Corporate Governance for Banks in Southeast Europe: Policy - IFC

B. Risk management and internal controls 43,44B1. Risk management versus internal control 45Risk management and internal control are twoprocesses that work hand in hand. Risk managementis intended to 1) identify risks; 2) assess the bank’sexposure to risks; 3) monitor exposure and conductconsequential capital planning; 4) monitor and assessdecision making as it relates to risk, in particular,whether risk decisions are in line with board-approvedrisk tolerance and policy; and 5) report to seniormanagement and the board.Internal control, on the other hand, ensures thateach key risk has an associated policy and controlmechanism, and that each control policy andmechanism is being applied effectively. Internal controlsprovide a variety of assurances to management, suchas the reliability of information, compliance with law,compliance with governance systems, prevention ofexcessive managerial discretion or fraud, and so on. It isa key responsibility of the board to ensure that effectivesystems of risk management and control are in place. 46Risk Management and RiskManagement Culture“When sophisticated risk management comestoo late, I do not think there is much reasonto celebrate.”George Bobvos, Montenegro“Effective risk management is not abouteliminating risk-taking; risk-taking is afundamental driving force in business andentrepreneurship. The aim should be to ensurethat risks are understood and managed and,when appropriate, communicated.”Hans Christiansen, Denmark“One of the most important lessons that I thinkcomes out of the crisis from a governancepoint of view is a focus on the risk governancerole of a board.”A best-practice board will typically need to rely onan internal auditor to provide the board, via theCatherine Lawton, United Kingdomaudit committee, with assurances regarding thebank’s risk management and internal controls andcorporate governance processes. The internal auditor traditionally reports to management administrativelyand to the board functionally, with the head of internal audit reporting directly to the chairperson of theaudit committee or to an independent lead board member. Internal auditors should enjoy substantiveindependence from management and have direct access to the board.Supervisors and bankers may use the term internal control to refer to a variety of aspects of the controlenvironment, including risk management, internal audit, controls, and compliance. Irrespective of how thefunctions of the control environment are named, each one is necessary and should be performed effectively.In addition, a bank’s general counsel or legal function contributes significantly to the control of risk. Manyproblems in developed markets during the recent financial crisis resulted from legal risk failures.For banks in the SEE region, implementing effective and reliable risk management and internal controls is oneof the most important challenges. It is only through an effective control environment that the board can beconfident that the information and reports that it receives are reliable. It is also the only way the board canexpress itself with any certainty on the risks in the bank.43 2010 BIS Principles, Section III.C, p. 17.44 For additional specific guidance on risk management, see CEBS, High Level Principles for Risk Management (2010).http://www.eba.europa.eu/documents/Publications/Standards---Guidelines/2010/Risk-management/HighLevelprinciplesonriskmanagement.aspx.45 2010 BIS Principles, Section III.C, p. 17.46 See also BIS, Framework for Internal Control Systems in Banking Organizations (1998).34Policy BriefCorporate Governance for Banks in Southeast Europe