The internal audit function in banks (JOURNAL OF INTERNATIONAL SCIENTIFIC RESEARCH)

Summary

• Principle 6 specifies that every activity, entity, and outsourced function of a bank must fall within the overall scope of internal audit.p.8
• The document defines a three lines of defence model, placing operational units in the first line, support functions in the second line, and internal audit in the third line.p.18
• An annual internal audit plan must be established based on a robust risk assessment and updated at least annually.p.14

Key insights

1. An effective internal audit function provides independent assurance on internal control, risk management, and governance processes to protect the organisation.p.7
2. Large and internationally active banks are assumed to have an audit committee within the board of directors to oversee internal audit activities.p.8
3. Internal auditors must maintain independence from audited activities and avoid conflicts of interest, including avoiding direct involvement in designing internal control measures.p.11
4. To prevent loss of objectivity, banks should periodically rotate internal audit staff or establish clear cooling-off periods for staff transferred from other departments.p.11
5. Internal audit scope must extend to capital adequacy, stress-testing processes, liquidity monitoring, finance, and regulatory compliance functions.p.14
6. Even when internal audit activities are outsourced to external experts, the board of directors remains ultimately responsible for the internal audit function.p.14
7. Internal audit serves as the third line of defence by independently assessing the control processes established by the first and second lines.p.19
8. Supervisors should regularly evaluate whether internal audit has sufficient standing and authority within the bank, reporting any identified weaknesses to the board.p.17