The activities of the Internal Audit Department of the Bank are built on the International Professional Practices Framework recommended by The Institute of Internal Auditors and are carried out in compliance with the standards and principles of ethics and professionalism – commitment to the principles of integrity, objectivity, competence, due professional care, and confidentiality. The independence of the Internal Audit Department in the implementation of its tasks and functions is ensured by an appropriate organizational status, which provides for organizational subordination and functional accountability of the Internal Audit Department to the Board of Directors of the Bank. The direct supervision of the activities of the Internal Audit Department is carried out by the Audit Committee of the Board of Directors of the Bank.

The main purpose of the activities of the Internal Audit Department is to strengthen the Bank's ability to create, protect, and sustain value by providing the Board of Directors and the Executive Body with independent, risk-based, objective assurances, opinions, recommendations, and forecasts.

The Regulations on the Internal Audit Department define the right of unimpeded and full access to any assets, to all documents, accounting records, and any other information on the activities of the Bank, including confidential information, as well as unimpeded and full access to information databases, software in passive viewing mode, without the right to enter and adjust data. Within the framework of their activities based on the approved risk-oriented annual audit plan, internal auditors, upon written request, exercise their rights in order to perform their main tasks and functions. Also, the Regulations on the Internal Audit Department define the right to inform the Audit Committee and/or the Board of Directors about problems, violations, and/or limitations that prevent the Internal Audit Department from independently, objectively, effectively, timely, and/or in full performing the set tasks and the annual audit plan, in order for them to resolve such problems and/or eliminate limitations.

The Internal Audit Department is an independent structural unit and is functionally accountable to the Board of Directors, and administratively to the Management Board of the Bank. The Head and employees of the Internal Audit Department are appointed by the Board of Directors.

In 2025, the staff number of the Internal Audit Department was 11 units. The Head of the Internal Audit Department holds the international Certified Internal Auditor (CIA) certificate and is the winner in the nomination "Best Head of Internal Audit of 2025" of the Institute of Internal Auditors of Kazakhstan. Internal auditors on an ongoing basis carry out continuous professional development and possess professional certificates and diplomas in the field of internal audit (CIA, DipPIA, and DiPCPIA).

The main tasks and functions of the Internal Audit Department are:

-     assisting the Executive Body and employees of the Bank in the development and monitoring of the execution of procedures and measures to improve risk management, internal control, and corporate governance systems;

-     coordinating activities with the external auditor of the Bank, as well as persons providing consulting services in the field of risk management, internal control, and corporate governance;

-     preparing and submitting quarterly reports to the Board of Directors and the Audit Committee on the results of the activities of the Internal Audit Department and the execution of the annual audit plan (including information on significant risks, deficiencies, results, and efficiency of implementation of measures to eliminate identified deficiencies, results of evaluation of the actual state, reliability, and efficiency of the risk management, internal control, and corporate governance system);

-     checking compliance by members of the Bank's Management Board and its employees with the provisions of the legislation of the Republic of Kazakhstan and internal documents concerning insider information and the fight against corruption, and compliance with ethical requirements;

-     monitoring the execution of recommendations of the external auditor;

-     providing consultations to the Board of Directors, the Executive Body, and structural units on issues of organization and improvement of internal control, risk management, corporate governance, and organization of internal audit, as well as on other issues within the competence of the Internal Audit Department.

All planned audit engagements for 2025 have been executed in full. Significant problems identified as a result of audit checks are related to the human factor, which led to the realization of the following key risks: incomplete compliance of the Bank's internal documents, processes and/or procedures with the requirements of the regulatory legal acts of the Republic of Kazakhstan, incorrect and/or untimely entry of data into information systems, and incomplete compliance with the requirements of the Bank's internal documents.

The main measures taken by the Bank to minimize these risks and problems consisted in the automation of business processes and technical improvements of the Bank's information systems, work to bring the internal documents of the Bank into compliance with the requirements of regulatory legal acts of the Republic of Kazakhstan, conducting briefings and training with the Bank's employees, as well as applying disciplinary sanctions to the Bank's employees.

In 2025, an external comprehensive review of information technologies and information security of the Bank was conducted for compliance with the requirements of the regulatory legal acts of the Republic of Kazakhstan, the international COBIT 2019 methodology, and the ISO:27001 standard. According to the results of the review, the efficiency level of the Bank's IT control processes against the main criteria of the international COBIT 2019 methodology is at a high level and amounted to 95% (corresponds to an "adequate" rating).

Annual risk-oriented audit plans are reviewed and approved by the Board of Directors.

In performing its functions, the Internal Audit Department confirmed its independence to the Board of Directors.