Risk Management Manual of Examination Policies - FDIC

INTERNAL ROUTINE AND CONTROLS Section 4.2
INTRODUCTION
The board of directors is responsible for ensuring the
proper and profitable conduct of banking activities; the
safety of the bank's assets; and the accuracy and adequacy
of periodic reports to shareholders, regulatory bodies, and
in some instances, the general public. As a result, the
primary responsibility for creating, implementing, and
monitoring a system of internal control rests with the
directorate. Rarely, if ever, can the board personally
discharge the many duties stemming from these
responsibilities. The workload usually demands delegation
to the management team and other employees. Increases in
asset size and complexity and business lines result in the
need for a continually growing and changing series of
interrelated operating procedures intended to establish and
maintain control over delegated duties. These continual
changes require that the internal control system be
periodically reviewed and updated in order for it to be
effective.
Internal control is a process designed to provide reasonable
assurance that the institution will achieve the following
internal control objectives: efficient and effective
operations, including safeguarding of assets; reliable
financial reporting; and, compliance with applicable laws
and regulations. Internal control consists of five
components that are a part of the management process:
control environment, risk assessment, control activities,
information and communication, and monitoring activities.
The effective functioning of these components, which is
brought about by an institution's board of directors,
management, and other personnel, is essential to achieving
the internal control objectives. This description of internal
control is consistent with the Committee of Sponsoring
Organizations of the Treadway Commission (COSO)
report entitled Internal Control-Integrated Framework.
Institutions are encouraged to evaluate their internal
control against the COSO internal control framework if
they are not already doing so.
BASIC ELEMENTS OF AN INTERNAL
CONTROL SYSTEM
Internal accounting controls are the techniques employed
to prevent and detect errors in the processing of data and to
safeguard assets and the reliability of financial records.
Many internal control techniques are built into the
operating system so that they appear to be part of the
normal processing of a given task. Any attempt to identify
and evaluate the overall system of controls requires that
individual activities be considered in concert with other
activities. The relative importance of an individual control,
or lack thereof, must be viewed in the context of other
control procedures that are in place. Every bank is unique,
and one set of internal procedures, or for that matter, even
a few sets of alternative procedures, cannot be prescribed
for all cases. There are, however, certain basic principles
and procedures that must be present in any bank to ensure
the adequacy of internal controls. These include:
development of an effective organizational structure;
establishment of appropriate accounting procedures;
provisions for the protection of assets; and development
and use of an effective audit program.
Organizational Structure
The control environment begins with the bank's board of
directors, which is responsible for the development of
objectives and policies and for monitoring adherence to
such. The policies established should ensure that decisionmaking
authority is vested at the proper management level
and that management decisions and policies are properly
implemented throughout the organization. An effective
directors’ audit committee, made up of or including outside
directors, is desirable to accomplish that responsibility.
The organization plan must have the complete support of
the board of directors and must establish clear lines of
authority and responsibility. The plan must segregate the
operating and recording functions and provide for
employees who are qualified to perform their assignments.
From an organizational viewpoint, an internal control
system, at a minimum, should provide for the items listed
below.
Directors' Approvals
Limitations imposed by the board of directors with regard
to authority levels, such as lending and investment
authority and responsibilities, should be clearly detailed in
(preferably) written job descriptions and policies. Actions
taken by officers should be subject to periodic review by
the board or a committee thereof. This control feature
should provide for a reporting system that keeps the
directors informed of such items as new loans, overdue
loans, overdrafts, securities transactions, the statements of
condition and income, and expense and audit reports.
Segregation of Duties
The participation of two or more persons or departments in
a transaction causes the work of one to serve as proof for
the accuracy of another. Additionally, when two or more
persons are involved in a transaction, the possibility of
fraud diminishes considerably. Ideally, duties should be
arranged so that no one person dominates any transaction
DSC Risk Management Manual of Examination Policies 4.2-1 Internal Routine and Controls (12-04)
Federal Deposit Insurance Corporation