Risk Management Auditing Flashcards

A bank auditor reviewing the Net Stable Funding Ratio (NSFR) finds the ratio at 98%. What action is required?

Answer: Immediate remediation; the NSFR minimum requirement of 100% is not met

The Basel III NSFR must be at least 100% at all times; a ratio below 100% indicates insufficient stable funding relative to required stable funding.

When auditing a bank's climate risk program, which item represents a transition risk rather than a physical risk?

Answer: Loan losses from borrowers in carbon-intensive industries facing new carbon taxes

Transition risks arise from the shift to a low-carbon economy, including policy changes like carbon taxes that impair borrowers in high-emission sectors.

Which audit technique is most effective for detecting unauthorized access to a bank's core banking system?

Answer: Analyzing user access logs to identify access attempts outside normal business hours or from unusual locations

Log analysis of user access patterns identifies anomalous behavior that may indicate unauthorized access, providing direct evidence rather than relying on management representations.

A bank's credit risk policy requires all commercial loans above $10M to receive an independent credit review before approval. An auditor finds 15% of loans in this tier bypassed the review. This is best classified as:

Answer: A material weakness because a key preventive control is failing at a material rate

A 15% bypass rate on a mandatory pre-approval control for large loans represents a material breakdown in the credit risk governance framework.

In reviewing a bank's risk taxonomy, an auditor finds that reputation risk is listed as a standalone risk category. Under most regulatory frameworks, how is reputation risk best characterized?

Answer: A consequential risk that typically arises from failures in other risk categories such as operational or compliance risk

Reputation risk is generally considered a secondary or consequential risk that results from failures in managing primary risk categories, rather than an independently originating risk.

An auditor is evaluating the bank's loan loss reserve (CECL) model. Which finding poses the greatest risk to financial statement accuracy?

Answer: Historical loss data used to calibrate the model predates the bank's current loan portfolio mix by ten years

Using stale historical loss data that doesn't reflect the current portfolio's risk profile will produce unreliable CECL estimates, potentially causing material misstatement of reserves.

Under the OCC's Heightened Standards for large banks, which risk management requirement distinguishes covered institutions from smaller banks?

Answer: A requirement to maintain a risk appetite statement approved by the board

OCC Heightened Standards (12 CFR Part 30, Appendix D) require large banks to have a board-approved risk appetite statement as a core governance element.