Resolution of the Board of the National Bank of the Kyrgyz Republic No. 20/6 of May 25, 2016 on Amendments to the Regulation on Minimum Requirements for External Audit of Banks

Lapsed in accordance with Resolution of the Board of the National Bank of the Kyrgyz Republic dated June 15, 2017 No. 2017-P-12/25-2

NATIONAL BANK OF THE KYRGYZ REPUBLIC

RESOLUTION

dated May 25, 2016 No. 20/6

On Amendments and Additions to the Resolution of the Board of the National Bank of the Kyrgyz Republic "On the Regulation 'On Minimum Requirements for External Audit of Banks and Financial-Credit Institutions Licensed by the National Bank of the Kyrgyz Republic' dated July 14, 2005 No. 22/2"

In accordance with Articles 7 and 43 of the Law "On the National Bank of the Kyrgyz Republic", the Board of the National Bank of the Kyrgyz Republic

RESOLVES:

1. Make the following amendments and additions to the Resolution of the Board of the National Bank of the Kyrgyz Republic "On the Regulation 'On Minimum Requirements for External Audit of Banks and Financial-Credit Institutions Licensed by the National Bank of the Kyrgyz Republic' dated July 14, 2005 No. 22/2" (attached).

2. The Legal Department:

• publish this Resolution on the official website of the National Bank of the Kyrgyz Republic;

• after official publication, send this Resolution to the Ministry of Justice of the Kyrgyz Republic for inclusion in the State Register of Regulatory Legal Acts of the Kyrgyz Republic.

3. This Resolution shall enter into force upon the expiration of fifteen days from the date of its official publication.

4. The Department of Supervision and Licensing Methodology shall bring this Resolution to the attention of commercial banks, the specialized financial-credit institution JSC "Financial Company of Credit Unions", the State Development Bank of the Kyrgyz Republic, the Non-State Joint-Stock Company "Association of Islamic Finance", the Association of Microfinance Organizations, and microfinance companies.

5. Control over the implementation of this Resolution shall be entrusted to Board Member of the National Bank of the Kyrgyz Republic T.Dj.Jusupov.

Chairman of the Board of the National Bank of the Kyrgyz Republic		T.Abdygulov

		Appendix to the Resolution of the Board of the National Bank of the Kyrgyz Republic dated May 25, 2016 No. 20/6

AMENDMENTS AND ADDITIONS to the Resolution of the Board of the National Bank of the Kyrgyz Republic "On the Regulation 'On Minimum Requirements for External Audit of Banks and Financial-Credit Institutions Licensed by the National Bank of the Kyrgyz Republic' dated July 14, 2005 No. 22/2"

Make the following amendments and additions to the Resolution of the Board of the National Bank of the Kyrgyz Republic "On the Regulation 'On Minimum Requirements for External Audit of Banks and Financial-Credit Institutions Licensed by the National Bank of the Kyrgyz Republic' dated July 14, 2005 No. 22/2":

in the Regulation "On Minimum Requirements for External Audit of Banks and Financial-Credit Institutions Licensed by the National Bank of the Kyrgyz Republic", approved by the aforementioned Resolution:

• in sub-item 2.4.2 of item 2.4, exclude the words "bank employee";

• supplement item 3.3 with a second sentence as follows:

"Banks must conduct an audit of the information system once every three years";

• supplement sub-item 3.4.1 of item 3.4 with paragraphs as follows:

"(6) Carry out an analysis and assessment of the compliance of the bank's information systems (IS) with the requirements:

a) regulatory legal acts of the National Bank, regarding the bank's information security;

b) internal policies/procedures of the bank's information systems, approved by the bank's management.";

• supplement item 3.4 with sub-item 3.4.2 as follows:

"3.4.2. When conducting an external audit of IS, it is necessary at a minimum to:

a) study internal regulatory documents on information security for their sufficiency and compliance with the requirements of the legislation of the Kyrgyz Republic, standards, and regulatory legal acts of the National Bank;

b) study the bank's strategic documents, business plans, policies, and procedures for IS risk management in order to assess their adequacy, sufficiency, and relevance;

c) assess the IT process quality management system and the operational risk management system;

d) assess the IS business continuity assurance system and IS recovery plans in case of emergencies;

e) assess the level of security of the network, operating systems, applications, databases, personnel, and physical security;

f) consider the degree of protection of information systems in branches;

g) assess the access management and role distribution system in automated systems;

h) assess the level of bank personnel awareness in the field of information security;

i) consider issues of compliance with legislation regarding intellectual property rights and the use of licensed software products.";

• supplement item 3.8 with sub-item 3.8.3 as follows:

"3.8.3. Staff or attracted auditors of information systems of the audit company must possess:

• a qualification certificate (CISA, CISM, etc.);

• experience in auditing information systems in financial-credit institutions.";

• supplement item 5.3 with an eighth paragraph as follows:

"- assessment of the IS risk management system as a category of operational risk.";

• in sub-items 3.8.1, 3.8.2 of item 3.8 and item 3.13, replace footnotes (3), (4), and (5) with footnote (2);

• recognize footnotes (3), (4), and (5) as having lost force.

Chairman of the Board of the National Bank of the Kyrgyz Republic		T.Abdygulov