The Basle Committee on Banking Supervision released to bank supervisory agencies around the world a framework that provides a set of principles for evaluating the adequacy of banks internal control systems over on- and off-balance sheet items.

Objectives

The committee outlined three broad objectives of the Framework

• Efficiency and effectiveness of operations

• Reliability and completeness of financial and management information

• Compliance with applicable laws and regulations

Return to top of page.

Breakdowns Found in Problem Banks Due to Internal Control Weaknesses

The Committee outlined five common breakdowns found in problem banks that can be remedied through the use of an effective internal control system.

1. Lack of adequate management oversight and accountability and failure to develop a strong control culture within the bank.

2. Inadequate assessment of the risk of certain banking activities, whether on- or off-balance sheet.

3. The absence or failure of key control activities, such as segregation of duties, approvals, verifications, reconciliations and reviews of operating performance.

4. Inadequate communication of information between levels of management within the bank, especially in the upward communication of problems.

5. Inadequate or ineffective audit programs and other monitoring activities.

Return to top of page.

Benefits of an Effective Internal Control System

The Framework lists eight areas that benefit from an effective internal control system. These areas include:

BANK MANAGEMENT - A system of effective internal controls is a critical component of bank management.

SAFETY AND SOUNDNESS - A system of effective internal controls is a foundation for the safe and sound operations of banks.

GOALS AND OBJECTIVES - A system of effective internal controls contributes to the accomplishment of the bank's goals and objectives.

LONG-TERM PROFITABILITY - A system of effective internal controls contributes to the accomplishment of the bank's long-term profitability targets.

FINANCIAL AND MANAGERIAL REPORTING - A system of effective internal controls contributes to the maintenance of reliable financial and managerial reporting.

COMPLIANCE - A system of effective internal controls contributes to compliance with laws, regulations, policies, plans and internal rules and procedures.

RISK OF LOSS - A system of effective internal controls decreases the risk of unexpected losses.

RISK OF DAMAGE TO REPUTATION - A system of effective internal controls decreases the risk of damage to the bank's reputation.

Return to top of page.

Internal Control Categories

The Committee presents 14 principles for effective internal control. The principles are classified into six categories.

1. Management Oversight and the Control Culture

2. Risk Assessment

3. Control Activities

4. Information and Communication

5. Monitoring

6. Evaluation of Internal Control Systems by Supervisory Authorities

Return to top of page.

Internal Control Principles

The following describes the Committee's 14 principles for effective internal control.

MANAGEMENT OVERSIGHT AND CONTROL CULTURE

Principle 1 - The Board of Directors is responsible for:

• Approving internal control strategies and policies;

• Understanding the risks the bank is subject to;

• Setting the acceptable level of risk to be taken by the bank;

• Ensuring that senior management takes the necessary steps to identify, monitor and control the risks;

• Approving the organizational structure; and,

• Ensuring that senior management is monitoring the effectiveness of the internal control system.

Return to top of page.

Principle 2 - Senior management is responsible for:

• Implementing the strategies approved by the Board of Directors;

• Establishing appropriate internal control policies; and,

• Monitoring the effectiveness of the internal control system.

Principle 3 - The Board of Directors and senior management are responsible for:

• Promoting high ethical and integrity standards; and,

• Establishing a culture within the organization that emphasizes and demonstrates to all levels of personnel the importance of internal controls.

Return to top of page.

RISK ASSESSMENT

Principle 4 - Senior management is responsible for:

• Identifying and evaluating internal and external factors that could adversely affect the achievement of the bank's objectives.

Principle 5 - Senior management is responsible for:

• Continually evaluating the risks affecting the achievement of the bank's strategies and objectives.

CONTROL ACTIVITIES

Principle 6 - Senior management is responsible for:

• Establishing an appropriate control structure to ensure effective internal controls;

• Establishing control activities at every business level;

• Periodically ensuring that all areas of the bank are in compliance with established policies and procedures; and,

• Ensuring that control activities are an integral part of the daily operations of the bank.

Return to top of page.

Principle 7 - Senior management is responsible for:

• Ensuring that there is appropriate segregation of duties and that personnel are not assigned conflicting responsibilities.

INFORMATION AND COMMUNICATION

Principle 8 - Senior management is responsible for:

• Ensuring adequate and comprehensive internal financial, operational and compliance data; and,

• Ensuring adequate and comprehensive external market information about events and conditions that are relevant to decision making.

Return to top of page.

Principle 9 - Senior management is responsible for:

• Establishing effective channels of communications to ensure that all staff are aware of policies and procedures affecting their duties and responsibilities; and,

• Ensuring that other relevant information is reaching the appropriate personnel.

Principle 10 - Senior management is responsible for:

• Ensuring that there are appropriate information systems in place that cover all activities of the bank; and,

• Ensuring that information systems are secure and periodically tested.

Return to top of page.

MONITORING

Principle 11 - Senior management is responsible for:

• Monitoring the overall effectiveness of the bank's internal controls on an ongoing basis;

• Monitoring key risks on a daily basis; and,

• Evaluating each key risk separately.

Principle 12 - Board of Directors and Senior management are responsible for:

• Ensuring an effective and comprehensive internal audit of the internal control system; and,

• Ensuring that the internal audit function reports directly to the Board of Directors or its audit committee and to senior management.

Return to top of page.

Principle 13 - Senior management is responsible for:

• Ensuring that internal control deficiencies are reported in a timely manner to the appropriate management level and addressed promptly; and,

• Ensuring that material internal control deficiencies should be reported to senior management and the Board of Directors.

EVALUATION OF INTERNAL CONTROL SYSTEMS BY SUPERVISORY AUTHORITIES

Principle 14 - Bank supervisors are responsible for:

• Requiring all banks to have an effective system of internal controls that is consistent with the nature, complexity and risk of the bank's on- and off-balance sheet activities and that responds to changes in the bank's environment and conditions; and,

• Taking appropriate action against banks with inadequate internal control systems to ensure that the internal control system is improved immediately.

Return to top of page.