Can any body provide the areas to be covered in management audit of asset management company of mutual fund or some guidelines to be followed by the AMC
17 March 2012
Internal Audit and Risk Management in BFSI sector is primarily intended to provide the management with clear, comprehensive and unbiased analysis of the adequacy, existence and effectiveness of internal controls and risk management framework of the entity. It reviews the functional efficiency of the organisation with a view to suggest areas for possible improvements. It is an important tool which enables an organisation in achieving its strategic business goals, meeting operational and business environmental challenges, complying with regulatory norms and managing reporting requirements. Internal Audit includes: Critical evaluation of internal controls, performing GAP analysis and suggesting areas for strengthening; Constructive review of business operations by keeping the organisation's business needs in focus; Identification and recommendation of areas for cost reduction, revenue optimisation and improvement in operational efficiency; Critical evaluation of systems and procedures and adherence to Standard Operating Procedures; Review of Information Technology (IT) controls and Business Continuity Plan; Identification, assessments and control of risks; Review of compliances with the various regulatory provisions and operations manuals; Review of adherence to the corporate governance requirements. As per the Institute of Internal Auditors ‘Enterprise-Wide Risk Management (ERM) is a structured, consistent and continuous process across the whole organisation for identifying, assessing, deciding on responses to and reporting on opportunities and threats that affect the achievement of its objectives’. The responsibility of ERM is with the Board of Directors. Internal audit is an independent, objective assurance activity and can provide valuable insight in providing assurance that major business risks are being managed appropriately and the risk management and internal control framework is operating effectively. ERM role shall include the following: Facilitating identification and evaluation of key risks; Evaluating and reporting of key risks; Consolidating risks across the organisation; Developing and maintaining the ERM framework. However, internal audit should not be involved in setting risk appetite, taking decision on risk response, implementing risk response or taking accountability of risk management. Internal Audit's core role in relation to ERM should be providing assurance to management and to the Board on the effectiveness of risk management. Internal Audit and Risk Management in today's global competitive environments depends heavily on Information System for decision making. Business processes are increasingly getting automated and controls becoming less person dependant. In such a scenario, the significance of Information Technology (IT) and Information System (IS) cannot be undermined as these are pervasive throughout the business. Some areas that can benefit include Information System Development, Assessment of risks and its management, Business Continuity Plan and Disaster Recovery Plan, Hardware, Software and Network audits etc.