AFM Finds Internal Audit Functions at Dutch Financial Institutions Continue to Professionalize

Key Takeaways

• The Dutch Authority for the Financial Markets (AFM) surveyed six major banks, four insurers, and five major financial service providers and found that internal audit functions are increasingly professional and are investing more in independent review.
• The AFM published good practice examples and expects firms to adapt them to their own organizations.
• Compliance teams should use the report to benchmark their third line of defense and prepare for supervisory expectations.

Deep Dive

The Dutch Authority for the Financial Markets (AFM) surveyed six major banks, four insurers, and five major financial service providers and found that internal audit functions are increasingly professional and are investing more in independent review. The AFM published good practice examples and expects firms to adapt them to their own organizations. Compliance teams should use the report to benchmark their third line of defense and prepare for supervisory expectations.

The AFM notes that financial service providers have no direct statutory obligation to establish an internal audit function. Many large providers nonetheless invest in independent review in a manner proportionate to their nature, size, risks, and complexity. The key expectation is that any provider that chooses to establish an internal audit function must structure it in line with the role and responsibilities of an independent third line of defense. Firms that label a function "internal audit" without adequate independence, mandate, or positioning may therefore draw supervisory scrutiny.

The report highlights several good practices: explicitly incorporating customer interests into audit planning, using data analysis, and issuing a comprehensive opinion on internal control. The AFM also observes that audit functions are increasingly covering customer interests, organizational culture, and future risks, going beyond traditional financial and process controls. The AFM acknowledges that not every method suits every firm and encourages tailored adoption rather than wholesale copying. No deadlines or implementation dates are specified.

Recommended actions for compliance professionals:
- Obtain and review the AFM market survey report, "Internal audit of banks, insurers, and financial service providers: a market survey."
- Benchmark the current internal audit or independent review setup against the good practices, particularly independence, adherence to professional standards, and quality assurance.
- Confirm that audit plans address customer outcomes, culture, and emerging risks.
- Assess opportunities for data analytics in audit work.
- Document the rationale for the chosen form of independent review, showing proportionality to the firm's size, risks, and complexity.
- Brief senior management and the audit committee on the findings.

The risk impact is moderate and primarily supervisory. Firms with weak or ambiguous third-line structures face an elevated risk of AFM follow-up, particularly if customer outcomes or governance weaknesses emerge. Firms that act proactively can strengthen governance and demonstrate a mature control environment.

Source: Dutch Authority for the Financial Markets