Annual Report 2016

30
Regulatory Audit | FAOA 2016
and examined these in detail in the
year under review. This examination
resulted in the following points:
Audit of compliance with risk
management and risk control
requirements (Art. 12 BankO, Art. 7
LiqO, Art. 12a CISO)
In many cases, insufficient appropriate
evidence was obtained in the
credit and interest rate risk area,
which is fundamental to banks. Credit
exposures and the recoverability of
collateral were not scrutinised with
sufficient professional scepticism.
Furthermore, the scope of sample
testing (determination of total population,
selection criteria, testing of
sample etc.) was incomprehensible.
Using the work of the internal
auditor and involvement of external
experts (e.g. actuaries)
Deficiencies were found in the use
and assessment, as regards ICS effectiveness,
of third party audit reports
on outsourced systems and functions.
For example, ISAE 3402 ITGC reports
did not cover the whole audit period
and no independent work was performed.
In several cases the work
and findings of the internal auditor or
actuary were insufficiently assessed
when relied upon.
Audit of compliance with AMLA
requirements
In several cases deficiencies were
found in sample design, which should
reduce sampling risk to an acceptably
low level (margin note 42 of FINMA
Circular 2013/3). In certain cases no
comprehensive or sufficiently detailed
documentation was prepared, such
that an informed third party could
neither understand nor re-perform
the audit procedures (margin note 39
of FINMA Circular 2013/3).
Root cause analysis and measures
The process for conducting root cause
analysis and determining measures in
the regulatory audit area is basically
the same as for financial audit.
The 2016 findings showed the importance
of measures to improve knowledge
of oversight law. These covered:
– Qualitative and quantitative training
concept improvements at the
regulatory audit firms;
– Involvement of external specialists;
– Fundamental redesign of audit
tools, programmes and checklists;
– Fundamental revision of review
levels;
– Fundamental redesign of internal
quality assurance system, as
well as the implementation and
improvement of regulatory audit
monitoring.
AMLA developments/audit impact
The past year was marked by numerous
prominent money laundering cases
concerning the Brazilian Petrobras
and the Malaysian State Fund 1MDB,
as well as by intense discussion over
the role of offshore structures in the
financial system. FINMA believes 41
that the risk of money-laundering in
Switzerland has increased.
Switzerland is recognised worldwide
as a leading location for private client
cross-border asset management business.
This places correspondingly high
demands on Swiss anti-money laundering
capabilities. As the extended
arm of FINMA, regulatory auditors
and regulatory audit firms are particularly
called upon:
First, audit procedures relating to
money laundering risks require great
professional scepticism. Secondly,
financial intermediaries and regulatory
auditors were confronted by various
developments in the regulation
of money laundering risks last year.
The revised FATF recommendations 42
were embedded into Swiss law as per
1 January 2016. These encompassed
a revision of the anti-money laundering
law, the relevant ordinances, FIN-
MA circulars and the self-regulation
standards of the profession. For their
part, the financial intermediaries were
required to tailor and update their
internal regulations and processes.
FINMA defines the content and methodology
of the regulatory audit and has
determined specific minimum testing
requirements for the audit of money
laundering risks. Given the increased
risk of money laundering, and the
amendment of the applicable regulatory
bases and specific minimum testing
requirements in this area, the FAOA
will continue to pay particular attention
to audit quality as regards money
laundering risks (see also «Regulatory
audit points of focus for 2017»).
Monitoring of training hours
The licensing conditions that came
into force on 1 January 2015 include
requirements with respect to minimum
annual training hours. The regulatory
audit firms could choose to
confirm the compliance of their regulatory
auditors-in-charge themselves.
Alternatively, each regulatory auditor-in-charge
could confirm compliance
personally using the appropriate
evidence. In the first case, a sample
of the hours confirmed is reviewed by
the FAOA during its inspections. The
personal confirmations of regulatory
auditors-in-charge are reviewed by
the FAOA on an ongoing basis.
The training hours required for licensing
could be verified with few exceptions.
In isolated cases training hours
were incorrectly reported. The most
common fault was to report hours
mistakenly under the training regulations
of EXPERTsuisse. Under these
41 FINMA annual media conference of
7 April 2016: Speech by Mark Branson
«Geldwäschereibekämpfung ist keine Kür,
sondern Pflicht»
42 https://www.admin.ch/opc/de/federal-gazette/2014/9689.pdf