Boards of banks, should modify their approach towards on internal controls so that they have a firmer say in the maintenance and improvement of internal control systems. Discussions between the managements and boards of banks on quality of internal control systems should be institutionalised.
The boards of banks should specifically pay attention to creating and sustaining a culture of control in banks.
There is need for greater orientation of the bank’s managements and their boards towards better understanding of risks and their management.
RBI may consider outlining clearly the role of the boards of banks in risk management. Risk-based supervision of banks by RBI has to be mirrored in their boards’ supervision and guidance.
Evaluation of risks affecting banks’ strategies and objectives by the senior management has to be continuous and should be placed on a formal basis. Such evaluations of risk management system and internal controls help in addressing appropriately any new or previously uncontrolled risks.
An assessment of the control environment and the involvement of the top management in fostering a strong control culture should form an important part of the on-site supervisory process.
The quality of MIS is an area of potential risk both from the point of view of internal control and regulatory oversight. It needs to be identified as such.
More awareness needs to be promoted among senior management in regard to security, risk and controls in computerised environment.
RBI may consider taking steps so that on-site inspections are made more bank-specific.
RBI may consider the practice of engaging external auditors for specific area audit/ inspection of banks and utilise their reports for supervisory oversight as is done by some other regulators.
