# VSB 20 Art. 59 — Audit by the audit firm - **Rubric (DE):** Kontrolle durch die Prüfgesellschaft - **Rubric (EN):** Auditing - **Chapter:** 8. Kapitel — Prüf- und Verfahrensbestimmungen (1. Abschnitt: Verfahren) - **Scope:** Banks & securities firms (incorporated via [[GwV-FINMA Art. 35 - Identification, controlling person and beneficial|GwV-FINMA Art. 35]]) - **Status:** In force (since 1 January 2020) ## Description Abs. 1: by signing the code of conduct, the bank instructs and authorises the audit firm (*Prüfgesellschaft*), within the mandatory audit (*Pflichtprüfung*) under FINMA Circular 13/3, to check compliance with the code of conduct under Abs. 2 and to report violations found as set out in Abs. 3 and 4. Abs. 2: the check is carried out on the basis of audits at the audit depth "Prüfung" (FINMA Circular 13/3); the audits cover business relationships newly entered into since the audit activities of the previous audit. A risk-based approach applies to determining the sample size and to the audit, taking into account in particular the type of business and the number and volume of business relationships newly entered into since the previous audit. The audit activities are coordinated with the bank's internal audit, and the audit firm must itself audit at least half of the sample size. Abs. 3: on finding minor cases (*Bagatellfälle*) under Art. 63, the audit firm sets the bank a restoration period of at most six months from notification to the bank, which can be extended once on reasoned request; if the deficiency is not remedied in time, the audit firm reports it to the supervisory commission (*Aufsichtskommission*) and the FINMA within one month after the restoration period expires. Abs. 4: violations that do not qualify as minor cases under Art. 63 are reported to the Aufsichtskommission and the FINMA within one month after the violation was established. ## Context & interpretation The SBA commentary states that Art. 59 refers to FINMA Circular 13/3 "Prüfwesen" and requires a risk-based approach to both the sample size and the audit. It states that, following the partial revision of that circular, the VSB 20's reference to the annual audit no longer applies, and that the frequency or cycle of the audit area "money laundering" now depends on an institution's risk situation. It states that the deadlines for reporting violations are set in Art. 59 and that, in minor cases, the audit firm may set the bank a deadline to remedy the deficiency. ## FATF - [[FATF R.26 - Regulation and supervision of financial institutions|FATF R.26]] — related: audit of compliance with the code of conduct by the audit firm, with violations reported to the FINMA. ## Swiss counterparts - [[VSB 20 Art. 63 - Minor cases|VSB 20 Art. 63]] — defines the minor cases for which the audit firm sets a restoration period (Abs. 3). - [[VSB 20 Art. 61 - Sanctions procedure|VSB 20 Art. 61]] — sanctions procedure before the Aufsichtskommission, to which violations are reported. - None in this map for the audit itself. ## Part of - [[VSB 20]] ## Sources - VSB 20 (Vereinbarung vom 13. Juni 2018, in force 1.1.2020), Art. 59 - SBVg Kommentar zur VSB 20 (2020), Art. 59