CIMA’s Corporate Governance Rule (2023) sets minimum governance standards for all regulated entities in the Cayman Islands, including investment managers, advisers, and funds. Internal audit is one of the key mechanisms through which those governance standards are implemented and evidenced: it provides independent assurance that the controls and processes required by the Rule are in place and working as intended.
What does the Corporate Governance Rule Require?
The Corporate Governance Rule requires regulated entities to maintain governance frameworks that include clear accountability structures, defined responsibilities for risk management and internal controls, documented policies and procedures, and oversight mechanisms proportionate to the entity’s size and risk profile.
The Rule does not prescribe internal audit as a named requirement in every case, but it does require that governance structures include independent oversight functions commensurate with the entity’s activities and complexity.
How does Internal Audit Deliver on those Requirements?
Internal audit directly supports several of the Rule’s core requirements.
It provides independent assurance over the internal control environment, assessing whether controls are designed correctly and operating effectively. It reviews whether documented policies and procedures are being followed in practice, not just in writing. It evaluates whether the board and senior management are receiving accurate and timely management information. And it produces findings that allow governance gaps to be identified and addressed before a CIMA inspection rather than during one.
What is the Role of the Audit Committee?
CIMA’s Corporate Governance Rule requires the governing body of every regulated entity to establish an audit committee or equivalent, with its form and scope calibrated to the entity’s size, complexity, structure, and risk profile.
Where an audit committee is in place, it should oversee the internal audit function, approve the audit plan, receive findings reports, and challenge management on the pace and quality of remediation. The board and audit committee’s active engagement with internal audit outputs is itself a governance indicator that CIMA may assess during an inspection.
How does Internal Audit serve as Evidence of Governance?
CIMA inspections increasingly focus not just on whether policies exist, but on whether they are applied in practice. Internal audit, particularly a programme with documented findings, management responses, and follow-up records, is one of the strongest forms of evidence that governance is live rather than merely on paper. Entities that cannot demonstrate a functioning independent oversight mechanism may face regulatory scrutiny even if their written policies appear adequate on their face.
How does Proportionality Apply to the Rule?
The Corporate Governance Rule applies on a proportionate basis. A small, single-strategy investment adviser will not face identical requirements to a large, multi-strategy fund complex. However, proportionality does not mean governance is optional below a certain size. It means the form of governance, including internal audit, should be appropriately scaled. CIMA expects to see a documented, credible rationale for whatever governance structure a regulated entity has adopted.
Internal audit is the mechanism through which CIMA-regulated entities demonstrate that their governance frameworks are operational, not aspirational.
Related questions: What is an internal audit charter and does a Cayman Islands regulated entity need one? | What are the key components of a risk-based internal audit programme for an offshore investment manager?
wb.group provides internal audit services aligned with CIMA’s Corporate Governance Rule. Contact us to discuss how we can support your regulatory compliance.
FAQs
CIMA’s Corporate Governance Rule (2023) sets minimum governance standards for all regulated entities in the Cayman Islands, including investment managers, advisers, and funds. Internal audit is one of the key mechanisms through which those governance standards are implemented and evidenced: it provides independent assurance that the controls and processes required by the Rule are in place and working as intended.
CIMA’s Corporate Governance Rule was published on 14 April 2023 and came into effect on 14 October 2023. It applies to all entities regulated by the Cayman Islands Monetary Authority, including licensed investment managers, registered investment advisers, and regulated funds. Regulated entities were required to have aligned their governance frameworks to its requirements by the 14 October 2023 effective date.
The Rule requires all regulated entities to establish an audit committee or equivalent. Section 5.12.2 of the Corporate Governance Rule states that the governing body must establish an audit committee or equivalent that is commensurate with the size, complexity, structure, nature of business, and risk profile of the entity. This means the form and scope can be proportionate, but the obligation itself is mandatory and not discretionary.
CIMA inspections commonly assess whether an internal audit function (or equivalent independent review arrangement) exists, that it operates independently of management, that its findings are reported to the board or audit committee, and that management is held accountable for remediating agreed actions. Documented audit reports, findings trackers, and board minutes discussing audit outputs are all relevant evidence. The absence of any independent oversight activity is a significant governance gap.