Circular No. 38/2025/TT-NHNN Issuing the Internal Control and Internal Audit Regulations of the State Bank of Vietnam

CIRCULAR

Issued REGULATION ON INTERNAL CONTROL AND INTERNAL AUDIT State Bank of Vietnam

 

Pursuant to the Law on the State Bank of Vietnam No. 46/2010/QH12 Law No. 46/2010/QH12;

Pursuant to the Accounting Law No. 88/2015/QH13;

Pursuant to the Government Decree No. 05/2019/NĐ-CP on internal audit;

Pursuant to Decree No. 26/2025/NĐ-CP of the Government stipulating the functions, tasks, powers, and organizational structure of the State Bank of Vietnam;

At the proposal of The Chairman of the State Bank of Vietnam Inspectorate;

The Governor of the State Bank of Vietnam promulgates this Circular issues Article 24THE ON INTERNAL CONTROL AND INTERNAL AUDIT OF THE STATE BANK OF VIETNAM.

Article 1. This Circular promulgates the Regulation on Internal Control and Internal Audit of the State Bank of Vietnam.

Article 2. This Circular takes effect from December 15, 2025 and replaces Circular No. 06/2020/TT-NHNN on Internal Control and Internal Audit of the State Bank of Vietnam.

Article 3. Heads of units under the State Bank of Vietnam and related organizations and individuals are responsible for implementing this Circular.

 

 

REGULATIONS

INTERNAL CONTROL AND INTERNAL AUDIT OF THE STATE BANK OF VIETNAM

(Attached to Circular No. 38/2025/TT-NHNN)

PART I

GENERAL PROVISIONS

Article 1. Scope of Regulation

This Regulation stipulates the internal control and internal audit of the State Bank of Vietnam (hereinafter referred to as the State Bank).

Article 2. Applicability

1. Units under the State Bank system, including: Departments, Bureaus, and equivalent units; Branches of the State Bank in Regions and public service units directly under the State Bank.

2. Banking supervisors, persons engaged in internal control and internal audit at the State Bank.

3. Other organizations and individuals related to the activities of internal control and internal audit at the State Bank.

Article 3. Explanation of Terms

In this Regulation, the following terms shall be understood as follows:

1. The State Bank's internal control system means the overall set of regulations, procedures, and measures for control that comply with legal provisions established and implemented in units under the State Bank system to achieve the objectives specified in Article 4 of this Regulation.

2. Internal control activity means the supervisory activity of the subjects specified in Clause 6 and Clause 7 of this Article over the performance of duties and powers of departments, units, and individuals within their own units to achieve the objectives specified in Article 4 of this Regulation.

 3. Internal audit activity means the inspection and evaluation activity of the subject specified in Article 8 of this Regulation regarding the effectiveness and efficiency of the internal control system at the audited unit and providing recommendations or advisory opinions to achieve the objectives specified in Article 13 of this Regulation.

4. Risk-oriented internal control and internal audit means the monitoring, inspection, and evaluation approach based on identifying and assessing the significance and risk levels for each activity and business process, prioritizing resources to monitor, inspect, and evaluate activities and business processes deemed significant or having high risk levels.

5. Dual control principle means the assignment of tasks, especially high-risk business operations, to be carried out by at least two people to supervise and control each other.

6. Internal control department means the department assigned to perform internal control tasks in units under the State Bank system.

7. Person engaged in internal control work means civil servants and officials assigned to perform internal control tasks in units under the State Bank system.

8. Person engaged in internal audit work means civil servants under the State Bank Inspectorate assigned to perform internal audit tasks in units under the State Bank system.

9. Related person means father, mother, adoptive father, adoptive mother, father-in-law, mother-in-law, father-in-law, mother-in-law, wife, husband, biological child, adopted child, full brother, full sister, full brother, full sister-in-law, full brother-in-law, full sister-in-law.

Chapter II

INTERNAL CONTROL

Article 4. Objectives internal control activities internal control

1. Ensuring that the unit's operations comply with laws, regulations of the State Bank, and internal regulations of the unit (if any).

2. Ensuring the safe, efficient, and economical management and use of assets and resources; preventing and limiting risks.

3. Enhancing effectiveness in management, operation, and business activities of the unit.

Article 5. Principles internal control activities internal control

1. Compliance with laws, regulations of the State Bank, and internal regulations of the unit (if any).

2. Suitability to the scale, nature, and specific characteristics of the unit's operations.

3. Implementation according to the internal control program approved by the head of the unit.

Article 6. Requirements internal control activities internal control

1. Internal control activities must be continuous and consistent with the daily operations of the unit.

2. Ensuring clear responsibilities and authorities between the unit's leadership and each department, section, individual, especially high-risk business areas to prevent manipulation of activities by civil servants, employees, and workers within the unit, implementing dual control principles.

3. Individuals assigned to internal control work must meet the standards regarding qualifications, skills, experience, and moral character of civil servants and employees as stipulated by law and the State Bank; ensuring relative independence when performing internal control tasks at their own units.

 Article 7. Scope and Methods of Internal Control

1. Internal control activities are carried out for all operations conducted by units under the State Bank system.

2. Methods of internal control include: compliance monitoring and risk-oriented monitoring.

Article 8. Contents of Internal Control Activities

1. Units, departments, sections, and individuals must regularly self-review the implementation of legal provisions, State Bank regulations, and internal regulations (if any) to promptly identify existing issues, inadequacies, and propose appropriate supplements and revisions.

2. Implementing self-supervision of accounting and financial systems, asset management, security of funds, information technology, and the compliance, effectiveness, and efficiency of operations of departments, sections, and individuals within the unit; promptly identifying errors, risks, and proposing corrective measures.

3. Establishing mechanisms for supervising, managing, and utilizing information systems, reports, and internal information exchange to prevent risks and handle incidents serving management and operational purposes.

Article 9. Responsibilities and Authorities of the State Bank Inspectorate

1. Advising the Governor of the State Bank (hereinafter referred to as the Governor) on maintaining an effective and efficient internal control system of the State Bank.

2. Submitting to the Governor for issuance: procedures for internal control operations of the State Bank; guidelines for internal control operations for units under the State Bank system.

3. Summarizing evaluations and advising the Governor on handling issues arising from internal control activities.

4. Monitoring the implementation of recommendations from units under the State Bank system through compiling reports on the results of internal control work.

Article 10. Responsibilities and Authorities of Unit Heads

1. Responsibilities:

a) Establishing and organizing internal control activities at the unit in accordance with this Regulation;

b) The unit head directly directs or assigns one Deputy Head to oversee internal control activities at the unit; arranging an internal control department and personnel for internal control work at the unit;

c) Approving the internal control program of the unit;

d) Creating conditions for the internal control department and personnel engaged in internal control work to effectively perform their assigned tasks;

e) For units without an internal control department, the unit head shall establish an internal control system based on the scale, nature of operations, and management requirements to achieve the objectives set forth in Article 4 of this Regulation;

f) Being responsible before the Governor for internal control work at the unit.

2. Authorities:

a) Having the authority to proactively allocate resources and decide on specific measures and methods to implement internal control work at the unit in accordance with this Regulation;

b) Handling according to their authority or recommending higher authorities to handle collectives or individuals who violate laws or State Bank regulations discovered through internal control activities.

Article 11. Duties and Authorities of the Internal Control Unit and Internal Control Staff at Units

1. Duties:

a) Develop the annual internal control program to be submitted for approval by the Head of the unit before December 31 each year;

b) Develop the internal control program outside the cases specified in point a, Clause 1, Article 11 of this Regulation (if applicable) to be submitted for approval by the Head of the unit;

c) Organize the implementation of the internal control program after it has been approved;

d) Advise the Head of the unit on implementing internal control activities in accordance with this Regulation;

đ) Recommend and propose to the Head of the unit to handle according to their authority or recommend to the competent authority to handle groups or individuals who violate laws or regulations of the State Bank discovered through internal control activities;

e) Be responsible to the Head of the unit for the results of assigned tasks.

2. Authorities:

a) Have access to and provide all relevant information and documents related to the unit's operations to perform internal control tasks in a timely manner;

b) Recommend to the Head of the unit to implement necessary measures to enhance the effectiveness and efficiency of internal control work at the unit; in case the Head of the unit does not handle or handles incorrectly, they may submit recommendations in writing to the Governor (through the State Bank Inspectorate);

Article 12. Reporting on Internal Control Work

1. The Internal Control Unit and internal control staff are responsible for regularly or urgently reporting the results of their work to the Head of the unit; the content and deadlines for reports are determined by the Head of the unit;

2. Annually, units must report to the Governor (through the State Bank Inspectorate) the results of internal control work at the unit before January 15 of the following year in accordance with the attached Appendix to this Regulation; urgent reports shall be made upon request of the State Bank Inspectorate (if applicable);

3. When risks arise leading to loss of funds, assets, or information security managed by the unit, the unit must promptly report in writing to the Governor (through the State Bank Inspectorate) within 24 hours from the time of discovery;

Chapter III

INTERNAL AUDIT

Article 13. Objectives of Internal Audit Activities

1. Assessing the effectiveness and efficiency of the State Bank's internal control system and the efficiency of internal control activities of audited units;

2. Evaluating the reliability of financial statements, the effectiveness of activities, compliance with laws and regulations, and business procedures of the State Bank, ensuring asset safety.

Article 14. Principles of Internal Audit Activities

1. Adhering to laws, regulations, procedures, and plans approved by the Governor;

2. Ensuring independence, honesty, objectivity, and maintaining state secrets and the confidentiality of audited units;

3. Not hindering the normal operation of audited units;

4. Having access to documents, files, transactions, and other necessary materials of the audit subjects to achieve audit objectives.

Article 15. Requirements for Internal Audit Activities

1. Internal audit activities must be conducted independently without interference in determining the scope, content, and results of audits;

2. Internal audit staff must aim to ensure compatibility with Vietnamese internal audit standards and ethical principles issued by authorized state agencies when conducting audits;

3. It is prohibited to assign internal audit staff to conduct audits of:

a) Activities or units where they were responsible for performing activities or managing departments within three years from the date of decision not to perform such activities or manage those departments;

b) Units where relatives of internal audit staff are unit leaders, chief accountants (or heads of accounting departments), heads of departments/units responsible for internal control work, and internal control staff of that unit.

Article 16Prohibited Conduct in Internal Audit Activities

1. Strictly prohibit the following actions against the State Bank Inspectorate, the Head of the Audit Team, and members of the audit team:

a) Engaging in acts of embezzlement, corruption, favoritism, waste, profiteering, harassment, and other violations of laws during the audit process;

b) Misusing duties, powers, and related information for personal gain;

c) Colluding with audited units to distort the contents of audit documents and reports;

d) Disclosing state secrets, secrets of audited units, or audit information, situations, and results before official issuance or publication;

đ) Engaging in other actions contrary to laws and regulations of the State Bank;

2. Strictly prohibit the following actions against audited units and related organizations and individuals:

a) Refusing to provide information and documents (including those containing state secrets) related to audit plans and contents as required by the State Bank Inspectorate and the internal audit team;

b) Obstructing or making difficulties for internal audit activities;

c) Providing false, incomplete, untimely, or unobjective information and data related to internal audit contents;

d) Bribery, solicitation, or collusion with the audit team to distort the contents of audit documents and reports;

đ) Other prohibited actions as stipulated by laws and regulations of the State Bank;

3. Strictly prohibit organizations and individuals from interfering illegally in internal audit activities.

Article 17Management and Direction of Internal Audit Activities

The Governor directly directs or assigns one Deputy Governor in charge to direct internal audit activities of the State Bank, including:

1. Approving the annual and ad hoc internal audit plans of the State Bank as requested by the Governor (if applicable).

2. Enact provisions on the organization and operation of the Internal Audit Group; the internal audit process of the State Bank (hereinafter referred to as the internal audit regulation, internal audit process of the State Bank).

3. Direct the Inspectorate of the State Bank to implement necessary measures to ensure the effectiveness and efficiency of the internal audit activities of the State Bank.

Article 18Scope, objects, methods of internal audit

1. The scope of internal audit includes all activities of the State Bank.

2. The objects of internal audit are all units specified in Clause 1, Article 2 of this Regulation.

3. The method for conducting internal audit is risk-oriented auditing.

Article 19Content of internal audit activities

1. The internal audit activities of the State Bank include:

a) Financial audit: Assessing the reliability of financial reports of the audited unit;

b) Compliance audit: Evaluating and confirming compliance with laws, regulations, and procedures that the audited unit must follow;

c) Operational audit: Assessing the effectiveness of operations and asset safety.

2. Advising and consulting with the audited unit on measures to address deficiencies, errors, limitations, improve and enhance the effectiveness of internal control activities, ensuring safety, efficiency, compliance with laws, and achieving set objectives.

Article 20. Annual Internal Audit Plan

1. The Inspectorate of the State Bank shall develop the annual internal audit plan of the State Bank, submit it for approval by the Governor before December 31, and notify all units within the State Bank system of the approved internal audit plan for implementation.

2. The annual internal audit plan must clearly define the content, scope, and objects of the audit and meet the following requirements:

a) All activities and units must be considered and evaluated; Prioritize audits of activities and units with high risk levels, scheduling appropriate cycles and frequencies;

b) Reserve sufficient time to conduct surprise audits at the request of the Governor or when there are signs of violations or high risks;

c) Adjust the plan when there are fundamental changes in content, scope of risk, available resources, or at the request of the Governor.

Article 21. Implementation of the annual internal audit plan, audit decision 1. Based on the approved annual internal audit plan, the Chief Inspector of the State Bank organizes the implementation of audits according to the internal audit regulation and process of the State Bank; issues detailed audit plans suitable to available resources and actual conditions of each audit, including: estimated audit duration, audit team composition, audit content, scope, objects, and other related requirements.

2. The Chief Inspector of the State Bank, acting on behalf of the Governor, signs the audit decision based on the approved annual internal audit plan. The audit decision includes the following contents:

a) Basis for conducting the audit;

b) Audited unit;

c) Objectives, content, scope of the audit;

d) Time and location of the audit;

e) Head and members of the audit team;

f) The audit decision must be notified to the audited unit at least three working days before the audit begins, except in cases of surprise audits at the request of the Governor.

e) Other contents (if any).

Any amendment or supplement to the audit decision (if any) must be immediately notified to the audited unit and the audit team.

The Decision to amend and supplement the Audit Decision (if any) must be immediately notified to the audited entity and the Audit Team.

Article 22. Internal Audit Reports

1. The audit report is prepared for each audit and issued in accordance with the internal audit process of the State Bank of Vietnam.

2. The Inspectorate of the State Bank of Vietnam shall aggregate and evaluate the results of the annual audit plan, and report to the Governor before January 31 of the following year.

3. Emergency reports: When serious violations or risks of asset loss, information security breaches, or damage to the reputation of the State Bank of Vietnam are discovered, or upon request from the Governor, the Inspectorate of the State Bank of Vietnam must submit a written report to the Governor within 48 hours from the time of discovery of the violation or receipt of the Governor's request.

Article 23Forms of handling in internal audit reports and implementation of recommendations in internal audit activities

1. Forms of handling in internal audit reports include:

a) Recommendations: These are advisory opinions aimed at preventing risks, improving quality, and enhancing operational efficiency.

b) Suggestions: These are requirements to correct operations and address existing deficiencies, errors, and limitations; accountability reviews or referral to the Governor for consideration and handling according to regulations.

2. Responsibilities for Implementation

a) Audited units and other related units are responsible for fully implementing all suggestions in the audit report within the specified timeframe.

b) Audited units are encouraged to study and apply recommendations to amend, supplement, and improve business processes, prevent risks, and enhance operational efficiency.

Article 24Duties and Authorities of The Inspectorate of the State Bank of Vietnam

1. Duties:

a) Organize risk assessment in the operations of the State Bank of Vietnam; prepare annual and emergency internal audit plans as required by the Governor, submit them for approval by the Governor; implement internal audit activities according to the approved annual internal audit plan.

b) Monitor, supervise, and inspect the implementation of suggestions in audit reports.

c) Submit to the Governor for issuance of regulations and procedures for internal auditing of the State Bank of Vietnam.

d) Issue guiding documents on regulations and procedures for internal auditing of the State Bank of Vietnam.

đ) Coordinate with relevant units to develop professional standards and business practices for bank auditors as a basis for recruitment, utilization, training, and development of personnel involved in internal control and internal auditing.

2. Authorities:

a) Ensure necessary resources and conditions to meet the requirements of internal auditing activities.

b) Access, exchange, and interview civil servants, employees, and workers of audited units regarding issues related to the scope and content of audits.

c) Recommend to the Governor for consideration and resolution of difficulties and obstacles arising during internal auditing activities.

d) Recommend to the Governor for consideration of responsibility and handling of organizations and individuals who fail to comply with audit decisions and internal audit recommendations.

đ) Exercise other authorities assigned by the Governor and as stipulated by law.

Article 25Duties and Authorities of the Chief Inspector of the State Bank of Vietnam

1. Responsibilities:

a) Be accountable to the Governor for the results of internal audit activities.

b) Examine and resolve complaints and recommendations from audited units within their authority.

c) Perform other tasks as required by the Governor related to internal audit activities.

2. Authorities:

a) Sign audit decisions on behalf of the Governor as prescribed.

b) Decide on the exploitation and use of internal audit files to serve work or provide to relevant organizations and individuals in accordance with laws and regulations of the State Bank of Vietnam.

c) Exercise other authorities assigned by the Governor and as stipulated by law.

Article 26Internal Audit Teams

1. Internal audit teams are established to perform audit tasks according to approved plans.

2. The composition of the audit team includes the Team Leader, Deputy Team Leader (if any), and members. The internal audit team is decided by the Chief Inspector of the State Bank of Vietnam based on the requirements of the audit.

3. Qualifications for the Team Leader and Deputy Team Leader of the audit

a) Possess professional qualifications, leadership capabilities, and work experience appropriate to the assigned tasks.

b) Be senior specialists or hold positions equivalent to Deputy Department Heads or higher.

4. Activities of the audit team; duties, authorities, and responsibilities of the Team Leader and members of the audit team are carried out in accordance with the internal audit regulations and procedures of the State Bank of Vietnam.

Article 27Duties and Authorities of Audited Units

1. Responsibilities:

a) Comply with internal audit decisions of the State Bank of Vietnam.

b) Provide complete and timely information, documents, records, and reports (including those containing state secrets) related to the audit content; bear responsibility before the Governor for the accuracy, truthfulness, and objectivity of the provided information and documents.

c) Fully and promptly explain and provide information on matters within the audit content when requested and be responsible for the content of explanations.

d) Facilitate the audit team in performing their tasks.

đ) Implement audit recommendations (including emergency inspection recommendations) and report on the implementation of recommendations in writing to the State Bank of Vietnam (through the Inspectorate of the State Bank of Vietnam).

2. Authorities:

a) Refuse to provide unrelated information and documents.

b) Provide written explanations and retain views and opinions on issues raised in draft audit reports.

c) Appeal against evaluations, conclusions, and audit recommendations.

d) Appeal or request replacement of the Team Leader or members of the audit team if there is evidence of legal violations or breaches of this Regulation (including non-compliance with requirements stipulated in Article 15 of this Regulation) affecting the integrity and objectivity of the audit results.

đ) Exercise other rights as provided by law and the State Bank of Vietnam.

Article 28. Quality Control of Internal Audit Activities

1. Internal audit activities and each internal audit of the State Bank of Vietnam must be internally monitored and evaluated to ensure compliance with legal provisions and to enhance the effectiveness and quality of auditing.

2. The Head of the State Bank of Vietnam Inspectorate shall stipulate, guide, and organize the assessment and control of the quality of internal audit activities of the State Bank of Vietnam in accordance with the requirements and tasks assigned.

Article 29. Internal Audit Files

1. Documentation for each audit must be established in a file.

2. Responsibilities, methods of establishment, components, and list of internal audit files shall be carried out in accordance with the internal audit procedures of the State Bank of Vietnam.

3. The preservation and storage of internal audit files shall be implemented in accordance with the provisions of the law and the regulations of the State Bank of Vietnam on archiving.

Chapter IV

BANK AUDITORS

Article 30. Bank Auditors

1. Civil servants engaged in internal control and internal audit work at the State Bank of Vietnam may be considered for appointment to the position of bank auditor if they meet the conditions and criteria as prescribed by the State Bank of Vietnam.

2. The rank of bank auditor includes: bank auditor, senior bank auditor, and principal bank auditor.

3. Bank auditors shall perform their functions, duties, and powers as prescribed by the Governor and other relevant documents; they shall enjoy benefits and policies as provided by law and the State Bank of Vietnam.

Article 31. Appointment and Removal of Bank Auditors

1. Based on the conditions and criteria prescribed by the Governor, units shall establish files for the appointment and removal of bank auditors and submit them to the Department of Organization and Cadres.

2. The Department of Organization and Cadres, in collaboration with the State Bank of Vietnam Inspectorate, shall present to the Governor for decision on the appointment and removal of bank auditors in accordance with the regulations./.