CBA (CNCF) study guide
CBA · Work through your exam, one topic at a time.
The Certified Bank Auditor (CBA) credential is designed for professionals who examine the internal controls, risk management, and regulatory compliance of banks and similar depository institutions. Candidates typically come from internal audit, compliance, credit review, or external audit roles, and often hold a few years of hands-on banking or assurance experience. The CBA study guide has 8 sections and about 2,144 words.
01Audit Standards, Ethics, and Governance
Internal audit derives its authority from three interlocking documents: the charter (board-approved mandate, scope, and access rights), the audit policy and methodology manual, and the professional standards that govern conduct. The IIA's Global Internal Audit Standards replaced the older IPPF in 2024, but the concepts tested remain stable: independence, objectivity, due professional care, and a quality assurance and improvement program (QAIP) with both internal and external assessments.
312 words, about 2 min02Internal Audit Process and Methodology
Every audit follows a recognizable arc: risk-based annual planning, engagement-level risk assessment, planning memo, fieldwork, workpapers, findings, reporting, and follow-up. Candidates should be able to sequence these steps and identify which activity belongs where.
275 words, about 1 min03Risk Management and Internal Controls
Candidates should be fluent in COSO's Internal Control-Integrated Framework (five components, seventeen principles) and the ERM framework (governance and culture, strategy and objective-setting, performance, review and revision, information-communication-reporting). Also know the three lines model: business units own risk, risk and compliance oversee, internal audit assures.
276 words, about 1 min04Banking Operations and Business Lines
Banks earn a spread: the difference between asset yields (loans, securities) and funding costs (deposits, borrowings). Candidates should understand the core business lines-retail, commercial, wealth, treasury, payments-and how each generates revenue and risk.
271 words, about 1 min05Regulatory Compliance and BSA/AML
The Bank Secrecy Act requires customer identification programs, customer due diligence, suspicious activity reporting, currency transaction reporting, and recordkeeping. Candidates must know thresholds: currency transaction reports for cash transactions over $10,000, suspicious activity reports generally within 30 days of detection, and enhanced due diligence for high-risk customers such as foreign politically exposed persons.
266 words, about 1 min06Credit and Lending Activities
Origination, underwriting, approval, disbursement, monitoring, and collection. Each stage has controls: credit policy, delegated authority, collateral valuation, covenant monitoring, and watchlist management.
244 words, about 1 min07Treasury, Capital, and Financial Reporting
Basel III established risk-weighted assets, the common equity tier 1 ratio, tier 1, and total capital ratios, plus leverage and liquidity buffers. Candidates should know that CET1 is the highest-quality capital and that risk weights vary by asset class-so a shift in portfolio mix changes capital needs even without new lending.
246 words, about 1 min08Information Technology and Data Security
Access management, change management, backup and recovery, and IT operations form the backbone. Candidates should understand that general controls support application controls-if access is poorly controlled, application-level approvals are unreliable.
254 words, about 1 min