This article examines how Iraqi banks can manage compliance remediation across multiple findings by assigning clear ownership and defining the evidence required to close each one. Banks receive findings from several sources: Central Bank of Iraq inspections, internal audit, external auditors, correspondent bank reviews and their own compliance testing. Over time, the number of open findings can grow, deadlines can be missed and the same issues can reappear. The cause is usually not a lack of willingness to remediate but a lack of structure.
Two elements make the difference. First, every finding needs a single owner who is accountable for its resolution. Second, every finding needs a defined standard of closure evidence agreed before work begins. Without these, findings are passed between departments, closed prematurely on the basis of promises and reopened when the regulator or auditor returns.
The Banking Law No. 94 of 2004 and the Central Bank of Iraq Law No. 56 of 2004 give the Central Bank powers to require corrective action and to sanction failures. The Anti-Money Laundering and Counter-Terrorism Financing Law No. 39 of 2015 governs a significant category of findings. Central Bank corporate governance guidance sets expectations for the roles of the board, audit committee, internal audit and compliance in addressing findings. The Labour Law No. 37 of 2015 is relevant where remediation involves staff accountability.
Consolidating findings into a single register
The first step is a consolidated register of all open findings, regardless of source. The register should record:
- Source and date. Who raised the finding and when.
- Description. The deficiency identified and the requirement concerned.
- Risk rating. The significance of the finding, considering regulatory, financial and reputational impact.
- Owner. The individual accountable for resolution.
- Actions and deadlines. The corrective steps and their target dates.
- Status. Open, in progress, pending validation or closed.
- Evidence. The documents demonstrating completion.
A single register allows management and the board to see the full picture, identify findings that share a root cause and prioritise resources.
Assigning ownership
Each finding should have one owner, usually the head of the business or function where the deficiency arose. Compliance and internal audit should not own findings in other departments’ areas, because their role is to advise and verify, not to implement. Where a finding spans several functions, one owner should coordinate and others should own specific actions.
Owners should have the authority and resources to deliver. If remediation requires system changes, the owner needs access to technology resources. If it requires policy changes, the owner needs a path to board approval. Corporate governance advice in Iraq can help design accountability structures that align with the bank’s governance framework.
Defining closure evidence in advance
Before work begins, the owner, compliance and internal audit should agree what evidence will demonstrate closure. Evidence should show that the deficiency has been corrected and that controls now prevent recurrence. Examples include:
- Policy findings. The revised policy, board approval and evidence of communication and training.
- Process findings. Revised procedures, evidence of implementation and samples showing the procedure being followed.
- System findings. Change records, test results and post-implementation samples.
- Data findings. Evidence that affected records have been corrected, with reconciliation reports.
Agreeing evidence in advance avoids disputes later about whether a finding is closed and ensures that work is directed at what will satisfy the regulator.
Tracking progress and escalating delays
The register should be reviewed regularly by senior management and reported to the audit committee or risk committee. Findings approaching their deadline without adequate progress should be escalated. Requests to extend deadlines should be justified and approved at an appropriate level, and for regulatory findings, communicated to the Central Bank where required.
Validating closure independently
Owners should not close their own findings. Internal audit or compliance should validate closure by reviewing the evidence and, where appropriate, testing whether the control operates effectively. Findings should move to closed status only after validation. For significant regulatory findings, external validation may be appropriate before reporting closure to the Central Bank.
Identifying root causes across findings
A consolidated register allows the bank to identify common root causes. Several findings concerning incomplete customer files may share a root cause in the onboarding system. Several findings concerning related-party lending may reflect a governance weakness. Addressing the common cause can close multiple findings and prevent future ones. Commercial and regulatory advice in Iraq can help analyse findings for patterns relevant to regulatory obligations.
Reporting to the regulator
When reporting to the Central Bank, the bank should provide accurate status updates supported by evidence. Reports should distinguish findings that are closed and validated from those that are in progress. Overstating progress is damaging when discovered. The bank should maintain an evidence file for each regulatory finding that can be produced quickly during follow-up inspections.
Linking remediation to accountability and incentives
Remediation performance can be included in the objectives of senior managers and reflected in performance assessments. Where findings result from individual misconduct, disciplinary action may be appropriate, consistent with the Labour Law. Employment law advice in Iraq can assist with accountability processes.
Using technology to support remediation
Managing many findings across several sources is difficult with spreadsheets alone, particularly in larger banks. Governance, risk and compliance software, or even a well-designed shared database, can help by recording each finding, linking it to actions and evidence, sending reminders to owners as deadlines approach and generating reports for management and the board.
The tool should be configured to support the bank’s process rather than dictate it. Key features include restricted rights to change status, so that only validators can close findings; an audit trail of changes; the ability to attach evidence files; and reporting that shows trends, such as the age of open findings and the number reopened after closure.
Technology does not replace accountability, but it makes accountability visible. Senior managers can see which findings in their area are overdue, and the audit committee can see whether the overall position is improving. When the Central Bank asks about the status of a finding, the bank can provide a complete history quickly, which itself demonstrates control.
Illustrative example. An Iraqi bank has forty open findings from the Central Bank, internal audit and a correspondent bank review. Several have been reported closed but were reopened on follow-up. The bank creates a single register, assigns each finding to a department head, agrees closure evidence for each and requires internal audit validation before closure. It identifies that twelve findings relate to weaknesses in its customer due diligence system and addresses them through a single system upgrade. Within a year, most findings are closed with evidence that withstands regulatory review.
Conclusion & how Etihad Law Firm can help
Effective compliance remediation in Iraqi banks depends on structure: a consolidated register, clear ownership, agreed closure evidence, independent validation and regular reporting. These elements turn remediation from a recurring burden into a process that strengthens the bank’s compliance and its standing with the regulator.
Etihad Law Firm advises Iraqi banks on remediation programmes, regulatory reporting and compliance governance. We help clients organise remediation work so that findings are closed with evidence that satisfies the Central Bank and other stakeholders.