So G Internal Controls in Banks
So G Internal Controls in Banks
Statement of Guidance
1. Statement of Objectives
2. Introduction
3.1. Directions
3.1.1 The board of directors should have responsibility for approving and
periodically reviewing the overall business strategies and significant
policies of the bank; understanding the major risks run by the bank,
setting acceptable levels for these risks and ensuring that senior
management takes the steps necessary to identify, measure, monitor
and control these risks; approving the organisational structure; and
_____________________________________________________________________________________________
3.1.3 The board of directors should include in its activities (1) periodic
discussions with management concerning the effectiveness of the
internal control system, (2) a timely review of evaluations of internal
controls made by management, internal auditors, and external auditors,
(3) periodic efforts to ensure that management has promptly followed
up on recommendations and concerns expressed by auditors and
supervisory authorities on internal control weaknesses, and (4) a
periodic review of the appropriateness of the bank’s strategy and risk
limits.
3.2.2 Senior management is responsible for carrying out the directives of the
board of directors, including the implementation of strategies and
policies and the establishment of an effective system of internal control.
Members of senior management typically delegate responsibility for
establishing more specific internal control policies and procedures to
those responsible for a particular business unit. Delegation is an
essential part of management; however, it is important for senior
management to oversee the managers to whom they have –delegated
these responsibilities to ensure that they develop and enforce
appropriate policies and procedures.
_____________________________________________________________________________________________
3.3.1 The board of directors and senior management are responsible for
promoting high ethical and integrity standards, and for establishing a
culture within the organisation that emphasises and demonstrates to all
levels of personnel the importance of internal controls. All personnel at
a banking organisation need to understand their role in the internal
controls process and be fully engaged in the process.
_____________________________________________________________________________________________
3.3.5 While having a strong internal control culture does not guarantee that
an organisation will reach its goals, the lack of such a culture provides
greater opportunities for errors to go undetected or for improprieties to
occur.
4.1. An effective internal control system requires that the material risks that could
adversely affect the achievement of the bank’s goals are being recognised and
continually assessed. This assessment should cover all risks facing the bank
and the consolidated banking organisation (that is, credit risk, country and
transfer risk, market risk, interest rate risk, liquidity risk, operational risk,
legal risk and reputational risk). Internal controls may need to be revised to
appropriately address any new or previously uncontrolled risks.
4.1.2 Effective risk assessment identifies and considers internal factors (such
as the complexity of the organisation’s structure, the nature of the
bank’s activities, the quality of personnel, organisational changes and
employee turnover) as well as external factors (such as fluctuating
economic conditions, changes in the industry and technological
advances) that could adversely affect the achievement of the bank’s
goals. This risk assessment should be conducted at the level of
individual businesses and across the wide spectrum of activities and
subsidiaries of the consolidated banking organisation. This can be
accomplished through various methods. Effective risk assessment
addresses both measurable and non-measurable aspects of risks and
weighs costs of controls against the benefits they provide.
4.1.3 The risk assessment process also includes evaluating the risks to
determine which are controllable by the bank and which are not. For
those risks that are controllable, the bank must assess whether to
accept those risks or the extent to which it wishes to mitigate the risks
through control procedures. For those risks that cannot be controlled,
the bank must decide whether to accept these risks or to withdraw from
or reduce the level of business activity concerned.
4.1.4 In order for risk assessment, and therefore the system of internal
control, to remain effective, senior management needs to continually
evaluate the risks affecting the achievement of its goals and react to
changing circumstances and conditions. Internal controls may need to
be revised to appropriately address any new or previously uncontrolled
_____________________________________________________________________________________________
5.1. Control activities should be an integral part of the daily activities of a bank. An
effective internal control system requires that an appropriate control structure
is set up, with control activities defined at every business level. These should
include: top level reviews; appropriate activity controls for different
departments or divisions; physical controls; checking for compliance with
exposure limits and follow-up on non-compliance; a system of approvals and
authorisations; and, a system of verification and reconciliation.
5.1.1 Control activities are designed and implemented to address the risks
that the bank identified through the risk assessment process described
previously. Control activities involve two steps: (1) the establishment of
control policies and procedures; and (2) verification that the control
policies and procedures are being complied with. Control activities
involve all levels of personnel in the bank, including senior
management as well as front line personnel. Examples of control
activities include:
_____________________________________________________________________________________________
5.1.2 Control activities are most effective when they are viewed by
management and all other personnel as an integral part of, rather than
an addition to, the daily activities of the bank. When controls are viewed
as an addition to the day-to-day activities, they are often seen as less
important and may not be performed in situations where individuals
feel pressured to complete activities in a limited amount of time. In
addition, controls that are an integral part of the daily activities enable
quick responses to changing conditions and avoid unnecessary costs.
As part of fostering the appropriate control culture within the bank,
senior management should ensure that adequate control activities are
an integral part of the daily functions of all relevant personnel.
_____________________________________________________________________________________________
_____________________________________________________________________________________________
6.1. An effective internal control system requires that there are adequate and
comprehensive internal financial, operational and compliance data, as well as
external market information about events and conditions that are relevant to
decision making. Information should be reliable, timely, accessible, and
provided in a consistent format.
6.2. An effective internal control system requires that there are reliable
information systems in place that cover all significant activities of the bank.
These systems, including those that hold and use data in an electronic form,
must be secure, monitored independently and supported by adequate
contingency arrangements.
6.2.3 In addition to the risks and controls above, inherent risks exist that are
_____________________________________________________________________________________________
_____________________________________________________________________________________________
7.1. The overall effectiveness of the bank’s internal controls should be monitored
on an ongoing basis. Monitoring of key risks should be part of the daily
activities of the bank as well as periodic evaluations by the business lines and
internal audit.
7.2. There should be an effective and comprehensive internal audit of the internal
control system carried out by operationally independent, appropriately trained
and competent staff. The internal audit function, as part of the monitoring of
the system of internal controls, should report directly to the board of directors
or its audit committee, and to senior management.
_____________________________________________________________________________________________
8. General Guidance
These guidelines have been developed using Framework for Internal Control
Systems in Banking Organisations, September 1998, issued by the Basel
Committee on Banking Supervision. For further guidance, institutions should
consult papers issued by the Basel Committee on Banking Supervision, and
the regulatory manuals from other internationally recognised regulators such
as the Comptroller of the Currency (OCC), the Federal Reserve, and the
Financial Services Authority (FSA).
_____________________________________________________________________________________________