A

PROJECT REPORT
ON

INTERNAL CONTROL SYSTEM IN

BANKS
PROJECT REPORT SUBMITTED
TO
UNIVERSITY OF MUMBAI
IN THE PARTIAL FULFILLMENT OF THE AWARD OF
SEMESTER V
BACHELOR OF COMMERCE IN
[BANKING & INSURANCE]
BY
CELESTE CEDRIC DSA.
UNDER THE GUIDANCE OF
MR. RAMCHANDRA TAVDE
SHRI PANCHAM KHEMRAJ MAHAVIDYALAYA
SAWANTWADI
OCTOMBER 2016

CERTIFICATE
This is to certify that, Celeste Cedric Dsa of
T.Y.B.com (Banking and insurance). Semester V
[2016-2017] has successfully completed project on
INTERNAL CONTROL SYSTEM IN BANKS under the
guidance of Mr. Ramchandra Tawde

[Signature of project guide]

[Signature of principal]

[Signature of coordinator]

[Signature of
External Examiner]

Date:
Place: Sawantwadi.

DECLARATION
I hereby declare that the project report on,
Internal Control System in Banks is completed
and written by me has not previously formed that
basis for the award of any degree or diploma or
other similar title of these or any other University
or examine body.

Date:

Place: SAWANTWADI
Cedric Dsa)

(Celeste

ACKNOWLEDGEMENT
A project is the fruit of experiment and
experience and it goes a long way to modeling a
person and gaining a new insight in that field of
research.
In this rewarding experience, one
recognizes the help and support rendered by kind
heart behind its success.
I would take this opportunity to thank all
my teachers. I would like to thank Mr. Ramchandra
Tawde, my project guide, who sincerely guided and
supported me in doing the project.
I would also like to show my gratitude
towards my family, friends and all others who have
helped and supported me in doing the project.

Date:
Place: Sawantwadi.
(Celeste Cedric Dsa)

INDEX
SR
PARTICULARS
NO
1. Chapter 1
INTRODUCTION
Principles for the assessment of internal control
system

2.

Chapter 2

BACKGROUND
3.

Chapter 3

4.

The Objectives and Role of the

Internal Control Framework
Chapter 4
The Major Elements of an Internal
Control Process

PAGE
NO

4.1

Management Oversight and the Control Culture

1. Board of directors
2. Senior management
3. Control culture

4.2

Risk Recognition and Assessment

4.3

Control Activities and Segregation of Duties

4.4

Information and Communication

4.5

E. Monitoring Activities and Correcting

Deficiencies

5.

Chapter 5
Evaluation of Internal Control
Systems by Supervisory
Authorities
Chapter 6
Roles and Responsibilities of
External Auditors
Chapter 7
Conclusion
References

6.

7.

CHAPTER 1
Introduction

1. As part of its on-going efforts to address bank supervisory issues and

enhance supervision through guidance that encourages sound risk
management practices, the Basle Committee on Banking Supervision1 is
issuing this framework for the evaluation of internal control systems. A
system of effective internal controls is a critical component of bank
management and a foundation for the safe and sound operation of
banking organizations. A system of strong internal controls can help to
ensure that the goals and objectives of a banking organization will be
met, that the bank will achieve long-term profitability targets, and
maintain reliable financial and managerial reporting. Such a system can
also help to ensure that the bank will comply with laws and regulations
as well as policies, plans, internal rules and procedures, and decrease the
risk of unexpected losses or damage to the banks reputation.
The paper describes the essential elements of a sound internal control
system, drawing upon experience in member countries and principles
established in earlier publications by the Committee. The objective of
the paper is to outline a number of principles for use by supervisory
authorities when evaluating banks internal control systems.
2. The Basle Committee, along with banking supervisors throughout the
world, has focused increasingly on the importance of sound internal
controls. This heightened interest in internal controls is, in part, a result
of significant losses incurred by several banking organizations. An
analysis of the problems related to these losses indicates that they could
Probably have been avoided had the banks maintained effective internal
control systems. Such systems would have prevented or enabled earlier
detection of the problems that led to the losses, thereby limiting damage
to the banking organization. In developing these principles, the
Committee has drawn on lessons learned from problem bank situations
in individual member countries.

3. These principles are intended to be of general application and

supervisory authorities should use them in assessing their own
supervisory methods and procedures for monitoring how banks structure
their internal control systems. While the exact approach chosen by
individual supervisors will depend upon a host of factors, including their
on-site and off-site supervisory techniques and the degree to which
external auditors are also used in the supervisory function, all members
of the Basle Committee agree that the principles set out in this paper
should be used in evaluating a banks internal control system.
4. The Basle Committee is distributing this paper to supervisory
authorities worldwide in the belief that the principles presented will
provide a useful framework for the effective supervision of internal
control systems. More generally, the Committee wishes to emphasize
that sound internal controls are essential to the prudent operation of
banks and to promoting stability in the financial system as a whole.
While the Committee recognizes that not all institutions may have
implemented all aspects of this framework, banks are working towards
adoption.
5. The guidance previously issued by the Basle Committee typically
included discussions of internal controls affecting specific areas of bank
activities, such as interest rate risk, and trading and derivatives activities.
In contrast, this guidance presents a framework that the Basle
Committee encourages supervisors to use in evaluating the internal
controls over all on- and off-balance sheet activities of banks and
consolidated banking organization. The guidance does not focus on
specific areas or activities within a banking organization. The exact
application depends on the nature, complexity and risks of the banks
activities.
6. The Committee provides background information is section I, sets out
the objectives and role of an internal control framework in Section II,
and stipulates in sections III and IV of the paper thirteen principles for

Banking supervisory authorities to apply in assessing banks internal

control systems

Principles for the Assessment of Internal

Control Systems
Management oversight and the control culture
Principle 1:
The board of directors should have responsibility for approving and
periodically reviewing the overall business strategies and significant
policies of the bank; understanding the major risks run by the bank,
setting acceptable levels for these risks and ensuring that senior
management takes the steps necessary to identify, measure, monitor and
control these risks; approving the organizational structure;
and ensuring that senior management is monitoring the effectiveness of
the internal control system. The board of directors is ultimately
responsible for Ensuring that an adequate and effective system of
internal controls is established and maintained.

Principle 2:
Senior management should have responsibility for implementing
strategies and policies approved by the board; developing processes that
identify, measure, monitor and control risks incurred by the bank;
maintaining an organizational structure that clearly assigns
responsibility, authority and reporting relationships; ensuring that
delegated responsibilities are effectively carried out; setting appropriate
internal control policies; and monitoring the adequacy and effectiveness
of the internal control system.

Principle 3:
The board of directors and senior management are responsible for
promoting high ethical and integrity standards, and for establishing a
culture within the organization that emphasizes and demonstrates to all
levels of personnel the importance of internal controls. All personnel at a
banking organization need to understand their role in the internal
controls process and be fully engaged in the process.

Risk Recognition and Assessment

Principle 4:
An effective internal control system requires that the material risks that
could adversely affect the achievement of the banks goals are being
recognized and continually assessed. This assessment should cover all
risks facing the bank and the consolidated banking organization (that is,
credit risk, country and transfer risk, market risk, interest rate risk,
liquidity risk, operational risk, legal risk and reputational risk). Internal
controls may need to be revised to appropriately address any new or
previously uncontrolled risks.

Control Activities and Segregation of Duties

Principle 5:
Control activities should be an integral part of the daily activities of a
bank. An effective internal control system requires that an appropriate
control structure is set up, with control activities defined at every
business level. These should include: top level reviews; appropriate
activity controls for different departments or divisions; physical controls;
checking for compliance with exposure limits and follow-up on noncompliance; a system of approvals and authorizations; and, a system of
verification and reconciliation.

Principle 6:
An effective internal control system requires that there is appropriate
segregation of duties and that personnel are not assigned conflicting
responsibilities. Areas of potential conflicts of interest should be
identified, minimized, and subject to careful, independent monitoring.

Information and communication

Principle 7:
An effective internal control system requires that there are adequate and
comprehensive internal financial, operational and compliance data, as
well as external market information about events and conditions that are
relevant to decision making. Information should be reliable, timely,
accessible, and provided in a consistent format.

Principle 8:
An effective internal control system requires that there are reliable
information systems in place that cover all significant activities of the
bank. These systems, including those that hold and use data in an
electronic form, must be secure, monitored independently and supported
by adequate contingency arrangements.

Principle 9:
An effective internal control system requires effective channels of
communication to ensure that all staff fully understand and adhere to
policies and procedures affecting their duties and responsibilities and
that other relevant information is reaching the appropriate personnel.

Monitoring Activities and Correcting

Deficiencies
Principle 10:
The overall effectiveness of the banks internal controls should be
monitored on an ongoing basis. Monitoring of key risks should be part
of the daily activities of the bank as well as periodic evaluations by the
business lines and internal audit.

Principle 11:
There should be an effective and comprehensive internal audit of the
internal control system carried out by operationally independent,
appropriately trained and competent staff. The internal audit function, as
part of the monitoring of the system of internal controls, should report
directly to the board of directors or its audit committee, and to senior
management.

Principle 12:
Internal control deficiencies, whether identified by business line, internal
audit, or other control personnel, should be reported in a timely manner
to the appropriate management level and addressed promptly. Material
internal control deficiencies should be reported to senior management
and the board of directors.

Evaluation of Internal Control Systems by

Supervisory Authorities
Principle 13:
Supervisors should require that all banks, regardless of size, have an
effective system of internal controls that is consistent with the nature,
complexity, and risk inherent in their on- and off-balance-sheet activities
and that responds to changes in the banks environment and conditions.
In those instances where supervisors determine that a bank's internal
control system is not adequate or effective for that banks specific risk

profile (for example, does not cover all of the principles contained in this
document), they should take appropriate action.

CHAPTER 2
Background

1. The Basle Committee has studied recent banking problems in order to

identify the major sources of internal control deficiencies. The problems
identified reinforce the importance of having bank directors and
management, internal and external auditors, and bank supervisors focus
more attention on strengthening internal control systems and
Continuously evaluating their effectiveness. Several recent cases
demonstrate that inadequate internal controls can lead to significant
losses for bank
2. The types of control breakdowns typically seen in problem bank cases
can be grouped into five categories:
Lack of adequate management oversight and accountability, and
failure to develop a strong control culture within the bank. Without
exception, cases of major loss reflect management inattention to, and
laxity in, the control culture of the bank, insufficient guidance and
oversight by boards of directors and senior management, and a lack of
clear management accountability through the assignment of roles and
responsibilities. These cases also reflect a lack of appropriate incentives
for management to carry out strong line supervision and maintain a high
level of control consciousness within business areas.
Inadequate recognition and assessment of the risk of certain
banking activities, whether on- or off-balance sheet. Many banking
organizations that have suffered major losses neglected to recognize and
assess the risks of new products and activities, or update their risk
assessments when significant changes occurred in the environment or
Business conditions. Many recent cases highlight the fact that control
systems that function well for traditional or simple products are unable
to handle more sophisticated or complex products.

 The absence or failure of key control structures and activities,

such as segregation of duties, approvals, verifications,
reconciliations, and reviews of operating performance. Lack of
segregation of duties in particular has played a major role in the
significant losses that have occurred at banks.
Inadequate communication of information between levels of
management within the bank, especially in the upward
communication of problems. To be effective, policies and
procedures need to be effectively communicated to all personnel
involved in an activity. Some losses in banks occurred because
relevant personnel were not aware of or did not understand the
banks policies. In several instances, information about
inappropriate activities that should have been reported upward
through organizational levels was not communicated to the board
of directors or senior management until the problems became
severe. In other instances, information in management reports was
not complete or accurate, creating a falsely favourable impression
of a business situation.
Inadequate or ineffective audit programs and monitoring
activities. In many cases, audits were not sufficiently rigorous to
identify and report the control weaknesses associated with problem
banks. In other cases, even though auditors reported problems, no
mechanism was in place to ensure that management corrected the
deficiencies.
3. The internal control framework underlying this guidance is based on
practices currently in place at many major banks, securities firms, and
non-financial companies, and their auditors. Moreover, this evaluation
framework is consistent with the increased emphasis of banking
supervisors on the review of a banking organizations risk management
and internal control processes

CHAPTER 3
THE OBJECTIVES AND
ROLE OF THE INTERNAL
CONTROL OF BANKS

 Internal control is a process affected by the board of directors,

senior management and all levels of personnel. It is not solely a
procedure or policy that is performed at a certain point in time, but
rather it is continually operating at all levels within the bank. The
board of directors and senior management are responsible for
establishing the appropriate culture to facilitate an effective
internal control process and for monitoring its effectiveness on an
ongoing basis; however, each individual within an organization
must participate in the process. The main objectives of the internal
control process can be categorized as follows:
1. Efficiency and effectiveness of activities (performance objectives);
2. Reliability, completeness and timeliness of financial and management
information (information objectives); and
3. with applicable laws and regulations (compliance objectives)
Performance objectives for internal controls pertain to the
effectiveness and efficiency of the bank in using its assets and
other resources and protecting the bank from loss. The internal
control process seeks to ensure that personnel throughout the
organization are working to achieve its goals with efficiency and
integrity, without unintended or excessive cost or placing other
interests (such as an employees, vendors or customers interest)
before those of the bank.

 Information objectives address the preparation of timely, reliable,

relevant reports needed for decision-making within the banking
organization. They also address the need for reliable annual
accounts, other financial statements and other financial-related
disclosures and reports to shareholders, supervisors, and other
external parties. The information received by management, the
board of directors, shareholders and supervisors should be of
sufficient quality and integrity that recipients can rely on the
information in making decisions. The term reliable, as it relates to
financial statements, refers to the preparation of statements that are
presented fairly and based on comprehensive and well-defined
accounting principles and rules.
Compliance objectives ensure that all banking business complies
with applicable laws and regulations, supervisory requirements,
and the organizations policies and procedures. This objective must
be met in order to protect the banks franchise and reputation.

CHAPTER 4
THE MAJOR ELEMENTS
OF AN INTERNAL
CONTROL SYSTEM

 The internal control process, which historically has been a

mechanism for reducing instances of fraud, misappropriation and
errors, has become more extensive, addressing all the various risks
faced by banking organizations. It is now recognized that a sound
internal control process is critical to a banks ability to meet its
established goals, and to maintain its financial viability.
Internal control consists of five interrelated elements:
1. Management oversight and the control culture;
2. Risk recognition and assessment;
3. Control activities and segregation of duties;
4. Information and communication; and
5. Monitoring activities and correcting deficiencies.
The problems observed in recent large losses at banks can be
aligned with these five elements. The effective functioning of these
elements is essential to achieving a banks performance, information,
and compliance objectives.

A.

Management Oversight and the

Control Culture

1. Board of directors
Principle 1:
The board of directors should have responsibility for approving and
Periodically reviewing the overall business strategies and significant
policies of the bank; understanding the major risks run by the bank,
setting acceptable levels for these risks and ensuring that senior
management takes the steps necessary to identify, measure, monitor and
control these risks; approving the organizational structure; and ensuring
that senior management is monitoring the effectiveness of the internal
control system. The board of directors is ultimately responsible for
ensuring that an adequate and effective system of internal controls is
established and maintained.
The board of directors provides governance, guidance and
oversight to senior management. It is responsible for approving
and reviewing the overall business strategies and significant
policies of the organization as well as the organizational
structure. The board of directors has the ultimate responsibility
for ensuring that an adequate and effective system of internal
controls is established and maintained. Board members should
be objective, capable, and inquisitive, with a knowledge or
expertise of the activities of and risks run by the bank. In those
countries where it is an option, the board should consist of some
members who are independent from the daily management of
the bank. A strong, active board, particularly when coupled with
effective upward communication channels and capable

financial, legal, and internal audit functions, provides an

important mechanism to ensure the correction of problems that
may diminish the effectiveness of the internal control system.
The board of directors should include in its activities (1)
periodic discussions with management concerning the
effectiveness of the internal control system, (2) a timely review
of evaluations of internal controls made by management,
internal auditors, and external auditors, (3) periodic efforts to
ensure that management has promptly followed up on
recommendations and concerns expressed by auditors and
supervisory authorities on internal control weaknesses, and (4) a
periodic review of the appropriateness of the banks strategy and
risk limits.
One option used by banks in many countries is the establishment
of an independent audit committee to assist the board in carrying
out its responsibilities. The establishment of an audit committee
allows for detailed examination of information and reports without
the need to take up the time of all directors. The audit committee is
typically responsible for overseeing the financial reporting process
and the internal control system. As part of this responsibility, the
audit committee typically oversees the activities of, and serves as a
direct contact for, the banks internal audit department and engages
and serves as the primary contact for the external auditors. In those
countries where it is an option, the committee should be composed
mainly or entirely of outside directors (i.e., members of the board
that are not employed by the bank or any of its affiliates) who have
knowledge of financial reporting and internal controls. It should be
noted that in no case should the creation of an audit committee
amount to a transfer of duties away from the full board, which
alone is legally empowered to take decisions.

2. Senior management
Principle 2:
Senior management should have responsibility for implementing
strategies and policies approved by the board; developing processes that
identify, measure, monitor and control risks incurred by the bank;
maintaining an organizational structure that clearly assigns
responsibility, authority and reporting relationships; ensuring that
delegated responsibilities are effectively carried out; setting appropriate
internal control policies; and monitoring the adequacy and effectiveness
of the internal control system.
Senior management is responsible for carrying out the directives of
the board of directors, including the implementation of strategies
and policies and the establishment of an effective system of
internal control. Members of senior management typically delegate
responsibility for establishing more specific internal control
policies and procedures to those responsible for a particular
business unit. Delegation is an essential part of management;
however, it is important for senior management to oversee the
managers to whom they have delegated these responsibilities to
ensure that they develop and enforce appropriate policies and
procedures.
Compliance with an established internal control system is heavily
dependent on a well documented and communicated organisational
structure that clearly shows lines of reporting responsibility and
authority and provides for effective communication throughout the

organization. The allocation of duties and responsibilities should

ensure that there are no gaps in reporting lines and that an effective
level of management control is extended to all levels of the bank
and its various activities.
It is important that senior management takes steps to ensure that
activities are conducted by qualified staff with the necessary
experience and technical capabilities. Staff in control functions
must be properly remunerated. Staff training and skills should be
regularly updated. Senior management should institute
compensation and promotion policies that reward appropriate
behaviours and minimize incentives for staff to ignore or override
internal control mechanisms.
3. Control culture
Principle 3:
The board of directors and senior management are responsible for
promoting high ethical and integrity standards, and for establishing a
culture within the organization that emphasize and demonstrates to all
levels of personnel the importance of internal controls. All personnel at a
banking organization need to understand their role in the internal
controls process and be fully engaged in the process.
An essential element of an effective system of internal control is a
strong control culture. It is the responsibility of the board of
directors and senior management to emphasize the importance of
internal control through their actions and words. This includes the
ethical values that management displays in their business dealings,
both inside and outside the organization. The words, attitudes and
actions of the board of directors and senior management affect the
integrity, ethics and other aspects of the banks control culture.

 In varying degrees, internal control is the responsibility of

everyone in a bank. Almost all employees produce information
used in the internal control system or take other actions needed to
effect control. An essential element of a strong internal control
system is the recognition by all employees of the need to carry out
their responsibilities effectively and to communicate to the
appropriate level of management any problems in operations,
instances of non-compliance with the code of conduct, or other
policy violations or illegal actions that are noticed. This can best be
achieved when operational procedures are contained in clearly
written documentation that is made available to all relevant
personnel. It is essential that all personnel within the bank
understand the importance of internal control and are actively
engaged in the process.
In reinforcing ethical values, banking organizations should avoid
policies and practices that may inadvertently provide incentives or
temptations for inappropriate activities. Examples of such policies
and practices include undue emphasis on performance targets or
other operational results, particularly short-term ones that ignore
longer-term risk compensation schemes that overly depend on
short-term performance; ineffective segregation of duties or other
controls that could allow the misuse of resources or concealment of
poor performance; and insignificant or overly onerous penalties for
improper behaviours.
While having a strong internal control culture does not guarantee
that an organization will reach its goals, the lack of such a culture
provides greater opportunities for errors to go undetected or for
improprieties to occur.

B.

Risk Recognition and Assessment

Principle 4:
An effective internal control system requires that the material risks that
Could adversely affect the achievement of the banks goals are being
recognized and continually assessed. This assessment should cover all
risks facing the bank and the Consolidated banking organization (that is,
credit risk, country and transfer risk, market risk, interest rate risk,
liquidity risk, operational risk, legal risk and reputational risk). Internal
controls may need to be revised to appropriately address any new or
previously uncontrolled risks.
Banks are in the business of risk-taking. Consequently it is
imperative that, as part of an internal control system, these risks
are being recognized and continually assessed. From an internal
control perspective, a risk assessment should identify and evaluate
the internal and external factors that could adversely affect the
achievement of the banking organizations performance,
information and compliance objectives. This process should cover
all risks faced by the bank and operate at all levels within the
bank. It differs from the risk management process which typically
focuses more on the review of business strategies developed to
maximize the risk/reward trade-off within the different areas of the
bank.

 Effective risk assessment identifies and considers internal factors

(such as the complexity of the organizations structure, the nature
of the banks activities, the quality of personnel, organizational
changes and employee turnover) as well as external factors (such
as fluctuating economic conditions, changes in the industry and
technological advances) that could adversely affect the
achievement of the banks goals. This risk assessment should be
conducted at the level of individual businesses and across the wide
spectrum of activities and subsidiaries of the consolidated banking
organization. This can be accomplished through various methods.
Effective risk assessment addresses both measurable and nonmeasurable aspects of risks and weighs costs of controls against
the benefits they provide.
The risk assessment process also includes evaluating the risks to
determine which are controllable by the bank and which are not.
For those risks that are controllable, the bank must assess whether
to accept those risks or the extent to which it wishes to mitigate the
risks through control procedures. For those risks that cannot be
controlled, the bank must decide whether to accept these risks or
to withdraw from or reduce the level of business activity
concerned.
In order for risk assessment, and therefore the system of internal
control, to remain effective, senior management needs to
continually evaluate the risks affecting the achievement of its
goals and react to changing circumstances and conditions. Internal
controls may need to be revised to appropriately address any new
or previously uncontrolled risks. For example, as financial
innovation occurs, a bank needs to evaluate new financial
instruments and market transactions and consider the risks
associated with these activities. Often these risks can bebest
understood when considering how various scenarios (economic
and otherwise) affect the cash flows and earnings of financial

instruments and transactions. Thoughtful consideration of the full

range of possible problems, from customer misunderstanding to
operational failure, will point to important control considerations.

C.

Control Activities and Segregation

of Duties

Principle 5:
Control activities should be an integral part of the daily activities of a
bank. An effective internal control system requires that an appropriate
control structure is set up, with control activities defined at every
business level. These should include: top level reviews; appropriate
activity controls for different departments or divisions; physical
Controls; checking for compliance with exposure limits and follow-up
on noncompliance; a system of approvals and authorizations; and, a
system of verification and reconciliation.
Control activities are designed and implemented to address the
risks that the bank identified through the risk assessment process
described above. Control activities involve two steps:
(1)

The establishment of control policies and procedures; and

(2)

Verification that the control policies and procedures are

being complied with. Control activities involve all levels of
personnel in the bank, including senior management as well
as front line personnel. Examples of control activities
include:

Top level reviews - Boards of directors and senior management often

request presentations and performance reports that enable them to
review the banks progress toward its goals. For example, senior

management may review reports showing actual financial results to date

versus the budget. Questions that senior management generates as a
result of this review and the ensuing responses of lower levels of
management represent a control activity which may detect problems
such as control weaknesses, errors in financial reporting or fraudulent
activities.
Activity controls - Department or division level management receives
and reviews standard performance and exception reports on a daily,
weekly or monthly basis. Functional reviews occur more frequently than
top-level reviews and usually are more detailed. For instance, a manager
of commercial lending may review weekly reports on delinquencies,
payments received, and interest income earned on the portfolio, while
the senior credit officer may review similar reports on a monthly basis
and in a more summarized form that includes all lending areas. As with
the top-level review, the questions that are generated as a result of
reviewing the reports and the responses to those questions represent the
Control activity.
Physical controls - Physical controls generally focus on restricting
access to tangible assets, including cash and securities. Control activities
include physical limitations, dual custody, and periodic inventories.
Compliance with exposure limits - The establishment of prudent
limits on risk exposures is an important aspect of risk management. For
example, compliance with limits for borrowers and other counterparties
reduces the banks concentration of credit risk and helps to diversify its
risk profile. Consequently, an important aspect of internal controls is a
process for reviewing compliance with such limits and follow-up on
instances of non-compliance.
Approvals and authorizations - Requiring approval and authorisation
for transactions over certain limits ensures that an appropriate level of
management is aware of the transaction or situation, and helps to
establish accountability.

Verifications and reconciliations - Verifications of transaction details

and activities and the output of risk management models used by the
bank are important control activities. Periodic reconciliations, such as
those comparing cash flows to account records and statements, may
identify activities and records that need correction. Consequently, the
results of these verifications should be reported to the appropriate levels
of management whenever problems or potential problems are detected.
Control activities are most effective when they are viewed by
management and all other personnel as an integral part of, rather
than an addition to, the daily activities of the bank. When controls
are viewed as an addition to the day-to-day activities, they are
often seen as less important and may not be performed in
situations where individuals feel pressured to complete activities
in a limited amount of time. In addition, controls that are an
integral part of the daily activities enable quick responses to
changing conditions and avoid unnecessary costs. As part of
fostering the appropriate control culture within the bank, senior
management should ensure that adequate control activities are an
integral part of the daily functions of all relevant personnel.
It is not sufficient for senior management to simply establish
appropriate policies and procedures for the various activities and
divisions of the bank. They must regularly ensure that all areas of
the bank are in compliance with such policies and procedures and
also determine that existing policies and procedures remain
adequate. This is usually a major role of the internal audit
function.

Principle 6:
An effective internal control system requires that there is appropriate

Segregation of duties and that personnel are not assigned conflicting

responsibilities. Areas of potential conflicts of interest should be
identified, minimized, and subject to careful, independent monitoring.

In reviewing major banking losses caused by poor internal

controls, supervisors typically find that one of the major causes of
such losses is the lack of adequate segregation of duties. Assigning
conflicting duties to one individual (for example, responsibility for
both the front and back offices of a trading function) gives that
person access to assets of value and the ability to manipulate
financial data for personal gain or to conceal losses. Consequently,
certain duties within a bank should be split, to the extent possible,
among various individuals in order to reduce the risk of
manipulation of financial data or misappropriation of assets.
Segregation of duties is not limited to situations involving
simultaneous front and back office control by one individual. It can
also result in serious problems when there are not appropriate
controls in those instances where an individual has responsibility
for:
I.
II.
III.
IV.
V.
VI.

approval of the disbursement of funds and the actual

disbursement
customer and proprietary accounts;
transactions in both the "banking" and "trading" books;
informally providing information to customers about their
positions while marketing to the same customers;
assessing the adequacy of loan documentation and monitoring
the borrower after loan origination; and,
any other areas where significant conflicts of interest emerge
and are not mitigated by other factors.

 Areas of potential conflict should be identified, minimized, and

subject to careful monitoring by an independent third party. There
should also be periodic reviews of the responsibilities and
functions of key individuals to ensure that they are not in a
position to conceal inappropriate actions.

D.

Information and Communication

Principle 7:
An effective internal control system requires that there are adequate and
Comprehensive internal financial, operational and compliance data, as
well as external market information about events and conditions that are
relevant to decision making. Information should be reliable, timely,
accessible, and provided in a consistent format.
Adequate information and effective communication are essential
to the proper functioning of a system of internal control. From the
banks perspective, in order for information to be useful, it must be
relevant, reliable, timely, accessible, and provided in a consistent
format. Information includes internal financial, operational and
compliance data, as well as external market information about
events and conditions that are relevant to decision making.
Internal information is part of a record-keeping process that should
include established procedures for record retention.
Principle 8:
An effective internal control system requires that there are reliable
Information systems in place that cover all significant activities of the
bank. These systems, including those that hold and use data in an
electronic form, must be secure, monitored independently and supported
by adequate contingency arrangements.

 A critical component of a banks activities is the establishment and

maintenance of management information systems that cover the
full range of its activities. This information is usually provided
through both electronic and non-electronic means. Banks must be
particularly aware of the organizational and internal control
requirements related to processing information in an electronic
form and the necessity to have an adequate audit trail.
Management decision-making could be adversely affected by
unreliable or misleading information provided by systems that are
poorly designed and controlled.
Electronic information systems and the use of information
technology have risks that must be effectively controlled by banks
in order to avoid disruptions to business and potential losses. Since
transaction processing and business applications have expanded
beyond the use of mainframe computer environments to
distributed systems for mission critical business functions, the
magnitude of risks also has expanded. Controls over information
systems and technology should include both general and
application controls. General controls are controls over computer
systems (for example, mainframe, client/server, and end-user
workstations) and ensure their continued, proper operation.
General controls include in-house back-up and recovery
procedures, software development and acquisition policies,
maintenance (change control) procedures, and physical/logical
access security controls. Application controls are computerized
steps within software applications and other manual procedures
that control the processing of transactions and business activities.
Application controls include, for example, edit checks and specific

logical access controls unique to a business system. Without

adequate controls over information systems and technology,
including systems that are under development, banks could
experience loss of data and programs due to inadequate physical
and electronic security arrangements, equipment or systems
failures, and inadequate in-house backup and recovery procedures.

In addition to the risks and controls above, inherent risks exist that
are associated with the loss or extended disruption of services
caused by factors beyond the banks control. In extreme cases,
since the delivery of corporate and customer services represent
key transactional, strategic and reputational issues, such problems
could cause serious difficulties for banks and even jeopardize their
ability to conduct key business activities. This potential requires
the bank to establish business resumption and contingency plans
using an alternate off-site facility, including the recovery of critical
systems supported by an external service provider. The potential
for loss or extended disruption of critical business operations
requires an institution-wide effort on contingency planning,
involving business management, and not focused on centralized
computer operations. Business resumption plans must be
periodically tested to ensure the plans functionality in the event of
an unexpected disaster.
Principle 9:
An effective internal control system requires effective channels of
Communication to ensure that all staff fully understand and adhere to
policies and procedures affecting their duties and responsibilities and
that other relevant information is reaching the appropriate personnel.

 Without effective communication, information is useless. Senior

management of banks need to establish effective paths of
communication in order to ensure that the necessary information is
reaching the appropriate people. This information relates both to
the operational policies and procedures of the bank as well as
information regarding the actual operational performance of the
organization.

The organizational structure of the bank should facilitate an

adequate flow of information - upward, downward and across the
organization. A structure that facilitates this flow ensures that
information flows upward so that the board of directors and senior
Management are aware of the business risks and the operating
performance of the bank. Information flowing down through an
organization ensures that the banks objectives, strategies, and
expectations, as well as its established policies and procedures, are
communicated to lower level management and operations
personnel. This communication is essential to achieve a unified
effort by all bank employees to meet the banks objectives. Finally,
communication across the organization is necessary to ensure that
information that one division or department knows can be shared
with other affected divisions or departments.

E.

Monitoring Activities and

Correcting Deficiencies

Principle 10:
The overall effectiveness of the banks internal controls should be
Monitored on an ongoing basis. Monitoring of key risks should be part
of the daily activities of the bank as well as periodic evaluations by the
business lines and internal audit.
Since banking is a dynamic, rapidly evolving industry, banks must
continually monitor and evaluate their internal control systems in
the light of changing internal and external conditions, and must
enhance these systems as necessary to maintain their effectiveness.
In complex, multinational organizations, senior management must
ensure that the monitoring function is properly defined and
structured within the organization
. Monitoring the effectiveness of internal controls can be done by
personnel from several different areas, including the business
function itself, financial control and internal audit. For that reason,
it is important that senior management makes clear which
personnel are responsible for which monitoring functions.
Monitoring should be part of the daily activities of the bank but
also include separate periodic evaluations of the overall internal
control process. The frequency of monitoring different activities of
a bank should be determined by considering the risks involved and

the frequency and nature of changes occurring in the operating

environment.

Ongoing monitoring activities can offer the advantage of quickly

detecting and correcting deficiencies in the system of internal
control. Such monitoring is most effective when the system of
internal control is integrated into the operating environment and
produces regular reports for review. Examples of ongoing
monitoring include the review and approval of journal entries, and
management review and approval of exception reports.
In contrast, separate evaluations typically detect problems only
after the fact; however, separate evaluations allow an organization
to take a fresh, comprehensive look at the effectiveness of the
internal control system and specifically at the effectiveness of the
monitoring activities. These evaluations can be done by personnel
form several different areas, including the business function itself,
financial control and internal audit. Separate evaluations of the
internal control system often take the form of self-assessments
when persons responsible for a particular function determine the
effectiveness of controls for their activities. The documentation
and the results of the evaluations are then reviewed by senior
management. All levels of review should be adequately
documented and reported on a timely basis to the appropriate level
of management.

Principle 11:
There should be an effective and comprehensive internal audit of the
Internal control system carried out by operationally independent,
appropriately trained and competent staff. The internal audit function, as
part of the monitoring of the system of internal controls, should report

directly to the board of directors or its audit committee, and to senior

management.

The internal audit function is an important part of the ongoing

monitoring of the system of internal controls because it provides an
independent assessment of the adequacy of, and compliance with,
the established policies and procedures. It is critical that the
internal audit function is independent from the day-to-day
functioning of the bank and that it has access to all activities
conducted by the banking organization, including at its branches
and subsidiaries.
By reporting directly to the board of directors or its audit
committee, and to senior management, the internal auditors
provide unbiased information about line activities. Due to the
important nature of this function, internal audit must be staffed
with competent, well trained individuals who have a clear
understanding of their role and responsibilities. The frequency and
extent of internal audit review and testing of the internal controls
within a bank should be consistent with the nature, complexity, and
risk of the organizations activities.
It is important that the internal audit function reports directly to the
highest levels of the banking organization, typically the board of
directors or its audit committee, and to senior management. This
allows for the proper functioning of corporate governance by
giving the board information that is not biased in any way by the
levels of management that the reports cover. The board should also
reinforce the independence of the internal auditors by having such
matters as their compensation or budgeted resources determined by

the board or the highest levels of management rather than by

managers who are affected by the work of the internal auditors.

Principle 12:
Internal control deficiencies, whether identified by business line,
internal audit, or other control personnel, should be reported in a timely
manner to the appropriate management level and addressed promptly.
Material internal control deficiencies should be reported to senior
management and the board of directors.
Internal control deficiencies, or ineffectively controlled risks,
should be reported to the appropriate person(s) as soon as they are
identified, with serious matters reported to senior management and
the board of directors. Once reported, it is important that
management corrects the deficiencies on a timely basis. The
internal auditors should conduct follow-up reviews or other
appropriate forms of monitoring, and immediately inform senior
management or the board of any uncorrected deficiencies. In order
to ensure that all deficiencies are addressed in a timely manner,
senior management should be responsible for establishing a system
to track internal control weaknesses and actions taken to rectify
them.
The board of directors and senior management should periodically
receive reports summarizing all control issues that have been
identified. Issues that appear to be immaterial when individual
control processes are looked at in isolation, may well point to
trends that could, when linked, become a significant control
deficiency if not addressed in a timely manner.

CHAPTER 5
EVALUATION OF
INTERNAL CONTROL
SYSTEM BY
SUPERVISORY
AUTHORITY

Principle:
Supervisors should require that all banks, regardless of size, have an
Effective system of internal controls that is consistent with the nature,
complexity, and risk inherent in their on- and off-balance-sheet activities
and that responds to changes in the banks environment and conditions.
In those instances where supervisors determine that a bank's internal
control system is not adequate or effective for that banks specific
Risk profile (for example, does not cover all of the principles contained
in this document), they should take appropriate action.
Although the board of directors and senior management bear the
ultimate responsibility for an effective system of internal controls,
supervisors should assess the internal control system in place at
individual banks as part of their ongoing supervisory activities.
The supervisors should also determine whether individual bank
management gives prompt attention to any problems that are
detected through the internal control process.
Supervisors should require the banks they supervise to have strong
control cultures and should take a risk-focused approach in their
supervisory activities. This includes a review of the adequacy of
internal controls. It is important that supervisors not only assess
the effectiveness of the overall system of internal controls, but also
evaluate the controls over high-risk areas (e.g., areas with
characteristics such as unusual profitability, rapid growth, new

business activity, or geographic remoteness from the head office).

In those instances where supervisors determine that a banks
internal control system is not adequate or effective for that banks
specific risk profile, they should take appropriate action. This
would involve communicating their concerns to senior
management and monitoring what actions the bank takes to
improve its internal control system.
Supervisors, in evaluating the internal control systems of banks,
may choose to direct special attention to activities or situations
that historically have been associated with internal control
breakdowns leading to substantial losses. Certain changes in a
banks environment should be the subject of special consideration
to see whether accompanying revisions are needed in the internal
control system. These changes include: (1) a changed operating
environment; (2) new personnel; (3) new or revamped information
systems; (4) areas/activities experiencing rapid growth; (5) new
technology; (6) new lines, products, activities (particularly
complex ones); (7) corporate restructurings, mergers and
acquisitions; and (8) expansion or acquisition of foreign
operations (including the impact of changes in the related
economic and regulatory environments).
To evaluate the quality of internal controls, supervisors can take a
number of approaches. Supervisors can evaluate the work of the
internal audit department of the bank through review of its work
papers, including the methodology used to identify measure,
monitor and control risk. If satisfied with the quality of the
internal audit departments work, supervisors can use the reports
of internal auditors as a primary mechanism for identifying control
problems in the bank, or for identifying areas of potential risk that
the auditors have not recently reviewed. Some supervisors may
use a self-assessment process, in which management reviews the
internal controls on a business-by-business basis and certifies to

the supervisor that its controls are adequate for its business. Other
supervisors may require periodic external audits of key areas,
where the supervisor defines the scope. And finally, supervisors
may combine one or more of the above techniques with their own
on-site reviews or examinations of internal controls.
Supervisors in many countries conduct on-site examinations and a
review of internal controls is an integral part of such examinations.
An on-site review could include both a review of the business
process and a reasonable level of transaction testing in order to
obtain an independent verification of the bank's own internal
control processes.
An appropriate level of transaction testing should be performed to
verify:
1. the adequacy of, and adherence to, internal policies, procedures
and limits;
2. the accuracy and completeness of management reports and
financial records; and
3. the reliability (i.e., whether it functions as management intends)
of specific controls identified as key to the internal control
element being assessed.
In order to evaluate the effectiveness of the five internal control
elements of a banking organization (or a unit/activity thereof)
supervisors should:
1. Identify the internal control objectives that are relevant to the
organization, unit or activity under review (e.g., lending,
investing, accounting);
2. evaluate the effectiveness of the internal control elements, not just
by reviewing policies and procedures, but also by reviewing
documentation, discussing operations with various levels of bank

personnel, observing the operating environment, and testing

transactions;
3. share supervisory concerns about internal controls and
recommendations for their improvement with the board of
directors and management on a timely basis, and;
4. determine that, where deficiencies are noted, corrective action is
taken in a timely manner.
Banking supervisory authorities that have the legal basis or other
arrangements to direct the scope of and make use of the work of
external auditors often or always do so in lieu of on-site
examinations. In those instances, the external auditors should be
performing the review of the business process and the transaction
testing described above under specific engagement arrangements.
In turn, the supervisors should assess the quality of the auditors
work
.
In all instances, bank supervisors should take note of the external
auditors' observations and recommendations regarding the
effectiveness of internal controls and determine that bank
management and the board of directors have satisfactorily
addressed the concerns and recommendations expressed by the
external auditors. The level and nature of control problems found
by auditors should be factored into supervisors evaluation of the
effectiveness of a bank's internal controls.
Supervisors should also encourage bank external auditors to plan
and conduct their audits in ways that appropriately consider the
possibility of material misstatement of banks' financial statements
due to fraud. Any fraud found by external auditors, regardless of
materiality, must be communicated to the appropriate level of
management. Fraud involving senior management and fraud that is

material to the entity should be reported by the external auditors to

the board of directors and/or the audit committee. External
auditors may be expected to disclose fraud to certain supervisory
authorities or others outside the bank in certain circumstances
(subject to national requirements).

In reviewing the adequacy of the internal control process at

individual banking organizations, home country supervisors
should also determine that the process is effective across business
lines, subsidiaries and national boundaries4. It is important that
supervisors evaluate the internal control process not only at the
level of individual businesses or legal entities, but also across the
wide spectrum of activities and subsidiaries within the
consolidated banking organization. For this reason, supervisors
should encourage banking groups to use common auditors and
common accounting dates throughout the group, to the extent
possible.

CHAPTER 6
ROLE AND
RESPONSIBILITIES OF
EXTERNAL AUDITOR

 Although external auditors are not, by definition, part of a banking

organization and therefore, are not part of its internal control
system, they have an important impact on the quality of internal
controls through their audit activities, including discussions with
management and recommendations for improvement to internal
controls. The external auditors provide important feedback on the
effectiveness of the internal control system.
While the primary purpose of the external audit function is to give
an opinion on the annual accounts of a bank, the external auditor
must choose whether to rely on the effectiveness of the banks
internal control system. For this reason, the external auditors have
to obtain an understanding of the internal control system in order
to assess the extent to which they can rely on the system in
determining the nature, timing and scope of their own audit
procedures.
The exact role of external auditors and the processes they use vary
from country to country. Professional auditing standards in many
countries require that audits be planned and performed to obtain
reasonable assurance that financial statements are free of material
misstatement. Auditors also examine, on a test basis, underlying
transactions and records supporting financial statement balances
and disclosures. An auditor assesses the accounting principles and
policies used and significant estimates made by management and
evaluates the overall financial statement presentation. In some
countries, external auditors are required by the supervisory
authorities to provide a specific assessment of the scope, adequacy
and effectiveness of a banks internal control system, including the
internal audit system.

 One consistency among countries, however, is the expectation that

external auditors will gain an understanding of a banks internal
control process to the extent that it relates to the accuracy of the
banks financial statements. The extent of attention given to the
internal control system varies by auditor and by bank; however, it
is generally expected that material weaknesses identified by the
auditors would be reported to management in confidential
management letters and, in many countries, to the supervisory
authority. Furthermore, in many countries external auditors may be
subject to special supervisory requirements that specify the way
that they evaluate and report on internal controls.

CHAPTER 7
Conclusion
References

Management Oversight and the Control Culture

Many internal control failures that resulted in significant losses for
banks could have been substantially lessened or even avoided if the
board and senior management of the organizations had established
strong control cultures. Weak control cultures often had two common
elements. First, senior management failed to emphasize the importance
of a strong system of internal control through their words and actions,
and most importantly, through the criteria used to determine
compensation and promotion. Second, senior management failed to
Ensure that the organizational structure and managerial accountabilities
were well defined. For example, senior management failed to require
adequate supervision of key decision-makers and reporting of the nature
and conduct of business activities in a timely manner.

Risk Recognition and Assessment

In the recent past, inadequate risk recognition and assessment has
contributed to some organizations internal control problems and related
losses. In some cases, the potential high yields associated with certain
loans, investments, and derivative instruments distracted management
from the need to thoroughly assess the risks associated with the
transactions and devote sufficient resources to the ongoing monitoring
and review of risk exposures. Losses have also been caused when
management has failed to update the risk assessment process as the
organizations operating environment changed. For example, as more
complex or sophisticated products within a business line were
developed, internal controls may not have been enhanced to address the
more complex products. A second example involves entry into a new
business activity without a full, objective assessment of the risks
involved. Without this assessment of risks, the system of internal control
may not appropriately address the risks in the new business.

Control Activities and Segregation of Duties

In reviewing major banking losses caused by poor internal control,
supervisors typically find that these banks failed to observe certain key
internal control principles. Of these, segregation of duties, one of the
pillars of sound internal control systems, was most frequently
overlooked by banks that experienced significant losses from internal
control problems. Often, senior management assigned a highly regarded
individual responsibility for supervising two or more areas with
conflicting interests. For example, in several cases, one individual
supervised both the front and back offices of a trading desk. This
permitted the individual to control transaction initiation (e.g., buying and
selling securities or derivatives) as well as the related book keeping
function. Assigning such conflicting duties to one individual gives that
person the ability to manipulate financial data for personal gain or to
conceal losses.

Information and Communication

Some banks have experienced losses because information in the
organization was not reliable or complete and because communication
within the organization was not effective. Financial information may be
misreported internally; incorrect data series from outside sources may be
used to value financial positions; and small, but high-risk activities may
not be reflected in management reports. In some cases, banks failed to
adequately communicate employees duties and control responsibilities
or disseminated policies through channels, such as electronic mail, that
did not ensure that the policy was read, understood and retained. As a
result, for long periods of time, major management policies were not
carried out. In other cases, adequate lines of communication did not exist
for the reporting of suspected improprieties by employees. If channels
had been established for communication of problems upward through
the organizational levels, management would have been able to identify
and correct the improprieties much sooner.

Monitoring Activities and Correcting Deficiencies

Many banks that have experienced losses from internal control
problems did not effectively monitor their internal control systems.
Often the systems did not have the necessary built-in ongoing
monitoring processes and the separate evaluations performed were either
not adequate or were not acted upon appropriately by management.

REFERENCES