Corporate Governance for Banks in Southeast Europe: Policy - IFC

B. Risk management and internal controls 43,44
B1. Risk management versus internal control 45
Risk management and internal control are two
processes that work hand in hand. Risk management
is intended to 1) identify risks; 2) assess the bank’s
exposure to risks; 3) monitor exposure and conduct
consequential capital planning; 4) monitor and assess
decision making as it relates to risk, in particular,
whether risk decisions are in line with board-approved
risk tolerance and policy; and 5) report to senior
management and the board.
Internal control, on the other hand, ensures that
each key risk has an associated policy and control
mechanism, and that each control policy and
mechanism is being applied effectively. Internal controls
provide a variety of assurances to management, such
as the reliability of information, compliance with law,
compliance with governance systems, prevention of
excessive managerial discretion or fraud, and so on. It is
a key responsibility of the board to ensure that effective
systems of risk management and control are in place. 46
Risk Management and Risk
Management Culture
“When sophisticated risk management comes
too late, I do not think there is much reason
to celebrate.”
George Bobvos, Montenegro
“Effective risk management is not about
eliminating risk-taking; risk-taking is a
fundamental driving force in business and
entrepreneurship. The aim should be to ensure
that risks are understood and managed and,
when appropriate, communicated.”
Hans Christiansen, Denmark
“One of the most important lessons that I think
comes out of the crisis from a governance
point of view is a focus on the risk governance
role of a board.”
A best-practice board will typically need to rely on
an internal auditor to provide the board, via the
Catherine Lawton, United Kingdom
audit committee, with assurances regarding the
bank’s risk management and internal controls and
corporate governance processes. The internal auditor traditionally reports to management administratively
and to the board functionally, with the head of internal audit reporting directly to the chairperson of the
audit committee or to an independent lead board member. Internal auditors should enjoy substantive
independence from management and have direct access to the board.
Supervisors and bankers may use the term internal control to refer to a variety of aspects of the control
environment, including risk management, internal audit, controls, and compliance. Irrespective of how the
functions of the control environment are named, each one is necessary and should be performed effectively.
In addition, a bank’s general counsel or legal function contributes significantly to the control of risk. Many
problems in developed markets during the recent financial crisis resulted from legal risk failures.
For banks in the SEE region, implementing effective and reliable risk management and internal controls is one
of the most important challenges. It is only through an effective control environment that the board can be
confident that the information and reports that it receives are reliable. It is also the only way the board can
express itself with any certainty on the risks in the bank.
43 2010 BIS Principles, Section III.C, p. 17.
44 For additional specific guidance on risk management, see CEBS, High Level Principles for Risk Management (2010).
http://www.eba.europa.eu/documents/Publications/Standards---Guidelines/2010/Risk-management/HighLevelprinciplesonriskmanagement.aspx.
45 2010 BIS Principles, Section III.C, p. 17.
46 See also BIS, Framework for Internal Control Systems in Banking Organizations (1998).
34
Policy Brief
Corporate Governance for Banks in Southeast Europe