The response of the senior levels of the organisation to these kind of issues will determine how personnel lower down actually behave in practice, including their attitude to control issues. Moving on to risk assessment, the important thing is to identify and evaluate every factor that could adversely affect the achievement of the institution’s objectives. This means not just the familiar risks of credit risk and liquidity risk, but also risks such as operational risk, interest rate risk, market risk, country and transfer risk, legal risk and reputational risk. And this needs to be an ongoing process, continually re-evaluating the risks and reviewing the control systems to address these risks. Regarding control activities, the point I would stress is that control activities need to be an integral part of the daily operations of an institution. Examples of this include: top level reviews of performance and risk exposure; appropriate activity controls that monitor performance and exceptions at the departmental or divisional level; segregation of duties; physical controls on access to assets; periodic checking for compliance with exposure limits; a system of approvals and authorisations for transactions over certain limits; and a system of verification and reconciliation of transaction details and activities. The objective should be to ensure that all areas of the institution are continually in compliance with established policies and procedures. On information and communication, it should be self-evident that an institution needs comprehensive and timely financial, operational and compliance data, and so needs to have good information systems.
The third thread is the absence or failure of key control activities, such as segregation of duties, approvals, verifications, reconciliations, and reviews of operating performance. Lack of segregation of duties in particular has played a major role in the significant losses that have occurred at banks. The fourth thread is inadequate communication of information between levels of management within the bank, especially in the upward communication of problems. To be effective, policies and procedures need to be effectively communicated to all personnel involved in an activity. Some losses in banks occurred because relevant personnel were not aware of or did not understand the bank’s policies. In several instances, information about inappropriate activities that should have been reported upward through organisational levels was not communicated to the Board of Directors or senior management until the problems became severe. In other instances, information in management reports was not complete or accurate, creating a favourable impression of a business situation that was in fact problematic. The fifth and final thread is inadequate or ineffective audit programs and other monitoring activities. In many cases, audits were not sufficiently rigorous to identify and report the control weaknesses associated with problem banks. In other cases, even though auditors reported problems, they were not corrected by management. From these common threads, it should now be clear why, in the first part of my remarks today, I stressed the things I did - management oversight and control culture, risk assessment, control activities and monitoring, and information and communication.