BPR Internal Audit: SKAI, Executive Officer, Audit Charter, and OJK Reporting

Photo by Towfiqu barbhuiya on Unsplash

For a BPR, the first question about internal audit is usually about size: must it establish an internal audit unit (SKAI), or is one officer enough? The answer is in OJK Regulation 9/2024 and its implementing circular letter issued in 2025. The content is quite detailed, from reporting lines and the audit charter to report deadlines to OJK.

Regulatory changes in 2025 to 2026 that affect this topic are summarized in the article audit and oversight regulation update 2026.

This article summarizes the internal audit function obligations at BPR and sharia BPR (BPRS) from the official text of the regulations. BPR here means Bank Perekonomian Rakyat (people's economic bank), the term used by OJK Regulation 9/2024 for banks previously called Bank Perkreditan Rakyat. References checked as of 23 October 2026. For the anti-fraud strategy that is also mandatory for BPR, read the article anti-fraud strategy under OJK Regulation 12/2024.

What Is the Legal Basis for BPR Internal Audit?

One note to avoid citing the wrong rule: OJK Regulation 1/POJK.03/2019 on the internal audit function applies to commercial banks, not BPR. The basis for BPR internal audit is OJK Regulation 9/2024.

When Must a BPR Have a SKAI?

Article 79 requires all BPR and BPRS to implement an effective internal audit function. Its form is determined by a single criterion, namely core capital.

Two points are often misunderstood. First, the Rp50 billion threshold is not a new rule: OJK Regulation 4/POJK.03/2015 Article 59 already contained the same threshold. Second, the transition period to 31 December 2025 in Article 110 of OJK Regulation 9/2024 does not cover Article 79. That transition applies to, among others, the audit committee, the risk monitoring committee, and the remuneration and nomination committee.

If core capital rises to Rp50 billion or more, Article 106 gives at most one year to meet the new core capital requirement. If core capital falls, the BPR continues to comply based on its core capital before the decline. OJK may also order a BPR below Rp50 billion to add internal audit staff or establish a SKAI, taking into account, among other things, indications of fraud, a significant decline in soundness rating, and the complexity of products and the spread of offices.

How Are Independence and Organization Arranged?

• Reporting line: The SKAI or internal audit PE is directly accountable to the president director (Article 82). According to the OJK Circular Letter, reports are submitted to the president director with copies to the Board of Commissioners and or the audit committee, the director overseeing compliance, and the Sharia Supervisory Board (DPS) at a BPRS.
• Appointment: the SKAI head or PE is appointed and dismissed by the president director, taking into account the opinion of the Board of Commissioners. The appointment and dismissal are reported to OJK online through the monthly periodic report.
• Prohibition on concurrent roles: the audit charter must contain a prohibition on internal auditors holding concurrent operational duties, and the SKAI or PE is prohibited from being in a position of conflict of interest.
• Certification: The OJK Circular Letter only states that a BPR may require a competency certificate, for example internal audit certification in accounting and finance. The text does not require it, and does not set a minimum number of staff or years of experience.
• Assistance from external parties: permitted for special expertise, on a temporary basis, appointed by the GMS (general meeting of shareholders), and reported to the OJK Office. This is not a substitute for the SKAI or PE.
• Conflict of interest at the leadership level: if the president director or president commissioner is in a conflict of interest, the SKAI or PE may submit findings directly to OJK.

What Does the Internal Audit Charter Contain?

Article 81 requires internal audit guidelines and work rules, known as the internal audit charter. The minimum contents are: duties, responsibilities, and authority; requirements and a code of ethics for internal auditors; and mechanisms for coordination and accountability for audit results.

The OJK Circular Letter adds that the charter is enacted by the president director after approval by the Board of Commissioners, taking into account the audit committee's recommendation, must be accessible to all stakeholders through the BPR's website, and is evaluated at least once every three years. The auditor code of ethics refers to four principles: integrity, objectivity, confidentiality, and competence.

What Are the Duties and Scope of Internal Audit?

Article 80 paragraph (1) sets out four duties: preparing and carrying out the annual audit program plan; assisting the president director and Board of Commissioners in overseeing operations, especially monitoring audit results; conducting analysis and assessment in finance, accounting, operations, and other activities; and giving improvement suggestions and objective information to all levels of management. OJK may ask a BPR to present its annual audit program plan and realization.

Six assessment areas according to the OJK Circular Letter: safeguarding public funds, achievement of operational objectives, resource efficiency, accuracy of financial and operational information, compliance with policies and regulations, and asset safeguarding. The OJK Circular Letter states that operational functions include fund disbursement and collection, procurement, bookkeeping, and information technology management. For BPRS, compliance with sharia principles is added. The text does not set an audit frequency, and does not mention AML/CFT (APU PPT) or IT audit as separate mandatory items.

What Are the Audit Stages and Follow-Up?

• Planning: the audit plan per assignment contains the focus, objectives, type (general or special), scope, team composition, and timeframe, with a notification letter to the auditee. The scope is approved by the president director.
• Execution: findings are prepared according to the significance of the risk, and each finding is accompanied by a recommendation and a deadline for resolution. Significant fraud or misconduct findings are reported immediately to the SKAI head and or the president director without waiting for the audit to finish.
• Monitoring: the implementation of follow-up is monitored and its adequacy analyzed. If the auditee does not follow up, this is reported in writing to the president director and the Board of Commissioners. The Board of Directors must follow up (Article 21) and the Board of Commissioners must oversee the follow-up (Article 45).

The risk-based prioritization approach is discussed in the article risk based audit, and recommendation monitoring in the article follow-up on internal audit findings.

What Reports Must Be Submitted to OJK?

The content of the main audit results report follows the Annex II format of the OJK Circular Letter: audit scope and timing, findings (facts, causes, impact), conclusion, recommendations, auditee response, deadline, and realization status (completed, in progress, or not followed up). If the online system is not yet available, the report is submitted offline within the same deadline.

What Is the Role of the Audit Committee and External Party Review?

Both obligations apply to BPR with core capital of Rp50 billion or more.

• Audit committee is formed by the Board of Commissioners (Article 59) and monitors and evaluates audit planning and implementation, follow-up, and the performance of the SKAI's duties (Article 64). Its members include at least one independent commissioner as chair, one independent party with finance or accounting competence, and one independent party with law or banking competence (Article 60). Members of the Board of Directors are prohibited from being members. BPR below the threshold perform this function through the Board of Commissioners.
• External party review (Article 84) contains an opinion on the SKAI's work and its compliance with standards, along with improvement suggestions. According to the OJK Circular Letter, it is conducted at least once every three years by a public accountant, public accounting firm, or audit consulting institution that has not audited the BPR's financial statements in the past three years. The wording of Article 84 paragraph (1) is somewhat ambiguous, so the once-every-three-years reference comes from the OJK Circular Letter and the OJK FAQ.

What Additional Requirements Apply to Sharia BPR?

OJK Regulation 25/2024 Article 38 requires BPRS with core capital of Rp50 billion or more to have a sharia internal audit function attached to the SKAI, while those below the threshold must have an executive officer who performs that function, and that officer may also serve as the internal audit executive officer. Its human resources must understand sharia banking operations, and the results of audits of sharia principle compliance are submitted to the Sharia Supervisory Board (DPS) (Article 39).

What Are the Sanctions for BPR That Do Not Comply?

• Violation of Article 79, 81, or 84 paragraph (1): a written warning. If it continues, a downgrade in soundness rating, temporary suspension of part of operations, and or a ban on business expansion (Article 85).
• In addition, the BPR and or its controlling shareholder may be fined Rp10 million to Rp100 million for each violation. Key parties may be barred from serving as key parties.
• Late offline report: a fine of Rp100,000 per working day, up to a maximum of Rp5,000,000.

What About the Anti-Fraud Strategy and Internal Audit?

BPR (rural banks) are also required to implement an anti-fraud strategy under OJK Regulation 12/2024. OJK Circular Letter 9/SEOJK.03/2025 states that the SKAI (internal audit unit) or the Executive Officer for Internal Audit (PE) may be assigned to handle implementation of the anti-fraud strategy while maintaining independence. Because the OJK FAQ for OJK Regulation 12/2024 states that functions cannot be combined where independence rules apply, such as internal audit, a BPR should confirm the interpretation with its OJK supervisor. The full discussion is in the article anti-fraud strategy under OJK Regulation 12/2024.

How Does Internal Audit Software Help BPR (Rural Banks)?

Audithink does not submit reports to OJK and does not replace the SKAI (internal audit unit) or the Executive Officer for Internal Audit (PE). Audithink is internal audit management software with six main features: risk assessment, audit planning, work program templates, notifications, follow-up monitoring, and automated reports. For a BPR (rural bank), these features help prepare a risk-based annual audit program plan, standardize work programs, remind teams of follow-up deadlines, and monitor the status of recommendations. An overview for banking is in the article Audithink for banking and bank internal audit application.

FAQ on BPR Internal Audit

Conclusion

BPR (rural bank) internal audit demands three things that can be proven: a function that is independent and has a clear reporting line, a documented audit plan and program, and follow-up that is monitored until completion. The size of the BPR determines the form of the function, but not its working standards.

If your BPR (rural bank) wants to tidy up its audit plan and follow-up monitoring, schedule an Audithink demo.