AICB Bank Audit Practices (BKA, Malaysia) cheat sheet

Three lines model: first line (business units) owns and manages risk; second line (risk, compliance) provides oversight and challenge; third line (internal audit) provides independent assurance to the board/audit committee.

Internal audit independence requires functional reporting to the audit committee (appointment, removal, budget, scope) and administrative reporting to senior management.

COSO internal control components: control environment, risk assessment, control activities, information and communication, monitoring activities; a deficiency in any component is a control gap.

COSO ERM (2017) five components: governance and culture, strategy and objective-setting, performance, review and revision, information/communication/reporting.

Inherent risk x control effectiveness = residual risk; residual risk is compared to the approved risk appetite for the process or portfolio.

Control types: preventive vs detective, manual vs automated, entity-level vs transaction-level; a key control is one that, if it fails, materially affects the risk being mitigated.

Board audit committee must comprise independent non-executive directors; BNM policy expects audit committee members to have relevant financial and audit literacy.

RMiT (BNM Risk Management in Technology) requires a board-approved technology risk appetite, a designated CIO/CRO accountability structure and independent technology audit coverage.

Segregation of duties rule: no single individual should be able to initiate, authorize, record and reconcile the same transaction; compensating controls are required where staffing prevents this.

Audit universe and annual plan: risk-rank auditable entities by inherent risk, control maturity, change velocity, prior findings and regulatory attention; plan coverage must be approved by the audit committee.

Materiality benchmarks: typically 0.5%-1% of profit before tax, 1%-2% of total equity, or 0.5%-1% of total revenue; select the benchmark most relevant to financial statement users.

Performance materiality is set below overall materiality (commonly 50%-75%) to reduce the probability that uncorrected aggregate misstatements exceed overall materiality.

Clearly trivial threshold is typically 3%-5% of overall materiality; misstatements below this need not be accumulated.

Audit risk = inherent risk x control risk x detection risk; audit effort is directed to reduce detection risk to an acceptable level.

Risk assessment procedures: inquiry, analytical procedures, observation and inspection; these inform the engagement scope but do not by themselves provide sufficient appropriate evidence.

Planning documentation includes engagement objectives, scope and exclusions, significant risks, resource and skill requirements, timetable, and reliance on other assurance providers.

Significant risk is an identified risk of material misstatement judged close to the upper end of the spectrum; it requires specific audit attention and substantive procedures regardless of control reliance.

Use of other auditors/experts: assess competence, independence and objectivity, agree scope in writing, and review their work before relying on it.

Evidence hierarchy: externally generated evidence in the auditor's hands is stronger than internal evidence; documentary evidence is stronger than oral representation; original stronger than photocopy.

Sufficiency relates to quantity of evidence; appropriateness relates to relevance and reliability; both are required before a conclusion can be drawn.

Sampling risk is the risk the sample conclusion differs from the conclusion from testing the whole population; non-sampling risk is all other testing error (wrong procedure, misinterpretation).

Attribute sampling for controls: sample size driven by tolerable deviation rate, expected deviation rate and confidence level; a deviation rate above tolerable rate means the control cannot be relied on.

Monetary unit sampling (PPS) selects items proportional to value; it is efficient for overstatement testing but provides no coverage for understatement or nil-balance items.

Projected misstatement in a sample = (sample misstatement / sample value) x population value; evaluate against performance materiality.

Working papers must be sufficient for an experienced auditor with no prior connection to the engagement to understand the work performed, evidence obtained and conclusions reached.

Evidence reliability test: reperform calculations, inspect source documents, confirm balances with third parties, observe processes, and use CAAT/data analytics for full-population testing.

Documentation review hierarchy: preparer, reviewer and engagement leader sign-offs; review notes must be cleared before the report is issued.

Five Cs of credit: character, capacity, capital, collateral, conditions; loan files should evidence assessment against each.

Loan classification under BNM's policy: performing, special mention (watchlist), substandard, doubtful, bad; classification drives specific and general provision levels.

Expected credit loss (MFRS 9) = probability of default x loss given default x exposure at default, discounted; stage 1 (12-month ECL), stage 2 (lifetime ECL, significant increase in credit risk), stage 3 (credit-impaired).

Significant increase in credit risk triggers include 30+ days past due, forbearance, deterioration in internal rating, or sector stress; stage 2 is a forward-looking judgement requiring documentation.

Credit audit tests: origination documentation completeness, income verification, collateral valuation currency and enforceability, covenant monitoring, limit and approval authority compliance.

Concentration risk: single borrower and connected-party limits, sector and geography caps; connected-party aggregation requires identification of common control and financial interdependence.

Restructuring and rescheduling: forbearance must be flagged, the modified cash flows re-tested, and the exposure not returned to performing status until a defined probation period of sustained payments.

Related-party lending must be identified, approved at board level where required, and disclosed; audit tests for undisclosed connected borrowers and preferential terms.

Provision adequacy review: compare specific provisions to collateral shortfall, test model inputs against actual recovery history, and assess management override/overlay judgements.

Market risk measures: VaR (loss threshold at a confidence level and holding period), expected shortfall (average loss beyond VaR), sensitivity (PV01, delta, basis point value) and stress testing.

VaR limitations: it says nothing about the size of losses beyond the threshold, is model and history dependent, and assumes normal market conditions; hence backtesting and stress testing are required.

Backtesting compares daily P&L to VaR; exceptions beyond the expected number at the confidence level trigger model review and possible capital add-on.

Liquidity coverage ratio (LCR) = high-quality liquid assets / net cash outflows over 30 days; net stable funding ratio (NSFR) = available stable funding / required stable funding.

Treasury front office, back office and risk control must be segregated; the dealer who executes a trade cannot confirm or settle it.

Limit framework: counterparty limits, settlement limits, stop-loss limits, tenor and product limits; audit tests that limits exist, are approved, monitored and breached only with documented escalation.

Valuation control: independent price verification, stale or unobservable mark review, model validation, and reserve methodologies for illiquid positions.

Interest rate risk in the banking book (IRRBB): repricing gap, duration and earnings-at-risk analysis; audit checks assumptions on non-maturity deposits and prepayment behaviour.

Liquidity stress testing must cover institution-specific, market-wide and combined scenarios, with documented assumptions, contingency funding plan triggers and board reporting.

Operational risk definition: risk of loss from inadequate or failed internal processes, people, systems or external events; includes legal risk but excludes strategic and reputational risk.

Loss event categories: internal fraud, external fraud, employment practices, clients/products/business practices, damage to physical assets, business disruption/system failures, execution/delivery/process management.

Key risk indicators (KRIs) are forward-looking metrics with thresholds (green/amber/red) that signal rising operational risk before losses occur.

Fraud triangle: pressure/incentive, opportunity, rationalisation; controls target opportunity, while monitoring and whistleblowing address pressure and rationalisation.

Segregation of duties in payments: maker, checker and releaser roles; audit tests for user access conflicts, dormant IDs, and privileged access to payment systems.

Reconciliation control: bank accounts, suspense and nostro/vostro accounts reconciled independently and promptly; unreconciled ageing items are a red flag.

Business continuity: RTO (recovery time objective), RPO (recovery point objective); audit tests plan currency, alternate site testing and dependency on third parties.

Outsourcing and third-party risk: due diligence, contractual audit rights, service level monitoring and exit plans; critical outsourcing requires BNM notification/approval.

Change management controls: testing, user acceptance, segregation between development and production, and approval before deployment to production.

Risk-based AML approach: customer risk rating (low/medium/high) drives CDD depth, ongoing monitoring intensity and periodic review frequency.

CDD requirements: identify and verify the customer and beneficial owner, understand purpose and intended nature of the relationship, and conduct ongoing due diligence.

Beneficial ownership threshold commonly applied is 25% or more of shares or voting rights, plus identification of persons exercising control by other means.

Enhanced due due diligence is required for PEPs, high-risk jurisdictions, correspondent banking relationships and unusual complex structures; senior management approval is needed for PEP relationships.

Suspicious transaction reporting: internal escalation to the compliance/AML officer, then a report to the Financial Intelligence and Enforcement Department (FIED) of BNM; tipping off the customer is prohibited.

Sanctions screening: screen customers, beneficial owners, counterparties and payments against applicable lists at onboarding and on an ongoing basis; alerts must be investigated and documented.

Record retention: AML records and transaction documents retained for at least six years under the AMLA regime.

Compliance audit tests: sample CDD files for completeness and timeliness, test transaction monitoring alert disposition and closure rationale, and verify STR timeliness and quality.

Compliance programme elements: board-approved policy, compliance risk assessment, training, monitoring and testing, and a designated compliance officer with independent reporting lines.

Finding structure: condition (what is), criteria (what should be), cause (why it happened), effect/risk (why it matters), and recommendation (specific, actionable, owned, dated).

Rating scales are defined in the audit methodology (e.g., critical, high, medium, low) and must map to escalation rules for audit committee reporting.

Report tone: lead with the risk and management impact, avoid jargon, and quantify exposure where possible; management responses must include an owner and a target date.

Audit committee reporting covers significant findings, thematic issues, overdue actions, resource and plan status, and any scope limitations or independence threats.

Follow-up: track agreed actions to closure, perform validation testing for high-risk findings, and escalate overdue high-risk actions to the audit committee.

Quality assurance and improvement programme: internal assessments (ongoing supervision plus periodic self-assessment) and an external assessment at least once every five years by a qualified independent assessor.

Engagement quality review: an independent reviewer assesses significant judgements and the draft report before issue for high-risk engagements.

Performance metrics for internal audit: plan completion rate, cycle time, issue closure rate, stakeholder feedback, and percentage of recommendations accepted.

Conformance with the Global Internal Audit Standards requires documented independence, competence, due professional care and a quality assurance programme with reported results.

Five Cs of credit: character, capacity, capital, collateral, conditions; loan files should evidence assessment against each.

Loan classification under BNM's policy: performing, special mention (watchlist), substandard, doubtful, bad; classification drives specific and general provision levels.

Expected credit loss (MFRS 9) = probability of default x loss given default x exposure at default, discounted; stage 1 (12-month ECL), stage 2 (lifetime ECL, significant increase in credit risk), stage 3 (credit-impaired).

Significant increase in credit risk triggers include 30+ days past due, forbearance, deterioration in internal rating, or sector stress; stage 2 is a forward-looking judgement requiring documentation.

Credit audit tests: origination documentation completeness, income verification, collateral valuation currency and enforceability, covenant monitoring, limit and approval authority compliance.

Concentration risk: single borrower and connected-party limits, sector and geography caps; connected-party aggregation requires identification of common control and financial interdependence.

Restructuring and rescheduling: forbearance must be flagged, the modified cash flows re-tested, and the exposure not returned to performing status until a defined probation period of sustained payments.

Related-party lending must be identified, approved at board level where required, and disclosed; audit tests for undisclosed connected borrowers and preferential terms.

Provision adequacy review: compare specific provisions to collateral shortfall, test model inputs against actual recovery history, and assess management override/overlay judgements.

Market risk measures: VaR (loss threshold at a confidence level and holding period), expected shortfall (average loss beyond VaR), sensitivity (PV01, delta, basis point value) and stress testing.

VaR limitations: it says nothing about the size of losses beyond the threshold, is model and history dependent, and assumes normal market conditions; hence backtesting and stress testing are required.

Backtesting compares daily P&L to VaR; exceptions beyond the expected number at the confidence level trigger model review and possible capital add-on.

Liquidity coverage ratio (LCR) = high-quality liquid assets / net cash outflows over 30 days; net stable funding ratio (NSFR) = available stable funding / required stable funding.

Treasury front office, back office and risk control must be segregated; the dealer who executes a trade cannot confirm or settle it.

Limit framework: counterparty limits, settlement limits, stop-loss limits, tenor and product limits; audit tests that limits exist, are approved, monitored and breached only with documented escalation.

Valuation control: independent price verification, stale or unobservable mark review, model validation, and reserve methodologies for illiquid positions.

Interest rate risk in the banking book (IRRBB): repricing gap, duration and earnings-at-risk analysis; audit checks assumptions on non-maturity deposits and prepayment behaviour.

Liquidity stress testing must cover institution-specific, market-wide and combined scenarios, with documented assumptions, contingency funding plan triggers and board reporting.