Action point/ risk management area

Details of implementation

Action point/ risk management area

Time frame for implementation

Details of steps taken during the last quarter
(If no progress during the quarter, the same to be specified)

Details of measures proposed to be taken to adhere to the time frame

Action Points

Progress made upto the quarter-end

Remaining Gaps

1. Put in place a institutional mechanism to direct and monitor the progress in implementation of risk based supervision :

(a) setting up Risk Management Architecture

(b) adoption of Risk Based Internal Audit,

(c) strengthening of Management Information System and Information Technology

(d) addressing HRD issues and,

(e) setting up of Compliance Units to monitor regulatory and supervisory compliance.

2. Name & designation of the officer who is the head of the above institutional mechanism.

3. Are the institutional mechanisms set up to attend to the requirements of RBS kept separate and distinct from the institutional mechanism attending to risk management functions.

4. Whether Quarterly review reports on RBS placed before the Board of Directors along with progress report on risk management systems.

5. Action/ steps taken for building up of an inventory of skilled and trained personnel to attend to risk management and RBS functions.

6. Persons trained in risk management, risk based supervision and risk focused internal audit should be positioned in appropriate places.

6.1 Arrangements for maintaining data base on training and placement of officials to be indicated.

Action Points

Progress achieved Upto the quarter-end

Remaining gaps

1. Strategy for implementation of RBI guidelines

1. Whether a Task Force comprising senior executives with the responsibility of chalking out an action plan for switching over to risk-based internal audit has been constituted.

• (a) Whether Task Force has identified transitional and change management issues (b) steps initiated to address the above and (c) periodicity of reporting to the Board of directors and the date of last reporting.

• Policy for risk-based internal audit

1. Whether a well-defined policy, duly approved by the Board, for undertaking risk-based internal audit has been adopted.
2. The policy should include (i) the risk assessment methodology for identifying the risk areas based on which the audit plan would be formulated (ii) the maximum time period beyond which even the low risk business activities/ locations should not remain unaudited.

• Functional independence

1. The Internal Audit Department (IAD) should be independent from the internal control process and should not be assigned the responsibility of performing other accounting or operational functions.
2. The date of latest reporting by the IAD to the Board /Audit Committee.

• Risk assessment

1. Whether business risks and control risks are evaluated and classified into low, medium and high categories.

• Whether a risk-matrix is drawn up for each business activity/location, taking into account both the above factors.

• An analysis of business risks and control risks should be done to assess the trend (stable, increasing or decreasing).

• Whether IAD has devised the risk assessment methodology incorporating size and complexity of the business with approval of the Board.

• What is the mechanism stipulated for keeping the internal audit function informed of all developments such as introduction of new products, changes in reporting lines, changes in accounting practices/policies etc.

• Is the risk assessment undertaken on a yearly basis.

• Is the risk assessment updated periodically, taking into account changes in business environment, activities etc. Date of last review.

• Had an independent risk assessment system instituted/ set up in the IAD.

• Audit Plan

1. The annual audit plan, approved by the Board, should include the schedule and the rationale for audit work planned.
2. The plan should include all risk areas and their prioritization based on the level and direction of risk.

• Scope

1. Whether the bank is preparing the Risk Audit Matrix ? If so, whether it is being used for prioritizing the audit work to give greater attention to areas mentioned in the risk-based internal audit guidelines (para 6.1 of the guidelines)?
2. The scope of risk-based internal audit should be determined for different risk levels such as low, medium, high, very high and extremely high and should, at the minimum, review/report the following aspects:

•  

   

   

   

   

   

   

   

   

   

   

   

   

   

   

   

  • process by which risks are identified and managed in various areas;
  • the control environment in various areas;
  • gaps, if any, in control mechanism which might lead to frauds, identification of fraud prone areas;
  • data integrity, reliability and integrity of MIS;
  • internal, regulatory and statutory compliance;
  • budgetary control and performance reviews;
  • transaction testing/verification of assets to the extent considered necessary
  • monitoring compliance with the risk-based internal audit report

•  

  • variation, if any, in the assessment of risks under the audit plan vis-à-vis the risk-based internal audit.

1.  

    

    

   1. The risk-based internal audit report should include comments on proper recording and reporting of major exceptions and excesses.
   2. Whether the bank has framed a policy with regard to the level of transaction testing in respect of the various levels and trends of risk?

• The scope of risk-based internal audit should include:

• a review of the systems in place for ensuring compliance with money laundering controls.
• identification of potential inherent business risks and control risks.

1. Communication

1. All serious deficiencies/ sensitive findings identified by risk-based internal audit staff should be reported to the appropriate level of management immediately.
2. All significant issues posing a threat to the bank’s business should be promptly brought to the notice of the Board / Audit Committee / top management.

• Performance evaluation

1. The IAD should conduct periodical reviews, annually or more frequently, of the risk-based internal audit undertaken by it vis-à-vis the approved audit plan. The performance review should include an evaluation of the effectiveness of risk-based internal audit in mitigating identified risks.
2. The Board /Audit Committee should periodically assess the performance of the risk-based internal audit (Date of last review).

• Audit resources

1. The IAD should be provided with appropriate resources and staff with requisite skills.
2. What are the arrangements in place for training staff periodically?

• Outsourced internal audit arrangements

1. Does the contract governing outsourcing of internal audit specify-

• the scope and frequency of work to be performed by the vendor
• the manner and frequency of reporting to the bank
• the manner of determining the cost of damages arising from errors, omissions and negligence on the part of the vendor
• the arrangements for incorporation of changes in the terms of contract, should the need arise
• the procedure/locations for safe keeping the work papers
• all work papers should be available to the bank when required
• the employees authorized by the bank have reasonable and timely access to the work papers
• the supervisors are to be granted immediate and full access to related work papers

1.  

    

    

   1. Is the work done by the vendor documented and reported to the top management through the IAD.
   2. Whether a contingency plan to mitigate any discontinuity in audit coverage on account of a sudden termination of the outsourcing arrangement drawn up.