CBA (CNCF) study plan

Map the IIA Global Internal Audit Standards domain structure (purpose, ethics, governance, managing the audit function) into a one-page outline you can recite from memory

Distinguish the five BSA pillars and state the specific requirement each pillar imposes on a bank's AML program

Explain how the audit committee, chief audit executive, and board interact on independence, reporting lines, and approval of the audit plan

Identify the core elements of an effective ethics and whistleblower program and the auditor's role in evaluating tone at the top

Walk through the stages of an audit engagement from planning memo through workpapers, findings, and report issuance

Draft risk-based sampling and testing logic for a BSA transaction monitoring review, including how to select and size a sample

Classify suspicious activity typologies (structuring, funnel accounts, trade-based laundering, third-party payment processing) and match each to red flags

Outline the SAR decision, documentation, and filing timeline requirements and the recordkeeping obligations around them

Build a risk assessment using likelihood and impact scoring and translate the results into a ranked audit universe

Distinguish preventive, detective, and corrective controls and identify control gaps in a described process

Apply the COSO internal control framework components to a lending or deposit process and document where each component shows up

Design a test of operating effectiveness for a key control, including attribute sampling and exception evaluation

Trace the flow of a loan from origination through underwriting, closing, servicing, and collection and name the control point at each stage

Compare commercial, residential mortgage, consumer installment, and credit card lending on underwriting standards, collateral, and loss exposure

Explain credit risk rating systems, allowance for credit losses methodology, and how charge-off and delinquency metrics signal deterioration

Describe core deposit, payment, and fee-income business lines well enough to identify where operational and compliance risk concentrates

Explain the regulatory capital framework, including the components of capital, risk-weighted assets, and the key ratio thresholds a bank must maintain

Interpret a bank's balance sheet and income statement, calculating net interest margin, efficiency ratio, and return on assets from given figures

Describe asset-liability management, interest rate risk, and liquidity coverage concepts and how treasury hedges exposure

Outline the audit considerations for financial reporting, including key reconciliations, estimate review, and regulatory call report accuracy

Map the major IT general control areas (access management, change management, backup and recovery, incident response) to the audit procedures used to test them

Explain data security and privacy obligations relevant to customer financial information and how a bank demonstrates safeguards

Identify third-party and vendor risk management controls, including due diligence, contract terms, and ongoing monitoring

Describe business continuity and disaster recovery testing expectations and evaluate whether a described plan is adequate

Write audit findings in the condition, criteria, cause, effect, and recommendation format without hedging language

Assess whether evidence gathered in a described engagement is sufficient, relevant, and reliable, and justify the conclusion

Explain quality assurance and improvement program requirements, including internal and external assessment cycles

Practice communicating a contentious finding to a resistant business line manager and document the escalation path

Complete two full-length timed practice exams and log every missed item by domain and error type

Re-study the three domains with the lowest practice-exam scores until each reaches at least 80% on a targeted retest

Recite the key regulatory thresholds, filing deadlines, and ratio requirements from memory without notes

Build a final one-page recall sheet of the 40 facts most likely to be tested and drill it to automatic recall