Risk-Based Internal Audit Directive No. MFI/31/2020

የኢትዮጵያ ብሔራዊ ባንክ NATIONAL BANK OF ETHIOPIA ADDIS ABABA

Licensing and Supervision of the Business of Microfinance Institutions

Risk-Based Internal Audit Directive No. MFI/31/2020

Whereas, risk-based internal audit, being supplemental to the risk based supervision, enhances soundness of the microfinance institutions;

Whereas, risk-based internal audit improves the effectiveness of internal control system and enhances corporate governance of a microfinance institution;

Whereas, there is a need to have an internal audit function that not only independently ensures accuracy, reliability, timeliness and completeness of transactions as well as financial and operational information, but also compliance with accounting principles, directives, policies, procedures, relevant laws and efficiency & effectiveness of resources used;

Now, therefore, in line with the powers vested in it by Article 34 (2) of the Microfinancing Business Proclamation No. 626/2009 as amended by Microfinance Business (Amendment) Proclamation No.1164/2019, the National Bank of Ethiopia has issued this Directive.

1. Short Title

This Directive may be cited as “Risk-Based Internal Audit Directive No. MFI /31/2020”.

2. Definitions

For the purpose of this Directive:

2.1. “Audit Charter” shall mean a formal written document that defines the purpose, authority and responsibility of the internal audit function and Board Audit Committee.

2.2. “Board Audit Committee” shall mean a sub-committee established from board of directors of a microfinance institution having oversight role over the internal and external auditors, as per relevant National Bank directives;

2.3. “Chief Internal Auditor” shall mean head of internal audit function of a microfinance institution; by whatever title he/she may be referred to, who is directly reporting to the Board;

2.4. “Independence” shall mean freedom from conditions that threaten the ability of the internal audit function to carry out its internal audit responsibilities in an unbiased manner;

2.5. “Management” shall mean all management or any officials defined by a microfinance institution as member of Senior Management, except Chief Internal Auditor, Chief Risk Officer and Chief Compliance Officer, who are responsible for the day-to-day activities of the microfinance institution.

2.6. “National Bank” shall mean the National Bank of Ethiopia;

2.7. “Objectivity” shall mean an unbiased mental attitude that allows internal auditors to perform engagements in such a manner that they have an honest belief in their work product and that no quality compromises are made;

2.8. “Risk-based internal audit” shall mean an audit system that focuses on significant and risky areas or activities and ensures compliance with accounting principles, laws, policies and procedures; analyses effectiveness of the internal control system; and independently and objectively report on material facts and figures; and

2.9. “Risk Register” is the main depository of key risks and respective controls identified across the microfinance institution’s departments/units or business lines;

3. Scope of the Directive

The provisions of this Directive shall be applicable to all microfinance institutions operating in Ethiopia.

4. General Requirements

A microfinance institution shall:

4.1. adopt risk-based internal audit methodology and ensure that its importance is understood throughout the microfinance institution.

4.2. establish internal audit function directly responsible to the board on all matters related to the performance of its mandate; with sufficient independence and authority as well as structure and staffing commensurate with the size and complexity of the microfinance institution.

4.3. develop an internal audit charter that articulates, among others, the purpose, accountability, independence and objectivity, authority and responsibility in a manner that promotes effective performance of internal audit function as stipulated under article 5 of this Directive.

5. Responsibilities of Internal Audit Function

The internal audit function shall:

5.1. carryout audit activities in a professional manner and according to accepted internal audit standards and practices;

5.2. develop and periodically review the internal audit policy and procedure manual;

5.3. bring all deficiencies that pose a threat to the microfinance institution, to the board or its audit committee promptly;

5.4. draw-up and periodically review internal audit and board audit committee charter in line with Annex I and II of this Directive; and shall be communicated throughout the microfinance institution;

5.5. be independent of all the audited activities, and objective in performing its work and shall not subordinate its judgment on audit matters;

5.6. independently identify significant as well as risky areas and activities, by covering all business lines at various levels and their respective control systems as appropriate. To this end, it shall consider at least:

i. risk register of all business lines or departments/units; ii. previous internal audit reports and compliance culture; iii. proposed changes in business lines; iv. expected innovations and developments; v. significant change in management/key personnel; vi. findings of the latest National Bank examination report as well as external auditors report; vii. industry trends and other environmental factors; viii. time elapsed since last audit; ix. volume of business and complexity of activities; and x. substantial plan performance variations.

5.7. analyze and assess inherent risks and control risks; and determine net residual risks so as to prioritize the audit work accordingly;

5.8. prepare risk-based audit plan on annual basis, which shall include all significant and risky areas. The risk based internal audit plan shall focus on:

i. significant line of businesses and activities, ii. intolerable risks where management action is required or areas with weak internal controls that need immediate audit, iii. key control systems in which the microfinance institution is most dependent, and iv. areas where inherent risk is very high.

5.9. update audit plan on quarterly basis by considering changes in business environment, activities and work processes;

5.10. produce risk-based audit reports, at least, on quarterly basis, which shall be discussed with the senior management for their rectification; and submitted to the board or its audit committee;

5.11. follow-up implementation of its recommendations and communicate the status to the board and the management, regularly at least on quarterly basis; and

5.12. review and report on, at least:

i. accuracy, reliability, timeliness and completeness of transactions as well as financial and operational information/reports produced, ii. efficiency and effectiveness of resources used and planned to be used, iii. compliance with accounting principles, National Bank directives, own policies and procedures and other relevant laws of the land, iv. frauds identified and fraud prone activities and line of businesses, v. effectiveness of internal control systems in general and AML/CFT compliance framework in particular, vi. transparency and accountability in budgeting and budgetary control, and vii. plan performance reports of each business lines including oversight functions.

6. Competences and Compositions of the Internal Audit Function Staff

The internal audit function staff shall have the following competences and compositions.

6.1. The internal audit function shall be comprised of auditors who as a group provide a mixture of core competencies including information technology, consistent with the size and complexity of the microfinance institution.

6.2. A Chief Internal Auditor (CIA) of a microfinance institution shall hold a minimum of first degree in relevant field from recognized learning institution and shall have a minimum of 4 years of experience in banking or microfinance business, of which, at least 2 year shall be in a managerial position.

6.3. A Chief Internal Auditor (CIA) shall meet other ‘fit and proper criteria’ as stipulated under the Requirements for Persons with Significant Influence in a microfinance institution Directives No. MFI/21/2012.

6.4. There shall be an ongoing training that enables auditors understand microfinancing activities in general, and risk based audit techniques in particular.

7. Responsibilities of Microfinance Institution’s Management

The management of a microfinance institution shall:

7.1. provide the necessary resources needed for the effective performance of internal audit, risk management and compliance function;

7.2. prepare risk register that identifies inherent risks and internal control and/or risk mitigations and submit same to the internal audit, the risk management and compliance departments/units;

7.3. ensure that the internal audit, the risk management and compliance functions are fully informed of new developments, products/services, projects and operational changes as well as associated risks;

7.4. provide full access to required information and explanations so as to support the audit work and not withhold information from the auditors; and

7.5. prepare action plan to implement findings and recommendations of internal audit, risk management and compliance departments/units, and take timely and appropriate actions.

8. Responsibilities of Board of Directors

Board of directors of a microfinance institution shall:

8.1. establish and ensure effective functioning of audit, risk management and compliance committees that shall be responsible for overseeing the microfinance institution’s internal and external audit activities, risk management and compliance functions, respectively;

8.2. ensure that all departments/units/business lines have prepared risk register; review and approve the same, and ensure that management has dispatched same to internal audit, risk management and compliance functions;

8.3. approve and ensure periodic review of the internal audit as well as board audit committee charter, policies, procedures and annual risk based audit plan; and

8.4. review the performance of the internal audit, risk management and compliance functions at least once in a quarter.

9. Record Keeping

9.1. All audit procedures shall be documented in working paper with sufficient information to trace back performed audit assignments and the manner in which the audit were performed.

9.2. The audit working paper shall be kept at least for 10 years at the microfinance institution’s archive.

10. Reporting

10.1. All microfinance institution shall submit internal audit reports for each quarter within a month period of time after ending of the quarter and disclose matters of regulatory significance/concern in a timely manner to Microfinance Institutions Supervision Directorate of the National Bank.

11. Effective Date

This Directive shall come into force on the 16th day of September 2020.

---

Annex-I

CHARTER OF INTERNAL AUDIT FUNCTION

i). Objective

To provide for well-designed and independent internal audit function that is able to ensure not only accuracy, reliability, timeliness and completeness of transactions as well as financial and operational information/reports produced, but also ensure compliance with accounting principles, National Bank directives, own policies and procedures and other relevant laws, and the effectiveness of internal control system, in general.

ii). Roles and Responsibilities

The internal audit function shall have an explicit authority to investigate any work unit of a microfinance institution, full access to and co-operation by management and full discretion to directly communicate any staff, director or executive officer, and reasonable resources to enable it discharge its functions properly. The internal audit function should have full and unrestricted access to information and be able to obtain independent professional advices from the microfinance institution’s external auditors and desk officer/portfolio manager of the National Bank. The internal audit function charter, among others, shall establish:

1. the internal audit function’s position within the microfinance institution, its authority, its responsibility, purpose and its relations with other oversight functions;
2. an open line of communication with senior management, external auditors and supervisory authority;
3. reporting line of the internal auditors to communicate the results of their engagements;
4. requirements to comply with sound internal audit standards;
5. responsibility and accountability of the Chief Internal Auditor (CIA);
6. responsibility and accountability of board of directors and senior management;
7. terms and conditions under which the internal audit function can be requested to provide consulting or advisory services or to carry out other special tasks;
8. to initiate direct communication with any member of staff, to examine any activity or unit of the microfinance institution, and to have full and unconditional access to any records, files, data, including management information system and minutes of all consultative and decision making bodies, whenever deemed relevant to achieve the objective of internal audit function;
9. criteria for when and how the function may collaborate/engage with the National Bank and external auditors;
10. scope of the internal audit function; that shall at least include: i. evaluating the adequacy and effectiveness of the internal control systems in general and AML/CFT compliance system in particular; ii. conducting information systems audit - reviewing and ensuring the safety and effectiveness of information system and IT infrastructure of the microfinance institution; iii. reviewing the management and financial information systems, including electronic financial services; iv. evaluating accuracy, reliability, timeliness and completeness of transactions as well as financial and operational information/reports produced, including regulatory reports; v. evaluating compliance with accounting principles, National Bank directives, own policies and procedures and other relevant laws; vi. evaluating level and effectiveness of budgetary control, transparency and accountability as well as efficiency and effectiveness of resources used and planned to be used; vii. reviewing and evaluating plan performance reports of each business lines including oversight functions; viii. evaluating safety and security of all tangible and intangible assets; ix. testing transactions and proper functioning of specific internal control procedures; x. reviewing systems established to ensure compliance with legal and regulatory requirements, and implementation of the microfinance institution’s policies and procedures; xi. conducting operational audit: reviewing and ensuring effectiveness and efficiency of operations; xii. conducting management audit: reviewing and ensuring the quality of management’s performance and soundness to achieve the microfinance institution’s objectives; and xiii. review effectiveness of internal controls and risk management processes.

---

Annex-II

CHARTER OF BOARD AUDIT COMMITTEE

i). Objective

To provide for independent review, monitoring and evaluation of the effectiveness of the internal audit function of the microfinance institution, and ensure checks and balances within the microfinance institution.

ii). Composition

The Audit Committee shall comprise at least three directors, of which at least one member shall have accounting and auditing expertise and/or experience in the financial sector.

iii). Roles and Responsibilities

The Audit Committee shall have an explicit authority to investigate any matter within its terms of reference, full access to and co-operation by management and full discretion to invite any director or executive officer to attend its meetings, and to have reasonable resources to enable it discharge its functions properly. It should have full and unrestricted access to information and be able to obtain independent professional advice.

Responsibilities of Board Audit Committee shall comprise, at least:

1. ensuring fair and transparent reporting and prompt publication of financial accounts;
2. ensuring the internal audit function is discharging its responsibilities in an independent manner in line with article 5 of this Directive and its charter;
3. propose a remuneration, recommend appointment and termination of the Chief Internal Auditor to the board of directors for approval, to ensure the function’s "independence" and "objectivity";
4. review the scope of audit plan, budget of internal audit function, and ensure that coverage of matters of regulatory interest within the audit plan is adequate;
5. review audit reports at least quarterly and ensure that the senior management is taking necessary and timely corrective actions to address control weaknesses and compliance issues;
6. review objectivity, performance and independence of external auditors, and recommend its appointment and removal;
7. review the external auditor’s management letter and response;
8. propose non-audit service required from the external auditors, and ensure that there are proper checks and balances in place so that the provision of non-audit services does not interfere with the exercise of independent judgment of the auditors;
9. review all related party transactions and keep the full Board informed of such transactions;
10. check compliance with proclamations, regulations, directives, guidelines and the internal policies and procedures, and other relevant laws;
11. ensure that the internal audit function has adequate resources to carry out its duties that commensurate with the internal audit plan and scope;
12. ensure that the internal audit function maintains open communication with senior management, external auditors, and the supervisory authority; and
13. hold regular meetings, at least on monthly basis, and report to the Board of Directors on quarterly basis.