Banking regulation is becoming stricter
In a broader sense, Europe has been actively contributing to stronger prudential supervision, notably banking supervision. At both global and national levels, there has been a marked tightening of banking and prudential rules. Work on corporate governance and internal audit has progressed too.
In light of the financial crisis experienced in advanced economies, it could fairly be asked whether the rules are to be blamed or the way in which they were applied. The answer to this question is pertinent also for this cooperation Programme.
In fact, it was decided that work foreseen in the Programme concerning the implementation of the Basel II framework should continue. Basel II focuses on risk-based supervision. It requires banks to operate a structured risk management. The internal capital adequacy assessment process (ICAAP) required by pillar 2 is a model for systematic strategic planning for any financial enterprise. Financial firms must have an understanding of their risk and capital situation. They are required to have a continual review of their risks, capital and business environment. I think that they will flourish only if they embrace in their corporate processes and culture the continual learning paradigm. This focus on the systematic management of a financial institution has been repeatedly stressed in both parts of the Cooperation Programme. Rightly so: the soundness of a financial firm depends on its own managers’ capability to understand, measure and master the risks, and to grasp the business opportunities on the basis of a good control of the downside risks. That capability constitutes its first line of defence. Supervision can only be the second line of defence.
Internal audit is an essential part of corporate governance
The internal audit part of the Cooperation Programme has focused on risk-based audit and IT audit. The audit function is orientated towards the organisation’s objectives. Internal audit delivers independent views and advice on the governance of the organisation. A comprehensive and systematic view of the risks posed to the objectives and the organisation as a whole guides the auditors in the planning of their work, as well as in the follow-up to their recommendations. As IT is nowadays an intrinsic part of the infrastructure as well as a critical business tool, the Programme’s focus on the particular challenges of the IT audit was certainly appropriate. Overall, the Programme emphasised risk orientation rather than compliance checks, an approach that is indispensable today. Only an audit function that understands the dynamics of the changing environment and the impact of these changes on the organisation’s objectives can provide the necessary reassurance to the organisation’s top management. The Programme has contributed to such a risk orientation – which has meant a considerable cultural change for the audit function.
I think that risk-based audits need two key ingredients for success: Firstly, chief auditors must enjoy the full trust and backing of the organisation’s top management, even when they convey unpleasant or unwelcome messages. And secondly, the auditors can only do their job properly if they are empowered to act autonomously.
© ECB - European Central Bank
Key
Hover over the blue highlighted
text to view the acronym meaning
Hover
over these icons for more information
Comments:
No Comments for this Article