External Audit Framework for Banking and Non-Bank Financial Institutions

BANK SUPERVISION DIVISION
GUIDELINE NUMBER 02-2015/BSD: EXTERNAL AUDIT FRAMEWORK FOR BANKING AND NON-BANK FINANCIAL INSTITUTIONS January 2015

Table of Contents

1. PRELIMINARY...................................................................................................................................2

2. PREFACE ...........................................................................................................................................3

3. INTRODUCTION................................................................................................................................5
   3.1. Background ...............................................................................................................................5
   3.2. Role of External Auditors.......................................................................................................6
   3.3. Rationale for Cooperation between External Auditors and Bank Supervisors.......7

4. RESPONSIBILITIES OF A BANK’S BOARD OF DIRECTORS & MANAGEMENT .............7

5. RELATIONSHIP BETWEEN AUDIT COMMITTEE & EXTERNAL AUDITORS.....................8

6. RELATIONSHIP BETWEEN BANK SUPERVISORS & EXTERNAL AUDITORS...............13

7. RELATIONSHIP BETWEEN SUPERVISORS & AUDIT OVERSIGHT BODIES..................19

8. SUPERVISORY EXPECTATIONS AND RECOMMENDATIONS FOR THE EXTERNAL
   AUDITOR ..................................................................................................................................................21

9. SUPERVISORY EXPECTATIONS AND RECOMMENDATIONS FOR THE AUDIT OF A
   BANK’S FINANCIAL STATEMENTS ..................................................................................................25

10. PRELIMINARY
    1.1. Short title: External Audit Framework for Banking and Non-Bank Financial
    Institutions
    1.2. Authorisation: This framework is issued under the authority of section 45 of the
    Banking Act [Chapter 24:20].
    1.3. Definitions: Terms used within this framework are as defined in the Banking Act
    [Chapter 24:20].
    1.4. Application: This framework applies to all banking and non-bank financial
    institutions that are licensed and supervised by the Reserve Bank of Zimbabwe, including bank holding companies. This framework is a replacement of the Framework on the Relationship between the Reserve Bank and Bank’s External Auditors issued by the Reserve Bank in 2004.

11. PREFACE
    2.1. The developments in the local banking sector over the last few years as well as
    the 2007 Global Financial Crisis have revealed weaknesses in risk management, control and governance processes at banks.
    2.2. Against this background, supervisors noted the need to improve the quality of
    external audits of banks and strengthen communication between supervisory authorities and external auditors of banking institutions.
    2.3. External auditors of banks play a pivotal role in promoting financial stability when
    they deliver quality audits which foster market confidence in banks’ financial statements. The respective roles and responsibilities of the supervisor and external auditors are broadly defined in the Banking Act [Chapter 24:20]. It is therefore imperative that the Reserve Bank and external auditors build effective relationships which foster information sharing and enhance banking supervision.
    2.4. The purpose of this framework is to strengthen the regulatory framework related
    to external auditors of banks and to ascertain the quality of the services performed by these external auditors, in relation to the specific risks of banks and financial sector in general.
    2.5. This framework provides elaborate information and guidance on how the
    relationship between the Reserve Bank of Zimbabwe and banking institutions’ external auditors can be strengthened to mutual advantage.
    2.6. The framework sets out principles that establish:
     the nature of the relationship between the supervisor and auditor;  the form and frequency that communication between the two parties should take; and  the responsibilities and scope for sharing information among the parties.
    2.7. The supervisory expectations and recommendations contained herein also
    provide a frame of reference to assist audit committees in the governance and oversight of the external audit function.
    2.8. Further, the framework promotes an effective two-way communication between
    the audit committee and the external auditor in order to promote the effectiveness

of the audit process. The guideline also form the basis for the supervisor’s assessment of the audit committee’s oversight of the bank’s external audit.
2.9. Overall, the framework should support the building of effective relationships
between prudential supervisors, external auditors, the banking institution and audit oversight bodies, thereby promoting cooperation in the discharge of their respective roles.

3. INTRODUCTION
   3.1. Background
   3.1.1 Banking institutions play a pivotal role in economic development through the
   financial intermediation process. Accordingly, the continued strength and stability of the banking system is a matter of general public concern.
   3.1.2 The external auditor has an important role to play in the regulatory framework of
   banking institutions which requires confidence in audited financial information to ensure that supervisory efforts and policies are effective, appropriate and based on accurate data. This requires an open, cooperative and constructive relationship between the supervisor and the auditor, so they can both provide effective input to the regulatory process.
   3.1.3 It is important, therefore, that the terms and scope of this relationship are clearly
   defined and understood by both the supervisor and auditor, as well as regulated financial institutions.
   3.1.4 Bank supervisors places reliance on the results of the auditors’ work, and may
   also engage external auditors to undertake additional tasks when these tasks contribute to the performance of the central bank’s supervisory role. At the same time, external auditors, in carrying out their function, leverages on information provided by bank supervisors to enhance the discharge of their responsibilities.
   3.1.5 The nature of the relationship and information-sharing between the regulator and
   audit firms should be considered in the context of the respective roles and responsibilities of auditors, a bank’s management and the board of directors.
   3.1.6 While the relationship with the regulator is designed to enhance the effectiveness
   of both the audit and the supervisory process, it does not detract from the independent role the auditor plays in forming judgments and opinions on a banking institution’s financial statements for the benefit of investors and other stakeholders. To the extent that the guideline is relevant, it should be applied in a

manner that is proportionate to the level of risk of the bank.
3.2. Role of External Auditors
3.2.1 The key responsibilities of a bank’s auditors include the following:
a) to express an objective opinion on a banking institution’s financial statements; b) conduct of audits of banking institutions in accordance with applicable auditing standards, as dictated by the relevant audit supervisory bodies; c) communicating to key stakeholders, including the board and senior management of the banking institution as well as regulatory bodies, the material weaknesses identified in its internal control system during the conduct of the audit; and d) external auditors of banking institutions may, from time to time, also be required to report on certain specified events or make regular reports to the supervisors in addition to the audit report on the bank’s financial statements. Generally, the scope of such reports will be agreed by the regulator, the bank concerned and its auditors before the commencement of the review.
3.2.2 In discharging their mandate, external auditors are expected at all times to
observe ethical standards such as independence, objectivity, professional competence and due care, commensurate with the complexity of the engagement. In order to do this auditors should assess the following factors including:
a) comprehensiveness of accounting policies; b) extent and adequacy of disclosure to enable full understanding of the financial position and risks facing banking institutions; and c) factors affecting the ability of the banking institution to continue as a going concern.
3.2.3 External auditors shall not be exonerated by disclaimer clauses in the statements
they endorse if they contain material errors and gross misrepresentation arising from negligence.

3.3. Rationale for Cooperation between External Auditors and Bank Supervisors
3.3.1 The continued transformation of bank balance sheets requires that there be
greater mutual understanding between various stakeholders such as bank supervisors and external auditors in their respective oversight roles in the risk management process of a bank.
3.3.2 External auditors play an important assurance role in the supervisory process, as
emphasised in the Basel Committee Core Principles of Banking Supervision.
3.3.3 The figure below highlights the key stakeholders charged with oversight of the
ongoing financial soundness of banking institutions:
4. RESPONSIBILITIES OF A BANK’S BOARD OF DIRECTORS &
MANAGEMENT
4.1. The board of a banking institution is charged with directing the affairs of a bank in
a sound manner. This is achieved through ensuring:
a) the individuals appointed to run the institution on a day to day basis have sufficient expertise, integrity and experience; b) the bank has adequate policies, practices and procedures related commensurate with the size and complexity of activities undertaken by the bank; Banking Institution (Senior management) Reserve Bank of Zimbabwe Board Audit Committee External Auditor

c) an effective system of internal controls is established throughout the organisational structure; d) the availability of appropriate management information systems are available for the management of banking activities; e) that the interests of all shareholders, depositors and other stakeholders are adequately protected; f) the bank has an appropriate risk management framework which is adhered to; and g) statutory and regulatory requirements are observed.
4.2. The board is responsible for the appointment of an audit committee to oversee
the establishment and maintenance of an internal control system in the bank. The effectiveness of the audit committee is enhanced through ongoing engagement with internal and external auditors.
4.3. Management is responsible for the implementation of the risk management
framework and internal control environment established by the board. In addition, management is responsible for the preparation of financial statements in accordance with the financial reporting framework set by the board and accounting standards.
4.4. The independent oversight of the Reserve Bank and external auditors does not
by any means reduce the responsibility of the board and management of a banking institution.
5. RELATIONSHIP BETWEEN AUDIT COMMITTEE & EXTERNAL AUDITORS
5.1. The overall responsibility of the audit committee is summarised in the figure
below:

Appointment of the External Auditor…
5.2. The audit committee must have a robust process for making such appointments
in a clear and transparent manner. Such a criterion must consider such issues as knowledge, competence and independence of the external auditor, among others.
5.3. The bank’s annual report must include a section that explains the approach the
audit committee has taken regarding the recommendation of the appointment or reappointment of the external auditor, and include supporting information on the tenure of the incumbent auditor.
5.4. If the board of directors has approval responsibilities with respect to the external
auditor, but does not accept the audit committee’s recommendation, the annual report, or any publication by the bank relating to the appointment/reappointment/dismissal of the external auditor, should include a statement explaining the audit committee’s recommendation and the reasons why the board of directors has taken a different position.
5.5. The audit committee is also required to conduct regular assessment of the
performance of the external auditor, in line with the objectives set out at Audit Committee Appointment of External Auditors Set independence requirements for external auditors and conduct reviews Review effectiveness of external audit process Receive & consider external audit reports Ensure ongoing communication between bank and external auditors

appointment. Such assessment must also take into account any regulatory requirements relating to the performance of audit work. Independence of External Auditor…
5.6. The bank, through the audit committee, should set acceptable independence
requirements, in line with existing supervisory requirements, and have procedures to monitor and assess the independence of the external auditor at least annually The assessment should consider all relationships between the bank and the audit firm (including the provision of non-audit services), any inadvertent violations, and any safeguards established by the external auditor.
5.7. The review of independence must also consider the risk of familiarity or self￾interest threat to the external auditor’s objectivity and independence in its audit of
the bank.
5.8. The audit committee should seek from the external auditor, at least on an annual
basis, information about the audit firm’s policies and processes for maintaining independence and monitoring compliance with the relevant independence requirements.
5.9. If a banking institution becomes aware at any time that its auditor is not
independent of the banking institution, it must take reasonable steps to ensure that it has an auditor independent of the firm. Further, the banking institution must notify the Reserve Bank if independence is not achieved within a reasonable time. Effectiveness of External Audit Functions…
5.10. The audit committee should maintain an understanding and knowledge of:
a) the structure and governance of the audit firm; b) the current nature of the audit environment, including in other jurisdictions where the bank operates; c) significant issues and concerns raised by the relevant audit oversight bodies regarding the audit firm, the auditor’s actions in addressing these concerns

and how these issues/concerns may affect the quality of the audit of the bank. In this regard, the audit committee should also consider, where available, the external audit firm’s annual transparency report and any inspection reports on the audit firm issued by the relevant audit oversight body; d) the nature of banking regulatory actions and conditions that could have an impact on the external auditor’s work on the bank; and e) public lessons learned from any recent external audit failures associated with the bank’s auditor, and other audit firms and how the audit firms have dealt with them so that similar audit risks are appropriately identified and limited.
5.11. The audit committee should satisfy itself that the level of the audit fees is
commensurate with the scope of work undertaken.
5.12. The audit committee should discuss and agree to the terms of the engagement
letter issued by the external auditor prior to the approval of the engagement.
5.13. If the external auditor resigns or communicates an intention to resign, the audit
committee should follow up on the reasons/explanations giving rise to such resignation.
5.14. The audit committee should ensure timely resolution of audit issues as part of
measures to promote audit effectiveness.
Effective Communication between Audit Committee & External Auditors...
5.15. Audit committees are required to establish effective ongoing communication with
the bank’s external auditors in order to reinforce the audit committee’s effectiveness and enhance the quality of the audit. In this regard, the audit committee of a bank should have the right and authority to meet regularly – in the absence of executive management – with the external auditor.
5.16. The audit committee should discuss with the auditor any matters arising from the
external audit work that may have an impact on regulatory capital or regulatory disclosures.
5.17. The audit committee should also communicate to the external auditor matters of

significant relevance to the conduct of the external audit, including areas requiring particular attention and significant communications with the supervisor. Reporting by the External Auditor to the Audit Committee…
5.18. As part of audit work carried out on banking institutions, external auditors are
required to report to the audit committee, an opinion on the effectiveness of internal controls over financial reporting processes and any additional matters identified during the audit, which warrant the attention of the audit committee.
5.19. External auditors are required to promptly report in writing to the board of the bank,
through the audit committee, any information which is considered relevant to the discharge of their governance role in the bank. As part of the above, the audit committee should request that the external auditor report to it on certain significant matters, including the following:
a) feedback on the auditor’s relations with management, the internal audit function and the risk management function, where relevant; b) significant difficulties encountered during the audit; c) significant internal control deficiencies identified in the course of the statutory audit; d) areas of significant risk or material misstatement in the financial statements, and the resultant effects on earnings, compensation structures and regulatory ratios; e) areas of significant management judgment and the auditor’s view on these areas; f) the extent to which the auditor uses external experts and the work of internal audit; and g) the adequacy of qualitative financial disclosures and recommendations

thereof.
6. RELATIONSHIP BETWEEN BANK SUPERVISORS & EXTERNAL AUDITORS
6.1. An effective relationship between the Reserve Bank and banks’ external auditors
enhances the processes of prudential supervision and the quality of external audits.
6.2. The establishment of an effective relationship between the two parties will enable
each party to carry out its respective statutory responsibilities. The external auditor can provide the supervisor with valuable insight into certain aspects of a bank’s operations.
6.3. The external auditor may also obtain helpful insights from the on-site and off-site
supervisory activities carried out by the Reserve Bank, particularly in areas significant to the external audit. Based on this symbiotic relationship, external auditors may also be requested by the Reserve Bank, to perform specific assignments that go beyond the scope of statutory audit work.
6.4. In order to discharge their respective statutory responsibilities, no party should
use the work of the other as a substitute for its own work and the supervised entity should remain the main source of information for their respective work.
6.5. For an effective relationship to exist, the engagement between the Reserve Bank
and the external auditor should involve individuals who are informed and empowered by their respective organisations to exchange information. Appointment of External Auditor…
6.6. In line with section 40 of the Banking Act, the Reserve Bank is empowered to
approve the appointment of an external auditor.
6.7. In making a determination to approve the appointment of an external auditor, the
Reserve Bank will consider whether the auditor (is):
a) registered as a public auditor, in terms of the Public Accountants and Auditors

Act [Chapter 27:12]; b) has been selected by the Audit committee of the banking institution; c) independent , in fact and appearance, of the bank audited, that is, the auditor is objective and impartial; d) complies with any other applicable ethical requirements; and e) able to demonstrate a competent quality assurance process, which ensures that internal and any externally imposed standards have been complied with. Disqualification of External Auditors…
6.8. The Reserve Bank will disqualify appointment of external auditors where:
a) the auditing firm, partner(s) and employees directly involved with the auditee bank have a borrowing relationship with the same; b) an employee or partner(s) of the audit firm is a director of the banking institution or of any corporate body which controls or is controlled by the banking institution; c) an employee or partner(s) of the audit firm is an officer or employee of the banking institution or of any associate of the banking institution; and d) external auditors no longer comply with the objective criteria outlined in the Banking Act [Chapter 24:20]. Reporting Requirements…
6.9. External auditors have a duty to report promptly to the Reserve Bank of Zimbabwe
any of the following matters concerning a supervised entity:
a) facts or decisions that constitute a material breach of laws or regulations; b) information that indicates failure to fulfil any of the requirements for a banking licence; c) significant internal control deficiencies identified during the conduct of the

audit; d) any indications affecting the bank’s ability to continue as a going concern; e) matters of a serious conflict within the decision-making bodies; f) the intention of the auditor to resign or the removal of the auditor from office; g) where after discussing the audit findings with a bank, they conclude that they will give an adverse opinion as opposed to one qualified by exceptions; and h) material adverse changes in current or potential risks of the bank’s business.
6.10. Notwithstanding, it remains the principle responsibility of the bank’s management
to ensure the provision of complete, accurate and timely information to the supervisor. Reporting on misstatements arising from fraud or error…
6.11. External auditors are required to apply audit approaches, techniques and
procedures designed to obtain reasonable assurance that material misstatements arising from fraud or errors are detected.
6.12. Where the external auditor determines that such material misstatement exists,
such information must be reported promptly by the external auditor to the Reserve Bank. External Auditors’ Reports
6.13. Where an external auditor discovers misstatements with a material impact on
financial statements, including use of inappropriate accounting policy or asset valuation or failure to disclose essential information, the auditor must request management to adjust the financial statements to correct the misstatement.
6.14. If management refuses to make such adjustments as are required to correct
misstatements, the external auditor must inform the Reserve Bank and issue a qualified or adverse opinion on the financial statements.
6.15. Reports by the external auditor to the Reserve Bank regarding misstatements

shall include some or all of the following information:
a) an outline of the key audit findings (including appendices); b) a description of any significant trends; c) a discussion of the exceptions which in the view of the external auditor, are most significant; d) background information on the business area of the report, including an organisational structure, and where appropriate the nature and approximate value of transactions; e) a tailored description of the key risks as they apply to that business and are faced by the bank, and based on the bank’s particular business characteristics; f) a risk matrix indicating the risk profile of the banking institution; g) a description of the key controls including an overall assessment of the control environment in each area of business examined; and h) an outline of the work undertaken in fulfilling the requirements of the scope of the report and any limitations.
6.16. The external auditor may further be required to provide detailed information on
specific matters such as:
a) audit approach used; b) quality of internal controls and the reliability and continuity of IT systems c) accounting items such as unrealized gains or losses, contingent liabilities and provisions; d) related party transactions; and e) compliance with prudential requirements e.g. capital adequacy, prudential lending limits or anti-money laundering procedures.
6.17. Reports to the Reserve Bank, together with any written comments from the bank’s
management, are required to be submitted within three months from the end of the period audited, unless otherwise specified.
6.18. External auditors are required to give bank management adequate time within

which to comment on the audit report.
Information sharing with Reserve Bank…
6.19. In view of the key role played by external auditors and supervisors in assuring
stakeholders of the continued soundness of banking institutions, there is need to establish effective lines of communication between auditors and supervisors.
6.20. Auditors are required to communicate to the Reserve Bank any information or
opinion on a matter that the auditor reasonably believes is relevant to any function of the Reserve Bank. In deciding what information to share with the Reserve Bank, the overriding consideration should be to disclose information that, according to the judgment of the audit partner, would assist the Reserve Bank to carry out its supervisory functions.
6.21. Such information should be disclosed in a timely manner by the auditor directly to
the Reserve Bank. Notwithstanding that such information may already have been discussed with the banking institution, it is not sufficient for the auditor to rely on management of the bank to notify the supervisor of the same.
6.22. Similarly, the Reserve Bank will disclose information to the external auditor that it
judges to be relevant to the fulfilment of the auditor’s statutory duties. While there are restrictions on the information the supervisor can share with auditors and the circumstances in which it can be shared, the supervisor will endeavour to share information that is likely to contribute to higher quality audits. Meetings between Reserve Bank and External Auditors…
6.23. Co-operation and communication between the Reserve Bank and external
auditors will take the form of periodic meetings and exchange of specific information between the supervisor and external auditor.
6.24. Such meetings could be through both formal channels, such as scheduled
bilateral and trilateral meetings with relevant individuals, and through informal channels, such as telephone calls and meetings as appropriate. The nature and

frequency of communications should be proportionate to the size and complexity of the regulated firm. Tripartite meetings…
6.25. The Reserve Bank will hold tripartite meetings with external auditors and banking
institutions at least annually. Such periodic meetings should at all times include the Chairperson of the bank’s audit committee.
6.26. The form, content and frequency of this dialogue will vary depending on the risk
profile and circumstances of the supervised banking institution.
6.27. The parties shall discuss areas of mutual interest which may focus on the
following:
a) the financial condition of the bank; b) external auditors’ reports on annual accounts and/ or ad hoc reports made by the auditors; c) internal auditors’ reports; d) material adverse events or transactions which affect the business operations or financial position of the bank; and e) implementation of corrective action and recommendations, as applicable. Bilateral Meetings…
6.28. The Reserve Bank and external auditors shall from time to time convene meetings
to discuss issues of mutual interest. Furthermore, pre-examination and post￾examination meetings will be held as part of the Reserve Bank’s risk-based examination approach. The purpose of these meetings is to discuss the key challenges facing the banking institution, progress made in implementing internal and external audit concerns as well as discussing any regulatory concerns.
6.29. The timing and content of these meetings could be aligned with the typical phasing

of the bank’s external audit and/or periodic supervisory assessment of the bank. Communication between auditors and banking institution…
6.30. Communication between external auditors with management and board of
directors about significant matters relating to financial reporting or supplementary matters should be put in writing and should form part of the bank’s records. Confidentiality…
6.31. External auditors are required by internationally accepted ethical standards to
treat the information received while carrying out their functions as confidential. Nevertheless, external auditors are required to make disclosures in good faith to the supervisor, where such disclosure is considered to be pertinent to the Reserve Bank’s performance of its supervisory duties.
6.32. Similarly, the Reserve Bank may communicate bank-specific information to the
external auditor when the information-sharing will help in its supervisory work and in turn assist the external auditor in conducting a quality external audit.
7. RELATIONSHIP BETWEEN SUPERVISORS & AUDIT OVERSIGHT BODIES
7.1. In view of the key role played by the audit and accounting profession and the
synergies to be obtained from establishing effective relationships between the Reserve Bank and auditors, there is need for ongoing engagement with the audit oversight bodies as shown in the diagram below.

Regular Communication between Reserve Bank, Accounting Profession and Audit Oversight Bodies…
7.2. The Reserve Bank will establish open, timely and regular communication with
audit firms and the accounting profession as a whole, at a national level. Such communication will focus on systemic risks, as well as a regular exchange of views on appropriate accounting techniques and auditing issues.
7.3. In this regard, meetings will be held at national level between the Reserve Bank,
audit firms and professional accountancy and audit oversight bodies to discuss existing and emerging key risks and systemic issues. Key risk issues may be identified from discussions concerning:
a) the appropriateness of accounting techniques for newly developed financial instruments or new products; b) adequacy of loan loss provisions held by banking institutions; c) threats to internal control environment of banking institutions; and d) Any other issues relevant to the conduct of audit of banking institutions. 7.4.Communication between the Reserve Bank, the accounting profession and the

• safety and
  soundness of banks
• general financial
  sector stability
  Reserve Bank of
  Zimbabwe
• appropriateness of accounting
  techniques
• transparency in reporting of
  impairment evaluations
• threats to internal control
  enviornment of banks
• adequcy of loan loss provisions
  Cooperation &
  Coordination
• quality of audits
• protection of
  investor and public
  Audit and Accounting
  Profession

audit oversight bodies should take place as frequently as deemed necessary to enable them to inform each other of topics or issues of mutual concern or interest arising from the performance of their duties that could be of relevance to the other authority, subject to relevant legal constraints.
7.5. Where, during the conduct of its supervisory work, the Reserve Bank notes
matters requiring the urgent action of the accounting profession and the audit firms as a whole, the Reserve Bank will communicate this through the relevant supervisory bodies.
7.6. The Reserve Bank may follow up issues raised by the oversight bodies for
remediation by banking institutions while the oversight bodies may also initiate a thematic review to analyse the impact of issues or topics identified by Reserve Bank.
7.7. Information shared between the Reserve Bank, the accounting profession and the
audit oversight body remains confidential in nature and should be handled as such by both parties. Consequently, all parties should be notified of any requests by third parties, for disclosure of information obtained through the information sharing arrangement and disclosure of the same should be done in consultation with the party providing the information.
7.8. Representatives of the banking industry association may be invited to attend such
periodic meetings, in order to enhance discussions on these topics and help achieve consistent adoption and application of appropriate accounting policies.
8. SUPERVISORY EXPECTATIONS AND RECOMMENDATIONS FOR THE
EXTERNAL AUDITOR
Knowledge and competence…
Expectation 1: The external auditor of a bank should have banking industry knowledge and competence sufficient to respond appropriately to the risks of material misstatement in the bank’s financial statements and to properly meet any additional regulatory requirements that may be part of the statutory

audit.
8.1. Given the complexity and diversity of banking activities, and the legal and
regulatory framework in which banks operate, the external auditor of a bank should have specialised knowledge and competence in auditing banks and should use experts as appropriate. Knowledge, Competence and Use of Experts…
8.2. The resources required to perform the audit should be such that the audit
engagement team, as a whole, has proficient knowledge and understanding of:
a) practical experience with, the banking sector and bank-specific risks, and the operations and activities of banks and bank audits. The audit engagement team may acquire this proficiency through specific training, participation in bank audits or work in the banking sector; b) applicable accounting, assurance and ethical standards, industry practice and relevant audit certification. c) relevant regulatory requirements in the areas of capital and liquidity, and a general understanding of the legal and regulatory framework applicable to banks; and d) IT relevant to bank audits.
8.3. In addition, the external auditor should consider whether the audit engagement
team should include specialists with a high degree of technical accounting knowledge relevant to banking, particularly given the complexity of the requirements of the applicable financial reporting framework pertaining to accounting estimates, including loan loss provisions, fair value measurements, and any areas known to be subject to differing interpretation or inconsistent or developing practices.
8.4. Audit firms should have documented policies and procedures that set minimum
competency criteria for members of a bank’s audit engagement team.
8.5. In some instances, such as the auditing of certain complex accounting estimates,
more specialised knowledge may be required to support the audit engagement

team, e.g. additional expertise beyond that possessed by the audit engagement team’s members in a field other than accounting or auditing.
8.6. The use of experts should be guided by the use of internationally accepted
auditing standards.
Objectivity and independence…
Expectation 2: The external auditor of a bank should be objective and independent in fact and appearance with respect to the bank, consistent with the more stringent requirements applicable to public interest entities in internationally accepted ethical standards
8.7. Auditors should be free from situations and relationships in which a reasonably
informed third party would conclude that an external auditor’s objectivity is impaired.
8.8. The external auditor of a bank must comply with the International Standards on
Auditing issued by the International Auditing and Assurance Standards Board and other relevant auditing standards issued by reputable auditing bodies.
8.9. When assessing whether any relationship or circumstance poses a threat to an
external auditor’s independence, the external auditor should evaluate not just the specific rules on independence, but also the substance of the threat to independence, and how a reasonably informed third party would perceive the threat and its effect on the external auditor’s objectivity.
8.10. The provision of significant non-audit services by the audit firm and, when
applicable, network audit firms to the bank being audited may particularly affect a third party’s perception of the external auditor’s independence.
8.11. The Reserve Bank expects the external auditor to consider actively potential
threats to the auditor’s independence, specifically the threat of self-review, when discussing accounting matters with the management. Professional skepticism… Expectation 3: The external auditor should exercise professional skepticism

when planning and performing the audit of a bank, having due regard to the specific challenges in auditing a bank.
8.12. Throughout the audit, the auditor should “adopt a questioning approach when
considering information and forming conclusions”.
8.13. Exercising appropriate professional skepticism is critically important in audits of
banks because of the number and significance of accounting estimates and the potential for limited objective evidence supporting those estimates. Professional skepticism is particularly important when auditing areas that:
a) involve significant management estimates and judgments because these are more prone to management bias; b) involve significant non-recurring or unusual transactions; or c) are more susceptible to fraud and errors being perpetuated due to weak internal controls.
8.14. The evidence of the extent of professional skepticism exercised should be
demonstrable and understandable through audit documentation that describes how, why and what conclusions were reached by the external auditor. In this regard, internationally accepted auditing standards establish minimum requirements for audit documentation. Quality control…
8.15. Audit firms must comply with the applicable jurisdictional and internationally
accepted standards on quality control. Further, the external auditor of a bank should comply with the more stringent requirements on quality control applicable to listed entities in internationally accepted quality control standards. To the extent that any of the rules within any one of these quality control standards is more restrictive than a corresponding rule in the other quality control standards, the external auditor must comply with the more restrictive rule.
8.16. The audit of a bank should be subject to an engagement quality control review
(EQCR) performed internally by the audit firm prior to the issuance of the audit opinion.
8.17. EQCR should be part of a broader firm-level internal system of quality control that

emphasises quality and consultation and creates a culture of compliance with auditing and ethical standards.
8.18. Where a network of audit firms is involved in the audit of a bank, the lead audit
engagement partner should be responsible for the performance of a quality audit by all the teams reporting to it.
8.19. The involvement of the engagement quality control reviewer throughout the audit,
and the outcome of the quality control review, should be evident in the audit working papers. Any significant discussions between the engagement quality control reviewer and the audit engagement team, particularly in areas where views may have differed and as to how conclusions were reached, should be fully documented in the audit working papers.
8.20. The Reserve Bank may request evidence of the quality control processes of the
audit firm.
9. SUPERVISORY EXPECTATIONS AND RECOMMENDATIONS FOR THE
AUDIT OF A BANK’S FINANCIAL STATEMENTS
Identifying potential risks…
9.1. In designing and performing the audit of a bank, the external auditor should
assess the inherent risks and control environment to determine the risk of material misstatements at the financial statement and assertion levels. This promotes an understanding of internal controls that are relevant to the audit, and particularly of the control environment designed by the bank.
9.2. The external auditors should develop an audit strategy that includes both
substantive procedures and control testing. The external auditors should perform extensive tests of controls over financial reporting to assess whether, and to what extent, the auditor can rely on them. Materiality…
9.3. Auditors must comply with internationally accepted accounting standards on

materiality.
9.4. In line with internationally accepted accounting standards, external auditors are
required to set a lower level of materiality for individual account balances, specific classes of transactions or disclosures which the auditor believes influence decision making by users of financial statements.
9.5. In determining the materiality threshold, there is need for external auditors to
consider the extent to which misstatements could influence economic decisions of users of financial statements.
9.6. Individual misstatements, including those below the level of materiality, should be
investigated in detail as they could be an indicator of wider issues within the bank.
9.7. Consequently, in determining the materiality threshold, external auditors need to
assess the bank’s internal control environment by considering the following:
a) assess whether board and senior management is promoting a robust control environment; b) determine whether the controls extend to all operations and branches of the bank; c) understand the bank’s approach to outsourcing of business activities and functions and the controls around these activities; and d) obtain an adequate understanding of the organisation of key control functions which should include the internal audit, risk management, and compliance.
9.8. External auditors also need to pay attention to compensation arrangements that
may encourage excessive risk-taking by management of the bank leading to material misstatements. Control activities…
9.9. When identifying and assessing risks of material misstatement and assessing
controls, the external auditor should take account of the following factors:
a) the knowledge and competence of those responsible for financial reporting and of other control functions impacting financial statements; b) the nature of hedging strategies employed by the bank which, if complex, improperly structured or inadequately monitored, can have accounting and

solvency implications; c) the use of complex financial instruments involving significant estimates of fair value; d) controls to ensure the separation of client and proprietary assets in custodial services; e) the volume of transactions by type of activity and/or presence of significant non-routine transactions; f) the use and monitoring of internal accounts; g) the structure and complexity of banks’ IT systems for conducting business and for facilitating efficient business and financial reporting and controls around the same; h) the number, scope and geographical dispersion of subsidiaries and the necessity for complex consolidation procedures; i) the existence of significant transactions with related parties; and j) the use of off-balance sheet financing arrangements, such as special purpose vehicles (SPVs) and other complex structures.
9.10. The external auditor should evaluate whether the internal control environment of
a bank is robust and able to cope with stressed environments.
9.11. Significant deficiencies in internal controls identified by the external auditor should
be communicated in writing to the board and senior management on a timely basis.
9.12. In addition, the external auditor should communicate, in writing, to the board all
significant decisions or actions by management that lack appropriate authorization and have an impact on the strategic direction of the bank. Internal audit…
9.13. The work of internal auditors can help external auditors assess the quality of the
internal control processes and identify risks.
9.14. In this regard, the external auditor should consider reviewing relevant internal

audit reports whose findings may have an impact on the financial statement audit. Responding to significant risks of material misstatement specific to a bank’s financial statements…
9.15. The external auditors should identify areas with significant risk of material
misstatement.
9.16. In this regard, external auditors should pay attention to areas in a bank’s financial
statements whose regulatory treatment could give rise to incentives for management bias in the recognition or measurement of such items. Examples of such items are deferred tax assets, investments in unconsolidated entities, pension fund assets, and the classification of financial instruments. External auditors should therefore be alert to any likelihood that the treatment of such items in the financial statements is influenced by management bias towards a desired regulatory outcome and consider this in their risk assessment of the bank.
9.17. External auditors should evaluate estimates which may be subject to bias, and
any potential audit differences otherwise identified, in the context of their impact on regulatory requirements.
9.18. Areas of significant risk of material misstatement particularly require an external
auditor to apply professional judgment and experience. External auditors need to obtain sufficient and appropriate audit evidence regarding the assessed risks of material misstatement, through designing and implementing appropriate responses to those risks.
9.19. Having determined areas of significant risks of material misstatement, external
auditors need to discuss the same with board and senior management. Loan loss provisioning…
9.20. Loan loss provisioning is generally material for a bank’s financial statements and
the calculation of capital and key performance metrics. The measurement of loan loss provisions in accordance with internationally accepted accounting principles

involves complex judgments about credit risk which may be subjective in nature.
9.21. The factors that external auditors need to consider in identifying and assessing
the significant risks of material misstatement in relation to loan loss provisioning and the related provision for loan losses include:
a) the estimation techniques used to compute provisions and how the techniques vary among and within banks; b) how management has assessed the effect of estimation uncertainty on the level of provisioning, and the effect on the adequacy of the recognised provision; c) impairment indicators for loan exposures including unexpected adverse developments in the market or economic environment, adverse movements in interest rates and inadequate underwriting policies adopted by the bank, among others; d) the incorporation of perspectives and data from different functions within the bank, including risk management, credit and internal audit, as well as reliable sources external to the bank, including peer data and regulator perspectives; e) where differences exist between accounting rules and regulatory reporting requirements for loan loss provisioning, there is need to assess correct and consistent application of the same. Further, where material differences in loan loss provisions for accounting and regulatory purposes are noted, external auditors need to be alert to any management bias in this area; and f) whether disclosures enable users to assess the loan loss provisioning methodology applied by the bank and how it compares with methodologies applied across the banking sector. Financial instruments measured at fair value…
9.22. External auditors should assess the treatment of financial instruments measured
at fair value as such impairment assessment may be subject to bias.
9.23. Where there are changes in the composition of a bank’s portfolio of financial
instruments – whether due to changes in customer demand, the bank’s approach to managing risk and liquidity, or changes in prudential regulation – the bank will

need to evaluate any accounting implications of the changes.
9.24. Accounting standards contain requirements on recognition; initial and subsequent
measurement (including impairment); reclassification from fair value to amortised cost; presentation; and disclosures. The external auditor should utilise wider￾ranging audit procedures to obtain sufficient appropriate audit evidence to satisfy himself that the financial statements are not materially misstated. The classification of an individual financial instrument may be particularly important for achieving a favourable regulatory outcome.
9.25. External auditors should comply with procedures set out in internationally
accepted accounting standards in the valuation of financial instruments for which there are significant unobservable inputs set out that may be followed in auditing financial instruments measured at fair value. Liabilities including contingent liabilities …
9.26. In the course of the audit, the external auditor should remain alert to actual or
suspected breaches or non-compliance with prudential requirements, business conduct requirements, legal requirements or contractual agreements which could lead to legal or supervisory actions against a bank, thereby exposing the bank to potential litigation and/or the imposition of substantial penalties.
9.27. Such events may require recognition of provisions, contingent liabilities and/or
qualitative disclosures in the bank’s financial statements.
9.28. In terms of section 43 of the Banking Act, if the external auditor identifies any such
breaches of material significance, the auditor should notify the supervisor immediately. Disclosures…
9.29. In responding to the significant risks arising from increased complexity of business
operations, the external auditor has an important role to play in encouraging consistent and meaningful disclosures which present the bank’s financial condition in a way that is informative and understandable to users of financial

statements.
9.30. In the course of its audit work, the external auditor should be alert to any
indications that disclosures in financial statements are not consistent with the bank’s prudential information such as capital adequacy and liquidity position disclosures within the financial statements. Going concern assessment…
9.31. The external auditor’s should evaluate the bank’s assessment of its ability to
continue to meet its obligations for the foreseeable future (for at least 12 months after the date of the financial statements) and whether there are material uncertainties in this regard that should be disclosed in the applicable accounting framework.
9.32. Given the nature of bank balance sheets and other risks, banks are required to
meet liquidity requirements and capital ratios set by the bank supervisory authority. There should be equal emphasis on the evaluation of liquidity and solvency of the bank for the period over which the going concern assumption has been assessed:
a) Liquidity: Factors to assess include the reasonableness and reliability of the cash forecast for at least 12 months after the date of the financial statements, liquidity risk disclosures, regulatory or contractual restrictions on cash, loan covenants, and pension funding. b) Solvency: Given the potential adverse impact of capital adequacy concerns on the confidence in a bank and, as a consequence, on the bank operating as a going concern, the external auditor should consider the robustness of the bank’s system for managing capital. In addition, the external auditor will need to consider the capital position in relation to the current and any known future capital requirements, definitions of capital resources, and challenges of raising capital.
9.33. In responding to the significant risks in this area of audit, and assessing
management’s assertion that a bank is a going concern, factors which are

necessary to consider are:
a) the robustness of the bank’s own systems and controls for managing liquidity, capital and market risk; b) the prudential information that is reported to supervisors covering the bank’s solvency and capital; c) any external indicators that reveal liquidity or funding concerns; and d) the availability of short-term liquidity support.
9.34. Given the above risks and the possible systemic implications, if there are any
significant doubts which may cause material uncertainty over the bank’s ability to continue as a going concern, and if the external auditor considers referring to the going concern issue in the audit report, the external auditor should promptly communicate this fact to the supervisors. Securitisations – SPVs…
9.35. The banking sector is involved in activities such as sponsoring (or originating)
structured products/transactions that support maturity, credit and liquidity transformation risks more often than other industry sectors. The sponsoring bank does not ordinarily fund such activities. The funding is generally provided by other parties. However, the sponsoring bank may be exposed to risks such as reputational risk in the event of the sponsored entity encountering financial or operational difficulties.
9.36. Such activities require special consideration by the external auditor and are of
interest to the supervisor for the following reasons:
a) Accounting concern – Accounting frameworks are often principles-based, which may result in different treatments of each of these complex transactions. In addition, because these are highly structured products, their accounting treatment may vary based on the facts and circumstances of each transaction, e.g. where SPVs are tailored to remain off the bank’s balance sheet. In these instances, it is necessary for the auditor to evaluate the judgments made by the management and consider whether the accounting treatment is

appropriate and the disclosures are sufficient. b) Regulatory concern – Because of the complexity of the securitisation and the chain of financial intermediation, the sponsoring bank in an “originate to distribute” model may underestimate the real risk transferred or the risk retained on its balance sheet (including reputation risk and conflicts of interest in case of defaults on the securitised assets). Even so, the originator may be able to benefit from an off-balance sheet treatment for the assets underlying these transactions and hence may not be required to hold additional regulatory capital unless specifically required by the supervisor. The external auditor should be alert to when the supervisor requires additional capital even though the off-balance sheet accounting treatment applied by the bank is appropriate. c) Interconnectivity – Increases the correlation between banks and other non￾banking sectors, which can add to the global systemic risk. Information Technology (IT) Certification…
9.37. In performing audit reviews of banks, external auditors should make an
assessment of the information technology and communications systems of banking institutions and confirm that the financial statements as reported by management and board are consistent with a non-intruded IT system and business conditions that prevailed over the accounting period.
9.38. To effectively assess the soundness of the audited banking institution’s IT
systems, external auditors should:
a) assess adequacy of board and management oversight on information systems; b) evaluate computer hardware and networks, software and applications that support financial information processing and the risk management process; c) review controls and audit trails over master file change requests; d) review data independence and security, transaction processing efficiency, data consistency, accuracy and completeness; e) evaluate information-security controls (information security management); f) evaluate control and security for data transmitted to or from remote locations

(network infrastructure security); and g) review business continuity arrangements.
9.39. On conclusion of the audit, the IT system should be rated on a scale of 1 to 5 and
the rating should reflect:
a) adequacy of the bank’s risk management practices; b) management of IT resources; and c) integrity, confidentiality, and availability of automated information.
9.40. 1 is the highest rating which reflects an appropriately controlled or managed IT
function, strong risk management practices and the least degree of supervisory concern.
9.41. 5 being the lowest rating level, reflects imminent threat to viability, unacceptable
controls or the risk management practices are deficient and has the highest degree of supervisory concern.