SUNANDO ROY – On Banking, Finance and Society

Digital banks are built on technology, data, and speed. Their operating model—cloud-native systems, API-driven architectures, automated decision-making, and extensive reliance on third parties—differs fundamentally from that of traditional banks. In this environment, internal audit can no longer rely on periodic, checklist-based reviews designed for branch-centric institutions. It must evolve into a technology-enabled, forward-looking assurance function capable of keeping pace with digital risks (Institute of Internal Auditors [IIA], 2023; Basel Committee on Banking Supervision [BCBS], 2023).

In a digital bank, internal audit must provide assurance over end-to-end digital processes, not just policies and manuals. Customer onboarding, remote identity verification, automated credit decisions, transaction monitoring engines, and digital customer journeys are all core banking activities executed largely through systems and code. Control weaknesses in these areas can crystallize rapidly into financial loss, regulatory breaches, or reputational damage (European Banking Authority [EBA], 2022). Internal audit therefore needs visibility into how systems interact, where controls are embedded, and how exceptions are identified and resolved in real time.

A defining feature of digital banks is their dependence on technology infrastructure and cybersecurity resilience. Internal audit plays a critical role in independently assessing cyber controls, access management, data protection, incident response preparedness, and operational resilience. This goes beyond confirming the existence of frameworks or policies; it requires testing whether controls actually work under stress, including recovery capabilities during outages or cyber incidents (Bank of England & PRA, 2023; Monetary Authority of Singapore [MAS], 2021).

Digital banks also operate within an expanded risk perimeter created by third-party and outsourcing arrangements. Cloud service providers, fintech partners, data vendors, and platform operators often support critical activities. These dependencies introduce concentration, substitution, and governance risks that can undermine continuity if not properly managed. Internal audit must assess whether due diligence, contractual protections, ongoing monitoring, and exit strategies are robust, and whether management retains effective oversight of outsourced functions (EBA, 2019; BCBS, 2023).

As automation and algorithm-driven decisioning become central to digital banking, internal audit’s remit extends into model and data governance. Assurance is required over data quality, model development and validation, explainability, bias controls, and performance monitoring. Failures in this area can lead to unfair outcomes, systemic errors at scale, and loss of supervisory and public confidence (European Central Bank [ECB], 2022; IIA, 2022).

Despite agile delivery models and cross-functional collaboration, independence remains a cornerstone of internal audit. While auditors must understand technology and engage with product and engineering teams, they must remain structurally and operationally independent. This independence is essential to provide credible challenge, particularly where speed-to-market pressures may incentivize control shortcuts (IIA, 2020).

Given the pace of change, audit planning in digital banks must be dynamic and risk-based. Static annual audit plans are often insufficient. Internal audit should continuously reassess priorities, focusing on new product launches, major system changes, code deployments, and emerging threat vectors. Timely assurance is critical; delayed findings may arrive too late to prevent material impact (BCBS, 2023).

Strong Board and Audit Committee engagement is central to the effectiveness of internal audit in a digital bank. Reporting should translate complex technical findings into clear insights on control effectiveness, emerging risks, and management’s remediation discipline. Boards increasingly rely on internal audit to act as an early-warning mechanism in fast-moving digital environments (Financial Stability Board [FSB], 2022).

Ultimately, the effectiveness of internal audit in a digital bank depends on skills and capability. Auditors must have expertise in IT, cybersecurity, data analytics, cloud architectures, and fintech operations, supported where necessary by specialist co-sourcing. Without these capabilities, internal audit risks becoming a mere formal compliance function rather than a meaningful line of defence (IIA, 2023).

In a digital bank, internal audit is not a backward-looking reviewer of past events. It is a critical trust function, safeguarding resilience, compliance, and customer confidence in a business model where risks can emerge and escalate at digital speed.

References

• Basel Committee on Banking Supervision (2023). Principles for the effective management and supervision of climate-related financial risks. BIS.

• Bank of England & Prudential Regulation Authority (2023). Operational Resilience: Impact Tolerances for Important Business Services.

• European Banking Authority (2019). Guidelines on Outsourcing Arrangements (EBA/GL/2019/02).

• European Banking Authority (2022). Guidelines on ICT and Security Risk Management (EBA/GL/2022/03).

• European Central Bank (2022). Guide on the use of Artificial Intelligence in the European banking sector. ECB.

• Financial Stability Board (2022). Supervisory and Regulatory Approaches to Outsourcing and Third-Party Relationships.

• Institute of Internal Auditors (2020). The Three Lines Model: An update of the Three Lines of Defense.

• Institute of Internal Auditors (2022). Auditing Artificial Intelligence.

• Institute of Internal Auditors (2023). Global Internal Audit Standards (Exposure Draft).

• Monetary Authority of Singapore (2021). Technology Risk Management Guidelines.