During the audit of Smile Bank, CA Sweety focused on understanding the risk management process of the bank. She reviewed how management developed…

Understanding the Risk Management Process: Management develops controls and uses performance indicators to aid in managing key business and financial risks. An effective risk management system in a bank generally requires the following: (i) Oversight and involvement in the control process by those charged with governance: Those charged with governance (Board of Directors/Managing Director) should approve written risk management policies. The policies should be consistent with the bank's business objectives and strategies, capital strength, management expertise, regulatory requirements and the types and amounts of risk it regards as acceptable. (ii) Identification, measurement and monitoring of risks: Risks that could significantly impact the achievement of bank's goals should be identified, measured and monitored against pre-approved limits and criteria. (iii) Control activities: A bank should have appropriate controls to mitigate its risks including effective segregation of duties (particularly between front and back offices), accurate measurement and reporting of positions, verification and approval of transactions, reconciliation of positions and results, setting up limits, reporting and approval of exceptions, physical security and contingency planning. (iv) Monitoring activities: Risk management models, methodologies and assumptions used to measure and mitigate risk should be regularly assessed and updated. This function may be conducted by the independent risk management unit. (v) Reliable information systems: Banks require reliable information systems that provide adequate financial, operational and compliance information on a timely and consistent basis. Those charged with governance and management require risk management information that is easily understood and that enables them to assess the changing nature of the bank's risk profile.