Corporate Governance Guideline (Revised)

The purpose of this Guideline is to provide guidance to financial institutions and persons on their collective oversight and governance responsibilities as well as to emphasize key components of risk governance. March 2021 (Revised) CORPORATE GOVERNANCE GUIDELINE

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 2 of 33
DEFINITIONS ....................................................................................................................................................... 3
1.0 INTRODUCTION..................................................................................................................................... 7
2.0 PURPOSE AND SCOPE OF THE GUIDELINE ..................................................................................... 8
3.0 THE ROLE OF THE BOARD OF DIRECTORS ..................................................................................... 9
Responsibilities of the Board ............................................................................................................................ 9
Corporate Culture and Values......................................................................................................................... 11
Risk Appetite, Management and Control.......................................................................................................... 12
4.0 Board composition and qualification....................................................................................................... 14
BOARD QUALIFICATIONS AND COMPOSITION ........................................................................................ 14
Board Composition .......................................................................................................................................... 14
Board Member Selection and Qualifications ................................................................................................... 15
5.0 BOARD’S STRUCTURE AND PRACTICES ....................................................................................... 16
Organization and Assessment of the Board...................................................................................................... 16
Chairperson’s Role .......................................................................................................................................... 16
Board Committees............................................................................................................................................ 17
Audit Committee .......................................................................................................................................... 18
Risk Management Committee....................................................................................................................... 19
Nomination Committee ................................................................................................................................ 20
Compensation Committee ............................................................................................................................ 20
Other Board Committees ............................................................................................................................. 21
Conflicts of Interest .......................................................................................................................................... 21
Role of Independent Directors ......................................................................................................................... 23
6.0 THE ROLE OF SENIOR MANAGEMENT......................................................................................... 23
7.0 GOVERNANCE OF FINANCIAL GROUPS AND Financial Holding Companies.............................. 24
Parent Company Boards.................................................................................................................................. 24
Subsidiary Boards............................................................................................................................................ 25
8.0 RISK GOVERNANCE FRAMEWORK................................................................................................. 26
Risk Management Function.............................................................................................................................. 26
Risk Identification, Monitoring and Controlling.............................................................................................. 28
Risk Communication ........................................................................................................................................ 30
9.0 COMPLIANCE....................................................................................................................................... 30
10.0 INTERNAL AUDIT................................................................................................................................ 31
11.0 DISCLOSURE AND TRANSPARENCY .............................................................................................. 32
12.0 EFFECTIVE DATE ................................................................................................................................ 33
TABLE OF CONTENTS

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 3 of 33 All expressions used in this Guideline (except where defined below or where the context otherwise requires) have the same meanings as defined in relevant legislation applicable to the financial institution. For the purpose of this Guideline, the following definitions are provided:
arm’s length The condition or fact that the parties to a transaction are independent, on an equal footing and are beyond the reach of personal influence or control. board of directors/board A governing body of persons appointed or elected by shareholders. CBA Central Bank Act, Chap. 79:02. Central Bank/ Bank Central Bank of Trinidad and Tobago. conflict of interest A conflict of interest is deemed to arise if a person were to make or participate in the making of a decision in the execution of his office and at the same time knows, or ought reasonably to have known, that in the making of the decision, there is an opportunity to either directly or indirectly further his private interests, or that of a member of his family, or of any other person or company from which he stands to benefit. It also includes conflicts of duty which arise when a person is required to fulfil two or more roles that may be in conflict with each other. control functions Those functions that have a responsibility independent from business and operational functions to provide objective assessment, reporting and/or assurance. This includes the risk management function, the compliance function and the internal audit function. duty of care Every director and officer of a company shall in exercising his powers and discharging his duties (a) act honestly and in good faith with a view to the best interests of the company; and (b) exercise the care, diligence and skill that a reasonably prudent person would exercise in comparable circumstances. In determining what is in the best interest of a company, a director shall also have regard to the interests of the company’s employees in general as well as to the interests of its shareholders. duty of loyalty The duty of board members to act in good faith in the interest of the financial institution. The duty of loyalty should prevent individual board members from acting in their own interest, or the interest of another individual or group, at the expense of the entity and DEFINITIONS

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 4 of 33 shareholders. It should also prevent individual board members from engaging in transactions that might involve an appearance of conflict of interest and requires them to deal with matters with transparency. ECA Exchange Control Act, Chap. 79:50. executive director A member of the Board (e.g. director) who also has management responsibilities within the financial institution. FIA Financial Institutions Act, 2008. financial institution Refers to commercial banks and other non-banks licensed under the FIA including payment system operators; financial holding companies, (FHCs), insurance companies, agents, agencies, brokers, and brokerages registered under the IA; payment service providers registered under the CBA and persons approved to issue e-money pursuant to a Ministerial Order issued under section 17(4) of the FIA; and bureaux de change licensed under the ECA1 . IA Insurance Act 2018.2 independent director A non-executive member of the Board that meets the definition of an independent director under section 36(6)(c) of the FIA and section 68(5)(c) of the IA. internal controls A set of rules and controls governing the financial institution’s organizational and operational structure, including reporting processes, and functions for risk management, compliance and internal audit. non-executive director A member of the Board who does not have management responsibilities within the financial institution. It should be noted that an independent director is a non-executive director but a non-executive director is not necessarily independent as they may for instance be an officer of a connected party of the financial institution. parent company A parent company is one which has a controlling or majority interest in another company, which gives it the right to control the subsidiary’s operations. risk appetite The level and type of risk that an institution is willing to assume in its exposures and business activities given its business objectives and

1 Reference to legislation in this Guideline includes subordinate legislation made under the relevant statute and any amendment, re￾enactment or modification thereunder. As proclaimed on January 1, 2021 by Legal Notice 369 of 2020.

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 5 of 33 obligations to stakeholders. risk appetite framework The overall approach, including policies, processes, controls and systems, through which risk appetite is established, communicated and monitored. It includes a risk appetite statement, risk limits and an outline of the roles and responsibilities of those overseeing the implementation and monitoring of the framework. risk appetite statement3 The written articulation of its risk appetite. It includes quantitative measures expressed relative to earnings, capital, risk measures, liquidity and other relevant measures as appropriate. It should also include qualitative statements to address reputation and conduct risks as well as financial crime and unethical practices. risk culture A financial institution’s norms, attitudes and behaviours related to risk awareness, risk-taking and risk management, and controls that shape decisions on risks. Risk culture influences the decisions of management and employees during the day-to-day activities and has an impact on the risks they assume. risk governance framework The framework through which the Board and management establish and make decisions about the financial institution’s strategy and risk approach; articulate and monitor adherence to risk appetite and risk limits vis-à-vis the financial institution’s strategy; and identify, measure, manage and control risks. risk limits Specific quantitative measures or limits based on, for example, forward-looking assumptions that allocate the financial institution’s aggregate risk to business lines, legal entities as relevant, specific risk categories, concentrations and, as appropriate, other measures. risk management The processes established to ensure that all material risks and associated risk concentrations are identified, measured, monitored, controlled, and reported on a timely and comprehensive basis. risk profile Point-in-time assessment of a financial institution’s gross risk exposures (i.e. before the application of any mitigants) or, as appropriate, net risk exposures (i.e. after taking into account mitigants) aggregated within and across each relevant risk category based on current or forward-looking assumptions.

See Appendix 1.B of the Central Bank’s Internal Capital Adequacy Assessment Process (ICAAP) Guideline, November 2020 for guidance on developing a risk appetite statement.

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 6 of 33 systemically important A financial institution whose distress or disorderly failure financial institution/ SIFI4 because of its size, complexity and/or interconnectedness would threaten the smooth functioning of the financial system and the wider economy and, whose distress would place the financial system in danger of disruption, substantial damage, injury or impairment.

See Chapter 4 of the Central Bank’s 2014 Financial Stability Report, which identified those financial institutions currently designated as SIFIs. The Central Bank will also advise a financial institution whether it has been designated as systemically important in accordance with the framework for the identification of a SIFI. The five non-bank financial institutions that were deemed SIFIs by Cabinet Minute in 2013 are encouraged to adhere to this Guideline as far as practical for their operations. These are the Trinidad and Tobago Unit Trust Corporation (TTUTC), National Insurance Board (NIB), Home Mortgage Bank (HMB), Trinidad and Tobago Mortgage Finance (TTMF) and the Agricultural Development Bank (ADB).

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 7 of 33
1.0 INTRODUCTION
1.1 Effective corporate governance is essential for the proper functioning of financial institutions
and the economy as a whole. Financial institutions play a crucial role in the development and stability of every economy, as they are responsible for the efficient transfer of funds from consumers/savers to productive sectors of the economy via loans and investments. Consequently, governance weaknesses particularly in systemically important financial institutions can result in a transmission of problems to the economy as a whole. Further, the impact of good corporate governance redounds to the benefit of the financial institutions’ depositors and policyholders whose interests must be protected as, quite unlike other corporate entities that rely on shareholder equity, financial institutions depend on deposits in the case of the banking sector and policyholders’ funds in the case of insurance companies as major sources of funding.
1.2 Corporate governance is defined as a set of relationships between a company’s management,
its Board, its shareholders, and other stakeholders5 . Good corporate governance therefore, requires that the relationships among management, the Board, shareholders, regulators and other stakeholders are transparent, fair and well balanced. Corporate governance also provides the structure through which the objectives of the company are set, and the means of attaining those objectives and monitoring performance are determined.
1.3 It should be noted that appropriate organizational structures, policies and other controls help
promote, but do not ensure good corporate governance. Lapses in governance can still occur through undesirable behaviour and inappropriate corporate values. Consequently, effective corporate governance must also be driven by behavioural factors such as directors and management demonstrating ‘duty of care’ to the institution.
1.4 This Guideline represents an update to the May 2007 Corporate Governance Guideline. The
global financial crisis of 2007 - 2009 exposed several corporate governance weaknesses at financial institutions. This Guideline therefore reflects emerging best corporate governance practices6 pertaining to inter alia, strengthening a financial institution’s risk governance; greater involvement in evaluating and promoting a strong risk culture; establishing the financial institution’s risk appetite; and overseeing management’s implementation of the risk appetite and overall governance framework.
1.5 This Guideline should be read in conjunction with the Central Bank’s Fit and Proper
Guideline (Revised) October 2019.

The Organization for Economic Cooperation and Development (OECD).
The OECD; the Basel Committee for Banking Supervision “Corporate Governance Principles for Banks” 2015; and Insurance Core Principles on Corporate Governance

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 8 of 33
2.0 PURPOSE AND SCOPE OF THE GUIDELINE
2.1 This Guideline is made in accordance with section 10(b) of the FIA; section 278 of the IA;
sections 5 and 6 of the ECA; and section 36 (cc) of the CBA and applies to all financial institutions as defined in this Guideline7 .
2.2 The purpose of this Guideline is to communicate the Central Bank’s expectations with respect
to corporate governance of financial institutions that it regulates. The Central Bank also expects the Boards and senior management of financial institutions to be proactive, and to be aware of (and adopt as appropriate) best practices that are applicable to their institutions.
2.3 The Guideline seeks to reinforce the collective oversight and risk governance responsibilities
of the Board, emphasize key components of risk governance such as risk culture, and risk appetite in relation to the financial institution’s risk capacity. This Guideline also specifies roles for the Board, board committees, senior management and control functions including the person carrying out the function of a Chief Risk Officer8 (CRO) and internal audit.
2.4 The Central Bank recognizes that corporate governance structures and practices may differ
across financial institutions depending on their size, ownership structure, legislative and regulatory requirements, nature or type of institution, scope and complexity of operations, corporate strategy and risk profiles. Nonetheless, the Central Bank expects financial institutions to align their corporate governance practices with this Guideline as far as practicable. Further, financial institutions are required to ensure that their governance processes expressly comply with any corporate governance requirements stipulated in the legislation under which they are licensed or registered.
2.5 The Central Bank will review this Guideline periodically to ensure that it remains relevant
and reflects changes in international best practices, legislative amendments or occurrences in the domestic financial system.
2.6 The Central Bank may make examinations, inquiries or place restrictions or revoke the
licence or registration of the financial institution if there are safety and soundness concerns for the financial institution and/or its customers as a result of failure to adhere to the provisions of this Guideline9 .

With reference to foreign insurers, the Corporate Governance Guideline 2007 remains applicable until such time that those institutions are reorganized in accordance with section 281 of the IA. This includes an individual who may be performing the functions typically assigned to a Chief Risk Officer though they have not been designated with the title of Chief Risk Officer. In accordance with sections 23(1) or 24 and 62 of the FIA, section 10(1) Insurance Act 2018 and Section 41(1)(b) of the ECA.

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 9 of 33
3.0 THE ROLE OF THE BOARD OF DIRECTORS
3.1 The Board of directors has ultimate responsibility for promoting, approving and overseeing
management’s implementation of the financial institution’s business and strategic objectives, governance, risk management and compliance frameworks, control functions and corporate culture. The Board may delegate some of its functions, though not its responsibilities, to board committees where appropriate, subject to board oversight and ratification of key decisions that materially impact the financial institution’s operations. Responsibilities of the Board
3.2 The Board should, inter alia:
a) Ensure the development and implementation of appropriate and comprehensive governance and internal control frameworks to govern the operations of the financial institution. Such frameworks should give consideration to the long-term implications of the Board’s decisions on the financial institution, its customers, officers and the public. In addition, the framework should be periodically reviewed to ensure that it remains appropriate and in line with material changes to the financial institution’s size, complexity, business strategy, markets and regulatory requirements; b) Approve the following:
i. the frameworks or key policies for inter alia the financial institution’s capital and
capital adequacy; liquidity planning; anti-money laundering, combatting of terrorism financing and counter proliferation financing (AML/CFT/CPF); risk management; and internal controls; outsourcing; and business continuity; and oversee their implementation;
ii. policies for major business activities and operations, such as, lending,
investments, intra-group and connected party exposures, and insurance underwriting;
iii. Information technology systems that are appropriate and reinforced with a system
of checks and balances to enforce integrity of data and which are structured to enable timely critical decision-making;
iv. The annual financial statements including a requirement to conduct a periodic
independent review of critical areas; and
v. The selection of the CEO, key members of senior management and heads of the

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 10 of 33 control functions; and oversee their performance. c) Oversee material commitments including major capital expenditures, acquisitions and divestitures, and material outsourcing arrangements; d) Establish the financial institution’s risk appetite and risk limits having regard to its risk exposures and risk management capabilities, in collaboration with senior management and the CRO; e) Ensure that there is an effective system in place for compliance with all applicable laws and regulations; f) Promote, together with senior management, a sound corporate culture within the financial institution which reinforces ethical, prudent and professional behavior; g) Oversee the financial institution’s approach to compensation, including monitoring and reviewing executive compensation and assessing whether it is aligned with the financial institution’s risk culture and risk appetite; and h) Oversee the integrity, independence and effectiveness of the financial institution’s policies and procedures for whistleblowing.
3.3 In carrying out their responsibilities, members of the Board should exercise appropriate ‘duty
of care’ and ‘duty of loyalty’10 to the financial institution. Accordingly, in addition to roles and responsibilities set out in relevant legislation, the Board should understand the types of risks to which the financial institution may be exposed and the techniques used to quantify and manage those risks. This includes an understanding of operating structures, such as, special purpose vehicles or corporate trusts used as part of the financial institution’s extended business operations.
3.4 The Board should ensure that the financial institution maintains an effective relationship with
the Central Bank through regular communication, including timely notification of material issues. Such communication can occur through scheduled meetings, e-mails, telephone, video/ audio conferences or other communication methods. The purpose of such communication is to support timely and open dialogue between the financial institution and the Central Bank on a range of issues, including:
a) The financial institution’s strategies, performance, business model, risks and risk management; b) The effectiveness of corporate governance at the financial institution; c) The financial institution’s culture, management issues and succession planning,

See definitions for the terms ‘duty of care’ and ‘duty of loyalty’ in the Definitions section of this Guideline.

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 11 of 33 compensation and incentives frameworks; and d) Other supervisory findings or expectations that in the opinion of the Central Bank should be important to Board members.
3.5 The frequency of meetings between the Board and the Central Bank will be based on the
size, complexity, structure, economic significance and risk profile of the financial institution and will generally be initiated by the Central Bank, but can also be initiated by the Board, in the case of material issues. Meetings may be held between the Central Bank and the entire Board, individual Board members or Board Committees.
3.6 The Board should oversee and approve the business continuity and disaster recovery policy/
frameworks for the financial institution, including strategies for the preservation of:
a) Critical operations and services when it comes under stress; and b) Financial soundness and strength, in particular capital adequacy and liquidity.
3.7 The Board should, as necessary, challenge management and hold it to account.
3.8 The Board is expected to comply promptly and fully with requests for information from the
Central Bank as required by law.
Corporate Culture and Values
3.9 The Board should set the ‘tone at the top’ by setting and adhering to professional standards
and corporate values that promote integrity for itself, senior management, and other employees.
3.10 The Board should establish standards of business conduct and code of ethics for directors,
senior management and other personnel of the institution. Standards of business conduct should include comprehensive and adequate policies and procedures that are fair and address conflicts of interest, lending to directors, officers and employees, other forms of self-dealing, and preferential treatment to connected parties and other related entities. The code of ethics should define acceptable and unacceptable behaviours and should promote:
a) Zero tolerance for illegal activity, such as financial misreporting and misconduct, fraud, money laundering, bribery and corruption, or the violation of consumer rights; b) Expectations that employees should conduct themselves ethically and perform their job with skill and due care and diligence in addition to complying with laws, regulations and the financial institution’s policies; and c) The critical importance of timely and frank discussion and elevation of problems to higher levels within the organization. In this regard, employees should be encouraged to communicate, with protection from reprisal, legitimate concerns about illegal, unethical

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 12 of 33 or questionable practices.
3.11 The Board should oversee and approve how, and by whom, legitimate material concerns of
misconduct should be investigated and addressed; whether by an objective independent internal or external body, senior management and/or the Board itself. Risk Appetite, Management and Control
3.12 The Board should approve an Enterprise-wide Risk Framework that sets out basic goals,
benchmarks, and limits with respect to the financial institution’s risk appetite. In so doing, it should ensure proper alignment with the financial institution’s strategic, capital and financial plans, as well as, its compensation practices.
3.13 An effective risk governance framework includes a strong risk culture and well-defined
responsibilities for risk management in particular, and control functions in general. The risk framework (often referred to as the “three lines of defense”) should include well-defined organizational responsibilities for risk management that addresses the following:
a) The business line’s management of risks incurred in conducting its activities. (1st line of defense); b) The risk management and compliance functions with responsibility for monitoring the implementation of effective risk management practices by the 1 st line of defense and assisting in defining the target risk exposure and reporting adequate risk related information throughout the organization (2nd line of defense); and c) An internal audit function that checks the effectiveness of the overall governance framework. (3rd line of defense)
3.14 The risk governance framework should outline actions to be taken when stated risk limits are
breached, including disciplinary actions for excessive risk-taking, escalation procedures and notification to the Board.
3.15 The Board must ensure that managers are held responsible and accountable for ongoing
management of the financial institution’s risk. This includes ensuring that management establishes robust policies, procedures and frameworks for the identification, monitoring, assessment and reporting of risks taking into account the institution’s risk appetite and its policies, procedures and controls. Senior management and business line managers should identify and assess risks critically rather than rely only on surveillance conducted by the risk management function.
3.16 The Board should approve the financial institution’s overall compliance framework,
including any key compliance policies. The compliance and/or internal audit function should assess the extent to which policies are observed and report to senior management and, as appropriate, to the Board on how the financial institution is managing its compliance risk.

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 13 of 33 The function(s) should also have sufficient authority, stature, independence, resources, and access to the Board. The compliance and/or internal audit function should, among other things, routinely monitor compliance with laws, corporate governance rules, regulations, codes, and policies to which the financial institution is subject.
3.17 The Board should ensure that the risk management, compliance, and internal audit functions
are adequately positioned, staffed and resourced to carry out their responsibilities independently, objectively, and effectively.
3.18 An independent and effective internal audit function should provide an independent review
and objective assurance on the quality and effectiveness of the financial institution’s internal control system, the business lines, and the risk management and compliance functions.
3.19 To ensure the effectiveness of the governance framework, the Board should regularly review
key policies and controls with senior management and with the heads of the risk management, compliance and internal audit functions to identify and address significant risks and issues as well as determine areas that need improvement. Oversight of Senior Management
3.20 The Board should ensure that senior management adheres to the financial institution’s values,
risk appetite, and risk culture, under all circumstances and should hold senior management accountable for actions that are not in line with its values, risk appetite or risk culture.
3.21 The Board should meet regularly with senior management; question and critically review
explanations and information provided by senior management; and set appropriate performance and remuneration standards for senior management and key personnel that are consistent with the financial institution’s strategic objectives, culture, control environment and financial soundness. Succession Planning
3.22 Succession planning practices refer to the nomination, orientation and training of new
directors, as well as, persons identified as possible successors to senior management and for other critical functions. The Board should actively engage in succession plans for the CEO, senior management and other key positions, as appropriate.
3.23 The Board should have a documented process for identifying, nominating and retaining
qualified, fit and proper directors and senior management. For example, personal qualities such as strength of character, an inquiring and independent mind, sound judgment and attributes such as professional qualifications, technical or specialized skills and work experience should be considered.
3.24 The Board should institute a formal training program for new directors, with periodic training
to keep members apprised of relevant subject matters. The Board should also ensure that

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 14 of 33 management has a suitable training program in place for persons identified as possible successors to senior management and for other critical functions. These programs should cover, inter alia: - a) key characteristics and nature of the industry; b) the regulatory framework, including key legislation governing the financial institution’s operations; c) the institution’s strategic plans, operations and management structure; d) the control structure, including the role of the internal and external auditors; and e) the fiduciary duties and responsibilities of directors and senior managers.
3.25 Persons identified as potential successors to senior management should be familiar with the
laws, regulations, codes and guidelines governing the institution’s operations.
3.26 Persons identified in the succession plan should undergo continuous training to ensure that
they are updated on new laws, industry developments, emerging trends, products, risks and opportunities.
3.27 The Board should also consider putting a program in place for staggering the terms of
directors (unless specified in the by-laws), subject to performance and eligibility for re￾election. Staggering the terms of directors ensures that that all directors do not demit office at the same time but rather the terms of service for elected directors will vary. Elections for the directors of a staggered board will occur as terms expire.
4.0 BOARD COMPOSITION AND QUALIFICATION
BOARD QUALIFICATIONS AND COMPOSITION
4.1 The Board must comprise members of sufficient experience and expertise to facilitate
effective oversight. Board members should be and remain qualified, individually and collectively, with a sufficient breadth of understanding of the financial institution’s business for their positions. They should understand their oversight and corporate governance role and be able to exercise sound, objective judgment about the affairs of the financial institution. Board Composition
4.2 The Board should comprise a sufficient number of independent directors based on the size,
risk profile and complexity of the financial institution to ensure that it can adequately meet all

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 15 of 33 its obligations as contained in relevant legislation11. To promote proper checks and balances, the chair of the Board should be either an independent or non-executive board member.
4.3 The Board of a systemically important financial institution should comprise a majority
of independent12 and non-executive directors. (See Sections 5.32 – 5.34).
4.4 The Board must develop, document, and regularly review the criteria and skill sets required of
its members, both individually and collectively.
4.5 The Board should comprise individuals with a diversity of skills, backgrounds, experience and
expertise, who collectively possess the necessary qualifications commensurate with the size, complexity, and risk profile of the financial institution. Their skills and expertise should include, inter alia, capital markets, financial analysis, financial stability issues, financial reporting, information technology, strategic planning, risk management, compensation, regulation, corporate governance and management.
4.6 The Board should collectively have a reasonable understanding of local, regional and global
economic and market forces and of the legal and regulatory environment.
Board Member Selection and Qualifications
4.7 The Board should have a clear, rigorous and documented process for identifying, assessing
and selecting Board candidates. The selection process should include reviewing whether Board candidates:
a) possess the knowledge, skills, experience, and independence of mind (for independent directors) given their responsibilities on the Board and in light of the financial institution’s business and risk profile; b) are fit and proper; c) have sufficient time to fully carry out their responsibilities; and d) have the ability to promote smooth interaction between board members.
4.8 Board members should not have conflicts of interest that could impede their ability to perform
their duties independently and objectively and subject them to undue influence from:
a) other persons (such as management or other shareholders); b) past or present positions held; or

Such as a majority independent audit committee in accordance with section 36(1) of the FIA and 68 (1) of the IA 2018. The number of required independent directors must not be less than what is legislatively required and in the case of a SIFI should be adequate to ensure compliance with the requirements of this Guideline. In this regard, please note all the areas of this Guideline where an independent and not a non-executive director is recommended.

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 16 of 33 c) personal, professional or other economic relationships with other members of the Board or management (or with other entities within the group).
4.9 To ensure that Board members acquire, maintain and enhance their knowledge and skills, and
fulfil their responsibilities, the Board should ensure that members participate in induction programs and have access to ongoing training on relevant issues, which may involve internal or external resources.
5.0 BOARD’S STRUCTURE AND PRACTICES
5.1 The Board should define appropriate governance structures and practices for its own work,
including its Board and committee charters, and put in place the means for such practices to be followed and reviewed periodically for ongoing effectiveness. Organization and Assessment of the Board
5.2 The Board should ensure that its structure and its meetings, including the frequency of such
meetings, facilitate the time and means necessary to cover all subjects in sufficient depth and have a robust discussion of issues.
5.3 The Board should maintain and periodically review/ update organizational rules, bye-laws, or
other similar documents setting out its organization, rights, responsibilities and key activities.
5.4 The Board should conduct regular self-assessments of the entire Board and/or create an
avenue to receive feedback on its committees and individual board members, periodically review the effectiveness of its own governance practices and procedures to determine where improvements may be needed, and make any necessary changes. The Board may engage external consultants or experts to assist in, and lend objectivity to, its Board evaluations.
5.5 The Board should maintain appropriate records (e.g. meeting minutes or summaries of matters
reviewed, recommendations and resolutions made, decisions taken, and dissenting opinions) of its deliberations and decisions. These should be made available to the Central Bank when required. Chairperson’s Role
5.6 The chair of the Board should provide leadership to the Board and is responsible for its
effective overall functioning, including maintaining a relationship of trust among board members.
5.7 The chair should ensure that board decisions are taken on a reasoned and well-informed basis.
The chair should encourage discussion on key issues impacting the financial institution, and

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 17 of 33 ensure that dissenting views can be freely expressed and discussed within the decision-making process. Board Committees
5.8 A Board shall establish certain specialized board committees to increase efficiency and allow
deeper focus in specific areas13
. Examples of board committees include an Audit Committee, a Risk Management Committee, a Nomination Committee and a Compensation Committee. Of these, all financial institutions should have an Audit Committee14 . Further, all SIFIs that are licensees or registrants under the FIA or IA should establish a Risk Management Committee and Nomination Committee. Financial Holding Companies (FHCs) should establish an Enterprise Risk Management Committee.
5.9 Each committee should have a charter or other instrument that sets out its mandate, delineated
areas of authority, scope and working procedures, and should include the following:
a) Composition; b) Purpose and objectives; c) Responsibilities; d) Frequency of and attendance at meetings; e) Qualification for membership; f) Appointment and removal procedures; g) Structure and operations; h) Reporting to the Board; and i) Minimum Quorum.
5.10 The charter or terms of reference should be reviewed at least every two (2) years or more
frequently if there has been a material change warranting an earlier review.
5.11 The Board should consider the occasional rotation of members and of the chair of such
committees, as this can help avoid undue concentration of power and promote fresh perspectives and should include these requirements in its Board charter. To promote robust

13 In accordance with Section 2.1 of this Guideline this requirement will apply to a financial institution consistent with applicable legislative requirements, as well as its size, complexity and the other criteria listed in that section. Especially where required by law. It is recognized that for some institutions e.g. bureaus, intermediaries and payment service providers the size, complexity and risks may not require an Audit Committee to be established, in which case the responsibility will fall to the full board.

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 18 of 33 and open deliberations by the Board on matters referred by board committees, the chairman of the Board must not chair any board committees.
5.12 Board committees should maintain appropriate records of their deliberations and decisions
(e.g. meeting minutes or summaries of matters reviewed, recommendations and resolutions made, and decisions taken, as well as, attendance and recusals of committee members). Such records should document the committees’ fulfilment of their responsibilities and assist the Central Bank in assessing the effectiveness of these committees. Audit Committee
5.13 Each financial institution15 should establish an Audit Committee16 chaired by an independent
director and the majority of members must be independent. The CEO shall not be a member of the Audit Committee17 . Additionally, the Chairman of the Board may not chair the Committee. In establishing its Audit Committee, financial institutions are required to adhere to the requirements outlined in section 36 of the FIA and section 68 of the IA.
5.14 At a minimum, the Audit Committee as a whole should possess a collective balance of skills
and expert knowledge commensurate with the complexity of the financial institution and the duties to be performed, and should have relevant experience in financial reporting, accounting, and auditing.
5.15 The Audit Committee is responsible for inter alia:
a) framing policy on internal audits and financial reporting; b) overseeing the financial reporting process; c) providing oversight of, and interacting with, the financial institution’s internal and external auditors; d) approving, or recommending to the Board or shareholders for their approval, the appointment, remuneration or dismissal of external auditors; e) approving the appointment or termination of appointment of the head of internal audit, assessing their performance and ensuring that their primary reporting line is to the Board or the Audit Committee; f) reviewing the adequacy, effectiveness, independence, scope and results of the external audit and the institution’s internal audit function;

Where statutorily required to so do or otherwise where required by the regulator on the basis of identified risks. 16 Refer to section 157 of the Companies Act Chap 81:01 in relation to public companies, section 36(1) of the FIA and section 68(1) of the IA. 17 The CEO may be invited to Audit Committee meetings to speak on specific issues and answer specific questions, however the independence of the Audit Committee should not be impeded or circumvented through this process.

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 19 of 33 g) receiving key audit reports, as well as, examination reports from the Central Bank and ensuring that senior management is taking necessary corrective actions in a timely manner to address control weaknesses, non-compliance with policies, laws and regulations, and other problems identified by auditors, the Central Bank and other control functions; h) overseeing the establishment of accounting policies and practices by the financial institution; and i) reviewing the design, adequacy, and effectiveness of the overall risk governance framework and internal control system. Risk Management Committee
5.16 Notwithstanding section 5.8, the Central Bank may require that financial institutions other
than a SIFI establish a Risk Management Committee. A Risk Management Committee should be established based on a financial institution’s size, risk profile or complexity, and should comprise members who have experience in risk management issues and practices.
5.17 The Risk Management Committee should have an understanding of the types of risks to which
the financial institution may be exposed, the techniques and systems used to identify, measure and monitor, report, and mitigate those risks.
5.18 The Risk Management Committee is responsible for inter alia:
a) discussing all risk strategies on both an aggregated basis and by type of risk, and making recommendations to the Board on the overall current and future risk appetite; b) reviewing the financial institution’s risk framework at least annually and amending individual risk policies that it has been determined require updating to bring them in line with identified changes to the risk framework; c) ensuring that management has processes in place to promote the financial institution’s adherence to the approved risk policies; d) oversight of the strategies for capital and liquidity management as well as for all relevant risks of the financial institution, such as credit, market, operational and reputational risks, to ensure they are consistent with the stated risk appetite; e) receiving regular reporting and communication from the CRO or equivalent officer and other relevant functions about the financial institution’s current risk profile, current state of the risk culture, utilization against the established risk appetite, and limits, limit breaches and mitigation plans; and f) establishing, documenting, and maintaining adequate risk management systems and

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 20 of 33 internal controls18 .
5.19 There should be effective communication and coordination between the Audit Committee and
the Risk Management Committee where applicable, to facilitate the exchange of information and effective coverage of all risks, including emerging risks, and any needed adjustments to the risk governance framework of the financial institution. Nomination Committee
5.20 The Board of a financial institution that is considered a SIFI should establish a Nomination
Committee comprised of a majority number of independent and non-executive board members, to identify, nominate and provide recommendations on prospective new directors or new members of senior management.
5.21 The Nomination Committee makes recommendations to the Board on relevant matters relating
to inter alia:
a) the review of succession plans for directors, in particular the appointment and/or replacement of the Chairman, the CEO and senior management; b) the process and criteria for evaluation of the performance of the Board, its board committees, and directors; c) the review of training and professional development programs for the Board and its directors; and d) the appointment and re-appointment of directors (including alternate directors).
5.22 The Nomination Committee should analyze the knowledge, experience and competence of
nominees for suitability of a role on the Board and their ability to discharge responsibilities in accordance with the role.
5.23 The Nomination Committee should strive to ensure that the Board is not dominated by any
one individual or small group of individuals in a manner that is detrimental to the interests of the financial institution as a whole. Compensation Committee
5.24 The Board may establish a Compensation Committee to oversee the remuneration system’s
design and operation. The Compensation Committee should ensure that remuneration is appropriate and consistent with the financial institution’s culture, long-term business and risk appetite, performance and control environment, as well as with any legal or regulatory requirements.

18 Refer to section 37(1) of the FIA and section 72(a) of the IA.

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 21 of 33
5.25 The Compensation Committee should work closely with the financial institution’s Risk
Management Committee in evaluating the incentives created by the remuneration system. The Risk Management Committee should, without prejudice to the tasks of the Compensation Committee, examine whether incentives provided by the remuneration system take into consideration risk, capital, liquidity, and the likelihood and timing of earnings.
5.26 Where the Board chooses not to establish a Compensation Committee, the Board should
establish and document policies and procedures to discharge its duties and responsibilities effectively in the absence of a Compensation Committee. The Board must also ensure that a formal process is in place to review the framework for remuneration plans, processes and outcomes at least annually. Other Board Committees
5.27 Other specialized committees that financial institutions should consider establishing include:
a. Ethics and Compliance Committee – this committee ensures that the financial institution has the appropriate means for promoting proper decision-making, due consideration of the risks to the financial institution’s reputation, and compliance with laws, regulations and internal rules. b. Conduct Review Committee – this committee institutes procedures for reviewing transactions with connected parties, as well as, mechanisms for monitoring and reporting such transactions on a continuous basis. The procedures should ensure that all transactions are conducted at “arm’s length”.
c. Information Technology Committee – this committee will have the responsibility to
review and approve the financial institution's technology planning and strategy, as well as, monitor and evaluate existing and future trends in technology that may impact the institution’s strategic plans, including monitoring of overall industry trends. Conflicts of Interest
5.28 Conflicts of interest may arise as a result of the various activities and roles of the financial
institution or between the interests of the financial institution or its customers and those of the financial institution’s directors or senior managers. For example, where the financial institution enters into a business relationship with an entity in which one of the financial institution’s directors has a financial interest.
5.29 Conflicts of interest may also arise when a financial institution is part of a broader group. For
example, where the financial institution is part of a group, reporting lines and information flows between the institution, its parent company, subsidiaries or affiliates can lead to the emergence of conflicts of interest (e.g. sharing of potential proprietary, confidential or otherwise sensitive information from different entities or pressure to conduct business on a non-arm’s length basis).

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 22 of 33
5.30 The Board should have a formal written conflicts-of-interest policy and an objective
compliance process for implementing the policy19. The policy should include:
a) a board member and senior manager’s duty to avoid, to the extent possible, activities that could create conflicts of interest -whether actual, potential or perceived; b) circumstances which constitute or may give rise to actual, potential or perceived conflicts of interests when serving as a board member or senior manager; c) a clearly defined process for directors to keep the Board, in the case of a board member, and the financial institution, in the case of a senior manager, informed of any change in circumstances that may give rise to an actual potential or perceived conflict of interest; d) a rigorous review and approval process for board members and senior managers to follow before they engage in certain activities (such as serving on another Board) so as to ensure that such activity will not create an actual potential or perceived conflict of interest; e) a board member and senior manager’s duty to promptly disclose any matter that may result, or has already resulted, in an actual potential or perceived conflict of interest; f) a senior manager of board member’s responsibility to abstain from voting or making a decision on any matter where they may have an actual, potential or perceived conflict of interest or where their objectivity or ability to properly fulfil duties to the financial institution may be otherwise compromised; g) adequate procedures for transactions with connected parties so that they are made on an arm’s length basis; h) the way in which the any non-compliance with the policy will be dealt with; and i) lending to board members, officers and employees and other forms of self-dealing, and preferential treatment to connected parties and other favoured entities and processes should be established that allow the Board to monitor compliance with these policies and ensure that deviations are reported to an appropriate level of management.
5.31 The Board should:
a) oversee and be satisfied with the process by which information relating to the financial institution’s policies on actual, as well as, potential and perceived conflicts of interest is disclosed in accordance with applicable legislative requirements; b) ensure that the Central Bank is informed of the financial institution’s policies on actual, as well as, potential and perceived conflicts of interest of directors and senior

19 These requirements must be read in conjunction with the requirements in the Fit and Proper Guideline.

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 23 of 33 management.
Role of Independent Directors
5.32 The presence of independent directors in sufficient numbers on a Board is intended to
provide adequate checks and balances to ensure that financial institutions operate in a safe and sound manner and that the interests of the institution are protected.
5.33 Independent and non-executive directors should meet at least annually with the external
auditor and the heads of the internal audit, compliance, and legal functions. These meetings should be held in the absence of, the CEO, executive directors and other executive level personnel. This can strengthen the ability of a financial institution’s Board to oversee management’s implementation of the Board’s policies and to ensure that a financial institution’s business strategies and risk exposures are consistent with risk parameters.
5.34 An independent director must immediately disclose to the Board any change in their
circumstances that may affect their status as an independent director. In such cases, the Board must review their designation as an independent director and notify the director in writing of its decision to affirm or change his/her designation. The Board should notify the Central Bank of the change in status of an independent director, including the rationale for the decision within 20 business days of the disclosure by the director.
6.0 THE ROLE OF SENIOR MANAGEMENT
6.1 Under the direction and oversight of the Board, senior management should carry out and
manage the financial institution’s activities in a manner consistent with the business strategy, risk appetite, remuneration and other policies approved by the Board.
6.2 Senior management is responsible and accountable to the Board for the sound and prudent
day-to-day management of the financial institution.
6.3 Senior management is responsible for delegating duties to staff and should establish a
management structure that promotes accountability and transparency throughout the financial institution.
6.4 Senior management should keep the Board regularly and adequately informed of material
matters, including:
a) proposed changes in business strategy, risk strategy/risk appetite; b) the financial institution’s performance and financial condition;

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 24 of 33 c) breaches of risk limits or compliance rules; d) internal control failures; and e) legal or regulatory concerns and the remedial actions taken to address them.
7.0 GOVERNANCE OF FINANCIAL GROUPS AND FINANCIAL HOLDING
COMPANIES
7.1 In a group structure, the Board of the parent company has the overall responsibility for the
establishment and operation of a clear corporate governance framework appropriate for the structure, business and risks of the group and its entities. The parent company may be a regulated financial institution or a financial holding company established either under the FIA or IA, and may or may not have cross-border subsidiaries. Parent Company Boards20
7.2 The Board of the parent company should be aware of the material risks and issues that might
affect both the financial institution as a whole and the group’s subsidiaries. It should exercise adequate oversight over subsidiaries while respecting the independent legal and governance responsibilities that might apply to them.
7.3 In order to fulfil its responsibilities, the Board of the parent company should inter alia:
a) ensure that the group’s corporate governance framework includes adequate policies, processes and controls and that the framework addresses risk management across the businesses and legal entity structures; b) ensure that the differences in the operating environment, including the legal and regulatory regime for each jurisdiction in which the group has a presence, are properly understood and reflected in the group structure; c) ensure that the group’s governance framework clearly defines roles and responsibilities for the oversight and implementation of group-wide policies; d) ensure that the group’s corporate governance framework includes appropriate processes and controls to identify and address potential intragroup conflicts of interest, such as those arising from intragroup transactions;

This section sets out the expectations for parent company boards in Trinidad and Tobago.

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 25 of 33 e) approve policies and clear strategies for establishing new structures and legal entities, and ensure that they are consistent with the policies and interests of the group; f) assess whether there are effective systems in place to facilitate the exchange of information among the various entities, to manage the risks of the separate subsidiaries or group entities, as well as of the group as a whole, and to ensure effective supervision of the group; g) have sufficient resources to monitor the compliance of subsidiaries with all applicable legal, regulatory and governance requirements; h) maintain an effective relationship with both the Central Bank and through the subsidiary board or direct contact, with the regulators of all subsidiaries; and i) establish an effective internal audit function that ensures audits are being performed within or for all subsidiaries and part of the group and group itself. Subsidiary Boards21
7.4 While parent companies must exercise oversight of the activities of subsidiaries, the Board of
the subsidiary retains its overall corporate governance responsibilities for the legal entity. Subsidiary boards should:
a) apply methods and procedures that support the effectiveness of risk management at a group level; b) understand the reporting obligations it has to the parent; c) assess the compatibility of group policies with local legal and regulatory requirements and where appropriate, amend those policies; d) make necessary adjustments where a group policy conflicts with an applicable legal or regulatory provision or prudential rule, or would be detrimental to the sound and prudent management of the subsidiary; and e) provide the Central Bank with such information and in such form as would enable the Central Bank to satisfy itself that the subsidiary’s operations are subject to adequate oversight.
7.5 While parent companies should conduct strategic, enterprise-wide risk management and
prescribe corporate risk policies, subsidiary management and Boards should have appropriate input in their local or regional application and assessment of local risks. Parent companies should ensure that the subsidiary understands the reporting obligations it has to the head

This applies to regulated subsidiaries in Trinidad and Tobago with either a local or foreign financial institution as a parent.

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 26 of 33 office.
7.6 Where a regulated subsidiary is significant, due to its risk profile or systemic importance or
due to its size relative to the parent company, the Board of the significant subsidiary should take such further steps as are necessary to help the subsidiary meet its own corporate governance responsibilities and the legal and regulatory requirements that apply to it.
8.0 RISK GOVERNANCE FRAMEWORK
Risk Management Function
8.1 The risk management framework must enable the identification, measurement, and
continuous monitoring of all relevant and material risks on an institution and group-wide basis. This should be supported by robust management information systems that facilitate the timely and reliable reporting of risks and the integration of information across the institution. The sophistication of the financial institution’s risk management framework must keep pace with any changes in the institution’s risk profile (including its business growth and complexity) and the external risk environment.
8.2 The risk management function complements the business line’s risk activities through its
monitoring and reporting responsibilities.
8.3 Financial institutions22 should have an effective independent risk management function,
under the direction of a CRO or equivalent officer, with sufficient stature, independence, resources and access to the Board.
8.4 Financial groups should appoint a group CRO at the level of the parent company who will
have overall responsibility for the financial group’s enterprise risk management function. A SIFI that is not part of a financial group must appoint a CRO. Financial institutions that the Central Bank determines to be large and/or complex, but not designated a SIFI are also expected to have a CRO.
8.5 The independent risk management function is responsible for overseeing risk-taking
activities across the enterprise and should have authority within the organization to do so. Key activities of the risk management function should include inter alia:
a) identifying and assessing material individual, aggregate and emerging risks, and measuring the financial institution’s exposure to them;

Where financial institutions are considered small and non-complex and do not have the capacity to facilitate a separate risk￾management function, it may be combined with the compliance function.

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 27 of 33 b) subject to the review and approval of the Board, developing and implementing the enterprise-wide risk governance framework, which includes the financial institution’s risk culture, risk appetite and risk limits; c) assessing the accuracy of any risk information or analysis provided by business lines in order to provide objective reporting to the Board, the Risk Committee and senior management; d) ongoing objective monitoring of the risk-taking activities and risk exposures in line with the Board approved risk appetite, risk limits and corresponding capital or liquidity needs (i.e. capital planning); e) establishing an early warning or trigger system for breaches of the financial institution’s risk appetite or limits; f) influencing and when necessary, challenging decisions that give rise to material risk; and g) reporting to senior management and the Board or Risk Management Committee on all these items, including but not limited to proposing appropriate risk-mitigating actions.
8.6 The risk management function should have a sufficient number of employees who possess
the requisite experience and qualifications, including market and product knowledge as well as command of risk disciplines.
8.7 To avoid conflicts of interest, individuals who operate at a decision making level in the
financial institution’s risk management function, should not be placed nor place themselves in a position of real or perceived conflict of interest with regards to accounts, or relationships for which they previously held line responsibility or participated in business decision making or the approval process. Role of the CRO 23
8.8 The CRO has primary responsibility for:
a) overseeing the development and implementation of the financial institution’s risk management function or the risk management framework across the entire group as applicable. This includes the ongoing strengthening of staff skills and enhancements to risk management systems, policies, processes, quantitative models, and reports as necessary to ensure that the financial institution’s risk management capabilities are sufficiently robust and effective to fully support its strategic objectives and all of its risk￾taking activities; b) supporting the Board in its engagement with and oversight of the development of the

This also applies to the Group CRO where applicable.

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 28 of 33 financial institution’s risk appetite and for translating the risk appetite into a risk limits structure; and c) managing and participating in key decision-making processes (e.g. strategic planning, capital and liquidity planning, new products and services, compensation design and operation).
8.9 The CRO should be independent from operational management and have duties distinct from
other executive functions. The CRO should not have management or financial responsibility related to any operational business lines or revenue-generating functions (e.g. the chief operating officer, chief financial officer, chief auditor or other senior manager should in principle not also serve as the CRO).
8.10 The CRO should have unfettered access and a functional reporting line to the Board or the
Risk Management Committee. Interaction between the CRO and the Board and/or Risk Management Committee should occur regularly, with and without executive directors being present. The reporting lines must therefore be established to appropriately reflect the importance of the role and accountability of the CRO. The CRO must be positioned at a sufficiently senior level within the organization to enable risk considerations to be raised directly with the Board and senior management and duly taken into account in Board and management decisions.
8.11 Appointment, dismissal and other changes to the CRO position should be approved by the
Board or its Risk Management Committee. The CRO’s performance, compensation, and budget should be reviewed and approved by the Risk Management Committee or the Board, and should not be linked to the performance of specific business lines of the financial institution. Risk Identification, Monitoring and Controlling
8.12 Risks should encompass all material risks to the financial institution and should be identified,
monitored, and controlled on an ongoing enterprise-wide and individual entity basis. The sophistication of the financial institution’s risk management and internal control infrastructure should keep pace with changes to the institution’s risk profile, as well as to the external risk landscape and industry practice.
8.13 Risk identification and measurement should include both quantitative and qualitative
elements.
8.14 As part of its quantitative and qualitative analysis, the financial institution should utilize
stress tests and scenario analyses, to better understand potential risk exposures under a variety of adverse circumstances.
8.15 The results of stress tests and scenario analyses should be communicated to and given
appropriate consideration by relevant business lines and individuals within the financial

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 29 of 33 institution.
8.16 The risk management function should keep the Board and senior management apprised of the
assumptions used in and potential shortcomings of the financial institution’s risk models and analyses.
8.17 Senior management should define and approve and, as applicable, the Board should review
and provide effective challenge to the scenarios that are used in the financial institution’s risk analyses. While tools such as external credit ratings or externally purchased risk models and data can be useful as inputs into a more comprehensive assessment, financial institutions are ultimately responsible for the assessment of their risks.
8.18 Internal controls are designed, among other things, to ensure that each key risk has a policy,
process, or other measure, as well as a control to ensure that such policy, process or other measure is being applied and works as intended.
8.19 The Board and senior management should give special attention to the quality, completeness,
and accuracy of the data used to make risk decisions.
8.20 The risk management function should be designed to report material exceptions to the Board
and monitor the positions to ensure that they remain within the financial institution’s framework of limits and controls or within exception approval.
8.21 Financial institutions should have risk management and approval processes for new or
materially different products or services, which should be in accordance with Central Bank’s Guideline for the Notification of New or Materially Different Banking Products or Services and the Guideline for the Approval of New or Significantly Amended Insurance Policies. Generally, risk management and approval processes should also be in place for expanded lines of business and markets, as well as for large and complex transactions that require significant use of resources or have hard-to-quantify risks.
8.22 Financial institutions should also have review and approval processes for outsourcing their
functions. The risk management function should provide input on risks as part of such processes and on the outsourcer’s ability to manage risks and comply with legal and regulatory obligations. Such processes should be in accordance with relevant laws or guidelines issued by the Central Bank.
8.23 Effective risk identification and measurement approaches are also necessary in subsidiary
institutions and affiliates. Material risk-bearing affiliates and subsidiaries should be captured by the enterprise-wide risk management system and should be a part of the overall risk governance framework.
8.24 Mergers and acquisitions, divestitures and other changes to a financial institution’s
organizational structure can pose special risk management challenges. In particular, risks can arise from conducting due diligence that fails to identify post-merger risks or activities

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 30 of 33 conflicting with the financial institution’s strategic objectives or risk appetite. Risk Communication
8.25 An effective risk governance framework requires robust communication within the financial
institution about risk, both across the organization and through reporting to the Board and senior management.
8.26 Senior management should actively communicate and consult with the control functions on
management’s major plans and activities so that the control functions can effectively discharge their responsibilities. Information should be communicated to the Board and senior management in a timely, accurate, understandable, and objective manner so that they are equipped to take informed decisions.
8.27 Financial institutions must establish risk monitoring and reporting requirements across the
group. These should include the development and use of key risk indicators to provide early warnings on adverse risk developments to ensure institutions are able to manage and mitigate their risks in a timely manner. Risk monitoring and reporting should be performed at the business unit and portfolio level, as well as, at the institution-wide and group-wide levels. Material risk-related ad hoc information that requires immediate decisions or reactions should be promptly presented to senior management and, as appropriate, the Board, the responsible officers, and where applicable, the heads of control functions so that suitable measures and activities can be initiated at an early stage.
8.28 Risk reporting systems should be clear about any deficiencies or limitations in risk estimates,
as well as any significant embedded assumptions (e.g. regarding risk dependencies or correlations).
9.0 COMPLIANCE
9.1 The Board is responsible for ensuring that a compliance function is established for the
purpose of ensuring that the financial institution operates with integrity and in compliance with applicable laws, regulations and internal policies. The Board should also approve the financial institution’s policies and processes for identifying, assessing, monitoring, and reporting and advising on compliance risk.
9.2 Senior management is responsible for ensuring that a compliance policy is established that
contains the basic principles and explains the main processes by which compliance risks are to be identified and managed through all levels of the institution. The compliance policy should be approved by the Board.

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 31 of 33
9.3 The compliance function should:
a) monitor legislative developments and keep the Board and senior management apprised of the impact on the institution’s operations; b) monitor the institution’s compliance with laws, and regulations, regulatory guidelines and internal policies, and assess the extent to which compliance is being observed and report to senior management and to the Board; and c) help educate staff about compliance issues, act as a contact point within the financial institution for compliance queries from staff members, and provide guidance to staff on the appropriate implementation of applicable laws, rules and standards in the form of policies and procedures, and other documents such as compliance manuals, internal codes of conduct, and practice guidelines.
9.4 The compliance function must have sufficient authority, stature, independence, resources and
access to the Board. Senior management should respect the independent duties of the compliance function and not interfere with their fulfilment.
10.0 INTERNAL AUDIT
10.1 An effective and efficient internal audit function regularly reports an independent assurance
to the board of directors and senior management on the quality and effectiveness of a financial institution’s internal control, risk management, compliance and governance systems and processes. It assesses whether the internal controls in the institution are working effectively, all of which ultimately assures the Board of the long-term soundness of the financial institution.
10.2 The internal audit function should have a clear mandate, be accountable to the Board and be
independent of the audited activities. It should have sufficient standing, skills, resources and authority within the financial institution to enable the auditors to carry out their assignments effectively and objectively.
10.3 The Board and senior management contribute to the effectiveness of the internal audit
function by:
a) requiring the function to independently assess the effectiveness and efficiency of the internal control, risk management and governance systems and processes; b) requiring the function to be provided with full access to all records, data, systems and processes;

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 32 of 33 c) requiring the function to adhere to domestic and international professional standards; d) requiring timely and effective correction of audit issues by senior management; e) requiring the function to perform a periodic assessment of the financial institution’s overall risk governance framework, including but not limited to an assessment of:
i. the effectiveness of the risk management and compliance functions;
ii. the quality of risk reporting to the Board and senior management; and
iii. the effectiveness of the financial institution’s system of internal controls.
f) ensuring that internal audit reports are provided to the Board or its audit committee without management filtering and that the internal auditors have direct access to the Board or the Board’s audit committee; g) ensuring that the head of the internal audit function’s primary reporting line is to the Board (or its Audit Committee), which is also responsible for the selection, oversight of the performance, and if necessary, dismissal of the head of this function; and h) ensuring that if the internal auditor is removed from their position, the Central Bank should be immediately notified together with the reasons for such removal.
11.0 DISCLOSURE AND TRANSPARENCY
11.1 The governance of the financial institution should be adequately transparent to its
shareholders, depositors, policyholders, other relevant stakeholders and market participants.
11.2 The objective of transparency is to provide all relevant parties with the information necessary
to enable them to assess and monitor the effectiveness of the Board and senior management in governing the financial institution.
11.3 All financial institutions should disclose relevant and useful information that supports the key
areas of corporate governance. Such disclosure should be proportionate to the size, complexity, structure, economic significance, and risk profile of the financial institution.
11.4 Disclosure should include, but not be limited to, material information on the financial
institution’s objectives, organizational and governance structures and policies, major share ownership and voting rights, and connected party transactions.
11.5 The financial institution should disclose key points concerning its risk exposures and risk

Corporate Governance Guideline March 2021
Central Bank of Trinidad and Tobago Page 33 of 33 management strategies without breaching necessary confidentiality. When involved in material and complex or non-transparent activities, the financial institution should disclose adequate information on their purpose, strategies, structures, and related risks and controls.
11.6 Disclosure should be accurate, clear and presented such that shareholders, depositors,
policyholders, other relevant stakeholders and market participants can consult the information easily. Timely public disclosure is desirable on a financial institution’s public website, in its annual and periodic financial reports, or by other appropriate means.
11.7 Financial institutions should have an annual corporate governance-specific and
comprehensive statement in a clearly identifiable section of the annual report depending on the applicable financial reporting framework.
11.8 All material developments that arise between regular reports should be disclosed to relevant
stakeholders as required by law and to the Central Bank without undue delay.
12.0 EFFECTIVE DATE
12.1 This Guideline will come into effect upon its issuance. However, financial institutions will be
allowed a transition period of up to one year to implement and/or update all relevant policies and procedures or effect any required organisational changes as set out in the Guideline.
12.2 Notwithstanding the timeframe given to comply in 12.1, the financial institution is required to
conduct a review of the Guideline, consider the areas of non-compliance and have in place a board approved action plan, to address identified deficiencies within 6 months of the date of issue of the Guideline. The action plan must be made available to the Inspector of Financial Institutions upon request.
12.3 New financial institutions seeking to be licensed or registered after the date of issuance of this
Guideline must comply with this Guideline from the date of its licensing or registration.