Notice No. 11/GGBM/99 of 30 December - Internal Control Standards for Credit Institutions and Financial Companies

Notice No. 11/GGBM/99
Establishes internal control standards to be observed by credit institutions and financial companies

The existence of an effective internal control system is an essential component of the management of credit institutions and financial companies, as well as the guarantee of sound and prudent operationality of these same institutions.

In these terms, the Bank of Mozambique, using the competence conferred upon it by the letter d) of paragraph 2 of Article 37 of Law No. 1/92, of January 3, determines:

Article 1
Credit institutions and financial companies, hereinafter referred to as institutions, must establish an internal control system that complies with the standards set forth in this notice.

Article 2

1. The internal control system shall cover, in particular, the definition of the organizational structure, accounting rules, and methods and procedures adequate for processing the objectives defined in Article 4.
2. In the design and implementation of internal control systems, the type and size of the institution, as well as the nature and risks of the operations carried out by them, must be taken into account.

Article 3

1. The creation and updating of the control system, as well as the verification of its functioning and effectiveness, must be directly supervised by the administrative body of the institution.
2. According to the provision in the previous paragraph, it is the responsibility of the administrative body, in particular:
   a) To approve strategies and policies to be adopted by the institution; b) To know the risks in which the institution incurs in the development of its activity and to establish acceptable levels for the assumption of these risks; c) To ensure that persons responsible for the current management of the institution adopt the necessary measures for the identification, assessment, and control of risks; d) To approve an organizational structure that ensures continuous evaluation of the internal control system.
3. The Board of Directors, together with other persons responsible for the current management of the institution, is also responsible for promoting high levels of professional ethics and integrity and establishing a culture within the organization that encourages and emphasizes, at all levels, the importance of the internal control system, specifying the role of each participant in that system.
4. The fundamental rules of the internal control system, which establish, in particular, its objectives, procedures, and means intended to ensure its execution, must be reduced to writing and made available to its users.

Article 4
With a view to minimizing the risks of fraud, irregularities, and error, ensuring their prevention and timely detection, internal control systems must pursue the following fundamental objectives:
a) Guaranteeing the existence and security of assets; b) Controlling the risks of the institution's activity, namely, credit, market, and liquidity risks; c) Compliance with current prudential standards; d) The existence of complete, reliable, and timely accounting and financial information, particularly regarding its recording, conservation, and availability; e) The provision of reliable, complete, and timely financial information to supervisory authorities; f) The prudent and adequate assessment of assets and liabilities, namely for the purpose of establishing provisions; g) The adequacy of operations carried out by the institution to other applicable legal, regulatory, and statutory provisions, namely internal standards, guidelines of corporate bodies, professional and ethical norms, and other relevant rules for the institution; h) The prevention of the involvement of the institution in operations related to money laundering.

Article 5
With a view to achieving its objectives, internal control must be exercised in a routine and continuous manner. To this end, institutions must guarantee the existence of a set of procedures that allow, in particular:
a) The adequate segregation or separation of functions between authorization, execution, recording, custody of values, and control; b) The chronological reconstruction of operations carried out; c) The justification of all accounting information through supporting documents, so that it is possible to reach the final summary documents through them, and from these to the source documents; d) An adequate and effective control system exercised at the level of the various structural units, enabling the respective responsible body to verify the achievement of established objectives and guidelines; e) The institutionalization of an authorization system and a verification and reconciliation system.

Article 6
Regarding information systems, the following specific procedures must be adopted, among others:
a) Systems must be subject to detailed description, and all changes introduced must be recorded in an appropriate document; b) Data must be subject to regular controls; c) Equipment, applications, and data must be provided with adequate protection, in order to prevent damage, fraud, and unauthorized access to the system and confidential information.

Article 7
The administrative body of the institution must prepare, and update whenever necessary, a summarized information on the internal control system, which must be available for verification by inspectors of the Bank of Mozambique or for submission to this bank when there is a request in that sense.

Article 8
Doubts arising from the interpretation and application of this Notice will be clarified by the Banking Supervision Department.

Maputo, December 30, 1999.