This lesson explores the governance structures that support the internal control system and the specific responsibilities of the board of directors and senior management.

7.1 Corporate Governance and the Control Culture
The board of directors and senior management are responsible for establishing the appropriate culture to facilitate an effective internal control process. This “tone at the top” is essential for fostering a control culture where employees understand the importance of internal controls. Corporate governance models define the responsibilities of directors and non-executive directors, clarifying the role of the auditor and the management of financial crime risks.

7.2 The Board’s Role in Internal Control
The board is ultimately responsible for ensuring an effective ICS. This includes:

• Oversight: Ensuring that the ICS is adequate for the nature, scale, and complexity of the bank’s business.

• Risk Appetite: Approving and periodically reviewing the bank’s Risk Appetite Statement (RAS).

• Monitoring: Receiving and reviewing reports from management, internal audit, and the compliance function on the effectiveness of the ICS.

• Remuneration: Designing compensation schemes that do not incentivise excessive risk-taking.

7.3 The Role of Senior Management
Senior management is responsible for implementing the board’s strategy and establishing the detailed policies, procedures, and controls. They must ensure that internal control activities are integrated into daily business processes.

7.4 External Audit and Public Disclosure
External auditors provide independent assurance on the bank’s financial statements and, in some jurisdictions, on the effectiveness of internal controls over financial reporting. The external audit and public disclosure requirements are governed by regulations like the Sarbanes-Oxley Act (SOX) in the U.S. Basel regulations also include requirements for disclosure (Pillar 3).