Bangladesh Bank has made major changes to banks’ internal audit arrangements. New instructions separate internal audit, compliance and risk management, allowing internal audit departments to work more independently than before. For the first time, a whistleblower system has also been made mandatory at all banks. As a result, if a bank’s board of directors or managing director (MD) is involved in corruption or serious irregularities, the bank’s internal auditors can report that information confidentially and directly to Bangladesh Bank — without needing permission from the bank’s management or board.
Bangladesh Bank issued the Internal Control Management System (ICMS) instructions on Tuesday, cancelling the 2016 Guidelines on Internal Control and Compliance in Banks.
A Bangladesh Bank official said the 2016 instructions suited the supervisory arrangements of the time, but the central bank has now introduced risk-based supervision (RBS), so the instructions were changed to match the new supervisory system.
The new instructions give separate weight to internal audit, compliance and risk management, the official said. Although risk management will have separate instructions, these instructions mainly set out how internal audit and compliance will be conducted.
The biggest change, the official said, is separating internal audit from compliance. Previously a single head of ICC handled both departments; from now on the head of internal audit and the head of compliance will be different people of equal rank, reducing the scope for ignoring any irregularity found in an audit.
The head of internal audit will report directly to the board’s audit committee, the official added. Previously they had to work through management; now they can work more independently.
Under the new instructions, if an internal audit finds irregularities against the board of directors or the managing director, it must be reported confidentially to Bangladesh Bank’s Banking Regulation and Policy Department-2 and the relevant bank supervision department. The 2016 instructions had no such provision.
Every bank must also set up a hotline, email, online platform or sealed written-complaint arrangement to receive complaints. Whistleblowers’ identities must be kept confidential, and anonymous complaints must also be investigated if they contain sufficient information. Bangladesh Bank will act against any bank that takes retaliatory measures such as demotion, suspension or harassment against a complainant.
Forensic, concurrent and virtual audits
The new instructions direct banks to introduce forensic, concurrent and virtual audits. Forensic audits will investigate fraud and gather evidence usable in court. Concurrent audits will monitor transactions as they take place. Virtual audits will allow audits to be conducted securely from a distance.
Technology-based monitoring
Bangladesh Bank has directed banks to strengthen technology-based monitoring, requiring modern technology to be used in detecting trade-based money laundering and in credit risk, market risk, counterparty risk, cyber security and fraud prevention.
All scheduled banks have been directed to complete the necessary organisational changes and implement the new instructions by December 31.
বাংলায় মূল প্রতিবেদন পড়ুন · Read the original Bengali report