# Bank Audit Approach & Control Environment
## Drawing the Audit Plan
An audit plan should be drawn up based on:
1. Nature and level of operations of the bank/branch.
2. Nature of adverse features identified.
3. Level of compliance based on previous reports.
4. Audit risks based on inadequacies in Internal Control (IC).
## Control Environment - The 5W1H Framework
When evaluating control activities at a bank, the auditor uses a structured 5W1H approach:
### WHO performs the control?
- Who actually performs the control?
- Does that person have the requisite knowledge and authority to perform it?
### WHAT evidence exists?
- What evidence is available to prove that the control is performed?
### WHEN is it performed?
- When and with what frequency is the control performed?
- Is the frequency enough to prevent, detect and correct Risk of Material Misstatement (ROMM)?
### WHERE is the evidence retained?
- Where is evidence of control performance retained?
- For how long is the evidence retained?
- Is the evidence available for review?
### WHY is the control performed?
- Why is this control being performed?
- What type of errors are prevented or detected through performance of this control?
### HOW is it performed?
- How exactly is the control performed?
- What are the control activities?
- Can these activities be bypassed?
- Can a bypass, if any, be detected?
- How are deviations resolved on identification?
- What is the time frame for resolving deviations?
## Audit Planning Memorandum (APM)
The auditor should summarise the audit plan by preparing an APM to:
- Describe the expected scope and extent of audit procedures.
- Highlight all significant issues and risks identified during planning and Risk Assessment Procedures (RAP).
- Provide evidence that the engagement was planned appropriately.
## Form & Content of Financial Statements
Banking Regulation Act, 1949 — Third Schedule:
- Form A → Form of Balance Sheet
- Form B → Form of Profit & Loss A/c