In June 2026, audit reports on four listed banks quietly confirmed what many depositors had feared for years. ICB Islamic Bank, United Commercial Bank, SBAC Bank, and AB Bank were sitting on a combined Tk63,243 crore in classified loans, investments, and provision shortfalls. Weeks later, a wider review found that seven listed banks had collectively concealed roughly Tk1.16 lakh crore in losses for 2025 alone, kept off the books through regulatory forbearance that let them defer mandatory provisioning against bad loans.
Numbers this large tend to produce a predictable reaction: blame the auditors. It is a reasonable first instinct. Auditors sign the opinion. Their name sits on the report that told the public these institutions were solvent when, in several cases, they were not. But having sat inside audit engagements myself, I want to push back on the easy version of that story, because it lets everyone else off the hook.
What an audit opinion can and cannot tell you
An audit under International Standards on Auditing is not a search for fraud. It is a structured, risk-based exercise designed to test whether financial statements are free of material misstatement, based on evidence that management is willing and able to provide. When a bank’s board deliberately understates non-performing loans, restructures bad debt to avoid classification, or benefits from central bank forbearance that legally permits it to defer provisioning, the auditor is not being deceived by a rogue transaction buried in a ledger. The auditor is being handed a set of numbers that comply, on paper, with rules the regulator itself relaxed.
This is the distinction that gets lost in the public conversation. Bangladesh Bank’s own forbearance policy allowed banks to defer provisioning that would otherwise have exposed the scale of their losses years earlier. An auditor testing compliance against that relaxed standard will, correctly, find the numbers compliant. The audit opinion is not wrong. The standard it is measured against was already compromised before the fieldwork began. A recent analysis in The Business Standard made the same point from outside the profession: audit opinions offer reasonable, not absolute, assurance, and depend heavily on the resources a firm can commit to any single engagement, resources that shrink as fee pressure and a limited approved-firm pool squeeze the market from the other side.
The tripartite problem
There is a structural feature of Bangladesh’s banking audits that deserves far more scrutiny than it gets: auditors are required to attend tripartite meetings with representatives of the client bank and Bangladesh Bank before signing off on their report. On paper, this looks like oversight. In practice, it places the auditor in a room with the very institution whose numbers they are supposed to independently assess, alongside the regulator who has often already signaled tolerance for the underlying weakness through forbearance. Independence is not just a checkbox in an engagement letter. It is a working condition, and this one is compromised by design.
Add to this the shrinking pool of firms permitted to audit banks, now down to roughly two dozen chartered accountancy firms for over ninety banks and non-bank financial institutions, and you get a market where a handful of firms depend on repeat business from the very institutions they are meant to hold to account. That is not a Bangladesh-specific pathology. It is the same conflict that produces audit failures everywhere, client relationships and regulatory approval determine which firms get to keep working. But it is sharper here because the pool is smaller and the political interference, as recent allegations involving Shariah-based banks suggest, runs deeper.
Forensic audits are not a substitute for governance
The government’s response, forensic audits of five merged banks under the new Bank Resolution Act, is necessary but insufficient. Forensic audits are retrospective. They tell you how deep the hole was after depositors have already lost sleep and, in some cases, access to their own savings. Faruk Hasan, a heart patient whose fixed deposits sit frozen at a financial institution now facing liquidation, does not need a report explaining how the money disappeared. He needed a system that made it harder for the money to disappear in the first place.
That system requires three things auditors alone cannot deliver. First, provisioning rules that reflect actual loan quality rather than politically convenient forbearance. Second, board-level accountability with real consequences, not the two-decade-long family control that reportedly shaped Premier Bank’s lending decisions long before the Tk10,500 crore syphoning through inflated export orders came to light. Third, an audit oversight structure where the regulator’s role is to enforce independence, not sit in the same room as the party being reviewed.
None of this is a defence of the audit profession as it currently operates in Bangladesh. The Institute of Chartered Accountants of Bangladesh has, to its credit, started acting. In its June 2026 council meeting, it approved fresh disciplinary actions against members, following earlier rounds in January and August 2025 that suspended audit partners at BSEC-panel firms and revoked practice certificates over professional misconduct. The Financial Reporting Council separately instructed ICAB to investigate the due diligence of dozens of CA firms, several sitting on Bangladesh Bank’s and BSEC’s own approved panels. That is real enforcement, not window dressing. But it is also enforcement that arrives after the fact, against individuals, for engagements where the underlying provisioning standard was already compromised by the regulator that now polices the auditors reviewing it.
I have sat in engagement teams where the gap between what a client’s numbers say and what the file actually supports is measured in judgment calls, not fraud. Most of the time that gap gets closed through more testing, more documentation, and more pressure on management for evidence. What I have not seen, and what these bank failures suggest, is a mechanism for closing that gap when the regulator itself has already told the client which numbers it is allowed to report. No amount of additional substantive testing fixes a provisioning shortfall that forbearance has made compliant by definition. That is not a training issue or a competence issue inside audit firms. It is a design flaw in who gets to set the rule the auditor is testing against.
So the fix has to run in the opposite direction from where the current conversation is pointed. Instead of asking ICAB to discipline its way out of a governance failure, Bangladesh Bank should be required to publish, bank by bank, every instance of provisioning forbearance it grants, with the reasoning and the expiry date attached, so an auditor’s clean opinion and a regulator’s quiet exemption are never allowed to sit in the same set of accounts without both being visible to the public. And the tripartite meeting, if it survives at all, should have its minutes disclosed to the Financial Reporting Council as a matter of routine, not produced only when a forensic audit is already underway. Depositors do not need the industry to promise it will try harder. They need the next Tk63,243 crore shortfall to be visible before it becomes a headline, not after.
