01 · Risk assessment and rating
Control Risk from the checklist, Business Risk from the core, one rating with its trend.
Checklist marks roll up into a Control Risk band for each area and overall, using bands your bank sets. Business Risk comes from the deposit and advance figures in your Core Banking System.
A Risk Audit Matrix combines the two into a risk rating with its trend, and that rating drives how often each unit is audited in the annual plan. Overrides need a second approver.
- Control Risk bandsChecklist marks rolled up per area and overall, against bands the bank sets.
- Business Risk from the coreDeposit and advance figures read from the Core Banking System.
- Risk Audit MatrixThe two combined into a risk rating, with its trend.
- Approved overridesA changed rating needs a second approver before it counts.
- Drives the planThe rating sets how often each unit is audited.
02 · Audits in one workspace
Concurrent, statutory, RBIA, IS and credit audits, on versioned questionnaires.
Concurrent, statutory, risk-based (RBIA), IS and credit audits, plus audit types your bank defines, such as audits of PACS and other societies, all run in one workspace. Each runs on a versioned questionnaire, frozen once published, so an audit keeps the version it started with.
Loan accounts are sampled by bank policy and pulled read-only from the Core Banking System. Answers save as you go, evidence attaches to the question it supports, and every deviation lands in the jotting sheet.
- Your own audit typesConcurrent, statutory, RBIA, IS and credit, plus PACS and society audits.
- Versioned questionnairesSections, questions and scoring, frozen once published.
- Sampling by policyLoan accounts sampled by the bank’s policy for each product.
- Live loan dataThe population pulled read-only from the core, checked account by account.
- Evidence in placeFiles attached to the question they support, scanned on upload.
- Jotting sheet and annexuresEvery deviation in one sheet, and irregular accounts listed, ready as Excel.
03 · Annual audit plan
The year’s plan from risk ratings and your frequency policy.
Generate the year’s audit plan from risk ratings and your frequency policy: which units fall due, and when. Branches and the bank’s other auditable units are planned on the same footing, each with its business figures.
Schedule around leave and training, so clashes surface before an audit is staffed, and track man-days as the year runs. A planned audit completes when its audit is released.
- Generated from riskUnits fall due by their risk rating and your frequency policy.
- Every auditable unitBranches and the bank’s other units, each with its business figures.
- Leave and trainingTime away planned around, with clashes caught before staffing.
- Man-daysTime logged by the day and tracked against the plan.
- Plan to releaseA planned audit completes when its audit is released.
04 · Findings and compliance
Each finding a thread between the audit side and the branch, through to a closure certificate.
Each finding is a thread between the audit side and the branch, with its evidence attached. A reply hands it to the other side with a deadline, and only the audit side can close it.
Deadlines follow severity, unresolved items carry into the next audit, and compliance moves through review to closure, which ends in a certificate.
- Two-sided threadsThe branch replies, the audit side decides; each reply hands the finding over.
- Deadlines by severityCritical findings get the shortest clock, set by the bank.
- Carried forwardUnresolved items carry into the next audit of the unit.
- Compliance reviewCompliance submitted, reviewed and accepted against its deadline.
- Closure certificateWhen every finding is settled, the audit closes with a certificate.
05 · Offsite monitoring
Rules check the core’s data between visits.
Between visits, rules check data from the Core Banking System: standard loans overdue past the limit but not yet classified NPA, loans long past maturity, accounts drawn beyond their limit, KYC older than its risk category allows, and activity on dormant, frozen or closed accounts.
Exceptions are graded, routed to the right level by a distribution matrix, rectified by the branch, and accepted by the region or Head Office. Offsite monitoring works with or without the AML module.
- AdvancesOverdue standard loans not yet NPA, and loans long past maturity.
- DepositsAccounts beyond their limit, and activity on dormant, frozen or closed accounts.
- KYCKYC older than its risk category allows, and activity on pending or rejected KYC.
- Graded exceptionsEach exception graded high, medium or low, and raised once.
- Distribution matrixRouted to the branch, region or office that owns it.
- Rectify and acceptRectified by the branch, accepted by the region or Head Office.
06 · AML transaction monitoring
An optional rule library for CTR, CBWTR and STR reporting.
An optional module with a rule library for cash (CTR), cross-border (CBWTR) and suspicious-pattern (STR) reporting, run on the Core Banking System’s transactions, with a watchlist the bank imports.
Hits are raised as alerts for review and grouped into cases. Escalation starts the seven-working-day filing clock, and FIU-IND filings are prepared from the case. A Suspicious Transaction Report stays invisible to anyone not cleared to see it.
- CTR, CBWTR and STR rulesCash, cross-border and suspicious-pattern rules on the bank’s transactions.
- WatchlistImported by the bank and checked alongside the rules.
- Alerts and casesAlerts reviewed and grouped into cases, with a reason for every decision.
- FIU-IND filingFilings prepared from the case; CTR and CBWTR in monthly batches.
- Confidential STRsAbsent, not merely hidden, for anyone not cleared to see them.
- OptionalSwitched off, its screens and jobs don’t exist for the bank.
07 · Reports and MIS
Annexures pre-filled from the core, documents in PDF and Excel.
A dashboard for every desk, MIS reports by region, and Annexure tables pre-filled from the Core Banking System, so the reports start from the record rather than from a blank sheet.
Audit documents (the rating sheet, the rating letter and the audit summary) come as PDF and Excel. Every export is watermarked, logged and carries its checksum.
- DashboardsOne for every desk, showing what needs doing next.
- MIS by regionReports by period, region and branch, for the bank and for the board.
- Annexures pre-filledAnnexure tables filled from the Core Banking System.
- PDF and ExcelRating sheet, rating letter and audit summary in both.
- Watermarked exportsEvery export watermarked, logged, and kept with its checksum.
- AU OverviewEvery unit’s position, from the bank to a region to one branch.
08 · Inspections and field work
Monthly branch inspections, spot rectification, leakage and incidents.
Monthly branch inspections open on their own. On site, the team records spot rectification, income leakage and incidents as they find them, each linked to the audit it belongs to.
Where the network isn’t there, the audit can be worked offline in an Excel file and uploaded back when the team is connected again.
- Monthly inspectionsBranch inspections that open on their own each month.
- Spot rectificationWhat was put right on the spot, recorded on the spot.
- Income leakageLost income recorded on the account, signed once and tracked to recovery.
- IncidentsSerious matters escalated, linked to the findings behind them.
- Offline in ExcelWork the audit offline in its Excel file and upload it back.