Banks must, every year, appoint an External Auditor or more, approved by the Central Bank, for auditing their accounts.
The Board audit committee must recommend the appointment, reappointment, dismissal and compensation of the External Auditor.
Banks must rotate their external audit firm at least every 6 years, subject to the conduct of a procurement procedure. In addition, Banks must rotate their external audit firm’s partner in charge of the audit every 3 years.
The Board audit committee must oversee the External Auditor’s effectiveness and independence.
The external audit firm engaged by the Bank, including its Affiliates or Subsidiaries, must not provide any non-audit services to the Bank during the financial years of its external audit mandate, which could impair its objectivity and independence.
The External Auditor must conduct audits in accordance with the International Standards on Auditing (ISA) that require the use of a risk and materiality based approach in planning and performing the audit.
The scope of the external audits must include areas such as the loan portfolio and loss provisions, non-performing assets, asset valuations, trading and other securities activities, derivatives, asset securitizations, consolidation of and other involvement with off-balance sheet vehicles, the Pillar 3 reporting and the adequacy of internal controls over financial reporting.
The External Auditor must comply with the independence provisions laid down in the Central Bank Law, this Regulation and the accompanying Standards. In case of violation of these provisions or failure in the performance of duties, the Central Bank may take any measures against the violating or negligent External Auditor, including rejection by the Central Bank to carry out audits in Banks.
The Central Bank may require a Bank to rescind the appointment of an External Auditor it determines has not adhered to established professional standards or has inadequate expertise or independence.
The External Auditor must meet with the Central Bank as deemed necessary for supervisory purposes. The Central Bank will access the External Auditor’s working papers, when necessary.
The Central Bank may require a Bank to appoint an auditor at the Bank’s expense, who may be the existing External Auditor or another auditor specified by the Central Bank, to provide a report on a particular aspect of the Bank’s business operations, prudential requirements, risk governance framework or such other matters as the Central Bank may specify.