AICB Bank Audit Practices (BKA, Malaysia) study plan

Map the three lines model onto a Malaysian bank's board, board audit committee, senior management and internal audit charter, and state who owns each control layer

Distinguish the COSO internal control components from the COSO ERM components and explain how internal audit uses each as an evaluation lens

Draft a one-page note on how BNM's corporate governance policy expectations for financial institutions translate into internal audit's mandate and reporting lines

Identify the independence threats (self-review, familiarity, undue influence) that arise when internal audit also performs consulting work in a bank

Apply a risk-based audit universe approach to rank a bank's auditable units by inherent risk and control maturity

Construct a risk assessment matrix that scores likelihood and impact for a retail credit and a treasury unit and justify the weighting choices

Convert assessed risk into an annual audit plan with coverage frequency, resourcing and rationale for any deferrals

Set planning materiality and performance materiality for a bank using a benchmark such as profit before tax or total assets, and document the judgement

Write audit objectives, scope and criteria for a loan origination audit that link each objective to the risk assessment findings

Translate audit objectives into specific tests of controls and substantive procedures, distinguishing tests of design from tests of operating effectiveness

Select a sampling approach (statistical versus judgemental, attribute versus monetary unit) for a population of loan files and justify the sample size drivers

Design a working paper template with preparer, reviewer, date, source, tick marks and conclusion that would survive an internal quality review

Evaluate the sufficiency and appropriateness of evidence types (inspection, observation, inquiry, recalculation, confirmation, reperformance) for a credit file review

Recompute key credit metrics such as debt service ratio, loan-to-value and classification triggers from a sample of loan files and document exceptions

Assess whether collateral valuation, security perfection and covenant monitoring controls operate as designed

Distinguish impairment staging under expected credit loss principles from classification and provisioning rules, and design procedures that test both

Test the loan review and watchlist process, including how early warning signals escalate and how forbearance and restructuring are identified and reported

Analyse concentration risk by sector, borrower group and connected parties, and articulate the audit implication of any breach of single counterparty exposure limits

Examine treasury front, back and middle office segregation, deal capture, revaluation and limit monitoring controls

Evaluate how interest rate risk in the banking book and liquidity risk are measured, including the use of stress testing and the liquidity coverage and net stable funding ratios

Recompute a sample of treasury deal revaluations and mark-to-market valuations against independent price sources

Map operational risk loss events and near misses to the bank's risk taxonomy and assess whether incident capture, root cause analysis and remediation are effective

Design fraud risk procedures for payments, customer onboarding, staff collusion and internal accounts, including red flag analytics such as duplicate beneficiaries and unusual override patterns

Apply the AML/CFT control chain from customer due diligence through ongoing monitoring, suspicious transaction reporting and record keeping, and identify where testing should focus

Assess sanctions screening and politically exposed person controls, including threshold tuning, alert disposition quality and escalation timeliness

Distinguish the auditor's role in detecting fraud from management's responsibility, and describe how findings should be escalated when fraud indicators are found

Draft audit findings in the condition, criteria, cause, effect and recommendation structure, with each finding rated by severity

Write an executive summary and audit report that communicates root cause and risk exposure to an audit committee without jargon

Distinguish the audit report from the management response, and evaluate whether a proposed action plan is specific, owned and time-bound

Design a follow-up and issue tracking process that defines closure evidence, ageing escalation and repeat finding treatment

Explain how an internal quality assessment review and an independent external quality assessment test whether the audit function conforms to professional standards

Consolidate weak areas by re-testing the lowest scoring domain from earlier weeks against a timed set of practice questions

Rehearse explaining the audit lifecycle from risk assessment through reporting and follow-up in a single narrative

Memorise and correctly apply the key definitions that exams test, including materiality, audit evidence sufficiency, inherent and control risk, and the three lines model

Build a one-page quick reference of the most confusable pairs, such as control risk versus detection risk and forbearance versus restructuring

Plan exam-day time allocation by domain weight so that the 15 percent domains receive proportionally more time