The internal audit function in ABL remains independent of the activities audited and objective in its work. There have been no restrictions placed over the right of access by internal audit to the records, management or employees of the Bank as part of the audit procedures performed during the year under review. The Head of Internal Audit maintains a direct reporting line with the Audit Committee for direction and accountability and to the Chief Executive Officer for administrative interface and support in line with good governance practices.
The Head of Internal Audit has regular access to the Chairperson of the Audit Committee. He attends quarterly meetings with the Audit Committee and more frequently when the need arises.
Kristy Kumar Ballah, a Chartered Banker and also a Fellow of the Institute of Chartered Accountants in England and Wales with 16 years of experience in the auditing field heads the Internal Audit department. Prior to joining the Bank, he was the Group Internal Audit Manager at the Mauritius Commercial Bank. He started his career with PwC where he grew to become an Audit Manager. Over the years, the Head of Internal Audit had exposure to local organizations operating in diverse sectors and also had significant international exposure. He is well acquainted with strategy setting for risk functions in Banks and risk management activities in general. The profile of the Head of Internal Audit is displayed on the Bank’s website.
The Head of Internal Audit is supported by staff members with significant banking and auditing experience. The team includes members with “Big 4 firm” exposure and who are also members of professional bodies such as ICAEW, CBI, ACCA, CISA, STEP etc.
The Internal Audit team implements the yearly risk-based audit plan approved by the Audit Committee. The audit frequency for identified processes is as follows:
Delays in executing the FY 2020 audit plan as a result of the lengthy confinement linked to COVID-19 meant completion of same only happened in Quarter 2 of FY 2021. Given the cascading effect and considering that ad-hoc assignments, comprising fact finding and other assignments of an advisory nature, have been performed at the request of management during FY 2021, the target is to complete the latter audit plan by the end of October 2021. The FY 2021 risk-based audit plan was approved by the Audit Committee and Internal Audit used amongst others use the following key criteria to assign inherent and residual risk ratings to the relevant processes in the Bank:
- Past audit findings and cumulative audit knowledge of controls design and performance;
- Financial impact;
- Volume of transactions;
- Whether the process is impacted by key regulatory requirements;
- Whether the process represents a key second line of defense function; and
- Recent or foreseen changes in management, structure, systems impacting the process.
The internal audit team provides varying degrees of assurance about the effectiveness of the risk management and control processes of selected activities and functions of the organization. The Internal Audit function does not believe that any deficiencies identified so far could at this stage, individually or collectively jeopardize the operations of the Bank.
It is worth mentioning that as at date, the majority of issues categorized as “critical” and “major” have been or are in the process of being addressed by management.
Any risk or deficiency in the system of internal controls revealed during audits performed have been reported in the respective reports issued at the end of the assignment. The audit report includes audit recommendations, management comments, action plan and timeline for implementation. Strict monitoring of implementation is done by Internal Audit and a periodic status is given to the Audit Committee.
Internal Audit also performs a close follow up on the implementation of recommendations in the management letter of the external auditors.