Central Bank of The Bahamas Guidance on Accounting Records and Internal Control Systems

The Central Bank of The Bahamas Accounting and Other Records Systems GUIDANCE NOTE ON ACCOUNTING AND OTHER RECORDS AND INTERNAL CONTROL SYSTEMS AND REPORTING ACCOUNTANTS’ REPORTS THEREON

1. PREFACE
   1.1 The maintenance of adequate records and systems is an implicit requirement for continued
   licensing under Section 8 of the Banks and Trust Companies Act (Chapter 287) (hereafter referred to as “the Law”)
   1.2 Further, licensed institutions should maintain adequate accounting and other records and
   internal control systems to ensure that directors and management have complete, accurate and timely information to enable them to make returns to the Bank Supervision Department (hereafter referred to as “the Department) in a proper and prompt fashion and to enable them to furnish the Department with any other information which it might require.
   1.3 The purpose of this Notice is to provide guidance on the Department’s requirements in
   relation to records and systems, to assist licensees to assess whether they meet those requirements, and to assist reporting accountants commissioned by the licensee upon direction by the Department, to report on the records and systems of institutions. The guidance is intended to be:
   a) sufficiently comprehensive to encompass the wide range of activities undertaken by both Bahamas incorporated and overseas incorporated licensees, and b) relevant to the circumstances of both large and small institutions which undertake transactions of varying degrees of volume and complexity.
   1.4 It is the responsibility of a licensee’s directors and management to ensure that adequate
   records and systems are maintained and the responsibility of the Department to judge whether the criteria for continued licensing pertaining to those records and systems is satisfied.
   1.5 The Department will rarely find it appropriate to prescribe in detail the manner in which a
   particular institution should maintain its accounting and other records and internal control systems. Rather, this Notice emphasizes the scope and nature of the internal control systems and the purpose for which they are established by management.
   1.6 The requirement for adequate accounting and other records and internal control systems
   to be maintained applies only to institutions licensed under the Law; it does not apply to subsidiary or associated companies of a licensed institution which are not themselves licensed. Nevertheless, licensees should have adequate records and systems to manage and control their investments in subsidiary and associated companies. This requirement also applies to overseas branches of Bahamas incorporated licensees and to Bahamas branches of overseas incorporated licensees.
   1.7 This guidance is intended to encompass all aspects of an institution’s business whether on
   or off-balance sheet, whether undertaken as principal or as agent and regardless of whether any part of the business is supervised by another regulator. BANK SUPERVISION DEPARTMENT March 2000 1

The Central Bank of The Bahamas Accounting and Other Records Systems
2. ACCOUNTING AND OTHER RECORDS
2.1 INTRODUCTION
2.1.1 The scope and nature of the accounting and other records which are required for the
business to be conducted in a prudent manner should be commensurate with an institution’s needs and particular circumstances and should have regard to the manner in which the business is structured, organized and managed, to its size and the nature, volume and complexity of its transactions and commitments. The accounting and other records should assist management to conduct the business of the institution in a prudent manner on a day-to-day basis.
2.2 GENERAL REQUIREMENTS
2.2.1 It is appropriate to prepare a comprehensive list of the accounting and other records which
an institution should maintain. However, the accounting and other records should:- a) capture and record on a timely basis and in an orderly fashion every transaction or commitment which the institution enters into with sufficient information to explain:-

• its nature and purpose.
• any asset and/or liability, actual and contingent, which respectively
  arises or may arise from it, and
• any income and/or expenditure, current and/or deferred which arises
  from it. b) provide details as appropriate for each transaction and commitment, showing:-
• the parties including, in the case of a loan advance or other credit
  exposure, whether and if so to whom it is sub-participated.
• the amount and currency.
• the contract, rollover, value and settlement or repayment dates.
• the contracted interest rates of an interest rate transaction or
  commitment.
• the contracted exchange rates of a foreign exchange transaction or
  commitment.
• the contracted commission or fee payable or receivable together with
  any other related payment or receipt.
• the nature and estimated value of any security for a loan or other
  exposure, the physical location and documentary evidence of such security; and BANK SUPERVISION DEPARTMENT March 2000 2

The Central Bank of The Bahamas Accounting and Other Records Systems

• in the case of any borrowing, whether it is subordinated and, if
  secured, the nature and book value of any asset upon which it is secured. c) be maintained in such a manner that financial and business information can be extracted promptly to enable management to:-
• monitor the quality of and safeguard the institution’s assets.
• identify, quantify, control and manage its risk exposures.
• monitor the performance of all aspects of its business on an up to
  date basis; and
• make timely and informed decisions.
  d) Contain details of exposure limits authorised by management which are appropriate to the type, nature and volume of business undertaken. These limits should, where relevant, include counterpart industry sector, country, settlement, liquidity, interest rate mismatch and securities position limits as well as limits on the level of intra-day and overnight trading positions in foreign exchange, futures, options, future (or forward) rate agreements (FRAs) and swaps, and provide information which can be summarised in such a way as to enable actual exposures to be readily, accurately and regularly measured against these limits; and e) provide on a memorandum basis details of every transaction entered into in the name of or on behalf of another party on an agency or fiduciary (trustee) basis where it is agreed that the institution itself is not legally or contractually bound by the transaction.
  2.2.2 A licensee should also maintain such other records as are required to enable its directors
  and management to conduct its business in a prudent manner on a day-to-day basis. The nature and extent of these records will vary from one institution to another but typically they will include:- a) a statement of corporate objectives, a medium-term strategic plan, a shorter term financial plan and an operating budget. b) procedures and controls manuals. c) correspondence files, internal memoranda and minutes of internal and external meetings. d) a register of current and past authorised signatures. e) a register of depositors’ specimen signatures. f) evidence of authorisation to commit the institution to an exposure or capital expenditure. g) comprehensive and detailed files for loans, advances and other credit exposures. h) completed dealing slips or tickets, counterparty, confirmations, nostro bank account statements, nostro account reconciliations and computer input vouchers. i) a fixed asset register. BANK SUPERVISION DEPARTMENT March 2000 3

The Central Bank of The Bahamas Accounting and Other Records Systems j) registers containing details of negotiable instruments held in the name of the institution, held on behalf of customers or borrowed from other parties and details of such instruments lent to other parties. k) suppliers’ invoices, and l) tape recordings of dealers’ telephone conversations. This list is not exhaustive but gives an indication of the type of records which may be necessary for the orderly management of an institution’s business.
2.3 INFORMATION FOR MANAGEMENT
2.3.1 Every institution should prepare information for directors and management so that they can
monitor, assess and control the performance of its business, the state of its affairs and the risks to which it is exposed. This information should be prepared on an individual company and, where appropriate, on a consolidated basis. The frequency with which information is prepare, its level of detail and the amount of narrative analysis and explanation will depend upon the level of management to which it is addressed. Some types of information will be needed on a more frequent basis than others and it may be appropriate for some to be presented on a basis of exceptions from agreed limits by way of exception reports.
2.3.2 It is the responsibility of directors and management to decide what information is required
and to decide who should receive it. Appropriate management information should be provided to:-

• persons responsible for exercising managerial functions or for
  maintaining accounting and others records.
• executives who either alone or jointly are responsible under the
  immediate authority of the directors for the conduct of the business of the institution, and
• the directors of the institution.
  This information should be prepared -
• to show the state of affairs of the institution.
• to show the operational results of the business both on a cumulative
  basis and by discrete period and to give a comparison with budgets and previous periods.
• to provide an analysis of its off-balance sheet positions showing how
  they have been valued, and
• to provide an analysis of income and expenditure showing how it
  relates to different categories of asset and liability and off-balance sheet positions.
  2.3.3 The type of management information which are consistent with the requirements in
  paragraph 2.3.2 above include:
  a) a balance sheet and profit and loss account prepared on a regular (but at least monthly) basis in accordance with the institution’s accounting policies. BANK SUPERVISION DEPARTMENT March 2000 4

The Central Bank of The Bahamas Accounting and Other Records Systems b) a listing or summary providing the cost and current valuation of assets held for dealing purposes and a list or summary of purchased sales of dealing assets showing respectively details of the cost of purchase and the profit or loss on sale. c) a listing or summary providing the cost and, where appropriate, the redemption value of assets held for the long term or until maturity. d) a listing or summary of credit exposures, analysed by sector, country or by other criteria as appropriate to the nature of the business undertaken by the institution. e) a record of overdue, out-of-order or rescheduled loans and advances, positions and receivables including those in excess of limits and those upon which due interest has not been received, the level of provision against such assets including the basis upon which each provision has been arrived at. f) a listing of summary of accruals of interest receivable and payable with an indication of the loans and deposits or categories of loans and deposits to which the accruals relate. g) a listing or summary and a valuation of spot and forward foreign exchange transactions. h) a comprehensive statement and, where appropriate, a valuation of outstanding off-balance sheet transactions, commitments and contingencies including futures, options, FRAs and swaps. i) an analysis of currency mismatches whether arising from loans and deposits or from off-balance sheet rights and obligations. j) an analysis of currency mismatches showing by currency, assets and liabilities, including off-balance sheet rights and obligations, recorded in the reporting currency at a specified rate of exchange. k) a sensitivity analysis showing, as appropriate, the effect of movements in exchange rates, interest rates and dealing asset prices on the value of on and off-balance sheet foreign exchange, interest rate, and dealing asset positions. l) a detailed analysis of assets and liabilities, including off-balance sheet rights and obligations, due to mature within a period identified by management as being short term. m) a complete maturity analysis of assets and liabilities, including off-balance sheet rights and obligations. n) a listing or summary of all large exposures, including connected lending, in accordance with the Department’s large exposures policy, and o) trend analysis of key financial and management information. 3 INTERNAL CONTROL SYSTEMS
3.1 INTRODUCTION
3.1.1 The scope and nature of effective control systems should take account of the size of the
business, the diversity of operations, the volume and size of transactions, the degree of risk associated with each area of operation, the amount of control by senior management BANK SUPERVISION DEPARTMENT March 2000 5

The Central Bank of The Bahamas Accounting and Other Records Systems over day-to-day operations, the degree of centralization and the extent and methods of electronic data processing. A system of internal control must be designed to ensure that all the institution’s revenues accrue to its benefit, all expenditure is properly authorised and disbursed, all assets are adequately safeguarded and all liabilities are recorded.
3.2 GENERAL REQUIREMENTS
3.2.1 It is not appropriate to prepare a comprehensive list of internal control procedures which
would then be applicable to any licensee nor is it possible to prepare a detailed list of particular procedures which should be undertaken, where appropriate, by all licensees. Nonetheless, internal control systems should provide reasonable assurance that - a) the business is planned and conducted in an orderly, prudent and cost￾effective manner in adherence to established policies. b) transactions and commitments are entered into in accordance with management’s general or specific authority. c) management is able to safeguard the assets and control the liabilities of the business. There are measures to minimise the risk of loss from irregularities, fraud and error, and promptly and readily to identify them when they occur. d) the accounting and other records of the business provide complete, accurate and timely information. e) Management is able to monitor on a regular and timely basis , inter alia, the adequacy of the institution’s capital, liquidity and profitability and the quality of its assets. f) Management is able to identify, regularly assess and, where appropriate, quantify the risk of loss in the conduct of the business so that:-

• the risks can be monitored and controlled on a regular and timely
  basis; and
• appropriate provisions can be made for bad and doubtful debts, and
  for any other exposures both on an and off-balance sheet; and. g) Management is able to prepare returns made to the Department completely and accurately and in accordance with the Department’s current reporting instructions and to submit them on a timely basis.
  3.2.2 In seeking to secure reasonable assurance that their internal control objectives are
  achieved, management must exercise judgement in determining the scope and nature of the control procedures to be adopted. They should also have regard to the cost of establishing and maintaining a control procedure in relation to the benefits, financial or otherwise, that it is expected to provide.
  3.2.3 It is a responsibility of directors and management to review, monitor and test its internal
  control systems on a regular basis in order to assure their effectiveness on a day-to-day basis and their continuing relevance to the business. In many institutions such a function is delegated to an internal audit department (see paragraph 3.5 below) whose independence from daily operations and operational management should be assured by its being responsible directly to the board, a sub-committee of the board or to an executive specified by the board. This function is distinct from that of an inspection department which typically provides primary day-to-day control over transactions and operations. BANK SUPERVISION DEPARTMENT March 2000 6

The Central Bank of The Bahamas Accounting and Other Records Systems Internal audit’s control function is a secondary one and should be designed, inter alia, to monitor the operation of, and ensure compliance with, daily procedures and controls.
3.3 DETAILED CONTROL OBJECTIVES
3.3.1 The scope and nature of the specific control objectives which are required for the business
to be conducted in a prudent manner should be commensurate with an institution’s needs and particular circumstances and should have regard to the manner in which the business is structured, organized and managed, to its size and the nature, volume and complexity of its transaction and commitments.
3.3.2 It is not appropriate for the Department to provide an exhaustive and prescriptive list of
detailed control requirements which should apply to all institutions. However, the Department considers that, subject always to the qualification in paragraph 3.3.1 above, each institution should address the following control objectives - a) organizational and administrative controls. b) monitoring procedures. c) segregation of duties. d) authorisation and approval. e) recording. f) safeguarding. g) reconciliation, and h) valuation.
3.3.3 Organizational and administrative controls: An institution should, again subject to the
qualification in paragraph 3.3.1 above, maintain - a) a concise statement providing the short and medium term strategic and policy objectives of the institution. b) a formal organization chart, supported by detailed employee job descriptions, their duties and responsibilities, and lines of reporting and communication. c) a written code of officer and employee conduct and a policy statement governing conflicts of interest. d) a programme for training employees and arrangements to keep employees informed about their duties and any changes or developments in the institution; selection procedures designed to ensure that employees have professional and personal skills commensurate with their responsibilities, ongoing procedures for allocating responsibilities to appropriate employees and for reviewing their competence. e) a manual clearly setting out its accounting policies and practices. f) a manual containing a full description of day-to-day operational procedures and controls both computer-based and manual, documentation on accounting and control systems, including a record of changes made to the systems and the date of and authority for their implementation. BANK SUPERVISION DEPARTMENT March 2000 7

The Central Bank of The Bahamas Accounting and Other Records Systems g) an up-to-date record of authorised signatures, including specimen signatures, identifying for each level of authority. h) a record of matters discussed at important meetings, both internal and external, a record of internal memoranda, and correspondence and comprehensive and detailed loans and advances files, and i) procedures for planning, authorising and commencing new types of business activities including, as appropriate, an understanding of the risks involved, the setting of exposure limits, and for establishing the necessary accounting and other records and internal control systems.
3.3.4 Monitoring procedures
The nature of the procedures given below and the manner in which the information is presented and the degree of its detail will vary according to the level of management monitoring the information in question. Similarly, the importance and scope of the procedure will determine the appropriate level of management required to undertake it. An institution should, subject to the qualification in paragraph 3.3.1 above, undertake or, as appropriate, maintain:
a) a regular (daily, weekly or monthly) review of reports showing actual risk exposures against limits authorised by management or a review of exception reports showing only those exposures which exceed or are likely to exceed authorised limits. These limits should be appropriate to the type, nature and volume of business undertaken and should, where relevant, include counterparty, industry sector, country, settlement, liquidity, interest rate mismatch and securities position limits as well as limits on the level of intra-day and overnight trading positions in foreign exchange futures, options, FRAs and swaps. b) procedures for identifying, reporting and resolving breaches of controls or limit excesses, written evidence of approved action taken in respect of positions which exceed authorised limits, systems to ensure that actual exposures can be readily, accurately and regularly measured against these limits and to indicate which positions are likely to exceed their authorised limits so that, if necessary, management can take corrective action on a timely basis. c) procedures to ensure that relevant and accurate management information is provided to appropriate levels of management on a regular and timely basis. d) a regular and frequent review to monitor compliance with established policies and procedures relating to the lending function; a regular and frequent review and assessment of the quality of the individual loans and advances (including any security for them), with a view to ensuring the early identification of problem or delinquent loans and to enable management to appraise their effect on the institution. e) a regular and frequent review of realized and unrealized profits and losses arising from assets held for dealing. f) a regular and frequent review of the source, concentration and likelihood of withdrawal of deposits. g) a monthly review of reports of actual results and performance analyses, both cumulative and by discrete period, compared to both operating BANK SUPERVISION DEPARTMENT March 2000 8

The Central Bank of The Bahamas Accounting and Other Records Systems budgets and the results for the same period of the previous accounting period. h) a continuous review of statutory, supervisory and regulatory requirements and guidance, and banking association guidance, to determine whether and, if so, what manner the institution’s activities are affected and whether it is in compliance, a review of the reports made pursuant to these requirements.
3.3.5 Segregation of duties
Segregation of duties reduces the risk of intentional manipulation or error by increasing the element of checking. The functions which should be separated include those of authorisation, execution, custody, recording and, in the case of a computer-based accounting system, systems development and daily operations. An institution should, subject to the qualification in paragraph 3.3.1 above, maintain procedures to ensure that - a) different individuals are responsible for the record keeping and physical custody of assets and for the authorisation, initiation and general supervision of transactions and commitments entered into, and b) segregation is such that no one individual can, intentionally or unintentionally, misappropriate assets, misstate liabilities or improperly record or account for transactions without a reasonable chance of subsequent detection.
3.3.6 Authorization and approval
By authorisation is meant the process by which a proposal to commit the institution to risk is agreed. By approval is meant the process by which such an authorisation (which may have been conditional on a number of events having occurred) is translated into specific transactions. In some circumstances these processes occur simultaneously. Accordingly, an institution should, subject to the qualification in paragraph 3.3.1 above, maintain procedures to ensure that - a) commitments are entered into in accordance with management’s intentions and authority. b) authorisation policies which specify the limit for general and specific authorisation and the name of the appropriate individual responsible for exercising each authority are complied with; authorisation policies which lay down the circumstances in which a specific authority given by particular management officers over and above a general authority are complied with, and c) disbursements or other transactions relating to authorizations described in a) and b) are approved as consistent with these authorizations.
3.3.7 Recording
An institution should, subject to the qualification in paragraph 3.3.1 above, maintain procedures to ensure that - a) all authorised transactions and commitments, both spot and forward, are recorded at the correct amounts in the appropriate accounting and other records, so that they can be accounted for in the balance sheet in the BANK SUPERVISION DEPARTMENT March 2000 9

The Central Bank of The Bahamas Accounting and Other Records Systems period in which they arise and in the profit and loss account in the period to which they relate. b) no fictitious transactions (excluding internal/notional accounting entries) are recorded, assets and liabilities recorded in the accounting and other records. c) transactions are processed each day and the books of account are balanced at the end of the working day. d) where records are maintained on computerised accounting systems there exist strong inbuilt validation checks and a complete and adequate audit trial (vide paragraph 3.4 below). e) the arithmetical accuracy of the records is verified, totals, reconciliations, control accounts, and trial balances are maintained and checked, the flow of documents through the accounting system is controlled. Errors and discrepancies are reported to management. f) the documentary evidence that a transaction or commitment has been recorded includes those documents which demonstrate the fact of its existence and that it has been entered into the accounting and other records and also the entries in the accounting and other records themselves; and g) where a loan recorded in the accounting records of a branch of an overseas-incorporated institution is arranged by head office, there exists a record of the authority and, where appropriate, the justification for the granting of the loans at the branch level.
3.3.8 Safeguarding
An institution should, subject to the qualification in paragraph 3.3.1 above, ensure that - a) security procedures and measures assigning responsibility for the physical custody of assets to specific authorised individuals who are independent of the related bookkeeping functions are complied with both direct physical and indirect documentary access to assets is limited to authorised personnel. b) security procedures and measures include, in particular, physical precautions over valuable, portable, negotiable, exchangeable or bearer assets by, for example, the use of locked file cabinets for unused bank drafts and certificates of deposit and fire-proof vaults for the protection of currency, securities and other documents of title. c) safe custody procedures exist for assets held on behalf of customers, or other parties whether in their own name or in that of a nominee company, and d) there are procedures for safeguarding its accounting and other records.
3.3.9 Reconciliation
An institution should, subject to the qualification in paragraph 3.3.1 above, maintain procedures to ensure that - a) accounting records are compared with the related assets, documents and control accounts on a frequent, regular and timely basis by, for example, BANK SUPERVISION DEPARTMENT March 2000 10

The Central Bank of The Bahamas Accounting and Other Records Systems the reconciliation of nostro accounts to bank statements, the reconciliation of balances on loan, investment, fixed asset and client accounts to detailed records of dealing positions to those positions according to the accounting records and by the regular and prompt analysis and clearance of transactions posted to suspense accounts; the frequency of reconciliation has regard to the volume and size of transactions passing over the particular account being reconciled and the size of the balance on the account. b) the nature and amount of reconciliation differences are determined; reconciling items are investigated and their subsequent clearance checked and, where appropriate, adjustments are made to the accounting records with the authorisation of the appropriate level of management. c) changes between the closing balances of one accounting period and the opening balances of the following accounting period are accounted for and any discrepancies are investigated and reported to the appropriate level of management. d) rapid exchange of deal confirmations takes place with relevant third parties, whether this is done by hand delivery, using postal services or electronic transmission methods, and e) the frequency, regularity and extent of reconciliation procedures throughout the institution have regard to the size and nature of its operations and the volume and size of its transactions.
3.3.10 Valuation
An institution should, subject to the qualification in paragraph 3.3.1 above, maintain procedures to ensure that - a) assets held for dealing purposes are revalued regularly and frequently at prices checked independently of dealers. b) the value of assets and liabilities and off-balance sheet rights and obligations are regularly and frequently reviewed and assessed; and c) provisions or other adjustments are made and recorded against those assets and rights, as appropriate, in order to conform with statutory and supervisory requirements, accounting standards and the institution’s accounting policies.
3.4 CONTROLS IN AN INFORMATION TECHNOLOGY ENVIRONMENT
3.4.1 The information held in electronic form within an institution’s information systems is a
valuable asset that needs to be protected against unauthorized access and disclosure. The control objectives described in 3.3 apply to operations undertaken in both manual and electronic environments; however, the use of electronic information systems introduces additional risks that need to be specifically addressed. It is the responsibility of management to understand the extent to which an institution relies upon electronic information, asses the value of that information and establish an appropriate system of controls. The Department recognizes that this will usually be achieved by a combination of manual and automated controls, the balance of which will vary between institutions reflecting the need for each to address its particular risks cost effectively.
3.4.2 The types of risk most often associated with the use of information technology in financial
systems may be classified as follows:-
BANK SUPERVISION DEPARTMENT March 2000 11

The Central Bank of The Bahamas Accounting and Other Records Systems a) Fraud and Theft:- Access to information and systems can create opportunities for the manipulation of data in order to create or conceal significant financial loss. Additionally, information can be stolen, even without its physical removal or awareness of the fact, which may lead to loss of competitive advantage. Such unauthorized activity can be committed by persons with or without legitimate access rights. b) Error:- Although they most frequently occur during the manual inputting of data and the development or amendment of software, errors can be introduced at every stage in the life cycle of an information system. c) Interruption:- The components of electronic systems are vulnerable to interruption and failure; without adequate contingency arrangements this can lead to serious operational difficulty and/or financial loss. d) Misinformation:- Problems may emerge in systems that have been poorly specified or inaccurately developed. These might become immediately evident, but can also pass undetected for a period during which they could undermine the veracity of supposedly sound information. An institution’s electronic systems, or their consequences, are often apparent at many points external to the organization. Unreliable, unfriendly and insecure systems can damage an institution’s business credibility. In addition, failure of an institution’s electronic systems might result in a breach of contract and legal liability, and/or a breach of regulatory requirements.
3.4.3 Controls need to be established that fall within three categories:-
a) Preventive: - Measures designed to eliminate or reduce the incidence or probability of fraud, errors and systems interruption. b) Detective:- Measures designed to detect that adverse incidents have occurred as quickly as possible before unacceptable damage is done. c) Contingency:- Measures designed to facilitate recovery from adverse incidents as quickly as possible with minimum cost and damage to the business.
3.4.4 Particular consideration should be given to control implications in the following areas when
establishing an electronic information systems environment:- a) Organization and structure of the resources used to manage and support an institution’s electronic information systems. b) The appropriateness of strategic planning for electronic information systems and its compatibility with, and support of, wider business strategy and planning. c) Systems development life cycle, which should include standards and procedures designed to ensure that well controlled systems are delivered. d) Documentation of electronic systems, their design, operation and use. e) Change control procedures, covering both planned modifications and emergency amendments. f) Operation, maintenance and support of electronic systems. g) Physical security of computerised facilities, in order to prevent uauthorized access and provide protection against environmental hazards (fire, flood, power loss, etc.). BANK SUPERVISION DEPARTMENT March 2000 12

The Central Bank of The Bahamas Accounting and Other Records Systems h) Logical access control procedures, designed to prevent unauthorized access to electronic systems and data, detect attempted violations and maintain audit trails. i) Network security, in particular the control of remote access to electronic systems and data, transmission integrity and overall confidentiality. j) Personal computer security, where the standards of control associated with larger systems are harder to maintain. Particular hazards include the illegal copying of software which can, inter alia, increase the risk of exposure to computer viruses and their attendant dangers. k) Standby systems, recovery management procedures and the arrangements for making copies of important electronic files. l) Business interruption planning, which should address the way in which business critical electronic systems are to be maintained in the event of fire, flood, power failure or other physical damage. Plans should be agreed, documented and regularly tested.
3.4.5 It is also important that management is aware of its responsibility to promote and maintain
a climate of security awareness and vigilance throughout the organization. In particular, it should give consideration to:- a) IT security education and training, designed to make all relevant staff aware of the need, for and their role in supporting, good IT security practice and the importance of protecting company assets. b) IT security policy, standards, procedures and responsibilities, designed to ensure that arrangements are adequate and appropriate.
3.5 INTERNAL AUDIT
3.5.1 Internal audit is an integral part of the internal control system established and maintained
by management and is distinct from the primary control function of an inspection department which provides day-to-day control over transactions and operations.
3.5.2 The existence, scope and objectives of internal audit are dependent upon the structure of
the institution and the risks inherent in its business. Important considerations in assessing the effectiveness of internal control include the scope of its terms of reference, its dependence from operational management, its reporting regime and the quality of its staff.
3.5.3 While the Department does not consider it appropriate at the present time to prescribe that
all licensees have an internal audit, it nevertheless believes that the following secondary control functions could be undertaken by internal audit - a) review of accounting and other records and the internal control environment. b) review of the appropriate, scope, efficiency and effectiveness of internal control systems. c) detailed testing of transactions and balances and the operation of individual internal controls to ensure that specific control objectives have been met. d) review of the implementation of management policies, and BANK SUPERVISION DEPARTMENT March 2000 13

The Central Bank of The Bahamas Accounting and Other Records Systems e) special investigations for management.
4. REPORTING ACCOUNTANTS’ EXAMINATIONS AND REPORTS
4.1 Reporting accountants appointed by an institution and approved by the Department will be
required to form an opinion on whether the institution’s accounting and other records and internal control systems have been maintained by management during the period examined in accordance with these guidelines. In forming this opinion they will be expected to have regard to the nature and scale of the business undertaken by the institution.
4.2. The Department does not expect that reporting accountants will be able to give an
unqualified opinion on the records and systems in every institution but that almost invariably they will prefer to draw the Department’s attention in their report to a number of matters which have come to their attention during the course of their work. The information provided in such an exception report will assist the Department to make its judgement on the adequacy of an institution’s records and systems and on whether the institution’s business is conducted in a prudent manner on a day-to-day basis. Reporting accountants are not required to make this judgement.
4.3 The circumstances giving rise to an opinion qualified by exceptions include those where:
a) certain records and systems do not exist and the reporting accountants consider that they should exist in order to assist management to conduct the business of the institution in a prudent manner on a day-to-day basis. b) there is, or has been, a significant weakness in, or failure of, certain records or systems during the period examined, or c) the reporting accountants are unable to form an opinion on a particular aspect of the records and systems and therefore wish to bring details of the matter to the attention of the Department to place it in a better position to judge whether the criteria for continued licensing are satisfied.
4.4 The Department does not require reporting accountants to report all omissions, weakness
and failures, however minor, in the existence, nature, scope and effectiveness of records and systems. Rather, it requires them to report those which individually or collectively are, in their opinion, significant and result in there not being reasonable assurance that the requirements set out in this Notice are satisfied. The Department does not expect reporting accountants to examine, assess or report on management’s judgements and decisions. The assessment of the quality of management and their banking decisions is a supervisory judgement for the Department to make.
4.5 An institution may, in consultation with its reporting accountants and with the agreement of
the Department, commission a limited scope examination in one year as part of a rolling programme of examinations spread over a number of years as an alternative to a comprehensive or “full scope” examination.
4.6 The reporting accountants’ report should be addressed to the directors in the case of a
Bahamas-incorporated licensee and to the senior manager in the case of a branch of an overseas-incorporated institution. The examination will cover a twelve-month period, or possibly a shorter period in the case of a newly licensed institution, and will arise from a letter of instruction from the institution to the reporting accountant (or a letter of engagement from the reporting accountants duly acknowledged by the institution), a copy of which should then be sent to the Department. This letter of instruction or engagement, which will in turn arise from directions from the Department requiring the institution to BANK SUPERVISION DEPARTMENT March 2000 14

The Central Bank of The Bahamas Accounting and Other Records Systems provide it with the required report, will set out in detail the scope of the reporting accountants’ examination.
4.7 The report should be completed, dated and submitted to the licensee not more than three
months after the end of the period examined. The institution should then submit the report to the Department, with such comments as management sees fit to make, not more than one month after the date of report. If the reporting accountants conclude, after discussing the matter with their client, that they will give a negative opinion (as opposed to one qualified by exceptions) or that the issue of a report will be delayed they must immediately inform the Department in writing giving their reasons. They should also send the institution a copy of their letter. Similarly, if the institution is unable to submit a report to the Department within the required period it should inform the Department in writing of the reasons for the delay.
4.8 It will be for the Department to judge in the light of the contents of a report and other
information about the institution which is available to it whether the requirements of the Law and/or for prudent conduct of licensee’s business are satisfied.
5. THE REQUIRED REPORT
5.1 The required report is prepared on the basis that it will be made by a firm of accountants
authorised by the Department.
5.2 The report should be in the form outlined on the next page.
Bank Supervision Department
BANK SUPERVISION DEPARTMENT March 2000 15

The Central Bank of The Bahamas Accounting and Other Records Systems REPORTING ACCOUNTANTS’ REPORT ON ACCOUNTING AND OTHER RECORDS AND INTERNAL CONTROL SYSTEMS THE DIRECTORS, XYZ BANK LTD. THE SENIOR MANGER, ABC BRANCH Dear Sirs, In accordance with your letter of instruction dated ( ), a copy of which is attached, we have examined the accounting and other records and internal control systems of XYZ Bank Ltd. (ABC Branch) which were in existence during the year ended ( ). Our examination has been carried out having regard to the Bank Supervision Department’s Guidance Note dated May 1998. As directors (senior manager) of XYZ Bank Ltd. (ABC Branch) you are responsible for establishing and maintaining adequate accounting and other records and internal control systems. In fulfilling that responsibility estimates and judgements must be made to assess the expected benefits and related costs of management information and of control procedures. The objective is to provide reasonable, but not absolute, assurance that assets are safeguarded against loss from unauthorized use or disposition, that banking risks are properly monitored and evaluated, that transactions are executed in accordance with established authorization procedures and are recorded properly, and to enable you to conduct the business in a prudent manner. Because of inherent limitations in any accounting and internal control system errors or irregularities may nevertheless occur and not be detected. Also, projection of any evaluation of the systems to future periods is subject to the risk that management information and control procedures may become inadequate because of changes in conditions or that the degree of compliance with those procedures may deteriorate. In our opinion, having regard to the nature and scale of its business, during the year ended (.......), EITHER, the accounting or other records and internal control systems examined by us were established and maintained in accordance with the requirements of the Guidance Note (with the exception of the matters set out in the appendix attached to this report). OR the accounting and other records and internal control systems examined by us were not established and maintained in accordance with the requirements of the Guidance Note for the reasons set out in the
appendix attached to this report.
Yours faithfully,
A Reporting Accountant
Chartered Accountants
BANK SUPERVISION DEPARTMENT March 2000 16