Statement of Guidance - Internal Audit - Banks

Summary

This is a CIMA Statement of Guidance setting out best-practice expectations for banks licensed in the Cayman Islands regarding the establishment and operation of an internal audit function. It expands on the general internal-control requirement in Rule 1(A) and describes what a sound, independent internal audit function should look like.

• Scope of the internal audit function
• Independence and impartiality
• Professional competence
• Its charter
• Application across group, branch, and subsidiary structures
• Its role in the internal capital assessment process
• Conditions under which internal audit activities may be outsourced, including for small banks

The guidance applies to all banks licensed by CIMA, including those with branches, subsidiaries or group structures, and addresses how internal audit should function within larger, complex institutions versus small banks that may outsource the function.

• Outsourcing expectations: Vendor competence
• Outsourcing expectations: Contractual terms
• Outsourcing expectations: Access rights for the Monetary Authority
• Outsourcing expectations: Contingency planning if an outsourcing arrangement terminates

As a Statement of Guidance rather than a binding rule, it describes CIMA's expected standard of best practice that banks should follow in designing and maintaining their internal audit function. Deviations may be scrutinized during supervisory review even though the document does not itself impose statutory penalties or specific filing deadlines.

Key obligations

• Each bank should maintain a permanent internal audit function appropriate to its size and the nature of its operations, providing adequate resources and staffing.
• The internal audit function must be independent of the activities it audits and of day-to-day internal control processes, reporting to the CEO, board of directors, or audit committee.
• The head of internal audit should have authority to communicate directly with the board, board chairman, audit committee, or external auditors on its own initiative.
• Internal audit staff should avoid conflicts of interest; internally recruited auditors should not audit activities they performed within the last twelve months, and staff should be rotated periodically where practicable.
• Each bank should establish, periodically review, and communicate throughout the organisation an internal audit charter defining scope, standing, powers, and accountability of the internal audit department, approved by senior management and confirmed by the board.
• The internal audit department must have unrestricted access to all bank records, staff, activities and entities, including branches, subsidiaries and outsourced activities.
• Internal audit staff must maintain professional competence through continuous training and be capable of examining all areas of the bank's operations.
• Internal audit should conduct regular independent reviews of the bank's internal capital assessment process and risk management system.
• For banks with subsidiaries or foreign branches, the parent bank should establish group-wide internal audit principles and ensure its internal audit department has unlimited access to subsidiary/branch activities and conducts on-site audits at sufficient intervals.
• Where internal audit activities are outsourced, the bank must ensure a written contract defining vendor responsibilities, require senior management pre-approval of the vendor's risk analysis and audit plan, and ensure CIMA, senior management and external auditors have access to the vendor's audit records and working papers.
• Banks using outsourcing vendors must select competent, financially sound firms and maintain a contingency plan in case the outsourcing arrangement terminates.
• In small banks with fully outsourced internal audit, senior management remains responsible for ensuring audit recommendations are addressed and implementation responsibilities are assigned.

Applies to

banks