Basel Core Principles for Effective Banking Supervision (2024) P26: Principle 26: internal control and audit

The bank has an internal control framework, the responsibility of the board and senior management, that keeps an effectively controlled and tested operating environment for its risk profile with a forward-looking view (including climate-related and emerging risks), covering organisational structure (defined duties, clear delegation such as loan approval limits, decision processes, separation of origination, payments, reconciliation, risk management, accounting, audit and compliance), accounting policies (reconciliations, control lists, management information), checks and balances (segregation of duties, cross-checking, dual control, double signatures) and safeguarding of assets (physical and computer access control), with measures to prevent and detect fraud, embezzlement, unauthorised trading and computer intrusion. Back office and control functions have skills, resources, expertise and authority (and board access where appropriate) to check the business units. A permanent, independent, adequately staffed compliance function helps senior management manage compliance risk, under board oversight. A permanent, independent and effective internal audit function (in-house, outsourced or co-sourced) assesses whether policies, processes and controls, including risk management, compliance and governance, remain effective and are complied with; it is resourced with trained staff, accountable to the board or audit committee with standing that makes management act on its findings, informed of material risk changes, free to contact any staff and access all records of the bank and affiliates, uses a risk-identifying methodology and a regularly reviewed risk-based audit plan, and can assess outsourced functions. Control staff remuneration is set independently of the lines they oversee.