Internal audit independence at a mid-sized Malaysian bank
Sri Mutiara Bank Berhad (total assets RM 31 billion) has a five-member audit committee (AC); only one member has prior banking experience. The chief audit executive (CAE) reports functionally to the AC but administratively to the CFO, who also chairs the Asset and Liability Committee and sponsors the expected credit loss (ECL) model. After a cost review, the internal audit budget was cut by 18% and two planned treasury audits were deferred. Two critical findings-unauthorised trading-limit overrides and unreconciled nostro accounts-remain open 210 days after management committed to remediate. AC papers show that management responses were edited by the CFO's office before submission, and the risk committee receives internal audit reports only after management has added a 'management perspective' section. The CAE is due to be appraised by the CFO next month. BNM's examination letter noted 'limited challenge from the third line'. The board wants a paper on whether internal audit remains fit for purpose.
1. Assess the threats to internal audit independence and effectiveness in this scenario. Rank the three most serious threats and explain why.
Read the worked answer
The threats are connected, so I would evaluate them against the three lines model rather than treating them as separate HR issues.
- Administrative reporting and appraisal by the CFO - the CFO owns two areas the auditors must challenge: ALCO decisions and the ECL model. If the CFO controls the CAE's budget, appraisal and administrative line, the CAE faces a self-interest and intimidation threat whenever a finding touches those areas. This is the most serious threat because it can change what gets audited and what gets reported, not merely how a report is worded.
- Management editing of AC papers and adding a 'management perspective' before risk committee review - this compromises the completeness and objectivity of information reaching those charged with governance. The AC cannot discharge oversight if management filters the third line's message. It is more serious than a resourcing issue because it affects every report, not one audit.
- Unresolved critical findings and budget cuts - two critical findings open for 210 days show weak follow-up and weak consequences, while an 18% budget cut and deferred treasury audits reduce coverage of high-risk areas. This undermines effectiveness even if individual auditors remain objective.
The AC's limited banking experience and the regulator's comment about 'limited challenge' are enabling factors: they reduce the likelihood that these threats will be detected and corrected.
2. Recommend governance changes, including reporting lines, AC composition, follow-up escalation and external communication. Sequence them over six months and justify the sequence.
Read the worked answer
I would sequence the changes to protect the CAE first, then restore capability, then strengthen oversight.
0–30 days
- Change the CAE's administrative reporting line to the AC chair or the CEO, but not the CFO; the AC should approve the CAE's appraisal, budget and any performance rating.
- Give the CAE direct, unfiltered access to the AC. Management responses should be attached separately and clearly labelled, not edited into the audit report.
- Hold an extraordinary AC session on the two critical findings and obtain a dated remediation plan with named owners.
30–90 days
- Restore the internal audit budget or reallocate resources to treasury and ECL coverage; document the risk accepted if the full budget cannot be restored.
- Introduce an issue-escalation protocol: critical findings open beyond 90 days go to the AC and board risk committee; beyond 120 days, the AC should consider whether regulatory notification or external auditor communication is appropriate.
- Strengthen the AC skills matrix by adding at least one member with recent banking, audit or treasury experience.
90–180 days
- Revise the internal audit charter to state functional reporting, unrestricted access, and the AC's role in appointment and removal of the CAE.
- Commission an independent quality assessment or gap review against BNM's expectations for the internal audit function.
- Given the examination letter, the board should proactively engage BNM with the remediation plan rather than wait for the next inspection. The sequence matters: reporting-line and information-flow fixes must come before capability spending, otherwise the extra resources remain under management control.
3. The CFO asks the CAE to soften a draft finding on the ECL model before it goes to the AC. How should the CAE respond?
Read the worked answer
The CAE should not alter the finding without evidence. The response should be professional and documented, not confrontational.
- Separate facts from management comment. The finding should state the audit criterion, the condition found, the effect and the root cause. If the CFO disagrees with the effect, the CFO's view belongs in a management response, not as a replacement for the audit conclusion.
- Ask for evidence. If the CFO believes the finding is factually wrong, the CAE should request supporting documentation and re-test. A legitimate correction is recorded with the reason and the reviewer's sign-off; an unsupported request to soften wording is not accepted.
- Escalate if pressure continues. The CAE should inform the AC chair that management sought a change and explain the basis for the final wording. This protects the AC's right to receive complete information and protects the CAE from later claims of concealment.
- Document the interaction. A contemporaneous note of the request, the CAE's response and the evidence considered is essential, particularly because the CAE's appraisal is controlled by the CFO.
The finding may be reworded for clarity and proportionality, but the substance should not be weakened to avoid 'surprises'. If the matter is material, the AC must see it before the CEO's preferred communication timetable.