MORNBFI Vol. 1 - Planters Development Bank

§§ 4180Q.8 - 4185Q.908.12.31jurisdiction should be coordinated within thestructure of the institution’s group-widecompliance policy. The organization andstructure of the compliance function and itsresponsibilities should be in accordance withlocal legal and regulatory requirements.§ 4180Q.9 (2008 - 4191Q.9)Outsourcing of compliance function. QBsshould establish policies for managing therisks associated with outsourcing activities.Outsourcing of services/activities canreduce the institution’s risk profile bytransferring activities to others with thenecessary expertise to manage the risksassociated with specialized businessactivities. However, the use of third partiesdoes not diminish the responsibility of theboard of directors and senior managementto ensure that the outsourced activity isconducted in a safe and sound manner andin compliance with applicable laws andregulations.Compliance risk assessment andtesting may be outsourced, subject toappropriate oversight by the complianceofficer: Provided, That a copy of theoutsourcing agreement stating the dutiesand responsibilities as well as rights andobligations of the contracting parties, whichagreement shall be approved by the boardof directors of the institution concerned,must be submitted to the appropriatedepartment of the SES at least thirty (30)days prior to its execution to enable reviewof its compliance with existing regulationson outsourcing of quasi-banking functions.The service level agreement shallensure a clear allocation of responsibilitiesbetween the external service providersand the QB. Furthermore, the outsourcingQB should manage residual risksassociated with outsourcing arrangements,including default, operational failures, andpossible disruption of services.Secs. 4181Q - 4184Q (Reserved)Sec. 4185Q (2008 - 4171Q) InternalControl Systems. The minimum internalcontrol standards established in AppendixQ-5 shall guide all QBs. The followingrecords/data shall be compiled and madeavailable for the inspection of BSPexaminers.a. Records showing compliance withindependent balancing procedures. Theserecords should indicate the accounts andthe periodic balancing proceduresperformed.b. Statements of actual duties ofpersons assigned to handle cash andsecurities.c. All internal control audit reports ortheir equivalent.d. Information/data on the directand/or indirect equity holdings and/orconnection with any firm, partnership orcorporation organized for profit, of all theinstitution’s directors, officers, and majorstockholders, as defined under Secs.4141Q and 4142Q.e. Information/data pertaining toelectronic data processing (EDP)department or service bureau of the QBparticularly on organization, input control,processing control, output control,software, program and documentationstandards, logs on the operations ofmainframes and peripherals, hardwarecontrol and such other EDP controlstandards prescribed by the BSP in separaterules and regulations.§ 4185Q.1 - 4185Q.8 (Reserved)§ 4185Q.9 (2008 - 4164Q.1)Independence of Internal Audit FunctionThe internal audit function must beindependent of the activities audited andfrom day-to-day internal control process. Itmust be free to report audit results,findings, opinions, appraisals and otherinformation to the appropriate level ofmanagement. It shall have authority toManual of Regulations for Non-Bank Financial InstitutionsQ RegulationsPart I - Page 51