We believe that effective IT governance process will enable financial institutions to effectively utilize their technologies to meet business' expectations and to add value to their business. In that way, IT will truly help the organizations to improve competitive advantage, customer satisfaction, cost efficiency, and ability to grow and innovate the business. Eventually, it will help financial institutions to realize better return on investment in technology infrastructure. Independent audit and review A financial institution is required to have IT independent audit and review all IT related areas to ensure that the board and management emphasize IT as a key business driver. IT controls are evaluated and those having a material impact on financial processes are specially focused. The assessment of these controls should be conducted on a regular basis. In Thailand, we require financial institutions to perform IT audit at least once a year. In addition, we also require an independent assessment of internet security. Now, let's turn to operational risk. Operational risk Supervisory objective In operational risk supervision, supervisors have to ensure that financial institutions have adequate security measures, data integrity process and contingency plans in place. Supervisory areas The focal point when we evaluate operational risk regarding IT is to ensure a financial institution establish adequate control mechanisms in IT process and procedure. The control can be done either technically or manually, or both. Segregation of duties is an example of manual control which should be maintained especially for critical functions or processes to prevent fraud.

Internet banking in Thailand can be classified into two categories, informational and transactional websites. The informational website provides banking information including products, services, interest rate, foreign exchange rate, etc. On the other hand, the transactional website is a channel for customer transactions such as money transfers and bill payments as well as inquiries such as balance inquiries and statement download. Since internet is ubiquitous and global in nature, it is an open network accessible from unknown sources. Messages are routed through unknown locations. Therefore, internet significantly magnifies the importance of security control and protection against fraud, hacking and other possible internet security threats. A financial institution needs to have a strong authentication process to prove the identity of the person who logs onto the service before any transaction is allowed. Since transaction via internet does not require face-to-face contacts, non-repudiation becomes another major issue as the ability to prove that a customer did request a transaction on service. As supervisors, we need to encourage FIs to implement strong security and control measures as well as provide mechanisms to keep abreast with emerging threats. E-Money, or known otherwise as Multipurpose Stored Value Card, E-Purse, E-Wallet, or Smart Card has three major characteristics. 1. Pre -paid: Consumer pay money in advance to e-money issuer. 2. Store value: Amounts of advance are stored in electronic media such as plastic card. 3.