Scribd Logo
Upload

Welcome to Scribd!

  • 119 views

    Control Monitoring and Testing

    Uploaded by

    Tejendrasinh Gohil
    This document provides an overview of control monitoring and testing at US Bank. It discusses the integrated framework, which includes the control environment framework for documenting and monitoring controls, and the quality assurance framework for independent testing. It outlines the roles and responsibilities of operational risk management in overseeing controls. Examples of control monitoring reporting include RCSA self-assessment results and quality assurance testing results. Lessons learned focus on early involvement in risk assessment and changing mindsets around first line of defense responsibilities.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Control Monitoring and Testing

    Uploaded by

    Tejendrasinh Gohil
    119 views15 pages
    This document provides an overview of control monitoring and testing at US Bank. It discusses the integrated framework, which includes the control environment framework for documenting and monitoring controls, and the quality assurance framework for independent testing. It outlines the roles and responsibilities of operational risk management in overseeing controls. Examples of control monitoring reporting include RCSA self-assessment results and quality assurance testing results. Lessons learned focus on early involvement in risk assessment and changing mindsets around first line of defense responsibilities.

    Original Description:

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document provides an overview of control monitoring and testing at US Bank. It discusses the integrated framework, which includes the control environment framework for documenting and monitoring controls, and the quality assurance framework for independent testing. It outlines the roles and responsibilities of operational risk management in overseeing controls. Examples of control monitoring reporting include RCSA self-assessment results and quality assurance testing results. Lessons learned focus on early involvement in risk assessment and changing mindsets around first line of defense responsibilities.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    119 views15 pages

    Control Monitoring and Testing

    Uploaded by

    Tejendrasinh Gohil
    This document provides an overview of control monitoring and testing at US Bank. It discusses the integrated framework, which includes the control environment framework for documenting and monitoring controls, and the quality assurance framework for independent testing. It outlines the roles and responsibilities of operational risk management in overseeing controls. Examples of control monitoring reporting include RCSA self-assessment results and quality assurance testing results. Lessons learned focus on early involvement in risk assessment and changing mindsets around first line of defense responsibilities.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 15
    At a glance
    Powered by AI
    The presentation discusses an integrated framework for control environment, quality assurance, and operational risk management oversight. It focuses on first line of defense control monitoring and testing.

    The integrated framework overview discusses assessing risk, documenting controls, managing change, monitoring/self-assessing controls, and executing independent quality assurance programs. It includes the control environment framework and quality assurance framework.

    ORM oversight roles are responsible for providing credible challenge for first line of defense procedures and governance, reviewing control inventory data quality, facilitating risk identification, and approving annual QA plans. They also periodically review framework adherence and aggregate/report QA results.

    Control Monitoring

    and Testing

    April 2017

    Presented by: Matt Duditch – SVP,


    Operational Risk Management
    US Bank
    Topics
    • Integrated Framework Overview
    o Control Environment Framework
    o Quality Assurance Framework
    • ORM Oversight Roles and Responsibilities
    • Lessons Learned
    • Control Monitoring Reporting Examples

    Presentation with focus on First Line of


    Defense Control Monitoring and Testing
    U.S. BANCORP | 2
    Integrated Framework Overview

    Monitor/ Execute
    Assess Risk Document Manage
    Self-Assess Independent
    (e.g. RCSA) Controls Change
    Controls QA

    Risk and Control Environment Quality


    Compliance Framework (Control Assurance
    Programs Environment Policy) Framework
    (QA Policy)
    U.S. BANCORP | 3
    Control Environment Framework
    • Align per risk • Drives
    assessments, auditability,
    leverage consistency of
    central practice
    repository
    Evidence
    Document
    the Control
    the Control in
    in Business
    the Control
    Practice and
    Inventory
    Procedures

    Monitor the
    Escalate
    Control to
    Findings and
    Confirm
    Manage
    Accuracy and
    Change
    Performance
    • Control • Leverage self-
    Governance assessments,
    and issue self- attestations for
    identification SOX, RCSA

    Governance and Oversight


    U.S. BANCORP | 4
    Quality Assurance Framework
    • Ensure QA of • Review
    controls process/
    mitigating all procedures/
    material risks controls
    • Document • Confirm test
    planned QA attributes
    by quarter Annual
    Test Prep
    Planning

    Issue ID
    Test
    and
    Execution
    Reporting
    • Vet findings & • Perform QA
    identify issues testing
    • Report results, • Review KIs
    and remediate • Note findings
    findings
    Governance and Oversight
    U.S. BANCORP | 5
    ORM Oversight Roles and
    Responsibilities
    Control
    RCSA Program Environment Quality Assurance
    Framework Framework
    Policy Ownership/Oversight/Procedure Review/Training

    Maintain Routines, Tools, Templates, and Guidance

    • Facilitate risk • Provide credible • Approve annual QA


    identification and challenge for FLOD plans and material
    scenario analysis Procedures and deviations
    • Provide credible Governance • Periodic review of
    challenge over • Review and framework adherence
    control identification, recommend actions • Aggregate and report
    inherent/residual risk related to control quarterly QA results
    ratings and inventory data quality
    • Lead coordinated
    effectiveness ratings
    remediation efforts
    U.S. BANCORP | 6
    Lessons Learned
    • Early involvement with risk assessment and program owners

    • Change mindset that control owners are responsible for


    monitoring and cannot only rely on independent QA and Audit

    • Implement framework for outsourced control


    execution/reliance on other Business Lines or Support
    Functions
    • Assert central repository for controls, build with robust
    governance and change management in mind
    • Strive for systematic QA planning and results capture early in
    the implementation cycle
    • Fully assess scoping levers for QA (see next slide)
    U.S. BANCORP | 7
    QA Scoping Levers
    Scoping of Risk Cutoff for testing per the inherent risk scale,
    degree of regulatory applicability
    Scoping of Controls Automated vs. IT Dependent vs. Manual,
    Primary vs. Secondary
    Program-Specific e.g. SOX, Basel, AML – specific prioritization
    Levers lens or level of scrutiny
    Maturity of Control Only physical evidence of control (onsite testing
    Design required) vs. systematic reporting, alignment of
    controls to key business objectives
    Maturity of Control Depth, frequency, and reliability of control
    Monitoring owner monitoring
    Frequency of testing Weekly, monthly, quarterly, annually, etc.
    Style of testing Frequent sample-based vs. “internal audit” style

    U.S. BANCORP | 8
    Control Monitoring and Testing
    Reporting Examples

    1) RCSA Driven Control Self-Assessment


    Results

    2) Quality Assurance Results


    U.S. BANCORP | 9
    RCSA Control Effectiveness
    Self-Assessment - Illustration

    U.S. BANCORP | 10
    RCSA Control Effectiveness
    Self-Assessment Reporting
    • Trend reporting of all less than satisfactory controls
    • Require formal remediation plan for each instance
    and validation by Operational Risk Management

    U.S. BANCORP | 11
    Quality Assurance Reporting
    Elements

    Control
    Control QA
    QA Plan Finding /
    Testing Originated
    Adherence Failure
    Profiling Issues
    Rates

    Thematic Analysis

    U.S. BANCORP | 12
    QA Control Failure/Finding Rate
    Failure / Finding Rate by Risk Category
    Risk Categories Control Failure Rate Control Finding Rate

    Risk Segment 1 1% 5%
    Risk Segment 2 3% 4%
    Risk Segment 3 0% 0%
    Risk Segment 4 0% 0%
    Risk Segment 5 0% 0%
    Risk Segment 6 6% 13%
    Risk Segment 7 0% 20%
    Risk Segment 8 2% 50%
    Risk Segment 9 0% 0%
    Risk Segment 10 7% 11%
    Enterprise 2% 6%

    Also report by Business Line matrixed with Risk Segment, etc.


    U.S. BANCORP | 13
    QA Finding Thematic Analysis
    Themes Identified in Findings by Risk Category
    Percent
    Themes Identified Risk 1 Risk 2 Risk 3 Risk … Total
    age
    Execution Evidence 4 3 7 41%
    eGRC Control Inventory
    0 0%
    Documentation
    Procedure Gap 1 1 6%
    Policy Non-compliance 1 1 6%
    Failed Execution /
    1 1 1 1 4 24%
    Human Error
    Process or Control
    1 1 2 4 24%
    Design Failure
    Total 5 4 2 3 17 100%

    Documentation Findings Control Failures


    U.S. BANCORP | 14
    QA Issue Reporting
    Business # %
    Q1 Q2 Q3 Q4 Q5
    Line Q over Q Q over Q
    BL 1 5 5 5 5 5 0 0%
    BL 2 10 10 10 10 15 5 50%
    BL 3 0 0 6 6 3 (3) (50%)
    BL4 4 5 8 8 10 2 25%
    Total 19 20 29 29 33 4 14%
    Areas of Heightened Focus
    Past Due 0
    Extensions 1
    Re-opened 1
    At Risk 2
    Aged > 24 Months 1
    Due Within 60 Days 5

    Do more sub-segment reporting by risk category, theme, etc.


    U.S. BANCORP | 15

    You might also like