Standard of Best Practice for Effective Corporate Governance of Deposit-Taking Entities

Standard of Best Practice for
Effective Corporate Governance of Deposit-Taking Entities © Bank of Jamaica All Rights Reserved July 2008

Section I. Definition and Purpose
Introduction and Definition

1. The long-term success of any institution is dependent on several factors including a sound
   business strategy, quality assets, a market for its products and services, access to capital and a sound system of internal controls and risk management. Central to all these factors is a robust corporate governance framework.
2. The Organization for Economic Co-operation and Development (OECD)1
   defines corporate governance as involving “a set of relationships between a company’s management, its board, its shareholders and other stakeholders. Corporate governance also provides the structure through which the objectives of the company are set and the means of attaining those objectives and monitoring performance are determined. Good corporate governance should provide proper incentives for the board and management to pursue objectives that are in the interests of the company and shareholders and should facilitate effective monitoring.”
3. Sound corporate governance is critical for deposit-taking institutions (DTIs) in particular, given
   the pivotal role they play in a country’s economic development in:
   a. Facilitating the efficient movement of funds between savers and investors i.e., facilitating effective intermediation; b. Providing financial services and access to a wide cross-section of the population; and
   c. Facilitating access to the payment systems.
   Although DTIs, like other companies, utilise their capital to support operations, most of the funds put at risk are not their own, but belong to their creditors, in particular depositors. DTIs therefore have a fiduciary responsibility to protect depositors’ funds and the successful execution of this responsibility is largely dependent on how well these entities are governed. The failure of a deposit-taking financial institution, as a consequence of poor governance will affect not only its own depositors and stakeholders, but may also have a contagion impact on the banking sector as a whole which may threaten the stability of the entire financial system. SBP Corporate Governance Page 1 of 38 Bank of Jamaica

The Organization for Economic Development (OECD) is an international organization formed to provide a forum for governments to compare and exchange policy experiences, identify good practices and promote decisions and recommendations. The mission of the OECD is to help governments and society reap the full benefits of globalization, while tackling the economic, social and governance challenges that can accompany it. There are currently thirty (30) member countries. July 2008

4. The fundamental objectives of corporate governance in financial institutions are to ensure
   effective and proper strategic guidance of the entity, to establish a balance of power between the institution’s governing and controlling bodies and to ensure that the organization is operating in a safe and sound manner. It therefore focuses on the quality of oversight and direction provided primarily by the shareholders, board and management - and the relationships among these groups. Other key elements of sound corporate governance involve :
   a. Establishing well articulated objectives and corporate values; b. Setting and enforcing clear assignment of responsibilities, decision-making authority and accountabilities that are appropriate for the entity’s risk profile;
   c. Placing constraints on management power and ownership concentration while
   simultaneously providing incentives to board, management and employees to act in the best interest of the company, its depositors and shareholders; d. Establishing strong risk management and internal control systems; e. Ensuring transparency and appropriate information flows internally, as well as to the regulator and the public.

5. Good governance plays a crucial role in achieving and preserving public trust and confidence in
   the deposit-taking system, which is essential for the proper functioning of the financial sector and the economy as a whole. It is also a major determinant in the maximization and maintenance of the value of the entity’s shares and allows for efficient and effective regulation.

6. Deposit-taking businesses are inherently risky as they take in deposits, primarily on demand,
   and on-lend them, largely on a long-term basis without the certainty of repayment. With the advent of globalisation, innovations in financial products and channels of delivery, technological advances, growing competitiveness and complexity of financial operations, the risks to which these entities are exposed have significantly increased, simultaneously heightening the need for good governance. SBP Corporate Governance Page 2 of 38 Bank of Jamaica July 2008

7. Further, the growing trend towards the establishment of DTIs within conglomerate structures,
   which in many instances extend beyond geographical borders, has led to the blurring of responsibilities and accountabilities within the governance framework for the group. These structures sometimes heighten risk exposures and pose significant challenges to effective governance.

8. Fundamental deficiencies within the governance framework evidenced in several corporate
   failures (such as ENRON and WORLDCOM), have led to an increased demand for corporate governance enhancements within corporations, including financial entities. The OECD and the Basel Committee2 are two international organizations that have since issued minimum principles for effective corporate governance, whilst other standard setters and local jurisdictions have been similarly enhancing requirements for effective governance of entities. Consequently, new initiatives and requirements have evolved such as:
   a. Incorporating corporate governance variables into credit rating methodologies; b. Legislating the accountability of Board of Directors and corporate officers, including provisions for facing criminal charges for breaches of their fiduciary responsibility;
   c. Restricting, and in certain instances, prohibiting company lending to senior executives;
   d. Increasing representation of independent, non-executive directors on company/entity boards and in particular on critical board committees (e.g. Audit) to enhance the effectiveness and the independence of the oversight function. For example, in 2002, the USA promulgated a significant statute, the Sarbanes-Oxley Act, to codify enhanced standards of governance for all US public companies. The Sarbanes-Oxley Act establishes specific requirements for boards, management and public accounting firms and seeks to address governance issues such as auditor independence, internal control assessment and financial disclosures. Notable requirements include:
   a. Mandating the establishment of a Board Audit Committee, comprising solely independent directors; SBP Corporate Governance Page 3 of 38 Bank of Jamaica

The Basel Committee is a group of bank supervisors taken from thirteen (13) countries (mostly G-7). The Committee provides a forum for regular co￾operation on bank supervisory matters and develops guidelines and supervisory standards where they are considered desirable. July 2008

b. Requiring the CEO and CFO to certify the accuracy of corporate financial reports;
c. Requiring CEO/CFO and auditors to confirm the effectiveness of internal controls for
financial reporting.
Purpose and Scope
9. Over the years, the Bank of Jamaica has issued to licensed DTIs several Standards of Best
Practice/Guidelines which emphasize the role and responsibilities of directors and senior officers in the management of specific areas of risk (refer to Appendix I for a complete list of Standards of Best Practice/Guidelines issued by the BOJ to date). This Standard of Best Practice for the Effective Corporate Governance of Deposit-Taking Entities however, serves as the comprehensive overarching governance standard which seeks to communicate the minimum expectations of the Supervisory Authority regarding the corporate governance framework to be established within licensed DTIs.
10. This Standard addresses the role and responsibilities of the key players in the execution of
governance within a DTI, i.e., the Board of Directors, senior management and the independent oversight functionaries. Although shareholders’ rights and other issues relevant to shareholders are not given focus in this document, entities are expected to be fully aware of and compliant with the relevant legislations, and other rules and guidance issued by relevant bodies to address these issues. These include the Companies Act, as well as rules and guidance issued by other bodies including the Financial Services Commission (FSC), the Jamaica Stock Exchange (JSE), and the Private Sector Organization of Jamaica (PSOJ).
11. The Standard will be reviewed periodically and amended as deemed necessary to ensure its
continued relevance and consistency with local statutes and international best practice standards. SBP Corporate Governance Page 4 of 38 Bank of Jamaica July 2008

Role of the Supervisory Authority in Corporate Governance
12. A key role of the Supervisory Authority is to promote strong corporate governance within
deposit-taking entities. This is achieved through the articulation of minimum expectations (via this Standard) and by reviewing and evaluating:
a. The adequacy and appropriateness of - i) The institution’s corporate governance policies and practices; ii) The implementation of corporate governance policies and practices; iii) The organizational structures that include appropriate checks and balances; b. The expertise and integrity of proposed directors and management (fit and proper assessment) which includes, but is not limited to the contribution of each individual’s skills and experience to the safe and sound operation of the DTI;
c. Whether there exist effective mechanisms through which the board and senior management
execute their oversight responsibilities. This includes assessing the quality of board deliberations and reports, internal and external audit, risk management and compliance functions.
13. The board and management must therefore remain fully cognizant of the regulatory framework
and environment in which it operates by:
a. Remaining continually aware of statutory and prudential requirements, including the Standards and Guidance Notes issued by the Supervisory Authority; b. Being fully abreast of the findings of the on-site examinations, as well as other material issues raised by the Bank of Jamaica through its ongoing regulation and supervision of each licensee. Where necessary, board and management should obtain further clarification on noted deficiencies;
c. Ensuring that there is appropriate and timely follow-up of noted deficiencies and
recommendations emanating from the Supervisory Authority and that appropriate remedial actions are taken in a timely manner; d. Maintaining open and frank dialogue with the Supervisory Authority, accurately disclosing information pertinent to the oversight of the institution. SBP Corporate Governance Page 5 of 38 Bank of Jamaica July 2008

Section II. Application
14. This Standard is applicable to the following financial institutions (and the groups to which they
belong) which carry on activities in Jamaica and are supervised by the Bank of Jamaica:
a. Commercial banks licensed under the Banking Act; b. Financial institutions licensed under the Financial Institutions Act;
c. Building societies licensed under the Building Societies Act.
Section III. Legal Status
15. This Standard does not by itself have the force of law. However, direct contravention or non￾observance by licensees would be regarded by the Bank of Jamaica as evidence of “unsafe and
unsound” business practices. Institutions should, in that regard, be aware of the specific provisions of Section 25(1) of the Banking Act/Financial Institutions Act, and Regulation 64 of the Bank of Jamaica (Building Societies) Regulations, which give the Bank of Jamaica the authority to administer varied measures against an institution for inter alia, contravention of the Standards issued by the Supervisory Authority. SBP Corporate Governance Page 6 of 38 Bank of Jamaica July 2008

Section IV. Minimum Standards for Effective Corporate Governance
Standard I: The corporate governance framework of a deposit-taking institution should be appropriate to and commensurate with the size and complexity of the entity. The framework should, at a minimum, allow for the establishment of a competent board of directors (including independent directors who add value in specific areas), senior management team and independent oversight functions, and the means by which these individuals are held accountable for the governance of the entity. The Board of Directors Overview
16. Each DTI should ensure the appointment of a Board of Directors to provide effective leadership
and oversight of the entity. While the board may delegate the day-to-day running of the institution to the executive management team, it is ultimately responsible for the safe and sound operation of the financial entity. The board should therefore ensure that its members are qualified to carry out their responsibilities. Equal to the responsibility for ensuring maximization of shareholder value, are other primary responsibilities that must be fulfilled by the board, including:
a. Safeguarding the interests of depositors; b. Defining the risk appetite of the institution while setting the overall tone and direction of the entity through the establishment of sound strategies, values and culture;
c. Establishing policies and monitoring adherence to those policies;
d. Ensuring that an effective management team is in place, that is directly accountable to the board; e. Defining clearly the authorities, responsibilities and accountabilities for all key players within the governance framework of the entity.
17. The hallmarks of effective corporate governance by the board are, inter alia:
a. An ability to make decisions that strike a reasonable balance between business objectives and risk management and control functions; b. Responsiveness to issues or deficiencies identified by the regulators, independent oversight functions, management and self evaluations; SBP Corporate Governance Page 7 of 38 Bank of Jamaica July 2008

c. Appropriate and timely decision-making based on the best information; and
d. Periodic review of the adequacy and frequency of information needed to fulfill responsibilities. Composition and Structure of the Board
18. The composition and size of the board must be consistent with local statutory and regulatory
requirements, the entity’s own bylaws, as well as the size and complexity of the institution. The Supervisory Authority requires that the board of all licensees should, at a minimum: - a. Comprise at least five (5) members, with a sufficient number of independent directors to ensure that the entity carries out its mandate. International best practices require that two￾thirds of an entity’s board comprise independent3 non-executive directors; b. Separate the roles of Chairman and Chief Executive Officer. Separation of the two posts is regarded as good practice as it contributes to achieving an appropriate balance of power, it increases accountability and improves the board’s capacity for decision-making, independent of management;
c. Possess collective knowledge, competence and expertise to fully understand the nature of
the financial institution’s material activities and associated risks. Further, the board should ensure that each individual member adds value to board deliberations and decision-making; d. Establish appropriate board sub-committees (refer to paragraph 25) to provide advice and support, assuming responsibility for matters that require more detailed and frequent review and thereby directly contributing to the board’s independent oversight function. At a minimum, the Supervisory Authority requires the establishment of an Audit Committee (refer to paragraphs 27-28), consistent with international best practices. e. It is emerging practice for deposit-taking entities to also have the following committees:
i) Risk management committee ii) Nominations committee iii) Compensation committee
19. The board should be capable of exercising judgment independent of the views of management,
political interests or inappropriate outside interests. Specifically, the board of directors has a responsibility to protect the DTI from illegal or inappropriate actions or influences of dominant or SBP Corporate Governance Page 8 of 38 Bank of Jamaica

3 The key characteristic of independence is the ability to exercise sound judgment after fair consideration of all relevant information and views without undue influence from management or inappropriate outside interests. July 2008

controlling shareholders that are detrimental to the prudent management of the entity or not in the best interest of depositors, the entity itself or its wider base of shareholders. Appointment, Evaluation and Removal of Board Directors
20. The board should implement a formal rigorous and transparent process for the nomination,
evaluation and removal of board members. The board has the responsibility for ensuring that:
a. Appointments are made on merit and against objective criteria. In that regard, the board should clearly demonstrate that due consideration has been given to the competencies and experience of proposed members to contribute to the cohesiveness and strengthening of the board as a whole. Importantly, the board should ensure that fit and proper assessments are conducted for proposed members, consistent with the process undertaken by the BOJ and as outlined in the “BOJ’s 2004 Fit and Proper Guidelines”; b. Formal advice and requisite submissions (refer to BOJ’s 2004 Fit and Proper Guidelines) are provided to the Supervisory Authority prior to appointment of proposed board members to facilitate the Authority’s conduct of fit and proper assessments in accordance with
Section 4(3) of the Banking Act/Financial Institutions Act and Regulation 8(b)(3) of the
BOJ (Building Societies) Regulations;
c. Formal letters are presented to directors upon appointment, which set out the key terms and
conditions of appointment and the responsibilities of the board as a whole (refer Appendix II for suggested Contents of Letters of Appointment). In this regard, the Bank of Jamaica recommends that such terms of reference address issues such as ethical codes of conduct, defined limits re: rotation and re-election of board members and any restriction on the number and types of other board memberships a board member may accept - as prospective board members should have adequate time available to devote to the job. In cases where directors are offered external appointments, this should be communicated to the board prior to the acceptance of that appointment; d. Formal advice is to be provided to the Supervisory Authority on the resignation/removal of board members. (Refer Section 4(4)(c) of the Banking and Financial Institutions Acts and
Section 8B(5)(c) of the Building Societies Act).
SBP Corporate Governance Page 9 of 38
Bank of Jamaica
July 2008

21. The board is expected to undertake a formal annual evaluation4
    of its own performance and that of its committees and individual directors to ensure the maintenance of balance of skills, knowledge and experience within the context of the nature of the financial institution’s operations/activities. The evaluation process should involve an assessment of whether each director continues to contribute effectively and remain committed with respect to time allocated for board and committee meetings and any other duties.
22. The board or some other appropriate board committee should establish policies and procedures to
    govern the removal/resignations of members from the board. These policies must be established on the principles of transparency, objectivity and independence5 . At a minimum, the policies should establish:
    a. Minimum notice required for resignations from the board (taking into consideration the extent of the due diligence process that must precede appointments); b. Conditions for removal from the board. These should critically include failure to satisfy the fit and proper criteria established by law6 (e.g. convicted of an offence involving dishonesty);
    c. Requirement for the Supervisory Authority to be immediately notified of
    removals/resignations, as well as the reasons for such actions.
    Board Meetings and Deliberations
23. The frequency of board meetings should depend on circumstances such as the nature and size of
    the entity’s operations, the governance structure (e.g. the number of board sub-committees and the scope of their responsibilities and frequency of meetings held), the current financial condition of the entity, as well as the current internal and external environment and its impact on the entity’s affairs. The Supervisory Authority requires however that, at a minimum, full board meetings of all deposit-taking entities be held on at least a quarterly basis. This is distinct from the various (and more frequently held) board sub-committee meetings. SBP Corporate Governance Page 10 of 38 Bank of Jamaica

4 Refer to the Combined Code on Corporate Governance – Suggestions for good practice from the Higgs report. 5 Refer CA 2004 Section 179, “Removal of Directors” and Section 180, “Court Disqualified Directors” 6 Refer to Section 4 of the Banking Act, the Financial Institutions Act and Section 8(b) (3) of the BOJ (Building Societies) Act, Regulation 7(d) of the draft Credit Union Regulation as well as the BOJ’s 2004 Fit and Proper Guidelines. July 2008

Board deliberations should include a comprehensive examination of the entity’s activities including an assessment of the institution’s financial condition, and the effectiveness of the governance/control framework (including risk management, compliance with regulatory and statutory requirements and internal policies etc.). The board should also seek to ensure that its decisions are based on timely, comprehensive and accurate reports received from the various board sub-committees and executive management. Reports should include a review of various aspects of the business and board decisions should also be based on information received through active interaction with the independent review functionaries (such as internal and external audit, compliance and risk management).
24. The minutes of each meeting of the board should be well documented to provide:
a. An accurate and adequate record of board deliberations, clearly outlining the issues discussed and the conclusions/decisions made; b. Indication of the members in attendance at each meeting;
c. An appropriate record of the material contribution of each member of the board.
The minutes of the meetings of the board, as well as proper records of board papers/submissions should be appropriately signed and made available to the BOJ examiners for review upon request. Board Sub-Committees
25. Boards can improve their effectiveness and efficiency through the establishment of various sub￾committees to provide vital support in the execution of their fiduciary duties and responsibilities.
Board sub-committees can handle matters requiring more detailed review or in-depth analysis, and may make decisions on behalf of the board or submit recommendations for its consideration, depending on their specific charter.
26. The number, structure and type of each committee should be in accordance with the licensee’s
size, business activities, board composition and expertise. The board should ensure that there are no material conflict of interest issues arising from directors serving on multiple committees. Licensees are encouraged to establish committees to maximize the efficiencies and effectiveness of the governance framework. Appendix III outlines specialised committees that have become common within deposit-taking institutions globally. SBP Corporate Governance Page 11 of 38 Bank of Jamaica July 2008

The Audit Committee
27. The Supervisory Authority requires that, at a minimum, each deposit-taking entity establishes an
Audit Committee. The primary purpose of the Audit Committee is to assist the board in fulfilling its oversight responsibilities with regard to the systems of internal controls, the entity’s financial reporting processes and audit functions, as well as compliance with legal and regulatory requirements. The Audit Committee should be chaired by an independent, external director with financial and accounting knowledge. The Supervisory Authority strongly recommends that the Committee be comprised of a majority of board members who are independent. Members should have a thorough understanding of the role of the Committee within the corporate governance framework.
28. The specific mandate of the Audit Committee should include the following:
a. Responsibility for the appointment, compensation, and oversight of independent auditors (internal and external) who should report directly to the Audit Committee. In that regard, the Audit Committee should approve or recommend to the board for the approval of shareholders, the appointment, compensation and dismissal of external auditors as well as review and approve the audit scope and frequency of both internal and external audits. The Audit Committee is responsible for ensuring that the independence of the internal and external audit function is maintained; b. Responsibility for oversight of the company’s accounting and financial reporting processes and the audits of its financial statement. This will involve reviews and discussions with management and the independent auditors (internal and external), which will include findings, as well as the appropriateness and quality of the accounting and auditing principles and practices. The Audit Committee should also review the external auditor’s management letter received from the external auditors and ensure the timely and adequate resolution of issues outlined;
c. Responsibility for oversight of the internal control systems and processes. The Audit
Committee is required to:
i) Review policies established with respect to internal controls, risk assessment and risk management; SBP Corporate Governance Page 12 of 38 Bank of Jamaica July 2008

ii) Meet separately and periodically with management, internal auditors and with external auditor to discuss internal control issues and management’s response to those issues; iii) Ensure that management is taking appropriate corrective actions in a timely manner to address identified weaknesses; d. Responsibility for oversight of the entity’s compliance with the legal and regulatory requirements, as well as the entity’s internal policies and procedures. The Audit Committee should ensure continued compliance with the legal and regulatory framework, including Standards and Guidance issued by the Supervisory Authority and with the licensee’s own internal policies. Additionally, the Audit Committee should undertake the comprehensive review of all related party transactions ensuring that these are subject to approval by the board. The Audit Committee should ensure that management is taking appropriate and timely remedial actions to address all identified areas of non-compliance with policies, laws and regulations; e. Reporting regularly on its work to the full Board of Directors. The Audit Committee Charter or terms of reference should set out clearly, in writing, the duties of the Audit Committee and how such duties should be carried out. The Charter or terms of reference should be reviewed at least on an annual basis. SBP Corporate Governance Page 13 of 38 Bank of Jamaica July 2008

EXECUTIVE MANAGEMENT
Role of the Board
29. It is the primary responsibility of the board to ensure that the executive management team
comprises individuals who possess the necessary knowledge, experience and technical capabilities. In that regard, the board should ensure that:
a. The size of the senior management team is proportionate to the size, scope and complexity of the entity’s operations. Senior management oversight and direction should be adequate to cover all areas of the entity’s operations; b. Fit and proper assessments are conducted for all proposed executives, consistent with the provisions of the “BOJ’s 2004 Fit and Proper Guidelines”. The board should retain the power to remove any member of senior management where such individuals have not been deemed “fit and proper”. When such action is taken, the Board of Directors is required to immediately notify the Supervisory Authority of not only the action taken but also the reasons for doing so. Further, senior management officers must be required to provide adequate notice of resignations in writing and in strict accordance with the institution’s policies;
c. The Supervisory Authority is immediately advised of all proposed appointment to the senior
management team, and also advised of all resignations and removals, with details of the reasons for such action; d. Appropriate succession systems are in place to identify, measure and monitor gaps in roles critical to the continuity of business operations. Overview of Responsibilities
30. At a minimum senior management should fulfil the following responsibilities:
a. Execute board directives, including the implementation of the institution’s strategic aims and objectives, ensuring that proper systems are in place for their attainment, monitoring results and timely reporting to the board; b. Assist the board in fostering a strong corporate culture that promotes compliance and integrity, as well as good ethical and professional practices;
c. Provide the board with sound advice on the organizational structure, which should ensure
that the roles and responsibilities of each officer of the entity are clearly delineated, and in SBP Corporate Governance Page 14 of 38 Bank of Jamaica July 2008

which critical control functions are embedded, such as segregation of duties and the “four eyes principle”; d. Ensure that the entity is adequately staffed and that staff has the requisite skills, experience and integrity to perform assigned functions effectively and efficiently. It is also the duty of the executive management team to ensure that officers are equipped with the necessary resources and support to effectively execute their duties; e. Facilitate the board’s oversight role through the provision of relevant, accurate and timely information, thus enabling the board to effectively oversee the management and operations of the institution; f. Ensure that there are appropriate and adequate systems established to facilitate the efficiency of the financial institution’s operations, which are subject to independent reviews, as well to facilitate accurate and timely reporting to the board and Supervisory Authority; g. Take reasonable measures to prevent the institution from being used to facilitate financial crimes. These measures must be in accordance with the relevant laws (POCA), as well as the Guidance Notes issued by the Bank of Jamaica; h. Conduct on-going assessment of the wider staff to ensure they are fit and proper and provide timely advice to the Supervisory Authority and the board of any appointment and removal of persons in sensitive positions. INDEPENDENT OVERSIGHT FUNCTIONS Internal and External Auditors, Risk Management and Compliance Overview & Scope
31. Independent oversight, which primarily includes internal and external audit, risk management and
compliance, are critical elements of an effective corporate governance framework. In executing its responsibilities, the board should ensure that the independence of these functions is preserved and that it remains positioned to place heavy reliance on the advice provided by these functions. In that regard the board should ensure that these functions are effective, independent, and that they are equipped with the necessary resources and authorities to perform their duties.
32. The board should regularly review the nature and scope of the proposed activities of these
oversight functions, discuss key findings arising from examinations and assessments, and follow￾SBP Corporate Governance Page 15 of 38 Bank of Jamaica July 2008

up on any material concerns raised to ensure that corrective actions are taken by management on a timely basis. The board may oversee these independent oversight functions directly or through an appropriate committee. Internal Audit Overview
33. The Institute of Internal Auditors (IIA) defines the internal audit function as “an independent,
objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.”
34. The Supervisory Authority requires the establishment of a permanent, independent internal audit
function within each DTI which is appropriate to the size and nature of the entity’s activities.
35. The Internal Auditor must be at a sufficiently senior level with appropriate standing and authority
within the DTI, as established by an internal audit charter approved by the board and senior management. In that regard, the Supervisory Authority requires that the Internal Audit function report directly to the board (or the Audit Committee). Scope of Internal Audit Activities
36. Every activity of the licensee should fall within the scope of, and hence subject to review by
internal audit. At a minimum, the scope of internal audit should include the following:
a. Reviewing the application and effectiveness of risk management procedures and risk assessment methodologies including assessment of the system established to assess the adequacy of capital in relation to such risk exposures; b. Examining and re-evaluating the adequacy and effectiveness of the internal control systems. This should include transaction testing, as well as testing of the functioning of specific internal control procedures; SBP Corporate Governance Page 16 of 38 Bank of Jamaica July 2008

c. Reviewing the accuracy and the reliability of the accounting records and financial reports,
as well as the management and financial information systems supporting those reports and records; d. Reviewing systems established to ensure compliance with legal and regulatory requirements, codes of conduct and the implementation of policies and procedures; e. Testing the reliability and timeliness of the regulatory reporting; f. Carrying out special investigations. Principles of the Internal Audit Function
37. The Internal Audit function should abide by the principles of independence, objectivity,
impartiality and professional competence. Adherence to the following principles can be measured against the following criteria:- a. Internal audit is able to exercise assignments on its own initiative in all departments and functions of the DTI; b. Internal audit is free to report its findings to management and head of business lines/departments;
c. Internal audit operates under the direct control of the board or the Audit Committee and has
authority to communicate directly and on its own initiative to the Board Chairman, the board itself or the Audit Committee; d. The compensation scheme for the internal auditor should be consistent with the objectives of the internal audit; e. Internal audit should avoid any conflict of interest and must be able to perform its assignments without bias and interference. This can best be achieved by restricting internal audit from involvement in the operations of the entity; f. The internal audit staff should be subject to ongoing systematic training to maintain professional competence.
38. International best practices recommend the conduct of an independent review of the internal audit
function at least once every five (5) years by an independent external body to determine:
a. Whether internal audit is positioned to meet the expectations of the DTI’s board, management and audit committee; SBP Corporate Governance Page 17 of 38 Bank of Jamaica July 2008

b. Whether the internal audit function is effectively contributing to the corporate governance framework as expected, in challenging and improving the risk and control environment; and
c. Benchmarking the performance of the internal audit function against industry best practices.
External Audit
39. The objective of an external audit of the financial statements of an entity is to enable an
independent auditor to express an opinion as to whether these statements are prepared, in all material respects, in accordance with the financial reporting framework established in Jamaica. The auditor’s opinion thus aids in establishing the credibility of the financial statements.

40. Section 19(A) of the Banking and Financial Institutions Act7
    requires that an external auditor reports to the Supervisory Authority, in writing, on certain material transactions or conditions that have come to the auditor’s attention in the ordinary course of the audit that may present concerns regarding the safety and soundness of financial institutions. The board and senior management must ensure that external auditors are aware of their statutory obligations in this regard.
41. Section 28 of the Banking and Financial Institutions Act and Regulations 61 and 62 of the Bank
    of Jamaica (Building Societies) Regulations further require that the external auditor provides written notice to the Bank of Jamaica of any intention to resign as auditor or any unwillingness to be considered for reappointment at the expiration of the period of appointment and shall in such notice state the reasons for his/her intention to resign or his/her unwillingness to be considered for reappointment. Section 28 also requires that the Bank of Jamaica shall be notified in writing where a financial institution intends to terminate the appointment of its auditor or where a resolution has been passed at any general meeting of the entity providing that the auditor shall not be reappointed and shall in such notification state the reasons for such intention to terminate or for the passage of such resolution.
42. The Supervisory Authority has a continued interest in ensuring that high standards of auditing of
    deposit-taking institutions are maintained and that the independence, objectivity and integrity of SBP Corporate Governance Page 18 of 38 Bank of Jamaica

This requirement is enforced by protocol to building societies and is slated for inclusion in statute in the next round of financial legislative amendments. Such amendment would be effected to the specific building society statute or as part of the Omnibus legislation. July 2008

the external auditor is preserved. In that regard, Regulations have been drafted (the Bank of Jamaica (Qualification of Auditors) Regulations) to govern primarily, the process for selection of external auditors of deposit-taking licensees. All deposit-taking institutions will be required to be in compliance with those provisions once enacted.

Risk Management Function
43. The Supervisory Authority has always recognised the importance of developing a strong risk
management framework in deposit-taking entities and has consequently issued various Standards and Guidance addressing specific material risk areas such as credit risk, liquidity risk, interest rate risk and foreign exchange risk. However, in addition to the development of a strong risk management culture and approach to managing specific risks inherent in the various products and activities within business lines, it is becoming increasingly important for institutions to develop an enterprise-wide approach to risk management. Enterprise-wide risk management (ERM) involves the implementation of a holistic, strategic risk management process designed to identify events with the potential to affect the financial institution on a portfolio basis – positively and negatively – and to manage all the risks associated with those events in accordance with the entity’s particular risk appetite.
44. The Supervisory Authority, in that regard requires that all deposit-taking institutions establish an
overarching risk management function that is independent of the business lines to monitor and manage the overall risks that the institution faces. The mandate of this risk management function would be to identify, manage and maintain the risk profile of the financial institution by, inter alia, engaging in the following activities:
a. Advising the Board in its determination on acceptable risk parameters both in terms of setting and articulating the DTI’s broader risk appetite, as well as the more narrowly defined risk tolerance levels; b. Designing and implementing a risk management framework which appropriately balances the “risk and reward” components;
c. Proactively bringing a risk management perspective to business decisions;
d. Creating a better understanding with major stakeholders about the risk management decision-making process; SBP Corporate Governance Page 19 of 38 Bank of Jamaica July 2008

e. Strategically managing risk in an integrated, enterprise-wide manner; f. Reporting to the board and senior management, on a timely basis, on the material exposures of the DTI and on whether such risks are being effectively managed and controlled within the various business lines; g. Ensuring that the DTI remains within its risk appetite parameters, by ensuring that business lines operate within articulated risk tolerance levels. Compliance Function
45. The Supervisory Authority requires the board and management of deposit-taking institutions to
establish a strong system and culture of compliance to ensure the effective management and mitigation of compliance risk. The Basel Committee defines compliance risk as “the risk of legal or regulatory sanctions, material financial loss, or loss to reputation a bank may suffer as a result of its failure to comply with laws, regulations, rules, related self-regulatory organization standards and codes of conduct applicable to its banking activities”. Ensuring a strong culture of compliance requires a “tone at the top” approach by the board and senior management who would consequentially be obligated to lead by example, emphasize standards of honesty and integrity, as well as to hold itself and all employees to high standards of conduct, observing not only the letter, but the spirit of laws, rules and standards.
46. Compliance laws, rules and standards include the primary legislations governing the deposit￾taking activities of the licensee (e.g. the Banking Act, the Financial Institutions Act, the Building
Societies Act and the BOJ (Building Societies) Regulations) along with their subsidiary regulations; other legislations that may affect an entity’s operations (such as the Proceeds of Crime Act, and its accompanying Regulations, the Companies Act); standards and guidance issued by the Bank of Jamaica, as well as the licensee’s own internal policies and procedures.
47. Some institutions may organise their compliance function within the risk management function,
while other institutions may establish separate units, focussing on specialist areas such as the prevention of money laundering and terrorist financing. Regardless of how the compliance function is organized within the licensee, it should be independent and sufficiently resourced, its SBP Corporate Governance Page 20 of 38 Bank of Jamaica July 2008

responsibilities should be clearly specified and its activities should be subject to periodic and independent review by the internal audit function. Standard II: The corporate governance framework should ensure the establishment of clear objectives, strategies and values to direct the ongoing activities of the financial institution. Purpose
48. The Board of Directors is ultimately responsible for the establishment of the strategic aims,
objectives and plans, as well as the risk appetite of the DTI. These should be clearly defined, well documented and communicated to all employees. In fulfilling these objectives, the board should:
a. Ensure that the financial institution has, not only adequate personnel but also financial, technological and organisational system capabilities to achieve strategic goals; b. Monitor and evaluate the entity’s progress towards achieving its objectives;
c. Review and challenge strategic options presented to the board by senior management,
giving full consideration to the risks involved; d. Approve detailed and clearly documented policies, procedures and operating mandates for each mission critical area of the financial institution’s operations.
49. The board should establish high values and standards of professional conduct that will direct the
on-going activities of the financial institution, and ensure that senior management implements policies and procedures designed to promote professional behaviour and integrity, which are widely communicated across the organization. These policies should prohibit or appropriately limit activities, relationships or situations that might diminish the quality of corporate governance, with special emphasis placed on issues such as conflicts of interest and treatment of related/connected party transactions (refer to paragraph 53 below).
50. In establishing corporate values, board members should take the lead in setting the ethical tone of
the institution and act in line with their fiduciary duties. The two key elements of the fiduciary duty of board members are the duty of care and the duty of loyalty8 . This duty of care9 requires SBP Corporate Governance Page 21 of 38 Bank of Jamaica

Section 174 1(a) of the Companies Act states that board directors should “act honestly and in good faith with a view to the best interest
of the company”. This is also a requirement under Section 4 of the Banking and Financial Institutions Acts and is one of the criteria against which the fitness and propriety of board directors are assessed by the Bank of Jamaica. Refer CA 2004 Section 174 “Duty of Care”. July 2008

board members to act on a fully informed basis, in good faith, with due diligence and care. This means that the board should be satisfied that the key corporate information and compliance systems that underpin its decision-making and monitoring responsibilities are fundamentally sound. The duty of loyalty is a key principle for board members and especially for those working within the structure of a group of companies. Even though a company might be controlled by another enterprise, the duty of loyalty for a board member relates primarily to the licensee and its depositors and not to the controlling company of the group.
51. The Board of Directors sets the ethical tone of the institution not only through its own actions,
and by appointing management executives who are “fit and proper”, but also by ensuring that senior management complies with these principles in hiring all employees of the DTI. In this regard, board and management should ensure that:
i) detailed background checks are conducted on all prospective employees (not just senior officers); and ii) there is on-going detailed scrutiny of all its existing employees in keeping with the “know your employee” requirements in this regard10.
52. The Board of Directors should ensure development of a code of conduct for employees,
management and board members based on professional standards or a broader code of behaviour. At a minimum, the ethical code should ensure compliance with applicable laws and set clear limits on the pursuit of private interests. The ethical codes should also clearly set out acceptable business practices as determined by the board and should enable employees to alert the board and management in good faith to potential misconduct without the fear of retribution.
53. The board should approve policies to prevent or appropriately manage potential conflicts of
interest. These policies should seek to address the following issues:
a. Ensure that business activities that may give rise to conflict of interest are carried out with sufficient degree of independence from each other. This can be achieved by establishing SBP Corporate Governance Page 22 of 38 Bank of Jamaica

10 Detailed background checks should be performed for existing employees under specific circumstances such as movement into senior management level or to a highly sensitive area or upon suspicion. Reference must also be made to paragraph 112 of the Draft BOJ 2008 AML/CFT Guidance Notes which addresses the need for ongoing and close scrutiny of employees to ensure the maintenance of high levels of integrity among DTI staff. July 2008

information barriers between various activities and by providing separate reporting lines and appropriate internal control measures; b. Ensure that where there is potential conflict of interest, particular care is taken to provide adequate information and that where recommendations are made, they are clear, fair and not misleading;
c. Ensure that there are comprehensive and adequate procedures to govern related parties’
transactions and activities to ensure that that these are done in compliance with the deposit￾taking statutes, on an arms’ length basis and not done on terms contrary to the interest of the licensee, its shareholders and depositors; d. Ensure that related party transactions are reviewed, monitored and approved by the board or by a sub-committee of the board comprising majority of independent directors. Standard III: The Board of Directors should set and enforce clear lines of responsibility and accountability throughout the organization.
54. An effective Board of Directors clearly defines the authorities and key responsibilities for
themselves as well as senior management. Failure to do this will impact the effectiveness and efficiency of the governance framework, leading to significant gaps in the governance structure and in unnecessary duplication of efforts due to the unclear understandings of responsibilities and accountabilities. Senior management is responsible for:
a. Establishing and implementing a structure to ensure the overall effective operation and governance of the DTI, subject to the approval of the board; b. Delegating duties to staff, while overseeing the effective execution of such delegated responsibilities to ensure that the aims and objectives of the institution are met;
c. Being accountable to the board for the performance of the DTI.
55. Deposit-taking entities operating as part of a wider group structure may establish certain
governance structures to include the board and management of the parent company or other group entities to obtain certain synergies and enterprise-wide management of the group as a whole. However, these structures may sometimes lead to the blurring of governance responsibilities. In that regard, the Supervisory Authority requires that the board and senior management of such SBP Corporate Governance Page 23 of 38 Bank of Jamaica July 2008

licensees retain ultimate responsibility for the proper governance of the entity - to ensure that the entity remains safe and sound and in compliance with legal and regulatory obligations. The board and senior management of deposit-taking licensees within a group structure (particularly as a subsidiary) should not subordinate or delegate its corporate governance to the group or otherwise, and should at all times ensure that the interests of depositors are protected. For a deposit-taking entity established as a branch of a foreign entity, whilst policy development would reside primarily at the board level, for practical purposes the implementation and enforcement of such policies substantially reside at the branch management level. The board would, however, need to ensure in such instances that appropriate oversight and reporting mechanisms are in place to ensure fulfilment of their obligations.
56. A deposit-taking financial institution which is a parent company of a financial group is charged
with the additional responsibility for the effective oversight of the entire group as part of its own corporate governance responsibility. This includes setting the general strategy and policies of the group and its subsidiaries and for determining what governance structure would best contribute to an effective chain of oversight for the group as a whole. Such parent boards should be aware of the material risks and issues that might affect the entities of the group and should, therefore, exercise adequate oversight over the activities of the subsidiaries. The parent board’s responsibilities should not however prejudice or diminish the corporate governance responsibilities of the board and senior management of each subsidiary within the group, while at the same time avoiding unnecessary replication of corporate governance structures and activities through adequate integration and co-ordination.
57. Where certain activities such as IT technical support, data processing, collection and recoveries
are outsourced, the board and management of deposit-taking institutions must be aware that they remain accountable for such activities as ultimate governance and responsibility cannot be outsourced. In that regard, the board and senior management must ensure that they maintain adequate oversight of outsourced areas of activities and that they understand and manage the associated risks. Board and senior management must also ensure that these outsourced areas of operations remain in compliance with the relevant laws and regulations, as well as the Corporate SBP Corporate Governance Page 24 of 38 Bank of Jamaica July 2008

Governance Standards and other Standards, Guidance and requirements issued by the Supervisory Authority.
58. Where DTIs have consultancy arrangements, these also do not preclude the corporate governance
responsibility of board and management. Board and senior management must ensure that consultants remain in compliance with the relevant laws and regulations, as well as the Standards, Guidance and requirements issued by the Supervisory Authority. Standard IV: The Board of Directors is ultimately responsible for ensuring that the licensee establishes and maintains an adequate and effective system of internal controls, as well as a system for measuring, monitoring and controlling all the material risks to which the deposit-taking entity is exposed and to relate those risks to the DTI’s capital levels. Internal Control System
59. As defined in the 1996 Standard of Best Practice: Internal Controls issued by the Bank of
Jamaica, internal control is “the process effected by an institution’s Board of Directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the safeguarding of assets and asset values, the effectiveness and efficiency of operations, the reliability of financial reporting and compliance with applicable laws and regulations”. The establishment and implementation of a sound system of internal controls is essential to the prudent operations of deposit-taking entities and promotes stability in the financial system as a whole.
60. A successful internal control system meets three main objectives – performance, information and
compliance. Performance objectives focus on the efficiency and effectiveness of the licensee in using its assets and resources and protecting the entity from losses. Information objectives are aimed at ensuring that financial and other information for decision-making are timely, reliable, relevant and complete. Compliance objectives are met if the licensee remains in compliance with applicable laws, regulations, requirements, standards and guidance of the Supervisory Authority, as well as the licensee’s own internal policies and procedures. An effective system of internal controls should also satisfy the following minimum conditions:
SBP Corporate Governance Page 25 of 38
Bank of Jamaica
July 2008

a. Be consistent with the nature, complexity and risks inherent in the deposit-taking entity’s activities; b. Ensure that key control structures are in place, including defining control at every business level with appropriate reviews by board, senior management and independent functionaries including essential elements such as - reviews of operating performance, approvals and authorisations, verifications and reconciliations, segregation of duties and identification and independent monitoring of potential conflict of interest;
c. Ensure the establishment of a well documented and communicated organizational structure
that clearly shows lines of reporting responsibility and authority and that provides adequate channels of communication to ensure that staff fully understand their duties and responsibilities in executing the control program of the entity; d. Ensure that reliable and secure information systems are in place which, inter alia, provides comprehensive information to management relevant to decision making. Information systems must be capable of providing information that is reliable, timely, accessible and provided in a consistent format; e. Ensure that internal control deficiencies are reported on a timely basis to board and/or senior management, whether detected by business line or by independent functions. Deficiencies detected are promptly addressed; f. Ensure that effective business continuity and contingency arrangements are in place; g. Ensure that all material risks that threaten the entity’s ability to achieve its performance, information and compliance objectives are recognised, assessed and monitored. Effective Risk Management Framework
61. It is the responsibility of the board and senior management of each DTI to ensure that an adequate
and effective risk management framework is in place for identifying, measuring, monitoring and controlling of all material risks to which the entity is exposed. As noted in Paragraph 43, it is no longer sufficient for entities to manage risk on a “silo” basis, rather, an enterprise-wide approach to risk management is recommended. Enterprise-wide risk management, as defined by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) “is a process, effected by an entity’s Board of Directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity SBP Corporate Governance Page 26 of 38 Bank of Jamaica July 2008

and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of the entity’s objectives.” Within this context, a licensee’s enterprise risk management framework should be appropriate for its approved risk appetite, size and complexity of its operations.
62. The risk management framework should, at a minimum:
a. Address all material risks inherent in the activities, products and business lines of the licensee. The framework should provide for the accurate and comprehensive identification, measurement, evaluation, monitoring, control/mitigation of risks,; b. Require a risk management structure commensurate with the size and complexity of the institution and the nature and level of risks;
c. Include the establishment of well-documented comprehensive board approved policies
and procedures to govern risk management on an enterprise wide level. They should be designed and implemented to ensure that new products and major risk initiatives are approved by the board and/or appropriate board committee. Policies and procedures must be periodically reviewed and updated to remain relevant and effective; d. Relate all material risks to the capital level. A comprehensive internal process must be established to ensure that overall capital adequacy is assessed in relation to the entity’s risk profile. This must be an integral aspect of the process for determining capital adequacy, in capital planning and management strategies; e. Include an adequate management information system for measuring, assessing and reporting on the quantum, composition and nature of risk exposures. Reports must be provided to board and senior management on a timely basis; f. Establish comprehensive contingency, disaster recovery and business continuity plans; g. Provide for the independent review of the risk management function by internal audit. Where an entity utilizes models to measure components of risk, there should be periodic and independent validation of these models and systems; h. Ensure that there is a formalised process to treat with exceptions to established policies, processes and limits and that exceptions receive the prompt attention and authorisation by senior management and the board. SBP Corporate Governance Page 27 of 38 Bank of Jamaica July 2008

63. The Supervisory Authority requires that the roles and responsibilities within the risk management
    structure be clearly defined from the level of line staff to the board oversight level. At a minimum, the risk management framework should allow for:
    a. Active board and senior management oversight, including effective risk monitoring by the Audit Committee, or a specialised Risk Committee. Paragraph 64 below outlines some of the primary responsibilities of the board and appropriate board committee in executing the risk management function, while Paragraph 65 outlines the role of senior management in the risk management of an entity; b. The establishment of an independent Risk Management function, as a central co￾ordinating point for evaluating, monitoring and controlling/mitigating material risks to which the entity is exposed. This risk management function must be clearly separated from, and independent of business lines/operating (risk-taking) functions and should report directly to the Board/Audit Committee/Risk Committee (see also Paragraph 44);
    c. Review by the internal audit department.

64. The board should clearly establish the licensee’s risk appetite and tolerance level, as well as the
    broad risk strategy and these must be effectively communicated throughout the organization. The board provides effective oversight to ensure that risk is being properly managed in accordance with its approved tolerance levels and strategy. The board may delegate the more detailed aspect of this oversight role to an appropriate board committee. In many organizations, risk management oversight is delegated to the Audit Committee; otherwise, a special Risk Committee of the board is established for this purpose. In providing effective oversight, the board/board committee should ensure that:
    a. Board members have a clear understanding of the nature and level of risks being taken by the licensee at all times; b. The board regularly receives, understands and reviews risk management information provided by senior management. Risk information must be presented in a form suitable for effective board oversight;
    c. Material exceptions to established policies and processes receive prompt attention. The
    board should be informed of, and satisfied with the manner in which material exceptions to policies and controls are identified, monitored and reported; SBP Corporate Governance Page 28 of 38 Bank of Jamaica July 2008

d. Management is provided with the resources required to adequately manage the material risks to which the licensee is exposed. Role of Senior Management
65. Senior management must assume overall responsibility for the enterprise risk management process,
from the identification to the mitigation and reporting of risks. In that regard, senior management should:
a. Have a clear understanding of the nature and level of risks being taken by the licensee at all times; b. Clearly identify all roles, responsibilities and accountabilities for risk management;
c. Establish policies, procedures and methodologies for the effective management of risk
across the organization, subject to approval by the board of directors. Senior management should also ensure that policies and procedures are effectively communicated and implemented throughout the organization; d. Review performance against board-approved risk tolerance and strategy and ensure that corrective action is taken on a timely basis when variances are noted; e. Communicate on the risk management process to the board or board committee. Standard V: The Board of Directors should ensure that compensation policies and practices are consistent with the values, objectives and strategy of the deposit-taking entity.
66. The board should establish formal and transparent policies to govern board and executive
management remuneration. These policies should, inter alia:
a. Be consistent with the deposit-taking entity’s corporate culture, long-term objectives and strategy and control environment; b. Include provisions that would restrict a director deciding his or her own remuneration;
c. Allow for the level and composition of remuneration appropriate to attract and retain,
competent and qualified directors and executive management personnel to successfully manage the licensee. SBP Corporate Governance Page 29 of 38 Bank of Jamaica July 2008

67. The board should disclose11 the remuneration policy, which at a minimum should cover board
    members and key executives. Such policy statement should specify:
    a. The relationship between remuneration and performance and include measurable standards that emphasize the long-term interests of the company over short-term considerations; b. The terms under which board members and key executives may hold and trade stock of the financial institution or affiliated companies in which the institution has material financial interest.

68. Remuneration policies may be reviewed and approved by a special committee12 of the board
    comprised wholly or by a majority of independent directors to mitigate potential conflict of interest and provide assurance to shareholders and other stakeholders.

69. The remuneration of non-executive directors and in particular those who are members of board
    committees such as audit or risk management committee, should take into account their responsibilities and time commitments, but this should not be unduly related to the short-term performance of the licensee. Remuneration for non-executive directors generally should not include share options. If share options are to be granted to non-executive directors, shareholder approval should be sought in advance.

70. Where executive directors or senior managers are eligible for performance-related incentives,
    their compensation should be subject to relevant and objective conditions designed to enhance long-term corporate value. To avoid incentives being created for excessive risk-taking, the salary scale should be set within the scope of general business policy, in such a way that they do not overly depend on short-term performance, such as short-term trading gains. SBP Corporate Governance Page 30 of 38 Bank of Jamaica

11 Remuneration disclosure should be to the Bank of Jamaica via prudential returns and to shareholders through the licensees’ annual report. 12 Refer Appendix III – List of specialized board committees, for the duties and responsibilities of the compensation committee. July 2008

Standard VI: The board of a licensed deposit-taking entity should ensure that the entity is governed in a transparent manner.
71. The Basel Committee in its paper “Enhancing Bank Transparency” (1998) defined transparency
as “public disclosure of reliable and timely information that enables users of that information to make an accurate assessment of a bank’s financial condition and performance, business activities, risk profile and risk management practices.” Public disclosure in and of itself does not achieve transparency if information disclosed does not meet the objectives of transparency as indicated in the above definition. Appropriate public disclosures should facilitate market discipline which, if operating effectively, will in itself promote good governance. The Basel Committee’s guidance indicates the difficulty for shareholders and other stakeholders and market participants to effectively monitor and properly hold accountable the Board of Directors and senior management where there is lack of transparency i.e. - where there is insufficient information with which to judge the effectiveness of the governance being provided by board and senior management.
72. The Supervisory Authority considers it necessary for each DTI to publicly disclose certain basic
information allowing users to better understand the entity’s financial condition and performance, risk profile and management and corporate governance structures. Some of these disclosure requirements are already mandated by the deposit-taking statutes, as well as by the Institute of Chartered Accountants of Jamaica (ICAJ) through the International Financial Reporting Standard (IFRS), which has been adopted as the reporting standard in Jamaica. The Jamaica Stock Exchange has also established certain disclosures for listed companies. It is recommended that at a minimum, a licensee should publicly disclose the following:
a. Financial Performance and Position – this includes basic profitability and balance sheet information provided on a periodic basis and in sufficient detail to allow users to assess:- i) The overall financial strength of the entity, including its ability to withstand/absorb foreseen and potential, existing and future losses through adequate provisioning and capital strength; ii) The sustainability of profits, current and potential future profit performance of the DTI, including ability to repay deposits and other liabilities as they fall due and to contribute to capital growth; SBP Corporate Governance Page 31 of 38 Bank of Jamaica July 2008

iii) The effectiveness of employment of the entity’s resources; iv) Significant developments. b. Risk Exposure and Risk Management – in addition to disclosing information about its financial position, a deposit-taking entity should also publicly provide quantitative and qualitative information regarding its risk profile, as well as its risk management framework, as this is a key factor in assessing the condition of an entity and the effectiveness of management. Disclosures should include discussions of the entity’s overall risk philosophy, overall risk policies and methodologies, risk management structure, risk measurement techniques (e.g. models, credit scoring etc.), validation and stress testing techniques, as well as monitoring techniques and tools (e.g. limits, collateral/guarantees).

c. Corporate Governance Framework and Business Profile - each DTI should provide basic
information on its corporate governance structure, as well as critical information on the entity’s business strategy. Corporate governance information disclosed would include information regarding the entity’s board (e.g. size of the board, board committees and membership) and management/organizational structure (responsibilities and reporting lines). Deposit-taking entities are also required to disclose basic information regarding the entity’s key activities and its ability to respond to changes in the market. The above list of disclosure requirements is not an exhaustive list of all types of information that could be disclosed or reported, as disclosure should be proportionate to the size, complexity, ownership structure, economic significance and risk profile of the financial institution. Additionally, as noted above, the degree of disclosure is also dependent on statutory or other obligations (e.g. for a publicly traded entity). However, the above are considered by the Supervisory Authority to be minimum required disclosures. Disclosures can be achieved through varied mechanisms including periodic public reports and/or the entity’s website. The Supervisory Authority will be issuing more detailed Standards relating to Public Disclosures in the near term. SBP Corporate Governance Page 32 of 38 Bank of Jamaica July 2008

Disclosures to the Supervisory Authority
73. The deposit-taking statutes specify that certain information must be submitted to the Supervisory
Authority on a periodic basis to facilitate ongoing supervision of these entities. The statutes also grant BOJ examiners full access to the books of deposit-taking licensees when conducting on-site examinations.
74. Notwithstanding, the Supervisory Authority is further requiring in this Standard, that deposit￾taking institutions provide immediate notification of the following events specified in Paragraph
75 below:
75. Deposit-taking institutions and the group to which they belong should provide the Supervisory
Authority with immediate notification of the following events:
a. Any matter which could have a significant adverse impact on the condition (including reputation) of the DTI, including but not limited to any significant failure in the entity’s systems or controls, including those reported to the entity by the internal or external auditor; b. Any matter that could result in serious financial consequences to the financial system or to other firms;
c. Any mergers and acquisitions.
d. Prior notification of /Sign-off on any proposed restructuring or reorganization of the DTI (and the group to which it belongs) including but not limited to:
i) Establishing a new undertaking within a firm’s group (as permitted by the deposit-taking statutes) or a new branch; ii) Changes to its board or senior management team or structure; iii) Commencing cross-border services into a new territory; iv) Commencing a new type of product or service; v) Ceasing to undertake a material business activity or significantly reducing the scope of activities; vi) Entering into, or significantly changing any outsourcing arrangement for core or direct support services that may have a material impact on the financial condition and/or operational soundness of the entity/group. SBP Corporate Governance Page 33 of 38 Bank of Jamaica July 2008

These disclosure requirements are applicable to all domestic deposit-taking operations, including those established as subsidiaries or branches of foreign entities. The board and management of these foreign entities should therefore be aware of and ensure compliance with these and other supervisory requirements. Local board and/or management of the subsidiary or branch should also be knowledgeable of the events noted above to be in a position to provide information/notification as required. SBP Corporate Governance Page 34 of 38 Bank of Jamaica July 2008

APPENDICES
Appendix I
Standards of Best Practice Issued to Date
The following Prudential Standards of Best Practice were developed by the BOJ and issued to the industry for adoption:

1. Capital Management (February 1996)
2. Country And Transfer Risk ( January 2005)
3. Credit Risk Management (February 1996)
4. Foreign Exchange Risk Management (March 1996)
5. Guidance Notes on the Detection and Prevention of Money Laundering and Terrorist Financing
   Activities (August 2004, revised draft issued March 2008).
6. Fit and Proper Guidelines (October 2004)
7. Interest Rate Risk Management (March 1996)
8. Internal Controls (March 1996)
9. Liquidity Risk Management (February 1996)
10. Management of Investment of Customer Funds (June 2002)
11. Real Estate Appraisal Management (March 1996)
12. Securities Portfolio Risk Management (February 1996)
    SBP Corporate Governance Page 35 of 38
    Bank of Jamaica
    July 2008

Appendix II: Contents of Director’s Letter of Appointment

1. Term of the appointment
2. Expected time commitment
3. Powers, duties and responsibilities
4. Any special duties or arrangements associated with the position
5. Requirement to disclose director’s interests and any other matters that may jeopardize
   independence
6. Induction, training and continued professional education
7. Confidentiality and rights of access to all the required information on the licensee
8. Access to independent professional advice
9. Performance review process
10. Details of director and employee liability insurance coverage and the duration of the cover.
11. Involvement with committee work envisaged
12. Removal or resignations from office and termination entitlements
13. Remuneration expenses and benefits
14. Securities policy re trading or dealing in securities and other financial instruments
    SBP Corporate Governance Page 36 of 38
    Bank of Jamaica
    July 2008

Appendix III: Specialised Board Committees
In addition to the Audit Committee, the following are the board committees established by leading banks and financial institutions globally. In all cases, these committees are chaired by and comprise either exclusively or primarily independent, outside directors.

1. Nominations Committee - The Nominations Committee is primarily responsible for identifying
   and presenting to the Board of Directors qualified candidates for nomination to the board and for service on committees of the board; compensation of the board; review proposals for appointment to senior management and recommends to the board. This Committee is also referred to as the Human Resource Committee or the Governance Committee.
2. Compensation Committee - charged with the responsibility to formulate and oversee senior
   management compensation programs, to ensure that compensation is consistent with objectives, strategy and control environment of licensee.
3. Risk Management Committee – provide oversight of risk management program established
   within the licensee; the functions of this Committee are sometimes combined with that of the Audit Committee. SBP Corporate Governance Page 37 of 38 Bank of Jamaica July 2008