See Webtrust for an introduction on what is usually done with CA.
A core point is that in many countries, banks must comply to existing regulations enforced by dedicated administrations. Such regulations and systems are still nascent in the case of certificate authorities and digital signatures; so the situation is not clarified yet. One can expect that common controls will emerge at some point (come back in 40 years or so...).
In the mean time, each actor in the business of signatures will have its own requirements and contractual engagements. For instance, Microsoft, in their Root Certificate Program, list a number of requirements, including:
The CA must complete an audit and submit audit results to Microsoft every twelve (12) months. The Audit must cover the full PKI hierarchy that will be enabled by Microsoft through the assignment of Extended Key Usages (EKUs). All certificate usages that we enable must be audited periodically. The audit report must document the full scope of the PKI hierarchy including any sub-CA that issues a specific type of certificate covered by an audit. Eligible audits include:
Anyway, the ultimate goal for a digital signature system is to revert the burden of proof: if there is a dispute between two parties A and B, A claiming that a given signature (purportedly by B) binds B, while B pretends that the signature is fake (or could have been forged, hence cannot be considered binding), then the digital signature system is "strong" if the judge estimates that it is up to B to prove the potential fakeness of the signature, while A can just sit and watch. All the controls and regulations and audits and InfoSec frameworks are means by which this goal may be achieved, within a legal framework which:
- depends on the jurisdiction, and
- does not exist yet (or not fully) in many jurisdictions.