If you’re responsible for responding to audit and examination requests, you’ve probably run into the same confusion: where exactly do audits and examinations differ? Some of that confusion makes sense. The two overlap in places, but they also differ meaningfully in nature and scope. It can feel like being asked to comply with two completely different standards. How often has an auditor raised a finding that never came up during an examination? And how often has an examiner thrown a curve ball that seemed to come out of nowhere?

In a perfect world, shouldn’t the audit be nothing more than preparation for the examination? The scope would be exactly what’s needed to get through the exam, no more and no less. Too much, and it feels like wasted time and money. Too little, and you haven’t gotten your money’s worth. That’s the logical assumption, but it’s not how this works. Both share the same broad goal of assessing alignment with a set of standards, but the audit typically draws on a broader set of industry standards, because FFIEC guidance itself is general and non-prescriptive by design. Consider one question from the FDIC’s Information Technology Officer’s Pre-Examination Questionnaire.

“Do you have a written information security program designed to manage and control risk (Y/N)?”

The correct answer is yes, but since the FDIC doesn’t supply an information security program template, how do you know your program will satisfy regulators? The answer is the IT auditor, who examines your InfoSec program directly and measures it against existing standards such as COBIT, ITIL, ISO 27001, SAS 94, NIST, and others. That comparison doesn’t guarantee you walk away from an examination with zero findings, but it reduces both the probability and the severity of them. This is the real difference between an audit and an examination: an audit identifies the root cause behind potential examination findings and gives you the chance to fix it beforehand. (Root cause, here, means anything that shows up in the Examination Procedures.) So using the example above, even if an examiner does raise a finding related to your information security program, it will concern how the root cause was addressed, not whether it was addressed at all. The FFIEC recognizes this dynamic between the audit and examination process directly.

A strong IT audit function, per FFIEC guidance, can shorten the time examiners need to spend reviewing those same areas during your examination.

Less time in an area usually means fewer curve balls, and an examination that’s considerably less stressful for you to sit through.