SEOJK on Standards for the Implementation of Internal Audit Functions of Rural Banks

To:
Board of Directors of Rural Banks

COPY
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY NUMBER 7/SEOJK.03/2016 CONCERNING STANDARDS FOR THE IMPLEMENTATION OF INTERNAL AUDIT FUNCTIONS OF RURAL BANKS

In relation to the Financial Services Authority Regulation Number 4/POJK.03/2015 concerning the Implementation of Corporate Governance for Rural Banks (State Gazette of the Republic of Indonesia Year 2015 Number 72, Supplement to the State Gazette of the Republic of Indonesia Number 5685), hereinafter referred to as POJK on BPR Corporate Governance, it is necessary to regulate the implementation of POJK on BPR Corporate Governance in this Circular Letter of the Financial Services Authority as follows:

I. GENERAL PROVISIONS

1. These implementation provisions include, among others, organizational structure, guidelines for the standard implementation of internal audit functions, and reports related to the implementation of internal audit functions.

2. The standard implementation guidelines for internal audit functions for Rural Banks (BPR) are prepared as a minimum standard reference that must be met by BPRs in formulating their own standard implementation guidelines for internal audit functions in order to fulfill one of the factors for implementing Corporate Governance. BPRs may formulate and develop standard implementation guidelines for internal audit functions according to the needs and complexity of their operational business, while still referring to the standard implementation guidelines for internal audit functions in the Appendix, which is an inseparable part of this Circular Letter.

II. ORGANIZATIONAL STRUCTURE

1. In accordance with Article 59 of POJK on BPR Corporate Governance, BPRs with core capital of at least IDR 50,000,000,000.00 (fifty billion rupiah) are required to establish an Internal Audit Unit (SKAI). Meanwhile, BPRs with core capital of less than IDR 50,000,000,000.00 (fifty billion rupiah) are required to appoint 1 (one) Executive Officer responsible for the implementation of internal audit functions, hereinafter referred to as PE Audit Intern.

2. The imposition of sanctions for fulfilling the internal audit organizational structure as referred to in item 1 shall take effect starting from April 1, 2017.

3. The Head of SKAI or PE Audit Intern is appointed and dismissed by the President Director, taking into account the opinion of the Board of Commissioners.

4. Officials from other BPRs within 1 (one) group and/or parties designated by the controlling shareholders of the BPR may provide auditor personnel assistance to carry out internal audits acting on behalf of the SKAI or PE Audit Intern at the relevant BPR; however, responsibility for the implementation and results of the internal audit remains attached to the aforementioned SKAI or PE Audit Intern. Auditor personnel provided to carry out internal audits must comply with the standard implementation guidelines for internal audit functions at each respective BPR and applicable laws and regulations, including bank confidentiality. The aforementioned auditor personnel may be reimbursed for accommodation, transportation, and per diem expenses according to reasonable internal BPR regulations without resulting in double financing from the group or the BPR.

III. REPORTS ON THE IMPLEMENTATION OF INTERNAL AUDIT FUNCTIONS

In accordance with Article 73 paragraph (1) of POJK on BPR Corporate Governance, reports related to the implementation of internal audit functions that BPRs are required to submit to the Financial Services Authority include reports on the appointment or dismissal of the Head of SKAI or PE Audit Intern, reports on the implementation and key points of internal audit results, and special reports. Furthermore, for BPRs with core capital of at least IDR 50,000,000,000.00 (fifty billion rupiah), reports on the results of reviews must be submitted to the Financial Services Authority. The aforementioned reports are submitted by BPRs to the Financial Services Authority addressed to the Regional Office or the local Financial Services Authority Office.

1. Reports on the Appointment or Dismissal of the Head of SKAI or PE Audit Intern

a. General Guidelines

1. BPRs submit reports on the appointment or dismissal of the Head of SKAI or PE Audit Intern to the Financial Services Authority no later than 10 (ten) working days after the date of appointment or dismissal of the Head of SKAI or PE Audit Intern.

2. The report is signed by the President Director and the Chief Commissioner.

b. Scope

1. The content of the report on the appointment of the Head of SKAI or PE Audit Intern must at least include:
   a) reasons for the appointment of the Head of SKAI or PE Audit Intern; b) identity data and curriculum vitae of the Head of SKAI or PE Audit Intern, including a recent 4x6cm passport-sized photo, a photocopy of a valid Identity Card (KTP), a sample of the signature and stamp; c) a photocopy of the President Director's Decision regarding the appointment of the Head of SKAI or PE Audit Intern; d) an attachment of the Board of Commissioners' opinion on the appointment of the Head of SKAI or PE Audit Intern; and e) an employment agreement (if any).

2. The content of the report on the dismissal of the Head of SKAI or PE Audit Intern must at least include:
   a) reasons for the dismissal of the Head of SKAI or PE Audit Intern; b) a photocopy of the President Director's Decision regarding the dismissal of the Head of SKAI or PE Audit Intern; and c) an attachment of the Board of Commissioners' opinion on the dismissal of the Head of SKAI or PE Audit Intern.

2. Reports on the Implementation and Key Points of Internal Audit Results

a. General Guidelines

1. Reports on the implementation and key points of internal audit results must at least meet the standards of being written, briefly and easily understood, objective, constructive, and systematic.

2. The report is prepared by the SKAI or PE Audit Intern and submitted to the President Director and the Board of Commissioners, with a copy to the Board of Directors member who oversees the compliance function.

3. Based on the report as referred to in item 2), the BPR submits reports on the implementation and key points of internal audit results, including confidential audit result information, to the Financial Services Authority.

4. The report as referred to in item 3) is signed by the President Director and the Chief Commissioner and submitted to the Financial Services Authority no later than January 31 of the following year.

5. Considering that sanctions for violations of the completeness of organizational structure obligations as referred to in Article 13 paragraph (1) of POJK on BPR Corporate Governance take effect starting from April 1, 2017, the Reports on the Implementation and Key Points of Internal Audit Results as referred to in item 1) are submitted for the first time for the period ending December 31, 2017.

b. Scope

1. Reports on the implementation and key points of internal audit results contain at least the following material:
   a) scope and timing of the audit; b) audit findings, namely the clear disclosure of facts occurring, the expected situation, and the impact and causes of deviations; c) conclusions of the SKAI or PE Audit Intern regarding audit results stating compliance or deviations occurring at the BPR based on audit results; d) auditor's statement that the audit was conducted in accordance with the standard implementation guidelines for internal audit functions of the BPR; e) recommendations regarding improvement steps proposed by the SKAI or PE Audit Intern regarding audit findings; f) auditee's response, which may be approval or rejection of the audit results along with reasons; g) follow-up actions by the auditee determined by the SKAI or PE Audit Intern regarding audit findings at the auditee; h) commitments by the auditee agreed upon by the SKAI or PE Audit Intern with the auditee to be implemented in order to improve the condition of the BPR; and i) results of monitoring the auditee's commitments conducted by the SKAI or PE Audit Intern regarding the realization of commitments promised by the auditee.

2. In the event that internal audits are conducted once within 1 (one) year, the reports on the implementation and key points of internal audit results submitted to the Financial Services Authority may consist of the audit results reports of the SKAI or PE Audit Intern submitted to the President Director, provided that the material requirements as referred to in item 1) are met.

3. In the event that internal audits are conducted more than once within 1 (one) year, the reports on the implementation and key points of internal audit results submitted to the Financial Services Authority consist of a summary of the key points of all internal audit results conducted within 1 (one) year and cover all material as referred to in item 1).

3. Special Reports

a. General Guidelines

1. Special reports are prepared in the event that there are internal audit findings estimated to disrupt the continuity of the BPR's business.

2. Internal audit findings estimated to disrupt the continuity of the BPR's business as referred to in item 1) are internal audit findings that meet conditions including:
   a) lowering the capital adequacy ratio; b) indications of criminal acts; and/or c) causing the BPR to be placed under special supervision.

3. The report is prepared by the SKAI or PE Audit Intern and signed by the President Director and the Chief Commissioner, and submitted to the Financial Services Authority no later than 10 (ten) working days after the discovery of the findings as referred to in item 2) by the SKAI or PE Audit Intern.

4. In the event that the President Director is temporarily unable to act, the report may be signed by the Board of Commissioners, accompanied by evidence of the temporary inability of the President Director.

5. The report is copied to the Director who oversees the compliance function.

b. Scope

Special reports must at least include:

1. internal audit findings estimated to cause the BPR to experience difficulties that disrupt its business continuity;
2. supporting evidence of the audit findings as referred to in item 1); and
3. follow-up actions on the audit findings.

4. Reports on the Results of Reviews of Internal Audit Function Implementation

a. General Guidelines

1. In accordance with Article 73 paragraph (2) of POJK on BPR Corporate Governance, BPRs with core capital of at least IDR 50,000,000,000.00 (fifty billion rupiah) are required to submit reports on the results of reviews by external parties.

2. The external parties as referred to in letter a) are public accountants and/or public accounting firms registered with the Financial Services Authority and do not audit the financial statements of the relevant BPR in the last 3 (three) years.

3. Reviews are conducted at least once every 3 (three) years.

4. Reports on the results of reviews are submitted to the Financial Services Authority no later than 1 (one) month after the results of the external party's review are received by the BPR.

5. Reports on the results of reviews of the implementation of internal audit functions as referred to in item 1) are submitted for the first time no later than April 1, 2020.

b. Scope

Reports on the results of reviews must at least include:

1. opinions on the work results of the SKAI or PE Audit Intern;
2. compliance of the SKAI or PE Audit Intern with the standard implementation guidelines for internal audit functions of the BPR;
3. assessments of the internal control system; and
4. improvement suggestions that may be made.

IV. CLOSING

Provisions in this Circular Letter of the Financial Services Authority shall take effect starting from the date of determination.

Determined in Jakarta
On the date of March 10, 2016
EXECUTIVE HEAD OF BANKING SUPERVISOR
FINANCIAL SERVICES AUTHORITY, signed
NELSON TAMPUBOLON

Copy matches the original
Legal Director 1
Legal Department signed
Yuliana

APPENDIX
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY NUMBER 7/SEOJK.03/2016 CONCERNING STANDARDS FOR THE IMPLEMENTATION OF INTERNAL AUDIT FUNCTIONS OF RURAL BANKS

GUIDELINES FOR THE STANDARD IMPLEMENTATION OF INTERNAL AUDIT FUNCTIONS OF RURAL BANKS

TABLE OF CONTENTS
TABLE OF CONTENTS Page
CHAPTER I : INTRODUCTION

1. Background 2
2. General Policy 2
   CHAPTER II : GUIDELINES FOR THE STANDARD IMPLEMENTATION OF INTERNAL AUDIT FUNCTIONS OF BPR
3. Organizational Structure, Functions, Duties, and Responsibilities 6
4. Scope of Internal Audit Work 12
5. Relationship of Internal Audit with the Internal Control System 13
6. Audit Implementation 15
7. Documentation and Administration 20

CHAPTER I
INTRODUCTION

1. BACKGROUND
   Rural Banks (BPR) are financial institutions whose business involves collecting funds from the public, so in their operations they must apply prudent principles and corporate governance. One important factor for BPRs in implementing corporate governance is through effective and adequate internal audit implementation. In order to ensure the effective implementation of internal audit functions at BPRs, it is necessary to formulate Guidelines for the Standard Implementation of Internal Audit Functions of BPRs to realize a common understanding regarding internal audit work as a minimum standard that must be met by all BPRs in Indonesia.

2. GENERAL POLICY
   The fulfillment of the interests of BPRs and depositors is part of the mission of BPR internal audit, considering that there are various interests from various parties, including owners, management, employees, and customers. In this regard, internal audit must be able to place its function above the interests of these various parties to ensure the realization of a healthy BPR, developing reasonably, and able to provide optimal services to the community. The Board of Directors and Board of Commissioners need to establish policies and activities in the supervision field in order to obtain adequate assurance that the interests of the BPR and the community can be maintained harmoniously, and can be implemented effectively and efficiently.

Several aspects requiring clarity and common understanding so that these policies and activities can be realized include the responsibilities and authority for supervision from the Board of Directors and Board of Commissioners, the scope of internal control, and internal audit work in relation to the BPR's internal control system. The internal control system is a control mechanism built to protect and secure the BPR's assets, reduce the impact of losses including fraud, increase organizational effectiveness, and is expected to increase cost efficiency. The internal audit function is part of the internal control system and supports the implementation of an effective internal control system.

a. Scope of Internal Control
The internal control system includes policies, organizations, procedures, methods, and regulations coordinated comprehensively within BPR work units. The internal control system aims to secure assets, ensure the accuracy and reliability of accounting data, optimize the economic and efficient use of resources, and encourage compliance with management policies that have been established. The scope of BPR internal control also includes aspects that can ensure the safety of funds deposited by the public and other third parties.

b. Internal Audit as Part of the Internal Control System Internal audit is part of the internal control system and refers to all forms of activities related to audits and reporting audit results regarding the coordinated operation of the control system at every level of management. Transparency and clarity are very important in BPR management, so internal audit policies related to authority and the level of independence need to be stated in a written document from the BPR's President Director with the approval of the Board of Commissioners. Periodically, the adequacy of this internal audit policy needs to be evaluated by the President Director and Board of Commissioners so that internal audit implementation remains at an optimal level.

c. Duties and Responsibilities of Internal Audit Function Executors
The duties of the SKAI or PE Audit Intern are to assist the President Director and Board of Commissioners in conducting BPR operational supervision, which includes planning, implementation, and monitoring of audit results. In carrying this out, the SKAI or PE Audit Intern creates analyses and assessments in the fields of finance, accounting, operations, and other activities at least through direct examination and document analysis, and provides objective improvement suggestions and information about the activities examined at all levels of management. Furthermore, the SKAI or PE Audit Intern must be able to identify all possibilities for improving and increasing the efficiency of resource and fund usage.

d. Independence
The SKAI or PE Audit Intern must act independently in conducting audits and expressing views and thoughts according to their profession and audit standards as per the standard implementation guidelines for internal audit functions.

e. Authority and Position
The SKAI or PE Audit Intern must be given authority and position within the organization so that they are able to carry out their duties according to the standard of work required by their profession.

f. Scope of Internal Audit Work
The scope of internal audit work must cover all aspects of BPR activities that directly or indirectly are estimated to affect the level of good implementation of the interests of the BPR and the community. In this regard, in addition to examining and assessing the adequacy and effectiveness of the internal control system and the quality of its implementation, it also covers all aspects and elements of the BPR organization so as to be able to support optimal analysis in helping the management decision-making process.

g. Internal Auditor Ethics
Internal Auditors must have a Professional Code of Ethics, which among other things refers to the Code of Ethics from The Institute of Internal Auditors. The code of ethics must at least contain the requirements to:

1. behave honestly, politely, impeccably, objectively, and responsibly;
2. have high dedication;
3. not accept and will not accept anything that can influence their professional opinion;
4. maintain confidentiality principles according to laws and regulations; and
5. continuously improve their professional capabilities.

h. Internal Auditor Mental Attitude
Internal Auditors must have a good mental attitude reflected in their honesty, objectivity, diligence, and loyalty to the profession.

CHAPTER II
GUIDELINES FOR THE STANDARD IMPLEMENTATION OF INTERNAL AUDIT FUNCTIONS OF BPR

1. ORGANIZATIONAL STRUCTURE, FUNCTIONS, DUTIES, AND RESPONSIBILITIES
   The internal audit function is a tool to help ensure that BPRs can manage and secure funds collected from the public so that they can optimize their ability to serve the community while increasing the welfare of employees, the Board of Directors, the Board of Commissioners, and shareholders. Therefore, BPR management must be responsible for directing the internal audit function to run effectively to guarantee the security of BPR assets by granting authority to the SKAI or PE Audit Intern. In relation to this authority, the SKAI or PE Audit Intern must have the knowledge and ability to conduct audits in the field of BPR operations and always work according to the applicable internal audit implementation guidelines and professional code of ethics.

a. Organizational Structure
The organizational structure of the internal audit function in the implementation of the internal audit function according to the amount of core capital as referred to in Article 59 of POJK on BPR Corporate Governance, as follows:

1. BPRs with core capital of at least IDR 50,000,000,000.00 (fifty billion rupiah) are required to establish an Internal Audit Unit (SKAI); or
2. BPRs with core capital of less than IDR 50,000,000,000.00 (fifty billion rupiah) are required to appoint 1 (one) PE Audit Intern.

Example of BPR organizational structure required to have SKAI *) only for BPRs with core capital of at least IDR 80,000,000,000.00 (eighty billion rupiah)

Example of BPR organizational structure required to have PE Audit Intern Board of Commissioners Audit Committee *) President Director Directors Director who oversees the compliance function SKAI Communication line or information submission

Structure...
Board of Commissioners
President Director
Directors
PE Audit Intern
Communication line or information submission

The organizational structure must regulate that the SKAI or PE Audit Intern is responsible to the President Director in implementing the internal audit function. Due to the type of business activities, business volume, and office network of BPRs differing among each BPR, determining the organizational structure of the SKAI or PE Audit Intern needs to be adjusted to the conditions faced by each respective BPR, while still referring to the regulations of the Financial Services Authority.

b. Position of SKAI or PE Audit Intern, President Director, and Board of Commissioners The SKAI or PE Audit Intern is directly responsible to the President Director. The Board of Directors and Board of Commissioners must support the SKAI or PE Audit Intern so that internal audit tasks can be carried out effectively. The President Director is responsible for ensuring the implementation of the internal audit function and ensuring follow-up on the SKAI or PE Audit Intern's examination findings. The Board of Commissioners has the authority to request the Board of Directors to follow up on the SKAI or PE Audit Intern's examination findings. In carrying out their duties, the SKAI or PE Audit Intern is required to submit reports to the President Director and the Board of Commissioners, with a copy to the Board of Directors member who oversees the compliance function.

c. Appointment and Dismissal
The Head of SKAI or PE Audit Intern is appointed and dismissed by the Board of Directors, taking into account the opinion of the Board of Commissioners, and reported to the Financial Services Authority.

d. Independence
The SKAI or PE Audit Intern must be independent of operational functions, namely functions related to granting credit, collecting funds, and other operational activities. The SKAI or PE Audit Intern is able to carry out their duties without influence or pressure from BPR management and external parties. To support independence and ensure smooth audits as well as authority to monitor follow-up, the Head of SKAI or PE Audit Intern can communicate directly with the Board of Commissioners to inform various matters related to audits. This information is reported to the President Director, with a copy to the Director who oversees the Compliance Function. Internal Auditors are considered independent if they can work freely and objectively. To obtain this independence, the position of the Head of SKAI or PE Audit Intern within the organization must be established in such a way that they are able to express their views and thoughts without influence or pressure from the Board of Directors, Board of Commissioners, shareholders, employees, or other parties related to the BPR. Furthermore, the SKAI or PE Audit Intern must:

1. receive full support from BPR management to work freely without interference from any party;
2. have freedom in determining the methods, ways, techniques, and approaches of audits to be conducted;
3. apply objectivity, namely a mental attitude of independence in conducting audits. This mental attitude is reflected in complete, objective reports based on careful and unbiased analysis. To maintain objectivity, it is necessary among other things:
   a) periodic rotation of work assignments for Internal Auditors (if the BPR is required to form an SKAI); b) careful review of audit results reports and processes;
4. be free from conflicts of interest regarding the objects or activities examined. Assignments of Internal Auditors by the Head of SKAI or the appointment of PE Audit Intern must be done in such a way as to avoid conflicts of interest.

e. Authority, Duties, and Responsibilities
The SKAI or PE Audit Intern has duties and responsibilities as referred to in Article 60 of POJK on BPR Corporate Governance, namely:

1. assisting the President Director and Board of Commissioners in conducting BPR operational supervision, which includes planning, implementation, and monitoring of audit results;

2. creating...

3. conducting analysis and assessment in the fields of finance, accounting, operations, and other activities, at minimum through direct examination and document analysis;

4. identifying all possibilities for improving and increasing the efficiency of resource and fund utilization; and

5. providing improvement suggestions and objective information regarding audited activities at all levels of management.
   The authority, duties, and responsibilities of the Internal Audit Unit (SKAI) or External Internal Audit Personnel (PE Audit Intern) must be formulated in a written document that must be approved by the Board of Commissioners and must at least include:

6. the position of the SKAI or PE Audit Intern;

7. the authority to access records, employees, resources, funds, and other assets of the BPR related to the implementation of the audit;

8. the scope of internal audit activities; and

9. a statement that Internal Auditors must not have the authority or responsibility to carry out operational activities of the Auditee.
   The Head of the SKAI or PE Audit Intern is responsible for planning, implementing, organizing, and directing audits, as well as evaluating existing procedures to obtain assurance that the objectives and goals of the BPR can be achieved optimally. The SKAI or PE Audit Intern must periodically report its activities to the Chief Director. The SKAI or PE Audit Intern must be able to provide consultation to internal parties of the BPR in need, particularly regarding the scope of its duties. The SKAI or PE Audit Intern must, among other things, respond to proposals for policies, systems, and procedures to ensure that internal control aspects have been incorporated into new policies or systems so that their implementation can achieve their objectives effectively and efficiently. The involvement of the SKAI or PE Audit Intern in system reviews does not mean that such matters will be excluded as audit objects.

f. Planning
Internal audit activities for a 1 (one) fiscal year period must be based on thorough planning. The SKAI or PE Audit Intern is responsible for creating the plan to implement the internal audit function. This plan must be consistent with the authority and responsibilities of the SKAI or PE Audit Intern, the objectives of the BPR, and must be approved by the Chief Director and reported to the Board of Commissioners and the Audit Committee (if the BPR has an Audit Committee). The audit planning process consists of:

1. Determination of audit objectives
   Objectives must be measurable and consistent with the BPR's operational plan and budget.
2. Determination of the audit work schedule
   The audit work schedule must include activities to be audited, start dates, and time required, considering the audit scope and results of audits previously conducted by Internal Auditors. Matters to be considered in creating the audit work schedule must at least include:
   a. findings from previous audit periods; and b. risk evaluation must include risks according to the types of risks that the BPR must apply as regulated in the regulations of the Financial Services Authority regarding the implementation of risk management for BPRs. The purpose of conducting risk evaluation is to identify material or significant activities of the audited work unit.
3. Human resources and budget plan
   In planning human resources and budget, attention must be paid, among other things, to the number of Internal Auditors required for task implementation in the event the BPR has an SKAI, the required qualifications, and training needed for development efforts other than administrative activities that must be carried out.

g. Policies and Procedures
The SKAI or PE Audit Intern must formulate written policies and procedures as guidelines for Internal Auditors in carrying out their duties. The form and content of these policies and procedures must be adjusted to the organizational structure and complexity of BPR activities.

h. Professional Development and Education Program The SKAI must have a human resource recruitment and development program that must at least contain:

1. clear job descriptions and responsibilities for each Internal Auditor;
2. criteria for requirements to become an Internal Auditor;
3. a plan for continuous professional education and training; and
4. methods for evaluating Internal Auditor performance.

i. Review
To assess the implementation of the internal audit function, BPRs with core capital of at least Rp50,000,000,000.00 (fifty billion rupiah) must undergo a review by external parties at least once every 3 (three) years. External parties are public accountants and/or public accounting firms registered with the Financial Services Authority that do not audit the financial statements of the relevant BPR in the last 3 (three) years and do not have conflicts of interest. The report on this review must contain an opinion on the results of the SKAI's work and its compliance with the Guidelines for the Implementation of Internal Audit Standards for BPRs, as well as improvements that may be made. The first review must be conducted 3 (three) years after the formation of the SKAI.

j. Relationship with Public Accountants and Public Accounting Firms For BPRs whose financial statements are audited by Public Accountants and/or Public Accounting Firms as regulated in regulations regarding the transparency of BPR financial conditions, the SKAI or PE Audit Intern is responsible for coordinating its activities with external auditor activities. Thus, it is hoped that comprehensive and optimal internal audit results can be achieved. Coordination can be carried out through periodic meetings to discuss matters considered important by both parties.

2. SCOPE OF INTERNAL AUDIT WORK
   The scope of internal audit work must include examination and assessment of the adequacy and effectiveness of the internal control system of the relevant BPR and the quality of performance in carrying out established responsibilities. The scope of work and activities to be and must be audited is approved by the Chief Director and the Board of Commissioners.

a. Assessment of Internal Control System Adequacy Examination and assessment of the adequacy of the internal control system is intended to determine to what extent the established system can be relied upon to provide reasonable assurance that the objectives and goals of the BPR can be achieved efficiently and economically.

b. Assessment of Internal Control System Effectiveness Examination and assessment of the effectiveness of the internal control system is intended to determine to what extent the system has functioned as expected.

c. Assessment of Performance Quality
Examination and assessment of performance quality is intended to determine whether organizational objectives and goals have been achieved.

3. RELATIONSHIP BETWEEN INTERNAL AUDIT AND INTERNAL CONTROL SYSTEM
   Internal audit is part of the internal control system. Internal control is any action taken by management to ensure the achievement of established objectives and goals. The main objectives of internal control are to ensure:
   a. protection of public funds; b. achievement of established operational activity objectives and goals;
   c. economical and efficient use of resources;
   d. truthfulness and integrity of information; e. compliance with policies, plans, procedures, laws, and regulations; and f. protection of assets.
   Internal Auditors conduct examination and assessment of the effectiveness of the internal control system intended to provide assurance to Internal Auditors that controls are running as established, as follows.

a. Protection of Public Funds
Internal Auditors must assess the reliability of the established system in securing funds collected by the BPR from the public, including deposits and savings.

b. Achievement of Established Operational Activity Objectives and Goals Internal Auditors must assess to what extent the objectives and goals of specific operational activities have been achieved consistently as expected. In this regard, among other things, Internal Auditors must be able to assess the fairness of the development of BPR business, both potential and constraints affecting it.

c. Resource Utilization
Internal Auditors must assess the efficiency of resource utilization. For this purpose, among other things, an assessment of the efficiency, effectiveness, and security of specific operational activities, such as activities utilizing information technology, is required. Additionally, Internal Auditors must assess the optimal utilization of resources and facilities that are underutilized or work that is deemed less productive.

d. Truthfulness and Integrity of Information
Internal Auditors must assess the truthfulness and integrity of financial and operational information, including the recording of assets, liabilities, and administrative accounts of the BPR. The purpose of assessing this information is to ensure that the information is accurate, reliable, timely, complete, and useful for the interests of the BPR, the public, and the Financial Services Authority.

e. Compliance with Policies, Plans, Procedures, and Legislation Internal Auditors must assess the conformity of the established system with policies, plans, procedures, and legislation that may have a significant impact on BPR operations, including assessment of aspects of BPR business activities that can affect health levels or cause problems.

f. Protection of Assets
Internal Auditors must assess the reliability of the asset protection system, including funds, and examine the existence of assets, including such funds.

4. AUDIT IMPLEMENTATION
   The approach to audit implementation is influenced by the size of the organization, characteristics, volume, and complexity of BPR business activities. Therefore, each audit implementation must consider the conditions of each BPR. Audit implementation can be distinguished into 5 (five) stages of activities, namely the audit preparation stage, audit program formulation stage, audit assignment execution stage, audit result reporting stage, and audit result follow-up stage.

a. Audit Preparation
Audit implementation must be well prepared so that audit objectives are achieved efficiently. Steps to be considered in the audit preparation stage include approach methods, assignment determination, audit notification, and preliminary research.

1. Internal Auditor Approach Methods
   Internal Auditors must be able to use the necessary approach methods for internal audit implementation so that audit implementation can run effectively and efficiently. Approach methods may differ between one Internal Auditor and another, and between one BPR and another, but at minimum, Internal Auditors need to pay attention to technical aspects such as sampling methods and determination, testing techniques to be conducted, minimum audit evidence required, how to obtain it, and the concept of materiality.

2. Assignment Determination
   Assignment determination is intended to inform the Auditee as a basis for conducting the audit as established in the BPR's annual audit plan. The assignment determination is conveyed by the Head of the SKAI or PE Audit Intern to the audit team leader and team in the form of an assignment letter signed by the Chief Director, which among other things establishes the audit team leader and members in the event the audit is conducted by the SKAI, audit objectives, and the time required.

3. Audit Notification
   Internal audit implementation must be accompanied by an audit notification letter from the SKAI or PE Audit Intern, which can be conveyed to the Auditee before or at the time the audit is conducted. In the notification letter, among other things, it is stated:
   a) the plan for an initial meeting with the Auditee's work unit, intended to explain the audit objectives and simultaneously obtain explanations from the head of the Auditee's work unit regarding the activities and functions of the Auditee's work unit; b) the PE Audit Intern or the leader and members of the team (in the event the audit is conducted by the SKAI), including auditor personnel from the BPR group or parties appointed by the controlling shareholder of the BPR who are seconded to carry out internal audit; c) data and information required; and d) a request to the Auditee to prepare the necessary data, information, and documents.

4. Preliminary Research of the Auditee
   Preliminary research is intended to recognize and understand the activities or functions of the Auditee in general so that the audit can be focused on strategic matters, allowing Internal Auditors to formulate audit objectives more clearly. In this stage, Internal Auditors must be well acquainted with aspects of the Auditee, including functions, organizational structure, authority and responsibilities, policies, operational systems and procedures, activity risks and controls, success indicators, legal aspects, and other regulations.

b. Audit Program Formulation
The audit program is documentation of procedures for Internal Auditors in collecting, analyzing, interpreting, and documenting information during audit implementation, including notes for future examinations. The audit program must at least include:

1. procedures for collecting, analyzing, interpreting, and documenting information during audit implementation;
2. audit objectives;
3. scope, level, and methodology of examination;
4. examination duration; and
5. identification of technical aspects, risks, processes, and transactions to be tested, including electronic data processing.
   The audit program can be changed as needed during the audit.

c. Audit Assignment Execution
The audit execution stage includes activities of collecting, analyzing, interpreting, and documenting audit evidence and other information needed in accordance with procedures outlined in the audit program to support audit results.

1. Audit Process
   The audit process includes the following activities:
   a) collecting sufficient and relevant evidence and information; b) examining, evaluating, and confirming all evidence and information to ensure conformity with systems and procedures; c) establishing sampling methods and techniques used in accordance with conditions; d) documenting audit working papers; and e) discussing audit results with the Auditee.

2. Evaluation of Audit Results
   Evaluation of audit results is the responsibility of each Internal Auditor. In evaluating these audit results, the PE Audit Intern or audit team must formulate conclusions at each level of the audit program, evaluate audit results against audit objectives, and compile a summary of findings and audit result recommendations.

a) Conclusions from Audit Program Implementation If the audit program and procedures have been completed, Internal Auditors must formulate conclusions regarding audit results in accordance with the objectives of the audit program and procedures.

b) Evaluation of Audit Results against Audit Objectives If Internal Auditors find deviations during testing, these deviations must be evaluated based on cause-and-effect analysis.

c) Summary of Findings and Audit Result Recommendations Internal Auditors must create a summary of findings and audit result recommendations. If weaknesses or deviations are found, the summary must at least disclose:
i. the facts or actual conditions that occurred;
ii. the conditions that should have occurred;
iii. the causes of the deviation;
iv. the impact of the deviation;
v. improvement steps already taken by the Auditee; and
vi. Internal Auditor recommendations.

d. Audit Result Reporting
Significant audit findings involving fraud or misconduct must be reported immediately by the Team Leader to the Head of the SKAI or PE Audit Intern without waiting for the audit to be completed.
Internal Auditors are obligated to formulate audit results in the form of a written report. The report must meet reporting standards, contain complete material, and go through a good formulation process.
The audit result report must at least meet the following standards.

1. The report must be written
   The report must be written and contain audit results in accordance with the scope of the assignment. Additionally, the report must function as a formal document reflecting the responsibilities of Internal Auditors and the Auditee for the activities conducted.

2. The report must be concise and easy to understand
   The report must be made concisely, containing key points or important matters and matters that need to be improved by the Auditee.

3. The report must be supported by adequate working papers
   Reports containing audit findings must be supported by adequate working papers to be accountable.

4. The report must be objective
   The report must be objective and based on facts, not favoring any particular interest.

5. The report must be constructive
   The report must be constructive and able to provide improvement suggestions or directions for the Auditee to make improvements.

6. The report must be signed by the Internal Auditor
   The Internal Auditor's signature is intended as a form of responsibility for the truthfulness of the content of the report made.

7. The report must be made and delivered on time
   The report must be made and delivered on time or within a time frame still relevant to the report's material.

8. The report must be formulated systematically
   The report must be formulated systematically, including among other things the audit object, audit period, audit findings, conclusions, and recommendations, as well as the Auditee's response.
   The report formulation process must be carried out carefully to present a report that is accurate and useful for the Auditee. The process involves the compilation and analysis of audit findings. Audit findings to be formulated in the report must be compiled and analyzed for their significance level. Audit activity reports must be submitted to the Chief Director and the Board of Commissioners, with copies to the Director overseeing the compliance function. The report must at least be able to describe the comparison between achieved audit results and previously established objectives, cost and budget realization, causes of deviations, and actions taken and needed to make improvements.

e. Follow-up of Audit Results
The SKAI or PE Audit Intern must monitor, analyze, and report on the progress of follow-up improvements carried out by the Auditee. The follow-up includes:

1. Monitoring of Follow-up Implementation
   Monitoring of follow-up implementation must be conducted to know its progress and to remind the Auditee if the Auditee has not been able to implement improvement commitments before or until the promised deadline.

2. Analysis of Follow-up Adequacy
   From the results of monitoring follow-up implementation, an analysis of the adequacy of the fulfillment of commitments carried out by the Auditee is conducted. Subsequently, follow-up monitoring must be conducted again if there are difficulties or obstacles causing the follow-up to not be carried out in accordance with commitments.

3. Follow-up Report
   In the event that follow-up implementation is not carried out by the Auditee, the SKAI or PE Audit Intern provides a written report to the Chief Director and the Board of Commissioners for further action.

5. DOCUMENTATION AND ADMINISTRATION
   To support audit results, the SKAI or PE Audit Intern must document and administer documentary evidence from the planning, preparation, implementation, analysis, evaluation, and audit result reporting stages. Products documented and administered are all audit working paper files, including correspondence and audit result reports.

a. Audit Working Paper Documentation
The SKAI or PE Audit Intern must document audit working papers completely and clearly. Audit working papers can be in paper, magnetic tape, or other electronic data storage media. All working papers are compiled with attention to their function, formulation, and storage.

1. Function of Audit Working Papers
   The function of audit working papers is as the main support for audit result reports and as a means to help the process of planning, implementation, and monitoring of audit results. Other functions of audit working papers are to obtain an overview of whether audit objectives have been achieved as planned, to help interested parties examine audit results, and to assess the ability or quality of the SKAI or PE Audit Intern in carrying out its duties.

2. Formulation of Audit Working Paper Documentation
   The formulation of audit working paper documentation must:
   a) Neat
   Audit working paper documentation must be neat to facilitate its use. Audit working papers must be complete, clear, and easy to understand to facilitate those needing the information. b) Systematic Audit working paper documentation must be formulated systematically based on the chronology of events using an archive index.

3. Storage of Audit Working Papers
   Audit working papers are the property of the BPR, so regulations regarding archiving, including document confidentiality, must be observed. Matters or special provisions to be considered in implementing the storage of audit working paper archives include the following. a) Use of Audit Working Papers Audit working papers are the property of the BPR, so their removal, borrowing, and duplication by parties outside the SKAI or PE Audit Intern, such as other work units in the BPR and external auditors, must be with the approval of the Head of the SKAI or PE Audit Intern while still observing bank secrecy regulations. b) Supervision of Audit Working Papers Audit working papers must be under the supervision of the SKAI or PE Audit Intern and may only be accessed by authorized persons. c) Storage of Audit Working Papers Storage of audit working papers must be separated into Dynamic Archives, Active Archives, and Inactive Archives. The SKAI or PE Audit Intern must create regulations regarding the storage procedures for these archives, adjusted to regulations, including the establishment of retention schedules.

b. Audit Result Administration
The final work product of the SKAI or PE Audit Intern is the written audit result report. The audit result report must be supported by audit working paper documentation and has been examined by the Head of the SKAI or PE Audit Intern regarding the presentation method and its truthfulness. Audit result reports and correspondence must be archived as confidential documents.

1. Audit Communication Administration
   All correspondence and reports related to audits, which are forms of communication with the Auditee and other parties, must be administered well.

2. Administration of Audit Implementation Completeness
   After audit implementation is completed, the SKAI or PE Audit Intern must re-examine the administrative completeness of all Audit Working Paper files, both in the planning, implementation, and audit result follow-up stages.

DEFINITIONS...

DEFINITIONS OF TERMS

Active Archive
Active Archive is an archive with high frequency of use and/or continuous use.

Dynamic Archive
Dynamic Archive is an archive used directly in the activities of the archive creator and stored for a specific period.

Inactive Archive
Inactive Archive is an archive whose frequency of use has decreased.

Auditee
Auditee is the work unit or employee responsible for operational activities within the audited BPR organization.

Internal Auditor
Internal Auditor is an employee within the Internal Audit Unit (SKAI) or Internal Audit Outsourcing (PE Audit Intern) who is independent of the audited BPR organization.

Established in Jakarta
On March 10, 2016

EXECUTIVE HEAD OF BANKING SUPERVISION
FINANCIAL SERVICES AUTHORITY,

signed,

NELSON TAMPUBOLON

Copy consistent with the original
Legal Director 1
Legal Department

signed,

Yuliana