Internal Audit in Banking

Visual overview

Internal Audit in Banking at a glance — Risk-based audit, audit committees, assurance.

Risk-Based Audit, Audit Committees, and the Third Line of Assurance

Internal audit serves as the independent conscience of a banking organization, providing objective assurance that the controls protecting the institution are functioning as intended. As the third line of defense in the risk management framework, internal audit does not manage risks itself but verifies that the first line of business units and the second line of risk management and compliance are fulfilling their responsibilities effectively. This independent verification function is essential in banking, where the complexity of operations, the volume of transactions, and the consequences of failure demand systematic oversight beyond what management can provide.

The core purpose of internal audit is to provide independent assurance on the effectiveness of governance, risk management and internal controls. Its mandate can also include advisory work where independence is protected, and it may assess compliance controls, fraud-risk management and investigations performed by responsible functions. Internal audit should not become the owner of the controls it later audits, nor should it be described as the bank's primary fraud-detection or compliance-execution function. Its reports should reach the board or audit committee through an independent functional reporting line, with senior management responsible for remediating agreed findings.

A common way to explain responsibilities is the three-lines concept. Business and operational management own and manage the risks created by their activities. Risk management, compliance and other second-line functions provide frameworks, challenge, monitoring and specialist oversight without replacing first-line ownership. Internal audit provides independent third-line assurance to the board. The Institute of Internal Auditors now refers to its framework as the Three Lines Model, while Basel banking guidance continues to use third-line language. The important point is the allocation of accountability and independence, not the label itself.

The principle of independence is foundational to internal audit effectiveness. Internal audit must report functionally to the Audit Committee of the Board rather than to the chief executive or management. This reporting line ensures that audit findings are communicated to those with the authority and independence to act on them without management interference. While administrative matters may be handled through normal management channels, the audit plan, resource allocation, and reporting relationships must maintain independence to preserve objectivity. Without this independence, internal audit becomes merely another management function subject to pressure to soften criticism or avoid sensitive topics.

Modern internal audit has evolved from traditional approaches focused on transaction testing and compliance verification to risk-based internal audit that concentrates resources where risk is greatest. Traditional audit approaches attempted to examine everything equally, conducting detailed transaction testing across all areas without regard to relative risk. Risk-based audit recognizes that resources are limited and focuses intensively on high-risk areas while providing lighter coverage of lower-risk activities. This approach shifts from backward-looking compliance verification to forward-looking risk identification, seeking to anticipate problems before they materialize. Audit plans become dynamic rather than fixed, adjusting throughout the year as risks emerge or recede. This responsiveness ensures that audit resources address the most significant current threats rather than executing plans developed months earlier based on outdated risk assessments.

A risk-based audit process normally moves from risk assessment and audit-universe design through planning, fieldwork, reporting and follow-up. Higher-risk areas generally receive greater depth or more frequent coverage, but there is no universal rule that every high-, medium- and low-risk activity must follow one fixed six-, twelve- or twenty-four-month cycle. Coverage should reflect the bank's size, complexity, risk assessment, regulatory expectations, significant change, previous findings and available assurance. The audit committee should understand why material areas are included, deferred or covered through thematic and continuous-audit approaches.

The audit committee, where required under the bank's applicable legal and regulatory framework, provides board-level oversight of internal audit, external audit and financial-control matters. Exact membership, independence, expertise and meeting requirements differ by institution type and jurisdiction and can arise from banking regulation, company law and securities-listing rules. Basel guidance expects the audit committee of a large or internationally active bank to support the board's oversight and to have members with the skills and independence needed to challenge management and auditors effectively. Practitioners should use the current rules for the specific bank rather than treat one committee template as universal.

Audit Committee responsibilities span the full range of financial integrity and control oversight. Financial reporting integrity involves reviewing accounting policies, significant judgments, and overall financial statement reliability. Internal audit oversight includes approving the annual audit plan, reviewing audit findings and management responses, ensuring internal audit independence, and evaluating the quality of internal audit work. External audit oversight covers appointment of auditors, review of their scope and findings, and evaluation of their independence and effectiveness. Internal control assessment involves regular review of the control framework's adequacy and identification of material weaknesses requiring remediation. Compliance monitoring tracks adherence to laws, regulations, and internal policies. Whistleblower oversight ensures that mechanisms for reporting wrongdoing function effectively and that reports are properly investigated without retaliation.

Banking requires specialized audit approaches addressing the industry's unique risks and activities. Branch audits examine operations, cash handling, compliance, and customer transactions at individual locations, providing assurance that standards are maintained throughout the network. Concurrent audits provide real-time review of daily transactions at high-volume branches, identifying issues immediately rather than months later. Credit audits examine loan portfolio quality, the loan sanction process, and documentation adequacy, ensuring that credit standards are maintained. Treasury audits review trading operations, investment portfolio management, and market risk controls, areas where losses can accumulate rapidly. Information systems and information technology audits address cybersecurity, data integrity, system access controls, and business continuity capabilities. Revenue audits detect leakage in interest income, fee income, and other revenue streams. Compliance audits verify adherence to regulatory requirements across all applicable areas. Anti-money laundering audits specifically assess KYC compliance and transaction monitoring effectiveness.

Banks can be subject to several assurance and supervisory mechanisms in addition to internal audit, including statutory external audit, regulatory reporting, supervisory inspection and specialised reviews. In India, the detailed requirements for statutory auditor appointment, long-form reporting, concurrent audit and other reviews depend on the type of bank and the current RBI instructions. Stock or collateral verification may also be required by credit policy, sanction terms or supervisory expectations. These mechanisms complement rather than replace internal audit, and their scope should be verified against the current rule applicable to the institution.

Internal audit quality can be assessed through several key indicators. Independence is preserved through reporting relationships, access to the Audit Committee, and protection from management interference. Competence requires qualified staff holding certifications such as Chartered Accountant, Certified Internal Auditor, or Certified Information Systems Auditor credentials. Methodology should be documented and consistently applied, with risk-based planning and systematic execution. Follow-up rates measure the percentage of past findings that management has actually resolved rather than merely acknowledged. Coverage metrics ensure that all significant risk areas receive audit attention within defined cycles. Timeliness requires that reports are issued within defined timelines from audit completion, ensuring that findings remain relevant and actionable.

Internal audit in banking serves as the final check in a system designed to manage risks that could otherwise destroy institutions and harm the economy. By providing independent assurance to the board, internal audit enables informed governance and supports regulatory confidence in the banking system. The evolution toward risk-based approaches has enhanced audit effectiveness, focusing limited resources where they matter most. As banking grows more complex, the internal audit function must continue evolving to provide the assurance that stakeholders require.

Deep Dive: Internal Audit as Independent Assurance in a Bank

Internal audit is the function that asks whether the bank's governance, risk management and controls work as management and the board believe they work. It does not own the risks and should not design itself into the daily controls it later audits. Its value comes from independence, professional scepticism, access to evidence and the ability to connect weaknesses across business lines that may look harmless when viewed separately.

In a modern bank, the audit universe can include lending, deposits, payments, treasury, market operations, financial reporting, regulatory reporting, AML controls, cyber security, data, models, cloud services, third parties, change programmes and legal entities. The function therefore needs both broad banking understanding and specialist expertise. Risk-based planning helps direct limited audit capacity toward the areas where failure could matter most.

1. Assurance is different from management ownership

A business line is responsible for operating its controls. Risk and Compliance provide frameworks, monitoring and challenge. Internal Audit independently evaluates whether those arrangements are adequate and effective.

This distinction matters when management asks Internal Audit to “approve” a new process. Auditors can provide advice or observations where the mandate permits, but they should avoid becoming the decision-maker. If Internal Audit designs the control, approves the configuration and later declares that same control effective, independence is compromised.

A useful boundary is that management owns the decision and remediation. Internal Audit may explain risk, challenge assumptions and assess whether the finished design provides sufficient control.

2. The audit charter establishes authority

An internal audit charter should describe the function's purpose, authority, responsibility, organisational position and access rights. It normally requires board or audit-committee approval.

The charter should give auditors unrestricted access, subject to appropriate information-security controls, to records, systems, premises and personnel needed for their work. It should also define how the head of Internal Audit can escalate when management restricts access or disagrees with a material finding.

Without this formal authority, independence can disappear exactly when the subject is sensitive.

3. Functional reporting protects independence

Administrative support can sit within normal management structures, but the head of Internal Audit needs a functional reporting line to the board or audit committee. The board should have meaningful influence over appointment, removal, performance assessment, remuneration, budget and audit-plan approval.

This reduces the risk that an executive can suppress uncomfortable work by limiting resources or threatening the auditor's position.

Direct private sessions between the audit committee and the head of Internal Audit are valuable because they create a channel for concerns that may be difficult to raise in a large management meeting.

4. Independence also depends on behaviour

A formal reporting line does not automatically create an independent mindset. Auditors can become too familiar with long-standing management teams, avoid difficult conclusions, or treat previous audit opinions as commitments that cannot be reconsidered.

Rotation, supervision, quality review and professional standards help protect objectivity. Auditors should declare conflicts and avoid auditing areas for which they recently had management responsibility where independence could reasonably be questioned.

Professional scepticism means being willing to change a conclusion when the evidence changes, even if that creates an uncomfortable discussion.

5. The audit universe should represent the real bank

An audit universe is the structured population of auditable entities, processes, systems, products, legal entities and risks. If it is incomplete, risk-based planning starts from a false map.

Banks should update the universe when new businesses launch, entities are acquired, systems migrate or operating models change. A cloud platform supporting five products should not disappear because the old universe was organised only by departments. A shared payment engine may create risk across several business lines and deserve its own coverage.

The universe should reflect dependencies as well as organisation charts.

6. Risk assessment should use more than historical findings

Previous audit issues are useful, but a clean historical record does not prove that an area is low risk today. Growth, leadership change, new regulation, system migration, outsourcing, market volatility or changing customer behaviour can alter risk quickly.

Audit risk assessment can consider inherent risk, control maturity, financial exposure, customer impact, regulatory importance, change intensity, incident history, data quality, external events and time since last coverage.

Judgement should be documented. A numeric score can support consistency but should not hide why one area receives priority over another.

7. Audit planning is dynamic

An annual plan provides structure, but the bank's risk profile does not freeze for twelve months. Internal Audit should have a process to amend coverage when major events occur.

A severe cyber incident, unexpected regulatory finding, acquisition or sudden liquidity stress can justify reallocating work. The audit committee should understand material plan changes and the consequences of deferred audits.

Dynamic planning does not mean constantly abandoning the approved plan. It means retaining enough flexibility to respond to genuinely changed risk.

8. Coverage frequency should be evidence-based

Some institutions use risk tiers to guide how often areas are audited. Those cycles are internal planning tools, not universal laws. A high-risk payment platform undergoing rapid change might need continuous or thematic review rather than one audit every six months. A stable low-risk function may still require targeted coverage if regulation changes.

The board should understand whether significant risks receive sufficient assurance from Internal Audit, external audit, regulators or other independent reviews. Reliance on other assurance can be sensible when scope and quality are understood.

9. Scoping is where audit quality often begins

An audit can be perfectly executed and still miss the real risk if the scope is wrong. Auditors should define which entities, systems, products, periods, risks and controls are included, and which are excluded.

For example, an audit titled “Payments” could cover customer initiation but omit sanctions screening, settlement, reconciliation and exception handling. The report title might sound comprehensive even though the scope is narrow.

Clear scope statements prevent that misunderstanding and help the audit committee see what assurance it is actually receiving.

10. Process walkthroughs test understanding before sampling

Before testing samples, auditors need to understand how the process really operates. A walkthrough follows a transaction or case from start to finish, comparing documented procedure with system behaviour and staff practice.

This can reveal controls that exist only on paper, manual workarounds, duplicate data entry or unclear ownership. It also helps identify where evidence is created and which systems are authoritative.

In a loan process, for example, the walkthrough may move from application through credit decision, documentation, booking, collateral, disbursement and monitoring rather than test one isolated approval field.

11. Control design and control operation are different questions

A well-designed control may fail in practice. Conversely, a staff member may achieve the right outcome through manual effort even though the process design is weak.

Auditors should distinguish design effectiveness from operating effectiveness. Design asks whether the control, if performed as intended, addresses the risk. Operating effectiveness asks whether it actually operated consistently during the period tested.

This distinction improves remediation. A design flaw needs process change; an execution failure may need training, capacity, supervision or automation.

12. Sampling must fit the risk

Statistical sampling can provide disciplined coverage, while judgemental sampling can target high-risk or unusual items. The choice should reflect the audit objective.

A random sample may miss the largest or most complex transactions. A purely judgemental sample may identify issues but not support conclusions about the wider population. Auditors should explain the basis and limitations of the sample.

Data analytics increasingly allows full-population tests for certain attributes, but automated testing still depends on data completeness and correct logic.

13. Data analytics expands audit reach

Internal Audit can use analytics to identify duplicate payments, unusual manual overrides, access conflicts, dormant accounts, limit breaches, late reconciliations or patterns that traditional sampling might miss.

The analytics itself needs control. Query logic should be validated, source systems understood and exclusions documented. If the population is incomplete, a sophisticated algorithm can produce a false sense of assurance.

Reusable analytics can support continuous monitoring by Internal Audit, but management should not assume that audit analytics replace first-line controls.

14. Root cause matters more than symptom count

Finding ten late reconciliations is less useful than understanding why they are late. The cause might be inadequate staffing, poor system design, unclear ownership, a broken interface or unrealistic service levels.

Audit reporting should distinguish the immediate control failure from the underlying cause. Otherwise management can close individual exceptions while the same problem reappears elsewhere.

Root-cause analysis also helps identify systemic themes across audits, such as weak data ownership or change governance.

15. Findings should describe risk clearly

An audit issue should explain condition, expected standard, cause, risk and required outcome. Long descriptions of procedure without a clear risk make it difficult for management and the board to prioritise.

Severity ratings should reflect potential impact and likelihood, considering financial loss, customer harm, legal consequences, operational disruption and control environment. Ratings should be governed consistently across teams.

A dramatic title should not be used to compensate for weak evidence, and a politically sensitive issue should not receive a lower rating merely because the owner is senior.

16. Management actions must be specific

“Management will strengthen the process” is not a good remediation plan. Actions should state what will change, who owns it, when it will be completed and how closure will be evidenced.

For technology issues, the action may require code change, access redesign, data repair and regression testing. For governance issues, it may require a revised mandate, reporting process or decision authority.

Internal Audit should challenge whether the proposed action actually addresses the finding rather than simply accept a target date.

17. Issue closure requires evidence

A finding is not resolved because the owner says it is resolved. Internal Audit or another defined assurance mechanism should verify closure according to severity and policy.

Evidence might include system screenshots, test results, revised procedures, reconciliations, training records or observed operation over time. Some changes need sustained performance before closure.

Premature closure can create misleading board reporting and allow repeat findings.

18. Overdue issues are a governance signal

Not every delay is equally serious. A low-risk documentation update and a critical cyber vulnerability should not be treated alike.

Management information should show overdue issues by risk, age, owner and root cause. Repeated date extensions need scrutiny, especially when they concern the same executive or programme.

The audit committee should be able to distinguish legitimate dependency delays from weak remediation discipline.

19. Repeat findings deserve heightened attention

A repeated issue suggests that prior remediation was ineffective or that management did not address the underlying cause. It can also indicate a broader cultural problem.

Internal Audit should identify recurrence across business units, not only within the same audit. Weak privileged-access control may appear separately in payments, lending and data platforms but represent one enterprise theme.

The board benefits when Internal Audit connects those dots.

20. Credit audit goes beyond file completeness

A credit audit should not be reduced to checking whether every document is present. It should assess underwriting standards, authority, risk rating, collateral, covenant monitoring, classification, provisioning inputs and early-warning processes as relevant to scope.

Portfolio behaviour matters as well. Rapid overrides, concentration growth or repeated exceptions can indicate deterioration before individual loans default.

Auditors should understand the credit lifecycle so they can distinguish a missing administrative document from a control failure that affects risk acceptance.

21. Treasury audit needs front-to-back understanding

Treasury activity can involve dealing, confirmation, settlement, valuation, limits, collateral, accounting and market data. Segregation of duties is fundamental because one person should not be able to trade, confirm and settle the same transaction without independent control.

Auditors should understand product complexity, valuation models, limit architecture and interfaces between front, middle and back office.

A reconciliation break can signal a booking error, system defect or unauthorised transaction. The audit should investigate the control environment around the break, not merely count it.

22. Payments audit follows the life cycle

A payment audit can trace initiation, authentication, fraud controls, sanctions screening, routing, settlement, posting, reconciliation, returns and investigations. Different schemes and channels create different risks.

The auditor should understand finality, duplicate prevention, access control, limits, exception queues and recovery procedures. For real-time payments, control speed and availability become especially important.

Payment risk crosses business, technology and operations, making end-to-end scoping essential.

23. AML audit evaluates the framework, not individual suspicion

Internal Audit can assess whether AML governance, customer due diligence, screening, transaction monitoring, investigation, reporting and quality assurance are designed and operating effectively.

It should not become the primary suspicious-activity decision-maker. The audit tests whether responsible functions make those decisions under the applicable framework.

Useful evidence includes alert populations, scenario governance, KYC backlogs, case quality, data lineage and regulatory commitments.

24. Technology audit is now core banking audit

Modern banks cannot separate business risk from technology risk. Core banking, APIs, cloud services, identity systems and data platforms directly affect customer balances and transactions.

Technology auditors may examine access management, change control, secure development, resilience, backup, logging, vulnerability management and architecture governance.

Specialist skills are essential, but technical findings should be translated into banking impact so the audit committee understands why they matter.

25. Cyber audit should test governance and execution

Cyber-security frameworks can look impressive on paper. Internal Audit should test whether critical assets are identified, vulnerabilities are remediated, access is controlled, incidents are detected and response plans work.

Exercises and technical testing can provide evidence, but scope should be coordinated with independent penetration testing and security assurance to avoid duplication.

A cyber audit should also consider third parties and identity dependencies because attackers often exploit the weakest connected point rather than the bank's strongest perimeter.

26. Model audit requires specialised judgement

Banks use models for credit risk, pricing, valuation, capital, fraud, AML and many other purposes. Internal Audit can assess model governance, inventory, validation, change control, use and remediation.

It does not normally replace independent model validation. Instead, it evaluates whether the model-risk framework itself is functioning and whether key controls are effective.

For artificial-intelligence models, data lineage, explainability, monitoring, human oversight and change management can become part of the audit universe.

27. Regulatory reporting audit follows data lineage

A regulatory return can be wrong even when the final spreadsheet looks reasonable. Auditors should understand source systems, transformations, manual adjustments, approvals, reconciliations and change control.

Material figures should be traceable back to authoritative data. Repeated manual corrections can indicate a structural system weakness.

The audit should distinguish reporting accuracy from regulatory interpretation. Legal or Compliance functions may own the interpretation, while data and Finance own execution; governance should connect both.

28. Outsourced services remain auditable risk

When the bank uses a third party, Internal Audit should consider whether the bank's third-party risk framework provides sufficient oversight and whether audit rights can be exercised.

The auditor may use provider assurance reports, bank monitoring evidence or targeted direct review depending on risk and contractual access. Reliance should consider scope, period, exceptions and independence of the external assurance.

The existence of a vendor contract does not remove the service from the audit universe.

29. Major change programmes need timely audit involvement

If Internal Audit waits until a three-year transformation is finished, it may identify fundamental weaknesses too late to fix economically. Risk-based audit can include programme assurance at key stages while preserving management ownership.

Auditors might assess governance, data migration, reconciliation, access, testing, cutover and issue management. They should avoid becoming project managers.

The audit committee should understand the distinction between real-time assurance and formal post-implementation audit opinions.

30. Audit quality needs independent assessment

Internal Audit itself is a control function and must be subject to quality assurance. Reviews can assess methodology, documentation, competence, independence, issue ratings, supervision and compliance with professional standards.

External quality assessment may be required or expected under applicable professional frameworks. The important point is that the assurance provider should not assume its own processes are automatically effective.

Audit committees should receive transparent reporting on quality findings and improvement actions.

31. Audit resources should match the risk profile

A global bank cannot credibly audit complex trading, cyber, cloud, models and financial-crime systems with only generalist branch-audit skills. Workforce planning should reflect the bank's changing risk profile.

Internal Audit can combine permanent staff, specialists and carefully governed external support. Outsourcing parts of audit work does not remove the board's responsibility for an effective function.

Use of external experts should protect confidentiality, independence and institutional knowledge.

32. A practical audit scenario

Suppose a bank launches a new instant-payment service. Six months later, management reports strong growth and few customer complaints. Internal Audit selects the service because of high transaction speed and technology dependency.

A walkthrough shows that sanctions-screening alerts are handled correctly, but reconciliation exceptions are accumulating overnight because one interface occasionally sends duplicate status messages. Operations manually clears the breaks, so customer balances are usually corrected before morning. The issue has never reached the board because no material loss occurred.

A strong audit does not simply report “37 reconciliation exceptions.” It explains the root cause, duplicate-posting risk, reliance on manual correction, data-quality weakness, volume-growth effect and management action needed before the process becomes unmanageable.

33. What strong Internal Audit delivers

A strong function gives the board confidence without offering false certainty. It identifies where controls work, where they do not, and where evidence is insufficient. It prioritises the risks that matter, communicates clearly, follows findings to genuine closure and remains independent when conclusions are unpopular.

The best measure of Internal Audit is not the number of reports issued. It is whether its work improves the board's understanding of risk and whether material weaknesses are corrected before they become customer harm, regulatory breaches or financial loss.

That is why Internal Audit is the third line: not because it is the third team to touch a process, but because it provides independent assurance over the system of governance and control as a whole.

Audit Continuation: Evidence, Judgement and Board-Level Assurance

Audit evidence must support the conclusion actually written

A report may state that a control is “effective,” but that conclusion should be supported by evidence covering the relevant period, population and risk. One successful walkthrough does not prove a control operated consistently for a year. Equally, one isolated exception does not automatically prove the entire framework is ineffective.

Auditors should connect the strength of the conclusion to the strength of evidence. Where testing is limited by data, timing or access, the report should describe the limitation clearly. Qualified assurance is more valuable than confident language unsupported by workpapers.

Workpapers should allow another auditor to reconstruct the work

Good documentation shows the audit objective, population, sample, procedure performed, evidence examined, result, reviewer challenge and conclusion. It should not depend on the original auditor's memory.

This matters when findings are disputed months later or when regulators review the work. Clear workpapers also support consistent supervision across audit teams.

Documentation should be sufficient without copying unnecessary sensitive data into audit repositories. Information-security and retention requirements apply to audit evidence too.

Supervisory review strengthens judgement

Senior audit reviewers should challenge whether testing addresses the risk, whether samples are appropriate, whether evidence contradicts the conclusion and whether issue severity is consistent with methodology.

Review is especially important for specialist topics where the field auditor may be highly technical but less familiar with the banking consequence, or vice versa.

A visible review trail helps demonstrate that conclusions were not the unchecked opinion of one individual.

Audit opinions need defined meaning

Banks use ratings such as satisfactory, needs improvement, unsatisfactory or effective with improvement. Whatever scale is used, the meaning should be documented and applied consistently.

A business should know what an overall audit opinion says about the control environment and how individual issues contribute to it. Management should not be able to negotiate a better overall rating merely because a poor rating is inconvenient.

Consistency across audits makes trend reporting meaningful.

The absence of findings is not proof of absence of risk

An audit may identify no significant findings because controls are strong, because scope was narrow, because testing missed the problem or because the risk had not yet materialised. Boards should interpret assurance within scope.

Internal Audit should avoid marketing “zero findings” as a target. Such targets can create pressure to soften issues or discourage exploratory work in emerging risk areas.

Quality of assurance matters more than the number of findings.

Emerging-risk audits can be exploratory

New technology or market developments may not have mature control standards. Internal Audit can still assess governance, accountability, risk identification and readiness without pretending there is one definitive control model.

For example, an early audit of generative-AI use might focus on inventory, approved use cases, data restrictions, human oversight and model/vendor governance.

Exploratory audits help the board understand whether the bank is building control at the same pace as adoption.

The audit universe should include end-user computing

Spreadsheets, macros, local databases and desktop tools can perform critical calculations outside formal applications. If they feed regulatory reports, valuations, reconciliations or customer outcomes, they belong within the risk universe.

Auditors should consider inventory, access, change control, independent review, backup and migration plans for material end-user tools.

A spreadsheet does not become low risk merely because it is small technically; materiality depends on what decision or financial output it controls.

Privileged access is a recurring audit theme

Administrators can change configurations, data or security controls. Audits across banking systems should consider how privileged access is approved, monitored, reviewed and removed.

Break-glass or emergency access should be controlled and retrospectively reviewed. Shared administrator IDs weaken accountability and should receive scrutiny.

Repeated privileged-access findings across systems may justify an enterprise thematic audit rather than separate local remediation.

Segregation of duties should follow actual system capability

A procedure may state that one employee initiates and another approves, but system roles determine whether that separation is enforceable.

Auditors should test role design, user assignments and transactions, including whether administrators can bypass normal workflow. Conflicts can exist across systems: a person may create a payment in one application and release it in another.

End-to-end segregation analysis is therefore stronger than reviewing each application's role matrix independently.

Reconciliations are a high-value audit control

Reconciliation compares two independently meaningful records to detect missing, duplicate or incorrect processing. Auditors should assess population completeness, frequency, tolerance, ageing, evidence of review and treatment of exceptions.

A reconciliation that always balances because both sides come from the same incorrect source provides little assurance. Similarly, thousands of old breaks can make a formally completed reconciliation ineffective.

Understanding the purpose of each reconciliation is essential before testing the signature box.

Manual journals deserve risk-based testing

Manual accounting entries can be legitimate, especially during close or correction, but they create override risk. Audit analytics can identify unusual users, timing, accounts, values and descriptions.

Testing should consider authority, supporting evidence, independent review and posting access. Entries close to reporting deadlines or affecting sensitive accounts may deserve targeted review.

The objective is not to treat manual journals as suspicious by default, but to ensure the override mechanism is controlled.

Regulatory commitments need an assurance trail

Banks often agree remediation actions with supervisors. Internal Audit may be asked to validate closure or assess the programme independently.

The assurance should test whether root causes were corrected and whether the new control operates, not merely confirm that project deliverables exist. If management committed to automated reconciliation, producing a design document is not closure.

Boards should understand which commitments received independent validation and which rely on management attestation.

External audit and Internal Audit have different mandates

External auditors focus primarily on the financial statements and related responsibilities under their professional and legal mandate. Internal Audit has a broader enterprise assurance role defined by its charter.

The functions can coordinate and share relevant information, but one does not automatically replace the other. Internal Audit should understand the extent to which it relies on external work, and external auditors may consider Internal Audit's work under applicable standards.

Clear boundaries avoid duplicate testing without creating assurance gaps.

Regulators are not the bank's internal control function

A supervisory inspection can identify weaknesses, but the bank should not wait for the regulator to discover them. Internal Audit contributes to the institution's own assurance framework.

Where a regulator finds an issue previously missed by Internal Audit, the audit function should assess why. Was the area outside scope, was testing ineffective, or did the risk emerge after the audit?

Learning from supervisory findings improves future risk assessment.

Continuous auditing should remain independent

Automated tests can run daily or weekly and alert Internal Audit to unusual activity. This is useful for high-volume banking processes.

But continuous auditing should not quietly become a first-line operational control. Management should still detect and resolve its own exceptions. Internal Audit analytics provide independent assurance and risk signals.

The roles should be documented so management does not assume “Audit will catch it.”

Thematic audits connect problems across silos

If several businesses show similar weaknesses in customer authentication, model governance or third-party monitoring, a thematic audit can examine the enterprise framework.

This approach helps identify root causes in central policy, technology or governance that individual audits may miss.

Thematic work is especially valuable where local management has repeatedly fixed symptoms without changing the shared control design.

Culture can be audited through evidence

Culture is difficult to audit directly, but auditors can examine indicators: policy exceptions, retaliation allegations, staff surveys, incentive structures, customer complaints, issue escalation and management override.

Interviews can provide insight, but conclusions should be supported by multiple evidence sources.

An audit can identify conditions that encourage poor culture without claiming to measure every employee's ethics.

Audit should distinguish error, control failure and misconduct

An isolated human mistake may indicate a training issue. Repeated mistakes can indicate a weak control design. Deliberate circumvention can raise misconduct concerns.

Auditors should avoid labelling intent without evidence. When potential misconduct is identified, the matter should be escalated to the function responsible for investigation under bank policy.

Internal Audit's role is to report the control implications and preserve independence.

Fraud risk should be evaluated without making Audit the fraud team

Auditors can assess whether fraud-risk governance, prevention, detection, investigation and reporting are effective. They may also identify suspicious evidence during normal work.

Dedicated fraud or investigation teams typically own case handling. If Internal Audit investigates a matter, scope and independence should be governed carefully, especially if later assurance over the same process is required.

Board private sessions can reveal unresolved concerns

Audit committees often meet privately with the head of Internal Audit without executive management present. This creates space to discuss obstruction, resource limitations, pressure on ratings or concerns involving senior leaders.

The practice should not turn the audit committee into an operational manager of Internal Audit. Its purpose is to protect open communication and independence.

Budget pressure can become an independence issue

All functions operate within financial constraints, but repeated budget reduction can make an audit plan impossible. The head of Internal Audit should explain the assurance consequences to the audit committee.

The board can then make an informed decision about risk rather than receiving a nominal plan that cannot be executed with available skills and time.

Resource sufficiency is part of audit governance, not just administration.

Specialist co-sourcing needs strong ownership

Banks may use external experts for cyber, quantitative models, tax or other specialist audits. Co-sourcing can improve quality, but the head of Internal Audit should retain responsibility for scope, conclusion and integration into the audit framework.

The provider's conflicts, confidentiality and quality should be assessed. A consultancy that designed a system may not be appropriately independent to audit its own design.

Audit reports should identify positive control where useful

Internal Audit is not required to praise management, but identifying controls that work can improve the accuracy of the overall assessment and help replicate good practice.

Positive observations should be evidence-based and should not dilute material findings. A balanced report can explain both control strength and remaining risk.

Closure quality affects the credibility of issue statistics

Management dashboards often celebrate high closure rates. If closure standards are weak, the metric can be misleading.

Internal Audit should define what evidence is required for closure by issue type and whether operating-effectiveness testing is necessary. A new policy may close a documentation issue but not a recurring transaction-control failure until practice is demonstrated.

Audit committee reporting should prioritise what matters

A board committee needs visibility over significant findings, overdue high-risk actions, themes, plan changes, resource constraints, quality issues and material disagreements with management.

It does not need every low-level finding reproduced in full. The head of Internal Audit should summarise without hiding the detail directors may need to challenge.

A treasury example: valuation control

Suppose an audit finds that an independent price-verification team reviews trading valuations monthly, but one illiquid portfolio uses trader-supplied prices because external data are scarce.

The key issue is not simply “independent price missing.” Audit should assess materiality, valuation uncertainty, model governance, reserves, escalation and whether Finance and Risk understand the exposure.

The resulting finding should describe the financial-reporting and risk consequences clearly enough for senior management to act.

A lending example: policy overrides

A bank allows senior credit officers to override automated risk grades with documented rationale. Audit analytics show overrides are concentrated in one region and nearly always improve the grade.

Testing should determine whether evidence supports the changes, whether performance validates the judgement and whether incentives influence behaviour.

The issue may be poor override governance even if no loan has yet defaulted.

A digital example: dormant access

An audit of a customer platform finds hundreds of active accounts belonging to contractors whose engagements ended months earlier. No misuse is detected.

The control failure still matters because access removal depends on manual notification between HR, Procurement and Technology. The finding should focus on the broken joiner-mover-leaver process and exposure created, not claim a breach that did not occur.

Audit maturity is visible in how uncertainty is communicated

Banking is complex, and Internal Audit will sometimes encounter incomplete data, emerging rules or models that cannot be tested with perfect precision. The mature response is to explain uncertainty and perform the strongest work available.

Pretending certainty weakens trust. Boards value an assurance function that can say, with evidence, “we found no exception in this scope,” “we identified a material weakness,” or “we cannot provide full assurance because this data limitation remains.”

Final perspective: assurance must remain useful after the meeting

An effective audit leaves more than a presentation. It leaves a documented view of the risk, evidence supporting that view, management actions that address root cause and a mechanism for independent follow-up.

Years later, another auditor should be able to understand why the conclusion was reached. That institutional memory is one of Internal Audit's most important contributions to a bank whose people, systems and risks continually change.

Audit Top-Up: Financial Close, Access Reviews and Enterprise Issue Insight

Financial-close audit should test the control chain, not only the calendar

A bank's month-end and year-end close combines ledger interfaces, accruals, valuations, reconciliations, manual journals, consolidation and management review. Internal Audit should understand which controls establish completeness and accuracy before financial information reaches senior management or external reporting.

Testing can examine whether feeder systems reconcile to the general ledger, whether suspense accounts are investigated, whether material manual journals receive independent approval and whether late adjustments are analysed for root cause. A close completed on time is not necessarily well controlled if teams repeatedly rely on undocumented workarounds to achieve the deadline.

Where one recurring manual adjustment compensates for a known system defect, Audit should consider whether management has accepted an unnecessarily permanent control weakness. The finding should distinguish an effective temporary compensating control from a structural issue that requires remediation.

Access recertification needs more than manager signatures

Periodic user-access review is common across banking systems, but its effectiveness depends on the information presented to reviewers. A manager cannot make a meaningful decision if the report contains cryptic role codes with no explanation of privilege.

Auditors can test whether reviewers understand the access being certified, whether terminated and transferred staff are removed promptly, whether privileged roles receive heightened scrutiny and whether conflicts across applications are identified. Evidence should show actual review, not bulk approval performed to meet a deadline.

High-risk access should also be compared with job responsibilities and transaction history where appropriate. A technically valid entitlement can still be excessive for the employee's current role.

Audit should connect issue populations across legal entities

Global banks often record findings separately by country or subsidiary. This can hide an enterprise pattern. Ten local issues involving weak data ownership may each receive a moderate rating while collectively demonstrating a material group-wide weakness.

Internal Audit should therefore maintain thematic views across its issue inventory. Common root causes, repeated vendors, shared platforms and recurring policy exceptions can justify enterprise escalation even when no single local finding crosses the highest severity threshold.

The reverse also matters: a group theme should not erase legal-entity accountability. Local boards and management remain responsible for risks within their entities under the applicable governance framework.

Audit-plan completion should not become the objective

A function can report that 100 percent of the annual plan was delivered while providing weak assurance if scopes were narrow or emerging risks were ignored. The audit committee should therefore consider plan completion alongside risk coverage, issue quality, stakeholder independence and changes in the bank's risk profile.

Where work is deferred, the head of Internal Audit should explain the assurance consequence. A delayed low-risk review is not equivalent to postponing coverage of a critical migration or severe control weakness.

Audit ratings should not be negotiated like commercial terms

Management should be able to challenge factual errors and provide evidence. That challenge improves audit quality. But disagreement should not turn into bargaining in which a finding moves from high to medium simply because a lower rating is easier for senior reporting.

The audit methodology should define severity factors and escalation when the auditor and management disagree. Material unresolved disagreement should be visible to the audit committee rather than silently resolved through wording compromise.

Audit should verify management's own monitoring

A control environment is stronger when first- and second-line teams identify problems before Internal Audit arrives. Auditors should examine whether management information detects the same exceptions that audit analytics reveal and whether escalation works.

If Audit repeatedly discovers aged reconciliation breaks, overdue KYC reviews or access conflicts that management dashboards show as green, the weakness may be in management assurance itself. The remediation should improve the monitoring framework rather than rely on future audits to find the same problem.

Regulatory-reporting lineage is an assurance priority

For material returns, Internal Audit can test whether definitions are governed, source data are complete, transformations are controlled, manual adjustments are evidenced and totals reconcile to authoritative records where appropriate. The objective is not for Audit to recalculate every regulatory return indefinitely.

Instead, assurance should determine whether the bank has a sustainable reporting process capable of producing accurate results after systems, rules and personnel change. Repeated spreadsheet corrections or unexplained mapping overrides are indicators that the process remains fragile.

Audit of reconciliations should assess break economics

A large number of small breaks and one very large break create different risk. Auditors should examine value, age, cause, customer impact and accounting consequence rather than counting exceptions only.

The bank should also distinguish timing differences from true discrepancies. A well-designed reconciliation defines expected timing items and escalates unexpected differences. If every break can be explained away as “timing,” the control may not be challenging enough.

Independent assurance over remediation should be proportionate

Severe regulatory, audit or operational findings may require validation before closure. Internal Audit can perform that role when consistent with its mandate and independence. Lower-risk actions may be verified through management evidence and targeted sampling.

The closure model should be clear in advance so owners know what proof is required. This reduces disputes near target dates and discourages superficial fixes designed only to satisfy documentation requirements.

Closing perspective: Internal Audit protects the quality of institutional truth

Boards and executives make decisions using representations about controls, data and risk. Internal Audit tests whether those representations are supported by evidence. Its purpose is not to eliminate management judgement or create a parallel operating organisation.

A mature audit function strengthens the bank by making weak assumptions visible, linking issues across silos and ensuring that remediation addresses root causes. Independence gives it permission to report uncomfortable facts; professional discipline gives those facts credibility.