Mr. Carse gives a banking supervisor’s perspective on control issues in financial institutions Speech by the Deputy Chief Executive of the Hong Kong Monetary Authority, Mr. David Carse, at the BanComp ’98 conference in Hong Kong on 25/5/98. I am pleased to be here this morning to speak to you at the start of this conference on internal controls and anti-money laundering. The advertised title of my speech is “Understanding the role and needs of the regulator in all authorised financial institutions”. This is a very broad subject and I have therefore narrowed it down to focus on the banking supervisor’s perspective on control issues in financial institutions. I am sure there are many compliance and audit professionals in the audience today, so I trust I should not have too hard a hard job persuading you that good internal controls are not only important, but crucial to the success of financial institutions. Just consider, for example, what poor internal controls did for BCCI, Daiwa Bank and Barings. So what advice can I offer you today to help you ensure that your institution will not meet the same fate? Well, what I will do is to share with you my thoughts on the key elements of a financial institution’s control systems, and highlight some of the areas where other institutions have gone horribly wrong. I will also talk about one of the key areas of a financial institution’s controls its controls against being used for money laundering. So let me start by giving you a banking supervisor’s view of internal controls. But first, what exactly do we mean by “internal controls”? The definition I would suggest, which is borrowed from the Basle Committee on Banking Supervision, is that internal controls refers to the ongoing process by which the Board of Directors and management of an institution ensure that the institution meets three key sets of objectives. First, operational objectives - the efficiency and effectiveness of the institution in using its assets and other resources and in protecting the institution from loss. Second, information objectives - the reliability and completeness of financial and management information needed for decision-making within the institution and for regulatory and other external uses. Third, compliance objectives - compliance with applicable laws and regulations, supervisory requirements, and internal policies and procedures, in order to protect the institution’s franchise and reputation. What, then, are the main elements of the sort of control systems needed to achieve these objectives? Basically, there are five inter-related elements: management oversight and the control culture; risk assessment; control activities; information and communication; and monitoring activities. The Basle Committee on Banking Supervision has recently put all this together into a set of fourteen principles for regulators to use in evaluating institution’s internal control systems. I do not propose to run through these one by one, but I would like to pick out one or two points so as to give you an idea of what I, as a regulator, see as the key ideas. First, on management oversight and the control culture, the starting point is that the Board of Directors need to understand the risks run by the institution, to set the acceptable limits on these risks, and to ensure that senior management takes the steps necessary to identify, monitor and control these risks. Senior management must then take the responsibility to implement the strategies approved by the Board, to set appropriate internal control procedures, and to monitor the effectiveness of these procedures. This makes it quite clear where the main responsibility for controls rests - and that is fairly and squarely on the shoulders of the institution’s Board of Directors and its senior management, not just on its compliance and audit departments. However, having said that, everyone in an institution shares the responsibility to some extent. A key task for the Board and senior management is to establish the right culture within the institution, a culture in which the importance of internal controls is stressed, and high ethical and integrity standards are promoted. This culture will be determined not simply by what the top levels of management say but what they do. For example, do the institution’s remuneration policies reward risk-taking at the expense of prudence? Does senior management display a casual attitude towards breaches of limits? Do they encourage the right attitude towards regulatory compliance? Is there backing and respect at senior levels for the internal audit and compliance functions? The response of the senior levels of the organisation to these kind of issues will determine how personnel lower down actually behave in practice, including their attitude to control issues. Moving on to risk assessment, the important thing is to identify and evaluate every factor that could adversely affect the achievement of the institution’s objectives. This means not just the familiar risks of credit risk and liquidity risk, but also risks such as operational risk, interest rate risk, market risk, country and transfer risk, legal risk and reputational risk. And this needs to be an ongoing process, continually re-evaluating the risks and reviewing the control systems to address these risks. Regarding control activities, the point I would stress is that control activities need to be an integral part of the daily operations of an institution. Examples of this include: top level reviews of performance and risk exposure; appropriate activity controls that monitor performance and exceptions at the departmental or divisional level; segregation of duties; physical controls on access to assets; periodic checking for compliance with exposure limits; a system of approvals and authorisations for transactions over certain limits; and a system of verification and reconciliation of transaction details and activities. The objective should be to ensure that all areas of the institution are continually in compliance with established policies and procedures. On information and communication, it should be self-evident that an institution needs comprehensive and timely financial, operational and compliance data, and so needs to have good information systems. But having the information is only the first step. Equally important is the second step, that the information should get to the right people at the right time. Finally, on monitoring, it cannot be overstressed that that monitoring of the effectiveness of an institution’s internal controls should be a continual and ongoing process, and that monitoring of key risks should be an integral part of the daily operations of the institution. Effective and independent internal audit and compliance functions have an important role to play here. This requires these functions to have direct access to senior levels of the organisation so that potential criticisms of systems or transactions cannot be blocked by the line management concerned. These, then, are what I would regard as the key elements of a financial institution’s internal controls. As regards how these are applied to individual institutions, my expectation as a banking supervisor is that any financial institution, regardless of size, should have an effective system of internal controls that is consistent with the nature, complexity, and risk of its activities and that responds to changes in the institution’s environment and conditions. I am not saying that I expect every institution to be using state-of-the-art risk management and control techniques. But what I do expect is that every institution should have control systems that adhere to the basic principles I have just discussed, and which are as state-of-the-art as they need to be given that particular institution’s activities. I also expect these systems to be kept under review as things change. Let me now move on to discuss some of the things that can go wrong when controls break down. I will not go into particular case studies, but will try instead to draw together some of the common threads of recent problem bank cases. The Basle Committee paper that I mentioned earlier suggests five such common threads, and I will draw on this in the following remarks. The first, which I have mentioned already, is lack of adequate management oversight and accountability, and failure to develop a strong control culture within the institution. Without exception, a common feature of recent problem bank cases has been management inattention to, and laxity in, the control culture of the institution, insufficient guidance and oversight by the Board of Directors and senior management, and a lack of clear management accountability through the assignment of roles and responsibilities. These cases also reflect insufficient incentives to carry out strong line supervision and maintain a high level of control consciousness within business areas. The second thread is inadequate assessment of the risk of certain banking activities, whether on or off balance sheet. Many banking organisations that have suffered major losses neglected to continually assess the risks of new products and activities, or update their risk assessments when significant changes occurred in the environment or business conditions. Many recent cases highlight the fact that control systems that function well for traditional or simple products are unable to handle more sophisticated or complex products. The third thread is the absence or failure of key control activities, such as segregation of duties, approvals, verifications, reconciliations, and reviews of operating performance. Lack of segregation of duties in particular has played a major role in the significant losses that have occurred at banks. The fourth thread is inadequate communication of information between levels of management within the bank, especially in the upward communication of problems. To be effective, policies and procedures need to be effectively communicated to all personnel involved in an activity. Some losses in banks occurred because relevant personnel were not aware of or did not understand the bank’s policies. In several instances, information about inappropriate activities that should have been reported upward through organisational levels was not communicated to the Board of Directors or senior management until the problems became severe. In other instances, information in management reports was not complete or accurate, creating a favourable impression of a business situation that was in fact problematic. The fifth and final thread is inadequate or ineffective audit programs and other monitoring activities. In many cases, audits were not sufficiently rigorous to identify and report the control weaknesses associated with problem banks. In other cases, even though auditors reported problems, they were not corrected by management. From these common threads, it should now be clear why, in the first part of my remarks today, I stressed the things I did - management oversight and control culture, risk assessment, control activities and monitoring, and information and communication. These are the areas that institutions need to focus on to avoid becoming a “problem bank case” themselves. Let me move on now to consider the role of the banking supervisor in ensuring that an institution’s internal controls are adequate and effective. This is an area on which there has been greatly increased emphasis in recent years. Of course supervisors, like the management of financial institutions, have always been concerned with the quality of control systems. However, the approach has been rather piecemeal, and has focused on certain types of risk which are easily quantifiable, rather than the more intangible types of risk. What we are trying to do nowadays is to move towards a more systematic identification and assessment of the risks facing a bank across the whole range of its activities and the adequacy of the controls over these risks. This “risk-based” approach is intended to focus our attention on what we see as the institution’s key risk areas. Of course, the correct identification of the institution’s key risk areas is crucial in this. For most of Hong Kong’s local banks, credit risk, liquidity risk and perhaps reputational risk remain the highest risk areas, but for individual institutions other forms of risk such as interest rate risk and market risk also come into the equation. If an institution engages in types of business that we regard as being at the higher end of the risk scale, such as share margin financing or lending for property development, this will also attract our attention. Other things that will attract our attention include major changes in the operating environment, including new technology; areas or activities which are experiencing rapid growth; the introduction of new lines of business, products or activities; and domestic and foreign acquisitions. In each case we would want to be assured that any necessary enhancements to the control environment have been made so as to reduce the chance of adverse and unforeseen effects on the institution. Different risk areas require different approaches, but essentially our approach is to start by reviewing the written policies and procedures setting down the controls over a particular area, and then to look at how the controls work in practice. This may involve a combination of reviews of documentation, discussions with staff, and some testing of transactions. The end-result will be a judgement as to whether we believe the controls are effective or need improvement. If improvement is needed we will discuss our recommendations with the management and agree an action plan and time-scale for the remedial action. This may sound to you quite similar in some respects to the work of an institution’s internal audit department and external auditors. I would agree that there are certainly some common features, and indeed we would usually review as part of our own work the work done by the audit department on identifying areas of potential risk and control problems. Similarly, external auditors’ observations and recommendations are often very useful to us in coming to a judgement on the effectiveness of an institution’s internal controls. However, to supervise an institution effectively a supervisor needs, in my opinion, a means of independently verifying that internal controls are sound and that all substantive risks have been identified and considered. For this reason, our ongoing dialogue with institutions, and our periodic on-site examinations of institutions’ activities, are invaluable. I believe this oversight can also be beneficial in a practical way to the institution itself. For example, we may have insights that the institution does not. We may be able to give an institution feedback on how it compares vis-à-vis its peers in similar areas and to indicate respects in which, from our experience, its controls and risk management processes are falling behind the game. I would not want to overplay this “management consultant” type role, but I think it can be beneficial, perhaps especially to the smaller, less sophisticated financial institutions. Of course, this presupposes that we have the necessary expertise to offer useful advice. This is a constant challenge in today’s environment of rapid technological change and product innovation. We have therefore tried to develop our own treasury and securities specialists whose task it is to review and assess more leading-edge and sophisticated areas such as value at risk and treasury and derivatives risk management. Let me move on now to the subject of the prevention of money laundering. This is a key concern for the supervisors of all major international financial centres, and is something that should be high on the agenda for the management of every financial institution. Here in Hong Kong considerable time and effort has been put in over a period of years into ensuring that the banking system follows best international practice on the prevention of money laundering. Principally, this means following the recommendations of the Basle Committee on Banking Supervision and the Financial Action Task Force, whose guidance notes on the prevention of money laundering we have used to develop our own detailed Guidelines to institutions. The basic thrust of these Guidelines is to provide that institutions should have in place adequate and effective policies, procedures and controls to combat money laundering, covering essential areas such as procedures for account opening, customer identification and record keeping as well as proper systems for reporting suspicious transactions and training of staff. Please be in no doubt as to how seriously we regard adherence to these Guidelines. The reason for this is simple. To paraphrase the health warning on a packet of cigarettes, “Money laundering can seriously damage your health”. Being associated with money laundering can seriously undermine confidence in an individual financial institution and potentially in a financial system as a whole. We are presently seeing this demonstrated in the case of the Mexican banking system, which is embroiled in a money-laundering scandal. So what steps can a banking supervisor take to ensure that institutions are doing everything they can to protect themselves from being used for money laundering? The first thing is to make sure that the Guidelines issued to institutions are kept up-to-date as techniques and patterns of money laundering evolve, and to ensure that institutions revise their own internal guidelines accordingly. We have recently revised our Guidelines and issued them as a convenient booklet. I am pleased to say that demand for this has been high and we have issued over 5000 copies of the booklet. However, Guidelines need to be put into practice. To ensure that senior management are focused on the need for this, money-laundering controls are a regular agenda item for our prudential meetings with management. They are also a regular topic for our on-site examinations. During these examinations we review an institution’s policies and procedures, look at their records of suspicious transactions, and interview staff at random to check that they have been trained to identify suspicious transactions and to follow the appropriate procedures for account opening and customer identification. We may also commission external auditors’ reports if we think it necessary. So how do institutions in Hong Kong rate on combating money laundering? Perhaps the best indicator of their vigilance against money laundering is the number of reports of suspicious transactions made to the Joint Financial Intelligence Unit (JFIU). These numbers suggest that institutions are certainly improving, as both the number of reports, and the number of institutions making reports, has been increasing over time. The number of reports made to the JFIU rose from only 264 in 1992 to 4210 in 1997. Our own on-site examinations also suggest that the level of awareness, and the training of staff, is improving. So, overall, institutions are doing well. However, there is always room for improvement, and I would urge those with responsibility for this area not to relax their guard. This brings me to my concluding remarks. I started out today by talking about the important elements of a control system, and how banking supervisors assess the effectiveness of institutions’ controls. I discussed some of the common threads of recent “problem bank” cases, and the control issues they highlighted. Finally, I stressed the importance of controls in the area of money laundering prevention. While I hope this was of interest to you, and at least gave you a slightly different perspective on some familiar issues, I think I should end by saying that I certainly lay no claim to having all the answers. Please do not sit back and expect the banking supervisors to issue guidelines telling you exactly what you need to do. While I hope my advice may be of some help, the responsibility for ensuring that your institution has the right controls and the right culture is yours. So I hope this conference provides you with some useful, practical ideas for improving your institutions’ controls when you return to work.