According to the Basel Committee on Banking Supervision guidelines, the internal audit function should evaluate the adequacy and effectiveness of the bank's compliance function and its compliance risk management framework1. This includes assessing the compliance risk inherent in the bank's activities, products, services, and systems, as well as the compliance policies, procedures, controls, and reporting mechanisms2. The internal audit function should also review the transactions and records of the bank to ensure compliance with applicable laws, regulations, and internal standards3.
The other statements are incorrect because:
B: An internal audit program of adequacy of the bank's compliance function should be established, but should not include review of transactions. This statement is false because the internal audit function should review the transactions and records of the bank to ensure compliance, as mentioned above3.
C: The compliance function and internal audit function should be combined. This statement is false because the compliance function and the internal audit function should be separate and independent from each other, to avoid conflicts of interest and ensure objectivity and credibility.
D: The auditors should not discuss internal audit findings with compliance management to maintain independence. This statement is false because the internal audit function should communicate and coordinate with the compliance function on a regular basis, to share information, insights, and recommendations, and to avoid duplication of work. However, the internal audit function should maintain its independence and report directly to the board of directors or the audit committee.
References:
1: The internal audit function in banks, Principle 10, p. 9
2: The internal audit function in banks, Principle 10, p. 10
3: The internal audit function in banks, Principle 10, p. 11
4: The internal audit function in banks, Principle 2, p. 4
5: The internal audit function in banks, Principle 10, p. 11