Audit Policy Manual for Rural and Community Banks

The control environment is the overall attitude, awareness, and actions of the Board of directors and managers regarding the internal control system and its importance. Control Activities are policies and procedures that management has established to achieve the entity's specific objectives. Risk is anything that endangers the institution's achievement of an objective. Internal auditing activity is primarily directed at improving internal control. The function aims to add value, improve operational efficiency, economy, and effectiveness of management processes, risk management, and internal controls. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the governance processes. Management is responsible for internal controls, and managers establish policies and processes to help the organization achieve specific objectives. Internal Control is designed to achieve three organizational objectives: efficiency and effectiveness of operations, reliability of financial reporting, and compliance with applicable laws and regulations. Factors reflected in the control environment include the function of the Board of Directors and its Committees, management's philosophy and operating style, the organizational structure and methods of assigning authority and responsibility, management's control system, including the internal audit function, personnel policies and procedures, and segregation of duties. The management of the bank is responsible for establishing and maintaining controls to discourage perpetuation of fraud. Internal Audit is responsible for examining and evaluating the adequacy and effectiveness of those controls. Audit procedures alone are not designed to guarantee the detection of fraud. An error is an unintentional mistake in financial statements, while an irregularity is an intentional distortion of financial statements or the misappropriation of assets. Roles and responsibilities are separated as follows: the Board of Directors, through its Board Risk and Audit Committees, is responsible for the Internal Control Policy of the Company. The General Manager is accountable to the Board of Directors for developing and implementing the internal control framework. Management is responsible for the development and implementation of control activities that ensure financial records and relevant databases accurately reflect actual operational activities, assets are safeguarded from unauthorized use or disposition, and irregularities and fraud are prevented. Internal Audit's primary activity is the implementation of a program of regular audits of the bank business operations. The complete range of services provided by Internal Audit may also include special projects and consultations as directed by the Board. Operational audits consist of critical reviews of operating processes and procedures and internal controls that mitigate area-specific risks. Compliance audits determine the degree to which areas within the bank adhere to mandated Government and bank's policies and practices. Financial audits review accounting and financial transactions to determine if commitments, authorizations, and the receipt and disbursement of funds are properly and accurately recorded and reported. Professional proficiency is the responsibility of the individual auditor. The Head of Internal Audit will assign each audit to the individual who possesses the necessary knowledge and skills to conduct the audit properly. The Internal Audit staff has a professional obligation to schedule and attend ongoing professional education forums to ensure they maintain academic proficiency and to advance professionally. The Head of Internal Audit is responsible for providing appropriate audit supervision, which is a continuing process initiated with the planning process. Internal Audit will conduct audits to evaluate whether the policies and processes are designed and operating effectively and provide recommendations for improvement. The Head of Internal Audit will notify the Audit Committee of the Board of Directors that an irregularity has been identified and the audit steps needed to determine the extent of the problem. The Board of Directors, through its Board Risk and Audit Committees, is responsible for the Internal Control Policy of the Company, and the General Manager is accountable to the Board of Directors for developing and implementing the internal control framework.