Skip to content

Evidence request lists

Basel III International Banking Framework

Evidence request list. 28 controls, 28 carrying auditor artefact guidance. Generated from the compliance knowledge graph on 11 September 2026. Published by The Art of Service.

Basel III Capital Buffers and Systemic Surcharges

BASEL3-BUF-1
Capital Conservation Buffer

Hold a capital conservation buffer of 2.5% of RWA, met with CET1 above the minimum requirements. Breaching the buffer triggers constraints on distributions (dividends, buy-backs, discretionary bonuses).

Artefacts an auditor will ask for
  • Buffer position calculation showing CET1 available to meet the buffer
  • Maximum Distributable Amount (MDA) calculation when within the buffer range
  • Board record of distribution decisions referencing the buffer
Where this commonly fails
  • Distributions made while the buffer is breached without MDA constraint
  • CET1 used to meet minimums double-counted toward the buffer
  • Buffer breach not reported to the supervisor
BASEL3-BUF-2
Countercyclical Capital Buffer

Hold a countercyclical capital buffer (0 to 2.5% of RWA in CET1), set by national authorities and applied as a weighted average of the buffers in jurisdictions to which the bank has private-sector credit exposures.

Artefacts an auditor will ask for
  • Geographic distribution of private-sector credit exposures used to weight the buffer
  • Bank-specific countercyclical buffer rate calculation
  • Mapping of announced jurisdictional CCyB rates applied
Where this commonly fails
  • Exposures allocated to the wrong jurisdiction
  • Announced buffer rates not applied on the effective date
  • Buffer add-on omitted from the combined buffer requirement
BASEL3-GSIB-1
G-SIB Higher Loss Absorbency Surcharge

Global systemically important banks must hold an additional CET1 higher loss absorbency requirement (1.0% to 3.5%) determined by their systemic importance bucket under the indicator-based assessment (size, interconnectedness, substitutability, complexity, cross-jurisdictional activity).

Artefacts an auditor will ask for
  • G-SIB indicator submission (the 12 indicators across the five categories)
  • Bucket allocation and resulting HLA requirement
  • Public disclosure of the G-SIB indicators
Where this commonly fails
  • Indicator data inconsistent with the public disclosure template
  • Bucket migration not reflected in the applicable HLA
  • D-SIB national surcharge omitted where additive

Basel III Large Exposures

BASEL3-LEX-1
Large Exposures Limit

Limit the sum of all exposures to a single counterparty or group of connected counterparties to 25% of Tier 1 capital (15% for exposures between G-SIBs), with prescribed connected-counterparty and exposure-value rules.

Artefacts an auditor will ask for
  • Large exposures report showing exposures >= 10% of Tier 1 and limit utilisation
  • Group-of-connected-counterparties identification methodology and records
  • Exposure value measurement including CRM substitution effects
Where this commonly fails
  • Connected counterparties not grouped (control or economic interdependence missed)
  • Exposure value not net of eligible CRM, or CRM creating new concentrations not captured
  • Trading-book and banking-book exposures not aggregated to the limit

Basel III Leverage Ratio

BASEL3-LEV-1
Leverage Ratio

Maintain a Tier 1 leverage ratio of at least 3% (Tier 1 capital divided by the total exposure measure), a non-risk-based backstop to the risk-based requirements.

Artefacts an auditor will ask for
  • Leverage ratio calculation showing Tier 1 capital and the total exposure measure
  • Components of the exposure measure (on-balance-sheet, derivative, SFT, off-balance-sheet CCFs)
  • Reconciliation of the exposure measure to the financial statements
Where this commonly fails
  • Netting applied to the exposure measure beyond what the standard permits
  • Off-balance-sheet items omitted or CCFs misapplied
  • Derivative and SFT exposures not measured per the standard
BASEL3-LEV-2
G-SIB Leverage Ratio Buffer

G-SIBs must meet a leverage ratio buffer equal to 50% of their risk-weighted higher loss absorbency requirement, met with Tier 1 capital, with distribution constraints when breached.

Artefacts an auditor will ask for
  • G-SIB leverage buffer calculation (50% of the HLA requirement)
  • Leverage-ratio-based MDA calculation when within the buffer
  • Disclosure of the leverage ratio buffer requirement and position
Where this commonly fails
  • Leverage buffer not linked to the current HLA bucket
  • Distribution constraints not applied on a leverage-buffer breach
  • Buffer met with capital other than Tier 1

Basel III Liquidity Standards

BASEL3-LCR-1
Liquidity Coverage Ratio (LCR)

Hold a stock of unencumbered high-quality liquid assets (HQLA) at least equal to total net cash outflows over a 30 calendar-day stress scenario (LCR >= 100%).

Artefacts an auditor will ask for
  • LCR calculation showing HQLA (by level, with haircuts and caps) and net cash outflows
  • Run-off and inflow rate assignments by deposit/funding category
  • Daily/monthly LCR monitoring and limit framework
Where this commonly fails
  • Assets counted as HQLA that are encumbered or fail operational requirements
  • Inflows assumed above the 75% cap on outflows
  • Run-off rates understated for less-stable funding
BASEL3-LIQ-1
Liquidity Monitoring Tools

Report the supervisory liquidity monitoring metrics: contractual maturity mismatch, concentration of funding, available unencumbered assets, LCR by significant currency, and market-related monitoring tools.

Artefacts an auditor will ask for
  • Contractual maturity mismatch report
  • Funding concentration report (by counterparty, product, currency)
  • Available unencumbered asset inventory
  • LCR by significant currency
Where this commonly fails
  • Significant currencies not identified for currency LCR
  • Funding concentrations under-reported through aggregation
  • Encumbrance status of assets not maintained
BASEL3-NSF-1
Net Stable Funding Ratio (NSFR)

Maintain available stable funding (ASF) at least equal to required stable funding (RSF) over a one-year horizon (NSFR >= 100%), promoting structural funding stability.

Artefacts an auditor will ask for
  • NSFR calculation applying ASF factors to funding and RSF factors to assets and off-balance-sheet items
  • Maturity and counterparty classification of funding sources
  • Interdependent asset/liability treatments where applied
Where this commonly fails
  • ASF/RSF factors mis-assigned by residual maturity or counterparty type
  • Encumbered assets not assigned the higher RSF factor
  • Off-balance-sheet RSF omitted

Basel III Pillar 1: Credit, Market and Operational Risk (RWA)

BASEL3-CRE-1
Credit Risk - Standardised Approach (SA)

Determine credit risk RWA under the revised standardised approach using prescribed risk weights by exposure class, with greater granularity and risk sensitivity and constraints on the mechanistic use of external ratings.

Artefacts an auditor will ask for
  • Exposure-class mapping and risk-weight assignment workpapers
  • Due-diligence evidence supporting external-rating-based risk weights
  • Loan-to-value and property valuation evidence for real estate exposures
  • CRM (collateral, guarantees, netting) eligibility and haircut documentation
Where this commonly fails
  • Exposures mis-classified into lower-risk-weight buckets
  • Mechanistic reliance on external ratings without due diligence
  • Ineligible credit risk mitigation recognised
BASEL3-CRE-2
Credit Risk - Internal Ratings-Based (IRB) Approach

Where approved, calculate credit risk RWA using the foundation or advanced IRB approach with input floors on PD, LGD and EAD, scope restrictions (e.g. removal of advanced IRB for certain portfolios) and supervisory model approval.

Artefacts an auditor will ask for
  • Supervisory IRB approval / model approval records
  • PD/LGD/EAD estimation methodology and back-testing results
  • Application of input floors (PD, LGD, EAD) per the standard
  • Independent model validation reports and rating system performance monitoring
Where this commonly fails
  • Input floors not applied to model parameters
  • A-IRB used for portfolios where the standard requires F-IRB or SA
  • Model overrides and rating migrations not monitored or governed
BASEL3-CRE-3
Counterparty Credit Risk (SA-CCR)

Measure exposure at default for derivatives and counterparty credit risk using the standardised approach for counterparty credit risk (SA-CCR), capturing replacement cost and potential future exposure.

Artefacts an auditor will ask for
  • SA-CCR exposure calculation by netting set (replacement cost + PFE, with the alpha factor)
  • Margining and collateral agreements (CSAs) feeding the calculation
  • Hedging-set and add-on factor mapping by asset class
Where this commonly fails
  • Netting sets defined inconsistently with enforceable netting agreements
  • Margined vs unmargined treatment misapplied
  • Add-on factors or supervisory deltas mis-assigned
BASEL3-CVA-1
Credit Valuation Adjustment (CVA) Risk Capital

Hold capital for the risk of mark-to-market losses arising from changes in counterparty credit spreads (CVA risk), under the standardised or basic approach to CVA.

Artefacts an auditor will ask for
  • CVA capital calculation under the elected approach (BA-CVA or SA-CVA)
  • Eligible CVA hedge documentation and recognition
  • Counterparty spread and exposure inputs to the CVA charge
Where this commonly fails
  • CVA hedges recognised that do not meet eligibility criteria
  • Approach election not consistent with supervisory approval
  • Exposures in scope of CVA omitted
BASEL3-MAR-1
Market Risk (FRTB)

Calculate market risk capital under the Fundamental Review of the Trading Book: a more risk-sensitive standardised approach (sensitivities-based method, default risk charge, residual risk add-on) and, subject to approval, an internal models approach with a clear trading book / banking book boundary.

Artefacts an auditor will ask for
  • Standardised approach calculation (sensitivities-based method, DRC, RRAO)
  • Trading-book/banking-book boundary policy and any reclassification approvals
  • For IMA desks: P&L attribution and backtesting results, expected shortfall and NMRF treatment
  • Desk-level model approval records
Where this commonly fails
  • Instruments assigned to the wrong book to obtain favourable capital treatment
  • Non-modellable risk factors not capitalised
  • P&L attribution / backtesting breaches not escalated
BASEL3-OPE-1
Operational Risk - Standardised Approach

Calculate operational risk capital using the single standardised approach based on the Business Indicator Component and (at supervisory discretion) an Internal Loss Multiplier derived from historical operational loss experience.

Artefacts an auditor will ask for
  • Business Indicator and Business Indicator Component calculation from the financial statements
  • Operational loss data set (>= 10 years where ILM applies) with quality controls
  • Reconciliation of loss data to the general ledger
Where this commonly fails
  • Business Indicator components mis-mapped from the P&L
  • Loss data set incomplete or below the required history
  • ILM applied where supervisor has set it to 1 (or vice versa)

Basel III Pillar 1: Risk-Based Capital

BASEL3-CAP-1
Common Equity Tier 1 (CET1) Capital Ratio

Maintain CET1 capital of at least 4.5% of risk-weighted assets. CET1 comprises common shares, retained earnings and disclosed reserves, after regulatory deductions (goodwill, deferred tax assets, etc.).

Artefacts an auditor will ask for
  • CET1 capital calculation worksheet reconciled to audited financial statements
  • Regulatory capital return (e.g. COREP/Call Report) showing CET1 ratio
  • Board-approved capital policy and capital plan
  • Schedule of regulatory deductions (goodwill, DTAs, AT1/T2 instruments)
Where this commonly fails
  • CET1 deductions applied incompletely or inconsistently with the standard
  • Capital instruments classified as CET1 without meeting the 14 eligibility criteria
  • RWA denominator not reconciled to the regulatory return
BASEL3-CAP-2
Tier 1 Capital Ratio

Maintain Tier 1 capital (CET1 plus Additional Tier 1) of at least 6.0% of risk-weighted assets. AT1 instruments must be perpetual and contain loss-absorption (going-concern) features.

Artefacts an auditor will ask for
  • Tier 1 capital calculation and ratio in the regulatory return
  • AT1 instrument term sheets evidencing perpetuity and going-concern loss absorption (PONV / conversion or write-down triggers)
  • Capital instrument register with eligibility assessment
Where this commonly fails
  • AT1 instruments lacking compliant loss-absorption triggers counted as Tier 1
  • Step-up or incentive-to-redeem features not identified
  • Minority interest inclusion exceeding permitted limits
BASEL3-CAP-3
Total Capital Ratio

Maintain Total capital (Tier 1 plus Tier 2) of at least 8.0% of risk-weighted assets. Tier 2 provides gone-concern loss absorption.

Artefacts an auditor will ask for
  • Total capital ratio in the regulatory return
  • Tier 2 instrument documentation (subordination, original maturity >= 5 years, amortisation in final five years)
  • Reconciliation of total regulatory capital to the balance sheet
Where this commonly fails
  • Tier 2 amortisation in the final five years to maturity not applied
  • Subordination of Tier 2 instruments not legally confirmed
  • Provisions/general reserves included in Tier 2 above the permitted cap
BASEL3-RBC-1
Output Floor

Aggregate RWA calculated using internal models must be no lower than 72.5% of the RWA produced by the standardised approaches (the output floor), phased in from 2022.

Artefacts an auditor will ask for
  • Parallel RWA computation under standardised approaches and internal models
  • Output-floor calculation showing the 72.5% comparison and any binding floor add-on
  • Transitional phase-in schedule applied to the floor
Where this commonly fails
  • Floor applied at portfolio level rather than aggregate RWA
  • Standardised-approach RWA not maintained for floored exposures
  • Phase-in percentage applied incorrectly for the reporting date

Basel III Pillar 2: Supervisory Review Process

BASEL3-SRP-1
Internal Capital Adequacy Assessment Process (ICAAP)

Operate a sound, comprehensive internal process to assess overall capital adequacy relative to the bank's risk profile and strategy, covering risks not fully captured under Pillar 1.

Artefacts an auditor will ask for
  • Board-approved ICAAP document and supporting risk assessments
  • Capital planning and stress-testing linkage to the risk appetite
  • Coverage of Pillar 2 risks (concentration, IRRBB, residual, strategic, reputational)
Where this commonly fails
  • ICAAP not integrated with business planning or risk appetite
  • Pillar 2 risks identified but not capitalised or mitigated
  • Board challenge of the ICAAP not evidenced
BASEL3-SRP-2
Supervisory Review and Evaluation Process (SREP)

Be subject to supervisory review and evaluation of the bank's risk profile, governance and capital and liquidity adequacy, with supervisory measures (including additional capital) where warranted.

Artefacts an auditor will ask for
  • Supervisory correspondence, SREP letters and capital/liquidity requirement notifications
  • Remediation plans addressing supervisory findings
  • Evidence of additional capital or liquidity requirements being met
Where this commonly fails
  • Supervisory findings not tracked to closure
  • Pillar 2 capital add-ons not incorporated into limits/MDA
  • Governance weaknesses identified by the supervisor not remediated
BASEL3-SRP-3
Interest Rate Risk in the Banking Book (IRRBB)

Identify, measure, monitor and control interest rate risk in the banking book using economic value of equity and net interest income measures, six prescribed interest-rate shock scenarios and the supervisory outlier test.

Artefacts an auditor will ask for
  • EVE and NII sensitivity results under the six prescribed shock scenarios
  • Behavioural assumptions (NMD, prepayment, early withdrawal) and their governance
  • Supervisory outlier test result against the 15% Tier 1 threshold
Where this commonly fails
  • Behavioural assumptions undocumented or not back-tested
  • Commercial margins and basis risk excluded inappropriately
  • Outlier-test breach not escalated to the supervisor
BASEL3-SRP-4
Supervisory Stress Testing

Conduct rigorous, forward-looking stress testing that identifies severe events or changes in market conditions that could adversely affect the bank, feeding capital and liquidity planning.

Artefacts an auditor will ask for
  • Stress-testing programme document, scenarios and severity rationale
  • Results feeding the ICAAP, capital plan and contingency funding plan
  • Board and senior management review of stress results
Where this commonly fails
  • Scenarios not severe or not tailored to the bank's vulnerabilities
  • Stress results not acted upon in capital/liquidity decisions
  • Reverse stress testing absent

Basel III Pillar 3: Market Discipline and Disclosure

BASEL3-DIS-1
Composition of Capital Disclosure

Publicly disclose the composition of regulatory capital with a full reconciliation to the audited balance sheet and the main features of capital instruments, using the prescribed templates.

Artefacts an auditor will ask for
  • Published composition-of-capital template (CC1) and reconciliation (CC2)
  • Main features template for capital instruments (CCA)
  • Governance/sign-off of the Pillar 3 report
Where this commonly fails
  • Disclosure not reconciled to the audited financial statements
  • Capital instrument features template incomplete
  • Disclosure not published at the required frequency
BASEL3-DIS-2
Risk-Weighted Assets and Risk Disclosures

Disclose RWA by risk type and the key risk metrics, including the standardised-approach comparison required for banks using internal models, to support market discipline.

Artefacts an auditor will ask for
  • Overview-of-RWA template (OV1) by risk type and approach
  • Standardised-approach RWA comparison disclosure for internal-model banks
  • Credit/market/operational risk disclosure templates
Where this commonly fails
  • RWA disclosures not tied to the regulatory return
  • Standardised comparison omitted for model banks
  • Risk-type breakdown inconsistent across templates
BASEL3-DIS-3
Leverage Ratio Disclosure

Disclose the leverage ratio, a breakdown of the total exposure measure and a reconciliation to the published financial statements, using the prescribed templates.

Artefacts an auditor will ask for
  • Leverage ratio common disclosure template (LR2) and summary reconciliation (LR1)
  • Breakdown of the exposure measure components
  • Reconciliation of accounting assets to the leverage exposure measure
Where this commonly fails
  • Exposure measure reconciliation to accounting assets missing
  • Disclosed ratio inconsistent with the regulatory return
  • Templates not published at the required frequency
BASEL3-DIS-4
Liquidity (LCR and NSFR) Disclosure

Disclose the Liquidity Coverage Ratio and Net Stable Funding Ratio using the prescribed common templates, including average values and the main drivers.

Artefacts an auditor will ask for
  • LCR disclosure template (LIQ1) with quarterly averages
  • NSFR disclosure template (LIQ2)
  • Qualitative discussion of liquidity risk drivers
Where this commonly fails
  • LCR disclosed on a point-in-time rather than average basis where averages are required
  • HQLA composition not disclosed
  • NSFR template omitted
BASEL3-DIS-5
Key Prudential Metrics Disclosure

Disclose the key prudential metrics (capital ratios, RWA, leverage ratio, LCR and NSFR) in the prescribed KM1 dashboard so users can track the bank's prudential position over time.

Artefacts an auditor will ask for
  • Key metrics template (KM1) covering the current and prior periods
  • Cross-references from KM1 to the detailed disclosure templates
  • Sign-off and publication record
Where this commonly fails
  • KM1 values inconsistent with the underlying detailed templates
  • Prior-period columns not maintained
  • Metric definitions diverging from the standard
Assembled from the framework's own control set. Every line traces to a control in the graph, so this pack is regenerated rather than written, and stays current as the graph does.

Assembled from the framework’s own control set, so this list is regenerated rather than written and stays current as the graph does. See the Basel III International Banking Framework framework page.