Banking is built around trust, but trust alone is not a control.
Every bank operates through hundreds of interconnected processes involving customers, accounts, transactions, employees, systems, branches, digital channels and third parties. A weakness in one process can create consequences somewhere else in the control environment.
This is why banking internal controls reviews should go beyond checking whether policies exist. The more important question is whether controls actually work in practice, whether exceptions are identified, and whether management receives timely information when something falls outside the expected pattern.
A controls gap assessment provides a structured way to answer these questions.
For banks and other financial institutions, effective banking internal controls are particularly important because weaknesses in customer due diligence, transaction monitoring, account management, access controls or governance can create regulatory, operational, financial and fraud-related risks.
In Pakistan, the State Bank of Pakistan has continued to strengthen customer onboarding and AML/CFT requirements. Its 2025 Consolidated Customer Onboarding Framework consolidates requirements relating to establishing customer relationships, accounts and wallets. Read the SBP Consolidated Customer Onboarding Framework.
What Is a Banking Controls Gap Assessment?
A banking controls gap assessment is a structured review designed to identify differences between:
- Required controls
- Designed controls
- Controls actually operating
- Evidence that controls are working
- Management monitoring and exception reporting
The assessment should consider both preventive controls and detective controls.
Preventive controls are designed to stop an error, unauthorized activity or violation before it occurs.
Detective controls are designed to identify an issue after it has occurred or when a developing pattern requires attention.
A strong banking internal controls framework normally needs both.
For example, maker-checker authorization is a preventive control. An exception report identifying transactions processed outside the normal authorization process is a detective control.
The objective is therefore not simply to produce a list of control deficiencies. It is to determine whether the overall process can reliably prevent, detect and escalate significant risks.
Key Areas to Cover in Banking Internal Controls
A comprehensive review of banking internal controls should cover the complete customer and transaction lifecycle rather than focusing only on traditional branch operations.
1. Customer Lifecycle Controls
Customer-related processes are among the most important areas for review because weaknesses at the beginning of the relationship can affect the entire account lifecycle.
Key areas include:
- Client onboarding
- CIF creation and maintenance
- KYC and CDD
- Account reactivation
- Dormant accounts
- Deceased accounts
- Account closure
- Customer communication
- Complaint management
The assessment should determine whether customer information is complete, accurate, appropriately verified and periodically updated.
KYC/CDD should also go beyond document collection. The institution should understand the customer’s purpose of relationship, expected activity, source of income or funds where applicable, ownership and other relevant risk factors.
The SBP AML/CFT Regulations set out customer due-diligence requirements, including identification and verification of customers and information relating to the purpose of the account, source of earnings and expected transaction activity.
The FATF Recommendations provide the broader international framework for applying risk-based AML/CFT controls.
2. Account Reactivation Controls
Dormant and inactive accounts require particular attention.
A review of banking internal controls should examine:
- Who can initiate reactivation?
- Is independent authorization required?
- Is customer identification appropriately performed?
- Are unusual transactions after reactivation monitored?
- Are exceptions reported to management?
- Is system access appropriately restricted?
A reactivated account followed immediately by unusual activity does not automatically indicate wrongdoing, but it can represent an exception requiring review.
This illustrates an important principle:
A control is more effective when it identifies exceptions rather than merely completing a checklist.
3. Dormant and Deceased Accounts
Dormant and deceased-account processes should be tested separately.
Important controls include:
- Timely status updates
- Restrictions on transactions
- Verification of authorized representatives
- Proper documentation
- System-level controls
- Exception reporting
- Periodic management review
A weakness may arise even when the underlying policy is adequate if information is not updated promptly across relevant systems.
The assessment should therefore consider both policy design and operational execution.
4. Account Closing
Account closure can appear straightforward, but it involves several control points.
A review should consider whether the institution verifies:
- Customer instructions
- Authorized signatories
- Outstanding liabilities
- Restrictions and liens
- Unpresented instruments
- Pending transactions
- Required documentation
- System closure
- Record retention
The objective is to ensure that an account is not merely marked closed in one system while residual balances, mandates, restrictions or access remain elsewhere.
5. Transaction Banking Controls
Transaction processing represents another major area for banking internal controls assessment.
Key areas may include:
- Cash over the counter
- Cheque returns
- PTEO and remittances
- Salaries and pensions
- Term deposit receipts
- Statements of account
- Mobile and digital banking
For each process, the assessment should consider the complete transaction flow:
Initiation → Authorization → Processing → Verification → Exception Detection → Reconciliation → Reporting
This approach helps identify gaps that may not be visible when individual control activities are reviewed in isolation.
For example, a transaction may have appropriate authorization but still create risk if exceptions are not independently monitored.
6. Cash and Currency Management
Cash remains a significant operational risk area for banks.
An effective banking internal controls assessment should examine:
- Cash holding limits
- Vault controls
- Cash transfers
- Dual custody
- Teller controls
- Cash counts
- Surprise verification
- Reconciliation
- Excess/short reporting
- Currency sorting and handling
- Damaged or unfit currency management
One significant gap that can emerge in a controls assessment is the absence of an effective currency management system.
Where important information is maintained manually, management may have limited visibility over cash positions, movements, exceptions and reconciliation status.
Automation can improve this by providing centralized information, exception alerts and an auditable record of activity.
7. AML/CFT and KYC Controls
AML/CFT controls should be assessed as an integrated framework rather than as an isolated compliance exercise.
Areas to consider include:
- Customer identification
- Customer risk classification
- CDD
- Enhanced due diligence
- Beneficial ownership
- Sanctions screening
- High-risk jurisdictions
- PEP-related controls
- Transaction monitoring
- Suspicious activity escalation
- Regulatory reporting
- Ongoing customer review
The SBP AML/CFT/CPF Regulations include requirements covering risk-based AML/CFT controls, customer due diligence, targeted financial sanctions, PEPs, transaction reporting, internal controls and high-risk jurisdictions.
The FATF risk-based approach emphasizes that controls should be proportionate to the risks identified rather than treating every customer and transaction in exactly the same way.
For practical background, see Equicio’s Anti-Money Laundering (AML) guide.
8. Exception Monitoring: The Missing Layer in Many Control Frameworks
One of the most important areas in a banking internal controls assessment is exception monitoring.
A control may exist on paper but still be ineffective if management cannot identify when the control fails.
Examples of useful exception monitoring include:
- Accounts reactivated outside normal patterns
- Transactions exceeding predefined thresholds
- Unusual cash activity
- Repeated manual overrides
- Transactions processed after unusual access events
- Changes to customer information
- Changes in authorized signatories
- Unusual dormant-account activity
- Repeated failed authentication attempts
- Transactions involving higher-risk jurisdictions
- Unusual third-party transactions
- Repeated control overrides
- Unresolved reconciliation differences
The purpose of exception monitoring is not to automatically label an exception as fraud.
An exception is a signal that requires appropriate review.
For additional practical reading, see Equicio’s article on fraud detection tests and suspicious transactions.
9. Governance: Preventive and Detective Controls
Governance is the layer that connects individual controls into an effective control environment.
A strong banking internal controls framework should therefore examine:
- Board and senior management oversight
- Clearly defined responsibilities
- Segregation of duties
- Delegated authorities
- Maker-checker controls
- Management information
- Exception reporting
- Internal audit coverage
- Compliance monitoring
- Risk assessments
- Issue tracking
- Remediation monitoring
A common weakness is having extensive policies but insufficient evidence that management monitors whether those policies are being followed.
A strong governance framework should answer three questions:
Who owns the risk?
Who monitors the control?
Who receives the exception when the control fails?
If the answer to any of these questions is unclear, the control environment deserves closer examination.
10. Unclaimed, Deceased and Asaan Accounts
Special account categories often require specific controls because their operational characteristics differ from normal active accounts.
The assessment should consider:
- Correct account classification
- System restrictions
- Periodic review
- Authorized transaction processing
- Customer or claimant verification
- Regulatory reporting
- Exception monitoring
- Management oversight
These areas can become particularly vulnerable when controls depend heavily on manual registers, spreadsheets or individual staff knowledge.
The issue is not necessarily that manual controls are always ineffective.
The concern arises when there is no reliable independent mechanism to identify missed, delayed or overridden controls.
11. Locker Portfolio Monitoring
Locker operations are another area that can receive less attention than mainstream transaction processes.
A banking internal controls review should examine:
- Locker allocation
- Customer eligibility
- Key/control management
- Access records
- Authorized persons
- Rent recovery
- Expired agreements
- Unclaimed lockers
- Periodic reconciliation
- Forced opening procedures
- Management review
A particular concern is the absence of systematic monitoring over the locker portfolio.
Management should be able to identify exceptions such as overdue rentals, inactive arrangements, unusual access patterns, documentation gaps and other matters requiring follow-up.
12. Access Controls and ID/Password Management
Digital access controls should form part of any modern banking controls assessment.
Areas include:
- User creation
- User modification
- User deletion
- Password controls
- Privileged access
- Segregation of duties
- Dormant user IDs
- Failed login monitoring
- Periodic access reviews
- Emergency access
- Audit trails
The key question is not merely whether passwords are protected.
It is whether access rights remain appropriate throughout the employee lifecycle.
An employee transferring departments, changing responsibilities or leaving the organization should not retain inappropriate access.
This is a fundamental part of effective banking internal controls, particularly as banks increasingly depend on digital platforms and interconnected systems.
13. Change Management
Changes to banking systems and processes can create significant operational risk.
The assessment should consider whether changes are:
- Properly authorized
- Risk assessed
- Tested
- Independently reviewed
- Documented
- Approved before implementation
- Subject to rollback arrangements
- Reviewed after implementation
A technically successful change can still represent a control weakness if the approval, testing or documentation process was inadequate.
14. Supporting Processes Often Overlooked
A comprehensive assessment of banking internal controls should also consider supporting activities such as:
- NOSTRO accounts
- Asaan accounts
- Currency management
- Unclaimed accounts
- Locker portfolio
- Asset management
- Change management
- Zakat and Hajj operations
- Lien management
These processes may not always receive the same level of attention as customer onboarding or transaction processing, but weaknesses can still create regulatory, operational or financial exposure.
Common Control Gaps Identified
A practical assessment may ultimately identify several recurring themes.
1. Ineffective KYC/CDD Review
The process may exist, but reviews can become checklist-driven rather than risk-based.
The key question should be whether the institution actually understands the customer and whether available information remains consistent with the customer’s activity.
2. Absence of Exception Monitoring
Controls may be performed manually without an effective mechanism to identify missed controls, unusual transactions or repeated overrides.
This creates a significant difference between control execution and control assurance.
3. Weak Preventive and Detective Governance Controls
A process may have authorization requirements but lack independent monitoring.
Alternatively, management may receive reports but lack clear accountability for resolving exceptions.
Effective governance requires both prevention and detection.
4. Ineffective Controls Over Special Account Categories
Unclaimed, deceased and Asaan accounts can create specific operational and regulatory risks when classification, restrictions, monitoring and review are not properly integrated.
5. Absence of an Effective Currency Management System
Where currency information is fragmented across manual records, management may lack timely visibility over cash movements, holdings and exceptions.
6. Inadequate Locker Portfolio Monitoring
Without systematic monitoring, overdue rentals, documentation issues, inactive lockers and other exceptions can remain unresolved.
From Controls Testing to Continuous Control Monitoring
Traditional internal control testing often relies heavily on periodic reviews and sample-based testing.
Sampling remains an important audit technique, but technology creates opportunities for continuous or more frequent monitoring.
Instead of asking only:
“Was the control performed?”
management can also ask:
“Which transactions or accounts require attention right now?”
This is where exception-based monitoring becomes valuable.
For example, a bank could develop dashboards showing:
| Control Area | Example Exception |
|---|---|
| KYC/CDD | Customer review overdue |
| Dormant Accounts | Unusual transaction after reactivation |
| Cash | Excess/short outside tolerance |
| Access Control | Inappropriate user access |
| AML | Unusual transaction pattern |
| Account Closure | Outstanding restriction |
| Locker | Agreement/rent exception |
| Currency | Unreconciled movement |
| Change Management | Change implemented without required evidence |
| Reconciliation | Long-outstanding difference |
The objective is not to automate every decision.
The objective is to make important exceptions visible, traceable and actionable.
A Practical Banking Controls Gap Assessment Framework
A useful assessment can evaluate each area of banking internal controls against five questions:
1. Is the control clearly defined?
If there is no documented control objective, accountability can become unclear.
2. Is the control preventive, detective or both?
Understanding the control type helps identify whether a process has adequate coverage.
3. Is the control automated or manual?
Manual controls are not inherently weak, but they require appropriate evidence, supervision and monitoring.
4. Is there independent exception monitoring?
A process should not depend entirely on the same person who performs the control to identify failures.
5. Can management demonstrate that the control works?
Evidence is critical.
Policies describe what should happen.
Control evidence demonstrates what actually happened.
Turning Control Gaps Into Action
A controls assessment becomes more useful when each identified gap is linked to a practical remediation plan.
A simple remediation structure can include:
Gap → Risk → Root Cause → Control Improvement → Owner → Target Date → Monitoring
For example:
Gap: No systematic monitoring of locker portfolio.
Risk: Operational, regulatory and fraud-related exposure.
Root Cause: Fragmented/manual monitoring.
Control Improvement: Centralized exception reporting and periodic independent review.
Owner: Relevant business/process owner.
Target Date: Defined remediation timeline.
Monitoring: Periodic management reporting.
This approach converts an assessment from a static list of weaknesses into a management tool.
It also helps internal audit, compliance and risk functions move from simply identifying deficiencies toward tracking whether agreed corrective actions actually address the underlying risk.
Final Thoughts
A strong banking internal controls framework is not created simply by adding more procedures.
The real objective is to ensure that important risks are:
Identified → Controlled → Monitored → Reported → Remediated
The most significant control weaknesses often arise where these stages are fragmented.
Manual processes, incomplete KYC/CDD reviews, weak exception monitoring, inadequate governance, limited automation and insufficient oversight of specialized processes can collectively increase regulatory, operational and fraud-related exposure.
The solution is not necessarily to automate everything.
Rather, banks should identify where automation, exception reporting, independent review and stronger governance can provide better visibility over the areas that matter most.
A mature control environment should allow management to answer a straightforward question at any time:
“What important exceptions are currently unresolved, who owns them, and what is being done about them?”
That is the difference between having controls on paper and having a control environment that actively manages risk.
For more practical guidance on financial risk, compliance and fraud controls, explore Equicio’s Risk & Compliance section.