Risk-Focused Internal Audit, Internal Controls and Compliance Reporting
This domain tests risk-focused internal audit and the control environment: how assurance is planned, how findings are escalated, and how compliance reporting closes the loop.
Core rules
- The three lines model: business owns controls; compliance/risk monitors; internal audit gives independent assurance.
- Risk-based internal audit (RBIA) starts with an audit universe and risk assessment, then a plan approved by the Audit Committee of the Board (ACB).
- Key controls include maker-checker, dual custody, reconciliation, suspense-account monitoring and segregation of duties.
- Compliance reporting includes the compliance certificate, action-taken notes and tracking to closure; the Chief Compliance Officer reports to the Board/ACB.
Worked example
Audit finds a suspense account unreconciled for 90 days. This is high risk because it can hide fraud or error. The branch should age the entries, identify the source, escalate to the ACB, fix the process and provide evidence of closure. A one-line "rectified" reply is not closure.
Traps
Treating audit as fault-finding; closing observations without evidence; non-risk-based sampling; not escalating to the ACB; confusing concurrent audit with independent internal audit. Audit independence is judged by reporting lines and access, not by the audit manual alone.