AICB Bank Audit Practices (BKA, Malaysia) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Three lines model

First line owns and manages risk, second line provides oversight and challenge, third line gives independent assurance to the board and audit committee.

Residual risk

The risk remaining after controls are applied; calculated as inherent risk adjusted for control effectiveness and compared against approved risk appetite.

Key control

A control whose failure would materially affect the risk being mitigated; it receives the most testing attention in an internal audit engagement.

Performance materiality

An amount set below overall materiality, commonly 50 to 75 percent, to reduce the chance that uncorrected aggregate misstatements exceed overall materiality.

Significant risk

An identified risk of material misstatement judged close to the upper end of the risk spectrum, requiring specific audit attention and substantive procedures.

Detection risk

The risk that audit procedures fail to detect a material misstatement; the auditor controls it by designing more effective and extensive testing.

Attribute sampling

A sampling method for controls testing where sample size is driven by tolerable deviation rate, expected deviation rate and required confidence level.

Projected misstatement

Sample misstatement divided by sample value, multiplied by population value; the result is compared against performance materiality to judge acceptability.

Monetary unit sampling

A selection method where probability of selection is proportional to value; effective for overstatement testing but gives no coverage to nil or understated balances.

Expected credit loss

Probability of default times loss given default times exposure at default, discounted; stage one uses twelve-month ECL and later stages use lifetime ECL.

Significant increase in credit risk

A trigger such as thirty days past due, forbearance or rating deterioration that moves an exposure from twelve-month to lifetime expected credit loss measurement.

Forbearance

A concession granted to a borrower in financial difficulty; it must be flagged, re-tested and not returned to performing status until sustained payments are observed.

Value at risk

A loss threshold at a stated confidence level and holding period; it is silent on losses beyond the threshold, so backtesting and stress testing are required.

Liquidity coverage ratio

High-quality liquid assets divided by net cash outflows over a thirty-day stress period; a key regulatory measure of short-term liquidity resilience.

Independent price verification

A control where a function separate from the front office independently checks trade valuations against external or model-derived prices and reviews stale marks.

Operational risk

The risk of loss from inadequate or failed internal processes, people, systems or external events; it includes legal risk but excludes strategic and reputational risk.

Fraud triangle

Three conditions behind fraud: pressure or incentive, opportunity, and rationalisation. Controls mainly reduce opportunity through segregation and monitoring.

Maker checker releaser

A payments control where separate individuals initiate, verify and release a transaction, preventing one person from completing a payment alone.

Beneficial ownership threshold

The commonly applied level of twenty-five percent or more of shares or voting rights, plus any person exercising control by other means.

Enhanced due diligence

Deeper customer checks required for politically exposed persons, high-risk jurisdictions and complex structures, with senior management approval for PEP relationships.

Suspicious transaction report

An escalation to the AML compliance officer and then to the Financial Intelligence and Enforcement Department of Bank Negara Malaysia; tipping off the customer is prohibited.

Finding condition and criteria

The condition states what was found; the criteria states what should have been, drawn from policy, regulation or leading practice.

Quality assurance programme

Internal assessments through supervision and periodic self-assessment, plus an external assessment at least every five years by a qualified independent assessor.

Follow-up validation

The process of tracking agreed management actions to closure and retesting high-risk findings to confirm the fix actually works.

Connected party aggregation

Grouping exposures that share common control or financial interdependence so that single borrower and related party limits are correctly applied.

Repricing gap

The difference between assets and liabilities repricing within a time bucket; it drives earnings sensitivity to interest rate movements in the banking book.

Recovery time objective

The maximum acceptable time to restore a process after disruption; business continuity audit tests whether this is defined, tested and achievable.

Sanctions screening

Checking customers, beneficial owners and payments against applicable sanctions lists at onboarding and on an ongoing basis, with documented alert investigation.

Audit committee escalation

The route for significant findings, overdue high-risk actions, scope limitations and independence threats to reach the board audit committee.

Special mention account

A watchlist classification for loans showing early signs of weakness, sitting below substandard and above performing in the credit grading scale.

Stop-loss limit

A treasury control capping cumulative trading loss; breaches must be escalated and evidenced rather than absorbed silently by the desk.

Clearly trivial threshold

A monetary amount, often three to five percent of overall materiality, below which misstatements need not be accumulated for evaluation.