Internal Audit Human Resources of State Commercial Bank of Vietnam

- Perform inspection and evaluation functions:

Internal auditors conduct inspections and assessments of audited information; develop internal audit procedures, develop and supplement internal audit methods and scopes; participate in audit planning and conduct audits in accordance with internal audit policies, processes and procedures. Thereby, internal audits play a role in providing assurance that commercial banks operate effectively and achieve their goals in banking governance (through risk management) and internal control. In fact, the inspection and assessment functions are performed most by internal audits of banks. Through collecting evidence, auditors will give comments on audited activities/operations. Auditors still mainly look for violations similar to the financial and accounting inspection functions; or review compliance with internal policies, rules and regulations and make assessments on the level of compliance of their units. In state-owned commercial banks that have not yet separated the functions of inspection, control and auditing, the color of internal audit is still quite vague, even when Circular 44 on internal audit of the State Bank has been issued. Through the audit function, internal audit has only been able to provide assurance on the operation of a number of control steps mainly related to credit activities, accounting, foreign currency investment and exchange rates, management and use of fixed assets of the bank or compliance with financial and banking accounting regulations. Therefore, senior managers and investors in banks have not yet had assurance from internal audit on the effectiveness of the internal control system and risk control in the operations of commercial banks.

- Perform consulting functions :

Internal audit will raise issues that have negative impacts on the bank's operations; review the nature of the impacts and make recommendations to address emerging issues; improve and enhance the effectiveness and efficiency of the internal control system. At the same time, recommend handling violations; advise the executive board and the board of directors.

Maybe you are interested!

Board of Directors and functional departments but does not affect the independence of internal audit. Currently, the advisory function of internal audit in state-owned commercial banks in general only stops at making recommendations to overcome problems arising in banking operations (recommendations stemming from the results of specific inspections and controls). Internal audit has not provided separate advisory opinions to levels in the bank. Consulting for the Board of Directors, Executive Board and other departments only stops at comments on the bank's internal audit report. On the contrary, the attention to the advisory opinions of internal audit and consideration of their use in making decisions by leaders at all levels has not been done regularly, causing the value of internal audit to be somewhat reduced.

- Perform training functions :

Training for other departments in the bank aims to improve the quality of human resources, but this activity is carried out informally. In fact, this is also a big waste of brainpower because the internal auditors are often experienced and have sufficient skills and expertise. At state-owned commercial banks, the internal audit department also performs a number of other functions such as: recruitment, working with independent auditors, the State Bank, the State Audit and performing other functions assigned by the Board of Directors and the Supervisory Board.

In fact, with the support of the World Bank through the Bank Modernization Project and the Technical Linkage Support Project, state-owned commercial banks such as BIDV, Vietinbank, Vietcombank, Agribank, MHB have actively built important infrastructure for the implementation of good practices in banking governance, one of the positive measures is to form a centralized management information system (MIS) and risk management. In this context, the position of internal audit is used as a tool to help the bank's management at all levels implement risk management to achieve goals and operate the management information system in the right direction. This means that the functions, tasks, and roles of internal audit

The internal audit function in the State-owned commercial banks has been improved to suit the current banking restructuring goals. However, the current situation at State-owned commercial banks before and after equitization still has difficulties and obstacles, reflected in the relationship between the Board of Directors and the Executive Board; the role of the Committees in the Board of Directors is still unclear; as a result, the role of the Supervisory Board and the Internal Audit Board have not properly performed their functions and tasks and have not completed the set goals due to the influence of independence. There are many factors, including the fact that State-owned commercial banks have to implement a number of policies under the direction of the Government or the State Bank when the economy is in difficulty, so internal audit work can also be affected by poor transparency. Therefore, it can be seen that the position and role of the internal audit department in State-owned commercial banks as well as the quality of the work of this department depend largely on the corporate governance model that each bank builds and develops.

2.2.3.2. Internal audit human resources of State Commercial Bank of Vietnam

In Vietnam, according to Decision No. 832-TC/QD/TCKT issued on October 28, 1997 by the Minister of Finance regulating the Internal Audit Regulations: “Internal auditors at State-owned enterprises must meet the following standards: (1) Be honest, objective, have no criminal record and have not been disciplined at the level of warning or higher due to violations in economic, financial and accounting management;

(2) Graduated from university with a major in economics, finance, accounting, or business administration; (3) Worked in the field of financial management and accounting for 5 years or more, of which at least 3 years worked at the enterprise where the auditor was assigned; (4) Received training in auditing and internal auditing according to the unified program of the Ministry of Finance and was granted a certificate”. In case the internal auditor does not have a university degree in economics, finance, accounting or business administration, he/she must have at least an intermediate level in economics, finance or business administration, have worked in the field of financial management and accounting for at least 5 years, and have worked at an enterprise.

3 years or more of professional experience but not lower than the professional level of the chief accountant of that enterprise. In Vietnam, there are currently no official regulations on standards for internal auditors of banks. Clauses 1, 2, 3, Article 13 of Circular 44/2011-NHNN stipulates the standards for internal auditors of banks as follows:

- Have honesty and awareness of law compliance;

- Have general knowledge and understanding of law, business administration and banking operations;

- Have a university degree or higher in relevant majors, have full knowledge and always update on assigned fields when performing internal audits;

- Ability to collect, analyze, evaluate and synthesize information;

- Have knowledge and skills in internal auditing;

- Have at least 3 years of experience working in finance, banking or auditing;

- Comply with the professional ethics rules of auditing as prescribed;

- Other standards specified by the bank.

For the Chief Internal Auditor and Deputy Chief Internal Auditor, they must have a university degree in banking, finance, accounting, auditing; and at least 5 years of experience working in the banking and finance sector. Some state-owned commercial banks also clearly state that the position of Chief/Deputy Chief Internal Auditor; or Chief/Deputy Chief Internal Auditor of the region must have professional competence, management and operational capabilities, and high credibility in the assigned work. In addition, the head of the internal audit department must also ensure leadership, direction, and orientation skills; skills in managing and motivating employees; skills in exchanging information, presenting, and synthesizing and writing reports. Through the actual survey (Appendix 2.1: Internal audit survey form of state-owned commercial banks; and Appendix 2.2: Summary of survey results), the NCS draws out the following contents:

The number of internal auditors at State-owned commercial banks as of 2012 averaged from 15 to 60 people at the Head Office; in regions and offices.

The number of representatives is less depending on the size of each bank. The number of internal auditors has almost no significant fluctuations over the years because the demand for this human resource has little change. For example, at Vietinbank, there are currently about 400 people. In 2012, Vietinbank reviewed and fundamentally changed the personnel of the regional internal audit departments with experienced resources from branches and external recruitment; at VCB at the Head Office there are about 30 people; in the Southern and Central regions there are about 20-30 people; at BIDV at the Head Office there are about 30 people, at Agribank at the Head Office there are about 40-60 people and the whole system is about 700 people. The current number of internal auditors basically meets the current job requirements.

Qualifications: 100% of university graduates and over 50% of postgraduate graduates majoring in finance, accounting, auditing, banking and other majors at home and abroad. The number of internal auditors with auditing practice certificates is quite small: less than 10% (mainly independent auditor certificates). In Vietnam, internal auditor certificates are almost non-existent and very few internal auditors have ever heard of internal auditor certificates (there is no Association of Internal Auditors in general and in the banking sector in particular). Other certificates in banking, basic construction, etc. account for about 30% of the internal auditors interviewed and are mostly provided by banking training centers or schools.

Requirements for independence in the auditing process: In practice, internal auditors are all signed labor contracts by the Board of Directors. Internal auditors at the Head Office, as well as internal auditors at the regions and representative offices, are all paid by the Board of Directors/Members' Council, as well as rewards or discipline if any; internal auditors, whether at representative offices or in regions, are all employees of the Head Office and do not interfere in the internal affairs of the regions or representative offices there. Appointment or dismissal of the positions of Chief/Deputy Chief of Internal Audit

or the regional internal audit department and the internal auditor must be decided by the Board of Directors. Internal auditors are given the best conditions to increase their independence, without interference both professionally, economically and emotionally with the units/departments/audited. In addition, internal auditors are also required to be objective in their work, including honesty, fairness, and impartiality.

Requirements on skills and abilities for internal audit work in banks include specific criteria given for surveying internal auditors at state-owned commercial banks as follows:

-Understanding professional ethics

Article 22 of Circular 44/2011-NHNN stipulates the code of ethics for internal auditing, including: honesty, objectivity, confidentiality, responsibility, and prudence. Article 22, Section 3 also requires commercial banks to have measures to monitor, evaluate, and manage to ensure that internal auditors comply with the code of ethics. In fact, 5 state-owned commercial banks have implemented this content in the internal regulations on internal auditing. However, very few (less than 10%) banks have specific measures to monitor, evaluate, and manage internal auditors to comply with professional ethics; mainly through personal self-assessments and comments by the head of internal auditing at the year-end summary periods. There are also no specific criteria to assess the level of compliance with professional ethics for each level of internal auditors. This also reflects an objective reality that even at the training facilities for auditing human resources in general, there is not yet an official subject/course on professional ethics standards for internal auditing in banks in Vietnam.

-Understanding professional standards

This is the content that internal auditors at all levels must practice regularly, so over 90% of auditors are able to understand (and apply) the work of internal auditing in banks, and the requirements in each task.

stage of the audit (except for a small number of new or probationary internal auditors).

-Understanding professional standards

Similar to professional standards, most selected internal auditors must have undergraduate and postgraduate degrees in majors related to bank auditing, especially knowledge of finance, accounting, law, and banking. However, to meet the specific requirements of internal auditing work in commercial banks, only about 50% of internal auditors receive additional training in governance, risk and control; organizational and behavioral theory (mainly self-training or attending courses organized by the bank).

-Skills and tools to support internal audit work

Regarding internal audit skills training : In fact, state-owned commercial banks regularly organize courses on communication; management (policies, procedures, processes, staff, time); leadership; teamwork ability. Currently, state-owned commercial banks all have training centers or staff training schools to carry out the task of training human resources for the bank.

Regarding internal audit support tools : Currently, banks have not yet developed internal audit software but mainly rely on their own internal audit regulations (according to the guidance of the State Bank). Some banks have not yet completed their internal regulations on the organization and internal audit process in accordance with Circular 44/2011-NHNN. Internal auditors mainly use tools such as: business analysis; risk assessment and control techniques; information collection and analysis skills; forecasting, balanced scorecard; (priority in descending order). In the past, Vietinbank has upgraded and completed the Remote Internal Monitoring program, increasing the functions and system monitoring indicators. At VCB, we continue to implement many information technology projects to support internal audit work such as: core-banking system, data management and analysis system, implementing workflow systemization project...

2.3. ASSESSMENT OF THE CURRENT STATE OF THE PROCESS AND ORGANIZATION OF THE INTERNAL AUDIT APPARATUS IN VIETNAMESE STATE-OWNED COMMERCIAL BANKS

2.3.1. Results achieved

In order to implement the Government's economic restructuring policy, in which restructuring the banking system is one of the three main pillars in the spirit of the Resolution of the 3rd Conference of the 11th Party Central Committee (October 2011), the Vietnamese commercial banking system has made reforms in institutions, organizational models and improved financial capacity. The Law on Credit Institutions 2010 and Circular 44/2011-NHNN have created a basic legal corridor for the organization and operation of Vietnamese commercial banks in general and internal audit activities in particular; aiming to gradually improve the management capacity of the banking system and gradually approach international standards and practices. The implementation of internal audit based on the Law on Credit Institutions 2010 and Circular 44 has helped state-owned commercial banks achieve the following results:

2.3.1.1. On the organization of the internal audit process

Firstly, the State-owned commercial banks have urgently completed the development of internal audit regulations and procedures through the issuance of the Internal Audit Policy or/and the issuance of a new Internal Audit Handbook in the spirit of Circular 44. Accordingly, a new internal audit process has been developed and specific work steps have been provided for each aspect of internal audit operations and methods to ensure standardization and consistency in internal audit work, in accordance with the operations of each State-owned commercial bank in the current period as well as access to the best governance practices currently being applied to the modern banking system in the world. This is an important premise to help the internal audit department conduct audit work in accordance with the goals and requirements set by the State Bank.

Second, diversify the content of internal audit. Internal audit areas are changed regularly to suit the actual requirements of each State-owned commercial bank. Audit content often focuses on prominent issues that are easy to

Fraud and material errors may arise that may affect the audited unit's profit during the period, such as credit activities, bad debts, basic construction, capital and foreign currency trading, assessment of compliance with regulations and internal policies, etc., so that the audit recommendations are often closely related to the unit's situation. 3 out of 5 commercial banks have conducted audits on major topics, thereby contributing to resolving problems at each branch and improving the unit's operational efficiency.

Third, with strong capital and technology potential, state-owned commercial banks have gradually formed an MIS management information system and built a risk management system in line with common practices in the world, through the support of the World Bank with the Bank Modernization and Technical Linkage Support Project (TA1, TA2). Upgrading the centralized information system aims to ensure that the information control process is centralized at a single point at the Head Office, thereby identifying, analyzing and assessing risks in a timely and accurate manner. This is the basis for internal audit to effectively deploy risk-based auditing methods and procedures.

2.3.1.2. On the organization of internal audit apparatus

Firstly, improve the organizational model and operation of the internal audit department, ensuring compliance with the provisions of Circular 44/2011/TT-NHNN dated December 29, 2011 of the Governor of the State Bank of Vietnam regulating the internal control and internal audit systems of banks; thereby clearly distinguishing the internal control and internal audit functions in state-owned commercial banks; minimizing overlap in work. Helping to increase awareness of those working in internal control and audit and the audited unit in coordinating work to complete tasks.

Second, in the internal audit policy, the audit handbook specifically stipulates the tasks, responsibilities, and powers of internal audit from the Head Office, Representative Office to the regions; specifically demarcates the scope and fields of audit activities.

internal audit at each level; clarifying standards/regulations on the rights and responsibilities of bank internal auditors (for each position); setting requirements on skills and capabilities of internal auditors; complying with professional ethics and professional standards, expertise of bank internal audit; as well as gradually building a professional culture in the system of State-owned commercial banks in Vietnam. The process of building the organizational structure and audit human resources is based on the common principles and practices on banking supervision activities advised by the Basel Committee, towards the current advanced risk management model.

2.3.2. Limitations

In addition to the above achievements, the internal audit organization in Vietnamese state-owned commercial banks still has the following limitations:

2.3.2.1. Limitations on the organization of the internal audit process

Firstly, regarding the organization of internal audit content : Currently, internal audit is mainly focusing on checking the level of compliance with the internal rules and regulations of the bank; policies and regimes of the State Bank; at the same time checking the compliance with the financial regime, bank accounting, credit activities and basic construction investment. In addition, it also conducts financial statement audits for specific areas such as accounting, credit activities... So it seems that internal audit is re-performing the work of the audited operational departments while these departments always have the function of self-inspection; as well as the internal control work of the Compliance Inspection/Supervision Department. Obviously, what is the difference in internal audit work? It is difficult for internal audit/internal control staff to answer because these departments have not yet performed all the auditing functions , especially the function of ensuring consulting as required by the bank's leaders. On the other hand, the content of operational audit is rarely performed , especially auditing the completeness, effectiveness and efficiency of the internal control system as prescribed in Circular 44. This further reduces the value of the function.

consulting, leading to the creation of added value for banks from internal audit activities is not yet clear. In addition, the audit content according to major topics is also rarely implemented, due to limitations in human resources, time and audit costs.

Second, regarding the development and application of auditing methods : KTNB has initially used the risk-based method, but mainly stopped at the level of statistical analysis of the possibility of violations in each field based on experience, without any guidance on how to implement it (this is clearly stated in Circular 44, but there is no specific guidance document). The relationship between the risk-based method and the compliance audit method and the basic audit method has not been clarified.

Third, on the development and application of internal audit processes :

State-owned commercial banks have not yet developed internal audit software, so the work in each audit stage is mainly performed manually with the support of office software on computers. The audit process is still designed according to the system approach and audit according to the assurance model (based on available guidelines on how to assess audit risks, internal controls, data bases, audit programs, etc.) to collect evidence. These contents are not really consistent with the theory of risk-based audit approach (based on the actual risks of the branch to build and assess audit risks, internal controls, or audit programs).

The audit planning is only done one-way, mainly from the internal audit department of the Head Office to develop and submit to the Board of Directors for approval, without any discussion with the unit to be audited (including the annual audit plan and the plan for each audit). This can lead to subjectivity in the planning stage because the audit staff at the Head Office do not have a clear understanding of the actual operating situation at the branches or use

The use of information reporting systems is not accurate. On the other hand, determining materiality and selecting audit samples is still mainly based on the auditor's experience because there is no software for selecting samples or assessing materiality. Therefore, the completeness and appropriateness of the audit evidence collected may be affected. That is why internal audit work still has the color of inspection or control activities.

During the audit practice phase: internal audit has not yet coordinated a variety of evidence collection techniques, but has mainly stopped at observation, document inspection, analysis, or interviewing. Inventory techniques are rarely used due to limitations in cost and audit time. The content of the applied methods is not clear, for example, internal audit mainly studies the design of internal control activities at the branch, but has not yet evaluated the operational aspect (checking the effectiveness of internal control regulations).

In the final stage of the audit: the internal audit report only stops at detecting violations in the management and business process of the branch, from which recommendations are made to correct the violations. The report does not clarify the advisory function of internal audit, especially in creating added value for the bank's management. This limitation has reduced the position of the bank's internal audit department, affecting the effectiveness of the audit.

2.3.2.2. Limitations on the organization of internal audit apparatus

Firstly, the internal audit structure of state-owned commercial banks has only been built to meet the requirements of Circular 44, while the effective operation of the departments in the organizational model has not been evaluated due to lack of practical experience (internal audit models have only been built and operated in the past 1-2 years).

Second, the position of the internal audit department has not been given due importance compared to the position built in the organizational model of state-owned commercial banks.

Comment