Risk Based Internal Audit in Banks

1. Risk Based Internal Auditin Banks April 7, 2014

2. Agenda Principles of Risk Based Internal Audit Methodology Risk Assessment Annual Plan Audit Engagement Reporting Benefits of Risk BasedAudit

3. 1. Principles of Risk Based Internal Audit • Risk: The probability of occurring an event having effects on achievement to objectives. • Risk has 4 components: • Event • Effect • Likelihood • Result Risk Management: The process of identification of potential cases, assessment, managing and controlling in order to realize institution’s objectives, for providing acceptable assurance. Risk Assessment Process

4. 1. Principles of Risk Based Internal Audit • Risk Assessment Process • A “risk assessment” is an effort to identify, measure, and prioritize risks organization faces, so that internal audit activities are focused on the auditable areas with the greatest significance. • Through the risk assessment process, it is able to develop a risk-based Internal Audit Plan. • Risk Assessment Goals • Inform senior management and the Board of Directors on risk assessment process. • Get to know your client needs. • Develop a project plan, timeline, and agree upon deliverables. • Provides a framework for assessing and prioritizing risks.

5. 1. Principles of Risk Based Internal Audit • What is risk based internal audit? • The Institute of Internal Auditors defines Risk Based Internal Auditing (RBIA) as: • a methodology that links internal auditing to an organization’s overall risk management framework • that allows internal audit to provide assurance to the board that risk management processes are managing risk effectively, in relation to the risk appetite

6. 2. Methodology

7. 3. Risk Assessment

8. 3. Risk Assessment

9. 3. Risk Assessment Sample Heat Map

10. 4. Annual Plan • Establishing the Risk Based Internal Audit Plan • According to IIA standards, a risk based internal audit plan should satisfy the following issues: • The internal audit activity’s plan of engagements must be based on a documented risk assessment, undertaken at least annually. The input of senior management and the board must be considered in this process. • The chief audit executive must identify and consider the expectations of senior management, the board, and other stakeholders for internal audit opinions and other conclusions. • The chief audit executive should consider accepting proposed consulting engagements based on the engagement’s potential to improve management of risks, add value, and improve the organization’s operations. Accepted engagements must be included in the plan.

11. 4. Annual Plan • InTurkey, regulations of Banking Regulation and Supervision Agency necessitate the following conditionsfor an efficient internal audit system: • Annual risk assessments that consider all business units and operations of the bank shall be made. • An annual audit plan shall be established conveniently to the results of risk assessments. • Annual audit plan shall be approved by the Board.

12. 4. Annual Plan • Annual Audit Plan is determined by evaluation of • Risk matrix, • Risk Matrices of Subsidiaries (If applicable) • Risk level of activities • Risk Indicators & Dynamic Risk Assessment • Contemporary conditions and expectations • Feedbacks of Board of Directors, Audit Committee & Senior Management, etc. SAMPLE AUDIT PLAN PROCESS Regulatory Authority (for information purposes only) Audit Committee (Approval) Board of Directors • (Approval) Internal Audit Department

13. 4. Annual Plan – Sample Risk Assessment Process: Bank Example The Bank’s Risk Matrix Identify Key Risks Define Audit Universe Perform Risk Ranking Audit Plan AUDIT PLAN Audit Period ImportanceLevel* Risk Level of Bank’s Activities Corporate Finance Trading and Sales Retail Banking Credit Extension Deposit Collection and Investment Products Retail Banking Operations Retail Brokerage Commercial Banking Credit Extension Deposit Collection and Investment Products Commercial Banking Operations Payment and Settlement Agency Services Asset Management Mergers and Acquisitions Insurance Services Information Systems Human Resources Legal Proceedings New Technologies Identifyingthe AuditableEntities Risk Indicators Risk Assessment Reports * A risk rating model can be used to define ideal audit periods.A risk rate can be given to each auditable entity from “1-High Risk”to “5-Low Risk”.

14. 4. Annual Plan – Sample Risk Based Annual Plan High (H); Medium (M); Low (L)

15. Financial records, • Operational records, • Record keeping and reporting activities. • Policies for Segregation of Duties • Evaluation of procedures designed against theft, forgery, illegal acts and etc. 5. Audit Engagement • Reliability & Integrity of Information • Safeguarding of Assets Subjects reviewed during the audit engagements vary according to the work performed by those units. According to the model, controls should provide tenable assurance about the following 4 issues. In the audit engagement controls on these issues are tested. • Compliance • Effectiveness & Efficiency of Operations • Policies, • Procedures, • Laws and regulations, • Agreements. • Efficiency of workflows, • Evaluation of capacity usage, • Over/under employment. COSO is a committee composed of 5 professional organizations. This model is preferred and suggested by IIA (Institute of Internal Auditors.).

16. 5. Audit Engagement Specific techniques USED to obtain information Executing the audits Confirmation Interviewing Observation & Inspection Statistical Sampling Detailed Testing Analytical Procedures Recomputing

17. 5. Audit Engagement Sample Audit Plan Sample Working Paper • Risk based audit plans and working papers are prepared in audit engagement. • Contents of these documents that are mentioned below identify the scope of assurance. • Purpose, • Scope, • Analyzing Method, • Sampling Method, • Results

18. 6. Reporting • What is expected by the senior management and the boardfrom internal audit reports? • Compliance of the audited unit to the Law and other legal procedures • Compliance of the audited unit to the internal policies and procedures • Efficiency and effectiveness of processes in the audited unit and possible corrective actions thatmay be taken by the senior management

19. 6. Reporting Internal Audit Reporting Sample

20. 6. Reporting Reporting to the Audit Committee The internal audit function is ultimately reports and is accountable to the Audit Committee. Prior to meeting the Audit Committee, internal audit reports of the audit period are prepared and delivered to the members of the Audit Committee and other concerned parties. Reporting to Senior Management and the Board In IIA standards, reporting levels are explained as follows: The chief audit executive must report periodically to senior management and the board on the internal audit activity’s purpose, authority, responsibility, and performance relative to its plan. Reporting must also include significant risk exposures and control issues, including fraud risks, governance issues, and other matters needed or requested by senior management and the board.

21. 6. Reporting • Monitoring Progress and Communicating the Acceptance of Risks • The chief audit executive must establish and maintain a system to monitor the disposition of results communicated to management. • When the chief audit executive concludes that management has accepted a level of risk that may be unacceptable to the organization, the chief audit executive must discuss the matter with senior management. If the chief audit executive determines that the matter has not been resolved, the chief audit executive must communicate the matter to the board. • The identification of risk accepted by management may be observed through an assurance or consulting engagement, monitoring progress on actions taken by management as a result of prior engagements, or other means. It is not the responsibility of the chief audit executive to resolve the risk.

22. 7. Benefits of Risk BasedAudit

23. Internal Audit Exam Deadlineto Application: April 18th, 2014 ExamDate: April 27th, 2014 ExamLocations: İstanbul Ankara İzmir ExpectedtoHire: 35 People ExpectedDatetoBegin: July 2014 http://garantilikariyer.garanti.com.tr/

24. April 7, 2014 - Istanbul