The Sharia Audit Finding the CEO Wants Removed
During a Sharia audit at City Islamic Bank, the auditor samples 30 commodity murabaha files. Twelve files lack evidence that the bank bought and took possession of the commodity before selling it to the customer; in eight of those the broker was a sister company of the customer. The Sharia board approved the product two years ago on a one-page description and never reviewed the standard operating procedures. The product generated USD 4 million of profit last year. Management says the missing documents are an administrative issue, the broker is reputable, and restating would damage the bank’s reputation. The CEO asks the head of Sharia audit to downgrade the finding from non-compliant to observation and to remove the sample details from the report. The regulator requires notification of material Sharia non-compliance within 15 days.
1. How should the auditor classify the finding, and why can it not be downgraded?
Read the worked answer
The finding should remain non-compliant and material. Ownership and possession are conditions of a valid murabaha; without evidence that the bank bought and held the commodity before selling it, the sale is not established and the profit is at risk. The related-party broker in eight files increases the risk that the bank was used to fund a pre-arranged on-sale. The product was approved on a one-page description without SOP review, which is a control failure at the design stage. The USD 4 million profit is material to the product and possibly to the bank. The auditor cannot downgrade a finding to protect reputation; independence and the audit charter require reporting to the Sharia board and, where required, the regulator. The CEO’s instruction should be documented and declined.
2. What remediation, financial treatment and regulatory action should the bank take?
Read the worked answer
Remediation: suspend new commodity murabaha transactions until the process is fixed; review all files, not only the sample; obtain missing evidence where possible; for files that cannot be evidenced, treat the profit as non-compliant and purify it by donating to charity rather than retaining it; assess related-party conflicts; strengthen custody, broker selection and documentation. Financial: reverse any unrecognised profit, consider impairment and disclosure, and restate if material. Regulatory: notify within 15 days if the breach is material and cooperate with the Sharia board. The bank should also review product approval: the Sharia board must approve the SOPs and the execution, not just the concept.
3. What governance lessons should the board draw from this episode?
Read the worked answer
Sharia audit must report to the Sharia board and audit committee, with a direct line to the board; the CEO cannot edit findings; the audit charter should protect the head of Sharia audit. Product approval must include a Sharia risk assessment, SOP review, sample testing and post-implementation review. The board should require a root-cause analysis and a culture review. The regulator’s notification requirement is a legal obligation, not a reputational choice. The bank should also consider whether the sister-company broker created a conflict that should have been disclosed. A remediation timetable with owners and board reporting should be agreed.