Six observations, three of them repeats, and a concurrent auditor who never escalated
A risk-based internal audit of a suburban branch returns a high-risk rating with six adverse observations. A suspense account carries ₹1.24 crore beyond 90 days, and three of those entries were 'held over' by manual intervention that overrode the age-wise report. Vault dual-control is not evidenced on 19 of 62 days. KYC documents are missing for 23 of 110 sampled accounts. A fixed deposit of ₹50 lakh was opened and closed within 11 days, with the proceeds transferred to an account opened three weeks earlier. The branch's reply to the previous audit on three of these same items was 'noted for future compliance'. The concurrent auditor had flagged the suspense entries twice but did not escalate. The Audit Committee meets in three weeks and the Chief Compliance Officer wants to know whether this is a branch-level lapse or a control failure.
1. Answer the CCO's question: is this a branch-level lapse or a control failure? Show your reasoning observation by observation.
Read the worked answer
The instinct is to read this as six lapses at one branch. The repetition is the finding.
1. Suspense of ₹1.24 crore beyond 90 days with manual held-over intervention. This is an integrity-of-books issue, not housekeeping. Suspense and clearing differences are where unrecorded liabilities and diversion live, and a manual override of the age-wise report is a deliberate circumvention of a system control, which points to someone with both motive and access.
2. Vault dual-control absent on 19 of 62 days. A custody failure, and in a branch also carrying a suspense problem it should be read together with it rather than in isolation.
3. ₹50 lakh deposit opened and closed in 11 days, proceeds to a three-week-old account. A layering indicator. Test it against the AML rule on account-opening due diligence and against the customer risk profile; an account of that vintage receiving ₹50 lakh is a trigger the branch should have escalated on its own.
4. KYC missing in 23 of 110 sampled accounts. A 21% defect rate is a process failure, not a clerk's oversight.
5. The prior audit reply 'noted for future compliance' on three of the same items, and the concurrent auditor's two unescalated flags. This is the answer. The assurance loop failed: findings were answered, not fixed, and escalation died at the first level.
So it is both - but the systemic control failure is the non-escalation and the acceptance of replies as closure, and that is what the Committee must rule on. Rate it high risk: the exposure is regulatory censure and potential loss, not the ₹1.24 crore alone.
2. How should the findings be reported and closure validated, and what other reporting channels might this trigger?
Read the worked answer
Reporting. The internal audit report goes to the Audit Committee of the Board, not merely to the zonal office, because the failure is in the assurance process. Frame the observation around three things: the manual override, the acceptance of 'noted for future compliance' as closure, and the absent escalation from concurrent audit. Include the branch rating downgrade and the prior-period trail.
Validation of closure. Closure must be evidence-based, accepted by internal audit and not by the branch: suspense entries actually cleared and reconciled, held-over capability withdrawn or made approval-based, dual-control logs produced and counter-signed, missing KYC obtained and verified by someone independent of the branch, and a re-test of a fresh sample 60 days later. A repeat observation after a validated closure should itself be reported to the Committee.
Other channels to consider.
- Test whether the accumulated observations amount to a significant deficiency in internal financial controls over financial reporting, which would require disclosure in the annual financial statements and a note in the auditors' reporting.
- Treat the override and the unescalated suspense as an operational risk incident, with loss data captured under the operational risk framework.
- The ₹50 lakh deposit is a distinct AML matter: if the source of funds is unexplained, file an STR through the Principal Officer rather than waiting for the audit to close.
Notify the Compliance function's own reporting line, so the CCO's attestation on the control environment is not given on an unremediated file.