The internal audit and risk management functions in Maltese commercial banks : an analysis

Abstract

Purpose- This analysis seeks to understand the roles of the Internal Audit and Risk Management functions in Maltese banks within the three lines of defence with reference to the extent and manner of their integration through committees and reporting. Furthermore, this study aimed to discover how the inter-relationship between both functions can be improved. A comparison between core and non-core banks is drawn. Design- Semi-structured interviews were carried out with internal auditors, risk managers within the banking sector, external auditors and the Maltese financial services regulator. Findings- Results show that the three lines of defence are present within Maltese banks however in smaller banks, it must be rigorously implemented. Corporate governance is crucial in the industry and measures are undertaken to safeguard it including the setting up of committees. Most banks agree with best practice regulation by incorporating separate audit and risk committees. In others, this distinction is inexistent because of their nature or size. Most large banks incorporate an internal audit function while the majority of smaller banks have it outsourced. Risk management is gaining importance yet some non-core banks must allot more resources for such function. Although internal audit and risk management integrate with one another through presence in committees and sharing of resources while being independent, communication should increase. Conclusions- The research concludes that the interrelationship between both functions can be improved through more frequent discussions and sharing of information. Furthermore, there is the need for greater risk awareness and its management throughout the whole bank. More people should be incentivised to work within the remit of risk management. Value- The study suggests ways how the relationship between internal audit and risk management can be enhanced. It seeks to determine whether banks are complying with best practice regulation with respect to such roles and reveals areas which need improvement.