Risk Assessment and Risk-based Auditing At Systemically Important and Large MFIs: Some Practical Guidelines…

Ramesh S Arunachalam

Rural Finance Practitioner  

Risk assessment and risk-based auditing are very critical mechanisms and need to be undertaken at large and systemically important MFIs and this post provides some practical suggestions in this regard…

Risk assessment is a process by which an auditor identifies and evaluates the quantity of the MFIs risks and the quality of its controls over those risks. Through risk-based auditing, the board and auditors use the results of the risk assessments to focus on the areas of greatest risk and to set priorities for audit work. That however does not mean that the audit department can lose sight of or ignore areas that are rated low-risk. An effective risk-based auditing program will ensure adequate audit coverage for all of an MFI’s auditable activities. The frequency and depth of each area’s audit should vary according to the auditor’s risk assessment.

Program Design: Properly designed risk-based audit programs increase audit efficiency and effectiveness. The sophistication and formality of audit approaches will vary for individual MFIs depending on the MFIs’ size, complexity, scope of activities, staff capabilities, quality of control functions, geographic diversity, and technology used. All risk-based audit programs should:

·         Identify all of the MFI’s operations, product lines, services, and functions (i.e., the audit universe).

·         Identify the activities and compliance issues within those operations, product lines, services, and functions that the MFI should audit (i.e., auditable entities).

·         Include profiles of significant operational units, departments, and products that identify business and control risks and document the structure of risk management and internal control systems.

·         Use a measurement or scoring system to rank and evaluate business and control risks of significant operational units, departments, and products.

·         Include board or audit committee approval of risk assessments or the aggregate result thereof and annual risk-based audit plans (that establish internal and external audit schedules, audit cycles, work program scope, and resource allocation for each area to be audited).

·         Implement the audit plan through planning, execution, reporting, and follow-up.

·         Have systems that monitor risk assessments regularly and update them at least annually for all significant operational units (regions or branches), departments, and products.

Risk Matrix and Guidelines: An effective scoring system is critical to a successful risk-based audit program. In establishing a scoring system, directors and management must consider all relevant risk factors so that the system minimizes subjectivity, is understood, and is meaningful. Major risk factors commonly used in scoring systems include:

·         The nature of transactions (e.g., volume, size, liquidity);

·         The nature of the operating environment (e.g., compliance with laws and regulations, complexity of transactions, changes in volume, degree of system and reporting centralization, economic and regulatory environment);

·         Internal controls, security, and MIS;

·         Human resources (e.g., experience of management and staff, turnover, competence, degree of delegation); and

·         Senior management oversight of the audit process.

Auditors or risk managers should develop written guidelines on the use of risk assessment tools and risk factors and review the guidelines with the audit or risk committee. The sophistication and formality of guidelines will vary for individual MFIs depending on their size, complexity, scope of activities, geographic diversity, and technology used. Auditors will use the guidelines to grade or assess major risk areas. These guidelines generally define the basis for assigning risk grades, risk weights, or risk scores (e.g., the basis could be normal industry practices or the MFI’s own historical experiences). They also would define the range of scores or assessments (e.g., low, medium, and high, or a numerical sequence, for example, 1 through 5). The written guidelines should specify:

·         The length of the audit cycles based on the scores or assessments. Audit cycles should not be open-ended. For example, some MFIs set audit cycles at 12 months or less for high-risk areas, 24 months or less for medium-risk areas, and 36 months or less for low-risk areas. However, individual judgment and circumstances at each MFI will determine the length of its audit cycles.

·         Guidelines for overriding risk assessments. The guidelines should specify who could override the assessments, the approval process for such overrides, and the reporting process for overrides. The override process should involve the board or its audit committee, perhaps through final approval authority or through timely notification procedures. Overrides of risk assessments should be more the exception than the rule.

·         Timing of risk assessments for each department or activity. Normally, risks are assessed annually, but they may need to be assessed more often if the MFI or a specific product experiences excessive growth (as between April 2007 – 2009), if MFI staff or activities change significantly, or changes to or new laws and regulations occur.

·         Minimum documentation requirements to support scoring or assessment decisions.

Management Responsibilities: Day-to-day management of the risk-based audit program rests with the internal auditor or internal audit manager, who monitors the audit scope and risk assessments to ensure that audit coverage remains adequate. The internal auditor or audit manager also prepares reports showing the risk rating, planned scope, and audit cycle for each area. The audit manager should confirm the risk assessment system’s reliability at least annually or whenever significant changes occur within a department or function.

Line department managers and auditors should work together in evaluating the risk in all departments and functions. Auditors and line department managers should discuss risk assessments to determine whether they are reasonable. However, the auditors, with concurrence of the board, audit committee or risk committee, should have ultimate responsibility for setting the final risk assessment. Auditors should periodically review the results of internal control processes and analyze financial or operational data for any effect on a risk assessment or weighting. Accordingly, MFI management should keep auditors current on all major changes in departments or functions, such as the introduction of a new product, implementation of a new system, changes in laws or regulations, or changes in organization or staff.

I hope that systemically important MFIs including large NBFCs wake up to have serious internal audits as part of their institutions…this alone can help prevent the kind of institutional lapses that led to the present day crisis…

Have a Nice Day!

Designing The Internal Audit Function At MFIs: Some Critical Issues…

Ramesh S Arunachalam

Rural Finance Practitioner  

Internal auditors play a very critical role in any organization and the same applies to micro-finance.

Role of Internal Auditors: The primary role of internal auditors is to independently and objectively review and evaluate an MFIs activities to maintain or improve the efficiency and effectiveness of risk management, internal controls, and corporate governance. They do this by:

·         Evaluating the reliability, adequacy, and effectiveness of accounting, operating, and administrative controls.

·         Ensuring that MFI internal controls result in prompt and accurate recording of transactions and proper safeguarding of assets.

·         Determining whether an MFI complies with laws and regulations and adheres to established policies.

·         Determining whether management is taking appropriate steps to address current and prior control deficiencies and audit report recommendations.

Internal auditors must understand an MFIs strategic direction, objectives, products, services, processes as well as clients to conduct these activities and make a judgement on the above. The auditors then communicate findings to the board of directors or its audit committee, who then will brief and discuss with senior management.

In addition, internal auditors often have a role in transformation activities. This role may include such duties as helping the board and management evaluate safeguards and controls, including appropriate documentation and audit trails, during the transformation process at the MFI – this is a very critical issue as many MFIs transform to become for profits from non-profits

Oversight and Structure: MFIs should conduct their internal audit activities according to existing professional standards and guidance. But how the internal audit function is accomplished depends on the MFI’s size, complexity, scope of activities, and risk profile, as well as the responsibilities assigned to the internal auditor by the board of directors.

In larger MFIs, a chief auditor and a full-time internal audit staff may accomplish the internal audit function. In other MFIs, the internal audit function may be accomplished by one or two employees or a holding company or even by an outside vendor. In many small MFIs, the officer or employee designated as a part-time auditor may also have operational responsibilities. In any case, to maintain independence, the person responsible for accomplishing the internal audit function should be independent of whatever area is being audited and should report findings directly to the board or its audit committee.

The audit committee should position the internal audit function in the institution’s organizational structure such that the function will perform its duties with impartiality and not be unduly influenced by managers of day-to-day operations. The ideal organizational arrangement is having the internal audit function report directly and solely to the audit committee regarding both internal audit issues and administrative matters, e.g., resources, budget, and compensation.

Some MFIs place the manager of internal audit under a dual reporting arrangement: functionally accountable to the audit committee for matters such as the design of audit plans and the review of audit scope and audit findings, while reporting to a senior executive on administrative matters. Such an arrangement potentially limits the internal audit manager’s independence and objectivity when auditing the senior executive’s lines of business. Thus, chief financial officer, controller, or other similar positions should generally be excluded from overseeing the internal audit activities even in a dual role. In structuring the reporting hierarchy, the audit committee should weigh this risk of diminished independence against the benefit of reduced administrative burden in adopting a dual reporting organizational structure. Under a dual reporting arrangement, the internal audit function’s objectivity and organizational stature is best served when the internal audit manager reports administratively to the chief executive officer.

That said, the best option of course is to ensure that the internal audit departmental head reports directly to the board or audit committee of the MFI, to ensure that all potential and real conflicts of interests are negated…

Have A Nice Day!

Assessing The Quality of Internal Control at MFIs: Guidelines for Regulators and Supervisors…

Ramesh S Arunachalam

Rural Finance Practitioner

Monitoring the quality of internal control at (NBFC) MFIs would become a key task, if the Malegam Committee Report is accepted. And an earlier post already provided a draft suggested questionnaire by which supervisors and examiners can collect basic information on the internal control system at MFIs (http://microfinance-in-india.blogspot.com/2011/04/monitoring-quality-of-internal-control.html)

While that post would enable collection of general information, supervisors/examiners should use appropriate mechanisms/tools to judge the adequacy of internal controls at MFIs and this must be done for each of the components (see post: http://microfinance-in-india.blogspot.com/2011/04/critical-internal-control-components-in.html) of the internal control system given below. This post attempts to provide some practical guidance in this regard:

A) Control Environment

Supervisory Objective: Determine whether the institution’s (MFI’s) control environment embodies the principles of strong internal control. For this, supervisors and examiners need to closely look at:

1.      Assess the effectiveness of the control environment. For this, they should look at:

• The integrity, ethics, and competence of personnel at the MFI
• The organizational structure of the institution and its reporting structure
• Management’s philosophy and operating style and especially that of senior and line management
• External influences affecting operations and practices including the lending and equity environment
• Personnel policies and practices and the entire HR system with the kinds of incentives provided
• The attention and direction provided by the board of directors and its committees, especially the audit or risk management committees.

2.      Determine whether the board periodically reviews policies and procedures to ensure that proper risk assessment and control processes have been instituted at the MFI.

3.      Determine whether there is an audit or other control system in place at the MFI to periodically test and monitor compliance with internal control policies/procedures and to report to the board instances of noncompliance.

• Does the board review the qualifications and independence of internal and external auditors?
• Do auditors report their findings directly to the board or its audit committee?
• Does the board take appropriate follow-up action when instances of noncompliance are reported?

4.      Determine whether management provides the board and its representatives complete access to bank records and this is a critical issue

5.      Determine whether board decisions are made collectively or whether dominant individuals control those decisions. This again is crucial 

6.      Determine whether management information systems provide the board with accurate and reliable information that they need to make informed and timely decisions.

7.      Determine whether the board receives adequate information about the MFI’s own (internal) risk assessment process and this would applicable for systemically important and large MFIs

8.      Determine whether the board and/or management communicate policies regarding the importance of internal control and appropriate conduct to all MFI employees.

9.      Determine whether codes of conduct or ethics policies exist at the MFI. This could even by the regulators’ suggested code (like that of RBI) or the codes provided by the various associations (Sa-Dhan or MFIN)

·         Do audit or other control systems exist to periodically test for compliance with codes of conduct or ethics policies?

·         Do audit or other control system personnel routinely review policies and training regarding ethics or codes of conduct?

B) Risk Assessment[i]

Supervisory Objective: Determine whether the MFI’s risk assessment system allows the board and management to plan for and respond to existing and emerging (including political) risks in the MFI’s activities. For this, supervisors and examiners need to:

1.      Determine whether the board and management of the MFI involve audit personnel or other internal control experts in the risk assessment and risk evaluation process.

2.      Determine whether the risk assessment/evaluation process involves sufficient staff members who are competent, knowledgeable, and provided with adequate resources.

3.      Determine whether the board and management at the MFI discuss and appropriately evaluate risks and consider control issues during the preplanning stages for new products and activities.

4.      Determine whether audit personnel or other internal control experts are involved when the MFI is developing new products and activities.

5.      Determine whether the board and management of the MFI consider and appropriately address technology issues including for new product development and introduction

C) Control Activities

Supervisory Objective: Determine whether the board and senior management at the MFI have established effective control activities in all lines of business. For this, supervisors and examiners need to: 

1.      Determine whether policies and procedures exist at the MFI to ensure that decisions are made with appropriate approvals and authorizations for transactions and activities.

2.      Determine whether processes exist at MFI to ensure that

• The performance and integrity of each function are independently checked and verified using an appropriate sample of transactions.
• Accounts are reconciled continually, independently, and in a timely manner and that outstanding items, both on- and off-balance-sheet, are resolved and cleared.
• Policy overrides are minimal and exceptions are reported to management.
• Employees in sensitive positions or risk-taking activities do not have absolute control over areas. For example,

Ø      Is there segregation or rotation of duties to ensure that the same employee does not originate a transaction, process it, and reconcile it to the general ledger account?

Ø      Is there periodic unannounced rotation of duties for employees or vacation requirements that ensure their absence for at least a two-week period?

Ø      Are safeguards in place for access to and use of sensitive assets and records?

Ø      Is there dual control or joint custody over access to assets (e.g., cash, negotiable collateral, official checks etc)?

3.      Determine whether reporting lines within a business unit (branch or regional or state headquarters) or functional area at the MFI provide sufficient independence of the control function.

• Is separation of duties emphasized in the organizational structure?
• Are systems in place to ensure that personnel abide by separation of duty requirements?
• Is there an internal review of employee accounts and expense reports?
• Are personnel accountable for the actions they take and the responsibilities/authorities given to them?

4.      Determine whether operating practices at the MFI conflict with established areas of responsibility and control. Examiners should

• Interview line and management personnel.
• Review policies delineating responsibilities.
• Review reconciliations and transaction origination.
• Reviews internal audit work papers.
• Review external audit reports.

5.      Determine whether the MFI internal audit or other control review functions are sufficiently independent. Consider:

• Where the function reports, administratively, within the organization.
• To whom, or to what level, the function reports the results of work performed.
• Whether practices conform to established standards.
• Whether management unduly influences the timeliness of risk analysis and control processes.

6.      Determine whether the board and senior management at the MFI has established adequate procedures for ensuring compliance with applicable laws and regulations. Examiners should

• Determine the frequency of testing and reporting for compliance with laws and regulations by reviewing:

Ø      Audit schedules, scopes, and reports.

Ø      Minutes of senior management and board committees.

Ø      The payment of any fines or liabilities arising from litigation against the institution or its employees. There have been some such cases with regard to some of the MFIs in India in the past

• Determine whether appropriate attention and follow-up are given to violations of laws and regulations. Consider:

Ø      The significance and frequency of the violations.

Ø      The willingness and ability to prevent reoccurrence.

D) Accounting, Information, and Communication Systems

Supervisory Objective: Determine whether the MFI’s accounting, information, and communication systems ensure that risk-taking activities are within policy guidelines and that the systems are adequately tested and reviewed. For this, supervisors and examiners need to:

1.      Assess the adequacy of accounting systems by determining whether

• The systems properly identify, assemble, analyze, classify, record, and report the institution’s transactions in accordance with national and international standards.
• The systems account for all assets and liabilities involved in transactions.

2.      Assess the adequacy of information systems by determining

• The type, number, and depth of reports generated for operational, financial, managerial, and compliance-related activities.
• Whether reports are based on accurate and timely data and sufficient to properly run and control the MFI.
• Whether access to information systems is properly restricted.

3.      Assess the adequacy of communication systems by determining whether

• Significant information is imparted throughout the MFI (from the top down and from the bottom up in the organizational chain), ensuring that personnel understand:

Ø      Their roles in the control system.

Ø      How their activities relate to others.

Ø      Their accountability for the activities they conduct.

• Significant information is imparted to external parties such as regulators, shareholders, customers, lenders, investors and others.

4.      Assess how frequently and thoroughly the accounting, information, and communication systems are verified. Consider:

• The frequency of testing given the level of risk and sophistication of the systems.
• The sufficiency of ongoing reviews of the systems’ accuracy.
• The competency, knowledge, and independence of the personnel doing the testing.
• The sufficiency of contingency planning.

E) Self-assessment and Monitoring

Supervisory Objective: Determine whether senior management and the board of the MFI properly oversee internal control, control reviews, and audit findings. For this, supervisors and examiners need to:

1.      Determine whether the MFI board or a designated board committee has reviewed management’s actions to deal with material control weaknesses and verified that corrective actions are objective and adequate. Consider:

• Minutes of appropriate board and committee meetings.
• Audit or other control review reports and follow-up reports.

2.      Determine the frequency and comprehensiveness of reports to the MFI board or board committee and senior management:

• Review the minutes of appropriate board or committee meetings.
• Determine whether the reports are sufficiently detailed.
• Determine whether reports are presented in a timely manner to allow for resolution and appropriate action.

3.      Determine the adequacy of the board’s or board committee’s review of audit and other control functions. Consider whether the MFI board or its committee

• Reviewed the qualifications and independence of personnel evaluating controls (e.g., external auditors, internal auditors, or line managers).
• Approved the overall scope of control review activities (e.g., audit, loan review, etc.).
• Reviewed the results of control evaluations.
• Approved the system of internal control.
• Periodically reviews the adequacy of audit or other control systems.

4.      Assess the adequacy and independence of the audit or other control review function. Consider:

• Results of audit’s or other control review function’s control evaluation and supporting work papers.
• The function’s organizational structure and reporting lines.
• The scope and frequency of audits or reviews for all activities across the organisation.
• Audit or control review reports, management responses, and follow-up reports.

5.      Determine whether MFI management responses to audit or other control review findings are fully documented and tracked for adequate follow-up. Consider whether

·         Documentation detailing the coverage, findings, and follow-up of control weaknesses is adequate.

·         Management gives appropriate and timely attention to material control weaknesses once identified.

·         Line management is held accountable for unsatisfactorily or ineffectively following up on control weaknesses. This is very critical indeed.

When after the above, substantive supervisory concerns about the adequacy of internal control or the integrity of financial reporting controls still exist, supervisors/examiners should consider performing more detailed and additional examination procedures, for those areas of concern. If, after completing those additional procedures, examiners still remain concerned about internal control adequacy or financial reporting control integrity, they should perform appropriate verification procedures to confirm the existence and description of assets.

As an alternative, examiners may require the MFI to expand its own verification program to include the areas of weakness or deficiency; however, this alternative will be used only if management has demonstrated a capacity and willingness to address regulatory problems, if there are no concerns about management’s integrity, and if management has initiated timely corrective action in the past. Use of this alternative must result in timely resolution of each identified supervisory problem. If examiners use this alternative, supervisory follow-up must include a review of work papers in areas where the MFI’s verification program was expanded.

The above aspects should be taken as a starter set and supervisors/examiners, will need to build on these using the day-to-day experience in supervising MFIs…

Have A Nice Day!

---

[i] While this will apply to all kinds of MFIs, it will be more applicable to large and systemically important MFIs

Building The Internal Audit Function at MFIs: The Need For Independence, Authority and Competence For Internal Auditors…

Ramesh S Arunachalam

Rural Finance Practitioner  

Internal auditors (at MFIs as well as other entities) must be independent of the activities they audit so that they can carry out their work freely and objectively. They must render impartial and unbiased judgments. The internal auditor or the manager (director) of internal audit should report directly and regularly to the board of directors.

While many MFIs still have very nascent internal audit operations, in some large MFIs, the internal audit function is made a part of a group that manages or controls the MFI’s risk management activities. This arrangement may be satisfactory as long as the audit function functionally reports directly to the board and retains its independence. If the internal audit manager reports to a senior executive on day-to-day administrative issues, then, the board must take extra and special measures to ensure that the relationship does not impair the auditor’s independence or unduly influence the auditor’s work. And in micro-finance as well other fields, this has proved difficult and therefore ensuring that the internal audit department head reports directly to the board or a board sub-committee (like audit committee) is perhaps the best option.

In reality, the board should be and is responsible for delegating the authority necessary to effectively allow internal auditors to perform their job. Thus, internal auditors must have the power to act on their own initiative in all departments, functions and units in the MFI; to communicate directly with any MFI personnel; and to gain access to all records, files, or data necessary for the proper conduct of the audit. Clear communication between the board, the internal auditors, and management is critical to timely identification and correction of weaknesses in internal controls and operations.

Internal audit staff should also possess the necessary knowledge, skills, and disciplines to successfully implement the audit program at the MFI in a proficient and professional manner. The evolving roles of internal auditors require that they expand their skills in analysis, technology, decision-making, and communication. At a minimum, members of the audit staff should:

·         Have appropriate education and/or experience, relevant to micro-finance and social development

·         Have organizational and technical (financial) skills commensurate with the responsibilities assigned and they should be familiar with micro-finance models and operations

·         Be skilled in oral and written communication

·         Understand accounting and auditing standards, financial principles, and related techniques

·         Recognize and evaluate the materiality and significance of deviations from sound micro-finance practices, and 

·         Recognize existing or potential problems and expand procedures as applicable

Thus, it is important for each member of the internal audit staff, including the audit manager or director, to commit to a program of continuing education and development, especially in line with the new developments in micro-finance. Hence, deputing them to courses and seminars offered by special institutions like CGAP (and others), industry associations or audit industry groups is a must and should afford them the required opportunities for maintaining audit skills and proficiency, especially with regard to the evolving micro-finance industry. In-house training programs, work experience in various departments and field areas at the MFI, and reviewing current literature on auditing and micro-finance/banking are also means to maintain and enhance auditing skills.

To summarise, internal auditors play a very fundamental role in ensuring the integrity of the various systems at MFIs and therefore, it is important that they are given the necessary authority, independence and skills/knowledge to effectively perform their crucial tasks.

Have a Nice Day!

Risk Management Systems in MFIs: Three Critical Aspects For Supervisory Examiners, Regulators, Bankers, Investors and Other Stakeholders…

Ramesh S Arunachalam

Rural Finance Practitioner  

Please recall that the Malegam committee report has recommended on-site supervision of large NBFC MFIs (although it is yet be accepted by the RBI). The key issue is that if the MCR proposals are accepted, then, supervisors will have to carry on examinations in such large NBFC MFIs, which would be some kind of a first for them. This post seeks to highlight some critical risk management issues for such supervisory/examination missions as well as the monitoring visits undertaken by bankers, investors and others including credit rating agencies. Read on…    

First, when examiners or other stakeholders assess risk management systems, they need to consider the MFI’s policies, processes, personnel, and control systems. If any of these areas is deficient, so is the MFI’s risk management. 

·         Policies are statements of actions adopted by the MFI to pursue certain results. Policies often set standards (on risk tolerances, for example) and should be consistent with a MFI’s underlying mission, values, and principles. A policy review should always be triggered when a MFI’s activities or standards change. The burgeoning growth experienced by the large Indian MFIs from April 2007 onwards should have prompted this…

·         Processes are the procedures, programs, and practices that impose order on the MFI’s pursuit of its objectives. Processes define how daily activities are carried out. Effective processes are consistent with the underlying policies and are governed by appropriate checks and balances (e.g., internal controls). Again, the phenomenal growth and the kind of results achieved in expanding client and portfolio outreach during the period April 2007 to March 2009 in India should certainly have caused the micro-finance industry (all stakeholders) to closely look (inward) at key processes. In fact, this would have clearly shown that the desire for faster growth and greater efficiency perhaps resulted in MFIs adopting short cuts in the various processes. Much of the process mapping and re-engineering done during this period achieved one impact very successfully – it reduced client level interaction and simply eliminated client relationship building in several places, to help MFIs gain efficiencies. Soon MFIs were just talking to various kinds of intermediaries (call them agents or business correspondents and the like) to add more clients and get them quicker than competition

·         Personnel are the MFI staff and managers that execute or oversee processes. Personnel should be qualified and competent, and should perform as expected. They should understand the MFI’s mission, values, policies, and processes. MFIs should design compensation programs to attract, develop, and retain qualified personnel. In addition, compensation programs should be structured in a manner that encourages strong risk management practices. Transformation (a key happening in Indian micro-finance) and consolidation present complicated personnel challenges. Any MFI transformation plan should lay out strategies for adding/retaining staff essential to risk management. Now, the huge growth in the aforementioned period coupled with fast rapid transformation meant that staff turnover was very high and all and sundry were hired and put into positions, without requisite training and orientation. In fact, because the staff were not committed to the original mission, in many MFIs, the mission that percolated to the field got hugely diluted and was focused on mindless and reckless growth, without considering the risks. Frauds and related strategies (like agency micro-finance model) were increasingly used to add more clients in a short time. Overall, the above factors again led to critical risk management issues being given a go by – in many cases, they existed on paper at the headquarters or regional offices but were hardly evident during implementation.

·         Control systems are the tools and information systems (e.g., internal/external audit programs) that MFI managers use to measure performance, make decisions about risk, and assess the effectiveness of processes. Feedback should be timely, accurate, and pertinent.  Now, when policies, processes and personnel are out of tune and literally perpetuate risk management, control systems will not work on the ground and that is what happened from April 2007 onwards in many MFIs

Thus, as noted above, it is critical for stakeholders to look at MFI policies, processes, personnel and control systems to come to a proper conclusion with regard to the MFI’s risk management system. 

Second, because market conditions and MFI structures vary, no single risk management system may work for all kinds of MFIs. The sophistication of risk management systems should be proportionate to the risks present and the size and complexity of an MFI, its operational environment and the like. As an MFI grows more diverse and complex in terms of its products, delivery models, capital sourcing, client demographics and the like, the sophistication of its risk management must also keep pace. Thus, risk management systems of large MFIs must be sufficiently comprehensive to enable senior management to identify and effectively manage the risk throughout the MFI’s diverse operations. Two other aspects deserve special mention here: a) In large MFIs, the focus of (examination) would have to be on the overall integrity and effectiveness of risk management systems; and b) Periodic validation must be a vital component of such large MFI examinations as only then can the integrity of these risk management systems over time be assessed. 

Third, sound risk management systems should be able to identify the key risks, measure them appropriately, monitor it continuously and control them where possible and necessary. These aspects are described below:

·         Identify risk: To properly identify risks, an MFI must recognize and understand existing risks and risks that may arise from new business initiatives, including risks that originate in sister institutions (subsidiaries in case of MFI holding companies) and/or affiliates, and those that arise from external market forces, or regulatory or statutory changes. Risk identification should be a continuing process, and should occur at both the transaction and portfolio level. A MFI must also identify interdependencies and correlations, across portfolios and lines of business, that may amplify risk exposures. Proper risk identification is critical for MFIs undergoing transformation (from one legal form to another) and consolidations to ensure that risks are appropriately addressed. Risk identification in transforming and consolidating MFIs begins with the establishment of uniform definitions of risk; a common language helps to ensure the success of transformation and consolidation.

·         Measure risk: Accurate and timely measurement of risk is essential to effective risk management. A MFI that does not have risk measurement tools has limited ability to control or monitor risk levels. Further, more sophisticated measurement tools are needed as the complexity of the risk increases. An MFI should periodically test to make sure that the measurement tools it uses are accurate. Sound risk measurement tools assess the risks of individual transactions and portfolios, as well as interdependencies, correlations, and aggregate risks across portfolios and lines of business. During MFI transformations and consolidations, the effectiveness of risk measurement tools is often impaired because of the technological incompatibility of the transforming systems or other problems of integration – I have seen this in some of the largest India MFIs that transformed activities from a society/MBT to an NBFC and the MIS and related integration was simply out of tune. Consequently, the resulting (new) company must make a concerted effort to ensure that risks are appropriately measured across the consolidated entity. Larger, more complex MFIs must assess the effect of increased transaction volume across all risk categories.

·         Monitor risk: MFIs should monitor risk levels to ensure timely review of risk positions and exceptions. Monitoring reports should be timely, accurate, and informative and should be distributed to appropriate individuals to ensure action, when needed. In many cases, I have seen reports being generated but gathering dust. Further, for large and complex MFIs, monitoring is essential to ensure that management’s decisions are implemented for all geographies, products, and legal entities (including Mutual Benefit Trusts – MBTs, that are a part of many Indian MFIs).

·         Control risk: MFIs should establish and communicate risk limits through policies, standards, and procedures that define responsibility and authority. These limits should serve as a means to control exposures to the various risks associated with the MFI’s activities. The limits should be tools that management can adjust when conditions or risk tolerances change. MFIs should also have a process to authorize and document exceptions or changes to risk limits when warranted. In MFIs transforming or consolidating, the transition should be tightly controlled; business plans, lines of authority, and accountability should be clear. Large, complex MFIs should have strong risk controls covering all geographies, products, and legal entities to prevent undue concentrations of risk.

Again, while the field of risk management is at its nascent best in Indian micro-finance, that should not deter us from asking the right questions during monitoring and supervisory examinations and I hope that various stakeholders involved in this crucial aspect recognize and seek to redress this on the ground in real time…

Have A Nice Day!

Monitoring The Quality of Internal Control in MFIs: Suggested Guiding Questions for Bankers, Investors, Regulators, Supervisors and Other Stakeholders…

Ramesh S Arunachalam

Rural Finance Practitioner  

As part of Malegam committee recommendations, micro-finance NBFCs are likely to come under supervision of the RBI, although the recommendations are as yet to be accepted by the Central Bank. Likewise, the RBI appointed working group on NBFC supervision, headed by former RBI deputy governor, Mrs Usha Thorat should also be recommending strategies for supervision of NBFCs (including NBFC MFIs).

In both cases, supervisors (examiners) would have to look at the formal/informal internal control and monitoring procedures at NBFC MFIs. That said, the key issue here is what questions should such supervisors and/or examiners ask to get appropriate information with regard to the quality of internal controls when they visit these NBFC MFIs. Please that these same questions are equally valid for bankers and investors who want to understand the quality of internal controls at NBFC MFIs. Likewise, these questions can also be suitably modified and used for MFIs incorporated as section 25 companies, cooperatives and the like.

Accordingly, this post provides a basic DRAFT questionnaire and it should assist supervisors (as well as regulators, examiners, bankers, investors and others) obtain critical information about an MFI’s formal/informal internal control and monitoring procedures. Depending on the specific characteristics and size of the MFI including legal form, the various stakeholders can also add and/or delete questions as appropriate.

Before moving on to the draft questionnaire, two specific issues deserve to be highlighted here. First, supervisors (or other stakeholders intending to judge quality of internal control) should preferably meet with the MFI’s chief executive officer (CEO), or the person most directly responsible for internal control (if it is not the CEO), to first conduct discussions on several aspects including board and management oversight, segregation of duties, dual control, employee policies, audit functions and the like. Second, they must also obtain and review appropriate reports and other information that substantiate management’s assertions on internal control (e.g., audit engagement letters, internal and external audit reports and management letters/responses, board reports, organizational charts, and policy/procedural manuals).  And to assist them in the above tasks, a set of key questions are given below:

Board and Management Oversight

1. What goals and objectives have you (CEO or person directly responsible for internal control) and the board established for internal control (e.g., management oversight, dual control, rotation of duties, timing/frequency or reconciliations, internal control reviews, risk assessments, and frequency and scope of internal control audits)? Who is chiefly responsible for ensuring that those controls are adhered to? Does any one individual significantly influence board decisions or control activities?
2. What accounting and information systems are in place to account for transactions, assets, and liabilities and ensure that risk-taking activities are within policy guidelines?
3. What type of operational, financial, managerial, and compliance-related reports does the board receive concerning risk assessments and internal control? How frequently does it receive them? Who is involved in their preparation?
4. What written board-approved policies and procedures addressing internal control, risk assessments, and ethics/conduct are in place?
5. Who monitors compliance with internal control policies and procedures? Who performs risk assessments? What issues have been noted within the last 12 months?
6. Do the board and its representatives have complete access to MFI records?
7. How do you establish what are the proper controls for new or significantly revised products, services, or operational procedures? How do you evaluate the risks associated with planned or potential new products or activities or changes to existing products or activities? Are audit or other control review personnel involved when discussing, designing and implementing such products or activities? How are technology issues and risks considered and addressed?
8. What new or significantly revised products, services, or operational procedures have you introduced since the last examination (will not apply when examination it happens first time)? What do you anticipate introducing within the next 12 months?
9. What are the most significant risks facing the MFI today? What processes do you have in place to assess and control those risks?

Control Policies, Procedures, and Activities

10. In general, describe your internal control process for ensuring segregation and rotation of duties. Are these applied MFI-wide, to all operational areas?  If not, why not?
11. How do you ensure that the same employee does not originate a transaction, process it, and reconcile the general ledger account? How are approval authorities put in place, communicated to employees, and periodically tested?
12. How often does someone independent of a specific function or department review reconciliations and other pertinent internal control to ensure that (1) reconciliations are timely and performed by an appropriate person, (2) out of date items are being researched for disposition, and (3) old items are charged off in a timely manner?
13. In general, describe your dual control process over the MFI’s cash, cash collateral, official checks, and other such items.
14. How do you ensure you have trained and qualified employees, including back-up employees, for all risk-taking activities and positions in the MFI?
15. Do you have employee policies/procedures that assist in detecting breaches of internal control (e.g., pre-employment criminal background investigation, vacation policies, rotation of duty policies, frequency of obtaining employee credit reports, sampling employee accounts, and reporting of policy overrides/exceptions)?
16. How do you communicate to employees, and do they understand, their roles in the control system, how their activities relate to others, and their accountability for the activities they conduct?

Audits

17. How does the board review qualifications and independence of internal and external auditors?

Internal Audit

18. Does the MFI have an internal audit or other control review function?
19. Are any internal audit activities outsourced to another party? If yes, to whom? How are outsourced arrangements and activities supervised and managed?
20. Describe the internal auditor’s educational background and experience. Who approves the hiring of key internal audit personnel?
21. What other duties does the internal auditor perform?
22. To whom does the internal auditor report? Who completes the internal auditor’s annual evaluation?
23. Describe the scope and frequency of internal audits.
24. Does the audit scope include an assessment of risk and internal control? Is compliance with established ethics/conduct policies periodically tested?
25. Who reviews the internal audit report (department head, line manager, senior management, audit committee, board)? How frequent are reports and follow-up reviews? How do you ensure that the board or management is able to understand and act on findings? Who follows up on deficiencies (department head, line manager, internal auditor, Audit Committee)? What tests ensure that corrective action has been implemented? Who does the testing?

External Audit

26. Which of the following types of external audits does the MFI receive:

• Opinion audit (full financial statements).
• Attestation report on internal control.
• Opinion audit (balance sheet only).
• Agreed-upon procedures (i.e., director’s exam).

27. Who performs the MFI’s external audit (independent chartered accountant or other independent party) and how long have they been doing the MFI’s audit work? What was the cost of the most recent audit? What non-audit services does the external auditor or other outside party provide for the MFI? What are the fees for these services?
28. Describe the scope and frequency of external audits and non-audit services.
29. Is the opinion audit performed accounting to nationally (and globally) accepted accounting standards? Is the report on internal control performed to attestation standards? For non-opinion audits or internal control attestation engagements, does the scope specifically include an assessment and testing of financial reporting controls or other internal control? If so, who decides which control functions will be tested and validated?
30. Who receives and reviews the external audit report or other reports issued by the external auditor (audit committee or board)?  How frequent are reports and follow-up reviews? Are reports sufficiently detailed to allow the board or management to understand and act on findings? Who follows up on deficiencies (department head/line manager, auditor, audit committee, etc.)? What tests ensure that corrective action has been implemented? Who does the testing?
31. Who determines whether the external audit scope and frequency are adequate? Who ensures that the MFI received what they contracted for? In other words, who ensures that the audit embodies what is in the engagement letter, specifically in the statement of scope?

General Assessment

32. How do you (the CEO or person in charge of the internal controls at the MFI) rate your overall internal control and monitoring procedures at the MFI - strong, satisfactory, or weak?
33. What areas do you think exhibit the most operational risk given the MFI’s internal control environment, culture, and characteristics including size and growth strategy?
34. What areas do you think exhibit the least operational risk given the MFI’s internal control environment, culture, and characteristics including size and growth strategy?
    
    
    The above starter’s and other questions can be used to get critical information on an MFIs internal control systems across a range of activities by supervisors, examiners and other stakeholders. And depending on the information received, further examination can be conducted and assessments made…
    
    
    And before I sign off, I would like to reiterate that we need to build up greater awareness in the entire micro-finance industry with regard to having (high) quality and appropriate internal controls, in real time (and not just on paper) and on the ground. That alone can perhaps be the long term insurance against AP like crisis situations in the future…

Have A Nice Day!