ANNUAL REPORT 2011
INTRODUCTION
MANAGEMENT AND CORPORATE GOVERNANCE PRACTICES
FINANCIAL INFORMATION AND RISK MANAGEMENT
ANNUAL REPORT (PDF)
Audit Committee's Assessment of the Operation of the Internal Audit, Internal Control, and Risk Management Systems
The internal audit, internal control and risk management activities at Ziraat Bank are carried out by the Board of Auditors and Internal Control and Risk Management Group, which have segregated duties and responsibilities, are organizationally independent from each other, but work in coordination.
Set up to cover all units, branches and the Bank’s subsidiaries subject to audit, the organization aims to ensure complete and secure pursuance of banking activities, realization of long-term profit targets, reliable financial and administrative reporting, and minimization of unexpected risks that might negatively affect the Bank’s reputation and financial stability.
Operation of the Internal Audit System
The Board of Auditors adopts a risk-focused approach to auditing and controls compliance of the activities carried out by all of the Bank’s head office units, domestic and international branches, and subsidiaries under its control with the law and other applicable legislation, as well as the Bank’s internal strategy, policy, principles and targets, including internal control and risk management. The Board of Auditors keeps the Bank’s Senior Management informed and pursues its efforts in a manner to contribute to the decision-making processes of the Senior Management.
Having 228 members and working in line with the international internal audit standards, the Board of Auditors, during 2011, audited and evaluated the effectiveness and efficiency of transaction steps that make up the primary processes, and the secondary processes, besides auditing the compliance of the Bank’s activities with the processes that they are governed by. In addition, the Bank’s IT Inspectors audited the processes identified in the Regulation on Bank Information Systems and Banking Processes published by the Banking Regulation and Supervision Agency (BRSA) in line with the Bank’s implementations.
Apart from on-site audits, the Centralized Audit Team, which operates under the Board of Auditors and produces a dissuasive effect in terms of establishing actual irregularities and of preventing possible irregularities with the scenario analyses implemented, continues to increase its contributions to the activities of the Board of Auditors owing to these characteristics.
In addition, the members of the Board of Auditors strived to build up the personnel’s practical knowledge through on-site trainings given in branches. On the other hand, the inspectors have the opportunity to conduct audit in different units periodically and thereby to constantly build on their professional knowledge and experience; they were also given training at certain intervals to support their personal and professional development. Along the line, the Bank continued in 2011 to implement the training catalogue, which is formulated by identifying the training programs for each member of the Board of Auditors in any seniority, and opportunities were created for the members of the Board of Auditors to take part in numerous extramural meetings, conferences and workshops during the reporting period.
In the period ahead, the Board of Auditors will continue to be guided by a high sense of responsibility and duty in the execution of the internal audit plan to be devised in line with the targets and policies determined by the Bank’s Senior Management and within the frame of the modern approach to audit; in the reporting of their outcomes to the Board of Directors via the Audit Committee, and in monitoring the precautions to be adopted based on audit reports.
Internal Control and Risk Management Group
Operation of the Internal Control System
Internal control activities are organized so as to cover all activities of the Bank’s domestic and international branches and head office units under the Regulation on Banks’ Internal Systems issued by the BRSA, and are constantly revised in line with the requirements.
Control programs for branches are devised quarterly within the frame of the risk-focused approach to control. They take into consideration a number of criteria including branch scales, transaction volumes, risk exposures, changes in the amount of lendings and results of the previous control period, etc. These programs are enforced upon approval of our Committee. Controls are carried out on an average of 1,000 branches in every quarter within the scope of the program.
Findings contained in the reports resulting from the control activities conducted at branches and at head office units are categorized under certain headings, and the results produced are shared with the relevant units and the Senior Management for necessary action.
It has been an ongoing practice also in 2011 to make maximum use of technological innovations and centralizing the controls to the highest extent possible. This has been instrumental in alleviating the operational workloads of Internal Controllers assigned to the field, thus allowing them to conduct risk-focused control and concentrate their activities in this field.
Another continued practice in 2011 was the preliminary examinations conducted by on-site Internal Controllers regarding matters established during the control activities and deemed to require further examination. Necessary action to be taken by the Bank based on the preliminary examination reports so issued were put into life forthwith and transactions doubted to be subject to abuse were shared with the Board of Auditors for ensuring that necessary examinations/investigations are undertaken.
In addition to the above, compliance control activities are also carried out by internal control within the frame of Article 18 of the Regulation on the Banks’ Internal Systems. In this frame, all of the past and planned activities of the Bank, as well as new products and transactions are controlled in terms of their compliance with the Law and other applicable legislation, internal policies and guidelines, and established banking practices. Furthermore, legislation issued or modified by the Bank is also reviewed within the scope of compliance controls and resulting opinions are shared with the related units.
Besides control activities, recommendation reports continued to be issued, which are aimed at improving the processes related to the activities carried out at the Bank by Internal Controllers and at prevention of possible risks. The objectives of this implementation are to prevent risks by identifying them in advance, improving processes so as to achieve alignment with the competitive environment and customer satisfaction, and taking cost-saving measures.
Besides the activities mentioned above that can be considered as basic duties, Internal Controllers are encouraged to take on administrative duties; along this line, 37 Internal Controllers were transferred to administrative positions during 2011, thus continuing to supply qualified human resource to the Bank’s administrative personnel.
In brief, internal control activities are being carried out in harmony with the Bank’s primary targets and strategies with respect to scope and implemented method. However, a proactive structure has been adopted to ensure immediate alignment with the changed risk perception, strategy and conditions. This proactive structure contributed to the execution of the Bank’s activities at a level above the industrial norms and in alignment with internal and external regulations, as well as competitive conditions.
Operation of the Risk Management System
The Risk Management Department effectively carried out its activities with 22 risk analysts and assistant risk analysts in 2011. The fundamental approach to risk management activities carried out at the Bank is to achieve the best possible practices in risk management functions by inculcating a culture of risk-awareness throughout the Bank and by continuously improving both the system and the human resources. Maximum attention is given to ensuring that the risk management activities that take place are conducted with the coordinated participation of all units that are involved in every activity associated with each category of risk.
Risk management activities cover the main headings of credit risk, market risk, operational risk and balance sheet risks (structural interest rate risk and liquidity risk), and have the ultimate objective of achieving compliance with international best practices.
Under credit risk management activities, work is undertaken for measuring, analyzing, reporting and monitoring credit risk, employing methods that are in alignment with Basel II. In this context, the end-of-month credit risk is measured using the standardized method, and reported to the BRSA. Calculations which fell under Basel I requirements until 30 June 2012 and which relate to Basel II requirements that will come into force on 01 July 2012 are revised as necessary upon new announcements made from time to time by the BRSA. Efforts are ongoing at the Bank for measuring creditworthiness in connection with advanced measurement methods. In this frame, work is being carried out on the outcomes of scoring models used for different loan portfolios.
Under the operational risk management activities, operational risks are defined, classified and analyzed. Basic Indicator Approach is employed in calculating the amount at operational risk, and activities are underway in relation to Advanced Measurement Methods. Self-assessments are used to ensure that operational risks are identified on-site by competent personnel. Operational risk loss database in Finart environment allows tracking incidents of operational risk. An Operational Risk Map has been prepared for use in the Internal Control audit program for the purpose of establishing the risk levels of the Bank’s branches. In addition, risk exposure assessments are conducted for companies providing outsourced support services within the frame of the BRSA’s regulations in force.
Within the scope of market and balance sheet risk management activities, market, liquidity, and structural interest rate risks are measured, analyzed, limited, scenario analysis is conducted thereon, and they are stress-tested, reported and monitored.
Within the framework of risk management activities, global and national developments are also monitored via time-series, and projections are made on economic and financial indicators used in risk management, employing econometric models, while work is carried out on “Economic Capital” projections that cover basic risks, as part of the internal capital adequacy assessment process.
Results of the analyses made under risk management activities and risk indicators are reported in different levels of content to the Board of Directors and the Audit Committee at six-month intervals, and to executive units and internal system units at monthly, weekly and daily intervals.
The new operating period will see continued activities under all risk categories on the basis of internationally accepted advanced risk management techniques, as well as execution of these activities as an integral part of the Bank’s strategic decision-making processes.
 Halil ÇELİK Member of the Audit Committee |
 Oğuz KAYHAN Member of the Audit Committee |