Effective Internal Audit for Central Banks

The independent world forum for central bankers and financial supervisors Training course/seminar series 2012 Effective Internal Audit for Central Banks 4-day intensive residential programme 23 26 April 2012 Cumberland Lodge, Windsor Course Chairman: Paul Apps Former Head of Audit, Reserve Bank of Australia Series adviser: Charles Goodhart, CBE Professor Emeritus London School of Economics Financial Markets Group www.centralbanking.com/events Hosted by Central Banking Publications

Dear Delegate, The financial crisis has changed the business of central banking. Around the world, central banks have responded to the crisis with an unprecedented range of operations, policies and regulations. Many have pushed the boundaries of their mandates or had their roles and responsibilities explicitly redefined. Yet it is not only the scale of change but the pace at which it is taking place. This combination of significant and rapid change of functions and roles creates a challenging environment for those charged with ensuring that risks are managed and controls enforced. It is an ideal breeding ground for operational risk, throwing away the rule book or doing things on the fly. Indeed, exposure to new and heightened risks requires, perhaps more than ever before, the internal audit discharge its duties as guardian and guarantor. Such a role is an integral element in the central bank s infrastructure and a necessary aspect of maintaining trust with politicians, financial markets and stakeholders. Recent developments in approaches to internal audit prompted by economic changes have caused many leading thinkers to promote a risk-based approach to audit. It is necessary for those working within the internal audit function to understand the changing dynamics of the economic environment and of their organisation s objectives to be able to evaluate effectively the various systems and processes they are responsible for monitoring. Understanding the challenges facing internal auditors in the current environment is the focus of this four-day residential seminar, which is held in a closed roundtable format to allow an international group of delegates the maximum opportunity to learn from each other. Over the course of the seminar, an elite panel of speakers comprising leading practitioners and public and private sector experts will be chaired by Paul Apps, former Head of Audit at the Reserve Bank of Australia. This seminar is designed to provide internal auditors with the tools to enhance their skills and knowledge to improve their work to the benefit of their organisations. Delegates will be challenged to consider some of the key issues affecting the internal audit function in the current climate, and reflect on what future issues the profession may face in the coming years. Key practitioner-led sessions address: Developing an annual audit plan Establishing effective relationships with other departments The interface between internal audit and risk management Reporting to the audit committee How to manage the risk of fraud Auditing information systems Now in its fourth year, this seminar encourages an interactive environment, with delegates and speakers exchanging views on the key issues facing their department in an informal setting. This format, as more than 3,500 central bankers and regulators can attest, encourages delegates to quiz panellists, raise issues and discuss solutions to the specific questions they have. For more information about the programme, please take a few moments to look at the detailed course contents presented on the pages which follow. I look forward to welcoming you to Windsor. Yours sincerely, Robert Pringle Chairman, Central Banking Publications

Monday 23 April Positioning the internal audit function in the organisational structure Effective Internal Audit for Central Banks Spring 2012 Chairman s welcome Paul Apps, Former Head of Audit, Reserve Bank of Australia This opening session will look at how the role of the internal audit function has altered as a result of the economic crisis, and consider what responsibilities the department must now consider as part of its remit. The discussion, led by the chairman, will then focus on the significant challenges facing internal auditors against the backdrop of the continuing financial crisis. Delegates will be invited to express their main areas of interest and share key issues facing their organisation. Corporate governance and the place of internal audit Kim Chong, Head of Internal Audit, Hong Kong Monetary Authority (invited) As central banks take on more functions, so the question of how to ensure good corporate governance within the central bank becomes more difficult. New and often complex functions bring new stakeholders, new risks and, potentially, conflicting interests with existing roles. Responsibility for developing and maintaining effective corporate governance frameworks extends across the organisation and involves governing boards, risk departments, executive directors, external audit and crucially internal audit. In this session the speaker will set out a model of good governance and discuss, in depth, what internal audit can do to provide the board with appropriate assurance in this. Building effective relationships with other departments Jana Bác ová, Head of Internal Audit Department, Czech National Bank One of the most important but underappreciated tasks internal auditors must fulfil is to build and maintain successful working relationships with other departments. Here the question is how to balance good relationships whilst maintaining independence. How can internal auditors uphold their objective approach whilst working closely alongside line managers and their teams? A perception of bias towards the former can lead to internal auditors often being accused of not understanding the business. This can be addressed in a number of ways and, in this session, the speaker will illustrate how internal auditors can forge better relationships and keep in regular contact through existing forums or formal relationship programmes. Discussion will consider examples of how taking a proactive approach will ensure the auditor is aware of upcoming new initiatives and opportunities to offer assistance. The course content and organization were excellent. A central bank delegate Standing ovation for the idea of the conference, its venue and organisation. A central bank delegate

Tuesday 24 April Towards a risk-based approach to internal audit Developing an annual audit plan Paul Apps Central bank activities can be very diverse: from government banking to currency printing to foreign exchange dealing to bank supervision. This panoply of functions makes it a challenge to find a base comparison methodology to determine which is more important to audit. The use of common risk factors is a way to square the circle and, in this session, the chairman will lead a discussion focusing on how to use a risk-based approach to developing the annual audit plan and provide delegates with practical methodologies to assess risk. This presentation will draw on one central bank s approach of utilising risk factors across the broad spectrum of auditable entities. The result is a comparison of apples with apples such that the scores can be meaningfully compared to inform decision on priority for audit in the coming year or over the life of a strategic audit plan. The session will offer opportunity to share methodologies used within the group enabling delegates to take concrete examples of international good practice home for application in their own departments. Efficient internal auditing: key priorities in building a value-for-money internal audit department Patrick Bailey, Head of Internal Audit, Sveriges Riksbank and the Swedish Financial Supervisory Authority An internal audit function, with the visibility and a mandate that cuts across the entire central bank, can significantly help the bank address the risks that it faces. Moreover, internal audit can contribute to making business processes more efficient and less costly to the organisation. Indeed, internal audit has the opportunity of reviewing processes across the entity and is ideally placed to identify re-engineering opportunities and recommending changes by employing the most efficient methods identified. Yet internal audit functions, like the majority of central bank departments, face having to deliver more with less. In this session the speaker will consider the key challenges facing central bank internal auditors in today s difficult economic conditions and explore some of the initiatives that can be utilised to deliver a value-for-money service. The interface between internal audit and risk management Martin Dressler, Senior Auditor, European Central Bank Internal audit plays a central role in providing assurance to management that the identified risks are being managed effectively in that controls are working as intended. For internal auditors developing synergies with those in charge of risk management can be highly beneficial. Internal audit can constructively evaluate and give assurance on risk management processes and in the reporting of key risks, and challenge management s decisions on risk in general. However, while there are synergies, at the same time, it is important to identify what roles internal auditors should not take on, such as setting the risk appetite of the institution and imposing risk management processes. In this session, the speaker will outline how internal auditors and risk managers can work together in order to better manage a central bank s business and reputation risks. Internal audit and risk management: a private sector perspective Simona Negoita, Senior Internal Auditor, Skandinaviska Enskilda Banken Risk management today is more than a way to manage financial risk, which, generally speaking, central banks have focused on in the past. The risk framework includes operational and strategic risks and these require a different set of skills. Internal auditors working within the private sector also have to consider how risk management can work effectively alongside the audit function. Just as central banks have to successfully define where internal auditors should assist in risk processes, those in the private sector have faced similar challenges in developing synergies between these two functions. In this session the speaker will address how this challenge is being faced within private sector banking. Delegates will be encouraged to consider how their home institution s approach compares to methods used in the private sector and where useful lessons can be learned. Managing the risk of fraud Jim Gee, Director of Counter Fraud Services PKF (UK) LLP, Chair, Centre for Counter Fraud Studies Interconnected, complex and increasingly automated financial systems may have reduced the risk of fraud. But they have not eliminated it. Beyond the headline-grabbing cases, such as the recent UBS rogue trader, there are a considerable number of incidents that have significant cost implications. Central banks are by no means immune to this, and the importance of reputation places a premium on internal procedures and working practices with inbuilt counter-fraud mentalities and disciplines. In this session a leading expert will share his thoughts about how central banks can develop an anti-fraud culture and put an economic cost against the risk of fraud losses.

Wednesday 25 April Assessing risk and maintaining standards Effective Internal Audit for Central Banks Spring 2012 Auditing information systems: a constructive approach Kim Chong, Head of Internal Audit, Hong Kong Monetary Authority (invited) In today s reduced-spend environment, technology is increasingly the focus for drives to reduce costs and improve productivity. A cost effective approach is for internal audit involvement in any new IT initiative from the ground up. For this to work internal auditors need to understand the strategic importance of information systems within business operations and management and the principles of information integrity, confidentiality and availability that underpin them. A senior audit resource will then be well placed to sit at the steering committee table to provide advice on control requirements and to help identify risks. At the same time audit resources should work alongside the project teams contributing to evaluating project management, testing plans, access security and similar control objectives to ensure the delivery of a quality system that will not require expensive retrofitting of controls. This session will discuss the key issues relating to planning and delivering an effective audit of IT. The speaker will consider what auditors should look for when conducting an IT audit and explore how internal audit can work effectively with IT project development. Internal audit: developing a best practice Jackie Cain, Policy Director, Chartered Institute of Internal Auditors For internal auditors in the private sector there are principle-focused professional standards that provide a framework to ensure an effective and disciplined service. Central banks, although typically not being obliged to follow such standards, have a responsibility to embrace the principle of professional internal auditing. In this session, the speaker will examine the usefulness of international standards for the central bank internal auditor and the extent to which central banks can and should follow a set of standards that the private sector is expected to adhere to. Identifying and managing ethical risks Simon Webley, Research Director, Institute of Business Ethics Central banks, perhaps more so than any other organisation, should have a set of ethical as well as operational or business values which they aspire to observe in carrying out their day-to-day business. Guiding the bank s ideas of acceptable, desirable and responsible behaviour, these values are an invaluable tool for the preservation of a good reputation and ensuring that all staff stay on-message. In this session the speaker will outline the principles for developing an ethical policy framework and explore the role that internal auditors have to play in embedding such a framework. About the course chairman Paul Apps is an internal audit and risk management advisor to the International Monetary Fund and has recently contributed to assistance programs to central banks in Tajikistan, Botswana and Lesotho. He is a member of a number of audit committees in Australia including Sydney Ferries, the Independent Commission against Corruption, the Australian Film Television & Radio School and four health districts. He was previously head of audit at the Reserve Bank of Australia, a post he held for eight years.

Thursday 26 April Reporting and resourcing Reporting to the audit committee Rowena Sandu, Head of Internal Audit, National Bank of Romania With budgets across the official sector being subject to greater scrutiny, it has become increasingly important that internal audit demonstrates its value to internal customers, notably the audit committee and senior management. Audit committees need to receive sufficient information to evaluate the tone at the top in the organisation and the appetite for risks and controls. A key indicator is the attitude of management to attending to the deficiencies identified by audit in the agreed timeframe. The audit committee can be a very powerful friend of the internal audit department in ensuring that audit recommendations are addressed and internal control attitudes are improved across the organisation. In this session the speaker will discuss approaches to reporting and consider how to ensure that reports matter, that they are relevant and that they have the right breadth and depth. Staffing and training the internal audit department Krisztina Hülvely, Head of Internal Audit, National Bank of Hungary Maintaining a high level of skill, knowledge and proficiency in those working within the internal audit department and how to effectively monitor performance. Yet many internal auditors are unaware of how to develop successful long-term planning for staffing or how to ensure a balanced composition of personnel. Should staff be recruited internally or externally? Internal hires will know the business well but require a significant amount of on-the-job audit training which quite often is not delivered. The recruitment of professionally trained and experienced external staff presents other challenges, particularly related to be able to offer attractive salary packaging. In this session the speaker will draw upon on her experience of resourcing the function in the central bank. Implementing the risk-based approach Concluding discussions led by the chairman In this final session the chairman will draw together highlights and key lessons from the preceding four days of discussions. Delegates will have the opportunity to share their thoughts on issues raised throughout the week and how they can take lessons they have learned back to their home institutions. Good, professional training programme! A central bank delegate CBP training course/seminar series, Spring 2012 include: Strategic Planning and Change Management for Central Banks New Developments in Banknote and Currency Management Financial Stability: Designing and Implementing Macroprudential Policy Central Bank Governance: the Role of the Board Current Challenges and the Future of Central Bank Statistics How to Implement a Risk-Based Framework to AML and CFT For detailed programmes and a fax-back registration form for each of these key courses, please visit: www.centralbanking.com/events

Booking details Course fee: 2,700 (VAT at 0% for delegates employed by government in furtherance of its sovereign activities) 4-Day (3 night) residential course Course fee includes: en-suite accommodation, meals, refreshments, course documentation and a complimentary copy of the most recent issue of the Central Banking journal. Substitute delegates can be accepted should the registered delegate be unable to attend; please let us know prior to the event. How to book Please complete and return the registration form overleaf to: Central Banking Publications Incisive Media Haymarket House 28 29 Haymarket London SW1Y 4RX UK telephone: +44 (0) 207 968 4530 fax: +44 (0) 207 504 3730 email: conference@centralbanking.com website: www.centralbanking.com/events The venue Cumberland Lodge is one of the Royal Houses in The Great Park at Windsor and was formerly used by members of the Royal family and their households. Occupying a superb position, it provides a unique setting for conferences where participants find they can work easily in tranquil and gracious surroundings. Most bedrooms are spacious and each has its own en-suite bathroom. About Central Banking Publications Central Banking Publications events division is the leading independent organiser of public policy seminars/training courses for the official sector. Since 1997, CBP has hosted roundtable seminars and training courses for over 3,500 senior policymakers from central banks, ministries of finance and financial regulatory agencies around the world. Senior officials from more than 120 countries have attended these meetings over the past ten years.

Registration for Effective Internal Audit for Central Banks 1. Delegate details: PLEASE WRITE IN CAPITALS Mr/Mrs/Ms: Surname/Family name: First name: Job title: Organisation: Address: Postcode: Telephone: Facsimile: Email 1: Email 2: Please provide us with the direct email address of the delegate and an additional email address if possible. This is very important because all correspondence with delegates is by email. Course fee: 2,700 (VAT at 0% for delegates employed by government in furtherance of its sovereign activities) 2. Payment details: Bank transfer: The Royal Bank of Scotland, 62/63 Threadneedle Street, London, EC2R 8LA, UK A/c No: 21975543 Sort Code:15-10-00 IBAN: GB89 RBOS 1510 0021 9755 43 Swift code: RBOSGB2L Please pay the course fee net of all bank charges and send us the copy of the transfer details Credit card: please charge to my Visa Mastercard American Express Card No: Cardholder name: Cardholder address (if different from above): Security code: Expiry date: Signature: Cheque: I enclose a cheque for Date: payable to Incisive Media Publishing I will require accommodation from I have read and agree to the terms and conditions below. Signature: Terms & Conditions: A refund (less 10% administration fee) will be made if notice of cancellation is received in writing three weeks before the conference. Regrettably, no refunds will be available for cancellations received less than three weeks before the event start date. If you do not attend the event or notify us of your intention to cancel, the full fee will still be payable. A substitute delegate is welcome but the organiser MUST be notified in advance of the conference to avoid incurring a charge. Substitutions may NOT be made at the conference. Payment must be received before the event start date. If we have not received payment in full by the event start date, you will be required to provide a credit card guarantee on the day to gain entry. The programme may change due to unforeseen circumstances, and Incisive Media reserves the right to alter the venue and/or speakers. Incisive Media accepts no responsibility for any loss or damage to property belonging to, nor for any personal injury incurred by, attendees at our conferences, whether within the conference venue or otherwise. Data Protection: By registering for a Central Banking training course you will receive further information relating to this event. In addition we will send you information about our other relevant products and services which we believe will be of interest to you. If you do not wish to receive other relevant information from Incisive Media via a particular medium please click the following relevant boxes: mail phone fax email. Incisive Media will also allow carefully selected third parties to contact you about their products and services. If you do not wish to receive information from third parties via any of the following media please tick the relevant boxes: mail phone. Please tick if you are happy to receive relevant information from carefully selected third parties by email and fax. Registered Office Haymarket House, 28 29 Haymarket, London, SW1Y 4RX UK. Registered in England and Wales number 4252091 VAT No. GB 756 9781 65P. to Date: