Corporate Governance for Banks in Southeast Europe: Policy - IFC

Effective systems of risk management, internal audit, and internal control are often taken for granted indeveloped banking markets. For example, the Bank of Montreal recently added 200 people to strengthenits risk function, and Toronto Dominion Bank added 500 new staff on its risk side. SEE banks on the otherhand may have difficulty finding and affording one highly competent risk professional. These figures put intoperspective the relative scale of SEE banks and their capacity to respond.On the other hand, it is worth noting that a large number of risk professionals does not equate to good riskmanagement; even in developed markets where financial and human resources are broadly available, firmshave been known to accommodate their risk control to meet short-term sales or profitability objectives. Forexample, before the crisis, positions for risk professionals in UBS were filled by individuals with sales (not riskmanagement) backgrounds in order to accommodate growth. 47 This confirms the common knowledge thatthere are important human elements to developing a sound risk management culture.Another practical challenge in SEE is the communication of risk up to the board. In SEE banks, includinginternational subsidiaries, communication from the risk control functions goes to management first; thechief executive officer and management are inevitably the first port of call for the internal auditor. Theaudit committee is likely to be secondary, especially in countries where the internal audit function is notwell-developed and where internal auditors are junior and do not have sufficient stature to go to the auditcommittee or balance their authority against the management structure.It is important to note that the risks involved in banking in SEE pertain mainly to operational risk and creditrisk and not to financial instruments, asset-backed securities, sophisticated market trading risk, or specialpurposevehicles, as was the case in more developed banking countries during the financial crisis. Thedifferent nature of risk in the SEE region calls for an adapted approach to risk management.Recommendations:The control environment: Bank boards need to assure themselves that the bank’s control environmentis functioning properly. The control environment should comprise not only risk management, compliance,internal controls, and the internal audit, but also the external audit. The importance of the general counselfunction and legal function in managing risk should also be recognized. Each of these functions should haveadequate authority, stature, independence, resources, and access to the board. Larger banks should have asufficiently independent audit committee to ensure professional oversight of the control environment.Communication of risk to the board: The communication of risk needs attention. Even though internalaudit and chief risk officers (CROs) may have organization-chart reporting lines to the board or to an auditcommittee, it is important to ensure that these lines of communication function in practice and are secure.Further, risk and audit committees should not localize information on risks, which needs to be shared with thefull board.Board review of the control environment: SEE boards should approve their bank’s control policies andassess the extent to which the bank is managing its risk effectively. They should regularly review (at leastannually) policies and controls with senior management to determine areas needing improvement andto identify and address significant risks. The board should ensure that the control functions are properlypositioned, staffed, and resourced and are carrying out their responsibilities independently and effectively. Indoing so, they should work directly with the internal auditor and the CRO.47 OECD, “The Current Financial Crisis: Causes and Policy Issues,” Financial Market Trends (2008), 10.http://www.oecd.org/dataoecd/47/26/41942872.pdf.Corporate Governance for Banks in Southeast Europe Policy Brief 35