Internal Audit Officer
Independent, risk-based assurance over governance, risk and control processes. Annual audit planning, field work, findings tracking, and reporting to the management board in line with MaRisk BT 2 and IIA standards.
§ 25a KWG · MaRisk BT 2 · IIA Standards (IPPF)
Talk to us about Internal Audit Officer
Three lines and you are in our inbox. We reply within one business day.
What does an Internal Audit Officer do?
An Internal Audit Officer leads an independent, risk-based assurance function that examines whether an organisation's governance, risk management and internal controls work as intended. In regulated financial institutions the function is mandated by the requirement for a proper business organisation under Sec. 25a of the German Banking Act (Kreditwesengesetz, KWG) and shaped in detail by the Minimum Requirements for Risk Management (MaRisk), specifically module BT 2 on the internal audit function (Interne Revision, the German term for internal audit). Internationally the work follows the standards of the Institute of Internal Auditors set out in the International Professional Practices Framework (IIA Standards, IPPF).
Outside the supervised sector the picture changes. No general statutory duty to appoint an internal audit officer applies. Comparable requirements exist for insurers and investment firms under their own supervisory regimes, and many large or listed companies run the function as a matter of corporate governance, on the basis of a board decision, the articles of association, or a commitment given to lenders and shareholders. The mandate then comes from the audit charter rather than from a statute, which makes its wording on scope, resourcing and reporting line all the more load-bearing.
The officer prepares a multi-year and annual audit plan that allocates audit effort according to the institution's risk profile, as MaRisk BT 2 requires, and ensures that all material activities and processes are audited within an appropriate cycle. They lead the fieldwork: examining processes, testing controls, gathering evidence and forming an objective judgement. Findings are documented with an agreed severity, a responsible owner and a remediation deadline, and the officer tracks them through to closure, satisfying themselves that the measure worked rather than that it was reported as done.
Independence and objectivity are central: the function reports directly to the management board, has unrestricted information and audit rights, and must be free of conflicts that would impair its judgement, as both MaRisk BT 2 and the IIA Standards demand. The officer reports findings and the overall control assessment to the board and, where required, to the supervisory authority, and follows up on the implementation of measures. Weaknesses seen in reviews are a plan that leaves parts of the business uncovered for years, findings closed without evidence, and audit work carried out in areas the auditor previously ran.
Core duties of the Internal Audit Officer
- Prepare a risk-based multi-year and annual audit plan as required by MaRisk BT 2.
- Ensure all material activities and processes are audited within an appropriate cycle.
- Lead fieldwork: examine processes, test controls and gather sufficient, reliable evidence.
- Document findings with severity, responsible owner and remediation deadline.
- Track findings through to closure and verify that agreed measures are effective.
- Report findings and the overall control assessment to the management board.
- Maintain independence and objectivity as required by MaRisk BT 2 and the IIA Standards.
- Carry out special and ad-hoc audits at the request of the board or supervisory authority.
- Operate a quality assurance and improvement programme for the audit function per the IIA Standards.
- Report to the supervisory authority where required and support external audit and inspections.
When is an Internal Audit function required?
For credit institutions and financial services institutions, an internal audit function is a mandatory element of the proper business organisation demanded by Sec. 25a (1) KWG, and MaRisk BT 2 specifies how it must be set up: as a process-independent function reporting directly to the management board, with unrestricted audit and information rights and a risk-based plan covering all activities and processes. The board carries overall responsibility but must equip the function with adequate resources and staff with the necessary expertise.
The head of internal audit must be qualified and the function staffed so that it can audit all material areas within an appropriate multi-year cycle. The IIA Standards add professional requirements such as independence, objectivity, due professional care and an external quality assessment at defined intervals. Outside the banking sector, comparable requirements apply to insurers and to investment firms under their own supervisory regimes, and many large or listed companies maintain an internal audit function as part of good corporate governance even without a sector mandate. The appointment, mandate and reporting lines should be documented in an audit charter approved by the board.
- Credit or financial services institution under Sec. 25a KWG
- Internal audit requirements of MaRisk BT 2
- Comparable supervisory regimes for insurers and investment firms
- Adoption of the IIA Standards (IPPF) as the professional framework
- External quality assessment obligation under the IIA Standards
- Corporate governance expectation in large or listed companies
Sectors that appoint an Internal Audit Officer
- Banks and credit institutions
- Financial services and investment firms
- Insurance companies
- Asset and fund management
- Payment and e-money institutions
- Listed corporations
- Public-sector bodies and utilities
- Large industrial groups
- Healthcare and pension organisations
How CIVAC supports the Internal Audit Officer role
CIVAC holds the internal audit function as its own role file: the appointment, the mandate, the reporting line to management and the deputy arrangement sit in one place, and role administration shows who has held the function since when. Task templates cover the recurring rhythm of plan preparation, audit milestones, findings follow-up and reporting, each as a scheduled task with a reminder before it falls due.
The documentation area keeps the audit charter, the audit plan, working papers, findings and the quality assurance programme the IIA Standards call for. The append-only audit trail records when a finding was raised, who owns it and when it was closed, the follow-up MaRisk BT 2 expects of a banking audit function. Training on standards and methods is evidenced per person, and a deputy is on file for holiday, sickness and staff changes, with the handover starting from the same records. An organisation that cannot staff the function internally can have an external officer appointed through CIVAC, at 49 euros per role per month. The data is held in the EU.
Frequently asked questions
Need this officer role for your organisation?
Appoint our experts as your external officer or license CIVAC for your in-house team. Get in touch and we walk you through the right setup.