1. vector INTERNAL CONTROL Mike Trigg

2. vector WHAT IS INTERNAL CONTROL? A key part of effective corporate governance Policies and processes to: - make operations efficient and responsive to risk - ensure quality of internal/external reporting - ensure compliance with internal rules, regulations and laws

3. vector COMPONENTS Controls Information and communication processes Monitoring processes

4. vector KEY FEATURES Embedded in bank’s operations and part of the culture Able to respond quickly to changing risks inside and outside the bank Procedures for urgent escalation of control weaknesses

5. vector DEVELOPING THE INTERNAL CONTROL REGIME 1Define objectives 2Define risks and risk appetite 3Assess significant risks 4Design controls 5Allocate ownership and accountability 6Monitor

6. vector (1) OBJECTIVES Clear objectives Communicated to, and understood by, all employees Critical success factors and performance indicators

7. vector (2) DEFINE RISKS AND RISK APPETITE Internal External Operational Credit Liquidity Market Reputational

8. vector (3) RISK ASSESSMENT PROBABILITY IMPACT

9. vector (4) DESIGN CONTROLS Focused on significant risks Responsive Early alert Define accountability Define freedom of action Effective flow of information

10. vector (5) MONITOR The Board Risk functions The Business Audit Committee Internal Audit External Audit

11. vector Risk Appetite Policies Controls Local Business Operations Business Senior Management Risk Functions BoardReporting Risk Reporting Performance

12. vector BOARD/DIRECTORS Ultimate responsibility to maintain internal control system Must set policies Must review effectiveness of regime Must disclose status of regime to stakeholders (regulators?)

13. vector RISK FUNCTIONS Design and recommend policy Formulate risk assessment tools Independent view Approvals within policy

14. vector THE BUSINESS All employees are accountable Implement policy Identify, evaluate, escalate risks Create internal controls that reflect: - Board policy - Risk appetite - Risk assessment - Bank’s objectives

15. vector AUDIT COMMITTEE Receive reports Independent assessment Recommendations to full Board

16. vector INTERNAL AUDIT/EXTERNAL AUDIT External Audit is finance focused Provides assurance on implementation of policies and controls Recommends corrective action Determines audit programme through risk assessment Independent line to Chairman/CEO

17. vector CONCLUSIONS 1Define bank’s objectives 2Define risks to those objectives 3Design policies and controls to manage risks 4Define ownership and accountability 5Encourage honesty and transparency 6Monitor aggressively