Discover the Crucial Auditor Role in ECL for Compliance

1. Why this topic matters for IFRS 9 reporters

Auditors play a central role in ensuring that ECL methodology and outputs are reliable, auditable and compliant with IFRS 9 and related disclosure requirements such as IFRS 7 Disclosures. For banks, leasing companies, and non‑bank lenders, inadequate audit coverage of ECL models can lead to misstated provisions, regulatory pushbacks and reputational risk. The auditor role in ECL is not purely an accounting check — it spans model validation, governance, data lineage, scenario design and the appropriateness of business‑driven judgments.

As part of a content cluster on IFRS 9 implementation challenges, this article complements our broader discussion and links to the pillar article that explains why implementation is complex and where audit focus should be concentrated.

Reference pillar article: Read the cluster anchor: The Ultimate Guide: Key challenges institutions face when implementing IFRS 9 – an overview of the difficulties and why implementation is complex.

2. Core concept: What the auditor role in ECL covers

Definition and scope

The auditor role in ECL involves independent assurance that the entity’s ECL Methodology is applied consistently, that models and inputs are appropriate, and that outputs are reproducible. Auditors must evaluate governance, documentation, model performance (PD, LGD and EAD Models), sensitivity testing, and disclosures.

Main components auditors must examine

• Model governance and change control: Verify approvals, version control, and traceability of model changes under Risk Model Governance.
• PD, LGD and EAD Models: Assess calibration, back‑testing, and the reasonableness of macroeconomic linkages and segmentation.
• Three‑Stage Classification: Confirm stage migration rules (12‑month ECL vs lifetime ECL) and management overlays.
• Sensitivity Testing & stress scenarios: Evaluate how sensitive ECL is to plausible shifts in PD, LGD and EAD and whether that sensitivity is reflected in provision buffers.
• Data & IT controls: Test data lineage from source systems to the calculations and reconciliations to the general ledger.
• IFRS 7 Disclosures: Ensure disclosure completeness, policy clarity and reconciliations between models and reported numbers.

Concrete example

Example: A retail portfolio with exposures of 500 million and an average PD of 1.0% and LGD of 40% yields a 12‑month ECL (approx) = 500m * 1.0% * 40% = 2.0m. If sensitivity testing increases PD by 1 percentage point (to 2.0%), ECL doubles to 4.0m. As an auditor you must verify that this sensitivity is reasonable, documented, and that management considered it for provisions and disclosures.

3. Practical use cases and audit scenarios

Below are recurring audit scenarios auditors encounter in the field with suggested procedures.

Scenario A — New or materially changed PD model

When credit risk changes or new scoring is introduced, auditors should: review validation reports, run independent calibration checks on a sample, test segment alignment, and confirm model governance sign‑offs. Check that migration matrices used for PD construction are documented and justified.

Scenario B — Stage migration spikes after macro shock

If there is a sudden increase in transfers to Stage 2, auditors should verify the trigger rules for significant increase in credit risk, review day‑to‑day monitoring reports, and test a sample of cases for consistent application of the Three‑Stage Classification policy.

Scenario C — Management overlays and judgemental adjustments

For overlays (e.g., pandemic adjustments), document evidence supporting the adjustment sizes, back‑test their impact on ECL, and assess whether similar adjustments were required in previous periods. Confirm that adjustments are applied consistently across similar portfolios.

Scenario D — Disclosure gaps

Auditors must reconcile model outputs to the disclosures required under IFRS 7 and ensure that qualitative explanations (e.g., macroeconomic scenarios used) match the quantitative results.

For internal assurance, combine model reviews with process audits; for a second line or internal audit function, reference our guidance on Internal audit of ECL to align expectations between audit types.

4. Impact on decisions, performance and outcomes

Strong audit coverage reduces provisioning misstatements, limits regulatory findings, and improves stakeholder confidence. Practical impacts include:

• More accurate capital planning due to reliable ECL numbers and scenario sensitivity.
• Fewer restatements and regulatory queries, preserving reputation and reducing remediation costs.
• Improved management of risk appetite by identifying model blind spots early (e.g., PD underestimation in downturns).
• Clearer investor communications through robust IFRS 7 Disclosures linking assumptions to observed outcomes.

Audit findings that highlight weaknesses in Risk Model Governance often trigger targeted remediation — from better data controls to more frequent sensitivity testing — which in turn improves profitability forecasting and capital efficiency.

5. Common mistakes auditors and institutions make — and how to avoid them

1. Overreliance on vendor or management-supplied results: Always reproduce a meaningful sample of model outputs independently and review model code or mathematics where practical.
2. Insufficient sensitivity testing: A common gap is running only a single scenario. Require at least three plausible scenarios (base, upside, downside) and validate how PD, LGD and EAD Models respond.
3. Poor documentation of judgemental overlays: Demand written rationale, evidence and retrospective reviews showing whether overlays were directionally correct.
4. Ignoring classification rules: Incorrect application of the Three‑Stage Classification inflates or deflates ECL materially; sample test for consistent rule application across portfolios.
5. Weak coordination between financial audit and model audit teams: Align expectations by cross‑referencing audit work — for model level issues see our guidance on ECL model audit.

Also, ensure external and internal audit scopes are complementary: the financial auditor should coordinate with subject matter experts — for example, see our note on External audit of ECL for typical external auditor procedures.

6. Practical, actionable tips and checklists

Use the short checklists below during planning, fieldwork and reporting phases.

Planning checklist (auditor)

• Identify material portfolios and map models (PD, LGD and EAD Models) that feed ECL.
• Assess model change log and recent approvals under Risk Model Governance.
• Plan sensitivity scenarios: at minimum, base, +1 SD, -1 SD for key macro drivers.
• Allocate specialists for quantitative validation and data lineage testing.

Fieldwork checklist (sample procedures)

• Recompute ECL for a representative sample of accounts and reconciliations to GL.
• Validate model performance metrics (e.g., PSI, Brier score for PD models) and check backtesting windows.
• Perform targeted Sensitivity Testing: show the % change in ECL for a +100bps PD shock.
• Test implementation of the Three‑Stage Classification rules using a random and risk‑based sample.
• Inspect IFRS 7 Disclosures for consistency with underlying model assumptions and scenario weights.

Reporting checklist

• Summarize findings clearly, with quantified potential misstatements and recommended remediation timelines.
• Differentiate between model risk, data risk and process risk in the report.
• Include action items for management to improve documentation, controls, and forward‑looking inputs.

To improve auditor effectiveness, invest in training such as Audit skills for ECL and communication proficiency with stakeholders; our guidance on Communication skills for ECL helps translate technical findings into board‑level action items.

KPIs / Success metrics

• Coverage: % of material portfolios with independent model validation in the last 12 months.
• Model calibration: PD calibration p‑value thresholds and hit ratios (target: within tolerance band defined by validation policy).
• Backtesting accuracy: deviation between predicted and observed defaults over rolling 12/24/36 month windows.
• Reconciliation rate: % of portfolio ECL that reconciles to GL without manual adjustments.
• Sensitivity responsiveness: % change in ECL under prescribed PD/LGD/EAD shocks documented and reviewed.
• Remediation closure time: median days to resolve audit findings related to ECL models and controls.
• Disclosure completeness: number of IFRS 7 Disclosures requiring revision post-audit.

FAQ