Implementation of Internal Audit Functions for Rural Banks and Sharia Rural Banks

A n k
Yth.
Directors of Rural Banks and Sharia Rural Banks at your address.

COPY

CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA NUMBER 9/SEOJK.03/2025

CONCERNING

THE IMPLEMENTATION OF INTERNAL AUDIT FUNCTIONS FOR RURAL BANKS AND SHARIA RURAL BANKS

In light of the establishment of Financial Services Authority Regulation Number 9 of 2024 concerning the Implementation of Good Governance for Rural Banks and Sharia Rural Banks (State Gazette of the Republic of Indonesia Year 2024 Number 13/OJK, Supplement to the State Gazette of the Republic of Indonesia Number 81/OJK), hereinafter referred to as POJK on the Implementation of Good Governance for BPR and BPR Syariah, and Financial Services Authority Regulation Number 25 of 2024 concerning the Implementation of Sharia Governance for Sharia Rural Banks (State Gazette of the Republic of Indonesia Year 2024 Number 35/OJK, Supplement to the State Gazette of the Republic of Indonesia Number 103/OJK), hereinafter referred to as POJK on the Implementation of Sharia Governance for BPR Syariah, it is necessary to regulate implementation provisions regarding the implementation of internal audit functions for BPR and BPR Syariah in a Circular Letter of the Financial Services Authority as follows:

I. GENERAL PROVISIONS

1. Rural Banks, hereinafter abbreviated as BPR, are a type of conventional bank that in its activities does not provide services in giro circulation directly.

2. Sharia Rural Banks, hereinafter abbreviated as BPR Syariah, are a type of Sharia bank that in its activities does not provide services in giro circulation directly.

3. Sharia Supervisory Board, hereinafter abbreviated as DPS, is a party that has the task and function of supervising the implementation of BPR Syariah activities to be in accordance with Sharia Principles.

4. General Meeting of Shareholders, hereinafter abbreviated as GMS (RUPS), is the general meeting of shareholders for BPR or BPR Syariah in the form of a limited liability company or regional state-owned enterprise, the regional head meeting representing the regional government in the ownership of separated regional assets in regional public enterprises for BPR in the form of a regional public enterprise legal entity, the member meeting for BPR or BPR Syariah in the form of a cooperative legal entity, or the shareholder meeting for BPR in the form of a regional company legal entity.

5. Internal Audit Work Unit, hereinafter abbreviated as SKAI, is a work unit within BPR and BPR Syariah that carries out internal audit functions. SKAI is led by the Head of SKAI at the level of an Executive Officer. In BPR and BPR Syariah that are not required to have an SKAI, the implementer of the internal audit function is the Executive Officer for Internal Audit, hereinafter referred to as PE Internal Audit.

6. For BPR Syariah, the Sharia internal audit function is attached to the SKAI. In accordance with POJK on the Implementation of Sharia Governance for BPR Syariah, the Executive Officer carrying out the Sharia internal audit function may hold a concurrent position as PE Internal Audit.

In accordance with Article 3 paragraph (1) of POJK on the Implementation of Good Governance for BPR and BPR Syariah, BPR and BPR Syariah are required to have internal procedures regarding the implementation of Good Governance for BPR and BPR Syariah in the conduct of business activities. Internal procedures that must be possessed by BPR and BPR Syariah include guidelines for the implementation of internal audit functions.

7. Guidelines for the implementation of internal audit functions for BPR and BPR Syariah as regulated in this Circular Letter of the Financial Services Authority are standard minimums that must be fulfilled by BPR and BPR Syariah in the context of realizing one aspect of governance implementation.

Guidelines for the implementation of internal audit functions for BPR and BPR Syariah as regulated in this Circular Letter of the Financial Services Authority concern, among others, general internal audit policies, the organizational structure of the internal audit function, the implementation of internal audits, and the reporting of the implementation of internal audit functions.

BPR and BPR Syariah formulate and develop guidelines for the implementation of internal audit functions according to the needs and complexity of business operations, strategies, and the vision and mission of each BPR and BPR Syariah, with reference to the guidelines for the implementation of internal audit functions as contained in Appendix I, which is an inseparable part of this Circular Letter of the Financial Services Authority.

II. CLOSING

1. At the time this Circular Letter of the Financial Services Authority takes effect:
   a. Circular Letter of the Financial Services Authority Number 7/SEOJK.03/2016 concerning Standards for the Implementation of Internal Audit Functions for Rural Credit Banks; and b. Circular Letter of the Financial Services Authority Number 12/SEOJK.03/2019 concerning the Implementation of Internal Audit Functions for Sharia People's Financing Banks, are revoked and declared invalid.

This copy is in accordance with the original
Director of Legal Development
Legal Department signed
Aat Windradi

2. The provisions in this Circular Letter of the Financial Services Authority take effect on the date of determination.

Determined in Jakarta on May 26, 2025

EXECUTIVE HEAD OF BANKING SUPERVISOR
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA,
DIAN EDIANA RAE signed

https://jdih.ojk.go.id/

APPENDIX I
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA NUMBER 9/SEOJK.03/2025 CONCERNING THE IMPLEMENTATION OF INTERNAL AUDIT FUNCTIONS FOR RURAL BANKS AND SHARIA RURAL BANKS

GUIDELINES FOR THE IMPLEMENTATION OF INTERNAL AUDIT FUNCTIONS FOR RURAL BANKS AND SHARIA RURAL BANKS

TABLE OF CONTENTS

CHAPTER I INTRODUCTION .......................................................................- 3 -
A. Background...............................................................................- 3 - B. Objectives...........................................................................................- 3 -

CHAPTER II GENERAL INTERNAL AUDIT POLICIES........................................- 4 -
A. Scope of Internal Control ..............................................- 4 - B. Relationship of Internal Audit as Part of the Internal Control System ............................................................................................- 4 -
C. Duties and Responsibilities of Internal Audit Function Implementers ...........- 5 -
D. Independence .................................................................................- 6 - E. Authority......................................................................................- 6 - F. Scope of Internal Audit Work...........................................- 6 - G. Internal Auditor Code of Ethics ................................................................- 7 - H. Internal Audit by External Parties.....................................................- 7 -

CHAPTER III ORGANIZATIONAL STRUCTURE OF THE INTERNAL AUDIT FUNCTION .................- 9 -
A. Organizational Structure .......................................................................- 9 - B. Position of SKAI or PE Internal Audit, President Director, Board of Commissioners, and DPS .....................................................................- 12 -
C. Appointment and Dismissal ...............................................- 12 -
D. Authority, Duties, and Responsibilities of SKAI or PE Internal Audit ..........................................................................................- 13 - E. Functions of the Head of SKAI or PE Internal Audit.....................................- 14 - F. Audit Charter ...............................................................................- 14 - G. Professional Development and Education Program..........................- 15 -

CHAPTER IV IMPLEMENTATION OF INTERNAL AUDIT DUTIES ................................- 17 -
A. Audit Planning.......................................................................- 17 - B. Audit Execution (Fieldwork) .....................................................- 17 -
C. Monitoring of Audit Result Follow-up........................................- 18 -

CHAPTER V REPORTING ON THE IMPLEMENTATION OF INTERNAL AUDIT FUNCTIONS ..............- 20 -
A. Internal Scope Reporting..........................................................- 20 - B. External Scope Reporting .......................................................- 20 -

CHAPTER I
INTRODUCTION

A. Background

BPR and BPR Syariah are financial institutions that collect funds from the public in the form of deposits and/or investments and distribute them to the public in the form of loans or financing and/or other forms, so that in their operations they must apply prudence and governance principles, as well as Sharia Principles for BPR Syariah. One important factor for BPR and BPR Syariah in the context of governance implementation is through the implementation of effective and adequate internal audit. Internal audit activities start from audit planning, audit execution, and reporting of audit results based on the risk priorities of BPR and BPR Syariah.

In light of this, it is necessary to formulate guidelines for the implementation of internal audit functions for BPR and BPR Syariah as a minimum standard that must be understood and fulfilled by all BPR and BPR Syariah in Indonesia, to realize a common understanding regarding internal audit work.

B. Objectives

These guidelines aim to provide standard minimums that must be fulfilled by BPR and BPR Syariah in formulating internal guidelines for the implementation of internal audit functions for BPR and BPR Syariah.

Thus, the guidelines for the implementation of internal audit functions for BPR and BPR Syariah are expected to encourage the implementation of effective and efficient internal audit functions. Effective and efficient internal audit functions provide quality assurance of internal controls and improve weaknesses in operational activities, thereby ultimately improving the overall performance and competitiveness of BPR and BPR Syariah.

CHAPTER II
GENERAL INTERNAL AUDIT POLICIES

The implementation of internal audit functions is in principle one implementation of the three lines of defense model framework, namely the business management line, the risk and compliance management line, and the internal audit line. The internal audit function is part of the internal control system and supports the implementation of an effective internal control system. The internal control system is a control mechanism built to protect and secure the assets of BPR and BPR Syariah, reduce the impact of losses including fraud, increase organizational effectiveness, and is expected to increase cost efficiency.

A. Scope of Internal Control

The internal control system includes policies, organization, procedures, methods, and regulations that are comprehensively coordinated within the work units of BPR and BPR Syariah. The internal control system aims to secure assets, ensure the accuracy and reliability of financial data, optimize the economical and efficient use of resources, and encourage compliance with management policies. The scope of the internal control system of BPR and BPR Syariah covers aspects that can ensure the security of funds deposited by the public and other third parties.

B. Relationship of Internal Audit as Part of the Internal Control System

An effective internal control system is an important component in the management of BPR and BPR Syariah and serves as the basis for healthy and safe operational activities of BPR and BPR Syariah. An effective internal control system can help the Board of Directors and Board of Commissioners protect the assets of BPR and BPR Syariah, ensure the availability of reliable financial and managerial reporting, increase BPR and BPR Syariah compliance with applicable laws and regulations, including Sharia Principles, and reduce the risk of losses, deviations, and violations of prudence aspects.

Internal audit is part of the internal control system, which relates to the audit and reporting of audit results regarding the coordinated implementation of the control system at every level of management. Transparency and clarity are very important in the management of BPR and BPR Syariah, so it needs to be stated in a written document from the President Director with the approval of the Board of Commissioners in the form of internal audit guidelines and code of conduct or internal audit charter. Periodically, the internal audit guidelines and code of conduct or internal audit charter are assessed for adequacy and then established by the President Director so that the implementation of internal audit remains at an optimal level.

Internal auditors conduct examinations and assessments of the effectiveness of the internal control system to provide assurance that controls are running in accordance with established policies or guidelines as follows:

1. Security of Public Funds
   Internal auditors must assess the reliability of the established system in securing funds collected by BPR and BPR Syariah from the public in the form of deposits and/or investments. The reliability of the aforementioned system relates to structure, infrastructure, and mechanisms.

2. Achievement of Established Operational Activity Objectives and Targets
   Internal auditors assess the extent to which the effectiveness of the internal control system has run in accordance with planning. The assessment of the internal control system against planning helps internal audit in identifying obstacles faced by BPR and BPR Syariah and areas for improvement so that enhancements can be made.

3. Economical and Efficient Use of Resources
   Internal auditors identify all possibilities to improve and increase the efficiency of resource and fund usage. Based on the identification results, internal audit assesses parts that need to be improved or have their efficiency increased.

4. Truthfulness and Integrity of Information
   Internal auditors assess the truthfulness and integrity of the financial condition and operational activities information of BPR and BPR Syariah presented completely, accurately, currently, and wholly. The purpose of assessing the truthfulness and integrity of financial condition information is so that it can be compared, serve as a basis for management to make appropriate and strategic decisions, and ensure that stakeholders, both internal and external, can accurately understand the performance of BPR and BPR Syariah.

5. Compliance with Policies, Plans, Procedures, Laws, and Applicable Regulations, including Sharia Principles
   Internal auditors assess the compliance of the established system with policies, plans, procedures, laws, and applicable regulations, including Sharia Principles, which have a significant impact on the operations of BPR and BPR Syariah, including assessments of business activity aspects of BPR and BPR Syariah that can affect the level of health or potentially cause BPR and BPR Syariah to experience difficulties endangering business continuity.

6. Asset Security
   Internal auditors assess the reliability of the asset security system to prevent risks of loss, damage, and misuse.

C. Duties and Responsibilities of Internal Audit Function Implementers

The duties of SKAI or PE Internal Audit are to assist the President Director, Board of Commissioners, and DPS in supervising the operations of BPR and BPR Syariah, covering at least:

1. Formulating and realizing the annual audit program plan;
   The annual audit program plan may contain several audit or examination activities, either general examinations or special examinations, including examinations upon request of the Financial Services Authority. Each audit or examination activity consists of audit planning, audit execution (fieldwork), and monitoring of audit results.

2. Monitoring audit results, namely follow-up on findings and recommendations from external auditors, the Financial Services Authority, and/or other authorities or institutions;

3. Making analyses and assessments in the fields of finance, accounting, operations, and other activities, including by identifying all possibilities to improve and increase the efficiency of resource and fund usage;

4. Providing improvement suggestions and objective information about the activities examined at all levels of management; and

5. For BPR Syariah, the duties and responsibilities of the Sharia internal audit function are in accordance with POJK on the Implementation of Sharia Governance for BPR Syariah.

D. Independence

SKAI or PE Internal Audit must act independently in carrying out audits and disclosing views and thoughts in accordance with their profession and audit standards as per these guidelines for the implementation of internal audit functions.

E. Authority

SKAI or PE Internal Audit is given authority and position in the organization so that they are able to carry out their duties in accordance with the standards of work required by their profession.

F. Scope of Internal Audit Work

The scope refers to the boundaries and areas that are the focus of attention of internal auditors in carrying out their duties. This context includes internal factors such as audit objectives, organizational structure, technology, policies and procedures, resources, and the risks faced by BPR and BPR Syariah, and external factors such as applicable laws and regulations, including Sharia Principles, and economic conditions that can affect the objectives and implementation of internal audit, thereby supporting optimal analysis in helping the management decision-making process.

The formulation of the scope of internal audit work considers, among others:

1. Identification of Risk-Prone Areas in BPR and BPR Syariah
   Identification and assessment of risk significance levels are conducted in coordination with the risk management organization and the compliance function organization, including Sharia risk management and Sharia compliance for BPR Syariah. Coordination implementation can be carried out through discussion meetings between the internal audit organization and the risk management organization and the compliance function organization.

For BPR Syariah, the Sharia internal audit function coordinates with the DPS in carrying out its duties with the knowledge of the President Director in accordance with POJK on the Implementation of Sharia Governance for BPR Syariah.

2. Assessment of the Adequacy of the Internal Control System
   Examination and assessment of the adequacy of the internal control system are intended to determine the reliability of the control system in providing reasonable assurance that the objectives and targets of BPR and BPR Syariah can be achieved efficiently and economically.

3. Assessment of the Effectiveness of the Internal Control System
   Examination and assessment of the effectiveness of the internal control system are intended to assess whether the established control system is functioning as expected.

4. Performance Quality Assessment
   Examination and assessment of performance quality are intended to determine whether the objectives and targets of BPR and BPR Syariah have been achieved.

5. Determination of Boundaries in Internal Audit Implementation
   Determination of boundaries in internal audit implementation includes time limits, resources, and auditors so that internal audit implementation can be carried out effectively and efficiently.

The scope is formulated by SKAI or PE Internal Audit and approved by the President Director. SKAI or PE Internal Audit may adjust the audit scope during the implementation of internal audit. Adjustments to the scope must be submitted in writing to the President Director.

G. Internal Auditor Code of Ethics

Internal auditors must comply with and implement the professional code of ethics for internal auditors as established by the internal audit professional association, including the Code of Ethics from The Institute of Internal Auditors, namely at least:

1. Integrity, meaning internal auditors build trust that becomes the basis for making judgments.

2. Objectivity, meaning internal auditors apply high professional objectivity in obtaining, evaluating, and communicating information about activities conducted.

3. Confidentiality, meaning internal auditors respect the value and ownership of information received and do not disclose information without proper authority, except as regulated in applicable laws and regulations.

4. Competence, meaning internal auditors apply the knowledge, skills, and experience they possess in conducting audits.

H. Internal Audit by External Parties

BPR and BPR Syariah may use external party services in the implementation of internal audits requiring special expertise.
The use of external party services in the implementation of internal audit is temporary and is not categorized as external audit implementation. BPR and BPR Syariah submit a report on the appointment of external party implementation of internal audit to the Financial Services Authority Office that supervises BPR and BPR Syariah. BPR and BPR Syariah may use external party services to implement internal audit based on appointment by the GMS. External Parties, for example, parties from the same business group as the owner or controller of BPR or BPR Syariah. The proposal for the appointment of external party services considers recommendations from the audit committee or Board of Commissioners.

The role of external parties in the implementation of the internal audit function at BPR and BPR Syariah becomes the responsibility of the Head of SKAI or PE Internal Audit. External parties implementing internal audit report all findings and follow-up recommendations to the Head of SKAI or PE Internal Audit. Follow-up recommendations for internal audits by external parties are monitored for implementation by SKAI or PE Internal Audit.

External parties must comply with the internal auditor guidelines or BPR and BPR Syariah audit charter and applicable laws and regulations, including bank confidentiality. All costs arising from the implementation of audits by external parties become the burden of BPR and BPR Syariah.

CHAPTER III
ORGANIZATIONAL STRUCTURE OF THE INTERNAL AUDIT FUNCTION

Management of BPR and Sharia BPR is responsible for directing the internal audit function to run effectively by granting authority to the Internal Audit Unit (SKAI) or the Executive Officer for Internal Audit (PE Audit Intern). In relation to this authority, the SKAI or PE Audit Intern must possess the knowledge and ability to conduct audits in the operational fields of BPR and Sharia BPR, and must work in accordance with the internal audit implementation guidelines applicable to BPR and Sharia BPR, as well as the internal auditor code of ethics.

A. Organizational Structure

The organizational structure of the internal audit function as regulated in the POJK on Corporate Governance of BPR and Sharia BPR and the POJK on Sharia Corporate Governance of Sharia BPR is as follows:

1. BPR and Sharia BPR with core capital of at least IDR 50,000,000,000.00 (fifty billion rupiah) are required to establish an Internal Audit Unit (SKAI).
2. BPR and Sharia BPR with core capital of less than IDR 50,000,000,000.00 (fifty billion rupiah) are required to appoint 1 (one) Executive Officer (PE), who carries out the internal audit function, hereinafter referred to as the PE Audit Intern.
3. The SKAI or PE Audit Intern is independent from the operational function. The operational function refers to functions related to fund disbursement, fund gathering, procurement of goods and services, bookkeeping, information technology management, and other operational activities. Other operational activities are activities or actions directly related to business responsibilities and can pose risk exposure to BPR and Sharia BPR.
4. Officials and staff of the SKAI or PE Audit Intern are prohibited from being placed in positions that involve a conflict of interest in carrying out the duties and responsibilities of the internal audit function.
5. The SKAI or PE Audit Intern reports directly to the Chief Director.
6. The SKAI or PE Audit Intern may be tasked with handling the implementation of anti-fraud strategies while maintaining independence.
7. The Board of Commissioners in BPR and Sharia BPR with core capital of at least IDR 50,000,000,000.00 (fifty billion rupiah) is required to form an audit committee that reports to the Board of Commissioners to assist in carrying out the duties and responsibilities of the Board of Commissioners in supervising the implementation of the duties of the SKAI or PE Audit Intern.

For Sharia BPR, 1 (one) member of the Sharia Supervisory Board (DPS) can be a member of the audit committee to support the implementation of Sharia governance. In the event that the audit committee does not include DPS members, the committee is required to request the opinion of the DPS on every discussion related to Sharia Principles.

Example of the organizational structure of the SKAI in a BPR with core capital of at least IDR 50,000,000,000.00 (fifty billion rupiah):

SKAI
Board of Commissioners Audit Committee
Chief Director
Director Members overseeing the Compliance Function Communication/Information Line Accountability Line

Example of the organizational structure of the PE Audit Intern in a BPR with core capital of less than IDR 50,000,000,000.00 (fifty billion rupiah):

PE Audit Intern
Board of Commissioners
Chief Director
Communication/Information Line
Director Members overseeing the Compliance Function Accountability Line

Example of the organizational structure of the SKAI in a Sharia BPR with core capital of at least IDR 50,000,000,000.00 (fifty billion rupiah):

SKAI
Board of Commissioners Audit Committee
Chief Director
Director Members overseeing the Compliance Function Communication/Information Line Accountability Line DPS

Example of the organizational structure of the PE Audit Intern in a Sharia BPR with core capital of less than IDR 50,000,000,000.00 (fifty billion rupiah):

PE Audit Intern
Board of Commissioners
Chief Director
Communication/Information Line Accountability Line DPS

8. The fulfillment of the organizational structure in BPR and Sharia BPR remains subject to provisions of applicable legislation.

9. In determining the organizational structure of the SKAI or PE Audit Intern, BPR and Sharia BPR need to consider the issues, business scale, and/or complexity of the BPR and Sharia BPR.

The Financial Services Authority (OJK) has the authority to order BPR and Sharia BPR with core capital of less than IDR 50,000,000,000.00 (fifty billion rupiah) to increase the number of human resources carrying out the internal audit function and/or establish an SKAI, considering:
a. the results of the Financial Services Authority's assessment of governance implementation reports, including internal audit implementation reports and main audit findings; b. the results of the Financial Services Authority's evaluation of issues in BPR and Sharia BPR, including indications of fraud, significant decline in health level, and/or potential causes that could lead BPR and Sharia BPR to difficulties endangering business continuity; and/or
c. the business activities of BPR and Sharia BPR, including the diversity of product types and complexity of activities, as well as the number and distribution of office networks.

B. Position of SKAI or PE Audit Intern, Chief Director, Board of Commissioners, and DPS

1. The SKAI or PE Audit Intern reports directly to the Chief Director and submits reports with copies to the Board of Commissioners and/or audit committee, Director Members overseeing the compliance function, and DPS. The Board of Directors and Board of Commissioners must support the implementation of the duties and responsibilities of the SKAI or PE Audit Intern to ensure effectiveness.
2. The Chief Director is responsible for ensuring the implementation of the internal audit function and ensuring follow-up on the findings of the SKAI or PE Audit Intern's examinations.
3. The Board of Commissioners has the obligation to ensure that the Board of Directors has followed up on audit findings and/or recommendations from the SKAI or PE Audit Intern, and has the authority to request the Board of Directors to follow up on the findings of the SKAI or PE Audit Intern's examinations. The Board of Commissioners receives reports from the SKAI or PE Audit Intern in order to carry out duties and responsibilities in supervising the implementation of the internal audit function.
4. The audit committee monitors and evaluates the implementation of duties carried out by the internal audit function, as well as the follow-up implementation by the Board of Directors on audit findings and/or recommendations from the SKAI or PE Audit Intern, in order to provide recommendations to the Board of Commissioners.
5. For Sharia BPR, the Board of Commissioners, audit committee (if not including DPS members), Chief Director, Director Members overseeing the compliance function, SKAI, and PE Audit Intern coordinate with the DPS in carrying out duties related to Sharia Principles.

C. Appointment and Dismissal

The Head of the SKAI or PE Audit Intern is appointed and dismissed by the Chief Director, considering the opinion of the Board of Commissioners.

D. Authority, Duties, and Responsibilities of SKAI or PE Audit Intern

The SKAI or PE Audit Intern has at least the following authorities:

1. Access to all relevant information regarding BPR and Sharia BPR related to the duties and functions of the SKAI or PE Audit Intern. This information includes financial data, operational documents, information system data, and physical assets;
2. Communicate directly with the Board of Directors, Board of Commissioners, and audit committee, and DPS for Sharia BPR, including conveying audit planning, audit implementation, audit findings, and the effectiveness of improvement recommendations;
3. Hold regular and incidental meetings with the Board of Directors, Board of Commissioners, and audit committee, and DPS for Sharia BPR to ensure independence and increase audit effectiveness;
4. Coordinate activities with external auditors, including regulators and other institutions; and
5. Attend strategic meetings while maintaining independence, aimed at identifying risks that may arise.

Examples of strategic meetings:
a. risk management committee meetings; and b. credit or financing approval meetings with significant amounts.

The SKAI or PE Audit Intern has duties and responsibilities as referred to in Article 80 of the POJK on the Implementation of Corporate Governance of BPR and Sharia BPR, at least:

1. Formulate and realize an annual audit program plan, including:
   a. Identifying potentially risky areas in BPR and Sharia BPR based on risk identification results and/or coordination with the risk management organization and compliance function organization, including Sharia risk management and Sharia compliance for Sharia BPR; b. Formulating an annual audit program plan based on the results of identifying potentially risky areas;
   c. Formulating an examination schedule considering available resources;
   d. Conducting examinations (fieldwork); and e. Formulating audit reports and monitoring the implementation of follow-up actions.
2. Assist the Chief Director and Board of Commissioners in supervising the operations of BPR and Sharia BPR, especially in monitoring audit results, including by ensuring that audit recommendations have been followed up. This is done by identifying audit recommendation results, determining the responsible parties for follow-up, and setting measurable deadlines.
3. Conduct analysis and assessment in the fields of finance, accounting, operations, and other activities, including:
   a. Examining the accuracy, completeness, and compliance of financial reports with applicable accounting standards, evaluating the internal control system in the financial field to avoid fraud, assessing company performance, and identifying the alignment of budgets with their realization; b. Analyzing accounting methods used in accordance with generally accepted standards;
   c. Examining the condition of fixed assets;
   d. Evaluating the efficiency and effectiveness of business processes and identifying obstacles/constraints; and e. Evaluating the fulfillment of Sharia Principles in the business activities of Sharia BPR.
4. Provide improvement suggestions and objective information about the activities examined at all levels of management.

E. Functions of the Head of SKAI or PE Audit Intern

The Head of the SKAI or PE Audit Intern applies adequate knowledge, skills, and abilities in leading an independent and objective internal audit function. BPR and Sharia BPR may establish requirements for professional certification bodies for the Head of SKAI or PE Audit Intern to ensure the competence of the individual, for example, internal audit certification in the field of accounting and finance. For Sharia BPR, the SKAI and PE Audit Intern must have knowledge and/or understanding of Sharia banking operations. The knowledge, skills, and abilities possessed by the Head of SKAI or PE Audit Intern, along with their development, are adjusted to the issues, business scale, and/or complexity of BPR and Sharia BPR.

The Head of the SKAI or PE Audit Intern is responsible for:

1. Ensuring the implementation of the internal audit function in accordance with professional internal audit standards and the internal auditor code of ethics;
2. Selecting competent human resources according to the needs in carrying out the duties of the internal audit function;
3. Formulating an annual audit plan and budget allocation for the implementation of the internal audit function;
4. Ensuring the implementation of internal audits in accordance with the established plan;
5. Reporting significant findings to the Board of Directors for corrective action to be taken quickly;
6. Monitoring corrective actions on significant findings; and
7. Reporting the results of monitoring follow-up corrective actions on significant findings to the Board of Directors and Board of Commissioners, with copies to the audit committee and Director Members overseeing the compliance function.

For Sharia BPR, the Head of the SKAI or PE Audit Intern is responsible for reporting findings related to the implementation of Sharia Principle fulfillment to the DPS.

F. Audit Charter

In accordance with Article 81 of the POJK on the Implementation of Corporate Governance of BPR and Sharia BPR, BPR and Sharia BPR are required to have internal audit guidelines and work rules known as the internal audit charter, which contains at least:

1. Duties, responsibilities, and authorities, including:
   a. The structure and position of the SKAI or PE Audit Intern; b. The duties and responsibilities of the SKAI or PE Audit Intern and its relationship with other work units performing other control functions;
   c. The authority of the SKAI or PE Audit Intern;
   d. Prohibition of concurrent duties and positions for internal auditors and practitioners in the SKAI or PE Audit Intern from carrying out operational activities of BPR and Sharia BPR; and e. Policy on periodic task restrictions and adequate cooling-off periods for assignments to members of the SKAI or PE Audit Intern;
2. Requirements and code of ethics for internal auditors, including:
   a. Internal auditor code of ethics; b. Requirements for internal auditors in the SKAI or PE Audit Intern;
   c. Criteria for using external experts to support the internal audit function, including restrictions on the use of external services; and
   d. Conditions that must be met by the SKAI or PE Audit Intern to maintain independence when requested to provide consulting services or other special tasks;
3. Mechanism for coordination and accountability of internal audit results, including:
   a. Accountability of the SKAI or PE Audit Intern; b. Responsibility and accountability of the Head of the SKAI or PE Audit Intern; and
   c. Procedures for coordinating the internal audit function with legal experts or external auditors.

The internal audit charter is established by the Chief Director after obtaining approval from the Board of Commissioners, considering recommendations from the audit committee. The audit charter must be accessible to all stakeholders through the website of the BPR and Sharia BPR.

In accordance with Article 3 paragraph (2) of the POJK on the Implementation of Corporate Governance of BPR and Sharia BPR, BPR and Sharia BPR are required to conduct evaluation and revision of internal procedures, including the company charter, among others, the audit charter.

Evaluation of the audit charter is conducted at least 1 (one) time in 3 (three) years. The implementation of the audit charter evaluation for BPR and Sharia BPR with core capital of at least IDR 50,000,000,000.00 (fifty billion rupiah) is carried out by the Head of the SKAI in coordination with the audit committee. The implementation of the audit charter evaluation for BPR and Sharia BPR with core capital of less than IDR 50,000,000,000.00 (fifty billion rupiah) is carried out by the PE Audit Intern.

G. Professional Development and Education Program

BPR and Sharia BPR must have a human resource development program for internal auditors containing at least:

1. Plan for continuous professional education and training. The development of the quality of internal audit human resources is carried out by involving human resources in competence development in technical and/or non-technical fields through:
   a. Work competence certification in the field of BPR and Sharia BPR; b. Work competence certification outside the field of BPR and Sharia BPR; and/or
   c. Other competence improvements.

The development of the quality of internal audit human resources is carried out in accordance with the Financial Services Authority Regulation on the Development of the Quality of Human Resources of BPR and Sharia BPR. In carrying out the development of the quality of human resources, internal auditors of BPR and Sharia BPR use funds for the development of the quality of human resources.

2. Method for evaluating internal auditor performance.
   BPR and Sharia BPR must have a clear and measurable performance evaluation method to evaluate the performance of internal auditors periodically. The evaluation method can include quantitative and qualitative assessments. The results of performance evaluation can be used as a basis for career development, promotion, and the granting of awards.

CHAPTER IV
IMPLEMENTATION OF INTERNAL AUDIT DUTIES

The implementation of audits or examinations is carried out in 3 (three) stages of activities, namely the audit planning stage, audit implementation (fieldwork), and audit result monitoring.

A. Audit Planning

The SKAI or PE Audit Intern carries out audit planning which includes:

1. Formulation of the Audit Plan (Audit Working Plan) containing at least:
   a. Elaboration of the results of identifying potentially risky areas or indications of problems into examination focus. b. Examination objectives, which are the objectives to be achieved from the implementation of the examination, which is part of the implementation of the annual audit program. Example: improving weaknesses in the implementation of corporate governance and risk management, specifically in credit or financing and operational aspects, such as knowing information regarding inventory such as bills and ensuring the correct recording of asset amounts. In 1 (one) examination period, there can be more than 1 (one) examination objective.
   c. Type of examination, which is general examination or special examination.
   d. Scope of examination, which is the established scope including audit focus and boundaries by determining activities, locations, processes, systems, components, and other elements that will be reviewed adequately to achieve examination objectives. e. Composition of the examination team and division of tasks, which includes the team leader and team members if the examination is conducted by the SKAI. f. Examination duration, which is the start date and completion date of the examination. Extension of the examination duration is done with the approval of the Chief Director.
2. Audit Notification

The implementation of the audit must be accompanied by an audit notification letter from the SKAI or PE Audit Intern, which can be conveyed to the auditee before or at the time the audit is conducted. In the notification letter, it is stated among others:
a. The plan for an initial meeting with the auditee's work unit, intended to explain the audit objectives and simultaneously obtain explanations from the head of the auditee's work unit regarding the activities and functions of the auditee's work unit; b. Information regarding the examination team; and
c. A request to the auditee to prepare the necessary data, information, and documents.

B. Audit Implementation (Fieldwork)

The audit implementation stage includes activities to collect, analyze, interpret, and document audit evidence and other information needed in accordance with the procedures established in the audit program to support audit results.

The audit process includes the following activities:

1. Collecting sufficient and relevant evidence and information with the audit objectives.
2. Examining, evaluating, and confirming all evidence and information to ensure compliance with systems and procedures, supported by adequate working papers.
3. Formulating findings or audit results based on the level of risk significance, considering the impact and other relevant factors.
4. Providing recommendations and improvement plans. Each finding is accompanied by improvement recommendations, including deadlines for completing the improvements.
5. Audit findings involving significant fraud or misconduct must be reported immediately by the Team Leader to the Head of the SKAI and/or Chief Director without waiting for the audit to be completed. If there is a conflict of interest from the Head of the SKAI, the audit findings involving significant fraud or misconduct are reported directly by the Team Leader to the Chief Director without waiting for the audit to be completed.

Internal auditors must document evidence to support the examination results compiled in written reports. In the event that there are internal audit findings estimated to disrupt the business continuity of BPR and Sharia BPR, and there is a conflict of interest from the Chief Director and/or Main Commissioner that can affect the audit process, the SKAI or PE Audit Intern can convey audit findings directly to the Financial Services Authority.

The SKAI or PE Audit Intern compiles conclusions for each audit implementation, evaluates audit results against audit objectives, and compiles a summary of findings and audit recommendations.

C. Monitoring of Follow-up on Audit Results

The SKAI or PE Audit Intern monitors, analyzes, and reports on the development of the implementation of follow-up improvements carried out by the auditee. The DPS has the obligation to supervise the follow-up by the Board of Directors on audit findings or examinations and recommendations from the SKAI or PE Audit Intern related to the implementation of Sharia Principles. The DPS receives internal audit results related to the implementation of Sharia Principle fulfillment reported by the SKAI or PE Audit Intern. The purpose of this monitoring is to ensure substantive follow-up so that similar findings do not recur in the future. Follow-up actions include:

1. Monitoring of follow-up implementation.
   Monitoring of follow-up implementation must be conducted to know its development and to remind the auditee if the auditee has not been able to implement improvement commitments approaching or until the promised deadline.

2. Analysis of follow-up adequacy.
   Based on the results of monitoring follow-up implementation, an analysis of the adequacy of the fulfillment of commitments implemented by the auditee is conducted. Furthermore, follow-up monitoring needs to be conducted again if there are difficulties or obstacles causing the follow-up to not be carried out in accordance with the commitment.

3. Follow-up report.
   If the follow-up implementation is not carried out by the auditee, the SKAI or PE Audit Intern provides a written report to the Chief Director and Board of Commissioners for further action. In order to support the validity and reliability of audit results, the SKAI or PE Audit Intern has the responsibility to document and administer all evidence and information related to the audit process. This responsibility includes documentation and administration at every stage of the audit, from planning, implementation, to monitoring the follow-up of audit results.

Careful documentation and administration produce complete audit working papers as products, which include all records, evidence, and information collected during the audit process. In addition, correspondence and audit result reports as part of formal communication in the audit process must be documented and administered well. With systematic and structured documentation and administration management, the SKAI or PE Audit Intern ensures that the entire audit process can be accounted for and its information easily traced back if needed.

CHAPTER V
REPORTING ON THE IMPLEMENTATION OF INTERNAL AUDIT FUNCTIONS A. Internal Scope Reporting

1. The Head of the Internal Audit Function (SKAI) or the Head of the Internal Audit Unit (PE Audit Intern) reports the implementation of duties and responsibilities periodically to the Chief Executive. The periodic schedule is adjusted according to the internal policy of each Rural Bank (BPR) and Sharia Rural Bank (BPR Syariah). Reporting on the implementation of duties and responsibilities to the Chief Executive is conducted prior to the submission time of reports to external parties.
2. The Head of the Internal Audit Function (SKAI) or the Head of the Internal Audit Unit (PE Audit Intern) reports to the Board of Commissioners and/or the Audit Committee regarding:
   a. audit plans and realization; b. monitoring of follow-up on audit results;
   c. internal audit findings estimated to endanger the continuity of the business of Rural Banks (BPR) and Sharia Rural Banks (BPR Syariah); and
   d. other matters related to the implementation of duties and responsibilities of the internal audit.
   For Sharia Rural Banks (BPR Syariah), reports to the Board of Commissioners and/or the Audit Committee are copied to the Sharia Supervisory Board (DPS).
   The submission period for reports to the Board of Commissioners and/or the Audit Committee is adjusted according to the internal policy of each Rural Bank (BPR) and Sharia Rural Bank (BPR Syariah).

B. External Scope Reporting

1. Report on the Appointment or Dismissal of the Head of the Internal Audit Function (SKAI) or the Head of the Internal Audit Unit (PE Audit Intern).
   In accordance with Article 83 paragraph (1) of the OJK Regulation on the Implementation of Corporate Governance for Rural Banks and Sharia Rural Banks, Rural Banks (BPR) and Sharia Rural Banks (BPR Syariah) are required to submit the following reports:
   a. Rural Banks (BPR) and Sharia Rural Banks (BPR Syariah) submit reports on the appointment or dismissal of the Head of the Internal Audit Function (SKAI) or the Head of the Internal Audit Unit (PE Audit Intern) to the Financial Services Authority (Otoritas Jasa Keuangan) online through the Financial Services Authority reporting system as part of the Report on Appointment, Replacement, and/or Dismissal of Executive Officials in the periodic monthly report, in accordance with the procedures set forth in the Financial Services Authority Circular Letter regarding reporting through the Financial Services Authority reporting system and transparency of financial conditions for people's economy banks and the Financial Services Authority Circular Letter regarding reporting through the Financial Services Authority reporting system and transparency of financial conditions for Sharia people's economy banks. b. The report on the appointment of the Head of the Internal Audit Function (SKAI) or the Head of the Internal Audit Unit (PE Audit Intern) includes at least:

1. reasons for the appointment of the Head of the Internal Audit Function (SKAI) or the Head of the Internal Audit Unit (PE Audit Intern), including knowledge, skills, and experience aligned with the audit function;
2. curriculum vitae and identity data of the Head of the Internal Audit Function (SKAI) or the Head of the Internal Audit Unit (PE Audit Intern), including a recent color passport-size photo and a copy of the Identity Card (KTP);
3. photocopy of the Chief Executive's decision letter regarding the appointment of the Head of the Internal Audit Function (SKAI) or the Head of the Internal Audit Unit (PE Audit Intern);
4. attachment of the Board of Commissioners' opinion on the appointment of the Head of the Internal Audit Function (SKAI) or the Head of the Internal Audit Unit (PE Audit Intern); and
5. employment agreement letter.
   c. The report on the dismissal of the Head of the Internal Audit Function (SKAI) or the Head of the Internal Audit Unit (PE Audit Intern) includes at least:
6. reasons for the dismissal of the Head of the Internal Audit Function (SKAI) or the Head of the Internal Audit Unit (PE Audit Intern);
7. proposal for the candidate for Head of the Internal Audit Function (SKAI) or the Head of the Internal Audit Unit (PE Audit Intern), commitment to fill the position, and the timeframe for the replacement of the Head of the Internal Audit Function (SKAI) or the Head of the Internal Audit Unit (PE Audit Intern);
8. photocopy of the Chief Executive's decision letter regarding the dismissal of the Head of the Internal Audit Function (SKAI) or the Head of the Internal Audit Unit (PE Audit Intern); and
9. attachment of the Board of Commissioners' opinion on the dismissal of the Head of the Internal Audit Function (SKAI) or the Head of the Internal Audit Unit (PE Audit Intern).
   d. The report is signed by the Chief Executive and the Main Commissioner.

2. Report on the Implementation of the Internal Audit Function
   In accordance with Article 83 paragraph (2) of the OJK Regulation on the Implementation of Corporate Governance for Rural Banks and Sharia Rural Banks, Rural Banks (BPR) and Sharia Rural Banks (BPR Syariah) are required to submit the following reports:
   a. Report on the Implementation and Main Results of Internal Audit

1. The report on the implementation and main results of internal audit is submitted completely, accurately, currently, and wholly, including confidential audit result information which is part of the corporate governance implementation report.
2. The report on the implementation and main results of internal audit must be submitted semi-annually, at the latest by January 31 for the report as of the end of December and by July 31 for the report as of the end of June, online through the Financial Services Authority reporting system as part of the corporate governance implementation report.
3. The report on the implementation and main results of internal audit is prepared by the Head of the Internal Audit Function (SKAI) or the Head of the Internal Audit Unit (PE Audit Intern), submitted, and signed by the Chief Executive and the Board of Commissioners.
   For Sharia Rural Banks (BPR Syariah), the report on the implementation and main results of internal audit is copied to the Sharia Supervisory Board (DPS).
4. The report on the implementation and main results of internal audit includes confidential audit result information to the Financial Services Authority.
5. The report on the implementation and main results of internal audit contains at least the following materials:
   a) scope and timing of audit implementation; b) audit findings, namely clear disclosure of facts that occurred, date of occurrence, causes of deviations, and the impact of the deviation; c) conclusions of the Head of the Internal Audit Function (SKAI) or the Head of the Internal Audit Unit (PE Audit Intern) and the Auditor's Statement on audit results stating audit conclusions and auditor statements; d) auditor recommendations, auditee responses, and follow-up or auditee recommendations regarding deviations, proposed corrective steps, follow-up, description of auditee commitments, and deadlines for follow-up completion; e) results of monitoring auditee commitments that have been agreed upon by the Head of the Internal Audit Function (SKAI) or the Head of the Internal Audit Unit (PE Audit Intern) with the auditee to be implemented to improve the condition of Rural Banks (BPR) and Sharia Rural Banks (BPR Syariah); and f) supporting documents. The report on the implementation and main results of internal audit is contained in Appendix II which is an inseparable part of this Financial Services Authority Circular Letter. b. Special Report
6. A special report is made in the event of internal audit findings estimated to disrupt the continuity of the business of Rural Banks (BPR) and Sharia Rural Banks (BPR Syariah).
7. Internal audit findings estimated to disrupt the continuity of the business of Rural Banks (BPR) and Sharia Rural Banks (BPR Syariah) as referred to in letter a are internal audit findings that meet conditions resulting in decreased capital adequacy, asset quality, liquidity, and profitability, as well as management not based on prudent principles and the principles of healthy banking.
8. The special report is prepared by the Head of the Internal Audit Function (SKAI) or the Head of the Internal Audit Unit (PE Audit Intern) and signed by the Chief Executive and the Main Commissioner, and submitted to the Financial Services Authority at the latest 10 (ten) working days since the finding was known, online through the Financial Services Authority reporting system.
9. In the event that the Chief Executive is temporarily unable to act, the report may be signed by the Board of Commissioners accompanied by evidence of the temporary inability of the Chief Executive.
10. The special report is copied to the Board of Directors members who oversee the compliance function. For Sharia Rural Banks (BPR Syariah), the special report is also copied to the Sharia Supervisory Board (DPS).

3. Report on the Review Results of the Implementation of the Internal Audit Function
   a. In accordance with Article 84 of the OJK Regulation on the Implementation of Corporate Governance for Rural Banks and Sharia Rural Banks, Rural Banks (BPR) and Sharia Rural Banks (BPR Syariah) with core capital of at least IDR 50,000,000,000.00 (fifty billion rupiah) are required to submit a report on the review results by an external party. b. The external party as referred to in letter a is a party with competence to conduct audits, which is evidenced among others by a competence certificate. Example: audit consulting agencies, public accountants, and/or public accounting firms. The public accountants and/or public accounting firms referred to do not conduct audits on the financial reports of the respective Rural Banks (BPR) and Sharia Rural Banks (BPR Syariah) in the last 3 (three) years.
   c. The review is conducted at least 1 (one) time in 3 (three) years.
   d. The report on the review results is submitted to the Financial Services Authority at the latest 1 (one) month after the review results by the external party are received by Rural Banks (BPR) and Sharia Rural Banks (BPR Syariah), online through the Financial Services Authority reporting system. e. The report on the review results includes at least:

1. opinion on the work results of the Head of the Internal Audit Function (SKAI) or the Head of the Internal Audit Unit (PE Audit Intern);
2. compliance of the Head of the Internal Audit Function (SKAI) or the Head of the Internal Audit Unit (PE Audit Intern) with the guidelines for the implementation of internal audit function standards for Rural Banks (BPR) and Sharia Rural Banks (BPR Syariah);
3. assessment of the internal control system; and
4. improvement suggestions that may be made.

This copy is consistent with the original
Director of Legal Development
Legal Department signed
Aat Windradi

Established in Jakarta on 26 May 2025
HEAD OF EXECUTIVE SUPERVISOR OF BANKING
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA,
DIAN EDIANA RAE signed

APPENDIX II
FINANCIAL SERVICES AUTHORITY CIRCULAR LETTER
REPUBLIC OF INDONESIA
NUMBER 9/SEOJK.03/2025
REGARDING
IMPLEMENTATION OF INTERNAL AUDIT FUNCTIONS FOR RURAL BANKS AND SHARIA RURAL BANKS

REPORT ON THE IMPLEMENTATION AND MAIN RESULTS OF INTERNAL AUDIT

1. Scope and Timing of Audit Implementation
   No. Scope Date of Start of Audit Implementation Date of End of Audit Implementation Filled with a description of the audit scope such as activities, locations, processes, systems, components, and other elements that will be the focus of the audit Filled with the date the audit implementation starts in YYYYMMDD format Filled with the date the audit implementation ends in YYYYMMDD format

2. Audit Findings
   No. Facts Occurred Date of Occurrence Cause of Deviation Impact of Deviation Filled with internal audit findings estimated to endanger the continuity of the business of Rural Banks (BPR) and Sharia Rural Banks (BPR Syariah) Filled with the date of the internal audit finding occurrence in YYYYMMDD format Filled with an explanation of the factors causing the deviation Filled with the impact or potential impact caused by the deviation

3. Audit Conclusions and Auditor's Statement
   No. Audit Conclusion Auditor's Statement
   Filled with conclusions for each audit implementation, namely evaluation of audit results against audit objectives, and summary of findings Filled with the auditor's statement regarding the audit results

4. Auditor Recommendations, Auditee Responses, and Follow-up/Auditee Recommendations
   No. Deviation Proposed Corrective Steps Follow-up/Auditee Commitment Description of Auditee Commitment Deadline for Follow-up Completion Filled with audit findings on the identification of non-conformity with systems and procedures Filled with auditor suggestions in the form of corrective actions to address deviations Filled with follow-up actions implemented by the auditee regarding audit findings Filled with a description of commitments for follow-up by the auditee to resolve or correct deviations Filled with the deadline date for follow-up completion in YYYYMMDD format

5. Results of Monitoring Auditee Commitments
   No. Realization of Auditee Commitments Results of Monitoring Commitments Status of Realization of Auditee Commitments Filled with the realization of follow-up commitments that must be implemented by the auditee Filled with an assessment of commitments that have been followed up by the auditee Filled with:
   01 if "Completed"
   02 if "In Process"
   03 if "Not Yet Followed Up"

This copy is consistent with the original
Director of Legal Development
Legal Department signed
Aat Windradi

Established in Jakarta on 26 May 2025
HEAD OF EXECUTIVE SUPERVISOR OF BANKING
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA,
DIAN EDIANA RAE signed