Statutory Bank Audit under CBS Environment Views Exchange Chartered Accountants Study Circle 16th March 2015 Arif Ahmed, Partner Arif Ahmed & Associates Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

Overview of Core Banking System Back Office Credit Card Switch

ATM Switch

Server Mobile Banking

Branch Net / Phone Banking

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

Scope of CBS • Branch uses a core banking solution • All transactions are captured and processed • Are there functions that are not seamlessly integrated like AML reporting • All calculations are automated • Statements are generated from the CBS

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

1

Limitations of CBS • The data centre takes care of data, analysis, internal controls, and we need to focus on systems audit for the same • Following areas comes outside CBS – Documentation and security of documents – Inspection and pledge – Discretionary powers – KYC checks – Process adherence Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

Set Up Issues • Configuration – Product Master level – Account Master Level – Account Level

• General ledger – GL subhead – Scheme – Account

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

Impact of CBS on statutory financial audit • • • • • • • • • •

Migration and software updates Importance of Day end Reports Impact of system generated transactions Intersol Transactions Parking Transactions Impersonal Accounts Security Maintenance Advance related areas Other important areas Jilani and Ghosh committee Reporting

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

2

Migration • • • •

Certificate of Verification of Integrity Consistency of data Migration Audit Interest computation

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

Software Updates • Introducing feature of application of Processing Charges and Annual Review charges in loan accounts by the system at Data Centre instead of the branch.

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

Day end reports • • • • • • • •

Exceptional report (EXCPRPT) List of users Access Log Rejected/Cancelled entries Over-limits/TOD Report GL affected Balances Report Report on large cash transactions/KYC Anti Money Laundering

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

3

Exception Reports • • • • • • • • • •

Debit /Credit balance change Maturity record deleted Inactive accounts reactivated Excess allowed over limit Debits to Income head accounts Overdue bills and bills returned Withdrawal against clearings Deposits accounts debit balance Temporary O/D beyond sanction limit Standing instruction failed in day

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

Reports we can ask for • Loans sanctioned beyond discretionary limits • Loans that are due and pending for review/ renewal beyond 3 months. • Expiry of Loan documents/ Security Insurance • Term loans having Moratorium period • Term loans where sanctioned repayment period has ended but account shows balance • Term loans with over 3 instalments outstanding Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

Reports we can ask for • CC cases where stock statements have not been submitted for over 3 months • Over limit CC accounts on 31st March • Restructured accounts – asset category wise • NPA account with multiple relation • Debit in income head account

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

4

Reports we can ask for

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

System generated transactions • • • • •

Application of Interest Application of service charges Updation of parameters globally Balancing & Reconciliations Classification of inoperative accounts

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

Intersol transactions • Reconciled centrally at The Data Centre as a part of EoD • Large Balances

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

5

Advances • Master File - Check Parameters – Repayment Schedule – EMI’s – Interest Rate Field – Drawing Power – Penal Interest – Overdue Principal and Interest (LAOPI) – Asset Classification • Account Inquiry (ACI) Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

Securities master maintenance • To check whether values of various securities are updated promptly and drawing powers are allowed on current value of such securities. • Security Register (SRM) – value of securities, – date of inspection, – date of valuation.

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

Linking of credit limits • In CBS environment, in order to know the consolidated outstanding and value of assets of a customer under various credit-limits, all limits are linked to central/common node. – One NPA all NPA – Duplicate Cust-id

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

6

Income recognition and asset classification • To check asset classification done by the system for correctness. • To check whether past–due status has been marked to all NPA accounts. • Provisioning at HO, normally not by system • Reversal of interest • Notional interest accounting

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

Reasons for Incorrect Interest • Interest rate not mapped correctly: for example, interest rate of housing loan to staff linked to interest rate of vehicle loan to staff. • Interest rate field kept as “Zero” • Interest collection flag kept as “N” instead of “Y” • Next interest demand date not changed and kept same as date of application of interest. • Account wrongly marked as Past-due/ “NPA”

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

TDS • To check whether accounts of customers submitting Form 15G/15H have been linked to correct TDS Table. • To check whether all accounts of the customer have been linked to a customer-id for the purposes of TDS.

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

7

Auto renewal of overdue deposits • To check whether auto–renewal of overdue TDR has been enabled • Comment on – Effective renewals and failures and – On application of interest

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

Parking/Proxy transactions • System generated – Standing instructions with sol closed • User generated – – Ambiguity – For instance: Depositing RD installment in excess of the cumulative installments. This entry may not be posted in RD Account and posted in Proxy/parking transactions account and reversed subsequently. Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

Impersonal/personal accounts • For instance: (a) sundry credit accounts, (b) sundry deposit accounts, (c) suspense (d) H.O Account etc – Postings in sundry credit accounts and sundry deposit accounts have been duly verified by the branch. – Deposit from public and Deposit from Banks have been shown correctly in appropriate GL Subheads. – Credit balances in Loan accounts have not been shown in sundry deposit account.

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

8

ATM • To check whether ATM Cash has been verified periodically. • ATM Reconciliation account – To check whether ATM transactions are reconciled periodically.

• To check whether adequate control over physical inventories of ATM cards has been exercised.

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

Internet Banking • To check & comment specifically whether adequate validation procedures such as verification of data relating to customer profile – Identity and address proof – Nature of constitution and – Mode of operations etc. fed into system have been carried out at Branch

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

RTGS / Swift Transfer • The process of the transfer – Based on branch based instruction – Based on internet based instructions

• Branch based instructions – Many branch asks customers for a spreadsheet – The legal instruction is the written document – Dates of receipt of instruction, debit to the transferor account, and credit to transferee

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

9

Other important areas • Verify that balance in GL tallies with the balance in Subsidiary book. • Charges automatically calculated. • Charges calculated manually not through parameters. • Penalty Interest. • Lien Marking of fixed deposits.

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

Other important areas • • • • •

Sensitive stationary maintenance module Software Licenses. Manuals – Hardware and software Error reporting Annual Maintenance and vendor vigilance

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

Other important areas • • • • • •

Fixed Asset Register Anti-virus updation Internet connectivity IS audit KYC/AML Module Use of SQL

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

10

Special Issues for fraud • Check for and comment on whether or not automatic NPA marking was activated – Look at the system configuration – Include in this in management letter

• Standing instruction failed in day • Change in master before closing

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

Special Issues for Fraud • Review some consideration of fraud – Active ID for transferred employees – Employee absent but transaction from same ID – Duplicate user ID – Review of employee job profile and privileges – Number of head teller in the branch – Employees permitted to commit inter-branch transaction – Number of open ports on system Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

Areas included under LFAR – Whether hard copies of accounts are printed regularly – Areas of operations covered – Are access and data security measures and other internal controls adequate – Physical Access – Logical Access – Database Access – Back-up Measures: Responsibility and versions – Contingency and disaster recovery plans Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

11

Areas included under LFAR • Scrutiny of the Information System Audit Report. • Jilani Committee Recommendation – Appropriate documented control measures protecting system from attacks of unscrupulous elements: Logical access controls, password – All aspects of security, reliability and accessibility are ensured before introduction of EDP applications in place of manual system by having pilot parallel runs.

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

Areas included under LFAR • Jilani Committee Recommendation – Consistent and reliable system of inputting, processing and generation of output of data. – EDP activities brought under scrutiny if inspection and audit including the financial aspects – Are there formal methods for incorporating changes in standard software

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

Areas included under LFAR • Ghosh Committee Recommendation – Are standards devised for suitable internal control (IT Policy) – Are standards in place for fully computerised branches – Replacement of unwilling workers in computer area

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

12

Thank You

Bank Statutory Audit in a CBS Environment © South-Asian Management Technologies Foundation

13