##le committee paper that i mentioned earlier suggests five such common threads, and i will draw on this in the following remarks. the first, which i have mentioned already, is lack of adequate management oversight and accountability, and failure to develop a strong control culture within the institution. without exception, a common feature of recent problem bank cases has been management inattention to, and laxity in, the control culture of the institution, insufficient guidance and oversight by the board of directors and senior management, and a lack of clear management accountability through the assignment of roles and responsibilities. these cases also reflect insufficient incentives to carry out strong line supervision and maintain a high level of control consciousness within business areas. the second thread is inadequate assessment of the risk of certain banking activities, whether on or off balance sheet. many banking organisations that have suffered major losses neglected to continually assess the risks of new products and activities, or update their risk assessments when significant changes occurred in the environment or business conditions. many recent cases highlight the fact that control systems that function well for traditional or simple products are unable to handle more sophisticated or complex products. the third thread is the absence or failure of key control activities, such as segregation of duties, approvals, verifications, reconciliations, and reviews of operating performance. lack of segregation of duties in particular has played a major role in the significant losses that have occurred at banks. the fourth thread is inadequate communication of information between levels of management within the bank, especially in the upward communication of problems. to be effective, policies and procedures need to be effectively communicated to all personnel involved in an activity. some losses in banks occurred because relevant personnel were not aware of or did not understand the bank ’ s policies. in several instances, information about inappropriate activities that should have been reported upward through organisational levels was not communicated to the board of directors or senior management until the problems became severe. in other instances, information in management reports was not complete or accurate, creating a favourable impression of a business situation that was in fact problematic. the fifth and final thread is inadequate or ineffective audit programs and other monitoring activities. in many cases, audits were not sufficiently rigorous to identify and report the control weaknesses associated with problem banks. in other cases, even though auditors reported problems, they were not corrected by management. from these common threads, it should now be clear why, in the first part of my remarks today, i stressed the things i did - management oversight and control culture, risk assessment, control

risk assessment ; control activities ; information and communication ; and monitoring activities. the basle committee on banking supervision has recently put all this together into a set of fourteen principles for regulators to use in evaluating institution ’ s internal control systems. i do not propose to run through these one by one, but i would like to pick out one or two points so as to give you an idea of what i, as a regulator, see as the key ideas. first, on management oversight and the control culture, the starting point is that the board of directors need to understand the risks run by the institution, to set the acceptable limits on these risks, and to ensure that senior management takes the steps necessary to identify, monitor and control these risks. senior management must then take the responsibility to implement the strategies approved by the board, to set appropriate internal control procedures, and to monitor the effectiveness of these procedures. this makes it quite clear where the main responsibility for controls rests - and that is fairly and squarely on the shoulders of the institution ’ s board of directors and its senior management, not just on its compliance and audit departments. however, having said that, everyone in an institution shares the responsibility to some extent. a key task for the board and senior management is to establish the right culture within the institution, a culture in which the importance of internal controls is stressed, and high ethical and integrity standards are promoted. this culture will be determined not simply by what the top levels of management say but what they do. for example, do the institution ’ s remuneration policies reward risk - taking at the expense of prudence? does senior management display a casual attitude towards breaches of limits? do they encourage the right attitude towards regulatory compliance? is there backing and respect at senior levels for the internal audit and compliance functions? the response of the senior levels of the organisation to these kind of issues will determine how personnel lower down actually behave in practice, including their attitude to control issues. moving on to risk assessment, the important thing is to identify and evaluate every factor that could adversely affect the achievement of the institution ’ s objectives. this means not just the familiar risks of credit risk and liquidity risk, but also risks such as operational risk, interest rate risk, market risk, country and transfer risk, legal risk and reputational risk. and this needs to be an ongoing process, continually re - evaluating the risks and reviewing the control systems to address these risks. regarding control activities, the point i would