Internal Audit Requirements for Representative Management¶
Overview¶
Internal audit plays a critical role in providing independent assurance that an FI's representative management framework is operating effectively and in compliance with MAS requirements. MAS expects all licensed FIs to maintain an internal audit function that is independent, adequately resourced, and has appropriate access to all areas of the business.
The internal audit function's coverage of representative management should be risk-based, covering the full lifecycle from appointment through ongoing monitoring to cessation. MAS Guidelines on Risk Management Practices and MAS Notice SFA 04-N22 (superseded SFA 04-N09 on 1 April 2024) set out expectations for internal audit in the context of representative management.
Internal Audit Framework¶
Independence and Reporting¶
- Reporting line: The internal audit function must report directly to the Board or the Audit Committee, not to line management. This ensures independence from the business functions being audited
- Functional independence: Internal auditors must not have operational responsibilities for the areas they audit. They should not participate in the design or implementation of controls they will later audit
- Unrestricted access: Internal audit must have unrestricted access to all records, personnel, and systems relevant to representative management
- Budget and resources: The Audit Committee must ensure the internal audit function has adequate budget and qualified staff to fulfil its mandate
Audit Universe and Planning¶
The internal audit universe for representative management should cover:
- Appointment process: Pre-appointment due diligence, Fit and Proper assessments, MAS notification procedures, documentation completeness
- Ongoing monitoring: Trade surveillance effectiveness, complaint management, CPD compliance tracking, conduct reviews, annual Fit and Proper reassessments
- Cessation process: Cessation procedures, MAS notification timeliness, exit interviews, handover of client accounts
- Regulatory reporting: Accuracy and timeliness of all regulatory returns related to representatives
- Training and competency: Adequacy of training programs, CPD completion rates, competency assessments
- Supervisory framework: Effectiveness of the supervisor-representative oversight structure
- Technology and systems: Adequacy of systems supporting representative management (trade surveillance, compliance monitoring, case management)
- Policy and procedures: Currency and completeness of policies and procedures governing representative management
Audit Frequency and Scope¶
Risk-Based Audit Cycle¶
- High-risk areas: Audited annually or more frequently. These typically include Fit and Proper assessments, trade surveillance, complaint management, and regulatory reporting
- Medium-risk areas: Audited every 18-24 months. These may include training and competency management, supervisory framework, and cessation procedures
- Low-risk areas: Audited every 2-3 years. These may include policy documentation reviews and system access controls
- Continuous auditing: Where feasible, implement continuous auditing techniques for high-volume, data-rich areas such as trade surveillance alerts and CPD tracking
Minimum Annual Coverage¶
At a minimum, the annual internal audit plan should include:
- Review of a sample of new representative appointments to verify compliance with Fit and Proper requirements and MAS notification procedures
- Assessment of the effectiveness of the ongoing monitoring framework, including trade surveillance, complaint tracking, and conduct reviews
- Verification of CPD compliance rates and the adequacy of training programs
- Review of a sample of representative cessations to verify proper procedures were followed
- Assessment of the accuracy and timeliness of regulatory returns related to representatives
- Testing of key controls in the representative management process
Key Audit Areas¶
1. Fit and Proper Assessment Process¶
- Sample testing: Select a representative sample of appointments during the audit period and verify that all required Fit and Proper checks were completed before the representative commenced activities
- Documentation review: Verify that all required documents (educational certificates, CMFAS examination results, reference checks, criminal record checks, bankruptcy checks) are on file and were obtained before appointment
- Assessment quality: Evaluate whether the Fit and Proper assessment was thorough and whether any red flags were appropriately investigated and escalated
- Timeliness: Verify that MAS notifications were submitted within the prescribed timeframes
- Approvals: Confirm that appointments were approved by authorized personnel at the appropriate level
2. Trade Surveillance¶
- Alert generation: Assess whether trade surveillance systems are generating alerts based on appropriate parameters and thresholds
- Alert investigation: Review a sample of alerts to verify they were investigated in a timely manner by qualified staff
- Escalation: Verify that alerts meeting escalation criteria were properly escalated to senior management and/or reported to MAS
- Closure documentation: Ensure that investigated alerts have adequate documentation of the investigation, findings, and rationale for closure
- System calibration: Assess whether surveillance parameters are regularly reviewed and recalibrated based on emerging risks and regulatory guidance
3. Complaint Management¶
- Completeness: Verify that all complaints are captured in the centralized complaint register
- Timeliness: Assess whether complaints are acknowledged, investigated, and resolved within the FI's service level agreements
- Root cause analysis: Evaluate whether root cause analysis is conducted for substantiated complaints and whether systemic issues are identified and addressed
- Regulatory reporting: Verify that complaints meeting MAS reporting thresholds are properly reported
- Trend analysis: Assess whether complaint data is analyzed for trends and patterns that may indicate broader conduct or process issues
4. CPD Compliance¶
- Tracking accuracy: Verify that CPD hours are accurately recorded and supported by evidence (certificates, attendance records)
- Compliance rates: Assess overall CPD compliance rates and identify any representatives who have not met their requirements
- Remediation: Verify that non-compliant representatives were identified in a timely manner and that appropriate remedial action was taken
- Quality of training: Evaluate whether CPD activities are relevant to the representative's regulated activities and of adequate quality
5. Regulatory Reporting¶
- Accuracy: Verify the accuracy of data submitted in regulatory returns by reconciling with source systems
- Timeliness: Confirm that all regulatory returns were submitted within prescribed deadlines
- Completeness: Ensure that all required returns were submitted and that no reporting obligations were missed
- Signoff: Verify that returns were reviewed and approved by authorized personnel before submission
MAS Expectations for Internal Audit¶
Audit Standards¶
MAS expects internal audit functions to adhere to recognized professional standards:
- Institute of Internal Auditors (IIA) Standards: The International Standards for the Professional Practice of Internal Auditing
- Quality assurance: Regular quality assurance reviews of the internal audit function, including periodic external quality assessments
- Professional competence: Internal auditors must have appropriate qualifications and experience in financial services regulation
Communication with MAS¶
- Audit reports: MAS may request copies of internal audit reports related to representative management
- Engagement with MAS inspectors: Internal audit should cooperate fully with MAS inspection teams and provide access to all relevant workpapers and reports
- Follow-up reporting: MAS may require the FI to report on the status of remediation actions arising from internal audit findings
Common Audit Findings¶
Based on industry experience and MAS inspection outcomes, common internal audit findings related to representative management include:
- Incomplete Fit and Proper documentation: Missing or outdated reference checks, expired criminal record checks, or incomplete self-declarations
- Delayed MAS notifications: Late submission of appointment or cessation notifications, often due to manual processes and lack of automated tracking
- Inadequate trade surveillance: Surveillance parameters that are too broad (generating excessive false positives) or too narrow (missing genuine suspicious activity)
- Poor complaint tracking: Complaints not being captured in the central register, particularly verbal complaints or complaints received through informal channels
- CPD non-compliance: Representatives failing to meet CPD requirements due to inadequate tracking and insufficient advance warning of impending deadlines
- Insufficient supervisory oversight: Supervisors with too many direct reports, or supervisory reviews that are perfunctory rather than substantive
- Weak documentation: Monitoring activities conducted but not adequately documented, making it difficult to demonstrate compliance to MAS
- Outdated policies: Policies and procedures that have not been updated to reflect regulatory changes or organizational restructuring
Remediation and Follow-Up¶
Issue Rating and Prioritization¶
Internal audit findings should be rated based on severity:
- Critical: Issues that represent an immediate risk of regulatory breach, client harm, or significant financial loss. Require immediate remediation (within 30 days)
- High: Issues that represent a material weakness in controls. Require remediation within 60-90 days
- Medium: Issues that represent a control gap but with limited immediate risk. Require remediation within 6 months
- Low: Opportunities for improvement. Addressed as part of normal business planning
Management Action Plans¶
For each finding, management must provide a formal action plan that includes:
- Root cause: Identification of the root cause of the deficiency
- Remediation actions: Specific actions to address the finding
- Responsible owner: Named individual accountable for implementation
- Target date: Realistic timeline for completion
- Evidence of completion: Defined evidence that will demonstrate the action has been completed
Follow-Up and Validation¶
- Tracking: Internal audit must maintain a tracker of all open findings and monitor progress against target dates
- Validation: Once management reports completion, internal audit must independently validate that the remediation action has been effectively implemented
- Escalation: Overdue findings must be escalated to the Audit Committee, with reasons for the delay and revised timelines
- Reporting: Regular reporting to the Audit Committee on the status of audit findings, including aging analysis and trend data