EXTERNAL AUDIT

1. Bank for International Settlements (Financial Stability Institute) - Committee of Banking Supervisors of West and Central AfricaKhartoum, Sudan, 11 April 2002 EXTERNAL AUDIT Errol Kruger Deputy Head - Bank Supervision South African Reserve Bank

2. Agenda • Responsibility of the board and senior management vis-à-vis the external audit function • The role of the external Auditor • The role of the banking supervisor • The relationship between the supervisor and the external auditor • Conclusion

3. Introduction • Banks play a central role in economy • General public interest • Annual financial statements audited by external auditors • Promotes confidence in banking system • Business of banking grows in complexity • Supervisors and external auditors face similar challenges • External auditors undertake additional tasks

4. Responsibility of the board and senior management • Primary responsibility for conduct of the business of a bank is vested in board of directors and management appointed by it • Responsibility includes: • those entrusted with banking tasks have sufficient expertise and integrity and that there are experienced staff in key positions • adequate policies, practices and procedures related to different activities of bank are established and complied with, including: • promotion of high ethical and professional standards; • systems accurately identify and measure all material risks and adequately monitor and control these risks • adequate internal controls, organizational structures and accounting procedures • evaluation of quality of assets and proper recognition and measurement

5. Responsibility of the board and senior management (cont.) • adequate policies, practices and procedures related to different activities of bank are established and complied with, including (cont.): • “know your customer” rules - prevent bank being used, intentionally or unintentionally, by criminal elements; • adoption of suitable control environment, aimed at meeting bank’s prescribed performance, information and compliance objectives; • testing of compliance and evaluation of effectiveness of internal controls by internal audit function • appropriate management information systems are established • appropriate risk management policies and procedures • statutory and regulatory directives, including directives regarding solvency and liquidity, are observed • interests not only of shareholders but also of depositors and other creditors adequately protected

6. Responsibility of the board and senior management (cont.) • Management responsible for: • preparation of financial statements • establishment of accounting procedures • responsibility includes ensuring that external has unhindered access to all relevant information • Audit committee • ensuring existence and maintenance of an adequate system of internal controls • reinforces both internal control system and internal audit function • external auditors allowed and encouraged to attend meetings of audit committee

7. Responsibility of the board and senior management (cont.) • Internal audit • established by management • part of ongoing monitoring of system of internal controls • commensurate with size and nature of operations • to be fully effective, should be independent from organisational activities it audits • span the business • adequately staffed

8. Role of the external auditor • Objective of an audit: • external auditor to express an opinion as to whether bank’s financial statements in accordance with an identified financial reporting framework • Reporting framework may differ from country to country • ISA 700 • Report addressed to shareholders or board of directors • No assurance on future viability • Designs audit procedures and assesses • inherent risk • control risk • Misstatements arising from fraud or error

9. Role of the external auditor (cont.) • Characteristics that distinguish banks from commercial enterprises • custody of large amounts of monetary items • engage in transactions that are initiated in one jurisdiction, recorded in a different jurisdiction and managed in another jurisdiction • operate with very high leverage • assets can rapidly change in value and value is often difficult to determine • significant amount of funding is usually derived from short-term deposits • fiduciary duties in respect of assets held that belong to other persons • large volumes and variety of transactions whose value may be significant

10. Role of the external auditor (cont.) • Characteristics that distinguishes banks from commercial enterprises (cont.) • operate through network of branches and departments - geographically dispersed • transactions can be directly initiated and completed by customer without any intervention by the bank’s employees • assume significant commitments without any initial transfer of funds • regulated by governmental authorities whose regulatory requirements often influence accounting principles that banks follow • customer relationships might affect auditor’s independence • exclusive access to clearing and settlement systems for checks and fund transfers, foreign exchange transactions, etc. • issue and trade in complex financial instruments

11. Role of the external auditor (cont.) • Detailed audit of all transactions impracticable, bases audit on: • inherent risk • control risk • testing of internal controls - substantive procedures performed on test basis • Reliance on internal audit • assesses internal audit function • nature timing and extent of external auditors procedures • Professional judgement • Risk of not detecting material misstatement resulting from fraud > risk of not detecting material misstatement resulting from error  fraud may involve sophisticated and carefully organized schemes designed to conceal it

12. Role of the external auditor (cont.) • External auditor discovers misstatement material to the financial statements  management to adjust the financial statements • Management refuses  issues qualified or adverse opinion on financial statements (serious effect on credibility and stability) • Communication to management re certain information supplementary • In South Africa, external auditors required to report on: • Process of corporate governance – Reg 38(6) • Guidelines relating to the conduct of directors – Reg 39(4)(d) • Audit reports – Reg 45

13. Role of the banking supervisor • Key objective of prudential supervision is to maintain stability and confidence in the financial system • Banking supervision is based on a system of licensing, which allows supervisors to identify the population to be supervised and to control entry into the banking system • Basic requirement for banking license: • suitable shareholders and members of board • management must be honest, trustworthy and possess appropriate skills and experience • the bank’s organisation and internal control must be consistent with its business plans and strategies • legal structure in line with its operational structure • adequate capital to withstand the risks inherent in the nature and size of its business • sufficient liquidity to meet outflows of funds

14. Role of the banking supervisor (cont.) • Banking supervisors  recourse to legal powers to bring about timely corrective action when a bank fails to meet prudential requirements • Foundation of prudential supervision is capital adequacy • Basel Committee proposes a new capital adequacy framework based on three complementary pillars: • minimum capital requirements • supervisory review process • market discipline • Banks subject to a variety of risks. Supervisors monitor a range of banking risks, such as: • credit risk • market risk (including interest and foreign exchange risk) • liquidity and funding risk • operational risk • legal risk • reputational risk

15. Role of the banking supervisor (cont.) • Most significant of banking risks - customer/ counterparty will not settle obligation for full value • capital used as supervisory standard against which exposures are measured or limited • supervisor relies on management’s judgment of proper valuation of assets, and on valuations that appear in financial statements - subject to external audit • Supervisors attach considerable importance for banks to have in place internal controls that are adequate for nature, scope and scale of business • Sophisticated real-time computerized information systems improved potential for control • but, has brought with it additional risks arising from possibility of computer failure or fraud

16. Role of the banking supervisor (cont.) • Supervisors to ensure quality of management adequate for nature and scope of business. This is achieved by: • on-site inspections • interviews with management on a regular basis • use opportunities to understand management's business plans and strategies • Effective supervision requires collection and analysis of information about supervised banks  identify potential problems • Supervisors must have means to validate information they receive • To enhance supervisors’ understanding of a bank’s corporate governance and system of operation supervisory authorities meet periodically with the: • audit committee • board of directors

17. Role of the banking supervisor (cont.) • Banking supervisors are interested in ensuring all work performed by external auditors carried out by auditors who: • are properly licensed and in good standing • have relevant professional experience and competence • are subject to quality assurance program • are independent in fact and appearance of the bank audited • are objective and impartial • Supervisor has statutory powers over appointment of external auditors • Supervisors have clear interest in ensuring high standards of bank auditing and important concern of supervisors is independence of external auditor who performs audit of bank

18. Is primarily concerned with maintaining the stability of the banking system and fostering the safety and soundness of individual banks in order to protect the interests of the depositors Is concerned with the maintenance of a sound system of internal control as a basis for safe and prudent management of the bank’s business Must be satisfied that each bank maintains adequate records prepared in accordance with consistent accounting policies and practices that enable the supervisor to appraise the financial condition of the bank and the profitability of its business, and that the bank publishes or makes available on a regular basis financial statements that fairly reflect its condition The relationship between the supervisor and the external auditor Supervisor and the external auditor have complementary concerns regarding the same matters though the focus of their concerns is different: Banking supervisor External auditor • Is primarily concerned with reporting on the bank’s financial statements ordinarily either to the bank’s shareholders or board of directors. • Is concerned with the assessment of internalcontrol to determine the degree of reliance to be placed on the system in planning and performing the audit. • Is concerned with whether adequate and sufficiently reliable accounting records are maintained in order to enable the entity to prepare financial statements that do not contain material misstatements and thus enable the external auditor to express an opinion on those statements.

19. The relationship between the supervisor and the external auditor (cont.) • When a banking supervisor uses audited financial statements in the course of supervisory activities, the supervisor needs to bear in mind the following factors: • Supervisory needs not ordinarily primary purpose for which financial statements were prepared • Audit in accordance with ISAs designed to provide reasonable assurance that financial statements taken as a whole are free from material misstatement • Importance of accounting policies used in preparation of the financial statements as financial reporting frameworks require exercise of judgment - may allow choices in certain policies or how they are applied • Financial statements include information based on judgments and estimates made by management and examined by auditor • Financial position of bank may have been affected by subsequent events since financial statements were prepared

20. The relationship between the supervisor and the external auditor (cont.) • When a banking supervisor uses audited financial statements in the course of supervisory activities, the supervisor needs to bear in mind the following factors: • Supervisor cannot assume that auditor’s evaluation of internal control for purposes of audit will necessarily be adequate for purposes for which supervisor needs an evaluation, given different purposes for which internal control is evaluated and tested by supervisor and auditor

21. The relationship between the supervisor and the external auditor (cont.) • Areas where the work of banking supervisors and external auditors can be useful to each other: • Communications from auditors to management and other reports submitted by auditors can provide supervisors with valuable insight into various aspects of the bank’s operations • External auditors may obtain helpful insights from information originating from banking supervisor. This information provides an independent assessment in important areas • Communications of matters that came to the attention of the auditor and may require urgent action by the banking supervisor: • information that indicates a failure to fulfil one of the requirements for a banking license • a serious conflict within the decision-making bodies or the unexpected departure of a manager in a key function

22. The relationship between the supervisor and the external auditor (cont.) • Communications of matters that came to the attention of the auditor and may require urgent action by the banking supervisor (cont.): • information that may indicate material breach of laws and regulations or the bank’s articles of association, charter, or by-laws • intention of auditor to resign or removal of auditor from office • material adverse changes in risks of the bank’s business and possible risks going forward • External auditor could also carry out specific assignments or issues special reports in accordance with statutes or at request of banking supervisor to assist supervisor in discharging its supervisory functions

23. Conclusion • Banking supervisors and external auditors therefore cooperate with each other to make their contributions to the supervisory process more efficient and effective