Auditing IT & EFT Systems in Banks

Philippine Auditing Practice Statement 1006

• Philippine Auditing Practice Statements (PAPSs) are issued by the Auditing Standards and Practices Council (ASPC) to help auditors implement the Philippine Standards on Auditing (PSAs) and promote good practice.
• PAPSs do not have the authority of PSAs.
• This statement is based on IAPS 1006, issued in December 2001 by the International Auditing Practices Committee (IAPC) of the International Federation of Accountants.
• It assists auditors and develops best practices by guiding the application of PSAs to bank financial statement audits.
• Auditors use professional judgment to determine the appropriateness of audit procedures in this statement, based on PSA requirements and bank circumstances.
• Purpose: Provide practical assistance to auditors, encourage best practices when applying PSAs for auditing bank financial statements, and is not a listing of all procedures and practices for the audit.
• The Bangko Sentral ng Pilipinas (BSP) requires additional reporting from auditors beyond the standard audit report, which is not covered in the statement.
• A bank is a financial institution mainly involved in deposit-taking, borrowing for lending, and investing, recognized as a bank by the BSP and the guidance applies to audits of financial statements covering banking activity carried out by those entities at groups.
• This statement provides guidelines on auditing financial assertion in banks financial statements and limited guidance on securities underwriting, brokerage, and asset management.

Characteristics of Banks

• Banks often engage in activities that involving derivative financial instruments.
• They have custody of large amount of monetary assets needing physical security and controls.
• They often engage in transactions conducted across different jurisdictions
• They operate with high leverage, making them more susceptible to economic downturn and increased risk of failure.
• They have assets with values that can change rapidly and are difficult to determine, impacting capital and solvency significantly.
• Banks derive significant funding from short-term deposits, so a loss of depositor confidence can cause a liquidity crisis.
• They have fiduciary responsibilities for others' assets, which requires specific operating procedures and internal controls to manage them.
• High transaction volumes and variety need complex accounting and IT systems.
• Networks of geographically dispersed branches require greater decentralization and make it difficult to maintain uniform practices.
• Transactions can be directly initiated and completed by customers through the internet or ATMs.
• Significant commitments are often made without funds transfer, often involving memorandum entries, making it difficult to detect.
• Banks are regulated by the BSP, whose regulatory requirements can affect accounting principles and financial statements.
• Customer relationships that the auditor may have with the bank may affect the auditor's independence.
• They generally have exclusive access to clearing and settlement systems.
• They are integral to national and international settlement systems, which can pose systemic risk.
• They may issue or trade in complex financial instruments needing fair value recording, requiring proper valuation procedures with reliable market data.

Special Audit Considerations

• The particular nature of the risks associated with bank transactions
• The scale of banking operations and exposures that result
• Extensive dependence on IT to process transactions
• The effect of regulations in various jurisdictions
• The development of new banking products and practices may outpace accounting or controls

Statement Organization

• A discussion of various facets of a bank audit is organized with emphasis towards matters that are of particular importance or specific to banking.
• Appendices include:
• Typical warning signs of banking operation fraud
• Examples for tests of control and processes for operational areas for treasury, trading and lending
• Financial ratios to analyze a banks financial condition
• Risks and issues in private banking, securities and asset management

Audit Objectives

• The objective of financial statement audit is to determine if the financial statements are fairly presented in compliance with the GAAP.
• The auditor reports regarding accounting principles used to prepare financial statements, accounting framework for foreign banks, the auditor reports based more detailed.

Engagement Terms

• The engagement letter outlines the purpose and scope of the audit between the auditor and client
• Considerations when setting terms:
• Assessing expertise needed to be the audit and its activites.
• Expertise of IT networks and communication
• Resourcing adequacy
• Use of specialists resources

Initial Comments on the Letter

• Reference to specialized account principles should be included:
• Regulations or laws that are applicable
• BSP statements of regulations
• Statements of accounting principles
• Base Committee on Banking Supervision
• Industry practice
• Report form -- Special purpose
• Protocol and communication requirements with the BSP.
• Auditor access that BSP could be granted

Planning the Audit

• The audit plan includes an entitys governance and business considerations, adequate control systems, and inherent risks analysis.
• The nature, extent, and timing of the audit will be decided plus the entitys ability to continue on a forseeable term with account principles under Philippine GAAP, for at least a period of one year after the balance sheet date.
• Knowledge of bank's operations
• Banking governance
• Economic and regulatory environment
• Market conditions

Corporate Bank governance

• Played an important part, BSP sets requirements for governance structures
• The auditor assesses the governance structure and how all charged work effectively.
• Risk assessment with banking will be classified as
• Country risk refers to foreign customers failing their obligation due to economic, political and country specific issues.
• Credit risk is the risk of a counterparty or customer failing its obligations on full value when at any time.

Types of Risks

• Currency: the risk that the exchange rates and currency fluctuate in value, rights and obligations.
• Fiduciary: Arises from failing safe custody or negligence for management on behalf of other parties assets.
• Legal and Document Risk: Contracts or documents incorrectly documented which cannot be enforced in relevant jurisdiction.
• Liquidity: The risk of an asset being changed with the banks ability to dispose o it.
• Modeling: Risk with imperfections with subjectivity regarding valuation models which determine total assets.
• Operational: Risk of loss with inadequate internal processes whether failed, external or people based.
• Price: The risk of market price changes which means interest rate or foreign exchange or equities.
• Regulatory: Risk of failure from compliance and legal requirements for the appropriate jurisdiction including changes in them.
• Revaluation: The risk of failure resulting in being required to market price, then can result in losses to contract price difference between banks and current.
• Reputational: Losing business from having negative impact or reputation loss due to being involved with misconduct.
• Settlement: Settlement risk exists if side of transaction are being settled without the customers consideration.
• Solvency: Possibility of insufficient funds and fund raising from market constraints.
• Transfer: Risk that counterparty obligations aren't denominated and cant get transferred due to particular financial condition.

Banking Operations

• The degree to which banking risks are concentrated and how it could impact any customer or area.
• Most operations involve more than one of the risks listed potentially with correlation.
• Risks in nature subject to ownership to influence direction and judgment.
• Increased risk from volume and IT systems.
• Not executing the transactions in time and potentially payment remittance issues.
• IT may be large scale and risks from unauthorized use.
• EFT and telecom system uses have risks of payments lost.

Fraudulent Activities

• Occur in any area from lending to deposit taking, with means and schemes in appendix 1.
• Banks are likely to ready for money laundering targets.
• Anti money laundering of 2001 enforces banking policies that will assist in deterring and reporting activities.
• Requirements of obtaining client IDs.
• The maintenance of transaction records.
• Authority of authorities and transactions beyond a certain amount.
• Educating staff of any instances.

Risk Management systems

• Management uses controls and metrics to manage key risks.
• Those in charge will oversee and involve the control processes.
• Policies need to be maintained that align with BSPs and strengths.
• Risks are monitored and compared to approved criteria
• Controls that prevent risks which segregate the controls and duties with verification.
• Models that are updated which internal audit should periodically check policies are complied with.

Reliable Information Systems

• These reliable system are needed for adequate and compliance for governance which assist in risks of profiling.
• Audit planning looks towards the the items below:
• Complexities of the undertakings
• Use of core and specialized services
• Any non statement sheet items
• Compliance with regulatory factors
• Using IT more and inherent control factors. -- Internal auditing quality
• Any material assessment and representatives

Undertaking Transactions

• Audit review considers the activities for the auditor to understand the effect on the statements overall.
• Judgement will needed with provisions or lending with risks like modeling or liquidity provision.
• In principle any audit service will look towards these core activities including cash credit.

Contingent Liabilities

• Guarantees and custody affect the financials with appropriate revenue evidence.
• The auditor gets evidence for the bank regarding record completeness.
• The regulatory considerations need information on external audit and sound banking for disclosures.

Key Audit processes

• Perform analytical procedures
• Obtain system information
• There may be pressure for financials engagements with proper categorizing and the auditor finds it helpful to stay in touch with communications regarding the banks performance assessment.

Extent of IT

• Transactions due to high volume uses extensive systems that auditor needs to focus on
• Calculation of gains and expenses
• System and determination
• System dependence presents risks in loss of audit trails.
• The auditor gains knowledge regarding application which can affect extent of what they rely on controls.

E Commerce

• The risks the strategy presents
• There is IT skill requirements and the auditor obtains understandings about where the application lives.
• It provides the auditor with insight into the extent of self developed integrated systems of direct.

Inherent Risks Assessment

• It needs to be on acceptance to have the extensive and EFT systems with high trade volumes
• Disperse nature and hard to cover.
• Complex trades difficult to audit
• Controls cannot help all processes and needs to assess the inherent factor with IT processes.

Internal Audit

• Scopes are objectives that lead to internal auditing being in sync with governance standards and the operational controls
• Financial reporting requirements
• Audit testing can depend on the size with the dispersion across branches with a reviewer to loan adherence review.

Materiality

• Relatively smaller statements that may not reflect the actual financial impact of capital even insignificantly.
• Regulations need to be satisfied with minimum capital maintenance which needs high materiality checks.
• Going processes affect the financial assessment matters which is why relationships and transactions are material.

Management Representations

• Help assist an audit to determine what is complete, true with a particularly financial audit
• There is often need for a auditor obtain management about changes in the business.

External Auditors

• Geographical dispersion which allows access to use from other external audits for competency.
• The auditor obtains and considers the level of the knowledge of others with independence to apply to the audit.

Coordinating Workload

The audit requires that there are experts and assistance across the teams.

• What it entails and mandates.
• The auditor must work within GAAP and regulation across the entity, they also need to comply with status reporting requirements.

Party Transactions

• Restrictions of parties will be observed in the audit with lending from the industry which will determine quantitative measures
• Auditors need guidance in the ability to continue as a matter of concern particularly if there are derivative losses.
• There needs to be capital and liquidity levels when banks are at their limits with rates on deposit and if it's shown that the bank is potentially of great risk
• BSP may implement conditions of concerns and disclosures for the BSP with communications and correspondence reviewed with regulatory aspects.

Internal Controls

• A framework controls for the bank in assessing systems that are very useful.
• Maintain an adequate accounting system
• It requires and effective approach and determining if there is substantive evidence to asses detection of risk for the statement.
• Less than high substantive procedures.
• Risk evaluation and control that can be achieved suchs that the below items are satisfied. - Execution of authorization - Transactions are correctly and promptly measured - Permission of assets - Recoding them at intervals

Objective: Fulfil Regulations

• In any failure to comply with the financial statement could have implications for the financial misstatement with the board as a system for how decisions can be maintained
• Procedures need to be followed for authorizing documentation to maintain limitations of exposures from each area.
• Audited needs to focus on compliance with policy and what has been measured with exposure to level to management .
• Aspects of that are in and close to area which is a particularly a area for the financial which needs to be presented.

High Volume

Banks are transacting in high volume so there's high balancing checks and accounts.

• Accounting needs to check these transactions.
• Balances often reflect the volume and is needed for foreign trades and transactions.
• It needs to allow how they verify and with information to maintain management and check transactions, it is of significance of the extensive IT used for a banks accounting system and controls.
• Assets can be high value which need controls like passwords or arrangements only accessible by authorized staff.
• This will be verified across both externally and internally.
• They must be revaluing this contracts with appropriate people

Limitations of Internal Control

• Auditor will be looking at the internal controls and what the audit is aware of and will depend on the inherent aspect of the factors.

• Auditor needs to understand the environment controls in place include

• Organisation and structure - Supervision.

• Substantive tests assess what is done for transactions on balances and classes

Covers key considerations when auditing IT and Electronic Funds Transfer (EFT) systems in banks. Discusses control assessments, system development, modifications, and confirmation procedures. Highlights contingency planning and segregation of duties for financial statement preparation.