aspect of sound risk management that did not change during the 1990s is the importance of sound corporate governance. in particular, bank directors and senior managers are responsible for seeing that their banks have effective internal controls, including an internal audit function. effective internal controls ensure the implementation of bank policies and procedures designed to limit and manage risks and otherwise promote sound business practices. for example, internal control procedures that give front - and back - office responsibilities to independent units within the corporation reduce the ability of individuals to hide losses from bank management and thereby reduce operating risk. an internal audit function, in turn, verifies that a bank ’ s internal control procedures function as intended. therefore, another critical aspect of our system of risk - focused supervision is the bank examiners ’ assessment and evaluation of a bank ’ s internal controls and internal audit function. the application of risk - focused supervision in the united states is supported by a strong culture of market discipline. the extent and the content of financial disclosure in the united states have developed markedly over the past few decades through the collective efforts of the corporate sector and government authorities. although recent events have illuminated weaknesses in the accounting and auditing professions in the united states, most knowledgeable observers believe that the quality of information released by most firms in this country continues to be sound. further, the long - standing independence of the regulatory community in the united states has fostered an environment in which banks are expected to correct in a timely fashion and have in most cases corrected deficiencies uncovered during the supervisory process. our supervisory system has successfully changed to the new risk - focused approach, but the transition was difficult in the early stages, particularly for supervisory staff who had long careers in the field. examiners at times struggled with the shift to evaluating risks and risk management systems from making independent valuations of a very large portion of an institution ’ s risk assets. also, some examiners misperceived that risk - focused supervision meant eliminating even a cursory review of lessimportant business lines and transaction testing from the examination process. in fact, we continue to struggle with these issues under our current approach, particularly since the system has not been thoroughly tested under adverse conditions in the banking sector. it is crucial that the new system remain both flexible in view of the rapid evolution of the banking industry and grounded in core supervisory concepts, such as maintaining an adequate control environment - - an issue to which i will return at the end of my remarks. applicability of this system to developing

- time evaluations derived from transaction validation and valuation - oriented banking supervision became insufficient to ensure that banking organizations, particularly large complex banking organizations, were operating in a safe and sound manner. moreover, the increased complexity and volume of financial transactions across the largest institutions began to significantly strain examiner resources. along with financial innovation, the risk management systems of banking organizations also began to evolve around this time because of advances in information technology, which significantly reduced the cost of obtaining and analyzing data and increased the sophistication of risk management models. more sophisticated risk management systems gave banking institutions a more accurate view of their risk - adjusted returns on capital. value - at - risk models were adopted to measure expected losses at given levels of probability, and financial products such as swaps and other derivatives were used to manage interest - rate risk more effectively. on the credit side, where banks already had access to considerable information about their borrowers, more sophisticated risk - modeling techniques complimented management ’ s views on credit risk. these models include credit scoring for consumer lending and kmv models for corporate financing, which estimate option - based pricing models and information contained in stock prices with the probability of default. as a result, the evolution of the industry in the 1990s rendered our traditional point - in - time, transaction validation, and valuation - based supervisory system inadequate. at the same time, the advancements in risk measurement in the industry allowed supervisors, when evaluating bank soundness, to rely more directly on information from banks ’ own internal risk management systems. doing so, however, necessitates testing these systems, and thus our current model of risk - focused supervision was developed. at its core, risk - focused supervision is a relatively simple concept : supervisors are expected to concentrate their efforts on ensuring that financial institutions use the processes necessary to identify, measure, monitor, and control risk exposures. given the risk profile of u. s. banking organizations, risks are divided into six categories : credit, market, liquidity, operational, legal, and reputational. more time has been allocated to the examination planning process, in which supervisory teams assess the most important risks facing the organization and structure their examination activities around assessing and testing the adequacy of it ’ s management of those important risks. thus, in the application of risk - focused supervision in the united states, our examiners verify the adequacy of the banking organization ’ s risk management systems, including whether they have an appropriate degree of transaction testing. one