AICB Bank Audit Practices (BKA, Malaysia) common mistakes
AICB Bank Audit Practices (BKA, Malaysia) · Understand the traps and how to avoid them.
Answering governance questions by naming the board or audit committee as the owner of every control, instead of distinguishing the three lines of defence - business unit management owns and operates controls, risk and compliance functions set frameworks and challenge, and internal audit provides independent assurance.
Candidates memorise 'the board is responsible for risk management' from general corporate governance material and then apply it to every scenario, collapsing the distinction between ownership, oversight and assurance that the BKA syllabus tests directly.
What to do instead
For each scenario, first ask 'who performs the activity?' If a business line performs it, it is a first-line control; if a risk or compliance function designs, monitors or challenges it, second line; if internal audit evaluates it, third line. Practise by taking ten common banking controls (credit approval, KYC onboarding, limit monitoring, reconciliation, model validation, complaint handling) and assigning each to a line with a one-sentence justification.
Treating the audit committee's role as identical to management's - for example stating that the audit committee approves individual credit facilities or remediates findings itself, rather than overseeing, challenging and receiving assurance.
The terms 'oversight', 'approval' and 'execution' blur together in study notes, and candidates default to the most senior body whenever a question asks 'who is responsible'.
What to do instead
Build a two-column table for each governance body (board, audit committee, senior management, internal audit, external audit) with 'decides/approves' versus 'receives/oversees'. Then answer scenario questions by locating the decision in that table before choosing an option.
Setting materiality once at planning and carrying that single figure through to evaluation, ignoring performance materiality and the clearly trivial threshold, and failing to revise materiality when new information emerges during the audit.
Candidates conflate 'materiality' with a single number and do not connect it to the design of procedures; the three-tier structure (overall, performance, clearly trivial) and the requirement to revise are easy to overlook under time pressure.
What to do instead
For every planning scenario, state all three figures with the rationale (benchmark chosen, percentage, qualitative factors such as regulatory reporting or covenant breaches) and add a sentence on when revision would be triggered. Practise with a bank client: choose profit before tax versus total assets versus regulatory capital, and justify why a prudential regulator might prefer a capital-based benchmark.
Designing substantive testing that ignores the direction of risk - for example testing credit balances for existence but not completeness, or testing loan existence but not the completeness of the allowance for credit losses.
Candidates learn assertions as a list and apply the same procedures regardless of the risk identified, rather than mapping each significant risk to the assertion most likely to be misstated and the direction of that misstatement.
What to do instead
For each risk, write the assertion and the direction explicitly (overstatement versus understatement) before choosing a procedure. For loan loss allowances, focus on valuation and completeness of provisioning; for liabilities and accruals, focus on completeness. Check that at least one procedure per significant risk actually tests the direction you identified.
Describing sampling as 'select a representative sample' without specifying the population, the sampling unit, the method (statistical or non-statistical), the basis for sample size, and how exceptions will be projected to the population.
Candidates know sampling terminology but not the operational chain, so answers stay at the level of intent and never demonstrate that the sample supports a conclusion.
What to do instead
Use a fixed five-part template for any sampling question: population and completeness check, sampling unit, method and selection technique, sample size driver (risk, tolerable deviation or misstatement, expected error), and evaluation including projection and conclusion. Apply it to a concrete case such as testing loan documentation completeness or approval authority compliance.
Reviewing credit files by checking that documents are present rather than evaluating credit quality - missing the assessment of repayment capacity, collateral valuation and haircuts, covenant compliance, watchlist triggers and the appropriateness of the risk grade.
Checklist-driven file review is easier and feels productive; candidates default to document existence because it produces a clean pass/fail, whereas judging creditworthiness requires applying lending policy criteria.
What to do instead
For each file, structure the review around five judgements: affordability and cash flow, collateral valuation and enforceability, covenant compliance, risk grade accuracy against the bank's grading criteria, and evidence of periodic review. Practise by writing the specific evidence you would need for each judgement rather than the document you would tick.
Auditing treasury by confirming that limits exist and that reports are produced, instead of testing whether limit breaches were identified, escalated and resolved, and whether the limit framework itself was recalibrated for market conditions.
Treasury and market risk are treated as highly technical and candidates retreat to control-existence testing; the operational reality is that the audit value lies in breach handling and limit governance.
What to do instead
Design treasury tests around the breach lifecycle: extract the limit-breach log, trace a sample from detection through escalation to resolution and any limit change, and confirm the approval authority for limit changes. Separately test that position and valuation data feeding risk reports reconciles to the general ledger and the front-office system.
Treating fraud risk as a separate checklist item rather than integrating it into the audit approach - for example not considering management override of controls, collusion, or the incentive and opportunity factors specific to a banking process.
Fraud is studied as a standalone topic and candidates do not carry it back into planning and testing, so fraud considerations appear as a boilerplate paragraph rather than shaping procedures.
What to do instead
At planning, for each significant process write one sentence on the fraud scheme most likely to occur (e.g. fictitious loans, fee waivers, ghost employees, teeming and lading), the incentive and opportunity, and the specific unpredictable procedure you would perform. Include management override journal-entry testing and review of accounting estimates as standing procedures.
Writing AML/CFT conclusions based on the existence of a policy and a KYC checklist, without testing customer risk rating accuracy, enhanced due diligence for higher-risk customers, transaction monitoring alert disposition, or the timeliness of suspicious transaction reporting.
AML is document-heavy and candidates equate a documented programme with an effective one, missing that regulators assess effectiveness of implementation rather than design alone.
What to do instead
For AML audits, test a sample end-to-end: onboarding file, risk rating against the bank's own criteria, EDD evidence, ongoing monitoring and periodic review, alert investigation notes, and STR decision and timing. Report findings against the specific regulatory obligation breached, not just 'weak documentation'.
Ending the answer at the audit finding - stating the issue and the recommendation - without grading severity, agreeing a management action with an owner and due date, or describing the follow-up and escalation mechanism if remediation slips.
Candidates treat reporting as the final step and underestimate how much of the syllabus covers communication, follow-up and quality assurance, so the closing loop is omitted.
What to do instead
Use a standard finding structure every time: condition, criteria, cause, effect, risk rating with justification, agreed action, owner, due date, and follow-up timing. Then add one sentence on escalation if the action is overdue, and on how quality assurance (engagement review, file inspection) would confirm the finding was properly evidenced.