a. The benefits an online system offers to Finpay and its customers include:

i. Immediate entry of transactions into the system (for example, transfer to or from the customer done on smart phones, electronic point of sale (POS) terminals, ATMs, or direct from other banks);

ii. Immediate updating of the customers‟ accounts (such as the immediate updating of the customer’s records as soon as a transfer is made);

iii. Effective enquiry system (such as immediate answers to balance enquiries from customers);

iv. Offer of uninterrupted banking services to customers round the clock, even on public holidays and at night;

v. Enabling real-time engagement, with the use of its Bobo chatbot;

vi. Immediate access to credit, with the use of data analytics, without human intervention;

vii. Enhancing automatic handling of routine transactions, for example, payment of monthly utility bills and DStv subscriptions, regulate payments to third parties;

viii. Cost effectiveness to customers and the bank;

ix. Provision of banking services at any location; and

x. Resolution of issues without physical attendance at bank’s physical office.

b. Controls embedded in FinPay system

i. General controls include:

 Access controls: Customers‟ transactions are processed immediately by the online systems. All unauthorised access to the programs and data files are prevented since the customer has a six-digit password;

 Programming controls are in-built to prevent or detect unauthorised changes to standing data, like monthly loan deductions, or monthly payments to DStv;

 Transaction logs are available on FinPay’s General Ledger Application System. This is even accessible on the customers‟ devices. This can be used to create an „audit trail‟;

 Firewalls are used. These protect FinPay’s General Ledger Application System from unauthorised access via the internet; and

 FinPay complies with regulatory KYC (Know You Customer) requirement by collecting NIN, telephone number, passport photograph, ID card, utility bill, and residential address.

ii. Application controls include:

 Before opening any account for any customer, FinPay’s system digitally verifies the customer’s NIN information, telephone number, ID card, and utility bill with issuing authorities;  There is pre-processing authorisation. A customer is required to log on to FinPay system with his/her telephone number and password before s/he can use the mobile App;

 Program checks (for example confirmation of customer’s account balance and the transaction PIN before transactions are consummated. This includes checking the number of digits in the password and PIN);

 „Balancing‟. This is evident in the fact that when a transfer is declined, the debit entry is reversed;

 Customer’s account number is derived from his/her registered telephone number; and

 FinPay links all transactions with the customer‟s registered telephone number or the bank‟s debit card.

c. Areas the auditors will give special consideration because of audit risks associated with Finpay’s operations

i. The skills and knowledge needed by auditor to understand Finpay’s fully automated banking system are very high. This knowledge is to help in identifying the operational risks to which Finpay is exposed and how to mitigate them.

ii. The Finpay’s system covers a very broad geographical market (even beyond Nigeria). The remote access granted customers exposes the system to potential high cyber security risks. The auditor should be aware of industry practices on how this risk is mitigated.

iii. Transaction integrity may be lost in the Finpay‟s system. The auditor should obtain knowledge of CBN‟s regulatory sandbox and guidelines and should examine that Finpay complies with these laws and guidelines. This can result in reputational damages if it occurs.

iv. There is the risk of inadequate audit trail. The auditor should test and confirm that this risk is mitigated by adequate logs, backups and a robust ERP system.