Download - African Bank

Risk review continued
compliance policy and has unrestricted
access to the CEO, various executive
committees, Group Audit Committee
and the chairmen of the board and
Group Audit Committee. The board
regularly reviews the compliance policy
and its ongoing implementation to
assess the extent to which the bank is
managing compliance risk.
Each business unit has a dedicated
compliance champion whose
responsibility it is to assist with the
implementation and monitoring of
compliance in the particular unit. Mini
manuals have been compiled specific to
the activities of the business unit to assist
the unit to focus on its compliance
requirements. A control self-assessment
approach is followed by the business
units. The mini manuals also facilitate the
monitoring of compliance by these units
and assist the internal audit department
who provides the necessary assurances
that the defined controls are
implemented and adhered to.
Compliance bulletins are issued on a
regular basis to inform the business units,
management and board on any new
statutory or regulatory developments.
This provides an opportunity for
management to be proactive and to
address any new requirements to ensure
timeous implementation.
Regular updates or reports are
submitted to the board and the South
African Reserve Bank on all compliance
related matters. There were no material
issues of non-compliance that had to be
reported during the year under review.
Money laundering
Effective controls have been
implemented and staff trained to comply
with the legislation pertaining to money
laundering. However, as the group does
not offer transactional facilities, the
possibility of the group being used to
launder funds is limited.
Internal audit
With the divisionalisation of certain Theta
subsidiaries into the bank during the
financial year, the risk teams of the
relevant subsidiaries merged to form a
group audit and forensic function with
African Bank Investments Limited 64
dedicated teams assigned to the major
divisions to ensure specialised knowledge
of the processes and control environment
of the division is maintained.
Internal audit operates in terms of an
approved Audit Committee charter.
The charter was revised to include the
additional activities of the audit and
forensic functions for the entire group.
The internal audit function reports
directly to the Audit Committee and
its staff have full and unrestricted access
to the CEO, chairman of the Audit
Committee and, if required, the
chairman of the board. Operationally,
the function reports to the group risk
officer who in return reports to the
financial director.
All group operations, business activities
and support functions are subject to
internal audit. The audit plan is
determined annually, based on the
relative degree of the inherent risks
identified from the ongoing group-wide
risk assessments. It also provides for ad
hoc assignments and special reviews
requested by management or the Audit
Committee or board. Progress against
the audit plan is reviewed at each Audit
Committee meeting.
The group’s internal audit responsibility
is aimed at providing quality audit
services to assist members of executive
and senior management in the effective
discharge of their duties and
responsibilities. To this end, audits are
planned and executed in such a manner
as to provide management with an
independent assessment and appraisal
of the adequacy and effectiveness of the
systems of internal control in place to,
inter alia:
Minimise potential risks and losses;
Recognise opportunities for
improvement;
Identify strengths and weaknesses in
current processes and procedures;
Evaluate the effectiveness of
business practices.
Internal audit operates closely with the
other risk functions of the group,
including operational risk management
and compliance. This is done so as to
obtain a more holistic view of the
potential risks that require additional
attention, as well as to provide the
compliance officer with the necessary
assurance on the existence and
adequacy of controls in place to ensure
satisfactory compliance with all relevant
laws and regulations. Assurance is also
provided to the Operational Risk
Manager regarding certain risks at a
process level.
Audit reports are formally presented to
executives who are directly responsible
for the functions reviewed and all those
in a position to take corrective action on
any control weaknesses identified.
Internal client surveys are periodically
distributed to obtain comments about
the audit process and management’s
experience with the internal audit team.
This is used to improve the effectiveness
of its services to management on an
ongoing basis.
Forensic investigations
Fraud is an inherent risk of any bank.
The group endeavours to combat acts
of transgression and unethical behaviour
through the implementation of dynamic
and sound fraud prevention practices.
The board has enforced a ZERO
TOLERANCE policy on fraud and all
instances involving a reportable offence
are managed consistently and in a
uniform manner.
Staff at all levels are responsible and
accountable for exercising due diligence
and control to prevent, detect, and
report acts or suspicion of acts of a
reportable nature, as defined in the
bank’s fraud policy. The bank’s policy is
to identify and promptly investigate any
possibility of fraudulent or related
dishonest activities against the group
and, when appropriate, pursue legal
remedies available under the law.
The group has recently invested in a
specialist software system that allows
management to track and analyse
incidents in more detail on an ongoing
basis. The creation of a group-wide
event loss database will also enhance
the forensic management and
reporting process at the various levels
of the group.