NATIONAL BANK OF ETHIOPIA

ADDIS ABABA

LICENSING AND SUPERVISION OF INSURANCE BUSINESS

Risk-Based Internal Audit Directive No. SIB/55/2022

Whereas, risk-based internal audit, being supplemental to the risk based supervision, enhances soundness of an insurance company;

Whereas, risk-based internal audit improves the effectiveness of internal control system and enhances corporate governance of an insurance company;

Whereas, there is a need to have an internal audit function that not only independently ensures accuracy, reliability, timeliness and completeness of transactions as well as financial and operational information, but also compliance with accounting principles, directives, policies, procedures, relevant laws and efficiency & effectiveness of resources used;

Now, therefore, in accordance with Article 64(2) of the Insurance Business Proclamation No. 746/2012 as amended by Insurance Business (Amendment) Proclamation No.1163/2019, the National Bank of Ethiopia has hereby issued this Directive.

1. Short Title

This Directive may be cited as “Risk-Based Internal Audit Directive No. SIB/55/2022”.

2. Definitions

In this Directive, unless the context provides otherwise:

2.1. “audit charter” means a formal written document that defines the purpose, authority and responsibility of an internal audit function;

2.2. “chief internal auditor” means head of internal audit function of an insurance company; by whatever title he/she may be referred to, who is directly reporting to the Board;

2.3. “independence” means freedom from conditions that threaten the ability of the internal audit function to carry out its internal audit responsibilities in an unbiased manner;

2.4. “insurance company” means a company licensed by the National Bank to undertake insurance business or an insurance company owned by the Government;

2.5. “National Bank” means the National Bank of Ethiopia;

2.6. “objectivity” means an unbiased mental attitude that allows internal auditors to perform engagements in such a manner that they have an honest belief in their work product and that no quality compromises are made;

2.7. “risk-based internal audit” means an audit system that focuses on significant and risky areas or activities and ensures compliance with accounting principles, laws, policies and procedures; analyses effectiveness of the internal control system; and independently and objectively report on material facts and figures;

2.8. “risk register” means the main depository of key risks and respective controls identified across an insurance company’s departments/units or business lines; and

2.9. “senior management” means chief executive officer, senior executive officer and any official, as may be defined by individual insurance company, responsible for the day-to-day running of an insurance company;

3. Scope of Application

The provisions of this Directive shall be applicable to all insurance companies and an Ethiopian reinsurer.

4. General Requirements

4.1. An insurance company shall adopt risk-based internal audit methodology and ensure that its importance is understood throughout the company.

4.2. An insurance company shall establish an internal audit function directly responsible to the board of directors on all matters related to the performance of its mandate; with sufficient independence and authority as well as structure and staffing commensurate with the size and complexity of the insurance business.

4.3. An insurance company shall develop audit charter that articulates, among others, the purpose, accountability, independence and objectivity, authority and responsibility in a manner that promotes effective performance of internal audit function as stipulated under Article 5 of this Directive.

5. Responsibilities of Internal Audit Function

The internal audit function shall:

5.1. carryout audit activities in a professional manner and according to accepted internal audit standards and practices;

5.2. develop and periodically review the internal audit policy and procedure manual;

5.3. bring all deficiencies that pose a threat to the insurance company, to the board or its audit sub-committee promptly;

5.4. draw-up and periodically review the audit charter in line with Annex I of this Directive; and shall be communicated throughout the insurance company;

5.5. be independent of all the audited activities, and objective in performing its work and shall not subordinate its judgment on audit matters;

5.6. independently, identify significant as well as risky areas and activities, by covering all business lines at various levels and their respective control systems as appropriate. To this end, it shall consider at least:

i. risk register of all business lines or departments/units;
ii. previous internal audit reports and compliance culture;
iii. proposed changes in business lines;
iv. expected innovations and developments;
v. significant change in senior management/key personnel;
vi. findings of the latest National Bank on-site and off-site examination reports as well as external auditors report;
vii. industry trends and other environmental factors;
viii. time elapsed since last audit;
ix. volume of business and complexity of activities; and
x. substantial plan performance variations.

5.7. analyze and assess inherent risks and control risks; and determine net residual risks so as to prioritize the audit work accordingly;

5.8. prepare risk-based audit plan on annual basis, which shall include all significant and risky areas. The risk based internal audit plan shall focus on:

i. significant line of businesses and activities,
ii. intolerable risks where management action is required or areas with weak internal controls that need immediate audit,
iii. key control systems in which the insurance company is most dependent, and
iv. areas where inherent risk is very high.

5.9. update audit plan on quarterly basis by considering changes in the business environment, activities and work processes;

5.10 produce risk-based audit reports, at least, on quarterly basis, which shall be discussed with the senior management for their rectification; and submitted to the board or its audit sub-committee;

5.11 follow-up implementation of its recommendations and communicate the status to the board and senior management, on a regular/at least on quarterly basis; and

5.12 review and report on, at least:

i. accuracy, reliability, timeliness and completeness of transactions as well as financial and operational information/reports produced,
ii. efficiency and effectiveness of resources used and planned to be used,
iii. compliance with accounting principles, National Bank directives, own policies and procedures and other relevant laws,
iv. frauds identified and fraud prone activities and line of businesses,
v. effectiveness of internal control systems in general and AML/CFT compliance framework in particular,
vi. transparency and accountability in budgeting and budgetary control, and
vii. plan performance reports of each business lines including oversight functions.

6. Competences and Compositions of the Internal Audit Function Staff

The internal audit function staff shall have the following competences and compositions.

6.10A Chief Internal Auditor (CIA) shall meet ‘fit and proper criteria’ as stipulated under relevant National Bank directives.

6.11 The internal audit function shall be comprised of auditors who as a group provide a mixture of core competencies including information technology, consistent with the size and complexity of the insurance company.

6.12 There shall be ongoing training that enables auditors understand insurance activities in general, and risk based internal audit techniques in particular.

7. Responsibilities of Insurance Company’s Management

The management of an insurance company shall:

7.10 provide the necessary resources needed for the effective performance of internal audit, function;

7.11 ensure the existence and maintenance of a risk register;

7.12 ensure that the internal audit function is fully informed of new developments, products/services, projects and operational changes as well as associated risks;

7.13 provide full access to required information and explanations so as to support the audit work and not withhold information from the auditors; and

7.14 prepare action plan to implement findings and recommendations of internal audit function and take timely and appropriate actions.

8. Board of Directors’ Responsibilities

Board of directors of an insurance company shall:

8.1 ensure that all departments/units/business lines have prepared risk register; review and approve the same, and ensure that management has dispatched same to internal audit, function;

8.2 select and appoint heads of internal audit who are qualified and competent with integrity, to administer the affairs of the insurance company effectively and efficiently or remove the same where they fail to be fit and proper;

8.3 approve and ensure periodic review of the audit charter, policies, procedures and annual risk based audit plan; and

8.4 review the performance of the internal audit function at least semiannually.

9. Record Keeping

9.10 All audit procedures shall be documented in working paper with sufficient information to trace back performed audit assignments and the manner in which the audit were performed.

9.11 The audit working paper shall be kept at least for 10 years.

10. Reporting

All insurance companies shall submit internal audit reports semiannually within a month period of time after ending of the sixth month and disclose matters of regulatory significance/concern in a timely manner to the Insurance Supervision Directorate of the National Bank.

11. Effective Date

This Directive shall come into force on the 4th day of April 2022.

Annex-I

AUDIT CHARTER OF INTERNAL AUDIT FUNCTION

i). Objective

To provide for well-designed and independent internal audit function that is able to ensure not only accuracy, reliability, timeliness and completeness of transactions as well as financial and operational information/reports produced, but also ensure compliance with accounting principles, National Bank directives, own policies and procedures and other relevant laws, and the effectiveness of internal control system, in general.

ii). Roles and Responsibilities

The internal audit function shall have an explicit authority to investigate any unit of an insurance company, full access to and co-operation by management and full discretion to directly communicate any staff, director or executive officer, and reasonable resources to enable it discharge its functions properly. The internal audit function should have full and unrestricted access to information and be able to obtain independent professional advices from the insurance’s external auditors and desk officer/portfolio manager of the National Bank. The internal audit function charter, among others, shall establish:

1. the internal audit function’s position within the insurance, its authority, its responsibility, purpose and its relations with other oversight functions;
2. an open line of communication with senior management, external auditors and supervisory authority;
3. reporting line of the internal auditors to communicate the results of their engagements;
4. requirements to comply with sound internal audit standards;
5. responsibility and accountability of the Chief Internal Auditor (CIA);
6. responsibility and accountability of board of directors and senior management;
7. terms and conditions under which the internal audit function can be requested to provide consulting or advisory services or to carry out other special tasks;
8. to initiate direct communication with any member of staff, to examine any activity or unit of the insurance company, and to have full and unconditional access to any records, files, data, including management information system and minutes of all consultative and decision making bodies, whenever deemed relevant to achieve the objective of internal audit function;
9. criteria for when and how the function may collaborate with/engage with the National Bank and external auditors;
10. scope of the internal audit function; that shall at least include:

i. evaluating the adequacy and effectiveness of the internal control systems in general and AML/CFT compliance system in particular;
ii. conducting information systems audit - reviewing and ensuring the safety and effectiveness of information system and IT infrastructure of the Insurance;
iii. reviewing the management and financial information systems, including electronic insurance services;
iv. evaluating accuracy, reliability, timeliness and completeness of transactions as well as financial and operational information/reports produced, including regulatory reports;
v. evaluating compliance with accounting principles, National Bank directives, own policies and procedures and other relevant laws;
vi. evaluating level and effectiveness of budgetary control, transparency and accountability as well as efficiency and effectiveness of resources used and planned to be used;
vii. reviewing and evaluating plan performance reports of each business lines including oversight functions;
viii. evaluating safety and security of all tangible and intangible assets;
ix. testing transactions and proper functioning of specific internal control procedures;
x. reviewing systems established to ensure compliance with legal and regulatory requirements, and implementation of the insurance’s policies and procedures;
xi. conducting operational audit: reviewing and ensuring effectiveness and efficiency of operations;
xii. conducting management audit: reviewing and ensuring the quality of management’s performance and soundness to achieve the insurance’s objectives; and
xiii. Review effectiveness of internal controls and risk management processes.