According to Basel Committee on Banking Supervision guidelines, which of the following statements best describes the relationship between the internal audit function and compliance?

According to the Basel Committee on Banking Supervision (BCBS), the internal audit function serves as the third line of defense, providing independent assurance on the effectiveness of the bank's governance, risk management, and internal control processes. This mandate explicitly includes assessing the bank's compliance with laws, regulations, and internal policies. Therefore, the internal audit methodology must be designed to evaluate compliance risk and the adequacy and effectiveness of the compliance function itself. This assessment is a fundamental component of the internal audit's scope and responsibility.

B. Excluding transaction reviews would severely limit the internal audit's ability to test the effectiveness of compliance controls, making its assessment of the compliance function inadequate.
C. Combining the compliance (second line of defense) and internal audit (third line of defense) functions would eliminate the structural independence that is essential for internal audit to perform its assurance role objectively.
D. Effective communication between internal audit and compliance management is critical. Auditors must discuss findings to ensure they are understood and that appropriate corrective actions are taken, which does not compromise their independence.

1. Basel Committee on Banking Supervision (BCBS). The internal audit function in banks. June 2012.

Paragraph 23: "The internal audit function should assess the bank’s compliance with laws, regulations and internal policies. This includes assessing the consistency of the bank’s internal policies with legal and regulatory requirements." (Supports Answer A)

Paragraph 24: "The internal audit function should test both the controls in the first line of defence and the risk management and compliance controls in the second line of defence." (Refutes Option B)

Principle 1: An effective internal audit function... must be independent... (Refutes Option C, as combining functions would violate independence).

2. Basel Committee on Banking Supervision (BCBS). Compliance and the compliance function in banks. April 2005.

Paragraph 40: "The bank’s internal audit function should independently evaluate the effectiveness of the compliance function. The internal audit function is a separate and independent function from the compliance function." (Refutes Option C)

Paragraph 41: "Internal audit should conduct a periodic review of the compliance function to assess the extent to which it is performing its responsibilities effectively and to identify any areas for improvement." (Supports Answer A)

3. The Institute of Internal Auditors (IIA). IIA Position Paper: The Three Lines of Defense in Effective Risk Management and Control. January 2013.

Page 4: Describes Internal Audit as the third line, which "provides assurance on the effectiveness of governance, risk management, and internal controls, including the manner in which the first and second lines of defense achieve risk management and control objectives." (Supports the distinct roles described, refuting Option C).