A liquidity risk management audit tests whether a bank can see its cash position, project it under stress, hold enough that can actually be turned into money on the day it is needed, and act fast enough when the projection goes wrong. After March 2023, when Silicon Valley Bank lost 42 billion dollars of deposits in a single day and was closed the next morning, every examiner, audit committee and chief audit executive wants that question answered with evidence rather than with a policy summary. This guide is the engagement-level program for answering it: how to scope the audit by bank size and regulatory category, the risk and control matrix that underpins it, sixteen tests with the evidence each one needs, the metrics the auditor rebuilds from source rather than accepts from the pack, the findings that recur, and a worked example at an illustrative 62-billion-dollar regional bank.
It assumes the reader knows what liquidity risk is. If not, start with the liquidity risk pillar for the concepts, metrics and regulatory framework, and the liquidity stress testing guide for scenario design; this guide is about testing the management of the risk, not explaining it. For the related balance sheet risk that shares the same committee, see the interest rate risk pillar, and for treasury as a whole, the how to audit treasury program.
In this guide
- Scoping the audit: what changes with size and category
- Where liquidity sits in the audit universe and plan
- The risk and control matrix: twelve controls that carry the framework
- The sixteen-test program
- The metrics the auditor rebuilds from source
- Testing the assumptions: deposits, collateral and the discount window
- Reporting: what ALCO and the board should see
- The findings that recur, with wording that lands
- Worked example: Thornwick Bank’s FY27 liquidity audit
- Frequently asked questions
- Related guides
Scoping the audit: what changes with size and category
The same question, can the bank fund itself under stress, is answered with very different machinery at a two-billion-dollar community bank and a three-hundred-billion-dollar Category III firm, and the audit scope has to match the machinery that exists and the rules that apply. In the United States the regulatory architecture is tiered. The 2010 Interagency Policy Statement on Funding and Liquidity Risk Management applies to every insured institution and sets the baseline: board-approved tolerance, cash flow projections, stress testing, a liquidity buffer, a contingency funding plan and independent review. The July 2023 addendum from the Federal Reserve, FDIC, OCC and NCUA added explicit expectations about contingency funding plans and discount window readiness after the spring 2023 failures. The Liquidity Coverage Ratio rule (2014) and the Net Stable Funding Ratio rule (2021) apply by category under the 2019 tailoring framework: the full ratios for Category I and II firms, reduced ratios for Category III and for Category IV firms with significant weighted short-term wholesale funding, and none for firms below 100 billion dollars. Regulation YY adds internal liquidity stress testing, buffer and governance requirements for firms at or above 100 billion dollars, with monthly testing for Categories I to III and quarterly for Category IV, and the FR 2052a complex institution liquidity monitoring report provides the data supervisors use to check all of it.
| Bank profile | Rules that apply | What the framework usually looks like | Scope emphasis for the audit |
|---|---|---|---|
| Community bank (under 10bn) | 2010 Policy Statement; 2023 CFP addendum; examiner guidance | Spreadsheet cash flow projection, a simple stress test, a CFP, FHLB and brokered funding as backstops | Projection accuracy, buffer composition, FHLB capacity and collateral, whether the discount window has ever been tested, uninsured deposit concentration |
| Regional bank (10bn to 100bn) | Policy Statement and addendum; no LCR or NSFR; heightened examiner expectations since 2023 | ALM system with liquidity module, monthly stress tests, formal CFP, early-warning indicators, often a voluntary LCR estimate | Stress test assumptions and governance, deposit segmentation, collateral management, intraday, the voluntary LCR if reported to the board, data lineage |
| Category IV (100bn to 250bn) | Reg YY liquidity (quarterly ILST, buffer, governance); reduced LCR and NSFR where wSTWF is significant; FR 2052a monthly | Dedicated liquidity risk function, documented ILST methodology, HQLA buffer sized to the 30-day stress, 2052a production process | ILST methodology and model governance, buffer calculation and eligibility, 2052a accuracy, Reg YY governance evidence (board review, independent review) |
| Category I to III (250bn and above, or systemically important) | Full or reduced LCR and NSFR; monthly ILST at four horizons; daily 2052a; resolution liquidity (RLAP, RLEN) | Industrial-scale liquidity management: intraday monitoring, legal-entity and currency views, resolution liquidity frameworks, model inventory | Model validation, legal-entity trapped liquidity, intraday, resolution liquidity, the independent review requirement in Reg YY, regulatory reporting controls |
Three scoping decisions follow. First, decide whether the engagement is a framework audit (governance, measurement, limits, CFP, reporting) or a targeted audit of one component (the stress test model, the 2052a report, intraday liquidity, collateral). The framework audit at a regional bank runs 400 to 700 hours; a 2052a accuracy audit at a Category II firm can run that on its own. Second, decide the entity view: consolidated, lead bank, each material legal entity, each currency. Trapped liquidity in a subsidiary that cannot be upstreamed is a classic finding at larger firms and invisible in a consolidated view. Third, agree with the second line what internal audit will rely on and what it will reperform; the assurance over ERM guide covers reliance mechanics, and the rule for liquidity is that the auditor reperforms the measures that bind (the stress test result, the buffer, the ratio) rather than relying on the function that produces them.
Where liquidity sits in the audit universe and plan
Liquidity risk management is usually a single auditable entity in a bank’s universe, rated high inherent risk at every size, with an audit cycle of one to two years and a continuous-monitoring layer between audits. The bank audit universe example shows it among roughly forty entities, sitting beside interest rate risk management, capital planning, treasury operations and regulatory reporting, with which it shares controls and people. Two planning points matter. Examiners expect internal audit’s coverage of liquidity to be explicit: Regulation YY requires independent review of the liquidity risk management process at least annually for covered firms, and the 2010 Policy Statement expects independent review at every institution, so the plan should name the engagement and the review should be documented as covering the elements the regulation lists. And the engagement is one of the few where the audit function’s own continuous monitoring, built on the ALCO pack, can replace part of the fieldwork: a quarterly read of survival horizon, buffer composition, uninsured deposit share, wholesale funding concentration and limit utilisation, set up as indicators under the KRI program guide, tells the function when to pull the audit forward.
The risk and control matrix: twelve controls that carry the framework
The risk and control matrix for a liquidity audit is short, because the framework rests on a dozen controls, and the hard part is testing them properly rather than listing them. The RCM template guide covers the columns; this table fills them for liquidity. Each control is numbered for the program that follows.
| # | Risk | Control | Owner | Type and frequency | Key evidence |
|---|---|---|---|---|---|
| L1 | The bank tolerates more liquidity risk than the board understands | Board-approved liquidity risk appetite with quantitative limits (survival horizon, buffer, concentration, ratios) reviewed annually | Board / CRO | Governance, annual | Appetite statement, board minutes, limit framework |
| L2 | Cash flow projections are wrong | Daily or weekly cash flow projection reconciled to actuals with variance analysis | Treasury | Detective, daily/weekly | Projection reports, back-testing, variance explanations |
| L3 | Stress tests understate outflows | Documented stress testing methodology with approved scenarios, assumptions and horizons; results reviewed by ALCO | Liquidity risk / treasury | Preventive, monthly or quarterly | Methodology document, assumption register, ALCO minutes |
| L4 | Assumptions drift from reality | Annual review and back-test of behavioural assumptions (deposit run-off, line draws, collateral haircuts) with change control | Liquidity risk | Detective, annual | Back-test results, assumption change log, approvals |
| L5 | The buffer is smaller or less liquid than reported | Buffer composition and eligibility checked against policy; unencumbered status verified; haircuts applied | Treasury / liquidity risk | Detective, daily | Buffer report, custody and pledging records, eligibility criteria |
| L6 | Contingent funding is unavailable when needed | Contingency funding plan tested annually: FHLB and discount window capacity confirmed, collateral pre-positioned, test draws executed | Treasury | Preventive, annual with evidence | CFP, test draw records, collateral schedules, borrowing capacity letters |
| L7 | Intraday shortfalls occur unnoticed | Intraday liquidity monitoring with thresholds and escalation | Treasury operations | Detective, intraday | Intraday reports, breach log |
| L8 | Limits are breached without action | Limit monitoring against each report with escalation per policy and documented decisions | Liquidity risk | Detective, per report | Limit utilisation history, breach log, exception approvals |
| L9 | Regulatory ratios and reports are wrong | LCR, NSFR and FR 2052a produced under documented procedures with reconciliations, independent review and change control | Regulatory reporting | Preventive, per submission | Procedures, reconciliations, review sign-offs, edit checks |
| L10 | Funding concentrations build unseen | Concentration limits by source, counterparty, product and tenor; uninsured deposit monitoring | Liquidity risk | Detective, monthly | Concentration reports, deposit segmentation analysis |
| L11 | Models are unvalidated | Liquidity models in the model inventory with validation, ongoing monitoring and documented limitations | Model risk management | Preventive, per validation cycle | Inventory, validation reports, open findings |
| L12 | Decision makers do not see the risk | ALCO and board reporting that shows the level and trend of exposure, limit status, stress results and assumption changes | Liquidity risk / CFO | Detective, monthly and quarterly | ALCO pack, board pack, minutes |
The sixteen-test program
The program below maps to the controls above and adds the substantive tests that an examiner would run. It is written for a framework audit at a regional bank; the scoping table shows what to add or drop at other sizes. Sample sizes follow the conventions in the sample sizes guide; where a population is small (twelve monthly stress tests, four quarterly board packs) test all of them.
| Test | Objective | Procedure | Evidence and sample | Control |
|---|---|---|---|---|
| 1. Appetite and limits | Limits exist for every material liquidity exposure and tie to the board’s stated tolerance | Read the appetite statement; map each limit to the metric that measures it; confirm annual review and that limits cover survival horizon, buffer, concentration and any applicable ratio | Appetite statement, limit framework, board minutes for the last two reviews | L1 |
| 2. Governance evidence | The committee structure works as the policy says | Read twelve months of ALCO minutes and four quarters of board risk committee minutes; trace three decisions (a limit change, an exception, a CFP action) from proposal to approval | Minutes, charters, attendance records | L1, L12 |
| 3. Cash flow projection accuracy | The short-term projection is reliable | Select 20 projection dates across the year; compare projected to actual net cash flow at 1, 7 and 30 days; investigate variances above the bank’s tolerance | Projection reports and actuals; variance explanations | L2 |
| 4. Stress test methodology | Scenarios and horizons meet policy and regulation | Read the methodology; confirm idiosyncratic, market-wide and combined scenarios; confirm horizons (overnight, 30, 90 days, one year where required); confirm the severity reflects the 2023 experience | Methodology document, scenario library | L3 |
| 5. Stress test reperformance | The reported result is right | Reperform the binding scenario for one month: re-apply run-off and draw assumptions to the balance sheet by segment; recompute inflows, outflows and the survival horizon; compare to the reported result | Balance sheet extract, assumption register, model output | L3 |
| 6. Assumption back-test | Assumptions reflect the bank’s own experience | Compare assumed deposit run-off by segment to the bank’s 2023 and 2024 experience and to peer failures; compare assumed line draws to actual draws in stress periods; confirm the annual review happened and changes were approved | Back-test files, assumption change log, approvals | L4 |
| 7. Buffer composition and eligibility | The buffer is what the report says | For the buffer at two month-ends, trace every security to custody records, confirm unencumbered status against pledging and repo records, re-apply haircuts, confirm Level 1 and Level 2 classification where the LCR applies | Buffer report, custody statements, pledging schedules, repo book | L5 |
| 8. Buffer liquidity value | The buffer could be monetised at the reported value | For long-dated securities in the buffer, compare amortised cost to market value; confirm the stress test uses market value; confirm the HTM designation does not prevent pledging or sale in the CFP | Portfolio reports, HTM designation memos | L5 |
| 9. Contingency funding plan and testing | Backstops work | Read the CFP; confirm it names triggers, actions, owners and communications; obtain evidence of FHLB and discount window test draws in the last twelve months; confirm collateral is pre-positioned and borrowing capacity letters are current | CFP, test draw confirmations, collateral schedules, capacity letters | L6 |
| 10. Intraday liquidity | Intraday exposure is monitored | Obtain intraday reports for ten days; confirm thresholds, breaches and escalations; confirm the largest intraday outflows (settlement, payroll, tax dates) are known | Intraday reports, breach log | L7 |
| 11. Limit monitoring and breaches | Breaches are escalated and acted on | Obtain twelve months of limit utilisation; for every breach or trigger, trace escalation, decision and resolution; confirm no limit was re-based after a breach without approval | Utilisation history, breach log, exception approvals | L8 |
| 12. Regulatory ratios and reports | LCR, NSFR and 2052a are accurate | For one submission, reperform the HQLA numerator and the net outflow denominator for the largest product lines; trace 2052a line items to source systems; confirm reconciliations and reviewer sign-off; review edit-check failures and resubmissions | Submission workpapers, reconciliations, instructions | L9 |
| 13. Concentrations and deposit segmentation | Concentrations are measured and limited | Rebuild the uninsured deposit share, the top-20 depositor concentration, brokered and wholesale funding shares and maturity ladders from source; compare to the reported figures and limits | Deposit system extract, funding reports | L10 |
| 14. Model governance | Liquidity models are validated | Confirm the stress test engine, behavioural models and 2052a logic are in the model inventory; read the latest validation; test that validation findings are tracked and that model changes went through change control | Model inventory, validation reports, change tickets | L11 |
| 15. Data lineage and controls | The numbers come from controlled sources | For the stress test and the buffer report, document the data flow from source systems to the model; test reconciliations at each hand-off; test access to the model and to manual adjustment files | Data flow diagrams, reconciliations, access lists, adjustment logs | L2, L3, L9 |
| 16. Reporting | Decision makers see level, trend, limits and assumptions | Compare the board pack to the ALCO pack for four quarters; confirm the board sees survival horizon, buffer, limit status, stress results under each scenario and any assumption changes; confirm reports are timely | ALCO and board packs, distribution records | L12 |
Tests 5, 7, 12 and 13 are the substantive core and consume most of the hours; they are also where findings come from, because they test outcomes rather than documents. A function that reads the methodology and the minutes but does not reperform the stress test has audited the description of the framework. The audit work program guide covers how to document the program and the annotated workpaper example what a completed test looks like.
The metrics the auditor rebuilds from source
The ALCO pack reports a set of metrics that management has computed, reviewed and presented. The audit’s value comes from rebuilding the ones that bind from source data and seeing whether they agree. The table lists the metrics, the source, what the rebuild involves and the disagreement that usually appears.
| Metric | Source for the rebuild | What the rebuild involves | Typical disagreement |
|---|---|---|---|
| Survival horizon (days until cumulative net outflow exceeds the buffer under the binding stress) | Balance sheet extract, assumption register, buffer report | Re-apply run-off rates by deposit segment, line draw rates, wholesale roll-off and buffer monetisation haircuts; compute cumulative net position daily | Management nets inflows the auditor would not count (loan repayments assumed on schedule, unsecured borrowing assumed available); result 20 to 40 per cent longer than the rebuild |
| Buffer, unencumbered | Custody statements, pledging schedules, repo and FHLB collateral records | Remove pledged and encumbered securities; apply haircuts; value at market | Securities pledged to the FHLB or municipal deposits counted in the buffer; HTM securities at amortised cost |
| Uninsured deposit share | Deposit system extract with ownership and account type | Apply FDIC insurance rules by ownership category and account; aggregate by depositor | Share understated because related accounts are not aggregated by beneficial owner; collateralised public deposits mixed with uninsured |
| Top-20 depositor concentration | Deposit extract aggregated by relationship | Aggregate across accounts, entities and affiliates | Reported by account rather than relationship; concentration understated by half |
| Wholesale funding maturity ladder | Borrowing and brokered deposit schedules | Bucket by contractual maturity; flag callable and putable features | Callable advances treated at final maturity; brokered sweep balances treated as core |
| LCR (where applicable) | HQLA inventory, outflow and inflow source extracts | Classify HQLA levels and caps; apply outflow and inflow rates by category; cap inflows at 75 per cent of outflows | Operational deposit classification too generous; Level 2 cap not applied; inflow cap missed |
| Contingent funding capacity | FHLB capacity letter, discount window collateral schedule, repo lines | Confirm current capacity after haircuts and existing usage; confirm collateral is pre-positioned and eligible | Capacity stated gross of existing advances; collateral not delivered to the Reserve Bank; capacity letter two years old |
Testing the assumptions: deposits, collateral and the discount window
Three assumption sets decide whether a liquidity framework would have worked in March 2023, and the audit should spend its judgment on them.
Deposit run-off assumptions are the heart of the stress test. The Basel LCR rates (3 to 10 per cent for stable and less stable retail deposits over 30 days, 25 to 40 per cent for operational and non-operational wholesale deposits, 100 per cent for unsecured wholesale funding from financial institutions) were calibrated before mobile banking and social media compressed a bank run from weeks into hours; SVB lost roughly a quarter of its deposits in one day and expected to lose another half the next. The test is not whether the bank uses the regulatory rates but whether its internal stress scenarios include a severe idiosyncratic case with run-off rates informed by 2023, segmented by what actually drove behaviour: insured versus uninsured, operational versus excess, concentrated industries, digital-channel customers, and the speed at which each segment can move money. The deposit beta guide covers the related interest rate assumption; the two studies should share a segmentation.
Collateral assumptions decide whether the buffer and the contingency plan are real. Securities count as liquidity only if they are unencumbered, eligible at the facility that would take them, valued at market and deliverable in time. An audit should trace the collateral schedule for the FHLB and the discount window to the custody and pledging records, confirm what is pre-positioned, confirm haircuts and eligibility, and look at the held-to-maturity question squarely: an HTM designation does not stop a security being pledged, but a bank that plans to sell HTM securities in a crisis will taint the portfolio, and the CFP should say which it intends.
Discount window and FHLB readiness is the operational assumption the 2023 addendum put at the centre. The addendum expects institutions to establish and maintain operational readiness to use the discount window and other contingency sources, including by testing them. The audit evidence is a test draw (a small advance taken and repaid, with the confirmation), current borrowing capacity letters, legal documentation in place at the Reserve Bank, and collateral delivered rather than merely identified. A bank whose CFP lists the discount window as a backstop and whose last test draw was before 2023 has a finding, and the addendum gives the auditor the citation.
| Assumption | Pre-2023 practice | What examiners expect now | Audit test |
|---|---|---|---|
| Uninsured deposit run-off, severe idiosyncratic scenario | 10 to 25 per cent over 30 days | Scenarios that include a run measured in days, with segment-level rates informed by 2023 and by the bank’s own concentration | Compare assumed rates to the bank’s 2023 flows and to published failure data; test segmentation |
| Operational deposit classification | Generous; based on product type | Based on evidence of operational purpose; excess balances separated | Sample 25 accounts classified operational; test against the policy criteria |
| Monetisation of the buffer | Sale or repo of securities assumed over 30 days at amortised cost | Market value, haircuts, delivery timing; pre-positioned collateral preferred over sale | Rebuild buffer at market; confirm pre-positioning |
| Discount window | Listed in the CFP; rarely tested; stigma assumed | Tested at least annually; collateral pre-positioned; documentation current (2023 addendum) | Obtain test draw confirmations and collateral schedules |
| FHLB capacity | Capacity letter taken as available | Capacity net of existing advances, after haircuts, with collateral delivered; FHLB membership and stock requirements understood | Reperform net capacity; confirm the letter date |
| Intraday | Not measured below Category III | Largest intraday outflows known and funded; monitoring in place at regional banks | Obtain intraday reports; confirm thresholds |
Reporting: what ALCO and the board should see
The 2010 Policy Statement expects the board to understand the institution’s liquidity risk profile and to receive reports that let it do so; Regulation YY specifies board review of the appetite, strategies and stress results. The audit test is a comparison: what ALCO sees against what the board sees, and what both see against what the auditor rebuilt. The board pack should carry, at minimum, the survival horizon under each stress scenario with trend, the buffer size and composition, limit utilisation and any breaches, the uninsured deposit share and top depositor concentration, contingent funding capacity and the date it was last tested, and any change to a stress assumption with its effect on the result. The board risk reporting guide gives the general design principles; the liquidity-specific failure is a board pack that shows a single survival horizon number, green, with no scenario detail and no mention that the number depends on assumptions changed last quarter.
The findings that recur, with wording that lands
Liquidity audits produce a recognisable set of findings. The table gives each one, the rating it usually carries, and condition and effect wording that survives management’s review without being softened into meaninglessness. The 5 C’s of audit findings guide covers the structure; the MRA lifecycle guide shows how the same findings read when an examiner writes them.
| Finding | Usual rating | Condition (what we found) | Effect (why it matters) |
|---|---|---|---|
| Stress assumptions not updated since the 2023 events | High | The severe idiosyncratic scenario assumes a 20 per cent 30-day run-off of uninsured deposits; the bank’s own March 2023 experience was 9 per cent in four days and peer failures exceeded 25 per cent in one day | The reported survival horizon of 94 days falls to 31 days under assumptions consistent with observed behaviour, inside the board’s 45-day minimum |
| Buffer includes encumbered or illiquid securities | High | 310 million dollars of municipal securities pledged against public deposits and 140 million of HTM securities at amortised cost were counted in the 1.9 billion buffer | The unencumbered buffer at market value is 1.4 billion; the limit of 1.5 billion was breached in four of twelve months without escalation |
| Contingency sources untested | High or Medium | The CFP lists the discount window as the primary secondary source; no test draw has been executed; collateral has not been delivered to the Reserve Bank | Access under stress is unproven; the 2023 addendum expects operational readiness to be established and tested |
| Uninsured deposits understated | Medium | Deposit insurance status is assigned by account; aggregation by beneficial owner raises the uninsured share from 38 to 51 per cent | Stress outflows and concentration limits are calculated on an understated base |
| Limit breaches cured by assumption changes | High | The survival horizon limit was breached in month four; the following month the run-off assumption for operational deposits was reduced without validation, restoring compliance | Reported compliance does not reflect a reduction in risk; the control over assumption changes failed |
| Reconciliation gaps in the stress model feed | Medium | Model balances exceed the general ledger by 210 million dollars in the deposit segment; differences are not investigated | Stress outflows are computed on an unreconciled population |
| Board reporting omits scenario detail and assumption changes | Medium | The board pack reports one survival horizon figure; ALCO sees three scenarios and the assumption change log | The board cannot see the exposure under the severe scenario or the effect of assumption changes on the figure it is given |
| Model not in inventory or validated | Medium | The liquidity stress engine and the deposit run-off study are not in the model inventory; no validation has been performed | Model risk policy not applied to the measures the board relies on |
Worked example: Thornwick Bank’s FY27 liquidity audit
Thornwick Bank is the illustrative 62-billion-dollar regional bank used across this site, with a 24-person internal audit function and a capital markets division that the trading floor controls audit covers. It sits below the 100-billion-dollar threshold, so the LCR, NSFR and Regulation YY liquidity requirements do not apply; the 2010 Policy Statement, the 2023 addendum and the state and Federal Reserve examiners’ expectations do. The FY27 plan scheduled a 560-hour framework audit after the FY26 examination had raised a matter requiring attention on contingency funding readiness.
Thornwick’s funding was 48 billion dollars of deposits (uninsured share reported at 41 per cent; 6.1 billion from the capital markets and commercial clients concentrated in two industries), 5 billion of FHLB advances, 2 billion of brokered deposits and 1 billion of senior debt, against a reported liquidity buffer of 9.4 billion dollars of unencumbered securities and cash and a reported survival horizon of 112 days under the severe idiosyncratic scenario, against a board minimum of 60 days.
| Test | Thornwick result | Finding |
|---|---|---|
| 5. Stress test reperformance | Reperformed the severe idiosyncratic scenario for the September month-end. Management’s result: 112-day survival. Rebuilt with management’s own assumptions: 109 days (a 150-million-dollar inflow from an expected securitisation had been included; policy excludes unexecuted transactions) | Low: inflow treatment |
| 6. Assumption back-test | The scenario assumed 15 per cent 30-day run-off of uninsured deposits and 5 per cent of insured. Thornwick’s own March 2023 experience: 7 per cent of uninsured balances left in five business days, concentrated in the two industries. Scenario did not segment by industry or by channel. Rebuilt with a 30 per cent uninsured run-off over ten days for the concentrated segments and 15 per cent elsewhere: survival horizon 58 days, below the 60-day minimum | High: assumptions not informed by 2023; limit would be breached |
| 7. Buffer composition | Of the 9.4 billion buffer, 1.1 billion was pledged against public deposits and derivative margin and 0.6 billion was HTM at amortised cost with a market value of 0.5 billion. Unencumbered buffer at market: 7.6 billion | High: buffer overstated by 1.8 billion |
| 9. CFP and testing | FHLB test draws current (quarterly). Discount window: legal documentation current, 2.2 billion of collateral identified, none delivered; no test draw since 2019 | High: repeats the FY26 examiner finding |
| 12. Voluntary LCR estimate | Thornwick reports a voluntary LCR of 118 per cent to the board. Rebuild with operational deposit classification tested: 23 of 25 sampled operational accounts met the criteria; two large balances (390 million) did not. Corrected ratio 109 per cent | Medium: classification |
| 13. Concentrations | Uninsured share rebuilt by beneficial owner: 46 per cent versus 41 per cent reported. Top-20 relationships: 9.2 billion versus 6.8 billion reported by account | Medium: aggregation |
| 16. Reporting | Board pack shows one survival horizon figure and the buffer total; ALCO pack shows three scenarios and the encumbrance detail | Medium: board sees less than ALCO |
The engagement was rated Needs Improvement with three High findings. Management’s actions: a deposit segmentation study by industry, channel and insurance status with scenario-specific run-off rates, due in the second quarter; a restated buffer definition excluding pledged and HTM securities at amortised cost, effective immediately, with the limit re-examined by the board in light of the restatement rather than quietly re-based; delivery of collateral to the Reserve Bank and a test draw within sixty days; and a board pack redesign. Internal audit’s continuous monitoring picked up the restated buffer and the survival horizon monthly, and validation of the three High findings was scheduled for the fourth quarter under the issue validation standard. The examiner’s FY27 review closed the MRA on contingency funding on the strength of the test draw and the delivered collateral.
The pattern is the one most liquidity audits find in 2026: the framework exists, the engine works, and the assumptions, the buffer definition and the backstop readiness are where the risk hides. An audit that rebuilds the binding metric, traces the buffer to custody, and asks for the discount window test confirmation will find what matters.
Frequently asked questions
How often should internal audit cover liquidity risk management?
Annually for firms subject to Regulation YY, which requires independent review of the liquidity risk management process at least once a year, and at least every one to two years elsewhere, with continuous monitoring of the key metrics in between. The 2010 Interagency Policy Statement expects independent review at every institution without fixing a frequency; examiners read a gap of more than two years as a weakness in the audit plan.
What is the difference between auditing liquidity risk and auditing treasury?
A treasury audit covers the function: cash management, debt, investments, hedging, bank relationships and the controls over each, as the how to audit treasury program shows. A liquidity risk management audit covers the risk framework: appetite, measurement, stress testing, buffer, contingency funding and reporting, regardless of which function performs each piece. At a bank the two overlap heavily and are often combined in one engagement; the scoping memo should say which elements are in each.
Does a bank below 100 billion dollars need to calculate the LCR?
No. The LCR and NSFR rules apply by category under the 2019 tailoring framework and do not reach firms below 100 billion dollars in assets. Many regional banks compute a voluntary LCR estimate for the board or for investors, and if they report it the audit should test it, because an inaccurate voluntary ratio is still a misstatement to the board.
What should the audit look for in the contingency funding plan after the 2023 addendum?
Evidence of operational readiness rather than a list of sources: current legal documentation with the Reserve Bank and the FHLB, collateral delivered and eligible rather than merely identified, borrowing capacity computed net of existing usage and haircuts, a test draw on the discount window within the last year, named triggers and decision rights, and a communications plan. The addendum from July 2023 makes the discount window a legitimate source that should be tested, which removes the stigma argument from management’s responses.
How do I test deposit run-off assumptions without a model background?
Compare them to experience. The bank has its own daily deposit flows for March 2023 and for any later stress; published data on the 2023 failures gives the severe end of the range; and the Basel LCR rates give the regulatory floor. Segment the comparison by insured status, operational purpose, industry concentration and channel, because the average hides the segment that runs. If the assumed rates are below what the bank itself experienced, the finding writes itself.
What is the relationship between the liquidity stress test and the interest rate risk model?
They share a balance sheet, a deposit segmentation and a committee, and a rate shock drives both: higher rates shorten deposit behavioural lives in the interest rate model and raise outflows in the liquidity stress test. The interest rate risk pillar covers the other side; the audit should confirm that the two frameworks use consistent deposit segmentation and that the combined scenario (rate shock plus deposit run) is run somewhere.
What goes into the FR 2052a and why does the audit care?
The FR 2052a collects detailed cash flow, asset and funding data by product, counterparty type and maturity bucket for firms subject to it, daily for the largest and monthly for Category IV. Supervisors use it to run their own liquidity monitoring, so errors in it misstate the bank’s position to its regulator. The audit tests the production process: source extracts, mapping to the product categories, reconciliations to the general ledger, edit checks, reviewer sign-off and resubmission history.
Which findings should be rated High?
Those that mean the reported position could not be relied on in a stress: assumptions that would breach the limit if updated, a buffer that includes encumbered or illiquid assets, contingency sources that have never been tested, and breaches cured by assumption changes. Reporting, reconciliation and classification findings are usually Medium unless they are large enough to change the headline figures. The finding severity ratings guide gives the calibration.
Related guides
- Liquidity Risk — the Risk Library pillar: definitions, metrics, Basel III and the US framework
- Liquidity Stress Testing — scenario design, horizons, the death spiral and the audit program for the test itself
- Corporate Liquidity Risk — the non-bank version: forecasts, covenants and committed lines
- How to Audit Treasury — the function-level program that liquidity sits inside
- Interest Rate Risk — the other half of the ALCO agenda, with the SVB lessons
- Deposit Beta Modeling — the deposit assumptions shared with the interest rate model
- Bank Internal Audit Universe Example — where this engagement sits among the entities a bank audits
- What Regulators Expect From Internal Audit — how examiners read the audit function’s coverage
- SR 11-7 and SR 26-2 — the model risk expectations for stress engines and behavioural models
- Risk and Control Matrix Template — the columns behind the twelve-control RCM above
- Liquidity Risk category — every guide on the subject in one archive
Leave a Reply