How banks can strengthen internal control management [Ping An Internal Control: “Regulations +1”]

After determining the development goal of Ping An of China into a leading international comprehensive financial group, the company's chairman Ma Mingzhe proposed that Ping An should implement "Regulations + 1" (where regulations are clearly stipulated, resolute and strict Execution; if regulations are not clearly stipulated, the internal control standards of code of conduct shall be determined according to higher ethical self-discipline standards). Specifically, it is necessary to build an internal control system that meets international standards and regulatory requirements, in accordance with national laws and regulations and the requirements of various regulatory agencies, aiming at the operation and management benchmark of world-class modern financial enterprises, and combining the company's comprehensive financial development strategy and operation and management needs, Effectively implement an internal control operation mechanism that is “comprehensive, standardized in operation, highly targeted, well implemented, and powerful in supervision”.

After the release of the "Basic Standards for Enterprise Internal Control" on June 28, 2008, Ping An of China attached great importance to it and took immediate action to organize a project team to implement it. It hired an internationally renowned consulting firm to assist in project implementation and followed "pragmatic integration" Adhering to the core principles of "system-based, risk-oriented, process-based, and internal control platform system as the starting point", the internal control system has been integrated and upgraded again, specifically including: Revising the "Internal Control Evaluation and Management Measures" ", "Internal Control Self-Assessment Manual" to further improve the internal control system; build an internal control evaluation system platform to provide risk status and decision-making support to the management; and gradually establish and improve the daily operation mechanism of internal control evaluation to realize "internal control for everyone Participation, compliance is everyone’s responsibility, and internal control is integrated into business and processes,” etc.

Building a "three-in-one" management and control mechanism

In terms of internal control governance structure and system, Ping An's board of directors bears the ultimate responsibility for the effectiveness of internal control. Ping An's board of directors is a board of directors that relies on local advantages and practices international corporate governance standards. Among the existing 19 directors, 3 independent non-executive directors and 5 non-executive directors are from overseas. These overseas directors are all from finance and insurance. Seniors in professional fields such as finance, law, etc., are responsible for the establishment, improvement and effective implementation of internal controls. The audit and risk management committee under the board of directors is responsible for supervising and reviewing the effective implementation and internal control evaluation of the company's internal controls, and coordinating internal control audits. and other related matters.

Ping An Group of China has established an internal control management center, including the compliance department, risk management department, and audit and supervision department; each professional company has established corresponding compliance, risk management, and audit and supervision functional departments. The company continues to optimize its internal control system. Under the leadership of the company’s deputy general manager and chief audit executive Ye Sulan (who, as the chief audit executive, reports directly to the chairman of the board and the audit and risk management committee of the board of directors in accordance with the "Working Rules of the Audit and Risk Management Committee", Under the overall coordination and management guidance of "Ensuring Independence", we will continue to strengthen the division of labor and collaboration in the three module functions of "compliance management, risk management, and audit and supervision", strengthen work connection and information sharing, and "before, during, and after the event". "After the event" three-in-one risk management and control mechanism. Ye Sulan told the "Board of Directors" that the "Trinity" refers to the division of labor, cooperation and collaboration between the three professional departments in risk management and control, and strengthens risk management and control before, during and after the event. Among them, the compliance department mainly performs "pre-risk planning and response", the risk management department mainly performs "risk monitoring and control during the event", and the audit and supervision department mainly performs "risk ex-post supervision reporting". Business departments are the first line of defense for risk management and control. By establishing internal control evaluation and assessment accountability, Ping An integrates internal control with daily operations and management, embeds it into business and processes, establishes the core driving force of internal control, and puts risk management and control as far forward as possible. Set. The compliance department and risk management department are the second line of defense, and the audit and supervision department is the third line of defense.

In view of the risks that may exist in integrated finance such as related transactions, risk transfer, and double calculation of capital, Ping An has established and improved strict "legal person firewalls", "financial firewalls", "transaction firewalls" and "information firewalls" ” and other firewall systems to control single/cumulative risks well below the group’s acceptable level.

It is worth mentioning that Ping An has been committed to establishing a comprehensive risk management system with the goal of becoming a leading international comprehensive financial services group and combined with its own business characteristics. Through a complete organizational structure, standardized management processes, and risk management technology methods that combine quantitative and qualitative methods, it identifies, evaluates and controls risks, supports business decisions, and promotes the group's efficient, sustainable and healthy development.

Ren Huichuan, general manager of Ping An of China, lamented to the "Board of Directors": "The risk control system is very independent and strict. The group emphasizes regulations +1. The reason why we can rest assured is because of this system."

Improving the internal control evaluation mechanism

As for the internal control evaluation mechanism, Ping An has established an internal control evaluation methodology based on it, covering all business departments to conduct internal control self-evaluation, the risk management department to conduct internal control risk assessment, and the audit and supervision department to conduct internal control self-evaluation. An internal control evaluation mechanism is established to set up a special evaluation team to conduct independent evaluation of internal control, and external auditors to audit the company's internal control status.

Ping An’s internal control evaluation work strictly follows the relevant external regulatory regulations and the procedures stipulated in the company’s internal control evaluation methods. The Company's Compliance Department will take the lead and work with each business and relevant management departments to conduct management self-assessments on internal controls. The Company's Audit and Supervision Department will conduct independent evaluations of internal control audits. Relevant responsible departments will formulate and implement rectification plans based on internal control deficiencies and rectification suggestions. Ping An of China continues to improve the management's internal control self-evaluation and internal control audit independent evaluation process, and standardizes the management's internal control self-evaluation and internal control audit independent evaluation by strengthening project management, process management, quality review, solidifying project methods and procedures, and classification of evaluation results. development of work. Through the internal control system platform, the company completes the initiation, testing, summary, review, approval, rectification tracking, and result analysis of internal control evaluations. During the process of management's internal control self-assessment and internal control audit independent evaluation, the company collects, confirms, and analyzes relevant information through interviews, data collection and discussion, special seminars, comparison with industry best practices, training, etc., to determine and implement the company's overall control Target-related risks, and on this basis, identify and refine the corresponding control activities, and then conduct walk-through testing and operational effectiveness testing of the control activities to obtain sufficient, relevant, and reliable evidence to evaluate the effectiveness of internal controls. And record the working papers in writing. Measure quantitatively and qualitatively to determine whether internal control deficiencies constitute internal control deficiencies. Supervise relevant units or departments to rectify the discovered internal control deficiencies, and verify and confirm the rectification results.

The audit opinion issued by Ernst & Young Hua Ming Accounting Firm, the external auditor of Ping An of China, on its internal control over financial reporting held that on December 31, 2011, Ping An of China had complied with the "Basic Standards for Enterprise Internal Control" and relevant regulations. Effective internal control over financial reporting is maintained in all material respects.

Building a trust project

The core of doing a good job in internal control and risk management is to give full play to the role of the governance structure and people - this is Ma Mingzhe's requirement for Ping An's internal control and risk management work . Ping An's summary of improving the internal control process also includes: Management's high priority is a necessary condition for the implementation of internal control work; establishing an internal control organizational structure with clear rights and responsibilities and efficient operation is a prerequisite for the implementation of internal control work; conducting internal control assessment and accountability is the key to internal control work. The driving force for work implementation; the power of external consulting companies is the professional support for the implementation of internal control work; internal control work needs to rely on the company's existing foundation to improve, optimize, integrate and upgrade, and under normal circumstances it is not appropriate to reinvent the wheel.

Building on the previous foundation, since 2010, Ping An has been striving to build the “Ping An Trust Project”, striving to build trust on systems and processes, and build trust on mechanisms and platforms (such as the current Ping An An electronic platform for internal control evaluation and management has been established. The system mainly includes internal control management modules, risk self-assessment modules, key risk indicator modules, and loss event management modules. It classifies the system from the perspective of internal control and clarifies business departments at each level, compliance The role of departments and audit departments in the system).

Legal compliance and effective risk control are only the foundation. The intention of Ping An’s board of directors is to establish a corporate model with the highest ethical standards and enhance the trust of customers, shareholders, employees and society. Ping An’s compliance management, internal The further goal of control and risk management work is to build trust on systems and standards, build trust on processes and mechanisms, promote the efficient, sustainable and healthy development of Ping An, and make unremitting efforts for the safety, stability, and development of the national financial industry. . Ping An of China wants to be a century-old store, and a century-old store must be built on a sound mechanism platform, and the continuous improvement of internal control is the key.