Distinguish internal audit from compliance monitoring
Internal audit provides an independent assessment of governance, risk management and controls, whereas compliance monitoring and testing may be conducted as an ongoing second-line activity. This separation is particularly relevant for institutions subject to prudential governance frameworks. The EBA Guidelines on internal governance under the Capital Requirements Directive discuss independent control functions and management-body responsibilities. They are not a blanket rule requiring every small non-bank lender to adopt the same three-lines structure. An audit charter should identify the mandate, reporting access, independence and areas to be reviewed under applicable institutional and national rules. Audit should not simply reapprove procedures designed by its own team.
Select audits according to material risk
A risk-based plan can prioritise products, jurisdictions or systems with high consumer impact, repeated complaints, complex pricing, weak prior controls or major outsourcing. Define the audit universe and identify the applicable legal requirements before scheduling fieldwork. A lending business may need audits of pre-contract information, affordability, credit bureau data, marketing claims, automated underwriting, arrears and complaint resolution. The relative priority should reflect actual exposure rather than equal attention to every process. Coordinate with other assurance teams without surrendering independent judgement. Where a regulatory deadline is imminent, consider readiness and control design separately from whether the new law is currently enforceable.
Set scope and evidence standards in advance
An engagement plan should describe the entities covered, time period, criteria, systems, sample method and people responsible for supplying evidence. Request documented policies, change records, decision files, data flows, complaints and control-testing results. Independent audit should verify a representative portion of management assertions rather than relying exclusively on self-assessment. For automated lending, reconstruct cases using the rules or model versions active when decisions were made. Establish lawful and secure access to personal data and define what evidence can be retained. Make clear when a control belongs to a third-party vendor and which institution remains responsible for oversight.
Evaluate both design and operating effectiveness
A control may look sound on paper but fail in production because staff bypass it or application software generates obsolete documents. Audit work should test both the policy design and actual consumer outcomes. Interviews are useful but should be corroborated with transactional records or direct system observation where appropriate. Exceptions must be compared with specific legal or internal criteria rather than being labelled breaches based only on preference. Examine management oversight, escalation and whether earlier problems were corrected. A board report can reveal material weaknesses, but an audit should also assess whether management took decisions supported by evidence and followed up.
Report findings with clear owners and severity
Audit findings should explain the requirement, facts, cause, risk and recommended response. Severity must account for actual or potential consumer harm, prevalence, likelihood, legal implications and control environment. Agree who will perform remediation and when evidence will be provided. Preserve the auditor's ability to report unresolved disagreement or significant concerns to the appropriate governance body. Internal audit should not assume responsibility for fixing the underlying system it later must review. Ensure that findings about potential regulatory breaches reach competent legal or compliance functions for the appropriate assessment. Reporting should avoid exaggerated claims unsupported by the audited sample.
Verify remediation and improve the audit cycle
A management action plan is not proof that a weakness has been resolved. Audit follow-up should inspect corrective changes and, where justified, retest transactions after implementation. Track overdue actions, recurring defects and reliance on compensating controls. Document why an issue is closed or remains open, and escalate persistent material findings. Coordination with external auditors or supervisors does not remove the organisation's own governance responsibilities. EBA guidance can inform an institution's assurance approach within its scope, while other credit providers must check their own licensing and national obligations. Audit findings should feed the next risk assessment without turning assurance work into routine operational ownership. For example, an internal audit might identify inconsistent creditworthiness evidence across branches, while second-line monitoring already reports high pass rates. Rather than accept either result at face value, the audit should reconcile case definitions, samples and data extraction methods. Independent challenge can reveal that both teams measured different controls. The resulting finding should specify the shared underlying risk and require a response that improves real borrower outcomes.
Frequently asked questions
Are internal audit and compliance the same team?
They have distinct roles in governance structures requiring independent assurance.
Do EBA governance guidelines apply identically to all non-bank lenders?
No. Their formal scope and applicable national rules need verification.
Should audit close findings after receiving an action plan?
No. Closure should be supported by evidence that the weakness was addressed.
Primary sources
EBA Guidelines on internal governance under CRD ↗EBA Guidelines on loan origination and monitoring ↗Directive (EU) 2023/2225 on consumer credit ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.