The activity of the Bank's Internal Audit Department (IAD) is built on the International Professional Practices Framework for internal auditing recommended by The Institute of Internal Auditors and is carried out in compliance with the principles and standards of integrity, professional courage, objectivity, competence, professional care, and confidentiality.

The purpose of the IAD is to strengthen the Bank's ability to create, protect, and maintain value by providing the Board of Directors and the Executive Body with independent, risk-based, objective assurances, opinions, recommendations, and forecasts.

The Internal Audit Department is an independent structural unit and is functionally reportable to the Board of Directors, and administratively to the Management Board of the Bank. Management oversight of the Internal Audit Department's activity is exercised by the Audit Committee of the Board of Directors. The Head and employees of the Internal Audit Department are appointed by the Board of Directors.

In 2025, the staff number of the Internal Audit Department was 11 people. The Head of the Internal Audit Department holds the international Certified Internal Auditor (CIA) certification. Internal auditors constantly carry out continuous professional development and hold professional certifications and diplomas in the field of internal audit (CIA, DipPIA, and DiPCPIA). The Head of the Internal Audit Department is the winner in the category "Best Head of Internal Audit 2025" of the Institute of Internal Auditors of Kazakhstan.

The main task of the IAD is to conduct internal audit - an independent and objective assurance and consulting activity aimed at improving the Bank's operations and assisting the Bank in achieving its goals by applying a systematic, consistent approach to evaluating and increasing the efficiency of internal control, risk management, and corporate governance.

All planned audit engagements for 2025 were executed in full. Significant issues identified based on the results of audit checks were related to the human factor, which led to the materialization of the following key risks: incomplete compliance of the Bank's internal documents, processes, and/or procedures with the requirements of the regulatory legal acts of the Republic of Kazakhstan (hereinafter – RLA), incorrect and/or untimely data entry into information systems, and incomplete compliance with the requirements of the Bank's internal documents.

The main measures taken by the Bank to minimize these risks and issues consisted of automating business processes and carrying out technical adjustments in the Bank's information systems, working to bring the Bank's internal documents into compliance with RLA requirements, conducting briefings and training sessions with the Bank's employees, as well as applying disciplinary actions to employees who committed violations.

In 2025, an external comprehensive review of the Bank's information technologies and information security was conducted for compliance with RLA requirements, the COBIT 2019 methodology, and the ISO:27001 standard. Based on the results of the review, the efficiency level of the Bank's IT control procedures against the main criteria of the international COBIT 2019 methodology is at a high level and amounted to 95% (corresponding to an "adequate" rating).

Annual risk-oriented audit plans are reviewed and approved by the Board of Directors.

In performing its functions, the Internal Audit Department confirmed its independence to the Board of Directors.