Loan file sampling, exceptions and unsupported conclusions
The internal audit team is auditing business loan approvals at a bank with 8,400 business loans totalling RM 2.7 billion. The auditor extracts the population on 28 February, three days before year-end, and selects 75 loans using a random number generator. Testing finds: four files lack current financial statements (two have statements more than 18 months old); one RM 1.8 million loan was approved by a regional head whose delegated authority is RM 1 million; one borrower is a director's private company but is not flagged as a related party; and one collateral valuation is 31 months old against a policy requiring annual revaluation for commercial property. The workpaper contains tick marks without a legend, and the review sign-off is blank. The auditor concludes that 'controls are generally effective' because 68 of 75 files had no exception. Management says the exceptions are 'administrative' and asks that they not be reported individually.
1. Evaluate whether the sample and the evidence are sufficient and appropriate to support the conclusion that controls are generally effective.
Read the worked answer
The conclusion is not supported by the evidence gathered.
- Population cut-off: the population was extracted on 28 February, three days before year-end. Loans approved in those three days are outside the population, so the sample does not cover the full period. The auditor should either extend the population to year-end or perform a separate roll-forward test.
- Sample design: 75 out of 8,400 loans is a small proportion, and there is no documented confidence level, expected deviation rate or stratification by loan size, product or approval authority. Random selection is acceptable, but the auditor must show why 75 is sufficient.
- Exception rate: 7 exceptions in 75 files is a 9.3% deviation rate, which is not trivial. The exceptions are not all 'administrative': approval above delegated authority and an unidentified related party are control and governance failures; stale financial statements and a 31-month-old valuation affect ECL and collateral adequacy.
- Workpaper quality: tick marks without a legend and a blank review sign-off mean the evidence is not properly documented or reviewed. An unreviewed workpaper is weak evidence of control effectiveness.
The auditor should not conclude 'generally effective' from 68 clean files. The exceptions must be evaluated individually, the sample should be extended or targeted testing performed, and the conclusion should be revised to reflect the deviation rate and the nature of the failures.
2. What additional audit procedures would you perform on the exceptions, and how would you quantify and report them?
Read the worked answer
I would treat each exception according to its risk, then aggregate the effect.
- Delegated authority breach (RM 1.8 million): obtain the credit committee minutes or ratification, confirm whether the regional head had temporary delegated authority, and assess whether the loan should have been declined or approved on different terms. Test whether the same regional head exceeded authority on other loans.
- Undisclosed related party: search the related-party register, company registry and director declarations; assess whether the loan was on arm's-length terms and whether it should be disclosed or approved by the board. Review other loans connected to the same director or group.
- Stale financial statements: assess whether the borrower's repayment capacity and ECL staging were affected. Recompute or challenge the impairment where the latest figures would change the loss estimate.
- Stale collateral valuation (31 months): obtain a current valuation or a desktop update, compare loan-to-value against policy, and assess whether the collateral shortfall affects ECL.
- Workpaper defects: add a tick-mark legend, document the sample rationale, and obtain reviewer sign-off before the report is issued.
Quantification should be done where possible: the monetary effect on ECL, the value of loans approved outside authority, and the exposure to undisclosed related parties. In the report, I would classify the authority and related-party matters as significant control deficiencies, not administrative exceptions, and include root cause, risk and management action.
3. How should the auditor respond to management's request not to report the exceptions individually?
Read the worked answer
The auditor can consolidate presentation but cannot omit significant matters.
- Agree on a summary table only if it preserves the substance. A table showing each exception, loan identifier, amount, policy breached, root cause and management action is acceptable. Removing the individual exceptions from the report is not.
- Distinguish significance. A minor documentation gap may be aggregated; an approval outside delegated authority, an undisclosed related party or a stale valuation that affects ECL should be reported individually because the AC needs to understand the specific risk.
- Include management's explanation in the report, but do not let it replace the finding. If management says the items are administrative, the report should state why the auditor disagrees.
- Escalate if necessary. If management refuses to accept a factual finding, the auditor should report the disagreement to the AC and document the basis.
The auditor's obligation is to communicate control deficiencies to those charged with governance. A request for brevity is reasonable; a request for concealment is not.