The Art of Islamic Banking and Finance: Tools and Techniques for Community-Based Banking

risk profile. The board of directors must carefully consider how exten-
sive the audit program must be to effectively test and monitor internal
controls and ensure the reliability of the bank’s financial statements and
reporting.
The board of directors must strive to ensure that the bank’s audit sys-
tem is efficiently capable to test internal controls in order to be able to
identify:

&Inaccurate, incomplete, or unauthorized transactions

&Deficiencies in the safeguarding of bank assets

&Unreliable financial and/or regulatory reporting

&Violations of laws and/or regulations

&Deviations from the bank’s policies and procedures

The board of directors is expected to do its best to be aware of all risks
and control issues for the bank’s operations, including risks in new prod-
ucts, emerging technologies, information systems, and Internet banking.
Control issues and risks associated with increasing reliance on technology
include:

&Increased user access to information systems

&Reduced segregation of duties

&Potential unidentifiable errors resulting from the shift of operations

from paper to electronic audit trails

&Lack of standards and controls for end-user systems

&Increased complexity of contingency plans and information system re-

covery plans

Engagement Letter for External Auditors

In its efforts to prudently identify the most capable auditing entities for its
various audits, the bank’s board of directors must invite and request exter-
nal auditors to submit engagement letters before commencing audit work.
Such a letter will be expected to reflect preliminary discussions between the
bank’s board and/or senior management and the external auditor(s).
The engagement letter(s) will stipulate, among other things, the audit’s
purpose, its scope, the period to be covered, and the reports the auditor will
develop. Schedules or appendixes may accompany the letter to provide the
board with more details of the proposed audit. The letter may briefly de-
scribe procedures to be used in specific areas. If the scope of the audit is
limited in any way, the letter may specify procedures that the auditor will
omit. Additionally, the letter would specify if the auditor were expected to

Starting an RF Bank in the United States 309