Risk Assessment, Audit Strategy, Fraud, and Special Regulatory Considerations

# Bank Audit: Risk Assessment, Audit Strategy, and Regulatory Framework

## The Auditor's Core Risk Workflow

```

Identify RMM (SA 315)

→ Understand Bank Environment & Internal Control

→ Assess Specific Risks (fraud, outsourcing, money laundering)

→ Design Overall Audit Strategy (SA 300)

→ Respond to Risks (SA 330)

```

---

## 1. Identifying and Assessing Risks of Material Misstatement (SA 315)

• Assess RMM at two levels:

1. Financial statement level — risks that affect the financial statements as a whole

2. Assertion level — for classes of transactions, account balances, disclosures

• Basis for designing further audit procedures

## 2. Understanding the Bank's Environment (SA 315)

Understanding the bank (including internal control) enables the auditor to:

• Identify and assess risk
• Develop an audit plan → determine operating effectiveness of controls → address specific risks

## 3. Understanding the Bank's Accounting Process

• The accounting process produces financial and operational information AND contributes to internal control
• Must be understood to identify RMM (fraud or non-fraud) and design further procedures

## 4. Understanding the Risk Management Process

An effective bank risk management system requires 5 components:

## 5. Engagement Team Discussions

• Team discussions improve understanding of bank and its environment
• Helps assess potential for material misstatements in financial statements

## 6. Overall Audit Strategy and Audit Plan (SA 300)

• Engagement partner establishes overall audit strategy before commencement
• Involves key team members and specialists
• SA 300 requires involvement of all key members while planning

## 7. Audit Planning Memorandum

The APM documents:

• Expected scope and extent of audit procedures
• Significant issues and risks from planning/risk assessment
• Reliance decisions on controls
• Evidence that the auditor has planned appropriately and responded to all risk types

## 8. Audit Materiality

• Relationship between materiality and audit risk must be considered
• Determination is a matter of professional judgment
• Depends on: knowledge of bank, engagement risk assessment, reporting requirements

## 9. Going Concern

• While understanding the bank, auditor should consider events/conditions that cast significant doubt on the bank's ability to continue as a going concern

## 10. Fraud Risk including Money Laundering (SA 240)

SA 240 "The Auditor's Responsibilities Relating to Fraud":

• Objective: identify and assess RMM due to fraud; obtain sufficient appropriate evidence; respond appropriately
• Auditor must maintain professional skepticism — recognise possibility of fraud-based misstatements

Money Laundering (RBI Guidelines):

• RBI has issued "Know Your Customer (KYC) Guidelines – Anti Money Laundering Standards"
• Banks must establish policies, procedures and controls to:
• Deter money laundering
• Recognise money laundering activities
• Report money laundering activities

## 11. Specific Risks and Outsourcing Risks

• Auditor identifies RMM at financial statement level (pervasive risks affecting many assertions)
• Outsourcing risks: Modern banks extensively use outsourcing (cost reduction + expert access). The auditor must assess risks associated with outsourced activities — management of these risks is essential.

## 12. Responses to Assessed Risks (SA 330)

SA 330 "The Auditor's Responses to Assessed Risks":

• Design and implement overall responses at the financial statement level
• Design further audit procedures whose nature, timing, and extent are responsive to assessed RMM at assertion level

## 13. Stress Testing

• Tests robustness of software/systems beyond normal operating limits
• Especially important for mission-critical systems
• RBI requirement: All commercial banks must have a Board-approved Stress Testing Framework integrated into their risk management systems

## 14. Basel III Framework

• BCBS (Basel Committee on Banking Supervision) + FSB (Financial Stability Board) reviewed regulatory framework after the sub-prime crisis
• Basel III document released December 2010: proposed minimum criteria for regulatory capital instruments
• Basel accords focus on risks to banks and the financial system

## 15. Reliance on Other Reports

The auditor should review adverse comments on advances in:

• Previous year's audit reports
• Latest internal inspection reports of bank officials
• RBI's latest inspection report
• Concurrent / Internal audit reports
• Reports on verification of security
• Other internal reports on particular accounts
• Manager's charge-handing-over report (when incumbent changes)

> Statutory Central Auditors must review the RBI's Annual Financial Inspection report and ensure variations in provisions reported by RBI are properly considered by bank management.