AICB Bank Audit Practices (BKA, Malaysia) key terms

A governance structure where operational management owns risk, a risk and compliance function provides independent oversight, and internal audit gives independent assurance to the board. It clarifies accountability for controls and reporting.

A formal board-approved document defining internal audit's purpose, authority, independence, scope and reporting lines. It gives auditors the right of access to records and protects them from management interference.

A board subcommittee of independent directors responsible for overseeing financial reporting, internal control, internal and external audit, and regulatory compliance. It approves the audit plan and receives audit findings.

A board-approved declaration of how much risk the bank is willing to accept in pursuing its objectives, often expressed as limits and tolerances by risk type. Auditors use it as a benchmark for judging exposures.

The tone set by senior management and the board, covering integrity, ethical values, organisational structure, authority and competence. It is the foundation on which all other internal control components rest.

A widely used internal control model with five components: control environment, risk assessment, control activities, information and communication, and monitoring. Many banks map their control frameworks to it.

An annual plan that prioritises audit coverage according to assessed risk, materiality and regulatory requirements. It links audit resources to the areas of greatest exposure and is approved by the audit committee.

A complete inventory of auditable entities, processes and systems within the bank, used to allocate audit coverage systematically. Each unit is rated for risk to determine how often it should be audited.

The level of risk in a process or activity before considering the effect of existing controls. Auditors assess it first so that control adequacy can be judged against the exposure it is meant to mitigate.

The risk that remains after existing controls have been applied. It drives the audit opinion on whether the control framework keeps exposures within the board's stated appetite.

The threshold at which an error, omission or control weakness could influence the decisions of users such as regulators, depositors or the board. It guides sampling size and the significance of findings.

A lower amount set below overall materiality to reduce to an acceptably low level the probability that uncorrected and undetected misstatements exceed the overall threshold. It is applied to individual tests.

A document confirming the objectives, scope, timing, responsibilities and reporting arrangements for a specific audit assignment. It is agreed with the auditee before fieldwork begins.

Tracing one or more transactions through the entire process from initiation to recording, to confirm the auditor's understanding of the flow and identify where controls operate. It informs the design of later tests.

A procedure to evaluate whether a control operated effectively throughout the period under review. Evidence is usually gathered by inspection, observation, inquiry or re-performance.

Procedures that detect material misstatements at the assertion level, including detailed tests of transactions, balances and analytical procedures. It is used where controls are weak or risk is high.

Applying procedures to less than the whole population so that each sampling unit has a chance of selection, enabling the auditor to draw conclusions about the population. It may be statistical or judgemental.

The risk that the auditor's conclusion based on a sample differs from the conclusion that would be reached by testing the entire population. It is controlled by sample size and selection method.

Records prepared or obtained by auditors documenting the procedures performed, evidence obtained and conclusions reached. They must be sufficient for an experienced auditor with no prior connection to the engagement to understand the work.

All information used to arrive at the audit conclusions, including records, confirmations, observations and analyses. Its sufficiency and appropriateness depend on risk, materiality and the reliability of the source.

Direct written response from a third party, such as a borrower or correspondent bank, verifying a balance or condition. It is generally more reliable evidence than internally generated records.

The risk of loss when a borrower or counterparty fails to meet contractual obligations. It is the largest risk for most banks and is managed through underwriting standards, limits, collateral and provisioning.

Assigning loans to categories such as performing, special mention, substandard, doubtful or loss, based on repayment behaviour and borrower condition. Classification drives provisioning and regulatory reporting.

A loan that is past due beyond a defined period, commonly 90 days, or where the borrower is unlikely to repay in full without realising collateral. It signals credit deterioration and attracts higher provisions.

A forward-looking impairment measure combining probability of default, exposure at default and loss given default over a defined horizon. It replaced incurred-loss provisioning in many jurisdictions.

Independent examination of a sample of credit files to assess underwriting quality, documentation, collateral valuation, classification accuracy and adherence to policy. Findings feed the credit risk rating of the portfolio.

Exposure arising from a large share of the portfolio being lent to one borrower, group, sector or geography, so that a single adverse event causes disproportionate loss. It is monitored against board-approved limits.

The risk that changes in interest rates reduce net interest income or the economic value of equity from non-traded positions. It is measured through gap analysis, duration and earnings simulations.

A regulatory ratio of high-quality liquid assets to net cash outflows over a 30-day stress period, requiring a minimum of 100 percent in many jurisdictions. It tests short-term resilience to funding stress.

A statistical estimate of the maximum loss on a portfolio over a given holding period at a stated confidence level. It is widely used for trading book market risk but does not capture tail events well.

Measuring positions at the price obtainable in current market conditions rather than historical cost. Auditors test valuation inputs, model governance and independent price verification for trading portfolios.

Dividing tasks so that no single person controls all stages of a transaction, such as initiation, authorisation, recording and reconciliation. It is a core preventive control against error and fraud.

An indicator or pattern suggesting possible fraudulent activity, such as unusual journal entries, lifestyle changes, override of controls or staff refusing leave. Auditors treat red flags as triggers for deeper testing.

A confidential mechanism for staff, customers and third parties to report suspected misconduct without fear of retaliation. Its independence, accessibility and follow-up are common audit testing areas.

A report filed with the financial intelligence unit when a bank suspects funds are linked to criminal activity, including attempted transactions. Timely filing is a core anti-money-laundering obligation.

Identifying and verifying customers, understanding their business and risk profile, and conducting ongoing monitoring. Enhanced measures apply to higher-risk customers such as politically exposed persons.

Comparing customer and transaction data against designated lists of prohibited persons and entities, including at onboarding and on each payment. Failures can attract severe regulatory penalties.

The formal document communicating the audit objective, scope, findings, risk ratings and recommendations to management and the audit committee. It must be balanced, evidence-based and clearly prioritised.

The auditee's written commitment to address a finding, stating the agreed action, accountable owner and target date. Auditors evaluate whether the response adequately mitigates the identified risk.

Verification that management actions agreed in response to audit findings have been implemented and are operating effectively. Overdue findings are escalated to the audit committee.

An independent review of an audit engagement's working papers, judgements and report before issue, performed by someone not involved in the assignment. It strengthens consistency and defends conclusions.