bank auditing

Bank AuditingBank Auditing

11 March 201311 March 2013

Agenda

1. Types of Audits in Banks

2. Audit of Risks in Banks

3. Audit of Financial Position & Results of Operations in Banks

4. Audit of Information Techologies Systems in Banks

5. Audit Tools & Reporting

6. Future of Bank Auditing

1. Types of Audits of Banks

Internal Audit

Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations.

It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.

Internal Audit

Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations.

It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.

External Audit

It is an audit conducted by an individual or firm that is independent of the company being audited.

Independent auditors audit the books of a company generally once per year after the completion of the company’s fiscal year. Their role is to give an opinion of the financials statements reflection of the status and operations of the company being audited.

Based on what they witness during the audit they will also produce, for management and board utilization, a management letter.

Although a financial statement audit is the most common type of external audit, external auditors may also conduct special purpose audits which might include; performing specific tests and procedures and reporting on the results, a less intensive review, and compilations.

External Audit

It is an audit conducted by an individual or firm that is independent of the company being audited.

Independent auditors audit the books of a company generally once per year after the completion of the company’s fiscal year. Their role is to give an opinion of the financials statements reflection of the status and operations of the company being audited.

Based on what they witness during the audit they will also produce, for management and board utilization, a management letter.

Although a financial statement audit is the most common type of external audit, external auditors may also conduct special purpose audits which might include; performing specific tests and procedures and reporting on the results, a less intensive review, and compilations.

1.1. Internal Audit

Internal audit departments mainly function to provide assurance to senior management of the Bank and stakeholders for the activities of the Bank’s whole departments, branches and subisidiaries on their consistency with the Banking Law, BRSA Regulations, banking legislation, Bank strategies, policies and procedures and for the adequacy of internal control and risk management system. Besides, it is responsible for establishing and maintaining effective internal audit system to minimize the effects of the operational risks.

Some of the audit functions are:

Evaluating the adequacy and effectiveness of risk management, control and governance processes of the Bank.

Assessing compliance with regulations of Legislative Bodies and the Bank’s procedures.

Providing recommendations for improving the operations of the Bank in terms of efficient and effective performance.

Assisting the detection of fraud.

For those purposes the Department conducts audits at the branches, departments and subsidiaries of the Bank throughout Turkey and abroad. All business systems, applications, processes, operations, functions and activities within the Bank are subject to the audits.

Roles and Responsibilities

1.1. Internal Audit

The BRSA Supervision on Internal Audit

The BRSA regulates and supervises also HR issues of IAD and audit studies performed.

Some of the issues are mentioned below:

The number and professional quality of internal auditors in IAD should be sufficient,

All audit plans and annual results must be reported to the BRSA, Manuals should be written, The charter, working papers must contain the minimum requirements asked by

the BRSA,

The BRSA, in its regulations, refers to the IIA’s standards on those issues.

1.1. Internal Audit

All of the activities in the head office departments, subsidiaries and Branches are subject to audit.

Although all financial subsidiaries have Internal Audit / Internal Control Units, Internal Audit Department of Garanti also performs audits in those subsidiaries.

Audit Universe & Coverage

Working Methodology

Identification

Sourcing

Assessment

Prioritization

AUDIT PLANSRISK

RISK BASED AUDITING PRINCIPLE

Audit manuals are established to provide guidance on specific audits. Manuals are about procedures of on-site engagements that the auditors may perform. Those manuals are attainable through the intranet of the Department.

1.1. Internal Audit

Interviewing

Re

com

pu

ting

Detailed Testi

ng

Observation

& Inspection

Statistical

Sampling

Con

firm

atio

n

Analytical

Procedures

1.2. External Audit

Taking into account opinion of the Audit Committee, the Board of Directors selects the authorized audit company, which conducts audit engagement in periods determined by legislation, and submits the company to approval of the General Assembly.

The authorized external audit company is evaluated quarterly by the Audit Committee during the service period and the results must be submitted to the Board of Directors.

Deloitte, KPMG, PWC, Ernst & Young as external audit companies are authorized by Banking Regulation and Supervision Agency (BRSA) for financial audit in banks.

In addition; banks quoted to Istanbul Stock Exchange are also subject to external audit in accordance to Capital Markets Board’s regulations.

The External Audit Companies generally offer the services below;

Audits of the financial statements, Audits of the Information Technology Systems.

Actions which will be taken by banks regarding External Audit Company’s IT audit findings are presented to and approved by Board of Directors and are sent to BRSA twice a year.


What is Risk ?

Pronounced as “risco” in Italian, “Risiko” in German and “risk” in English, this concept has been used as “riziko ” formerly, and later has been used as “ risk ” .

Risk is the potential that a chosen action or activity (including the choice of inaction) will lead to a loss or undesirable outcome.

The concept has been used as a synonym with “ danger ”, and used for the situations which is predicted to appear in the future but which at the same time is unknown whether or not it is going to happen.

The two fundamental components (R) of the Risk are the probability of that the loss will occur (p) and the magnitude of the potential loss (L).

Ri=Lip(Li)


ConcentrationRisk

Transaction & Business Risk

CounterpartyCredit Risk

Issuer Risk

Transaction Risk

Structural Interest

Rate Risk

Share Risk

Interest Rate Risk

Exchange Rate Risk

Commodity Risk

Financial Risks Operational

Risk

Reputation Risk

Business & Strategic Risks

Market Risk

Credit Risk

SpecificRisk

General Market

Risk

Issuing Risk

Liquidity Risk

Types of Risks


Benefits of Risk Management

Less shocks and unexpected surprises

Giving assurance to shareholders

Quick understanding and

capturing new opportunities

Supporting the internatl audit

program to focus

Encouraging continuous renewal and improvement

Enhancing the business plan and

the strategical planning

Reinforcement of the effective usage

of resources

Enhancing the communication between units

Potential Benefits


Capital Requirement Calculation Methods

Level of Level of DevelopmeDevelopme

ntnt

MARKET MARKET RISKRISK

CREDIT CREDIT RISKRISK

OPERATIONAL OPERATIONAL RISKRISK

SIMPLESIMPLESimplifiedStandartApproach

Basic Indicator Approach

MEDIUMMEDIUM Standard Approach

Standard Approach

Alternative Standard Approach

Standard Approach

ADVANCEDADVANCEDValue at Risk

(VAR) Approach

Basic Internal Rating

Approach

Advanced Internal Rating

Approach

Advanced Measurement Approaches


Calculation of Minimum Capital Requirement

Total Capital

≥ %8Credit Risk

Market Risk

Operational Risk

+ +


LCR: Liquidity Coverage RatioNSFR: Net Stable Funding Ratio

In the past, the stability of a bank was generally measured purely on the sum of its capital tiers divided by its Risk Weighted Assets. With the Basel III, the capital rules have been strengthened and all the components operating together has been taken as a complete framework.


According to the Basel Committee on Banking Supervision, the Basel 3 proposals have two main objectives,

a. To strengthen global capital and liquidity regulations with the goal of promoting a more resilient banking sector; and

b. To improve the banking sector's ability to absorb shocks arising from financial and economic stress.

To achieve these objectives, the main proposal the BCBS Basel 3 has developed are:

a. Capital reform (including quality and quantity of capital), complete risk coverage, leverage ratio; and

b. Liquidity reform (short term and long term ratios).


In view of preserving core Tier 1, the Committee introduced two new "buffers. A Capital Conservation Buffer should allow banks to absorb shocks in periods of stress without breaching core Tier 1. And a more discretionary Countercyclical Buffer to compensate for increased systemic risks in times of excessive credit growth.

In terms of quantity, total Tier 1 Capital is now required at 6%, up 2% from Basel II .

Furthermore, a new leverage ratio will make part of banking regulatory framework. Banks will be required to maintain a leverage ratio of 3 percent or more (33 times its capital). The unweighted assets include provisions, loans, off-balance sheet items with full conversion, and all derivatives. The main purpose of this ratio is to constrain leverage in the banking sector, while also helping to safeguard against model risk and measurement errors.

In addition to the capital banks must hold against risk weighted assets, financial institutions now have two new ratios to comply with: Liquidity Coverage Ratio (LCR) and Net Stable Funding Ratio. LCR is designed to promote the short-term resilience of a bank's liquidity risk profile by ensuring that it has sufficient high-quality liquid assets to survive a significant stress scenario lasting for 30 calendar days; and the NSFR aims at promoting longer-term resilience by requiring banks to have capital or longer term high-quality funding which can survive over a one year period of less severe stress.


Risk Management Audit and Internal Auditors

Internal Auditors should;

1.Focus on risks related to a possible recession (reputation, liquidity, labor force reduction...)2.Audit the effectiveness of risk management and corporate governance processes.3.Conduct the re-evaluation of risks and identify the risks associated with each other.4.Undertake a teaching role on risk management.5.Improve the relations with other governance, risk and checkpoints within the organization.6.Expand the studies related with Fraud on the audit plans.

Also;

1.Auditors should be in close contact with the senior management and the audit committee.2.More flexible inspection plans that can be changed during the period should be used.3.Information about the organization and business should be improved.4.In order to conduct more effective audits, the audit reports should be prepared in shorter times and intensive technology should be used.

3. Audit of Financial Position / Results of Operations in Banks

Audit operations for assets;

Cash and Cash Equivalents

Financial Investments

Derivative Financial Assests and Liabilities

Loans

Tangible and Intangible Fixed Assets

Other Various Assets and Liabilities

Investments Held as for Sale

Audit of Assets


Audit of Assets

First of all, auditor has to audit current assets whether these are recorded correct or not.Reconciliation is done by auditor to reach equity of trial balance-MIS-balance sheet.Back-dated bank receipts are examined.Reconciliation is done for all bank accounts.Nominal values of securities are verified.Conformity of the data is examined which was used for valuation of securities.Income and expense is examined which was obtained by derivative operations.Valuations of derivative products is examined.Current credit balance of bank is compared with past periods to examine difference.Rediscount calculation of loans is examined to be certain of accuracy.Depreciation accounting of bank is examined to verify accuracy.Current and past period is compared to examine differences.Accounting records are examined which put into operation with the definition of ‘Other’.Market value of bank is examined.


Audit of Liabilities

Audit operations for liabilities;

Deposit and Other Liabilities

Credits Obtained

Reserves

Tax Liabilities on Profit

Shareholders Equity


Reconciliation is done by auditor to reach equity of trial balance-MIS-balance sheet.

Current deposits and other liabilities of bank are compared with past periods to examine difference.

Current obtained credits of bank are compared with past periods to examine difference.

Rediscounts of interest for obtained credits are examined to be certain of accuracy.

Collateral accounts are examined to be certain of accuracy.

Tax calculation of bank is examined.

For shareholders equity, capital movements in a period is examined.

Audit of Liabilities


Audit of Income Statement

Interest income

Interest expense

Service and commission income/expense

Personnel expense

Income and expense of other activities

Other income and expenses

Rediscount and evaluation transactions


Audit of Income Statement

An income statement audit can help auditor to isolate mathematical errors and ledger discrepancies.

Reconciliation is done by auditor to reach equity of trial balance-MIS-balance sheet for related accounts.

Change in trend of interest income and expense is examined to determine possible reverse entries.

Change in trend of commission income and expense is examined. Possible correction records related to commission income and expense are examined to

be certain of accuracy. Current personnel payments are compared to past periods. Conformity of the subsidiary records to the trial balance is examined.


Audit of Off-Balance Sheet Items

Liabilities are examined to understand their origin.

Nominal amounts of securities are examied to confirm their assets on off-balance sheet.

Reconciliation is done related to deposits which is given or taken.

4. Audit of IT Systems in Banks

The computerized environment provides advantages over manual system in terms of accuracy and uniform processing of transactions. But at the same time it poses certain challenges before the auditor in terms of audit risk due to peculiar nature and characteristics of computerized Information System (CIS) environment, where potential for fraud is much more and can be more easily hidden in the digital data.

Computer fraud and abuse can have a detrimental effect on an organization. Periodic surveys undertaken by organizations such as the NCC (National Computing Centre) and the Audit Commission indicate the following common instances of computer fraud and abuse:

Unauthorised disclosure of confidential informationUnavailability of key IT systemsUnauthorised modification/destruction of softwareUnauthorised modification/destruction of dataTheft of IT hardware and softwareUse of IT facilities for personal business


Computer Security Audit“A computer security audit is a systematic, measurable technical assessment of how the organization's security policy is employed at a specific site. Computer security auditors work with the full knowledge of the organization, at times with considerable inside information, in order to understand the resources to be audited”.

Symantec

Computer security auditors perform their work though personal interviews, vulnerability scans, examination of operating system settings, analyses of network shares, and historical data. They are concerned primarily with how security policies- the foundation of any effective organizational security strategy - are actually used. There are a number of key questions that security audits should attempt to answer:

Are passwords difficult to crack?Are there access control lists (ACLs) in place on network devices to control who has access to shared data?Are there audit logs to record who accesses data? Are the audit logs reviewed?Have all unnecessary applications and computer services been eliminated for each system? Is there a disaster recovery plan? Have the participants and stakeholders ever rehearsed the disaster recovery plan?


Technical Competence, Information, Standards and Tools Used

Standards

INFORMATIONTECHNOLOGIES

AUDIT

•BRSA Regulations•COBIT•ITIL •ISO 27001, BS 25999 •CMMI, PMBOK, NIST…

Tools

•Data Mining/ Query Tools (Oracle, ISQL..)•Monitoring Tools (MS MOM/ SCOM/SMS) •Security Test Tools•MBSA•Nessus•Penetration Tools (Wireshark, Paros, Developer Tools…)

Audit Competences

•CISA,CEH,PMP,CISM,CRISC•Process Audit Methodology •Sampling Methodology•Evidence Gathering Method.•IT Audit Methodology

Technical Information

•Operating Systems •Databases•Software Development•Network Infrastructure•Comp.Engineering Background•Continuous Pro. Education

5. Audit Tools & Reporting

2. Communicating the ResultsSince the branch audit reports are submitted to related parties according to the subject of findings, more than one report is prepared after the audit engagement.

Reports mainly contain following information;

Introduction Name of the branch Type of audit Audit period Report date Audit duration Name of the party that the reports are submitted to

Audit Findings Significant discrepancies or weaknesses discovered Risks involved Recommendation Target remediation date is determined (if applicable)

Response of AuditeeFinal Opinion of IAD (if needed)


With the developments in banking sector, classical audit practices changed to modern audit methodologies.

Traditional Methods Modern MethodsFocused in finding errors Focused in system, process and riskIssue PreventionFocused to past Focused to futureFinancial losses EfficiencyLabor intensive System intensiveBased on problem Based on solution

7. T. Garanti Bankasi A.S. Recruitment Process

Internal Audit Exam

March 11, 2013 - IstanbulMarch 11, 2013 - Istanbul

bank auditing

Documents

audit functions

audit studies

audit plans

brsa regulations

bank strategies

bank auditing11

financial statement

adequacy of internal