Bank Treasury CycleControl ObjectivesAudit Work Program19Treasury Cycle Control Risk Asse.docx

Bank Treasury CycleControl ObjectivesAudit Work Program19Treasury Cycle Control Risk Asse.docx

《Bank Treasury CycleControl ObjectivesAudit Work Program19Treasury Cycle Control Risk Asse.docx》由会员分享，可在线阅读，更多相关《Bank Treasury CycleControl ObjectivesAudit Work Program19Treasury Cycle Control Risk Asse.docx（43页珍藏版）》请在冰豆网上搜索。

BankTreasuryCycleControlObjectivesAuditWorkProgram19TreasuryCycleControlRiskAsse

TREASURYCYCLE

CONTROLRISKASSESSMENTDOCUMENT（"CRAD"）

Thisinformationisintendedonlytoserveasaguideforstudyingandevaluatinginternalcontrolsinbanks.Itshouldnotberelieduponwithregardtoanyparticulartransactionorbank.

Thistool,oracceptablealternativedocumentation,shouldbecompletedbycyclemanagementinconjunctionwithitsreviewandassessmentoftheeffectivenessofthebank'sinternalcontrolsoverfinancialreporting.

NAMEOFDEPARTMENT:

DATEOFFINANCIALSTATEMENTS:

PREPAREDBY:

DATE:

INSTRUCTIONS

Objective

Theprincipalobjectiveofthisaidistoassistdepartmentmanagementinanalyzingtheeffectivenessoftheinternalcontrolstructureoverfinancialreportingatthetransactioncyclelevel.Theinternalcontrolstructureatthecyclelevelconsistsofthemanagementcontrolstructure（MCS）andthebusinessprocesscontrolsimplementedinthetransactioncycle.

TheMCSisthefoundationofabusiness'internalcontrolstructure.WhiletheestablishmentofastrongMCSiscritical,itssuccessultimatelydependsonhowtheestablishedMCSisimplementedwithinthetransactioncycles（loan,deposit,investment,treasury,etc.）.IfmanagementofthecyclesdoesnotimplementoroverridesthecomponentsoftheMCS,thecyclecontrolstructureisweakened.SuggestedinthistoolisanapproachtoevaluatetheMCSwithinthecycle.

TheMCSconsistsoftheenvironmentandprocessesputintoplacebymanagementtoensurethatsignificantriskspresentingthreatstothesuccessfulachievementofkeybusinessobjectivesareidentified,evaluatedandreducedtoanacceptablelevel.Examplesofkeybusinessobjectivesincludereliabilityoffinancialreporting,operationaleffectivenessandefficiencyandcompliancewithlawsandregulations.Thefocusofthistoolisonreliabilityoffinancialreporting.

ThefollowingMCScomponentsarespecificallyaddressedinthistool:

Assessexternalandinternalrisks

Establishcontrolenvironment

Providereliableandrelevantinformation/Supportcommunicationprocesses

Businessprocesscontrolsprovidecontinuousassurancethat（a）financialaccountinginformationusedtosupportbusinessdecisionsisreliableandrelevant,and（b）operatingandsupportprocessesachieveprocessobjectiveseffectivelyandefficiently.Forpurposesofthistool,theyprovidereasonableassurancethatthebusinessprocesseswithinatransactioncycleareperformingeffectivelyinachievingfinancialreportingrelatedobjectives.

Therearetwocategoriesofbusinessprocesscontrols:

Processcontrols—Thesecontrolsareanintegralpartofmakingbusinessprocesseswork.Embeddedwithintheprocesses,theyprovideassurancethattheprocessesarepreventinganddetectingerrorsandirregularitiesascloseaspossibletothesource.

Monitoringcontrols—ThesecontrolsfocusonevaluatingtheresultsoftheprocesstoensurethattheyareinaccordancewiththeBank'sobjectivesandestablishedperformancecriteria.Somemonitoringcontrolsprovideevidencethatcertainprocesscontrolsareoperatingeffectively.

TheCRADprovidesatooltodocumentmanagement'sassessmentoftheeffectiveness,intermsofbothdesignandoperation,ofprocessandmonitoringcontrols.Thecontextofevaluatingcontrolseffectivenessiswhetherornottheyprovidereasonableassurancethatfinancialreportingrelatedcontrolobjectivesareachieved.TheCRADsupportsmanagement'sconclusionsregardingtheadequacyofcontrolactivitiesandmonitoringwithinthecycle.

Responsibility

Becauseoftheimportanceofexperiencedprofessionaljudgmentinproperlyrespondingtothequestionscontainedherein,cycledepartmentheadsmustactivelyparticipatealongwithothermembersofthemanagementteamintheevaluationprocess.

CompletingtheCRAD

Thetreasurycyclemanagementteamshouldperformthefollowing:

A.Respondtothequestionslistedforeachtreasurycycleinternalcontrolcomponent.A"yes"answerimpliesthefollowing:

•FortheMCSsectionofthistool（RiskAssessment,ControlEnvironment,andInformationandCommunication）,therearecontrolattributesandprocessesthat,inmanagement'sview,mitigatetheriskofmaterialfinancialreportingmisstatements.Controlattributesareenvironmentalcharacteristicsorriskindicatorsthatsuggesttheexistenceorabsenceofrisk.Controlprocessesarecontrolsimplementedbymanagementtoaccomplishthestatedobjectives.Theassessmentofattributesismoresubjectivethanprocesses,becauseprocessesaremoresusceptibletoindependenttesting.

•Forthebusinessprocesscontrolsection（ControlActivitiesandMonitoring）,thereareprocessandmonitoringcontrolsthatareeffective（inbothdesignandoperation）inprovidingreasonableassurancethatthespecifiedobjectivesareachieved.Theobjectivesrelatetoauthorization,completenessandaccuracy,substantiationofbalances,evaluationofbalancesandaccesstoassets.

A"no"answermeansthattreasurycyclemanagementbelievesthatthereisanabsenceofpositivecontrolattributesoroneormorekeycontrolsand,ifnotcompensatedforinotherareas,increasesthelikelihoodthattherearesignificantcontrolriskswarrantingconsiderationbymanagement.

B.Documentthebasisfortheanswerstoeachquestion.Theprincipalsupportfora"yes"responsebymanagementtoeachquestionshouldbeidentified.IntheMCSsection,theexistenceofnegativecontrolattributesortheabsenceorineffectivenessofkeycontrolsthatresultina"no"responseshouldalsobedocumented.Forthebusinessprocesscontrolsection,processandmonitoringcontrolsshouldnotbeconsideredassupportforapositiveresponseunlessmanagementissatisfiedthatsuchcontrolsexistandareeffectivelyfunctioning（seeD.below）.Anysignificantweaknessesorrisksnotaddressedbycontrolsshouldbeexplained.

C.Documentcyclemanagement'sevaluationofcontrolsbasedontheresponsestotheindividualquestionsandsummarizetheimpactofthatevaluationonmanagement'spublicreportoninternalcontrolstructure.

D.ValidatetheMCSandbusinessprocesscontrolsuponwhichtheanswersarebased.Thevalidationprocessisacontinuousone.Processandmonitoringcontrolsresultinginapositiveassessmentordinarilyshouldbevalidatedthroughdiscussionswithkeymembersofmanagement,reviewofcompanyreports,reviewofdocumentaryevidenceandobservationofmanagementintheperformanceofitsduties.

AcceptableAlternativeDocumentation

Anexampleofacceptablealternativedocumentationwouldbeamemorandumdocumentingcyclemanagement'sanswerstothequestionsinthistool,thesupportformanagement'sresponsesandtheapproachusedtovalidatethemoresignificantcontrols.

MCS

1.AssessRisk

Thecyclefacesriskfromexternalandinternalsources.Theserisksmustbeassessedintermsoftheirimpactonthebank'sabilitytoachieveitsobjectives.Cyclemanagementmusteitherestablishaprocessorbepartofanestablishedprocesstoeffectivelyidentifyandevaluatetherisksintheexternalandinternalenvironmentthatpresentthreatstotheachievementofobjectives.

A.Hascyclemanagementestablishedoverallobjectivesandstrategiestoachievetheseobjectivesthatareconsistentwiththeofoverallobjectivesandstrategiesestablishedbytopmanagement?

YES_____NO_____

B.Havethebusinessprocesseswithinthecyclebeenalignedwiththecycleobjectivesandstrategies（e.g.,havetheybeendesignedtosupporttheobjectivesandstrategies）?

YES_____NO_____

C.Doesthecyclehaveeffectiveriskassessmentprocessesin（a）identifyingandevaluatingtheimplicationsofsignificantexternalandinternalriskstotheachievementofthedepartment'sobjectivesandtheexecutionofitsstrategiesand（b）providingabasisforreducingthoseriskstoanacceptablelevel?

YES_____NO_____

D.Doescyclemanagementcontinuouslyimprovebusinessprocessesforidentifyingandreactingtochangingcircumstancesandconditionsinaccordancewithorganizationalpolicies?

YES_____NO_____

E.Arekeycyclebusinessactivitiesdependentontheintegrityandavailabilityofcomputerprocessing,orontheaccuracyandcompletenessofinformationmaintainedandreportedbycomputerprocessing?

YES_____NO_____

ControlAttributesandProcessesFormingBasisforResponse:

2.EstablishControlEnvironment

Managementmustestablishaneffectivecontrolenvironmenttoprovidedisciplineandstructureandastrongfoundationforcontrolinthedepartment.Thecontrolenvironmentconsistsofthepeopleofthedepartmentandtheenvironmentinwhichtheyoperate.Itsetsthetoneofthedepartment,influencingthecontrolconsciousnessofitspeople.Itisthefoundationforallothercomponentsofthecontrolstructurewithinthecycle.

A.Doesthecyclehaveaneffectiveandunderstandableorganizationalstructurethat（a）effectivelymonitorsthecriticalbusinessprocesseswithinthecycleand（b）facilitatestheverticalandhorizontalcommunicationsandinformationflowsnecessarytoachievethedepartment'sobjectivesandstrategy?

YES_____NO_____

B.Arecyclemanagement'sprocessesforassigningresponsibility,delegatingauthorityandestablishingappropriatepoliciesinaccordancewiththeorganization'sestablishedpolicies?

Dotheprocessesresultineffectivelycommunicatingperformanceexpectations,establishingaccountabilityandcontrol,anddefiningtheroleandresponsibilityofeachindividualinthedepartment?

YES_____NO_____

C.Arethecyclehumanresourcepoliciesandpracticesforrecruitingandretainingcompetentpeopleanddevelopingcompet