The American Institute of Certified Public Accountants on Wednesday issued a series of questions that top managers and bank directors should be asking about their institution's derivatives activities. The questions - six main ones plus related issues - follow.
1. Has the board established a clear and internally consistent risk management policy, including risk limits (as appropriate)?
Are our objectives and goals for derivatives activities clearly stated and communicated? To what extent are our operational objectives for derivatives being achieved? Are derivatives used to mitigate risk or do they create additional risk? If risk is being assumed, are trading limits established? Is the entity's strategy for derivatives use designed to further its economic, regulators, industry, and/or operating objectives?
2. Are management's strategies and implementation policies consistent with the board's authorization?
Management's philosophy and operating style create an environment that influences the actions of treasury and other personnel involved in derivatives activities. The assignment of authority and responsibility for derivatives transactions sends an important message.
Is that message clear? Is compliance with these or related policies and procedures evaluated regularly? Does the treasury function view itself, or is it evaluated, as a profit center?
3. Do key controls exist to ensure that only authorized transactions take place and that unauthorized transactions are quickly detected and appropriate action is taken?
Internal controls over derivatives activities should be monitored on an ongoing basis, and should also be subject to separate evaluations. Who is evaluating controls over derivatives activities? Do they bring the appropriate technical expertise to bear?
Are deficiencies being identified and reported upstream? Are duties involving execution of derivatives transactions segregated from other duties (for example, the accounting and internal audit functions)?
4. Are the magnitude, complexity, and risks of the entity's derivatives commensurate with the entity's objectives?
What are the entity's risk exposures, including derivatives? Internal analyses should include quantitative and qualitative information about the entity's derivatives activities. Analyses should address the risks associated with derivatives, which include credit risk, market risk, and legal risk.
Are our derivatives transactions standard for their class or are they more complex? Is the complexity of derivatives transactions inconsistent with the risks being managed? The entity's risk assessment should result in a determination about how to manage identified risks of derivatives activities.
Has management anticipated how it will manage potential risks before assuming them?
5. Are personnel with authority to engage in and monitor derivative transactions well qualified and appropriately trained?
Who are the key derivatives players within the entity? Is the knowledge vested only in one individual or a small group? The complexity of derivatives activities should be accompanied by development of personnel.
For example, do employees involved in derivatives activities have the appropriate technical and professional expertise? Are other employees being appropriately educated before they become involved with derivatives transactions?
Does the entity have personnel that have been cross-trained in case of the absence or departure of key personnel involved with derivatives activities?
6. Do the right people have the right information to make decisions?
What information about derivatives activities are we identifying and capturing, and how is it being communicated? The information should address both external and internal events, activities, and conditions.
Are the analysis and internal reporting of risks the company is managing and the effectiveness of its strategies comprehensive, reliable, and well designed to facilitate oversight?
