A Shariah audit is an independent assessment, carried out at intervals, of whether an Islamic financial institution has complied with Shariah principles and with the rulings of its own Shariah scholars in the way it designs products, signs contracts, handles transactions and reports its results. It gives the board, the scholars and, in some cases, the public an assurance that the institution's claim to operate Islamically is borne out in practice. Islamic banks, takaful operators, Islamic fund managers and the Islamic units of conventional banks are all subject to it in jurisdictions with formal Shariah governance rules.
The audit forms one part of a wider Shariah governance system. Scholars sitting as the Sharia supervisory board decide what is permissible; management implements those decisions; and assurance functions check that implementation. Shariah audit is usually distinguished from Shariah review, which is a continuous compliance activity, although terminology differs between countries and standards.
Purpose and scope
The main purpose is to control Sharia non-compliance risk: the risk that a transaction is found to breach Shariah, with the result that income from it cannot be kept, contracts may be challenged and the institution's reputation suffers. An audit typically covers:
- Products and contracts. Whether products were approved before launch and whether the legal documents used match the approved structure.
- Execution. Whether transactions followed the required sequence. In a murabaha sale, for example, the bank must own the goods before selling them to the customer.
- Financial matters. Whether profit has been calculated and shared as agreed with investment account holders, and whether zakat and charity payments have been computed correctly.
- Governance and systems. Whether policies, IT systems, staff training and marketing material reflect Shariah requirements.
- Treasury and investments. Whether liquidity placements, hedging arrangements and holdings such as sukuk are in approved forms.
Internal and external Shariah audit
Internal Shariah audit is performed by a unit within the institution, often part of or alongside the internal audit department. To preserve independence it reports to the board audit committee, with its findings also going to the Shariah scholars. In terms of the three lines model, it sits in the third line, while Shariah review and Shariah risk management sit in the second.
External Shariah audit is performed by an outside firm, which may be the statutory financial auditor or a specialist. It provides an independent opinion to shareholders or the regulator on the institution's compliance, or on the reliability of the Shariah board's annual report. Some countries, including Pakistan, Oman and Bahrain, require an external Shariah audit; others leave it to the institution.
How an audit is carried out
The work follows the pattern of a conventional audit. The auditors prepare an annual plan based on risk, giving priority to complex products and areas with past findings. They then test samples of transactions against the relevant fatwa, product manual and contract templates, examine supporting evidence such as purchase documents and timestamps, and interview staff. Findings are graded, discussed with management and reported with recommended corrections.
Where a breach is confirmed, the Shariah board decides the consequence. Income from a non-compliant transaction is normally removed from the institution's profit and given to charity, a process called income purification, and the underlying contract may need to be redone. Follow-up audits check that corrections have been made.
Standards and regulation
Two international bodies set reference standards. AAOIFI issues governance and auditing standards that cover the Shariah supervisory board, internal Shariah audit and external Shariah audit, and these are mandatory or influential in a number of Gulf and other markets. The IFSB publishes guiding principles on Shariah governance aimed at supervisors.
National rules vary. Malaysia's central bank requires Islamic financial institutions to maintain separate Shariah review, Shariah risk management and Shariah audit functions under its Shariah governance policy, and operates a national Shariah advisory council whose rulings bind institutions. Other countries rely mainly on each institution's own board of scholars. These differences mean that the depth and independence of Shariah audit are not uniform across the industry.
Challenges
Commonly cited difficulties include a shortage of auditors trained in both Islamic commercial law and audit technique, the absence of a single global set of Shariah rulings against which to test, and questions of independence where the same scholars approve products and oversee their audit. Conventional banks operating an Islamic window face the additional task of showing that Islamic funds are kept separate from the rest of the business. Advocates of stronger external audit argue that an independent published opinion would improve confidence in Islamic banking generally.