Internal audit in banking organisations and the relationship of the supervisory authorities with internal and external auditors

Invitation to comment

The Basel Committee is issuing this paper for consultation and welcomes comments on all aspects of the paper. In particular comments on the following issues are appreciated.

1. The definition of internal audit. The definition quoted¹in the paper includes a consulting activity for the internal auditors. However, many are of the opinion that advising or consulting should only be ancillary to the basic function of internal audit, which is an independent appraisal function established within a bank to examine and evaluate its internal control systems. Do you believe that the paper is adequately balanced in this regard?

2. The so-called 'whistleblowing' function of internal auditors.Some might want to argue that internal auditors should be authorised and have a duty to disclose information to the supervisory authorities. Others argue that the 'whistleblowing' function weakens the relationship based on trust between management and the internal auditor. However, it is often considered to be a good practice for the audit charter to provide internal auditors with sufficient mechanisms for the reporting of audit results, findings, opinions, or other information, without bringing such matters to the attention of persons outside of the organisation. Such mechanisms include reporting to the appropriate level of management, the board of directors or the audit committee if one exists. Do you believe that the reporting issues for the internal audit function have been adequately addressed?

3. The degree to which the internal audit function may be outsourced.Some countries require that a bank's internal audit department should be proficient enough to examine the bank's key activities. However, these countries accept that an external expert may carry out certain examinations for which the internal audit department is not - or not sufficiently - proficient. Other countries may permit outsourcing arrangements under which the outsourcing vendor performs virtually all internal audit work. Under such an arrangement, the institution should, however, maintain a senior and experienced individual as head of internal audit and a small internal staff. What is your opinion on the pros and cons of outsourcing of internal audit and the measures to be taken when outsourcing is done?

4. Internal audit by the institution's external auditor.Some countries require the internal audit outsourcing vendor to be in all respects completely independent of the external auditor or of the latter's company or group. Other countries allow an outsourcing vendor who is an external auditor and who performs a financial statement audit or some other service for the institution. What are your views on the issue?

Comments should be submitted in writing no later than 30 November 2000 to:

Basel Committee on Banking Supervision
Attention: Mr Bengt A Mettinger
Bank for International Settlements
CH-4002 Basel, Switzerland
Fax + 41 61 280 81 00 or 41 61 280 91 00

¹The paper quotes the definition of internal audit approved in June 1999 by the Board of Directors of the Institute of Internal Auditors.