The document discusses various types of audits conducted on banks, including internal audits which evaluate risk management and compliance, and external audits of financial statements; it also covers how internal audit departments are organized and their responsibilities in assessing risks, controls, and governance processes across a bank's branches and departments. Key risks faced by banks that are subject to audit include credit, market, operational, liquidity, and reputational risks, and the document outlines different approaches for calculating capital requirements to address these risks under Basel III standards.
The document discusses various types of audits conducted on banks, including internal audits which evaluate risk management and compliance, and external audits of financial statements; it also covers how internal audit departments are organized and their responsibilities in assessing risks, controls, and governance processes across a bank's branches and departments. Key risks faced by banks that are subject to audit include credit, market, operational, liquidity, and reputational risks, and the document outlines different approaches for calculating capital requirements to address these risks under Basel III standards.
The document discusses various types of audits conducted on banks, including internal audits which evaluate risk management and compliance, and external audits of financial statements; it also covers how internal audit departments are organized and their responsibilities in assessing risks, controls, and governance processes across a bank's branches and departments. Key risks faced by banks that are subject to audit include credit, market, operational, liquidity, and reputational risks, and the document outlines different approaches for calculating capital requirements to address these risks under Basel III standards.
The document discusses various types of audits conducted on banks, including internal audits which evaluate risk management and compliance, and external audits of financial statements; it also covers how internal audit departments are organized and their responsibilities in assessing risks, controls, and governance processes across a bank's branches and departments. Key risks faced by banks that are subject to audit include credit, market, operational, liquidity, and reputational risks, and the document outlines different approaches for calculating capital requirements to address these risks under Basel III standards.
Download as PPT, PDF, TXT or read online from Scribd
Download as ppt, pdf, or txt
You are on page 1of 34
Bank Audit
Auidit of Banks
Agenda
1. Types of Audits of Banks
2. Audit of Risks in Banks 3. Audit of Financial Position & Results of Operations of Banks 4. Audit of IT Computer Systems in Banks 5. Future of Bank Auditing
Page 2
1. Types of Audits of Banks
1.1. Internal Audit Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.
1.2. External Audit
External audit is an audit conducted by an individual or firm that is independent of the company being audited. Independent auditors audit the books of a company generally once per year after the completion of the companys fiscal year. Their role is to give an opinion of the financials statements reflection of the status and operations of the company being audited. Based on what they witness during the audit they will also produce, for management and board utilization, a management letter. Although a financial statement audit is the most common type of external audit, external auditors may also conduct special purpose audits which might include; performing specific tests and procedures and reporting on the results, a less intensive review, and compilations
Page 3
1.1. Internal Audit
Roles and Responsibilities Internal audit departments mainly function to provide assurance to senior management of the Bank and stakeholders for the activities of the Banks whole departments, branches and subisidiaries on their consistency with the Banking Law, BRSA Regulations, banking legislation, Bank strategies, policies and procedures and for the adequacy of internal control and risk management system. Besides, it is responsible for establishing and maintaining effective internal audit system to minimize the effects of the operational risks. Some of the audit functions are: Evaluating
the adequacy and effectiveness of risk management, control and
governance processes of the Bank. Assessing compliance with regulations of Legislative Bodies and the Banks procedures. Providing recommendations for improving the operations of the Bank in terms of efficient and effective performance. Assisting the detection of fraud. For those purposes the Department conducts audits at the branches, departments and subsidiaries of the Bank throughout Turkey and abroad. All business systems, applications, processes, operations, functions and activities within the Bank are subject to the audits. Page 4
1.1. Internal Audit
The BRSA Supervision on Internal Audit The BRSA regulates and supervises also HR issues of IAD and audit studies performed. Some of the issues are mentioned below:
The number and professional quality of internal auditors in IAD should be
sufficient, All audit plans and annual results must be reported to the BRSA, Manuals should be written, The charter, working papers must contain the minimum requirements asked by the BRSA,
The BRSA, in its regulations, refers to the IIAs standards on those issues.
Page 5
1.1. Internal Audit
Audit Universe & Coverage All of the activities in the head office departments, subsidiaries and Branches are subject to audit. Although all financial subsidiaries have Internal Audit / Internal Control Units, Internal Audit Department of Garanti also performs audits in those subsidiaries.
Working Methodology RISK BASED AUDITING PRINCIPLE
RISK
Identification Sourcing Assessment Prioritization
AUDIT PLANS
Audit manuals are established to provide guidance on specific audits. Manuals are prepared about procedures of on-site engagements that the auditors may perform.
Page 6
1.1. Internal Audit
The Banks Risk Matrix
Risk Mapping and Audit Plan
Risk Level of Banks Activities
Branch
Risk Indicators
Risk Assessment
Head Office Departments
Subsidiaries
AUDIT PLAN
Regional Credit Granting Offices
Audit Period
Risk Matrices of Subsidiaries
Risk Indicators
Importance Level
Credit Extension Retail Banking Operations Commercial Banking Operations Deposit Collection and Investment Products Treasury Management Financial Investments and Placement Management of Customer Funds Safe Keeping Insurance Services Agency Services Payment Systems IT Systems Human Resource Legal Proceedings New Technologies
Risk Assessment
AUDIT PLAN PROCESS
Internal Audit Department
Audit Committee
Board of Directors
BRSA
Page 7
1.1. Internal Audit
Organizational Structure of Internal Audit Department INTERNAL AUDIT DEPARTMENT DIRECTOR
SUPERVISOR Central Computerized Audit & Central Fraud Detection
SUPERVISOR Fraud Investigation
SUPERVISOR
SUPERVISOR
H/O Departments &Subsidiaries & Risk Management
H/O Departments &
Subsidiaries & Training
SUPERVISOR H/O Departments &Subsidiaries
Risk Management Audit Team
SUPERVISOR IT Audit
SUPERVISOR Financial Accounting Audits
IT Audit Team
Auditors/Assistant Auditors
Page 8
1.1. Internal Audit
On-Site Audits Branch Audits H/O and Subsidiary Audits
Central Audits Audits of Operations and Transactions Process Audits Internal Fraud Detection
Information Technologies Audits IT Processes Banking Applications Subsidiary IT Audits
Operational Audits
Financial Audits
IT Audits
Performance Audits
Managerial Audits
Compliance Audits
Internal Fraud Detection
Risk Management Audits
Page 9
1.1. Internal Audit
le
firm Co n
Recomputing
ing ew
t ai e D
g tin s e dT
ati o
i erv
Int
Observation & Inspection
Statistical Sampling An Pr alyti c oc ed al ur es
Page 10
1.2. External Audit
Taking into account opinion of the Audit Committee, the Board of Directors selects the authorized audit company, which conducts audit engagement in periods determined by legislation, and submits the company to approval of the General Assembly. The authorized external audit company is evaluated quarterly by the Audit Committee during the service period and the results must be submitted to the Board of Directors. Deloitte, KPMG, PWC, Ernst & Young as external audit companies are authorized by Banking Regulation and Supervision Agency (BRSA) for financial audit in banks. In addition; banks quoted to Istanbul Stock Exchange are also subject to external audit in accordance to Capital Markets Boards regulations. The External Audit Companies generally offer the services below; Audits of the financial statements, Audits of the Information Technology Systems. Actions which will be taken by banks regarding External Audit Companys IT audit findings are presented to and approved by Board of Directors and are sent to BRSA twice a year. Page 11
2. Audit of Risks in Banks
What is Risk ? Pronounced as risco in Italian, Risiko in German and risk in English, this concept has been used as riziko formerly, and later has been used as risk . Risk is the potential that a chosen action or activity (including the choice of inaction) will lead to a loss or undesirable outcome. The concept has been used as a synonym with danger , and used for the situations which is predicted to appear in the future but which at the same time is unknown whether or not it is going to happen. The two fundamental components (R) of the Risk are the probability of that the loss will occur (p) and the magnitude of the potential loss (L).
Ri=Lip(Li)
Page 12
2. Audit of Risks in Banks
Types of Risks
Share Risk Market Risk
Credit Risk
Transaction Risk
Interest Rate Risk
Exchange Rate Risk Commodity Risk
Structural Interest Rate Risk
Specific Risk General Market Risk
Liquidity Risk
Financial Risks
Operational Risk
Counterparty Credit Risk Transaction & Business Risk Issuer Risk
Reputation Risk Business & Strategic Risks
Concentration Risk
Issuing Risk
Page 13
2. Audit of Risks in Banks
Benefits of Risk Management Enhancing the business plan and the strategical planning Quick understanding and capturing new opportunities
Giving assurance to shareholders
Enhancing the communication between units
Potential Benefits
Less shocks and
unexpected surprises
Reinforcement of the effective usage of resources
Encouraging continuous renewal and improvement
Supporting the internatl audit program to focus
Page 14
2. Audit of Risks in Banks
Capital Requirement Calculation Methods
Level of Development
MARKET RISK
SIMPLE
MEDIUM
ADVANCED
Standard Approach Value at Risk (VAR) Approach
CREDIT RISK
OPERATIONAL RISK
Simplified Standart Approach
Basic Indicator Approach
Standard Approach Basic Internal Rating Approach Advanced Internal Rating Approach
Alternative Standard Approach Standard Approach Advanced Measurement Approaches
Page 15
2. Audit of Risks in Banks
Calculation of Minimum Capital Requirement
Total Capital
%8 Credit Risk
Market Risk
Operation al Risk
Page 16
2. Audit of Risks in Banks
In the past, the stability of a bank was generally measured purely on the sum of its capital tiers divided by its Risk Weighted Assets. With the Basel III, the capital rules have been strengthened and all the components operating together has been taken as a complete framework.
LCR: Liquidity Coverage Ratio
NSFR: Net Stable Funding Ratio
Page 17
2. Audit of Risks in Banks
According to the Basel Committee on Banking Supervision, the Basel 3 proposals have two main objectives, a)To strengthen global capital and liquidity regulations with the goal of promoting a more resilient banking sector; and a)To improve the banking sector's ability to absorb shocks arising from financial and economic stress.
To achieve these objectives, the main proposal the BCBS Basel 3 has developed are: a)Capital reform (including quality and quantity of capital), complete risk coverage, leverage ratio; and a)Liquidity reform (short term and long term ratios).
Page 18
2. Audit of Risks in Banks
In view of preserving core Tier 1, the Committee introduced two new "buffers. A Capital Conservation Buffer should allow banks to absorb shocks in periods of stress without breaching core Tier 1. And a more discretionary Countercyclical Buffer to compensate for increased systemic risks in times of excessive credit growth. In terms of quantity, total Tier 1 Capital is now required at 6%, up 2% from Basel II . Furthermore, a new leverage ratio will make part of banking regulatory framework. Banks will be required to maintain a leverage ratio of 3 percent or more (33 times its capital). The unweighted assets include provisions, loans, off-balance sheet items with full conversion, and all derivatives. The main purpose of this ratio is to constrain leverage in the banking sector, while also helping to safeguard against model risk and measurement errors. In addition to the capital banks must hold against risk weighted assets, financial institutions now have two new ratios to comply with: Liquidity Coverage Ratio (LCR) and Net Stable Funding Ratio. LCR is designed to promote the short-term resilience of a bank's liquidity risk profile by ensuring that it has sufficient high-quality liquid assets to survive a significant stress scenario lasting for 30 calendar days; and the NSFR aims at promoting longer-term resilience by requiring banks to have capital or longer term high-quality funding which can survive over a one year period of less severe stress.
Page 19
2. Audit of Risks in Banks
Risk Management Audit and Internal Auditors Internal Auditors should; 1.Focus
on risks related to a possible recession (reputation, liquidity, labor force reduction...)
2.Audit the effectiveness of risk management and corporate governance processes. 3.Conduct the re-evaluation of risks and identify the risks associated with each other. 4.Undertake a teaching role on risk management. 5.Improve the relations with other governance, risk and checkpoints within the organization. 6.Expand the studies related with Fraud on the audit plans. Also; 1.Auditors
should be in close contact with the senior management and the audit committee. 2.More flexible inspection plans that can be changed during the period should be used. 3.Information about the organization and business should be improved. 4.In order to conduct more effective audits, the audit reports should be prepared in shorter times and intensive technology should be used.
Page 20
3. Audit of Financial Position / Results of Operations of
Banks Audit of Assets Audit operations for assets; Cash and Cash Equivalents Financial Investments Derivative Financial Assests and Liabilities Loans Tangible and Intangible Fixed Assets Other Various Assets and Liabilities Investments Held as for Sale
Page 21
3. Audit of Financial Position / Results of Operations of
Banks Audit of Assets First of all, auditor has to audit current assets whether these are recorded correct or not. Reconciliation is done by auditor to reach equity of trial balance-MIS-balance sheet. Back-dated bank reciepts are examined. Reconciliation is done for all bank accounts. Nominal values of securities are verified. Conformity of the data is examined which was used for valuation of securities.
Income and expense is examined which was obtained by derivative operations.
Valuations of derivative products is examined.
Current credit balance of bank is compared with past periods to examine difference.
Rediscount calculation of loans is examined to be certain of accuracy.
Depreciation accounting of bank is examined to verify accuracy. Current and past period is compared to examine differences. Accounting records are examined which put into operation with the defination of Other. Market value of bank is examined.
Page 22
3. Audit of Financial Position / Results of Operations of
Banks Audit of Liabilities Audit operations for liabilities; Deposit and Other Liabilities Credits Obtained Reserves Tax Liabilities on Profit Shareholders Equity
Page 23
3. Audit of Financial Position / Results of Operations of
Banks Audit of Liabilities Reconciliation
is done by auditor to reach equity of trial balance-MIS-balance sheet.
Current
deposits and other liabilities of bank are compared with past periods to examine difference. Current
obtained credits of bank are compared with past periods to examine
Rediscounts Collateral
difference.
of interest for obtained credits are examined to be certain of accuracy.
accounts are examined to be certain of accuracy.
Tax
calculation of bank is examined.
For
shareholders equity, capital movements in a period is examined.
Page 24
3. Audit of Financial Position / Results of Operations of
Banks Audit of Income Statement
Interest income
Interest expense
Service and commission income/expense
Personnel expense
Income and expense of other activities
Other income and expenses
Rediscount and evaluation transactions
Page 25
3. Audit of Financial Position / Results of Operations of
Banks Audit of Income Statement An income statement audit can help auditor to isolate mathematical errors and ledger discrepancies.
Reconciliation is done by auditor to reach equity of trial balance-MIS-balance sheet for
related accounts. Change in trend of interest income and expense is examined to determine possible reverse entries. Change in trend of commission income and expense is examined. Possible correction records related to commission income and expense are examined to be certain of accuracy. Current personnel payments are compared to past periods. Conformity of the subsidiary records to the trial balance is examined.
Page 26
3. Audit of Financial Position / Results of Operations of
Banks Audit of Off-Balance Sheet Items
Liabilities are examined to understand their
origin.
Nominal amounts of securities are examied
to confirm their assets on off-balance sheet.
Reconciliation is done related to deposits
which is given or taken.
Page 27
4. Audit of IT Computer Systems in Banks
The computerized environment provides advantages over manual system in terms of accuracy and uniform processing of transactions. But at the same time it poses certain challenges before the auditor in terms of audit risk due to peculiar nature and characteristics of Computerized Information System (CIS) environment, where potential for fraud is much more and can be more easily hidden in the digital data. Computer fraud and abuse can have a detrimental effect on an organization. Periodic surveys undertaken by organizations such as the NCC (National Computing Centre) and the Audit Commission indicate the following common instances of computer fraud and abuse: Unauthorised disclosure of confidential information Unavailability of key IT systems Unauthorised modification/destruction of software Unauthorised modification/destruction of data Theft of IT hardware and software Use of IT facilities for personal business
Page 28
4. Audit of IT Computer Systems in Banks
Computer Security Audit A computer security audit is a systematic, measurable technical assessment of how the organization's security policy is employed at a specific site. Computer security auditors work with the full knowledge of the organization, at times with considerable inside information, in order to understand the resources to be audited. Symantec Computer security auditors perform their work though personal interviews, vulnerability scans, examination of operating system settings, analyses of network shares, and historical data. They are concerned primarily with how security policies- the foundation of any effective organizational security strategy - are actually used. There are a number of key questions that security audits should attempt to answer: Are passwords difficult to crack? Are there access control lists (ACLs) in place on network devices to control who has access to shared data? Are there audit logs to record who accesses data? Are the audit logs reviewed? Have all unnecessary applications and computer services been eliminated for each system? Is there a disaster recovery plan? Have the participants and stakeholders ever rehearsed the disaster recovery plan? Page 29
4. Audit of IT Computer Systems in Banks
Information Technologies Audit Risk Assessment Step 2: Step 1: Interviews & Determination of Surveys Risk Assessment Participators
Step 3: Risk Prioritization
Step 4: Evaluation by the Internal Audit Mng.
Step 5: Establish Risk Based Audit Plan
For the risk assessment of IT Processes, initially interviews with business unit managers and Garanti Technology senior management are performed.
IT Risk Assessment surveys are filled by the said managers, to determine the risky IT processes. The results of surveys are evaluated in terms of vulnerability and impact of IT processes.
Applications and Subsidiaries are assessed based on the international Risk
Assessment methodologies of ISACA (Information Systems Audit & Control Association).
Annual audit plans are formed based on the prioritization resulted from the risk assessments.
Risk assessment is performed annually.
Page 30
4. Audit of IT Computer Systems in Banks
Technical Competence, Information, Standards and Tools Used Standards BRSA Regulations COBIT ITIL ISO 27001, BS 25999 CMMI, PMBOK, NIST Technical Information
Audit Competences CISA,CEH,PMP,CISM,CRISC Process Audit Methodology Sampling Methodology Evidence Gathering Method. IT Audit Methodology
INFORMATION TECHNOLOGIES AUDIT
Operating Systems Databases Software Development Network Infrastructure Comp.Engineering Background Continuous Pro. Education
GarantiBank SA. Garanti Pension & Life Insurance Garanti Leasing Garanti Securities Garanti Factoring Garanti Asset Man. Garanti Bank Moscow Garanti Mortgage ..
In IT Process audits, general controls in the processes are evaluated, based on COBIT, ISO 27001, ITIL, CMMI control objectives, ISACA checklists, BRSA regulations and various technical control lists. In Banking Application audits, application controls including data creation/ authorization, input/ output, data processing, mining, limit, compliance, workflow, efficiency, security controls are evaluated. In IT Audits of Subsidiaries, general and application controls of Subsidiaries current IT and financial processes are evaluated based on the same standards used in IT Process & Application audits.
32 Page 32
5. Future of Bank Auditing
With the developments in banking sector, classical audit practices changed to
modern audit methodologies.
Traditional Methods Focused in finding errors Issue Focused to past Financial losses Labor intensive Based on problem
Modern Methods Focused in system, process and risk Prevention Focused to future Efficiency System intensive Based on solution
