CBA (CNCF) cheat sheet

The IIA Global Internal Audit Standards (2024) replaced the IPPF; five domains: Purpose, Ethics, Governance, Management, and Performing Internal Audit Services.

Two core principles anchor the ethics domain: integrity and objectivity. Objectivity is impaired when an auditor audits an activity they previously managed within the past 12 months.

Independence is an attribute of the internal audit function; objectivity is an attribute of the individual auditor.

The chief audit executive reports functionally to the audit committee (approve charter, plan, budget, appointment/removal) and administratively to management.

Three lines model: first line owns and manages risk, second line provides oversight and challenge, third line (internal audit) provides independent assurance.

Audit charter must define purpose, authority, and responsibility, including unrestricted access to records, personnel, and property.

Mandatory guidance includes the Standards and the Code of Ethics; conformance is required, and any nonconformance must be disclosed to senior management and the board.

Impairments to independence or objectivity must be disclosed to the board; the auditor should be reassigned when feasible.

Quality assurance: internal assessments ongoing plus periodic, and an external assessment at least once every five years by a qualified independent assessor.

Engagement sequence: plan, perform fieldwork, communicate results, monitor follow-up.

Risk-based annual audit plan derives from the entity's risk assessment and is approved by the audit committee; changes require documented rationale.

Materiality is set during planning (often a percentage of revenue, assets, or net income) and drives sample sizes and finding severity.

Sufficient, reliable, relevant, and useful evidence supports conclusions; evidence hierarchy: auditor observation > external confirmation > internal documents > inquiry.

Sampling: attribute sampling for compliance rates, variables sampling for monetary amounts; sampling risk is the risk conclusions differ from testing the whole population.

Finding elements: criteria, condition, cause, effect (and often recommendation). Missing criteria or effect weakens the finding.

Working papers must be reviewed, retained per policy, and support the report; they remain the property of the organization.

Follow-up verifies remediation of agreed management actions; unresolved high-risk findings escalate to the audit committee.

Audit report should include scope, objectives, conclusions, findings, and management responses with target dates.

COSO ERM components: governance and culture, strategy and objective-setting, performance, review and revision, information/communication/reporting.

COSO internal control framework has five components: control environment, risk assessment, control activities, information and communication, monitoring.

Inherent risk is risk before controls; residual risk is risk after controls. Control risk is the risk controls fail to prevent or detect a misstatement.

Risk response options: accept, avoid, mitigate, transfer, exploit (for opportunities).

Segregation of duties separates authorization, custody, recording, and reconciliation; compensating controls apply when separation is impractical.

Preventive controls stop errors before they occur; detective controls identify errors after the fact; corrective controls remediate.

Key risk indicators are leading metrics; key performance indicators are outcome metrics.

Risk appetite is the amount of risk the board is willing to accept; risk tolerance is the acceptable variation around it.

Business continuity: RTO is maximum tolerable downtime; RPO is maximum tolerable data loss.

Core banking functions: deposit-taking, lending, payments, treasury, trust, and wealth management.

Net interest income = interest income − interest expense; net interest margin = NII ÷ average earning assets.

Deposit types: demand (checking), savings, time (CDs); brokered deposits are third-party sourced and carry heightened liquidity and rate risk.

Loan classifications: commercial, consumer, real estate, agricultural; each has distinct underwriting and documentation standards.

Fee income sources include service charges, interchange, trust fees, and loan origination fees.

Operational loss events include internal fraud, external fraud, employment practices, client/products, damage to physical assets, and execution/delivery failures.

Nostro account is held at another bank in that bank's currency; vostro is the mirror held for another bank.

Payment systems: ACH for batch, wire for real-time large value, RTP/FedNow for instant payments.

BSA/AML pillars: internal controls, customer due diligence, ongoing monitoring and reporting, and independent testing (plus designated compliance officer).

CDD rule requires beneficial ownership identification for legal entity customers (25% ownership threshold or a single control person).

SAR threshold: $5,000 for suspicious activity with insider abuse or potential BSA violation; $25,000 for transactions where a subject can be identified; $2,000 for money services businesses.

CTR threshold: currency transactions over $10,000 in a single business day, filed within 15 calendar days.

SAR filing deadline is 30 calendar days after initial detection, extendable to 60 days if no subject is identified.

Structuring is deliberately splitting transactions to evade reporting thresholds; it is itself a suspicious activity.

OFAC sanctions screening applies to all transactions; matches must be blocked and reported to OFAC within 10 business days.

Enhanced due diligence applies to high-risk customers including foreign PEPs, correspondent accounts, and private banking.

Recordkeeping: funds transfer records retained 5 years; monetary instrument logs for purchases of $3,000–$10,000 in currency.

The five Cs of credit: character, capacity, capital, collateral, conditions.

Allowance for credit losses under CECL uses lifetime expected losses from origination; no minimum threshold.

Loan classification categories: pass, special mention, substandard, doubtful, loss.

Past due thresholds: 30, 60, 90, 120+ days; loans 90+ days past due are generally nonaccrual.

Loan-to-value ratio = loan amount ÷ appraised value; a higher LTV increases loss given default.

Debt service coverage ratio = net operating income ÷ total debt service; a ratio below 1.0 indicates insufficient cash flow.

Concentration risk arises from exposure to a single borrower, industry, or geography; limits are set in policy.

Troubled debt restructuring grants concessions due to borrower financial difficulty; modified loans require impairment evaluation.

Credit risk rating migration drives provisioning; watchlist loans receive heightened monitoring.

Basel III capital: CET1, Tier 1, and Total capital; minimum CET1 is 4.5% of risk-weighted assets plus a 2.5% capital conservation buffer.

Leverage ratio = Tier 1 capital ÷ average total consolidated assets; minimum 4%.

Liquidity coverage ratio = high-quality liquid assets ÷ net cash outflows over 30 days; minimum 100%.

Net stable funding ratio = available stable funding ÷ required stable funding; minimum 100%.

Interest rate risk in the banking book arises from repricing, basis, yield curve, option, and basis risk.

Gap analysis compares rate-sensitive assets and liabilities within repricing buckets.

Duration measures price sensitivity to rate changes; a 1% rate rise reduces value by approximately duration percent.

Financial statements: balance sheet, income statement, statement of cash flows, statement of changes in equity, and notes.

Accrual accounting matches revenue to the period earned; fair value hierarchy levels 1, 2, and 3 reflect observability of inputs.

CIA triad: confidentiality, integrity, availability.

Authentication factors: something you know, something you have, something you are. Multi-factor requires at least two distinct categories.

Encryption at rest protects stored data; encryption in transit protects data moving over networks (TLS).

Access control principles: least privilege, need-to-know, and periodic recertification of entitlements.

Change management requires testing, approval, segregation between developer and production access, and rollback plans.

GLBA Safeguards Rule and the Interagency Guidelines require a written information security program with risk assessment and vendor oversight.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, lessons learned.

RTO/RPO drive backup and disaster recovery design; hot sites offer fastest recovery at highest cost.

Data classification tiers (public, internal, confidential, restricted) determine handling and retention requirements.

Auditor competence includes knowledge, skills, and experience; the CAE must ensure the team collectively holds needed competencies.

Due professional care means applying the care a reasonably prudent auditor would use, not infallibility.

Confidentiality obligations continue after the auditor leaves the organization.

Conflicts of interest must be disclosed and managed; the auditor should decline engagements where objectivity cannot be preserved.

Audit committee should include at least one financial expert and meet independently with the CAE and external auditors.

The CAE should confirm annually to the board the organizational independence of internal audit.

Ethical principles in the IIA Code: integrity, objectivity, confidentiality, competency.

Preliminary survey gathers background on the auditee, objectives, risks, and prior findings before detailed testing.

Risk and control matrix maps each significant risk to the controls that address it.

Walkthroughs confirm understanding of process flow and identify control gaps before testing.

Test of one vs. test of many: substantive testing of individual transactions vs. controls reliance testing.

Exception rate = exceptions ÷ items tested; compare to tolerable rate to conclude on control effectiveness.

Audit programs document step-by-step procedures and are approved before fieldwork begins.

Exit conference communicates preliminary results to management and resolves factual disputes before the final report.

Three lines model distinguishes management, risk/compliance oversight, and independent assurance.

Control self-assessments let business units evaluate their own controls and surface gaps early.

Key control designation focuses testing on controls that materially mitigate a significant risk.

Residual risk scoring typically multiplies likelihood by impact on a defined scale.

Risk register captures description, owner, rating, controls, and treatment plan for each risk.

Fraud triangle: pressure, opportunity, rationalization.

Inherent limitations of internal control include collusion, management override, and human error.

Efficiency ratio = noninterest expense ÷ (net interest income + noninterest income); lower is better.

Return on assets = net income ÷ average total assets; return on equity = net income ÷ average equity.

Demand deposits are the lowest-cost funding source; wholesale funding is more rate-sensitive.

Loan origination fees are deferred and amortized over the loan life as an adjustment to yield.

Overdraft programs carry heightened compliance risk under UDAP and Reg E.

Correspondent banking relationships require enhanced due diligence under BSA rules.

Trust department fiduciary duties: loyalty, prudence, and impartiality among beneficiaries.

Independent BSA testing must be conducted by internal audit or an outside party, not by the BSA officer.

PEPs are individuals entrusted with prominent public functions; foreign PEPs are inherently higher risk.

Correspondent accounts for foreign financial institutions require due diligence and prohibitions on payable-through accounts for certain jurisdictions.

Cash-intensive businesses (MSBs, casinos, dealers in precious metals) are higher-risk customer types.

Automated monitoring systems generate alerts; alert disposition must be documented and retained.

Regulator exam findings are rated under the consumer compliance rating system and BSA/AML is evaluated separately.

Training must be role-appropriate and refreshed at least annually, with attendance documented.

Underwriting standards specify income verification, collateral valuation, and debt-to-income limits.

Credit concentration limits cap exposure to a single borrower or sector relative to capital.

Loan review is an independent post-approval function that validates risk ratings and documentation.

Covenant compliance monitoring detects deterioration before default.

Nonaccrual loans stop accruing interest; cash payments may be applied to principal.

Charge-offs reduce the allowance and are recorded when a loss is confirmed.

Insider lending is subject to Regulation O limits and requires board approval for extensions of credit to insiders.

Stress testing (DFAST/CCAR) projects capital under adverse scenarios over a multi-year horizon.

Capital adequacy is measured against risk-weighted assets; higher-risk assets consume more capital.

Liquidity stress testing assumes deposit runoff and funding market closure to test survivability.

Fair value option and hedge accounting under ASC 815 align derivative gains/losses with hedged exposures.

Reconciliation controls compare general ledger balances to subsidiary systems and external statements.

Segregation between trade execution and trade confirmation reduces unauthorized trading risk.

Regulatory reporting (Call Report) must reconcile to the general ledger and be reviewed before filing.

Vulnerability scanning identifies weaknesses; penetration testing exploits them under controlled conditions.

Patch management cadence should be risk-based, with critical patches applied within defined windows.

Privileged access management restricts administrative accounts and logs their activity.

Third-party risk management requires due diligence, contractual security requirements, and ongoing monitoring.

Data loss prevention tools detect or block exfiltration of sensitive data.

Business impact analysis identifies critical systems and dependencies that drive recovery priorities.

Logging and monitoring must retain sufficient history to support investigations and regulatory review.