Board and Management Oversight in Internal Controls: That is Where The Buck Really Stops…

Ramesh S Arunachalam

Rural Finance Practitioner  

I recently heard a few commercial bankers mention that much of the problems in India micro-finance can be attributed to the consistent failure of the board and senior management of MFIs to create a strong and positive control environment. I told them that I felt the same way and had in fact written about it in a small measure in a previous blog post (http://microfinance-in-india.blogspot.com/2010/11/strengthening-internal-controls-during.html.

I am writing this post because these bankers wanted me to highlight the key issues in detail pertaining to the roles of the board and senior management with regard to control environment…especially, based on happenings from the field during the last 6 months

At the outset, let me clarify that the hallmark of a positive control environment is a commitment by the board of directors and senior management to strong controls. And that is where the buck really stops and I hope MFIs will learn from the present Indian crisis and ensure this in real time…Read on…and here are some practical suggestions…

First, as noted above, an MFI’s board of directors and management are mainly responsible for establishing and maintaining an effective internal control system that meets statutory and regulatory requirements and responds to changes in the MFI’s environment and conditions. Thus, they must ensure that the system operates as intended and is modified appropriately when circumstances dictate – as is presently the case in India and especially given the multiple lending, use of agents, frauds and other happenings (of not-so-good processes). I hope that MFI boards and management have begun looking at various field realities in this regard

Second, the board and management must also ensure that the MFI’s information systems produce pertinent, timely and reliable/valid information in a form that will enable staff, auditors, and others stakeholders (as appropriate) to carry out their respective responsibilities. This is a very vital aspect and again, the MIS of many MFIs falls short of required standards on several facets and I again hope that MFI boards and management have started to address the various deficiencies in an honest manner. Please see following post in this regard - http://microfinance-in-india.blogspot.com/2010/11/understanding-state-of-management.html

Third, the board (of directors), which oversees the control system in general, approves and reviews the business strategies and policies that govern the system. They are therefore also responsible for: (a) understanding risk limits and setting acceptable ones for the MFI’s major business activities; (b) establishing the organizational control structure; and (c) making sure that senior management identifies, measures, monitors, and controls risks as well as monitors internal control effectiveness. I really hope that the MFI boards, especially with nominee directors from institutions like SIDBI and other investors, begin to perform these functions seriously

Among other things, this would require MFI boards to: (1) discuss periodically the internal control system’s effectiveness with management; (2) review internal control evaluations conducted by management, auditors, and other stakeholders in a timely manner; (3) monitor management’s actions on auditor and other third party reviewers’ (like staff of rating companies or supervisors, if the Malegam Committee Report is implemented) internal control recommendations and concerns; and (4) periodically review the MFI’s strategy and risk limits. If the board lacks the time, it could also consider delegating these duties and responsibilities to an audit committee, risk committee, or both – this of course would depend on the size and structure of the MFI in question. I would strong recommend that MFI boards have a separate risk committee other than the audit committee

Fourth, senior management oversees operations and provides leadership and direction for the communication and monitoring of control policies, practices, and processes. In effect, they (are to) implement the board’s strategies and policies by establishing effective internal control and delegating or allocating control duties and responsibilities to appropriate personnel. Senior management is also responsible for performing background checks on staff members before they are hired and ensuring that they are qualified, experienced, trained, and compensated to effectively conduct control activities. I hope that senior management in MFIs start to focus on these tasks with utmost seriousness and urgency. Much of the problems that have occurred in Andhra Pradesh relates to lack of appropriate and trained personnel with regard to maintaining effective internal controls and that needs to be addressed at various (MFI) levels immediately

Fifth, organizations grow and the environment changes and therefore the board and management must continually evaluate whether the control system’s methods, records, and procedures are proper in relation to the MFI’s changing asset size, organizational and ownership characteristics, business activities, operational and environmental complexity, risk profile, methods of processing and maintaining data, legal and regulatory requirements and the like. Assuming that the world of tomorrow or today is the same as that of yesterday is a serious flaw that was committed by many MFIs with regard to their control environment and this needs to be addressed immediately

Last but not the least, the board of directors must ensure that management properly considers the risks and control issues of emerging MIS and related technologies, enhanced information systems, and various of electronic/mobile banking. These issues typically include: more users with access to information systems; less segregated duties; a shift from paper to electronic audit trails; a lack of appropriate standards and controls for end-user systems; and, more complex contingency planning and recovery planning for information systems.

Thus, board and senior management can play a very useful and positive role in continually shaping the control environment and they must do so on a regular basis – I really wish that the enthusiasm to serve on MFIs boards is also accompanied by the drive and desire to work with MFIs to enable them to improve their somewhat nascent (control) systems in comparison to their burgeoning growth and complex operational environment. This is undoubtedly a priority task for most MFIs, especially in the crisis ridden Indian micro-finance industry…

Have A Nice Day!