Management Oversight – Lessons Learnt from BSI AML Control Failures

 

The Monetary Authority of Singapore (MAS) announced on 24 May 2016 that it has served BSI Bank Limited (BSI Bank) notice of intention to withdraw its status as a merchant bank in Singapore for serious breaches of anti-money laundering requirements, poor management oversight of the bank’s operations, and gross misconduct by some of the bank’s staff.

Although there were many control failures, serious breaches of regulations, unacceptable risk culture and acts of gross misconduct by the staff, it all boiled down to management oversight.  In most banks, the management has to set the tone for company-wide AML culture.  Here, we take a look at what are the management roles in AML in a bank, which can be adapted to help strengthen the AML compliance system in any businesses.

 

What is management oversight and why is it so important? This can be looked at through the eyes of the Board of Directors and Senior Management.

 

Board of Directors

The Board of Directors has the role and responsibility of:

approving strategies and policies, understanding the risks run by the bank, setting acceptable levels for these risks and ensuring that senior management takes the steps necessary to identify, monitor and control these risks, approving the organisational structure and ensuring that senior management is monitoring the effectiveness of the internal control system.

The Board provides governance, guidance and oversight to senior management. It is responsible for setting the broad strategies and major policies of the organisation and approving the overall organisational structure. The Board has the ultimate responsibility for ensuring that an adequate system of internal controls is established and maintained. Effective Board members are objective, capable and inquisitive, with a knowledge of the activities of and risks run by the bank. A strong and active Board, particularly when coupled with effective upward communication channels and capable financial, legal, and internal audit functions, is often best able to ensure the correction of problems that may diminish the effectiveness of the internal control system.

The Board should include in its activities:

periodic discussions with management concerning the effectiveness of the internal control system, a timely review of evaluations of internal controls made by management, internal auditors and external auditors, and periodic efforts to ensure that management has appropriately followed up on recommendations and concerns expressed by auditors and supervisory authorities on internal control weaknesses.

One option used by banks in many countries is the establishment of an independent audit committee to assist the Board in carrying out its responsibilities. The establishment of an audit committee allows for detailed examination of information and reports without the need to take up the time of all directors and ensures that the particular questions concerned receive proper attention. It should be noted that in no case should the creation of an audit committee amount to a transfer of duties away from the Board, which is legally empowered to make decisions.

 

Senior Management

Senior Management should have responsibility for:

implementing strategies approved by the board, setting appropriate internal control policies, and monitoring the effectiveness of the internal control system.

Members of senior management typically delegate responsibility for establishing more specific internal control policies and procedures to those responsible for a particular unit’s activities or functions. Consequently, it is important for senior management to ensure that the managers to whom they have delegated these responsibilities develop and enforce appropriate policies and procedures.

It is important that senior management takes steps to ensure that activities are conducted by qualified staff with the necessary experience and technical capabilities. Staff should be properly compensated and their training and skills periodically updated. Senior management should institute compensation and promotion policies that reward appropriate behaviours and minimise incentives for staff to ignore or override internal control mechanisms.

The Board of directors and Senior Management are responsible for promoting high ethical and integrity standards, and for establishing a culture within the organisation that emphasises and demonstrates to all levels of personnel the importance of internal controls. All levels of personnel at a banking organisation need to understand their role in the internal controls process and be fully engaged in the process.

An essential element of an effective system of internal control is a strong control culture. It is the responsibility of the board of directors and senior management to emphasise the importance of internal control through their actions and words. This includes the ethical values management displays in their business dealings, both inside and outside the organisation. The words, attitudes and actions of the board of directors and senior management affect the integrity, ethics and other aspects of the bank’s control culture.

While having a strong internal control culture does not guarantee that an organisation will reach its goals, the lack of such a culture provides greater opportunities for errors to go undetected or for improprieties to occur.