Treasury limits, liquidity appetite and valuation evidence

I would rank the weaknesses by their potential to cause undetected misstatement or concealment, then by their prudential impact.

1. Valuation and HTM classification: RM 2.3 billion of HTM bonds with an RM 84 million unrecognised fair-value loss, plus Level 3 bonds priced from a single broker, is the most serious issue. If the HTM classification is not supported by the business model and intent, or if the broker quotes are stale or biased, the financial statements and capital position could be misstated. The single-broker source is also a valuation-governance weakness.
2. Segregation of duties in treasury: the front office prepares the general ledger reconciliation, and the same dealer confirms execution and valuation. This creates a fraud and error-concealment risk and undermines independent price verification. It affects both financial reporting and market-risk control.
3. VaR limit breach and late escalation: a breach of RM 11.4 million against a RM 9 million limit for three days, reported two weeks late, shows the limit-monitoring and escalation process is not operating. It is a risk-management failure even if no loss occurred.
4. Liquidity concentration and appetite breach: LCR of 112% is above the 100% regulatory minimum but below the 120% internal minimum. That is an internal risk-appetite breach, not automatically a regulatory breach, but the concentration in top-20 wholesale depositors and RM 600 million maturing within 30 days makes the bank vulnerable to a funding shock.

The report should separate regulatory breach from internal appetite breach; conflating them weakens credibility.

The procedures should test classification, valuation and disclosure rather than only re-performing the accounting.

HTM classification

• Obtain the bank's documented business model and intent for the portfolio; inspect investment policy, ALCO minutes and actual sales activity.
• Test whether any HTM sales occurred and, if so, whether the sales were more than insignificant or due to a permissible event. A pattern of sales can call the classification into question.
• Recalculate the amortised cost, premium/discount amortisation and any impairment.
• Assess whether the RM 84 million fair-value loss is disclosed and whether it affects regulatory capital or liquidity buffers.

Level 3 valuations

• Obtain the valuation policy, hierarchy classification and the list of Level 3 instruments.
• For a sample, independently price the bonds using a second source or the auditor's valuation specialist; challenge the single broker's assumptions, timing and independence.
• Test the unobservable inputs, such as credit spreads, recovery rates and liquidity discounts, and assess whether they are consistent with market evidence.
• Review the price-verification committee minutes and broker-approval process.
• Assess whether the dealer who confirms execution is also providing the valuation; if so, obtain an independent confirmation and test for dealer bias.
• Evaluate disclosure of valuation uncertainty under the relevant financial reporting standards.

The auditor should document why the procedures provide sufficient evidence, and should not rely on the broker quote merely because it is the only quote available.

Internal audit should report this as a liquidity risk-management and governance issue, not as a financial statement audit opinion.

• What to report: LCR is above the 100% regulatory minimum, so the bank has not breached the regulatory ratio on the facts given. However, it is below the board-approved internal appetite of 120%. That is a breach of internal risk appetite and should be reported as such. The report should also cover the deposit concentration, the RM 600 million maturity profile, the adequacy of the contingency funding plan and the timeliness of ALCO escalation.
• To whom: ALCO and the risk committee immediately, then the board and audit committee. If the auditor concludes that liquidity risk management is ineffective, the internal audit report rating should reflect that, for example 'needs improvement' or 'unsatisfactory' under the bank's rating scale.
• Qualified opinion: internal audit does not issue a qualified opinion on the financial statements; that is the external auditor's role. The internal audit report may state that the control environment is not effective in this area. The audit committee should consider whether the matter affects the external audit or requires regulatory notification by the bank.
• Timing: the LCR breach of internal appetite should be escalated without waiting for the next scheduled AC meeting if the trend is deteriorating. The report should require a remediation plan with dates and accountable owners, and follow-up within 30–60 days.