Professional Documents
Culture Documents
Audit of Banking Industry
Audit of Banking Industry
Agenda
Page 2
1. Types of Audits of Banks
Page 3
1.1. Internal Audit
For those purposes the Department conducts audits at the branches, departments and
subsidiaries of the Bank throughout Turkey and abroad. All business systems,
applications, processes, operations, functions and activities within the Bank are subject
to the audits.
Page 4
1.1. Internal Audit
The BRSA regulates and supervises also HR issues of IAD and audit studies performed.
The BRSA, in its regulations, refers to the IIA’s standards on those issues.
Page 5
1.1. Internal Audit
Although all financial subsidiaries have Internal Audit / Internal Control Units, Internal Audit
Department of Garanti also performs audits in those subsidiaries.
Working Methodology
RISK BASED AUDITING PRINCIPLE
•Identification
•Sourcing
RISK AUDIT PLANS
•Assessment
•Prioritization
Audit manuals are established to provide guidance on specific audits. Manuals are prepared about
procedures of on-site engagements that the auditors may perform.
Page 6
1.1. Internal Audit
The Bank’s Risk Matrix Risk Mapping and Audit Plan
Risk Level of
Bank’s Activities Branch
Risk
Importance Level
Credit Extension Indicators
Retail Banking Operations
AUDIT PLAN
Audit Period
Commercial Banking Operations
Deposit Collection and Investment Products
Treasury Management Regional Credit
Financial Investments and Placement Granting Offices
Risk
Management of Customer Funds
Indicators
Safe Keeping
Insurance Services
Agency Services
Payment Systems Risk
IT Systems Head Office Departments Assessment
Human Resource
Legal Proceedings
New Technologies
Page 7
1.1. Internal Audit
Organizational Structure of Internal Audit Department
INTERNAL
AUDIT
DEPARTMENT
DIRECTOR
OPERATION
SERVICE
ASS.DIRECTOR
ASS.DIRECTOR H/O Departments &
Branch Audits & Subsidiaries &
Central Audits & IT Audits & Risk Management Audits
Internal Fraud & Investigations & Financial Accounting Audits &
Trainings & Human Resources Mng.
Risk Management
IT Audit Team
Audit Team
Auditors/Assistant Auditors
Page 8
1.1. Internal Audit
On-Site Audits
Operational Audits
Branch Audits
H/O and Subsidiary Audits
Financial Audits
Central Audits
Audits of Operations and
Transactions IT Audits
Process Audits
Internal Fraud Detection
Performance Audits
Information Technologies
Audits
IT Processes
Managerial Audits
Banking Applications
Subsidiary IT Audits Compliance Audits
Governance Audits
Page 9
1.1. Internal Audit
Int
on
e rvi
ati
ew
firm
ing
n
Co
Observation & Statistical
Inspection Sampling
g An
n
st i Pr alyti
Te oc c
d e d al
Recomputing
le
tai ur
es
De
Page 10
1.2. External Audit
Taking into account opinion of the Audit Committee, the Board of Directors selects the
authorized audit company, which conducts audit engagement in periods determined by
legislation, and submits the company to approval of the General Assembly.
The authorized external audit company is evaluated quarterly by the Audit Committee
during the service period and the results must be submitted to the Board of Directors.
Deloitte, KPMG, PWC, Ernst & Young as external audit companies are authorized by
Banking Regulation and Supervision Agency (BRSA) for financial audit in banks.
In addition; banks quoted to Istanbul Stock Exchange are also subject to external audit
in accordance to Capital Markets Board’s regulations.
Actions which will be taken by banks regarding External Audit Company’s IT audit
findings are presented to and approved by Board of Directors and are sent to BRSA
twice a year.
Page 11
2. Audit of Risks in Banks
What is Risk ?
•Pronounced as “risco” in Italian, “Risiko” in German and “risk” in English, this concept
has been used as “riziko ” formerly, and later has been used as “ risk ” .
•Risk is the potential that a chosen action or activity (including the choice of inaction)
will lead to a loss or undesirable outcome.
•The concept has been used as a synonym with “ danger ”, and used for the situations
which is predicted to appear in the future but which at the same time is unknown
whether or not it is going to happen.
•The two fundamental components (R) of the Risk are the probability of that the loss will
occur (p) and the magnitude of the potential loss (L).
Ri=Lip(Li)
Page 12
2. Audit of Risks in Banks
Types of Risks
Specific
Risk
Share Risk Transaction
Risk
Market Risk General
Interest Rate Risk
Market
Structural
Risk
Exchange Rate Risk Interest
Credit Risk Rate Risk
Commodity Risk
Liquidity Risk
Financial Counterparty
Credit Risk
Risks Operational Transaction &
Risk Business Risk
Issuer Risk
Reputation Concentration
Risk Risk
Issuing
Risk
Business &
Strategic Risks
Page 13
2. Audit of Risks in Banks
Page 14
2. Audit of Risks in Banks
Simplified
Basic Indicator
SIMPLE Standart
Approach
Approach
Alternative Standard
Standard Standard Approach
MEDIUM Approach Approach
Standard Approach
Basic Internal
Value at Risk Rating Approach Advanced
ADVANCED (VAR) Approach
Measurement
Advanced Internal Approaches
Rating Approach
Page 15
2. Audit of Risks in Banks
Total Capital
≥ %8
Credit Market Operational
Risk + Risk
+
Risk
Page 16
2. Audit of Risks in Banks
In the past, the stability of a bank was generally measured purely on the sum of its capital tiers
divided by its Risk Weighted Assets. With the Basel III, the capital rules have been
strengthened and all the components operating together has been taken as a complete
framework.
Page 17
2. Audit of Risks in Banks
According to the Basel Committee on Banking Supervision, the Basel 3 proposals have two
main objectives,
a)To strengthen global capital and liquidity regulations with the goal of promoting a more
resilient banking sector; and
a)To improve the banking sector's ability to absorb shocks arising from financial and economic
stress.
To achieve these objectives, the main proposal the BCBS Basel 3 has developed are:
a)Capital reform (including quality and quantity of capital), complete risk coverage, leverage
ratio; and
Page 18
2. Audit of Risks in Banks
In view of preserving core Tier 1, the Committee introduced two new "buffers. A Capital
Conservation Buffer should allow banks to absorb shocks in periods of stress without breaching
core Tier 1. And a more discretionary Countercyclical Buffer to compensate for increased
systemic risks in times of excessive credit growth.
In terms of quantity, total Tier 1 Capital is now required at 6%, up 2% from Basel II .
Furthermore, a new leverage ratio will make part of banking regulatory framework. Banks will
be required to maintain a leverage ratio of 3 percent or more (33 times its capital). The
unweighted assets include provisions, loans, off-balance sheet items with full conversion, and
all derivatives. The main purpose of this ratio is to constrain leverage in the banking sector,
while also helping to safeguard against model risk and measurement errors.
In addition to the capital banks must hold against risk weighted assets, financial institutions now
have two new ratios to comply with: Liquidity Coverage Ratio (LCR) and Net Stable Funding
Ratio. LCR is designed to promote the short-term resilience of a bank's liquidity risk profile by
ensuring that it has sufficient high-quality liquid assets to survive a significant stress scenario
lasting for 30 calendar days; and the NSFR aims at promoting longer-term resilience by
requiring banks to have capital or longer term high-quality funding which can survive over a one
year period of less severe stress.
Page 19
2. Audit of Risks in Banks
1.Focus on risks related to a possible recession (reputation, liquidity, labor force reduction...)
2.Audit the effectiveness of risk management and corporate governance processes.
3.Conduct the re-evaluation of risks and identify the risks associated with each other.
4.Undertake a teaching role on risk management.
5.Improve the relations with other governance, risk and checkpoints within the organization.
6.Expand the studies related with Fraud on the audit plans.
Also;
1.Auditors should be in close contact with the senior management and the audit committee.
2.More flexible inspection plans that can be changed during the period should be used.
3.Information about the organization and business should be improved.
4.In order to conduct more effective audits, the audit reports should be prepared in shorter
times and intensive technology should be used.
Page 20
3. Audit of Financial Position / Results of Operations of
Banks
Audit of Assets
•Financial Investments
•Loans
Page 21
3. Audit of Financial Position / Results of Operations of
Banks
Audit of Assets
First of all, auditor has to audit current assets whether these are recorded correct or
not.
• Reconciliation is done by auditor to reach equity of trial balance-MIS-balance sheet.
• Back-dated bank reciepts are examined.
• Reconciliation is done for all bank accounts.
• Nominal values of securities are verified.
• Conformity of the data is examined which was used for valuation of securities.
• Income and expense is examined which was obtained by derivative operations.
• Valuations of derivative products is examined.
• Current credit balance of bank is compared with past periods to examine difference.
• Rediscount calculation of loans is examined to be certain of accuracy.
• Depreciation accounting of bank is examined to verify accuracy.
• Current and past period is compared to examine differences.
• Accounting records are examined which put into operation with the defination of ‘Other’.
•Market value of bank is examined.
Page 22
3. Audit of Financial Position / Results of Operations of
Banks
Audit of Liabilities
•Credits Obtained
•Reserves
•Shareholders Equity
Page 23
3. Audit of Financial Position / Results of Operations of
Banks
Audit of Liabilities
•Reconciliation is done by auditor to reach equity of trial balance-MIS-balance sheet.
•Current deposits and other liabilities of bank are compared with past periods to examine
difference.
•Current obtained credits of bank are compared with past periods to examine difference.
Page 24
3. Audit of Financial Position / Results of Operations of
Banks
• Interest income
• Interest expense
• Personnel expense
Page 25
3. Audit of Financial Position / Results of Operations of
Banks
Page 26
3. Audit of Financial Position / Results of Operations of
Banks
Page 27
4. Audit of IT Computer Systems in Banks
Computer fraud and abuse can have a detrimental effect on an organization. Periodic
surveys undertaken by organizations such as the NCC (National Computing Centre) and
the Audit Commission indicate the following common instances of computer fraud and
abuse:
Page 28
4. Audit of IT Computer Systems in Banks
Page 29
4. Audit of IT Computer Systems in Banks
For the risk assessment of IT Processes, initially interviews with business unit
managers and Garanti Technology senior management are performed.
IT Risk Assessment surveys are filled by the said managers, to determine the risky
IT processes. The results of surveys are evaluated in terms of vulnerability and
impact of IT processes.
Annual audit plans are formed based on the prioritization resulted from the risk
assessments.
Page 30
4. Audit of IT Computer Systems in Banks
Standards
•BRSA Regulations
•COBIT
•ITIL
•ISO 27001, BS 25999
•CMMI, PMBOK, NIST…
Tools
Page 31
4. Audit of IT Computer Systems in Banks
Information Technologies Audit - Scope
Banking Subsidiary
IT Processes Applications IT Audits
22 Audit Areas 27 Audit Areas 18 Audit Areas
In IT Process audits, general controls in the processes are evaluated, based on COBIT, ISO 27001, ITIL, CMMI control objectives, ISACA checklists,
BRSA regulations and various technical control lists.
In Banking Application audits, application controls including data creation/ authorization, input/ output, data processing, mining, limit, compliance,
workflow, efficiency, security controls are evaluated.
In IT Audits of Subsidiaries, general and application controls of Subsidiaries’ current IT and financial processes are evaluated based on the same
standards used in IT Process & Application audits.
32
Page 32
5. Future of Bank Auditing
Page 33
5. Future of Bank Auditing
Page 34