Chương II Thông tư 06/2020/TT-NHNN: Kiểm soát nội bộ

Chapter II

INTERNAL CONTROL

Article 4. Objectives of internal control activities

1. Ensure units’ strategies and plans are implemented under the direction to achieve their objectives.

2. Ensure that units operate in accordance with laws, and regulations and business processes of SBV and in a manner that prevents and reduces risks; manage and use assets and resources in a safe, effective and economical way.

3. Discover deficiencies and inadequacies, and promptly request competent authorities to amend, add or promulgate internal mechanisms, rules and regulations with a view to strengthening implementation of measures to ensure safety of assets and improve operational efficiency of units.

Article 5. Principles of internal control activities

1. Ensure objectivity and compliance with laws, and regulations and business processes of SBV and internal regulations of units; be suitable for the units’ scale and operation.

2. Adhere to the inspection and control programs and plans approved by heads, and professional guidelines of SBV.

3. Give priority to inspection, control and supervision of key or high risk activities and operations.

Article 6. Requirements for internal control activities

1. Internal control activities shall be established and maintained for all activities, business processes and transactions of a unit.

2. Internal control activities shall be carried out regularly and continually in association with control principles for daily activities of the unit, including:

a) Assigning and authorizing persons to perform tasks in a clear, transparent and lawful manner; ensuring tasks, powers and responsibilities delegated to each individual and department of a unit are separated, avoiding conflicts of interest; making sure no single individual has the total power to manipulate the operation of the unit or conceals information or violations against laws, and relevant internal rules and regulations for personal gain or for personal purposes.

b) Ensuring the principle of dual control is adhered to: the assignment of tasks and handling of operations, especially high risk operations, must be performed by at least two persons so as to supervise and control each other to ensure regulatory compliance, protect assets and improve performance unless otherwise provided by law.

c) Stipulating and strictly complying with regulations on reporting and exchange of internal information in a timely and effective way to ensure the unit operates in accordance with regulations of law.

3. Responsibilities and powers shall be delegated to each leader, department and board of a unit during internal control activities; responsibilities and roles of internal control department/division and internal controllers shall be promoted by fully and effectively implementing relevant regulations and business processes and the responsibility for task performance results to the head and the law shall be assumed.

4. Units, divisions, departments and individuals must regularly review and inspect the implementation of relevant internal regulations and business processes to promptly detect possible shortcomings, inadequacies and risks, suggest appropriate amendments in order to prevent risks and improve effectiveness in internal control activities by the units.

5. Heads of units affiliated to SBV shall provide instructions on analysis and assessment of risks posed to operations within their jurisdiction to proactively prevent and take appropriate measures to control and manage risks.

6. The role of a full-time internal controller shall be independent of that of a department, division or individual performing professional duties at a unit. Internal auditors should not be allowed to participate in professional activities subject to the inspection, supervision and control by the unit. Internal auditors (including heads of divisions in charge of internal control) who are relatives of the unit’s head should not be deployed.

7. Full-time internal controllers shall satisfy standards to be satisfied by bank controllers regarding qualifications, skills, experience and morality in accordance with SBV’s controllers.

Article 7. Scope and method of internal control activities

1. The scope of internal control activities covers all activities, operations and transactions made by a unit.

2. Internal control method means a risk-based method that is developed to inspect and supervise the compliance, especially key or high risk activities and operations.

Article 8. Contents of internal control activities

1. Regularly reviewing documents to promptly promulgate and amend internal rules, business processes and regulations so as to define work contents, tasks, powers and responsibilities of the unit and its department, division and individual upon management and handling of works in a lawful, close and scientifically sound manner.

2. Self-inspecting, controlling and supervising the compliance with regulations on accounting, financial and asset management, safety during treasury-related activities, information technology, compliance and operational efficiency of divisions and individuals in the unit; reviewing and assessing the reasonableness, effectiveness and efficiency, determining current problems and suggest necessary changes to the internal control system to ensure safety of assets and improve the effectiveness in management by the unit and its operational efficiency.

3. Classifying, managing and using information and reports of units in line with regulations of SBV to ensure smooth and continuous operation.

4. Establish effective mechanisms for supervising, reporting and exchanging internal information with the purpose of preventing risks and serving the management in an appropriate and effective manner.

Article 9. Providing instructions on and inspecting internal control

1. The Governor shall decide an appropriate method for establishing SBV internal control system on the basis of regulations of law and requirements for management and administration by SBV from time to time.

2. The Internal Audit Department shall advise and suggest the Governor to:

a) develop a method for establishing and maintaining the SBV internal control system in an appropriate, effective and efficient way.

b) promulgate regulations on professional guidance and process for internal control of units affiliated to SBV.

c) provide instructions on, inspect and assess internal control systems of units; suggest the Governor to adopt measures to perfect mechanisms and business processes and organize internal control activities of SBV in an effective and efficient manner.

d) provide and exploit relevant information and documents in order to effectively carry out internal control activities of SBV.

Article 10. Responsibilities and powers of heads of units

1. A head of a unit has the responsibility to:

a) establish and maintain an internal control system and organize internal control activities at the unit in accordance with Article 5 through 8 hereof and other relevant regulations of SBV, and be responsible to the Governor for the internal control.

b) make and promulgate internal regulations and business processes so as to perform his/her functions and tasks, manage and use assets in accordance with regulations of law, rules and regulations of SBV.

c) provide instructions on provision and exploitation of information related to internal control activities at the unit; closely cooperate with the Internal Audit Department in implementing measures to supervise and exploit information concerning risk assessment and warning.

d) direct and be in charge of the internal control department/division or internal controllers of the unit; deploy full-time internal controllers at the unit in accordance with the requirements set out in Clauses 6 and 7 Article 6 hereof; enable the internal control department/division and internal controllers to effectively perform its/his/her duties.

dd) If the unit does not have any internal control department/division or full-time internal controller, the head shall establish and maintain an internal control system which is suitable for the unit’s scale, operation and form of administration, and organize internal control activities in accordance with regulations laid down in this Circular and be responsible to the Governor for the compliance with laws and asset safety assurance by the unit.

2. A head of a unit has the power to:

a) proactively deploy personnel and decide internal control measures and methods in line with regulations of this Circular and SBV’ relevant regulations.

b) request the Governor to amend, add or complete mechanisms, rules and business processes in order to improve the effectiveness in internal control activities at the unit and SBV.

c) take actions against violations of laws and SBV’s regulations discovered during through auditing or request a competent authority to do so.

d) Other powers prescribed by law and SBV.

Article 11. Tasks and powers of internal control department/division and full-time internal controllers at a unit

1. Tasks:

a) Develop annual and periodic (if any) internal control programs and plans and submit them to the head for approval; organize the implementation thereof after obtaining approval;

b) Assist the head in carrying out internal control activities in accordance with this Circular and other relevant regulations of SBV.

c) Directly inspect, control and supervise operations and asset safety assurance as assigned; request and suggest the Governor to amend, add and perfect the business process, take actions against deficiencies and violations discovered through auditing and be responsible to the head for performance results.

d) Submit internal control reports to the head as prescribed and as requested.

dd) Regularly update and consider documents, rules, business processes, professional knowledge and skills to perform tasks as requested.

2. Powers:

a) Exploit and sufficiently and promptly provide all information and documents concerning activities, operations and transactions of the unit to perform the internal control task.

b) Request the head to take necessary measures to enhance effectiveness and efficiency in internal control activities and provide instructions on correcting deficiencies and violations discovered through auditing.

c) Be deployed and enabled to perform their tasks; be offered training and refresher training courses to improve their professional competence and skills.

d) If any violation against laws and SBV’s regulations is found possibly resulting in threatening safety of information, money and assets of the unit, the internal control department/division or full-time internal controller shall immediately report the violation to the head; if the head fails to impose penalties or imposes penalties for such violation in contravention of regulations, the internal control department/division or full-time internal controller is entitled to notify the Governor in writing (via the Internal Audit Department).

Article 12. Reporting of internal control

1. Every internal control department/division and internal controller shall submit periodic or ad-hoc internal control reports to the head. The head shall prescribe contents, methods and time limit for submitting the reports.

2. The units mentioned in Clause 1 Article 2 hereof shall submit an annual report on internal control to the Governor (via the Internal Audit Department) in writing before January 15 of the following year according to the Appendix hereto.

In the event that a risk is posed resulting in loss of money or assets or threatening information safety, the unit shall notify the Governor (via the Internal Audit Department) in writing within 24 hours from the time when the risk is posed.

3. The Internal Audit Department shall consolidate propositions, advise and suggest the Governor to deal with them upon internal control at units affiliated to SBV.