Such efforts would therefore need to be implemented within the agenda of the overall financial sector development programme in the individual countries. It is within this context that Malaysia has chosen to adopt a flexible timeframe, underpinned by four key implementation principles: •  First, for capacity building measures to be implemented;  •  Second, within these capacity building efforts, the emphasis on the enhancement of the risk management framework for all banking institutions;  •  Third, to emphasise on strong business justification instead of regulatory mandate in the adoption of the more advanced approaches; and  •  Finally, to enhance the supervisory methodology to assess the internal models and the advanced risk management systems. The rigorousness of the analytical process under Basel II will certainly be demanding for banking institutions. It is equally demanding from the supervisory perspective to develop an appropriate response and assessment framework on these processes. Instead of over focus on validating the detailed quantitative and statistical procedures, supervisory attention would need to ensure that the analytical processes are undertaken to support decision making, and not merely to meet regulatory  expectations. Supervisors also need to undergo early training to identify the relevant issues when undertaking the supervisory assessment. This underscores, the importance of efforts to accelerate supervisory capacity building efforts, particularly in the development of specialised supervisory skills to conduct model validation.
If an institution engages in types of business that we regard as being at the higher end of the risk scale, such as share margin financing or lending for property development, this will also attract our attention. Other things that will attract our attention include major changes in the operating environment, including new technology; areas or activities which are experiencing rapid growth; the introduction of new lines of business, products or activities; and domestic and foreign acquisitions. In each case we would want to be assured that any necessary enhancements to the control environment have been made so as to reduce the chance of adverse and unforeseen effects on the institution. Different risk areas require different approaches, but essentially our approach is to start by reviewing the written policies and procedures setting down the controls over a particular area, and then to look at how the controls work in practice. This may involve a combination of reviews of documentation, discussions with staff, and some testing of transactions. The end-result will be a judgement as to whether we believe the controls are effective or need improvement. If improvement is needed we will discuss our recommendations with the management and agree an action plan and time-scale for the remedial action. This may sound to you quite similar in some respects to the work of an institution’s internal audit department and external auditors.