Audit response is the work of providing documents, answering questions, and fixing and tracking the findings raised. Derivatives valuation, risk management reporting and limits, settlement, and systems are business areas that the supervisory guidelines and similar sources list as points checked by internal audit and in inspections by the authorities.

How internal audit, external audit, and inspections and examinations differ

The audits a financial institution undergoes fall into three kinds: internal audit, external audit, and supervisory examinations by the authorities. Among the authorities, the supervisory examination by the Financial Services Agency (FSA) is called an inspection (kensa), and that by the Bank of Japan (BOJ) is called an examination (kosa). The single word "audit" is used only when referring to all three together.

Kind Performed by Basis What it checks
Internal audit An internal audit unit independent of the units it audits The Comprehensive Guidelines for Supervision of Financial Instruments Business Operators, etc. (the FSA's supervisory guidelines for financial instruments business operators) require management to set up a structure in which the internal audit unit can perform its function, and to approve the basic matters of the internal audit plan1 How business is carried out, and whether internal management and internal controls are appropriate, effective, and reasonable2
External audit A certified public accountant or an audit firm The Financial Instruments and Exchange Act requires an audit certification of the financial statements and the internal control report that listed companies and others file3 Whether the financial statements contain material misstatements. The auditor audits after understanding the company and its environment, including internal control4
FSA inspection The FSA For banks, Article 25 of the Banking Act5. For financial instruments business operators, etc., Article 56-2 of the Financial Instruments and Exchange Act6 The state of business and assets, the compliance framework, and the risk management frameworks7
BOJ examination The Bank of Japan An examination contract with the financial institution that is its counterparty (Article 44 of the Bank of Japan Act)8 The state of business and assets, and the risk management frameworks. It focuses on credit risk, market risk, liquidity risk, operational risk, and others8

Inspections and examinations differ in legal standing. An FSA inspection is carried out as an administrative authority with the power to enter premises and to demand documents7. In an inspection of a bank, failing to answer questions, giving a false answer, or refusing the inspection is punishable under the Banking Act by imprisonment for up to 1 year or a fine of up to 3 million yen9. A BOJ examination rests on a contract, so there is no statutory penalty. If a financial institution refuses an examination or a request for information without a legitimate reason, however, the BOJ may make that fact public, and it may also terminate current account transactions and similar arrangements710. The results of an individual examination are not published, because the BOJ is bound by a duty of confidentiality8.

Internal audit is carried out from a position independent of the audited units, so that it acts as a check on them2. The Board of Governors of the Federal Reserve System (FRB) publishes an examination manual (the "FRB manual" below). Its February 1998 section says the internal audit unit is separated, both organizationally and functionally, from the management and supervision of the trading units, and reports to the board of directors11.

Internal audit is the third line of the three lines model. Verifying compliance is in principle the job of the first and second lines within their own operations. The third line independently and objectively checks whether the controls are sound, taking into account the state and results of that verification12. The three lines model and segregation of duties are covered in Front, Middle and Back Office Roles.

The flow of undergoing inspections and examinations

The basic procedure for on-site inspections carried out by the FSA is set out in the annex "Basic Procedures for On-Site Inspections" to the Comprehensive Guidelines for Supervision of Major Banks, etc. (the FSA's supervisory guidelines for major banks). It is important that both the inspectors and the inspected financial institution understand the procedures and carry them out in accordance with due process13.

FSAInstitutionIn principle,announce in advanceand ask for documentsExplain the basis,verification scope,and so onAn officer withrepresentativepower consentsRequestdocuments andask questionsProvide documentsand answerquestionsCheck the factsand hear theinstitution's viewDeliver the noticeof inspectionresults, etc.Request a reportunder Article 24of the Banking ActReport themattersrequested
Figure 1Exchanges between the FSA and the institution in an FSA on-site inspection
Figure description

The FSA proceeds from the advance notice and the request for documents to the delivery of the notice of inspection results, etc., and the institution responds with the consent of an officer, the provision of documents, and answers to questions. For a bank that received a notice, the FSA finally requests a report under Article 24 of the Banking Act, and the bank reports.

  1. Advance notice and request for documents in advance. An on-site inspection is in principle announced before it begins. When it is necessary to confirm actual conditions, an inspection can also be carried out without notice14. After the notice, the chief inspector explains the content of the documents requested in advance and their deadline14.
  2. Explanation of key matters. The chief inspector explains the basis of the on-site inspection, the start date, the list of inspectors, the main scope of verification, and similar matters, and obtains the consent of an officer with the power to represent the institution by the first day of the on-site inspection. If there was no notice, this is done promptly after the on-site inspection begins15.
  3. On-site inspection. Inspectors request documents and question officers and employees as needed16. When necessary, they go to the premises where business is carried out, and extract and read original documents16. When they point out a problem and confirm the institution's understanding of it, they in principle use a written document16.
  4. Exit meeting at the end of the on-site inspection. The chief inspector checks with officers that there is no difference in understanding of the facts established, and hears the institution's view on the problems. The final view is in principle given in the notice of inspection results and similar documents17.
  5. Delivery of the notice of inspection results and similar documents. The FSA delivers one of the notice of inspection results, the supervisory findings, or a feedback letter, depending on how serious the problems are18.

The FSA does not carry out on-site inspections at fixed intervals. It treats them as one of its monitoring methods. Depending on the issue, it chooses an efficient and effective method from interviews, voluntary requests for documents, requests for reports under Article 24 of the Banking Act, and on-site inspections19. For that reason, the occasions on which a bank provides documents are not limited to on-site inspections.

The BOJ's examination was described in a June 2013 BOJ article as three stages: preparation, on-site visit, and wrap-up. In the example of a regular examination, the BOJ spends about 3 weeks analyzing documents the financial institution submitted in advance, and then visits on site for 2 to 3 weeks (roughly 13 business days). After the visit, the head of the examination meets the institution's top management, conveys the results, and urges improvements10. The BOJ applies for the examination by stating its timing and purpose, and notifies the institution in advance of the names and titles of the examiners10.

Preparing documents, submitting data, and answering questions

In an FSA inspection, the documents submitted are in principle the institution's existing documents. The documents requested in advance are limited to what is needed, and documents collected through day-to-day monitoring are also used. Even when documents other than existing ones are requested, the format is not specified as long as they contain the required content. The deadline is set with regard to the institution's capacity to respond and its administrative burden1416. Questions and requests for documents are in principle made during the institution's business hours20.

An inspection may include an exchange of views with the external auditor. It takes place at the chief inspector's discretion or at the external auditor's request, with the consent of the financial institution and the external auditor, and before the exchange the inspector checks that the external auditor's duty of confidentiality has been lifted21. Sharing the notice of inspection results and the documents collected in the inspection with the BOJ is also among the matters explained before the on-site inspection22.

In an external audit, the auditor obtains written confirmation from management on points such as that management is responsible for preparing the financial statements, the accounting policies management adopted, and that management has provided all the materials needed for the audit (the auditing standards as revised in November 2020)23. For accounting estimates, the auditor evaluates the estimation method management used, including its methods, assumptions, and data24.

Internal audit audits the audited units according to the internal audit plan2. Under the Basel Committee on Banking Supervision's 1998 principles, it is essential that internal audit have access to all of a banking organization's activities, including its branches and subsidiaries25.

Responding to findings and tracking improvement

What is required after a finding depends on the kind of audit.

Audit What is required after a finding
Internal audit The internal audit unit reports the important matters it has pointed out to the representative director and the board of directors without delay, and keeps track of how the findings are being improved28. It manages the audited unit's progress on improvement and reflects it in later internal audit plans29
External audit Important matters identified or pointed out in an external audit are reported to the board of directors or the board of company auditors without delay. The audited unit improves on the findings within a set period, and the internal audit unit keeps track of and verifies the progress30
FSA inspection When the FSA has delivered a notice of inspection results, it in principle asks the bank for a report within 1 week of the delivery date. What it asks for includes confirmation of the facts of the findings, analysis of the causes, and improvement and response measures, and the request is based on Article 24 of the Banking Act. The deadline for the report is within 1 month. The matters to be reported are set individually according to the content of the finding31
BOJ examination The BOJ conveys the results of the examination and urges improvement (June 2013 article)10

Consider a hypothetical example in which the internal audit unit of Bank M checks whether the valuations given to clients agree with the values from an independent pricing model or with internal mark-to-market valuations, and finds a material difference32. The unit reports this important matter to the representative director and the board of directors without delay, and keeps track of how it is being improved28. If an FSA inspection points out the same difference and a notice of inspection results is delivered, the FSA in principle asks for a report within 1 week of the delivery date, under Article 24 of the Banking Act. It asks for items such as confirmation of the facts, analysis of the causes, and improvement and response measures; the deadline is within 1 month, and the matters to be reported are set individually according to the content of the finding31. In internal audit, the path the sources describe is a report to management and follow-up on improvement; in an inspection, it is a report to the authority.

The tracking arrangements are described in the Basel Committee on Banking Supervision's 1998 principles as follows. Internal control deficiencies are reported to the appropriate staff as soon as they are identified, and serious ones are reported to senior management and the board of directors. Internal auditors, through follow-up reviews and similar means, immediately inform senior management or the board of directors of deficiencies that have not been corrected. Senior management is responsible for building a system to track weaknesses and corrective actions33. The February 1998 section of the FRB manual likewise says that management reviews responses to internal audit findings and auditors follow up to confirm that deficiencies have actually been corrected34.

In its March 1999 section, the FRB manual says that, for internal audit of foreign exchange settlement, management responds to the internal audit report in writing and sets out the planned corrective action. When a finding points to room for improvement in foreign exchange settlement, the units that it affects are also to be informed, such as credit management, reconciliation and accounting, systems development, and management information systems35.

When tracking fails, internal audit loses its effect. For banks where internal audit was not effective, the Basel Committee summarizes the cause as a combination of fragmented audits, a lack of understanding of business processes, and inappropriate follow-up when problems were recognized. Effectiveness also falls when management does not follow up properly on findings, and when senior management or the board of directors does not receive timely progress reports on serious problems and corrective measures36.

Derivatives business that audits check

The table below lists the derivatives business that the supervisory guidelines and similar sources give as a point to check in internal audit or inspections. The supervisory guidelines for major banks cover banks, the supervisory guidelines for financial instruments business operators cover financial instruments business operators, etc., and the FRB manual covers US financial institutions. The sections of the manual (1998 to 2003) are old and do not describe present practice as it is.

Area Points to check Source and date
Operations control (reconciliation, approval, and others) In internal audit of back-office operations, manual processes, complex automated calculations, independent revaluation, key reconciliations, and approval processes may be listed as key points of risk34. The internal audit unit audits the framework for managing operational risk38 The FRB manual (February 1998); the supervisory guidelines for financial instruments business operators (October 2026)
Valuation For banks that manage trading transactions subject to market risk regulation, the transactions covered by the trading book and the way they are managed must be set out in a document. Regular internal audit must confirm that operations follow that document. The valuation method and its operation are also points to check in internal audit and accounting audit39. Internal audit may also look at whether the valuations given to clients agree with the values from an independent pricing model or with internal mark-to-market valuations32 The supervisory guidelines for major banks (October 2026); the FRB manual (April 2003)
Risk management reporting and limits Internal auditors verify compliance with limits and assess the reliability and timeliness of the information reported to management and the board of directors. They also assess the independence of the risk management unit and its overall effectiveness. Even when audits are good, examiners test the revaluation process, credit approvals, and compliance with limits themselves40 The FRB manual (February 1998)
Segregation of duties and data integrity Internal audit conducts a comprehensive review of risk management every year, with emphasis on verifying segregation of duties and data integrity. When many new products or models have been introduced, it adds testing41 The FRB manual (February 1998)
Foreign exchange settlement The settlement unit has an adequate scope of internal audit, and the scope and frequency of internal audit are commensurate with settlement risk35 The FRB manual (March 1999)
Counterparty credit risk management As part of the regular audit program, internal audit checks the integrity of the credit management information system42 The FRB manual (April 2003)
Systems Whether an internal audit unit independent of the systems department conducts system audits regularly27 The supervisory guidelines for major banks (October 2026)

The frequency and scope of internal audit differ by financial institution. Under the Basel Committee's 1998 principles, the frequency and scope of internal audit should be consistent with the nature, complexity, and risk of the business43. Practices required of one financial institution may be unnecessary for another44.

Notes

  1. Financial Services Agency, "金融商品取引業者等向けの総合的な監督指針" (Comprehensive Guidelines for Supervision of Financial Instruments Business Operators, etc.) (October 2026), III-1(1), ①ハ (page 45) and ②ト (page 46) (in Japanese). ↩

  2. Financial Services Agency, "金融商品取引業者等向けの総合的な監督指針" (Comprehensive Guidelines for Supervision of Financial Instruments Business Operators, etc.) (October 2026), III-1(1)④, main text and sub-items イ, ロ, and ハ (pages 46–47) (in Japanese). ↩ ↩2 ↩3

  3. "金融商品取引法" (Financial Instruments and Exchange Act, in Japanese; English translation: Japanese Law Translation), Article 193-2, paragraph 1 (documents on financial calculations) and paragraph 2 (internal control reports). ↩

  4. Business Accounting Council, "監査基準の改訂に関する意見書" (Opinion on the revision of auditing standards, our translation) (November 6, 2020), the Auditing Standards attached to it, III Standards of Fieldwork, 1, items 1 and 2 (page 7) (in Japanese). ↩

  5. "銀行法" (Banking Act, in Japanese; English translation: Japanese Law Translation), Article 25, paragraph 1 (entry into a bank's business offices and similar premises, questions on the state of business and assets, and inspection of books, documents, and other items). ↩

  6. "金融商品取引法" (Financial Instruments and Exchange Act, in Japanese; English translation: Japanese Law Translation), Article 56-2, paragraph 1 (orders to financial instruments business operators, etc. to submit reports or materials, and inspection of books, documents, and other items). ↩

  7. Bank of Japan, "日本銀行の考査と金融庁の検査との違いは何ですか？" (What is the difference between the Bank of Japan's examinations and the Financial Services Agency's inspections?), 教えて！にちぎん (in Japanese). ↩ ↩2 ↩3

  8. Bank of Japan, "考査とは何ですか？" (What is an examination?), 教えて！にちぎん (in Japanese). The examination contract under Article 44 of the Bank of Japan Act, the risks the examination focuses on (note), and the reason individual examination results are not published (the examination contract and the duty of confidentiality under Article 29 of the Bank of Japan Act). ↩ ↩2 ↩3

  9. "銀行法" (Banking Act, in Japanese; English translation: Japanese Law Translation), Article 63, item 3 (failing to answer a question under Article 25, paragraph 1, giving a false answer, or refusing, obstructing, or evading an inspection). ↩

  10. Bank of Japan, "日本銀行金融機構局「考査」の仕事 金融機関の健全な経営を支える" (The work of examination at the Bank of Japan's Financial System and Bank Examination Department: supporting the sound management of financial institutions) (published June 25, 2013) (in Japanese). That there is no statutory penalty, the advance application and notice of the examiners, the three stages of an examination and their duration, and the conveying of results and urging of improvement. ↩ ↩2 ↩3 ↩4

  11. Board of Governors of the Federal Reserve System, "Trading and Capital-Markets Activities Manual," Section 1010.1 "Organizational Structure" (February 1998), page 4. ↩

  12. Financial Services Agency, "金融機関の内部監査高度化に関する懇談会 報告書（2025）" (Report of the Panel on Advancing Internal Audit at Financial Institutions (2025), our translation) (June 2025), page 11 (explanation of the first stage) and page 20 (building the three lines model) (in Japanese). ↩

  13. Financial Services Agency, "主要行等向けの総合的な監督指針" (Comprehensive Guidelines for Supervision of Major Banks, etc.) (October 2026), Annex 2 "立入検査の基本的手続" (Basic Procedures for On-Site Inspections), page 1 (in Japanese). ↩

  14. The same guidelines, Annex 2, 1 "立入検査開始前" (Before the on-site inspection begins), (1) advance notice (page 1) and (3) points to note when requesting documents in advance (pages 1–2) (in Japanese). ↩ ↩2 ↩3

  15. The same guidelines, Annex 2, 1(4)① (page 2), and Annex 2-2 "重要事項一覧" (List of key matters), 1 (page 9) (in Japanese). ↩

  16. The same guidelines, Annex 2, 2 "立入検査中" (During the on-site inspection), (3) points to note when requesting documents, (4) verification ②, and (5) on-site survey (pages 3–4) (in Japanese). ↩ ↩2 ↩3 ↩4

  17. The same guidelines, Annex 2, 2(6) procedures at the end of the on-site inspection (pages 4–5) (in Japanese). ↩

  18. The same guidelines, Annex 2, 3(1) delivery of the notice of inspection results and similar documents (pages 5–6) (in Japanese). ↩

  19. The same guidelines, II-1-2(1), (2)①ロ, and (2)② (pages 10–13) (in Japanese). ↩

  20. The same guidelines, Annex 2, 2(8)④ (page 5) (in Japanese). ↩

  21. The same guidelines, Annex 2, 2(2) exchange of views with the external auditor (accounting auditor) (pages 2–3) (in Japanese). ↩

  22. The same guidelines, Annex 2-2 "重要事項一覧" (List of key matters), 4(2) (page 9) (in Japanese). ↩

  23. Business Accounting Council, "監査基準の改訂に関する意見書" (Opinion on the revision of auditing standards, our translation) (November 6, 2020), the Auditing Standards attached to it, III Standards of Fieldwork, 3, item 9 (page 9) (in Japanese). ↩

  24. Business Accounting Council, "監査基準の改訂に関する意見書" (Opinion on the revision of auditing standards, our translation) (November 6, 2020), the Auditing Standards attached to it, III Standards of Fieldwork, 3, item 5 (page 9) (in Japanese). ↩

  25. Basel Committee on Banking Supervision, "銀行組織における内部管理体制のフレームワーク" (A framework for internal control systems in banking organizations; provisional translation by the Financial Services Agency) (September 1998), Principle 11 and paragraph 40 of the main text (in Japanese). ↩

  26. Financial Services Agency, "主要行等向けの総合的な監督指針" (Comprehensive Guidelines for Supervision of Major Banks, etc.) (October 2026), Annex 2, 2(5)④ (page 4) (in Japanese). ↩

  27. The same guidelines, III-3-7-1-2(7)① to ④ (page 266) (in Japanese). ↩ ↩2

  28. The same guidelines, III-1-2-1(5)③ (page 51) (in Japanese). ↩ ↩2

  29. Financial Services Agency, "金融商品取引業者等向けの総合的な監督指針" (Comprehensive Guidelines for Supervision of Financial Instruments Business Operators, etc.) (October 2026), III-1(1)④, sub-items ニ and ホ (page 47) (in Japanese). ↩

  30. Financial Services Agency, "金融商品取引業者等向けの総合的な監督指針" (Comprehensive Guidelines for Supervision of Financial Instruments Business Operators, etc.) (October 2026), III-1(1)⑤, sub-items イ and ロ (page 47) (in Japanese). ↩

  31. Financial Services Agency, "主要行等向けの総合的な監督指針" (Comprehensive Guidelines for Supervision of Major Banks, etc.) (October 2026), II-1-2(2)②ニ (page 13) (in Japanese). ↩ ↩2

  32. Board of Governors of the Federal Reserve System, "Trading and Capital-Markets Activities Manual," Section 2100.1 "Financial Performance" (April 2003), page 10. ↩ ↩2

  33. Basel Committee on Banking Supervision, "銀行組織における内部管理体制のフレームワーク" (provisional translation by the Financial Services Agency) (September 1998), Principle 12 and paragraph 43 of the main text (in Japanese). ↩

  34. Board of Governors of the Federal Reserve System, "Trading and Capital-Markets Activities Manual," Section 2060.1 "Operations and Systems Risk (Back-Office Operations)" (February 1998), "AUDITS," page 7. ↩ ↩2

  35. The same manual, Section 2021.1 "Counterparty Credit Risk and Settlement Risk" (March 1999), "Internal Audit," pages 4–5. ↩ ↩2

  36. Basel Committee on Banking Supervision, "銀行組織における内部管理体制のフレームワーク" (provisional translation by the Financial Services Agency) (September 1998), Appendix II (supervisory lessons from cases of internal control failure), E, paragraphs 13 and 15 (in Japanese). ↩

  37. Financial Services Agency, "主要行等向けの総合的な監督指針" (Comprehensive Guidelines for Supervision of Major Banks, etc.) (October 2026), III-1-3(2)② (page 64) (in Japanese). ↩

  38. Financial Services Agency, "金融商品取引業者等向けの総合的な監督指針" (Comprehensive Guidelines for Supervision of Financial Instruments Business Operators, etc.) (October 2026), III-2-7(1)①ニ (page 77) (in Japanese). ↩

  39. Financial Services Agency, "主要行等向けの総合的な監督指針" (Comprehensive Guidelines for Supervision of Major Banks, etc.) (October 2026), III-2-1-2-3(1) (page 88) (in Japanese). Institutions newly subject to the regulation are excluded. ↩

  40. Board of Governors of the Federal Reserve System, "Trading and Capital-Markets Activities Manual," Section 2000.1 (February 1998), "Internal Controls and Audits," page 5. ↩

  41. The same manual, Section 2000.1, page 6, "SOUND PRACTICES," the item "Auditors should perform a comprehensive review of risk management annually." ↩

  42. The same manual, Section 2020.1 "Counterparty Credit Risk and Presettlement Risk" (April 2003), page 14. ↩

  43. Basel Committee on Banking Supervision, "銀行組織における内部管理体制のフレームワーク" (provisional translation by the Financial Services Agency) (September 1998), paragraph 41 of the main text (in Japanese). ↩

  44. Board of Governors of the Federal Reserve System, "Trading and Capital-Markets Activities Manual," Section 2060.1 (February 1998), page 7, the opening of "SOUND PRACTICES FOR BACK-OFFICE OPERATIONS." ↩