a strong background in accounting and regulatory reporting. The Bank's assets are approximately $720 million as of December 31, 2020.

Regulatory requirements are limited to low-profile regulations and law issues that warrant action but have significantly lower levels of risk. Impact on accurate timely financial reporting is minimal. Likelihood of material financial reporting effect is negligible.

Significant regulatory requirements are evident; however, regulatory expectations are clear, seasoned, and considered routine. Violations if any will be technical in nature. Material financial effect is possible; however, activity is routine and noncomplex and errors would be readily evident in normal operations.

Potential violations of high profile regulations with potential fines, legal liability or costly corrective action are possible. Material financial misstatement is possible due to incorrect handling of infrequent, complex transactions or estimates. Critical management decisions may be based on these financial areas. Complex manual or automated systems are new, critical to management

13

Nature of Transactions

The nature of the Bank's accounting for transactions is routine. However, an error holds the potential for a material effect on the financial statements. The Bank has not experienced any financial restatements in the last 24 months. Moreover, external audits completed by Ma son & J ones , LLC (the Bank's external auditors) revealed no significant deficiencies or material weaknesses in internal controls.

14

Nature of Operations

The processes involved in the accounting function are routine. Personnel responsible for those processes have been adequately trained and are experienced in their job functions. Many of the processes are both manual and automated. However, the complexity of this function holds the potential for exposure to risk. The Bank utilizes electronic workpapers for documenting both the financial reporting and reconciliation processes.

Noncomplex systems and operations are seasoned, with well established back up routines.

Seasoned and complex manual or automated systems are important to management decision making or product delivery; however, collaborating or alternative back-up systems exist.

decision making, or important to product delivery.

12

Internal Controls

Controls are strong or adequate.

Products of the accounting function (reconciliations, financial reporting, etc.) are subject to multiple levels of review prior to being finalized, submitted, and/or filed. The Bank has a month-end closing checklist as well as an account reconciliation tracking spreadsheet for GL accounts. The Bank utilizes electronic workpapers for documenting both the financial reporting and reconciliation processes which enhance the effectiveness of internal controls. No significant changes occurred in the past 12 months and there are no anticipated changes within the next 12 months. However, the Bank will begin preliminary planning and preparing for Federal Deposit Insurance Corporation Improvement Act (FDICIA) as the Bank assets continue to grow closer to the $1 Billion asset threshold. Members of management have achieved their positions within the Bank because of their level of knowledge, demonstrated skills, and experience within the banking industry. A strong emphasis is placed on maintaining a sound internal control environment.

Controls are nonexistent or known to be weak.

There is no basis for control assessment, or they are thought to be weak.

8

Changes to systems, processes, or procedures

Minor changes since last audit are anticipated this year.

No changes since last audit are planned this year.

Major changes since last audit are anticipated this year or not recently reviewed. Management lacks experience or places low priority on internal controls.

11

Management

Management has average experience.

Management is experienced and has high priority on controls.

9

67

Risk Score

- 3 -