Start assessment ↘
An independent professional review-support toolkit for examining governance, control ownership, monitoring, data analytics, TBML indicators and corrective action under the Bangladesh Bank ICMS Guideline, July 2026.
This toolkit is based on the Bangladesh Bank Guidelines on Internal Control Management System in Banks, July 2026. It is independently prepared by RegTech Nexus AI. It is not issued, approved, certified or endorsed by Bangladesh Bank, and it does not replace official instructions, bank management, internal audit, legal advice or supervisory judgment.
Open the official source document ↗Policy Gap Analyzer: use for an initial, browser-local comparison of non-sensitive policy wording against a source-mapped control pack. Its text-matching output is a review signal, not proof of operating effectiveness.
ICMS Toolkit: use for the wider governance and control review, including assessment, evidence discussion and corrective-action tracking. The assessment remains indicative and is not an official Bangladesh Bank rating.
Open Policy Gap Analyzer ↗ · Open guided regulatory case studies ↗
Use the toolkit to structure internal discussion, identify evidence gaps and prepare a management-level action plan. It is a starting point for professional review—not a regulatory rating.
The 24-question assessment remains an indicative core review. This supplemental matrix records the guideline domains that are conditional, reference-only or outside that score, so important requirements are not silently excluded from risk discussion.
Use probability after considering mitigation and impact before considering mitigation. Banks may customise the matrix to their own risk profile and quantifiable control parameters.
| Probability \ Impact | Low (1) | Medium (2) | High (3) |
|---|---|---|---|
| High (3) | Medium | High | High |
| Medium (2) | Low | Medium | High |
| Low (1) | Low | Low | Medium |
| Guideline domain | Risk-matrix treatment | Status |
|---|---|---|
| Ch. 1–2 · ICMS architecture, on/off-site audit, QAIP, external auditor & dispute settlement | Governance, assurance and escalation dependency | Supplemental |
| Ch. 3 · risk model, assessment matrix, branch rating & RBAP | Risk identification and annual audit planning | Added to matrix |
| Ch. 4 · RBIA execution, evidence, testing, sampling, findings, QAIP & annual assurance | Independent assurance depth and evidence reliability | Added to matrix |
| Ch. 5 · CRM, CRA/CMP, regulatory change, new-product approval, training, reporting & objection settlement | Compliance-risk lifecycle and unresolved-objection escalation | Added to matrix |
| Ch. 6 · C&M monitoring, independent assurance, annual health report & follow-up | First-line tools plus monitoring, reporting and closure | Core + overlay |
| Ch. 7 · Shariah audit, non-compliance rating, violation response, independence, qualifications & timeliness | Conditional Shariah risk and governance overlay | Conditional |
| Ch. 8 · concurrent, IS, virtual/remote, whistleblower & forensic audit | Progressive-control exposure and capability overlay | Reference overlay |
| Ch. 9 · penalties for non-compliance & Bangladesh Bank’s right to amend | Regulatory consequence and change-management escalation | Added to matrix |
| Annexures A–H · branch/risk rating, DCFCL/QOR/LDCL, AHR, Shariah rating & virtual-audit risks | Evidence, scoring and reference-control basis | Reference evidence |
Coverage correction: These rows make exclusions visible and reviewable. The supplemental entries do not turn the 24-question core score into an official Bangladesh Bank rating; they identify where a bank should perform additional risk assessment, evidence review, specialist testing or escalation.
These working-paper aids reproduce the thresholds, weights and rating logic stated or sampled in the July 2026 Guideline. They are separate from the site’s 24-question/72-point diagnostic and do not create an official Bangladesh Bank rating.
Enter the combined business-unit score from the bank’s documented risk-grading work. The circular lists branch rating, pre-audit control functions, AML testing, RBIA and post-audit compliance as inputs.
| Score | Risk level | Audit frequency |
|---|---|---|
| 0.00–40.00% | Low | Yearly |
| 40.01–60.00% | Moderate | Yearly |
| 60.01–80.00% | Above Average | Half-yearly |
| 80.01–100.00% | High | Quarterly |
Enter component scores out of 100. The sample composite uses Financial Health 40%, ICMS Health 35% and Image & Reputation 25%; higher scores indicate stronger health.
| Score | Rating | Interpretation |
|---|---|---|
| 90+ | Excellent | Strong / full compliance |
| 80–89 | Very Good | Generally compliant; minor gaps |
| 70–79 | Good | Minor weaknesses or gaps |
| 60–69 | Satisfactory | Corrective action needed |
| Below 60 | Marginal | High risk / ineffective controls |
Enter the branch, window or unit score out of 100 using the Annexure-G scoring sheet. Unlike the Health Report, a higher score here means greater Shariah non-compliance risk.
| Score | Risk category | Audit frequency |
|---|---|---|
| 50.00–100.00 | High | Twice a year |
| 30.00–49.99 | Above Average | At least once a year |
| 15.00–29.99 | Moderate | As decided by Shariah Board / SSC / ICMS |
| 0.00–14.99 | Low | As decided by Shariah Board / SSC / ICMS |
Annexure-A supplies the 3×3 probability × impact matrix shown above. Annexure-B supplies the branch audit line-item scoring sheet; complete that sheet with branch evidence before using its result in the Chapter 3.5 business-unit grading.
Framework boundary: The calculators above are browser-only aids for applying the circular’s published/sample thresholds. Keep the 24-question/72-point score separate, retain the bank’s evidence and approvals, and validate every conclusion against the full circular and applicable instructions.
The suite maps the key control, monitoring and reporting tools described in the Bangladesh Bank ICMS Guideline, July 2026. These are independent professional review-support blueprints—not official Bangladesh Bank forms, certification or compliance determinations.
Structure branch and unit-level control checks, attestations, exceptions and follow-up evidence across the required review cycles.
Bring branch and sub-branch operational control information into one repeatable quarterly review and escalation pack.
Check whether credit and investment files contain the required approvals, security, legal and supporting documentation.
Monitor single-borrower, group and sector concentration, approved limits, excesses and escalation decisions.
Review trade documents, invoices, Bills of Lading, parties and transaction context for value, quantity, description and sanctions-related red flags.
Track expiry dates, outstanding exposure, margin, limit usage and timely action for letters of credit and guarantees.
Keep market-risk limits, value-at-risk, dealer limits and breach escalation visible for treasury and management review.
Trigger re-assessment after downgrades, adverse information, negative financial performance or other material changes.
Review project governance, technology dependencies, identity and access, data protection, vendors, incidents and recovery readiness.
Assess fraud-risk controls, preventive and detective measures, reporting routes, investigation readiness and closure evidence.
Bring together control health, material weaknesses, monitoring evidence, unresolved actions and governance review for the reporting period.
Support independent assurance planning around governance, risk management, internal controls, evidence quality and remediation.
Chapter 8 of the July 2026 Guideline covers progressive and contemporary control practices. This reference map is not added to the current 24-question core assessment.
Reference domains include concurrent audit, information-system audit, virtual or remote audit, whistleblower arrangements and forensic audit.
Review lensAssess scope, governance, evidence, technology and proportionality against the bank’s context and applicable requirements.Scope note: This specialist card is a coverage map, not an official Bangladesh Bank form or a compliance conclusion. The listed domains should be assessed through the bank’s approved policies, responsible functions and applicable regulatory instructions.
The checklist uses the Three Lines of Defense as a practical conversation structure. It does not assess a bank’s compliance on behalf of the regulator.
Own the risks in day-to-day activities, execute controls, preserve evidence and escalate exceptions.
Set frameworks, monitor effectiveness, provide specialist challenge and coordinate corrective action.
Provide independent, objective assurance to the Board and Audit Committee on governance and controls.
Answer all 24 prompts using the strongest evidence currently available. The result is an indicative internal discussion score, not an official compliance grade.
This result is indicative, self-reported and not evidence-verified. It is not a regulatory rating, audit opinion, certification or compliance determination.
Use this browser-only tracker to structure ownership, deadlines and evidence requirements after the review. Do not enter confidential customer information.
| Issue / action | Owner | Priority | Due date | Status | Evidence / notes | |
|---|---|---|---|---|---|---|
| Confirm ICMS architecture, roles and reporting lines | Board / SMT | Approved structure and meeting record | ||||
| Establish TBML red-flag review and escalation workflow | Compliance / Trade Finance | Methodology, sample alerts and reviewer sign-off | ||||
| Prepare annual ICMS health-report methodology | Compliance / Internal Audit | Scoring method, evidence pack and approval route |
The tracker runs in this browser and is not connected to a bank system or server-side case database. Export and store the file only through an approved institutional process.
Illustrative example only—not linked to the current assessment result. It is a discussion structure for management and the Audit Committee, not a prescribed Bangladesh Bank reporting format.
Illustrative example · Not linked to this assessment result · Toolkit version 1.1
Core control functions are identified, but evidence quality, monitoring coverage and corrective-action ownership require further validation.
Strengthen the linkage between trade documents, exception indicators, authorised review and periodic reporting.
Each prompt is scored from 0 to 3. The 24-question instrument has a maximum indicative score of 72. It is a compressed practical diagnostic, not a complete clause-by-clause mapping of every applicable ICMS guideline or evidence of effective control operation. This composite score is an independently created RegTech Nexus AI diagnostic for internal prioritisation—not a Bangladesh Bank rating. The circular contains separate official scoring and risk-rating frameworks, including Chapters 3.5, 6.4 and 7.5 and Annexures A, B and G; see the framework references above.
Use the strongest available evidence: approved documents, meeting records, reports, system extracts, testing results, issue registers and closure validation. A “3” should be supported by evidence, not intention.
This static page processes assessment answers in the browser. Do not enter customer names, account data, transaction details, confidential documents or regulated personal information.
Primary source: Bangladesh Bank, Guidelines on Internal Control Management System in Banks, July 2026. Toolkit version: 1.1 · Last reviewed: 26 September 2026.
Verify against the official guideline ↗Responsible use: This toolkit supports professional analysis and internal discussion. It does not provide legal advice, regulatory approval, an audit opinion, an official Bangladesh Bank interpretation or an automatic compliance determination.