Setting up of risk management architecture: With the progressive deregulation of the financial system as also to address systemic concerns on the safety and soundness of the banking system, RBI advised banks in India in February 1999 to introduce, effective from April 1, 1999, a scientific system of Asset-Liability Management. RBI also issued in October 1999 comprehensive guidelines for putting in place an effective and comprehensive Risk Management System. The guidelines envisaged that banks would set up proper organizational structure, policies, procedures, limits for credit, market and operational risk management. Under the ALM guidelines banks were expected to cover 100% of their assets and liabilities by April 1, 2000. A review undertaken by RBI has revealed that most of the banks are yet to cover 100 per cent of their assets and liabilities for ALM or set up proper risk management systems and policies for managing credit, market, operational and other risks.

As stated earlier, supervisory resources would be focused on the areas of higher risks to a bank. The risk profile would highlight both the strengths and vulnerabilities of a bank and would provide a foundation from which to determine the procedures to be conducted during an on-site examination.

Under a risk-focused on-site examination approach, the degree of transaction testing would be reduced when internal risk management processes are determined to be adequate or risks are considered minimal. When, however, risk management processes or internal controls are considered inappropriate, additional transaction testing sufficient to fully assess the degree of risk exposure in a function or activity would be performed. It would be necessary for banks to carry out a fresh review of their current status of risk management architecture by an expert team and initiate measures to bridge the gaps.

Adoption of Risk focused Internal Audit: Internal Audit is an independent activity designed to improve the bank's operations. The internal audit function is a part of the ongoing monitoring of the system of internal control and assists the staff in effective discharge of their responsibilities. The success of internal audit function depends largely on the extent of reliance the bank management would place in guiding the bank's operations. The Internal Audit Department will therefore have to be independent from the internal control process and be given an appropriate standing within the bank to carry out its assignments with objectivity and impartiality. The Internal Audit Department should therefore be provided with appropriate resources and staff to achieve its objectives. Historically, the internal audit system in banks has been concentrating on:

1. transaction testing, accuracy and reliability of accounting records and financial reports,

2. testing of integrity, reliability and timeliness of control report, and

3. adherence to legal and regulatory requirements though transaction testing would remain a reliable and essential examination aspect of internal auditing, in the changing scenario such testing by itself would not be sufficient.

Over the years, the evolvement of financial instruments and markets have enabled banks to reposition their portfolio risk exposure. It has become clear that periodic assessment based on transaction testing alone cannot keep pace with the rapid changes occurring in financial risk profiles. In this context the widening of the scope of internal auditing assumes significance. The internal audit would have to capture in a larger way the application and effectiveness of risk management procedures and risk assessment methodology and critical evaluation of the adequacy and effectiveness of the internal control systems. The internal audit department should pay special attention to auditing the banking activity in all the places through which the activity is undertaken. The precise scope of work of internal auditing must be determined by each bank but as a minimum, must review and report upon the control environment as a whole, the process by which risks are identified, analysed and managed, the line of controls over key processes, the reliability and integrity of corporate management function, safeguarding of assets and compliance with rules and regulations.

To achieve these objectives, banks would have to gradually move towards risk focused auditing, in addition to the system of selective transaction based auditing. The implementation of risk based auditing would mean that greater emphasis is placed on the internal auditor's role of mitigating risks. By focussing on effective risk management the internal auditor would not only offer remedies for current trouble areas but also anticipate problems and play an important role in protecting the bank from risk hazards. The risk based auditing would not only cover assessment of risks at the branch level but would also cover, as an independent assessing authority, assessment of risks at the corporate level and the overall process in place to identify, measure, monitor and control the risks. In order to focus attention on areas of greater risk to the bank, a location-wise and activity-wise risk assessment should be performed in advance of on-site risk based auditing. This would allow identification of high risk areas which would enable prioritising the activities and locations for risk based audit. If initial inquiries into the risk management system raise material doubt as to the system's effectiveness, no significant reliance should be placed on the system and a more extensive series of tests need to be undertaken to ensure that the bank's exposure to risk from a given function or activity is accurately captured and monitored. The high-risk areas need to be looked into more frequently than the low risk areas.

Risk based audit would be an aid to the ongoing risk management by banks, as it would provide checks and balances in the system. The banks could form a small Committee of executives and entrust them with the responsibility to chalk out an action plan, implement and monitor the progress in adoption of risk management systems and risk focused audit and report to the Top Management and Board of Directors periodically.

Strengthening of Management Information System and Information Technology: A principal foundation for RBS is the availability of detailed data. Under RBS the monitoring needs of RBI will differ based on the risk profile of a bank and accordingly RBI may require banks to provide information in addition to the data now being furnished in the OSMOS returns. Consequently, there is a need to devise a policy for backup and storage of various databases on regular intervals. The policy should specify details like frequency of backups, media to be used, off-site storage areas, departments and officials (Data Managers) responsible for these actions. The accuracy, completeness and the timeliness of data are very important and would have to be ensured by banks through up-gradation of their management information and information technology systems. The Data Manager's role should be created in order to ensure that the data has integrity, is stored in correct place, comprehensive and timely. The Data Managers should be made responsible for specific databases. Banks should review the present status of the management information and information technology systems and initiate necessary measures to ensure that RBI data needs as well as supervisory reporting systems are streamlined.

Addressing HRD issues: A major transitional task towards completion of risk management set up and introduction of risk based audit will be the reorientation of the staff to meet the required objectives. The potential primary obstacles will be the skill formation of the staff and placement in appropriate positions. Banks may have to create a dedicated risk management team at head office and reorient the Internal Audit Department to undertake risk-based audit. These objectives could be attained through addressing several HRD issues like manpower planning, selection and deployment of staff and extensive training in risk management including asset liability management and risk based audit. The banks will have to adopt a forward looking training arrangement through appropriate course designing and compilation of training materials keeping in view the best international practices and procedures.

Setting up of Compliance Unit: Banks are required to take corrective action to remedy or mitigate any significant risks which have been identified in the earlier part of the supervisory cycle and which have been incorporated into the current risk profile. RBI will issue bank specific MAP which will include directions to banks on actions to be taken. If the actions and timetable set out in the MAP fail to be met, RBI may issue further directions or impose sanctions or take mandatory and discretionary actions, if deficiencies continue to persist. It is therefore necessary for banks to set up a dedicated compliance unit to coordinate various actions of the bank for compliance and for periodical reporting to RBI, and ensure the completion of compliance action within the time period indicated in the MAP. The compliance unit should be headed by a Chief Compliance Officer of the rank of not less than a General Manager who will be responsible and accountable for timeliness and accuracy of the compliance.