Bank of Jamaica Standards of Sound Business Practices: Internal Control

Bank of Jamaica
March 1996
STANDARDS OF SOUND
BUSINESS PRACTICES
INTERNAL CONTROL
© 2005 The Bank of Jamaica.
All rights reserved

Internal Control Page 2
INTERNAL CONTROL
A. PURPOSE
This document sets out the minimum internal controls that each institution needs to have in place and apply, and the control environment within which these controls need to be applied, in order to provide reasonable assurance that the institution operates in a sound and prudent manner. The establishment and maintenance of effective internal controls within a strong and effective internal control environment is a fundamental component in the safe and sound management of all institutions. In this context, this and other standards of sound business and financial practices set out an institution’s responsibilities in terms of managing and controlling specific business and financial practices and risks. An important aspect of an institution’s responsibility is to provide depositors, creditors, shareholders, and regulators with reasonable assurance that the institution’s business is appropriately controlled and its risks are prudently and soundly managed. In this regard, internal control, no matter how well designed and operated, can provide only reasonable assurance regarding achievement of an institution’s objectives. The likelihood of achievement is affected by limitations inherit in all internal control systems. These include the realities that human judgement in decision-making can be faulty, that persons responsible for establishing internal controls need to consider their relative costs and benefits, and that breakdowns can occur because of human failures such as simple error or mistake. Moreover, controls can be circumvented by fraudulent means, and by the collusion of two or more people. Finally, management has the ability to override the internal control system. B. DEFINITIONS Internal control is the process, effected by an institution’s Board of Directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the safe guarding of assets and asset values, the effectiveness and efficiency of operations, the reliability of financial reporting and compliance with applicable laws and regulations. _________________________________________________________________________________ Bank of Jamaica March 1996

Internal Control Page 3
Internal controls are the policies and procedures established and implemented alone, or in concert with other policies of procedures, to mange and control a particular risk or business activity, or combination of risks or business activities, to which the institution is exposed or in which it is engaged. The internal control environment is the framework under which internal controls are developed, implemented and monitored. It consists of the mechanisms and arrangements that ensure internal and external risks to which the institution is exposed are identified, that appropriate and effective internal controls are developed and implemented to soundly and prudently manage these risks, and that reliable and comprehensive systems are in place to appropriately monitor the effectiveness of these controls.
C. INTERNAL CONTROL ENVIRONMENT
Each institution needs to have in place an appropriate and effective internal control environment to ensure that the institution is managed and controlled in a sound and prudent manner. The factors which together comprise the control environment, are:

• as stewards of an institution, a Board of Directors that is actively concerned with
  sound corporate governance and that understands and diligently discharges its responsibilities by ensuring that the institution is appropriately and effectively managed and controlled;
• a management that actively manages and operates the financial institution in a
  sound and prudent manner;
• organizational and procedural controls supported by an effective management
  information system to soundly and prudently manage the institution’s exposure to risk; and
• an independent inspection/audit mechanism to monitor the effectiveness of the
  organizational and procedural controls.
  D. BOARD OF DIRECTORS
  A Board of Directors is one of a number of components which must have a strong interest in the effective corporate governance of an institution. A Board of Directors has a principal role in providing direction, guidance and oversight to an institution and in ensuring that the affairs of the institution are carried out in the _________________________________________________________________________________ Bank of Jamaica March 1996

Internal Control Page 4 best interests of depositors and shareholders. In fulfilling this role, a director’s responsibilities fall into two categories: a duty of loyalty and a duty of care. The fiduciary duty of loyalty commits directors to act in the best interests of the institution. It includes principles such as observing the utmost good faith toward the institution, acting honestly in exercising powers, ensuring strict accountability for conflicts of interest, and adhering to a strict practice of preserving the confidentiality of matters involving the institution. Directors also assume a duty to act carefully in fulfilling the important task of directing and monitoring the activities of management. The duty of care requires directors to follow the “reasonably prudent person” rule, that requires them to act with the degree of diligence, care and skill that a reasonably prudent person would exercise in comparable circumstances. Effective corporate governance requires a high level of cooperation between an institution’s Board of Directors and its management. Management supervision is one of the board’s most direct responsibilities. A Board of Directors should ensure that the institution’s day-to-day operations are in the hands of qualified, honest and competent management. This necessitates that each director exercise independent judgment in evaluating management’s actions and competence. Carrying out this responsibility generally requires periodic goal setting, review and evaluation of management performance A Board of Directors usually discharges this management supervision responsibility by:

• influencing the ethical values of the institution;
• defining the duties and responsibilities of the chief executive officer (“CEO”);
• selecting or approving an individual with appropriate ability, integrity and
  experience to fill the CEO position;
• reviewing proposed senior management appointments;
• ensuring the selection, appointment and retention of qualified and competent
  management;
• reviewing the institution’s personnel and human resource policies, including
  reviewing and approving changes to the compensation plan for all employees and management;
• reviewing the institution’s management succession plan; and
• reviewing the sufficiency and qualifications of the institution’s human resources.
  _________________________________________________________________________________ Bank of Jamaica March 1996

Internal Control Page 5
Although a Board of Directors is ultimately accountable for its responsibilities, the board may wish to fulfil board functions through authority delegated to committees. Examples include the formation of an audit committee and a business conduct review committee. In other situations, a Board of Directors may wish to establish committees to assist and advise the board in fulfilling its responsibilities. Where a Board of Directors is fulfilling some functions through authority delegated to committees, a board needs to ensure that, at a minimum:

• committees, including their terms of reference, are established by a formal
  resolution of the board or through the institution’s corporate by-laws;
• board members are appropriately represented on the committees;
• committee members are appointed by the board; and
• board members are regularly informed of each committee’s activities, findings,
  conclusions and recommendations.
  E. MANAGEMENT
  The operations and the handling of the day-to-day business and affairs of each institution are functions of management. In this regard, the competence, skills, integrity and prudence of management are probably the most important factors in the safety and soundness of an institution. A key management responsibility is the breadth, scope and effectiveness of the institution’s organizational and procedural controls, without which the stability and soundness of the institution would be at risk. The CEO is ultimately accountable for the institution’s organizational and procedural controls and usually fulfils this responsibility by:
• ensuring the integrity of internal controls by providing the appropriate leadership
  and direction that will set an operational tone of respect for the priority and integrity of the internal control of the institution and that will influence the control consciousness of individuals within the organization who develop, administer and monitor the controls;
• ensuring that the institution has in place an effective management team that:
  ~ bears specific responsibility for the development and implementation of particular organizational and procedural controls; _________________________________________________________________________________ Bank of Jamaica March 1996

Internal Control Page 6
~ is aware of its responsibilities;
~ discharges these responsibilities in a pro-active diligent manner; and ~ is accountable to the CEO for the performance of these responsibilities.

• meeting regularly with members of the management team to review their
  responsibilities and performance with respect to controls.
  F. ORGANIZATIONAL AND PROCEDURAL CONTROLS
  A properly-functioning system of organizational and procedural controls is essential in assisting an institution to effectively manage and control its operations and to carry on business in an orderly manner. The scope and particulars of a system of effective organizational and procedural controls that are utilised by institutions to conduct their business in a sound and prudent manner will differ depending on factors such as: the nature and diversity of business; the volume, size and complexity of transactions; the degree of risk associated with each area of operation; the degree of centralization and delegation of authority; and the extent and effectiveness of information technology. At a minimum, a comprehensive set of organizational controls requires:
• developing and implementing a formal code of conduct for the institution;
• developing, at least annually, and implementing a comprehensive business plan
  for the institution;
• developing an organizational structure appropriate for the business and risk￾taking activities of the institution;
• establishing, within the management structure, either a reporting requirement or
  another method of ensuring that the significant risks to which the institution is exposed and the business activities in which the institution is engaged are identified and evaluated, and that sound, prudent and effective business and risk management policies and procedures are developed and implemented to manage and control these risks and business activities with the objective of maintaining a sound and prudent institutional risk profile; and
• developing and implementing appropriate and effective human resource policies
  and procedures.
  At a minimum, a comprehensive set of procedural controls requires:
  _________________________________________________________________________________ Bank of Jamaica March 1996

Internal Control Page 7

• developing and maintaining comprehensive documentation that clearly sets out
  the institution’s organizational and procedural controls;
• clearly defining prudent and appropriate levels of delegation of authorities;
• ensuring a prudent segregation of functional responsibilities within the
  institution;
• establishing and maintaining an effective management information systems,
  including appropriate accounting and record-keeping controls;
• developing and implementing appropriate and effective asset and liability
  management safeguards and controls (both on- and off-balanced sheet);
• developing and implementing sound and conservative valuation policies and
  procedures; and
• developing and implementing prudent and appropriate information technology
  controls.
  Code of Conduct
  Although all business organizations depend on public confidence, this is especially true for financial institutions. As a taker of deposits, each institution is in a position of special trust – that of a guardian of depositors’ savings - and so must conduct itself according to the highest standards of ethical behaviour. Therefore, a strong code of ethics at all levels is vital to the well being of each financial institution. The conduct of any corporation is reflected in the actions of the individuals who act on its behalf – its Board of Directors, management and employees. The integrity of an institution depends on the personal integrity of each and every representative of the institution. In this context, ethical behaviour must be incorporated into every decision a member institution makes. A code of conduct outlines the institution’s approach to help representatives make these decision consistently and alert them to potential problem areas. It should serve as a tool in promoting the practice of ethical decision making on a daily basis. In this way, a code of conduct creates conditions that are conducive to ethical behaviour and so is an important element of an institution’s internal control system, a system which is designed to detect and report actions that are not ethical. At a minimum, a comprehensive code of conduct requires:
  _________________________________________________________________________________ Bank of Jamaica March 1996

Internal Control Page 8

• Establishing prudent and appropriate rules governing the proper business
  conduct and ethical behaviour of the institution and its Board of Directors, management and employees with respect to:
  ~ stewardship of depositors’ funds;
  ~ complying with applicable legislation, regulation and rules; ~ respecting the privacy of client and institutional information; ~ transactions with related parties of the institution and other situations involving potential conflicts of interest; and ~ trading in securities generally and particularly in securities of the institution and its affiliates. ~ trading in securities generally and particularly in securities of the institution and its affiliates.
• implementing an effective mechanism to ensure that directors, management and
  employees understand and adhere the code of conduct.
  To ensure that the institution’s code of conduct is appropriate and that the directors management and employees understand and adhere to it, each institution needs to ensure that:
• the code is reviewed periodically and ratified by the institution’s Board of
  Directors; and
• employees and management are required to sign an acknowledgement indicating
  their awareness of, and compliance with, the code.
  All institutions should consider the need for adopting specialized codes of conduct for certain types of employees who may have special duties and responsibilities imposed on them as a result of the nature of their work such as those involved in the investment and treasury function. Business Plan A business plan is an important management and control tool by or through which an institution will:
• identify opportunities in the marketplace, anticipate and initiate changes in
  strategic direction, forecast results and highlight financial and other resources that may be needed to achieve its business objectives;
• communicate the institution’s business objectives throughout the institution; and
  _________________________________________________________________________________ Bank of Jamaica March 1996

Internal Control Page 9

• establish benchmarks against which the institution’s performance can be
  monitored.
  At a minimum, a comprehensive business plan requires:
• outlining the institution’s current financial and strategic positioning in the
  marketplace;
• identifying the institution’s business objectives, including the core businesses or
  target markets;
• developing short- and long-term strategies for achieving these objectives,
  including identifying potential risks to which the institution is exposed and assessing the key resources required to enable the institution to achieve these objectives; and
• establishing financial and other indicators against which the institution’s
  performance may be measured and assessed.
  In order to develop a business plan effectively, there must be a formal process that:
• clearly allocates planning-related tasks and appropriate successive levels of plan
  approval within the institutions; and
• ensures that the conclusions, recommendations, projections and assumptions set
  out in the plan are supported by adequate and appropriate information, scrutiny and analysis. Risk Identification, Evaluation and Management All institutions are subject to continual changes in their business environment that may impact the risk profile of the institution. These changes may arise from both external and internal sources, including economic, industry, regulatory, and operational changes. Each institution needs to take steps to ensure that it has in place and applies sound and prudent policies and appropriate procedures and controls in order to prudently manage and control the significant risks to which the institution is exposed and the significant business activities in which the institution is engaged. A number of such significant risks and business activities are set out in this and other Standards of Sound Business and Financial Practices. At minimum, this necessitates having in place an effective and appropriate reporting requirement or other method for:
  _________________________________________________________________________________ Bank of Jamaica March 1996

Internal Control Page 10

• identifying an evaluating , on an on-going basis, the significant risks to which the
  institution is exposed and their potential impact on the institution;
• ensuring that appropriate and effective organizational and procedural controls
  are developed and implemented to prudently manage and control these risks;
• regularly reviewing the institution’s organizational and procedural controls
  implemented to manage and control risks to ensure that circumstances for which these controls originally were designed continue to apply and that the controls continue to be appropriate and effective;
• ensuring that effective and appropriate procedures are in place for planning,
  authorizing and commencing new types of business activities, evaluating the risks involved, and establishing the necessary organizational and procedural controls – including the setting of sound and prudent exposure limits and risks management policies; and
• ensuring that the overall risk profile of the institution is sound and prudent.
  Human Resource Management/Training
  Human resource policies and procedures assist institutions to ensure that their human resource requirements are identified and that they have the personnel required to prudently and effectively achieve their objectives. At a minimum, the elements of a human resource programme need to include:
• the development and implementation of long-range resource plans to ensure
  that the institution has enough experienced and skilled personnel to carry out its business activities in a prudent manner, including:
  ~ a recruiting strategy;
  ~ a programme for training and developing employees; ~ selection criteria designed to ensure that personnel have skilled commensurate with their responsibilities; and ~ a plan for management succession; and
• the development and regular review of compensation programmes to ensure,
  among other things, that the institution is not engaged in risk-increasing compensation policies; and
• regular personnel evaluation and review.
  _________________________________________________________________________________ Bank of Jamaica March 1996

Internal Control Page 11
Documentation of Controls
Documenting the institution’s organizational and procedural controls:

• provides the necessary guidance to individuals responsible for the institution’s
  policies, procedures and controls; and
• assists in ensuring that the controls used are authorized, adequate and current.
  Documentation should be in written or electronic media form and describe each key organizational and procedural control in detail. Approval Authorities Clearly defined responsibilities and levels of authority help to ensure that decisions are made by duly authorized persons who are in a position to assess their overall implications and be accountable for them, that individuals report to an appropriate level of authority and that delegated authority is adequate and appropriate. Authority may be absolute or incremental, or a combination thereof, and may also be individual, pooled or shared within a committee. The delegation of authority needs to be clearly documented, and at a minimum, must specify:
• the absolute and/or incremented general or specific authority being
  delegated;
• the units, individuals, positions or committees to whom authority is being
  delegated;
• the authority of recipients to further delegated authority; and
• any restrictions placed on the use of the delegated authority.
  The extent to which authority is delegated will vary among institutions according to a number of factors including:
• the types of risks being assessed; and
• the experience of the institution’s officers.
  Segregation of Duties
  Effective controls respecting the segregation of duties ensure that there exist a clear and distinct separation of duties between those persons who:
  _________________________________________________________________________________ Bank of Jamaica March 1996

Internal Control Page 12

• authorized, supervise, initiate or execute transactions; and
• record and account for transactions.
  The segregation of duties, both between individuals and between departments, reduces the risk of intentional or unintentional manipulation or error by increasing the element of independent verification. The underlying principle is that no one person should be in a position to control sufficient stages of processing a transaction so that errors of defalcations could occur without a reasonable chance of detection. Ideally, the flow of activity should be designed so that the work of one person is either independent of, or serves as a check on, the work of other persons. Management Information Systems All institutions require quality information at all levels within the institution to assist in making informed business decisions, to facilitate the effective management and control of the institution’s operations and to facilitate external reporting. Management information systems are those arrangements by which information about an institution’s business, the state of its affairs and the risks to which it is exposed is produced and supplied to individuals or groups of individuals within the institution in a form that enables them to monitor, review and act on the information in carrying out their responsibilities, as well as to external users of information such as regulators and shareholders. In this context, reports and information generated from an effective management information system may also assist an institution to monitor compliance with certain internal controls, thereby providing some reasonable assurance that its controls are being complied with and are functioning appropriately Each institution needs to develop, maintain and utilize an effective comprehensive management information system in order that sufficient, timely and relevant information may be produced to enable the business of the institution to be prudently managed and controlled. At a minimum, an effective comprehensive management information system needs to ensure that relevant, accurate and timely information is reported to appropriate persons within the institution to enable the institution to:
• identify, quantify, assess and monitor its business activities, exposure to risk,
  financial position and performance and take effective decisions related thereto; and _________________________________________________________________________________ Bank of Jamaica March 1996

Internal Control Page 13

• monitor the effectiveness of, and compliance with, its organizational and
  procedural controls and report any exceptions related thereto.
  The frequency with which information is prepared, its level of detail and the amount of narrative analysis and explanation will depend upon the level of authority to which it is addressed. Some types of information will be needed on a more frequent basis than others. Management information reports need to be prepared frequently enough to provide timely and relevant information about the business area or risk reported on. The nature and importance of the procedure will determine the appropriate level of management required to undertake it. Internal control deficiencies need to be reported to those individuals, or groups of individuals, with appropriate authority to rectify the situation. Serious deficiencies in policies, procedures or controls should be brought to the attention of senior management, the inspection/audit function and the Board of Directors. It may be appropriate for some information to be presented as activity reports showing actual business activity or risk positions against established norms, plans or position limits or as exception reports that highlight exceptions from agreed limits. Management information systems need to be reviewed and regularly to assess the current relevance of information generated and the adequacy and quality of the system’s performance over time. Accounting and Record-Keeping Controls Each institution needs to establish and maintain sufficient appropriate controls over the accounting and other record-keeping process with respect to both on- and off-balance sheet assets and liabilities, to reasonably ensure:
• the completeness of accounting information;
• the accuracy of all amounts reported;
• timeliness in the reporting of transactions/business activity;
• the validity of transactions; and
• the proper maintenance or records.
  All licensees need to maintain and follow accounting policies and practices that are conservative and appropriate in the circumstances. Safeguarding Controls _________________________________________________________________________________ Bank of Jamaica March 1996

Internal Control Page 14
Appropriate and effective safeguards ensure that:

• procedures exist for the safekeeping and protection of the institution’s assets and
  those of its customers or other parties held in physical custody or on a book￾based system of the institution; and
• effective procedures exist for limiting access to the institution’s accounting and
  other records of assets and liabilities to authorized personnel.
  No internal control structure can completely prevent errors, illegal acts or fraudulent activities. Nevertheless, each institution needs to identify areas of its operations which are susceptible to these risks and ensure that sufficient and effective preventive and detective control mechanisms are in place to safeguard the assets of the institution and its clients. The nature and extent of controls necessary depends on:
• the value of the asset or assets in question;
• their qualities of portability and negotiability;
• how easily loss or misappropriation can be concealed; and
• the repercussions of loss or misappropriation on the institution’s financial
  position, operations and reputation.
  Valuation Policies and Procedures
  Valuation policies and procedures assist in ensuring that appropriate provisions are made for the depreciation or decline in value of an institution’s assets or liabilities (both on- and off-balance sheet). Each institution needs to develop and implement sound and conservative policies and procedures to:
• regularly monitor, review and quantify the quality and value of its assets and
  liabilities (both on- and off-balance sheet) based on the risk of loss (including contingent losses) in the conduct of its business that will, or is expected to, be incurred; and
• value these items by making and recording prudent provisions or other
  appropriate adjustments against these assets and liabilities in order to conform with the institution’s valuation policies, regulatory requirements and accounting standards. _________________________________________________________________________________ Bank of Jamaica March 1996

Internal Control Page 15
Information Technology Controls
The dependence of financial institutions on information technologies such as computer systems and telecommunications has rapidly expanded in recent years. These systems often support critical services within an institution. The potential loss or extended disruption of these systems presents a significant risk to these institutions. Accordingly, the effective management of these risks is an important element of internal control of all institutions. At minimum, comprehensive information technology controls require developing and implementing appropriate and effective information technology systems and security controls, including adequate backup and recovery procedures. i) Information Technology Systems Development Each institution needs to ensure that:

• the institution’s information technology strategy is consistent with its business
  plan and strategies;
• systems hardware and software satisfy this strategy;
• systems are appropriately tested before they are implemented; and
• operational and procedural controls are developed and implemented to ensure
  that:
  ~ changes to systems hardware, software and data are properly authorized, tested, and implemented; and ~ the system is appropriately documented, including a record of systems changes; ~ system controls are subject to independent review prior to implementation. ii) Information Technology Security Controls Comprehensive information technology security controls require the development and implementation of appropriate and effective:
• systems access security; and
• business interruption backup and recovery arrangements.
  Systems access security controls need to ensure:
  _________________________________________________________________________________ Bank of Jamaica March 1996

Internal Control Page 16

• the integrity of the hardware, software and data;
• the physical access to systems hardware, software and data is restricted to
  authorized persons; and
• that security devices and logical systems access sufficiently minimise the
  risk of unauthorized access to systems programmes and data.
  Business interruption controls need to ensure that:
• the institution has adequate systems backup and recovery procedures and
  standby arrangements in case of an interruption, destruction or other loss of systems facilities, data files, hardware, software and documentation; and
• these business interruption arrangements are periodically reviewed and tested.
  At appropriate stages of information technology development, consideration needs to be given to promoting the involvement of an independent inspection/audit function to ensure that the proper degree of controls have been included as part of the design process. G. INDEPENDENT INSPECTION/AUDIT Independent inspections/audits are a key element in monitoring and assessing the integrity of internal controls and the internal control environment. Each institution needs to have in place an independent inspection/audit function through which the institution may be provided with reasonable assurance that its key organizational and procedural controls are effective and appropriate and are being complied with. The need to establish and maintain a system of independent inspection/audit is distinct from the requirement to establish and maintain internal controls over day-to-day transactions and operations. The independent inspection/audit function does not have primary responsibility for establishing or maintaining internal controls. Rather, independent inspectors/auditors evaluate the effectiveness of these controls and thus contribute to their ongoing effectiveness. In this way, an independent inspection/audit function forms an integral part of each institution’s internal control environment. Although independent inspections/audits are usually performed within the institution using an internal inspection or audit department, in the case of small institutions this function could be carried out by outside organizations such as their parent or affiliate, or, through special mandate, the institution’s external auditors. Independent inspection/audit assessments should be presented to the institution’s Board of Directors on a timely basis for review, but a least once a year. _________________________________________________________________________________ Bank of Jamaica March 1996

Internal Control Page 17
To be effective, the independent inspection/audit function must, at a minimum:

• have an appropriate mandate governing its duties and objectives;
• be independent of the functions and internal controls that it inspects;
• have sufficient resources to achieve this mandate; and
• be conducted through a professional inspection/audit programme.
  i) Mandate
  A mandate is a written statement of objectives and authority.
  At minimum, the mandate of the audit/inspection function should ensure that:
• the function has sufficient authority to carry out its responsibilities objectively
  and independently and that the function has appropriate access to the highest level of management and to the Board of Directors;
• inspection/audit personnel have access to the institution’s records, information,
  and personnel;
• its scope and objectives allow for the expression of opinions about the adequacy
  and effectiveness of the institution’s existing and proposed internal controls;
• inspection/audit recommendations are adequately considered and acted on, by
  providing the function with the authority to follow up on findings and recommendations; and
• the institution’s management and Board of Directors are informed of the results
  of evaluations.
  To be effective, the mandate needs to be approved by management and the Board of Directors. ii) Independence The objectivity of the independent inspection/audit function is vital to its effectiveness. Therefore, inspectors/auditors need to be independent of the activities, functions and internal controls they audit. Generally, there is a greater degree of independence when:
• the mandate and authority of the independent inspection/audit function is
  separate from that of day-to-day control over transactions and operations;
• the function reports to a level of management that is senior enough to ensure
  that it may act independently of the individuals responsible for the activities being inspected; _________________________________________________________________________________ Bank of Jamaica March 1996

Internal Control Page 18

• the function has a direct access to the CEO and to the Board of Directors, if
  necessary; and
• the selection and dismissal of the independent inspection/audit head can be
  made only with the express agreement of the Board of Directors. iii) Resources A competent, qualified, well-trained and independent internal audit department is a key component of an effective internal control environment. Each institution needs to ensure that personnel who perform this function possess the qualifications, knowledge, skills, experience and training to fulfil the audit requirements of the institution. iv) Inspection/Audit Programme Inspection/audit programmes are usually designed to provide reasonable assurance that control objectives are met. The extent of testing of particular business activities or risk areas is a matter of professional judgement. Although the complete testing of all transactions and other aspects of an activity under review may provide further assurance as to the integrity of its operations, this may not be necessary or practical for sound inspection/auditing reasons. Reasonable assurance may be attained by developing a comprehensive inspection/audit programme based on the assessment of risk and the materiality of that risk, either alone or in combination with other risk factors. The key elements of a comprehensive inspection/audit programme include:
• a comprehensive plan governing the inspection/audit objectives for the period
  under review. The plan needs to identify the risk activities, operations and internal control systems to be reviewed, specify the frequency of the audit and identify the necessary resources to carry out the plan;
• comprehensive procedures for achieving the audit plan, including:
  ~ identifying the risk and/or control objectives for each area to be reviewed; ~ specifying how the risk and/or control mechanism will be assessed including, where applicable, sample sizes and method of selection; and ~ criteria for assessing the adequacy of specific policies, procedures and controls established to address these risks and/or control objectives;
• documenting the work performed, who performed it, how it was controlled and
  supervised, and the resulting findings, conclusions and recommendation; and _________________________________________________________________________________ Bank of Jamaica March 1996

Internal Control Page 19

• a system for reporting following-up on inspection/audit findings conclusions
  and recommendations.
  D. ROLE OF BOARD OF DIRECTORS
  The Board of Directors of each institution is ultimately responsible for ensuring that the institution is managed and operated in a safe and sound manner. In discharging this responsibility, a Board of Directors has a duty, among others to ensure that each institution has adequate and effective internal controls. At a minimum, a Board of Directors should ensure:
• that the operations of the institution are in the hands of qualified and competent
  management;
• the institution’s internal controls are appropriate and effective by:
  ~ reviewing and approving the institution’s organizational controls based on recommendations by the institution’s management; ~ periodically reviewing reports form the independent inspection/audit function to verify that the institution’s organizational and procedural controls are appropriate, in place and being complied with; and ~ reviewing any recommendations from regulators and external auditors respecting their assessment of the effectiveness of the institution’s internal controls that come to their attention in the conduct of their work; ~ that the institution has an independent audit/inspection function to monitor the effectiveness of organizational and procedural controls. A Board of Directors needs to have a means of ensuring compliance with internal controls, generally through periodic reporting by management and independent inspectors/auditors. The reports must provide sufficient information to satisfy the Board of Directors that organizational and procedural controls are in place and operating within the framework of an appropriate and effective internal control environment. E. ROLE OF MANAGEMENT The management of each institution is responsible for developing and implementing the institution’s internal controls, and the control environment within which these controls are applied, to ensure that the institution operates in a safe and sound manner. Although specific responsibilities will vary from one institution to another, management at each institution is responsible for:
  _________________________________________________________________________________ Bank of Jamaica March 1996

Internal Control Page 20
ƒ developing and recommending organizational controls for approval by the Board of Directors; ƒ implementing the organizational controls; ƒ developing and implementing the institution’s procedural controls, including the development and implementation of appropriate and effective management information systems to monitor and analyze existing and potential risks; ƒ ensuring that the organizational and procedural controls are appropriate, in place and effective; ƒ ensuring that an independent audit/inspection function reviews and assesses the effectiveness of organizational and procedural controls; and ƒ reporting comprehensively on the organizational and procedural controls to the Board of Directors. _________________________________________________________________________________ Bank of Jamaica March 1996

Internal Control Page 21
GLOSSARY
Approval Authority
The process by which a proposal to commit the institution to risk is agreed upon and by which such an authorization is translated into specific transactions. Board Committees Committees of the Board of Directors assigned to carry out specific functions to assist and advise the board in fulfilling its responsibilities. Conflict of Interest Situations wherein an individual’s personal interest may compromise, or appear to compromise, their legal and moral duties of loyalty and care; or wherein an institution’s corporate interest may compromise, or appear to compromise, its fiduciary responsibilities. Detective Controls Controls designed to provide reasonable assurance that errors and illegal acts do not go unreported. Exception Reports Reports that identify situations in which exception criteria are breached or authority limits are exceeded. These reports assist institutions to concentrate their efforts on exceptional situations. Internal Control The process, effected by an institution’s Board of Directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the safeguarding of assets and asset values, the effectiveness and efficiency of operations, the reliability of financial reporting and compliance with applicable laws and regulations. Internal Controls The policies and procedures specifically established and implemented alone or in concert with other policies or procedures to manage and control a particular risk or _________________________________________________________________________________ Bank of Jamaica March 1996

Internal Control Page 22 business activity, or combination of risks or business activities, to which the institution is exposed or engaged. Internal Control Environment The framework under which internal controls are developed, implemented and monitored. It consists of the mechanisms and arrangements that ensure internal and external risks to which the institution is exposed are identified, that appropriate and effective internal controls are developed and implemented to soundly and prudently manage these risks, and that effective systems are in place to appropriately monitor the effectiveness of these controls. Management Those persons appointed to manage the operations of an institution. Management Information Systems Those mechanisms for gathering and producing information about an institution’s business, the state of its affairs and the risks to which it is exposed, and distributing the information to appropriate individuals or groups of individuals within the institution in a form that enables them to monitor, review and act upon the information in carrying out their responsibilities. Objectives Objectives identify the specific results an institution seeks to achieve. They may pertain to the institution as a whole, or target specific activities within the institution. Usually, objectives relate to an institution’s strategic direction (target markets or business activities), financial performance (specific performance indicators), operational efficiency and the effective use of the institution’s resources. Preventive Controls Controls designed to provide reasonable assurance that errors and illegal acts do not occur. Significant Risk Risks that have a high probability of occurring and the occurrence of which is likely to have a significant impact on the institution’s ability to meet its stated objectives. _________________________________________________________________________________ Bank of Jamaica March 1996