CMS Case Study

engage in activities or relationships that will impair the independence or objectivity of audits, or conflict with the interest of the bank.

Internal Auditors will evaluate the adequacy, effectiveness, and efficiency of the internal bank controls. Our bank’s internal control system has been designed to provide reasonable assurance that the bank’s assets are being safeguarded. The Internal Audit reports will be prepared regarding the scope and results of each audit performed by the internal audit. These reports will include corrective actions recommendations regarding significant (1) internal control deficiencies and weaknesses and (2) deviations from legal, regulatory, and bank policy requirements. Audits will be tentatively scheduled quarterly, and then finalized by the 1 st day of the second month following the month-end being audited. The Internal Audit Firm will provide internal audits or reports to the Internal Audit Officer who will forward them to the Chairman of the ACIT Committee and Executive Management upon receipt of the Final report. The Internal Audit firm will meet with the ACIT Committee, and/or the Board as the Chairman of the Committee deems appropriate. It will be the responsibility of the management of the Bank to follow up on recommended corrective actions within a timely manner. C. Internal Audit Review • Review and approve the annual internal audit plan. • Review completed audit reports. • Approve the Audit Charter. • Review the Internal Audit function of the Company including its independence and the authority of its reporting relationships. • Review and concur in the appointment, replacement, reassignment, or dismissal of the Internal Audit Officer. • The Board of Directors of the Bank shall select, engage and if necessary, discharge independent public accountants to perform an audit of the books and affairs at least once a year. These audits shall be full scope audits sufficient to meet the minimum requirements for compliance under Section 7-1-487 of the Code. Where customer confirmations and other third-party involvements are a part of a procedure, these confirmations must be under audit’s control from the time they are prepared and mailed until the returned replies have been evaluated. • Annually, the Audit Committee will ensure a formal statement delineating all relationships between the independent accountants and the Company, which is consistent with Independent Standards Board Standard 1, is received from the independent accountants. The Audit Committee will discuss with the independent accountants all significant relationships the independent accountants have with the Company to determine the accountants’ independence. D. Independent External Audit Policy

Reviewed by Board of Directors on 5.27.21