• Internal Audit within a Group or Holding Company Structure

    • HC-6.5.61

      The internal auditors who perform the internal audit work at the bank must report to the bank's audit committee, or its equivalent, and to the group or holding company's head of internal audit.

      Added: April 2018

    • HC-6.5.62

      To facilitate a consistent approach to internal audit across all the banks within a banking organisation, the board of directors of each bank within a banking group or holding company structure should ensure that either:

      (a) The bank has its own internal audit function, which should be accountable to the bank's board and should report to the banking group or holding company's head of internal audit; or
      (b) The banking group or holding company's internal audit function performs internal audit activities of sufficient scope at the bank to enable the board to satisfy its fiduciary and legal responsibilities.
      Added: April 2018

    • HC-6.5.63

      The board of directors and senior management of the parent bank in a banking group must ensure that an adequate and effective internal audit function is established across the banking organisation and must ensure that internal audit policies and practices are appropriate to the structure, business activities and risks of all of the components of the group or holding company.

      Added: April 2018

    • HC-6.5.64

      The head of internal audit at the level of the parent bank must define the group or holding company's internal audit strategy, determine the organisation of the internal audit function both at the parent and subsidiary bank levels (in consultation with these entities' respective audit committees and in accordance with local laws) and formulate the internal audit principles, which include the audit methodology and quality assurance measures.

      Added: April 2018

    • HC-6.5.65

      The group or holding company's internal audit function must determine the audit scope for the banking organisation. In doing so, it must comply with local legal and regulatory provisions and incorporate local knowledge and experience.

      Added: April 2018