Governance, risk management and the internal control framework
What the exam tests
This domain asks how an internal auditor forms an opinion on governance, risk management and the internal control framework in a Malaysian licensed bank. Expect questions on board and audit committee oversight, the three lines model, risk appetite, COSO components, and BNM corporate governance expectations under the FSA 2013 and IFSA 2013.
Core rules and concepts
- The board approves strategy, risk appetite and the control framework; the audit committee must be independent and able to challenge management and the chief internal auditor.
- The IIA three lines model: management owns risk and controls (first line); risk and compliance provide independent oversight and challenge (second line); internal audit provides independent assurance (third line). It is not a reporting hierarchy.
- COSO five components: control environment, risk assessment, control activities, information and communication, monitoring. Auditors test design and operating effectiveness, not mere existence.
- Controls are preventive, detective or corrective. Key controls include authorisation, segregation of duties, reconciliation, access restriction and exception reporting.
- BNM expects a risk appetite framework with quantitative and qualitative limits, regular board reporting, and an internal audit function with unrestricted access.
Worked example
You review a bank where the internal audit head reports administratively to the CFO, the audit committee meets twice a year, and no committee member has banking or accounting experience. The audit work itself looks competent. The correct conclusion is not no issue. Functional reporting to the CFO compromises independence; infrequent meetings and missing financial expertise weaken oversight. Rate the governance control as deficient, explain the effect on the audit committee ability to challenge, and recommend a direct functional line to the audit committee plus a skills matrix review.
Traps
- Treating the three lines as an org chart rather than separate roles.
- Accepting management self-assessment as assurance.
- Ignoring Shariah governance in Islamic banks.
- Confusing risk management (second line) with internal audit.