Implementation of Internal Audit Function for Sharia Micro Finance Banks

To:
The Board of Directors of Sharia Micro Finance Banks

COPY

CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY NUMBER 12 /SEOJK.03/2019 CONCERNING THE IMPLEMENTATION OF THE INTERNAL AUDIT FUNCTION FOR SHARIA MICRO FINANCE BANKS

In connection with the establishment of Financial Services Authority Regulation Number 24/POJK.03/2018 concerning the Implementation of Corporate Governance for Sharia Micro Finance Banks, hereinafter referred to as the POJK on BPRS Corporate Governance, it is necessary to regulate the implementation of the aforementioned Financial Services Authority Regulation in the Financial Services Authority Circular Letter as follows:

I. GENERAL PROVISIONS

1. This Financial Services Authority Circular Letter covers standard guidelines for the implementation of the internal audit function and related reports regarding the implementation of the internal audit function.

2. The standard guidelines for the implementation of the internal audit function for BPRS are minimum standards that must be met by BPRS in formulating the BPRS internal audit function implementation guidelines to fulfill one of the factors for implementing corporate governance. BPRS formulates and may develop the internal audit function implementation guidelines according to the needs and complexity of the BPRS business operations with reference to the Standard Guidelines for the Implementation of the Internal Audit Function in the Appendix which is an inseparable part of this Financial Services Authority Circular Letter.

3. In accordance with Article 87 of the POJK on BPRS Corporate Governance, to implement the internal audit function, BPRS is required to submit to the Financial Services Authority:
   a. a report on the appointment or dismissal of the Head of the Internal Audit Work Unit (SKAI) or the Executive Official responsible for the implementation of the internal audit function (PEAI), accompanied by considerations and reasons for the appointment or dismissal; b. a report on the implementation and key points of internal audit results, including confidential audit result information;
   c. a special report regarding internal audit findings that may disrupt the continuity of the BPRS business; and
   d. a report on the review of the internal audit function for BPRS with core capital of at least IDR 50,000,000,000.00 (fifty billion rupiah).

4. In accordance with Article 94 of the POJK on BPRS Corporate Governance, BPRS is required to submit reports as referred to in item 3 to the Financial Services Authority electronically through the Financial Services Authority reporting system. In the event that submission of reports electronically through the Financial Services Authority reporting system cannot yet be performed, reports are submitted offline.

Submission of reports related to the internal audit function electronically through the Financial Services Authority reporting system or offline is carried out as regulated in the Financial Services Authority Regulation regarding reporting by rural credit banks and Sharia micro finance banks through the Financial Services Authority reporting system.

II. REPORTS RELATED TO THE INTERNAL AUDIT FUNCTION

1. Report on the Appointment or Dismissal of the Head of SKAI or PEAI
   a. General Guidelines
   In accordance with Article 88 paragraph (1) of the POJK on BPRS Corporate Governance, the report on the appointment or dismissal of the Head of SKAI or PEAI, accompanied by considerations and reasons for the appointment or dismissal, must be signed by the President Director and the Main Commissioner, and must be submitted to the Financial Services Authority no later than 10 (ten) working days from the date of appointment or dismissal of the Head of SKAI or PEAI.

   b. Scope

   1. The content of the report on the appointment of the Head of SKAI or PEAI must at least include:
      a) considerations and reasons for the appointment of the Head of SKAI or PEAI; b) identity documents of the Head of SKAI or PEAI with reference to the identity documents of the appointed Executive Official as regulated in the Financial Services Authority Circular Letter concerning BPRS; c) photocopy of the President Director's decision letter regarding the appointment of the Head of SKAI or PEAI; d) appendix of the Board of Commissioners' opinion regarding the appointment of the Head of SKAI or PEAI; and e) employment agreement letter (if any).
   2. The content of the report on the dismissal of the Head of SKAI or PEAI must at least include:
      a) considerations and reasons for the dismissal of the Head of SKAI or PEAI; b) photocopy of the President Director's decision letter regarding the dismissal of the Head of SKAI or PEAI; and c) appendix of the Board of Commissioners' opinion regarding the dismissal of the Head of SKAI or PEAI.

2. Report on the Implementation and Key Points of Internal Audit Results
   a. General Guidelines

   1. In accordance with Article 87 paragraph (1) letter b of the POJK on BPRS Corporate Governance, BPRS is required to submit a report on the implementation and key points of internal audit results, including confidential audit result information, to the Financial Services Authority.
   2. The report on the implementation and key points of internal audit results must at least meet the criteria of being submitted in writing, described briefly and easily understood, objective, constructive, and systematic.
   3. The report on the implementation and key points of internal audit results is prepared by the SKAI or PEAI and submitted to the President Director and the Board of Commissioners with a copy to the Board of Directors member who oversees the compliance function.
   4. The report on the implementation and key points of internal audit results is prepared annually for the reporting position up to December 31 and is signed by the President Director and the Main Commissioner, and submitted to the Financial Services Authority no later than March 31 of the following year.
   5. In accordance with Article 116 of the POJK on BPRS Corporate Governance, BPRS is required to submit the report on the implementation and key points of internal audit results to the Financial Services Authority for the first time for the reporting position at the end of December 2022.

   b. Scope

   1. The report on the implementation and key points of internal audit results must at least include:
      a) scope and time of audit implementation; b) audit findings, namely clear disclosure of facts that occurred, the situation that should have existed, and the impact and causes of deviations; c) conclusions of the SKAI or PEAI regarding the audit results stating conformity or deviations that occurred in the BPRS based on audit results; d) auditor's statement that the audit has been conducted in accordance with the BPRS internal audit function implementation guidelines; e) recommendations regarding improvement steps proposed by the SKAI or PEAI regarding audit findings; f) auditee's response which can be approval or rejection of the audit results along with reasons; g) auditee's follow-up determined by the SKAI or PEAI regarding audit findings; h) auditee's commitment agreed upon with the SKAI or PEAI to be implemented in improving the BPRS condition; and i) results of the SKAI or PEAI's monitoring of the auditee's commitment regarding the realization of commitments promised by the auditee.
   2. In the event that internal audit is conducted once in one year, the report on the implementation and key points of internal audit results submitted to the Financial Services Authority can be the audit result report of the SKAI or PEAI submitted to the President Director with the scope as referred to in item 1).
   3. In the event that internal audit is conducted more than once in one year, the report on the implementation and key points of internal audit results submitted to the Financial Services Authority is a summary of the key points of all internal audit results conducted within a one-year period with the scope as referred to in item 1).

3. Special Report
   a. General Guidelines

   1. A special report is prepared in the event of internal audit findings that may disrupt the continuity of the BPRS business.
   2. Internal audit findings that may disrupt the continuity of the BPRS business as referred to in item 1) are internal audit findings that meet conditions including:
      a) lowering the capital ratio (minimum capital provision ratio); and/or b) causing the BPRS to be placed under intensive supervision or special supervision.
   3. The special report is prepared by the SKAI or PEAI and submitted to the President Director and the Board of Commissioners with a copy to the Board of Directors member who oversees the compliance function.
   4. In accordance with Article 88 paragraph (3) of the POJK on BPRS Corporate Governance, the special report must be signed by the President Director and the Main Commissioner and must be submitted to the Financial Services Authority no later than 10 (ten) working days from the date the internal audit finding as referred to in item 2) is known by the SKAI or PEAI.
   5. In the event that the President Director is temporarily unable to act, the special report can be signed by the Board of Commissioners accompanied by proof of the temporary inability of the President Director.

   b. Scope
   The special report regarding internal audit findings that may disrupt the continuity of the BPRS business must at least include:

   1. internal audit findings that may disrupt business continuity;
   2. supporting evidence of audit findings as referred to in item 1); and
   3. follow-up of audit findings.

4. Report on the Review of the Internal Audit Function
   a. General Guidelines

   1. In accordance with Article 67 paragraph (5) of the POJK on BPRS Corporate Governance, the review of the internal audit function is conducted at least once in 3 (three) years, namely for the period from July to June of the next 3 (three) years.
   2. The review of the internal audit function by external parties is conducted for the first time no later than 3 (three) years after the SKAI is formed. The external party is a public accountant and/or a public accounting firm registered with the Financial Services Authority and does not audit the financial reports of the BPRS concerned in the last 3 (three) years. Example: BPRS ABC forms SKAI on December 31, 2021. The review of the internal audit function is conducted for the first time for the period from January 1, 2022 to June 30, 2024. The next review is conducted for the period from July 1, 2024 to June 30, 2027.
   3. In accordance with Article 88 paragraph (4) of the POJK on BPRS Corporate Governance, the report on the results of the review of the internal audit function must be submitted to the Financial Services Authority no later than 1 (one) month after the results of the external party's review are received by the BPRS.

   b. Scope
   The report on the results of the review of the internal audit function must at least include:

   1. opinion on the work results of the SKAI;
   2. SKAI's compliance with the BPRS internal audit function implementation guidelines; and
   3. improvements to be made.

III. CLOSING

The provisions in this Financial Services Authority Circular Letter shall take effect on the date of determination.

Determined in Jakarta on June 28, 2019

EXECUTIVE HEAD OF BANKING SUPERVISOR
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA,

signed
HERU KRISTIYANA

APPENDIX
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY NUMBER 12 /SEOJK.03/2019 CONCERNING THE IMPLEMENTATION OF THE INTERNAL AUDIT FUNCTION FOR SHARIA MICRO FINANCE BANKS

GUIDELINES
STANDARD IMPLEMENTATION OF THE INTERNAL AUDIT FUNCTION SHARIA MICRO FINANCE BANKS

TABLE OF CONTENTS
Page
CHAPTER I INTRODUCTION .......................................................................... - 2 -

1. Background ............................................................................... - 2 -
2. General Policy............................................................................ - 2 -
   CHAPTER II STANDARD GUIDELINES FOR THE IMPLEMENTATION OF THE INTERNAL AUDIT FUNCTION
   BPRS .......................................................................................... - 5 -
3. Organizational Structure, Functions, Duties, and Responsibilities.............. - 5 -
4. Scope of Internal Audit Implementation .......................................- 11 -
5. Relationship of Internal Audit with Internal Control System ...........- 12 -
6. Audit Implementation..........................................................................- 13 -
7. Documentation and Administration.......................................................- 18 -
   TERMINOLOGY ...........................................................................- 21 -

CHAPTER I
INTRODUCTION

1. Background
   BPRS is a financial institution whose business activities include collecting funds from the public based on Sharia Principles, so in its operations it must apply prudence and corporate governance principles. One important factor for BPRS in implementing corporate governance is through the implementation of effective and adequate internal audit. To ensure the effective implementation of the internal audit function in BPRS, it is necessary to formulate standard guidelines for the implementation of the BPRS internal audit function to realize a common understanding regarding the implementation of internal audit as a minimum standard that must be met by all BPRS.

2. General Policy
   The fulfillment of the interests of BPRS and depositors is part of the mission of the BPRS internal audit, considering the existence of various interests from various parties, including shareholders, Board of Directors, Board of Commissioners, Sharia Supervisory Board (DPS), employees, and customers. In this regard, internal audit must be able to place its function above the interests of these various parties to ensure the realization of a healthy BPRS, which develops normally and is able to provide optimal services to the public. The Board of Directors, Board of Commissioners, and DPS need to establish policies and activities in the supervision field to obtain adequate assurance that the interests of BPRS and the public can be maintained harmoniously, and can be implemented effectively and efficiently. Several aspects that require clarity and common understanding so that these policies and activities can be realized include the supervisory responsibilities and authority of the Board of Directors, Board of Commissioners, and DPS, the scope of internal control, and the implementation of internal audit in its relationship with the BPRS internal control system. The internal control system is a control mechanism built to protect and secure BPRS assets, reduce the impact of losses including fraud, increase organizational effectiveness, and is expected to increase cost efficiency so as to maintain the continuity of BPRS business. The internal audit function is part of the internal control system and supports the implementation of an effective internal control system.

   a. Scope of Internal Control
   The internal control system includes policies, organization, procedures, methods, and regulations that are coordinated comprehensively in BPRS work units. The internal control system aims to secure assets, ensure the accuracy and reliability of accounting data, optimize the economical and efficient use of resources, and encourage compliance with established management policies. The scope of BPRS internal control also includes aspects capable of ensuring the security of funds stored by the public and other third parties.

   b. Internal Audit as Part of the Internal Control System Internal audit is part of the internal control system and all forms of activities related to audit and reporting of audit results regarding the implementation of the control system in a coordinated manner at every level of management. Transparency and clarity are very important in the management of BPRS, so internal audit policies related to authority and level of independence need to be stated in a written document approved by the President Director and the Board of Commissioners. The adequacy of this internal audit policy needs to be evaluated periodically by the President Director and the Board of Commissioners so that the implementation of internal audit remains at an optimal level.

   c. Duties and Responsibilities of Internal Audit Function Executors
   The duties of the SKAI or PEAI are to assist the President Director, Board of Commissioners, and DPS in conducting operational supervision of BPRS, which includes audit preparation, audit program formulation, audit assignment implementation, audit result reporting, and follow-up of audit results. The SKAI or PEAI creates analysis and assessment in the fields of finance, accounting, operations, and other activities at least by direct examination and document analysis, and provides improvement suggestions and objective information about the activities examined at all levels of management. In addition, the SKAI or PEAI must be able to identify all possibilities for improving and increasing the efficiency of resource and fund usage.

   d. Independence
   The SKAI or PEAI must act independently in conducting audits and disclosing views and thoughts in accordance with their profession and the internal audit function implementation guidelines which refer to these Standard Guidelines for the Implementation of the Internal Audit Function.

   e. Authority and Position
   The SKAI or PEAI must be given authority and position in the organization so as to be able to carry out duties according to the professional work standards required by their profession.

   f. Scope of Internal Audit Implementation
   The scope of internal audit implementation must cover all aspects of BPRS activities that directly or indirectly can affect the realization of the interests of BPRS and the public. The implementation of internal audit includes examination and assessment of the adequacy and effectiveness of the internal control system and the quality of its implementation, including all aspects and elements of the BPRS organization so as to be able to help the management decision-making process.

   g. Internal Auditor Code of Ethics
   Internal auditors have a code of ethics that must be observed and implemented, which at least contains the requirement to:

   1. behave honestly, politely, impeccably, objectively, and responsibly;
   2. have high dedication;
   3. not accept and will not accept anything that can influence their professional opinion;
   4. maintain the principle of confidentiality in accordance with applicable laws and regulations; and
   5. continuously improve their professional capabilities.

CHAPTER II
STANDARD GUIDELINES FOR THE IMPLEMENTATION OF THE INTERNAL AUDIT FUNCTION OF BPRS

1. Organizational Structure, Functions, Duties, and Responsibilities
   a. Organizational Structure
   The organizational structure related to the internal audit function is in accordance with the amount of core capital as referred to in Article 67 paragraph (1), paragraph (2), paragraph (3), and paragraph (4) of the POJK on BPRS Corporate Governance, as follows:

   1. BPRS with core capital of at least IDR 50,000,000,000.00 (fifty billion rupiah) is required to form an Internal Audit Unit (SKAI) which must be supported by employees who have knowledge and/or understanding in the field of Sharia banking operations; or
   2. BPRS with core capital less than IDR 50,000,000,000.00 (fifty billion rupiah) is required to appoint 1 (one) Executive Official responsible for the internal audit function (PEAI) who must have knowledge and/or understanding in the field of Sharia banking operations.

   Figure 1. Example of Organizational Structure Related
   to the Internal Audit Function in BPRS Required to Have SKAI

   Explanation:
   *) Audit Committee only for BPRS with core capital of at least IDR 80,000,000,000.00 (eighty billion rupiah).

   [Diagram Description: Board of Commissioners and DPS at the top. Audit Committee below them (if applicable). President Director below that. Board of Directors member overseeing Compliance Function below that. SKAI at the bottom. Lines indicate communication/reporting lines to Board of Commissioners and accountability lines to President Director/Board of Directors.]

   Figure 2. Example of Organizational Structure Related
   to the Internal Audit Function in BPRS Required to Have PEAI

   Explanation:
   In formulating the organizational structure related to the internal audit function, BPRS adjusts to the type of business activities, business volume, and office network of each BPRS as well as Financial Services Authority Regulations.

   [Diagram Description: DPS and President Director at the top. Board of Commissioners below them. Board of Directors member overseeing Compliance Function below that. PEAI at the bottom. Lines indicate communication/reporting lines to Board of Commissioners and accountability lines to President Director/Board of Directors.]

   b. Position of SKAI or PEAI, President Director, Audit Committee, Board of Commissioners, and DPS

   1. In implementing the internal audit function, the SKAI or PEAI is directly responsible and submits reports to the President Director, and submits reports to the Board of Commissioners with a copy to the Board of Directors member who oversees the compliance function. The Board of Directors and Board of Commissioners must support the SKAI or PEAI so that the implementation of the internal audit function can be carried out effectively.
   2. The President Director is responsible for ensuring the implementation of the internal audit function and ensuring the implementation of follow-up on audit findings and/or recommendations from the SKAI or PEAI.
   3. The Audit Committee monitors and evaluates the implementation of tasks carried out by the internal audit function, as well as the implementation of follow-up by the Board of Directors on audit findings and/or recommendations from the SKAI or PEAI, in order to provide recommendations to the Board of Commissioners.
   4. The Board of Commissioners has the obligation to ensure that the Board of Directors has followed up on audit findings and/or recommendations from the SKAI or PEAI.
   5. The DPS receives internal audit results related to the implementation of Sharia Principle fulfillment reported by the SKAI or PEAI.

   c. Appointment and Dismissal of the Head of SKAI or PEAI
   The Head of SKAI or PEAI is appointed and dismissed by the President Director considering the opinion of the Board of Commissioners and reported to the Financial Services Authority.

   d. Independence of SKAI or PEAI
   The SKAI or PEAI must be independent from other work units or functions. The SKAI or PEAI is able to carry out duties without influence or pressure from the Board of Directors, Board of Commissioners, DPS, and external parties.
   To support independence and ensure smooth audits and authority in monitoring follow-up, the Head of SKAI or PEAI can communicate directly with the Board of Commissioners to inform various matters related to audits. This information provision is reported to the President Director with a copy to the Board of Directors member who oversees the compliance function. In the event that audit findings relate to the President Director, the Head of SKAI or PEAI submits the audit findings directly to the Board of Commissioners and informs the President Director regarding this submission. Internal auditors are considered independent if they can work freely and objectively. To obtain this independence, the position of the Head of SKAI or PEAI in the organization must be able to disclose views and thoughts without influence or pressure from shareholders, Board of Directors, Board of Commissioners, DPS, employees, or other parties related to the BPRS. In addition, the SKAI or PEAI must:

   1. receive full support from the Board of Directors, Board of Commissioners, and DPS to be able to work freely without interference from any party;

2. having the freedom to determine the methods, ways, techniques, and audit approaches to be conducted;
3. applying objectivity, namely being independent in conducting audits. This independence is reflected in reports that are complete, objective, and based on careful and impartial analysis. To maintain objectivity, among other things:
   a) periodic rotation of work assignments for internal auditors (for BPRS required to form an Internal Audit Unit/SKAI); and b) careful review of audit results reports and the process; and
4. free from conflicts of interest regarding the objects or activities being examined. Assignments of internal auditors by the Head of SKAI or the appointment of an External Internal Audit Consultant (PEAI) must avoid conflicts of interest.

e. Authority, Duties, and Responsibilities of SKAI or PEAI SKAI or PEAI has duties and responsibilities as referred to in Article 68 of the POJK on BPRS Corporate Governance, namely at least:

1. assisting the duties of the Director and Board of Commissioners in conducting operational supervision of BPRS, which covers planning, implementation, and monitoring of audit results;
2. creating analysis and assessments in the fields of finance, accounting, operations, and other activities, at least by means of direct examination and document analysis;
3. identifying all possibilities for improving and increasing the efficiency of resource usage and fund usage; and
4. providing improvement suggestions and objective information about the activities examined at all levels of management.

The authority, duties, and responsibilities of SKAI or PEAI must be formulated in a written document approved by the Director and Board of Commissioners and must at least include:

1. the position of SKAI or PEAI;
2. the authority to access records, employees, resources, funds, and other assets of BPRS related to the implementation of audits;
3. the scope of internal audit implementation; and
4. a statement that internal auditors must not have the authority or responsibility to perform the functions of the auditee.

The Head of SKAI or PEAI is responsible for planning, implementing, organizing, and directing audits and evaluating existing procedures to obtain assurance that the objectives and goals of BPRS can be achieved optimally. SKAI or PEAI must periodically account for activities to the Director.

SKAI or PEAI may provide consultation to internal parties of BPRS in need, particularly concerning the scope of their duties. SKAI or PEAI can, among other things, respond to proposals for policies, systems, and/or procedures to ensure that internal control aspects have been incorporated into the proposed policies, systems, and/or procedures, so that implementation can achieve objectives effectively and efficiently. The involvement of SKAI or PEAI in responding to proposals for policies, systems, and/or procedures does not mean that these matters will be excluded as audit objects.

f. Audit Planning
Internal audit activities for a 1 (one) financial year period must be based on thorough planning. SKAI or PEAI is responsible for creating the plan to implement the internal audit function. This plan must be consistent with the authority and responsibilities of SKAI or PEAI, the objectives of BPRS, and must be approved by the Director and reported to the Board of Commissioners and the Audit Committee (if the BPRS has an Audit Committee). The audit planning process consists of:

1. Determination of audit objectives
   Objectives must be measurable and consistent with the BPRS plan and budget.
2. Determination of audit work schedule
   The audit work schedule must cover activities to be audited as well as start dates and time required, considering the audit scope and audit results previously conducted by internal auditors. Matters to be considered in creating the audit work schedule must at least include:
   a) findings from previous audit periods; and b) risk evaluation, which must include risks according to the types of risks that must be applied by BPRS as regulated in the Financial Services Authority Regulation regarding the implementation of risk management for BPRS. The purpose of risk evaluation is to identify material or significant activities of the audited work unit.
3. Human resources and budget plan
   In planning human resources and budgets, attention must be paid to, among other things, the number of internal auditors required for task implementation if the BPRS has an SKAI, the required qualifications, and training needed for development efforts other than administrative activities that must be performed.

g. Policies and Procedures of the Internal Audit Function SKAI or PEAI must formulate written policies and procedures as guidelines for internal auditors in performing their duties. The form and content of these policies and procedures must be adjusted to the organizational structure and complexity of BPRS business activities.

h. Development and Professional Education Program for the Internal Audit Function BPRS must have a recruitment and human resource development program that at least contains:

1. clear descriptions of duties and responsibilities for each internal auditor;
2. criteria for requirements to become an internal auditor;
3. a plan for continuing professional education and training; and
4. methods for evaluating internal auditor performance.

i. Review of the Internal Audit Function
To assess the implementation of the internal audit function in BPRS with core capital of at least IDR 50,000,000,000.00 (fifty billion rupiah), a review by external parties must be conducted at least 1 (one) time in 3 (three) years. External parties are public accountants and/or public accounting firms registered with the Financial Services Authority and do not audit the financial statements of the relevant BPRS in the last 3 (three) years. The report on this review must contain an opinion on the work results of SKAI and its compliance with the guidelines for implementing the internal audit function of BPRS, as well as improvements to be made.

j. Relationship of the Internal Audit Function with Public Accountants and Public Accounting Firms For BPRS whose financial statements are audited by public accountants and/or public accounting firms as regulated in statutory regulations regarding the transparency of BPRS financial conditions, SKAI or PEAI is responsible for coordinating its activities with the activities of public accountants and/or public accounting firms. Thus, it is hoped that comprehensive and optimal internal audit results can be achieved. Coordination can be carried out through regular meetings to discuss matters considered important for both parties.

2. Scope of Internal Audit Implementation
   The scope of internal audit implementation must cover examination and assessment of the adequacy and effectiveness of the internal control system of the relevant BPRS and the quality of performance in implementing established responsibilities. The scope of internal audit implementation is approved by the Director and Board of Commissioners.

a. Assessment of Internal Control System Adequacy Examination and assessment of the adequacy of the internal control system is intended to determine the level of reliability of the internal control system established to provide reasonable assurance that the objectives and goals of BPRS can be achieved efficiently and economically.

b. Assessment of Internal Control System Effectiveness Examination and assessment of the effectiveness of the internal control system is intended to determine whether the internal control system has functioned as expected.

c. Assessment of Performance Quality
Examination and assessment of performance quality is intended to determine whether the objectives and goals of the organization have been achieved.

3. Relationship of Internal Audit with Internal Control System
   Internal audit is part of the internal control system. Internal control is any action taken by management to ensure the achievement of established objectives and goals. The main objectives of internal control are to ensure:
   a. security of public funds; b. achievement of operational activity objectives and goals that have been established;
   c. economical and efficient use of resources;
   d. truthfulness and integrity of information; e. compliance with policies, plans, procedures, and statutory regulations; and f. asset security.

Internal auditors conduct examination and assessment of the effectiveness of the internal control system intended to provide assurance to internal auditors that controls are running as established, as follows:
a. Security of Public Funds
Internal auditors must assess the reliability of the internal control system established to secure funds collected from the public by BPRS, including deposits and savings. b. Achievement of Established Operational Activity Objectives and Goals Internal auditors must assess whether operational activity objectives and goals have been achieved consistently, among other things by assessing the fairness of the development of BPRS business, both potential and constraints affecting it.
c. Resource Utilization
Internal auditors must assess the efficiency of resource utilization. For this purpose, among other things, an assessment of the efficiency, effectiveness, and security of certain operational activities is required, such as activities utilizing information technology. In addition, internal auditors must assess the optimal utilization of resources and facilities that are underutilized or work that is considered less productive. d. Truthfulness and Integrity of Information Internal auditors must assess the truthfulness and integrity of financial and operational information, including the recording of assets, liabilities, and administrative accounts of BPRS. The purpose of assessing this information is to ensure that the information is complete, accurate, current, intact, comparable, and useful for the interests of BPRS, the public, and the Financial Services Authority. e. Compliance with Policies, Plans, Procedures, and Statutory Regulations Internal auditors must assess the suitability of the established system against policies, plans, procedures, and statutory regulations that have the potential to have a significant impact on BPRS operations, including assessment of BPRS business activity aspects that can affect the health level or cause problems. f. Asset Security Internal auditors must assess the reliability of the asset security system, including funds, and examine the existence of assets including such funds.

4. Audit Implementation
   The audit implementation approach is influenced by the size of the organization, characteristics, business volume, and complexity of BPRS business activities. Therefore, each audit implementation must consider the conditions of each BPRS. Audit implementation consists of 5 (five) stages of activities, namely the audit preparation stage, audit program formulation, audit assignment implementation, audit result reporting, and audit result follow-up.

a. Audit Preparation
Audit implementation must be well prepared so that audit objectives are achieved efficiently. Steps to be considered in the audit preparation stage include approach methods, assignment determination, audit notification, and preliminary research.

1. Internal Auditor Approach Method
   Internal auditors must be able to use the necessary approach methods for internal audit implementation so that audits can be conducted effectively and efficiently. These approach methods may differ between internal auditors and among BPRS, but internal auditors need to pay attention to technical aspects at least, namely sampling methods and determination, testing techniques to be conducted, audit evidence required, methods of obtaining audit evidence, and the concept of materiality.
2. Assignment Determination
   Audit assignment determination is intended to inform the auditee as a basis for conducting audits as established in the BPRS annual audit plan. Assignment determination in the form of an assignment letter signed by the Director, among other things, establishes the audit team leader and members in case the audit is conducted by SKAI, or establishes the PEAI assignment in case the audit is conducted by PEAI, audit objectives, and time required.
3. Audit Notification
   Internal audit implementation must be accompanied by an audit notification letter from SKAI or PEAI delivered to the auditee before or at the time the audit is conducted. The notification letter consists of, among other things:
   a) a plan for an initial meeting with the auditee, intended to explain audit objectives and obtain explanations from the auditee regarding the activities and functions of the auditee; b) PEAI or the team leader and audit members (in case the audit is conducted by SKAI), including external audit personnel seconded to implement internal audits; c) data, information, and documents required; and d) a request to the auditee to prepare the required data, information, and documents.
4. Preliminary Research
   Preliminary research is intended to recognize and understand each activity or function of the auditee generally so that the audit can be focused on strategic matters, allowing internal auditors to formulate audit objectives more clearly. In this stage, internal auditors must be well acquainted with aspects of the auditee, among other things, functions, organizational structure, authority and responsibilities, policies, systems and operational procedures, activity risks and controls, success indicators, and statutory regulations.

b. Formulation of Audit Program
The audit program is documentation of procedures for internal auditors in collecting, analyzing, interpreting, and documenting information during audit implementation, including notes for future examinations. The audit program must at least cover:

1. procedures for collecting, analyzing, interpreting, and documenting information during audit implementation;
2. audit objectives;
3. scope, level, and methodology of examination;
4. examination duration; and
5. identification of technical aspects, risks, processes, and transactions to be tested, including electronic data processing.

The audit program can be changed as needed during the audit.

c. Implementation of Audit Assignment
The audit implementation stage covers activities to collect, analyze, interpret, and document audit evidence and other information needed according to procedures established in the audit program to support audit results.

1. Audit Process
   The audit process covers the following activities:
   a) collecting sufficient and relevant evidence and information; b) examining, evaluating, and confirming all evidence and information to ensure compliance with systems and procedures; c) establishing sampling methods and techniques used according to conditions; d) documenting audit working papers; and e) discussing audit results with the auditee.
2. Audit Evidence
   Audit evidence is all data and information used by auditors to support their audit findings. Internal auditors must obtain sufficient and relevant evidence to support the formulation of conclusions and recommendations. In this regard, internal auditors must use professional judgment to determine the quantity and type of audit evidence needed after carefully studying the conditions faced. This evidence can be obtained through physical or document examination, confirmation, observation, inquiry, calculation, and analytical testing.
3. Evaluation of Audit Results
   Evaluation of audit results is the responsibility of each internal auditor. In evaluating these audit results, the audit team or PEAI must formulate conclusions at each level of the audit program, evaluate audit results against audit objectives, and prepare a summary of findings and audit result recommendations. a) Conclusions from Audit Program Implementation If the audit program and procedures have been completed, internal auditors must formulate conclusions on audit results according to the objectives or goals of the audit program and procedures. b) Evaluation of Audit Results against Audit Objectives If internal auditors find deviations during testing, these deviations must be evaluated based on cause-and-effect analysis. c) Summary of Findings and Audit Result Recommendations Internal auditors must create a summary of findings and audit result recommendations. In case weaknesses or deviations are found, the summary of findings must at least disclose:
   (1) the facts or actual conditions that occurred; (2) the conditions that should have occurred; (3) the causes of the deviations; (4) the impact of the deviations; and (5) improvement steps already taken by the auditee.

d. Reporting Audit Results
Significant fraud or misconduct audit findings must be reported immediately by the team leader to the Head of SKAI or by the PEAI without waiting for the audit to be completed.
Internal auditors are obligated to formulate audit results in the form of written reports. These reports must meet reporting standards, contain complete material, and go through a good formulation process.
Audit results reports must at least meet the following standards:

1. The report must be written and contain audit results according to the scope of the assignment. In addition, the report must function as a formal document reflecting the responsibilities of internal auditors and auditees for activities conducted.
2. The report must be described briefly and easily understood, containing several main points or those considered important and matters that need improvement by the auditee.
3. The report must be supported by adequate working papers to be accountable.
4. The report must be objective, based on facts, and impartial to specific interests.
5. The report must be constructive and able to provide improvement suggestions or directions for the auditee to make improvements.
6. The report must be signed by the relevant internal auditor as a form of responsibility for the truthfulness of the report content.
7. The report must be made and delivered on time.
8. The report must be formulated systematically, among other things containing audit objects, audit period, audit findings, conclusions, recommendations, and auditee responses.

The report formulation process must be carried out carefully so that it can be presented accurately and usefully for the auditee. This process involves compilation and analysis of audit findings. Audit findings to be formulated in the report must be compiled and analyzed for their significance level.

According to Article 69 paragraph (2) of the POJK on BPRS Corporate Governance, in implementing the internal audit function, SKAI or PEAI submits reports to the Director and Board of Commissioners with copies to Directors in charge of the compliance function. These reports must at least be able to describe the comparison between achieved audit results and previously established objectives, cost and budget realization, causes of deviations, and actions taken and needed to be taken for improvement.

e. Follow-up of Audit Results
SKAI or PEAI must monitor, analyze, and report on the development of follow-up improvements already taken by the auditee. This follow-up includes:

1. Monitoring of Follow-up Implementation
   Monitoring of follow-up implementation must be conducted to know the development of follow-up implementation of audit results. If the auditee has not implemented improvement commitments until the specified deadline, SKAI or PEAI reminds the auditee based on this monitoring.
2. Analysis of Follow-up Adequacy
   From the results of monitoring follow-up implementation, an analysis of adequacy regarding the fulfillment of commitments already implemented by the auditee is conducted. Furthermore, follow-up monitoring needs to be conducted again in case there are difficulties or obstacles causing the follow-up to not be performed according to commitments.
3. Follow-up Report
   If follow-up implementation is not carried out by the auditee, SKAI or PEAI provides a written report and proposal for further actions to be approved by the Director and reported to the Board of Commissioners.

5. Documentation and Administration
   To support audit results, SKAI or PEAI must document and administer documentary evidence starting from the audit preparation stage, audit program formulation, audit assignment implementation, audit result reporting, and audit result follow-up.
   Products documented and administered include audit results reports, including audit working papers and correspondence documents.

a. Audit Working Paper Documentation
SKAI or PEAI must document audit working papers completely and clearly. Audit working papers can be in paper or electronic data storage media. All working papers are compiled considering their function, formulation, and storage.

1. Function of Audit Working Papers
   The function of audit working papers is as the main support for audit results reports and a means to help the audit preparation process, audit program formulation, audit assignment implementation, audit result reporting, and audit result follow-up. Other functions of audit working papers are to obtain an overview of the comparison of achievement with audit plan objectives, help interested parties in examining audit results, and assess the ability or quality of SKAI or PEAI in performing duties.
2. Formulation of Audit Working Paper Documentation
   a) Audit working paper documentation must be neat to facilitate its use. Audit working papers must be complete, clear, and easy to understand to facilitate those needing this information. b) Audit working paper documentation must be formulated systematically based on the chronology of events using an archive index.
3. Archiving of Audit Working Papers
   Audit working papers are archives belonging to BPRS, so statutory regulations regarding archiving must be observed. Matters to be considered in implementing the storage of audit working paper archives include:

---

a) Use of Audit Working Papers
The taking, borrowing, and making of copies of audit working papers by parties other than the Internal Audit Unit (SKAI) or External Audit Unit (PEAI), such as other units within the Sharia People's Financing Bank (BPRS), public accountants, or public accounting firms, must be with the approval of the head of the SKAI or PEAI and must observe the provisions of laws and regulations regarding bank secrecy.

b) Supervision of Audit Working Papers
Audit working papers must be under the supervision of the SKAI or PEAI and may only be accessed by authorized parties.

c) Storage of Audit Working Papers
The storage of audit working papers must be separated into dynamic archives, active archives, and inactive archives. The SKAI or PEAI must establish provisions regarding archive storage procedures adjusted to laws and regulations regarding archives, including the determination of retention schedules.

b. Administration of Audit Results
The final work output of the SKAI or PEAI is a written audit report that must be supported by audit working paper documentation. The presentation and correctness of the audit report are examined by the head of the SKAI or PEAI. Subsequently, the audit report, including audit working paper files and correspondence documents, must be archived as confidential documents.

1. Audit Communication Administration
   All correspondence documents and reports related to audits, which constitute communication with the auditee and other parties, must be administered properly.

2. Administration of Audit Execution Completeness
   After the audit is completed, the SKAI or PEAI must re-examine the administrative completeness of all audit working paper files, both during the audit preparation stage, audit program preparation, audit assignment execution, audit result reporting, and audit result follow-up.

TERMINOLOGY
Public Accountant
A person who has obtained a license to provide services as referred to in the Law regarding public accountants.
Active Archive
An active archive is an archive that has a high frequency of use and/or is used continuously.
Dynamic Archive
A dynamic archive is an archive that is used directly in the activities of the archive creator and is stored for a certain period.
Inactive Archive
An inactive archive is an archive whose frequency of use has decreased.
Auditee
The auditee is a unit or employee responsible for the activities being audited.
Internal Auditor
An internal auditor is an employee within the SKAI or PEAI who is independent from other units or functions within the BPRS.
External Auditor
An external auditor is an auditor assisted to perform internal audit functions, including officials from other BPRSs and/or rural credit banks within one (1) group and/or parties designated by the controlling shareholders of the BPRS.
Public Accounting Firm
A business entity established based on laws and regulations and obtaining a business license as referred to in the Law regarding public accountants.

This copy corresponds to the original
Legal Director 1
Legal Department signed
Yuliana
Established in Jakarta on 28 June 2019
EXECUTIVE HEAD OF BANKING SUPERVISOR
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA, signed
HERU KRISTIYANA