Financial Institutions conduct an IT audit annually.  Many financial institutions have an internal auditing staff that conduct these IT audits.  The knowledge base required for the auditors to understand the different operating systems, firewalls,  ancillary applications, communication systems, online banking, Item Processing and the advancing technology being brought into the bank is becoming overwhelming. 

A number of financial institutions have begun to engage external IT auditors to conduct their internal IT audits.  It reduces the cost of training the staff and reduces the overhead of number of staff required to conduct the audits.  Good external IT auditors review dozens of bank annually and see multiple systems.  They keep up with the changing technology and apply it in their IT controls reviews.  

The Garland Group has a good IT audit staff that conducts a comprehensive risk assessment with every IT audit.  The financial institution will receive numerous reports and spread sheets to follow the processes used and to help them work more effectively and inline with the FFIEC guidelines.