Reporting institutions must also draw up, under the same conditions, a procedure manual which specifies the means intended to ensure the proper functioning of internal control, in particular:

• Different levels of responsibility.
• The responsibilities and resources allocated to the operation of the internal control system.
• The rules, which ensure the independence of these systems under the conditions, set out in article 22 of the 2016 COBAC regulation relative to internal control.
• The procedures relating to the security of information and communication systems and business continuity plans.
• A description of the systems for measuring, limiting, monitoring and controlling risks.
• The organization of the compliance control system.

The organization of the compliance system meets the following conditions:

• The compliance control department is independent of the operational business units and reports directly to the executive body,
• It is responsible for coordinating compliance risk management within the group,
• To avoid any potential conflict of interest, the compliance officer must not hold any other position within the group.
• Certain tasks relating to the responsibilities of the compliance officer may be delegated to departments. In this case, the compliance officer assumes a coordinating role between the entities responsible for carrying out the tasks arising from his responsibilities.
• The persons in charge of compliance must have a high level of competence in the field of banking and financial activities and an in-depth knowledge of the rules and standards in force.

The permanent control system must ensure that;

• The specific risk analysis has been carried out rigorously;
• That the procedures for measuring, setting limits on and controlling the risks incurred are adequate;
• That, where necessary, the procedures in place have been adapted;
• That risk monitoring is in place, together with sufficient resources for its implementation.

Ongoing control of the compliance, security and validation of the transactions carried out and compliance with the other due diligence procedures associated with the tasks of the risk management function is ensured, using a range of appropriate resources, by:

• Some staff, in central and local departments, dedicated exclusively to this function,
• Other staff carrying out operational activities.

Reporting institutions must ensure that any service that plays a substantial part in the decision to enter into a transaction with the institution’s customers is outsourced only to persons approved or authorized to carry out such activities in accordance with the required standards.

Decisions binding the establishment with regard to customers referred to in the previous paragraph are those relating to:

• All banking operations with their related operations.
• Services involved in the performance of these operations.
• Operations for which a failure could undermine the conditions for exercising the authorization granted by the monetary authority, after receiving the assent of the Central African Banking Commission, or compliance with legal and regulatory provisions.

Reporting entities that outsource activities must:

• Ensure that their internal control system includes their outsourced activities,
• Set up control systems for their outsourced activities.

The outsourcing of activities must not have the effect of reducing or limiting the responsibilities of the executive body, internal audit, the entities and individuals in charge of permanent control, risk management and compliance.

Taxable establishments, which outsource a service to their business, must retain full control of the said activity. In particular, they must comply with the following requirements:

1. The outsourcing of activities must:
2. Give rise to a written contract between the external service provider and the reporting entity.
3. Form part of a formal policy for controlling external service providers, defined by the reporting entity.
4. In their relations with external service providers, reporting institutions must ensure that the latter:
5. Are committed to a level of quality that meets normal service operation and, in the event of an incident, leads to recourse to back-up mechanisms.
6. Implement back-up mechanisms in the event of serious difficulties affecting the continuity of the service or that their own continuity plan takes account of the fact that the external service provider is unable to provide the service.
7. May not impose a substantial change to the service they provide without the prior agreement of the establishment concerned.
8. Comply with the procedures defined by the reporting entity concerning the organization and implementation of the control of the services they provide etc.
9. All data of the reporting institution must be available on the territory of the state of its head office in the CEMAC, notwithstanding any other arrangements made by the institution as part of its contingency and business continuity plans. To this end, the following must be kept and be permanently accessible in the territory of the state in which the establishment has its head office in CEMAC:
10. The computer servers containing all the establishment’s data.
11. All physical files relating to staff, assets, banking and related operations and all other transactions carried out by the reporting institution.
12. All procedures, archives and miscellaneous documents.

The risk committee assists the Board of Directors in overseeing risk management within the group. The committee’s duties include;

• Advise the board on the definition of a risk management policy.
• Propose limits for each type of risk and periodically ensure that the executive body complies with these limits.
• Periodically assessing the quality of the system for measuring, controlling and monitoring risks at the level of the institution or the group.
• Ensuring that the information systems are appropriate for the nature of the institution’s business.
• Ensuring that human and material resources are allocated to the risk management function and guaranteeing its independence.

Reporting institutions are required to draw up an internal audit charter which defines in particular:

• The position, powers and objectives of the internal audit function.
• The responsibilities of this function and the nature of its work.
• The procedures for communicating the results of its audit assignments.
• This charter is communicated to the general secretariat of the banking commission.

To this end, at least once a year, it examines the activities and results of the internal control system on the basis of information sent to it by the executive body in the form provided for in these regulations.

The deliberative body is responsible for;

• Defining and reviewing at least once a year all the business strategies and significant policies of the reporting entity,
  
  
• Understanding the main risks incurred by the reporting entity,
  
  
• Approve the overall risk management policy and the strategic guidelines for managing each individual risk,
  
  
• Set limits for these risks and ensure that the entity takes the necessary measures to identify, measure, monitor and control these risks with a view to mitigating or controlling them etc.

As part of the internal control system, the deliberative body’s duties include;

• Supervise the implementation of the internal control system,
  
  
• Approving the internal audit charter referred to in these regulations and the audit programme, after obtaining the opinion of the audit committee,
  
  
• Ensuring that the activities of the reporting entity are fully covered by internal controls and external audits,
  
  
• Ensure that the internal control system is appropriate for the activities of the reporting entity etc.

• Implementing the strategies and policies approved by the governing body,
  
  
• Implementing appropriate internal control policies,
  
  
• Develop processes for identifying, measuring, monitoring and controlling the risks incurred by the reporting institution,
  
  
• Maintain an organizational structure that clearly assigns reporting relationships, authority and responsibility etc.

The design and implementation of the internal control system are the responsibility of the executive body, which, to this end;

• Establishes the structure of the internal control system,
  
  
• Provides the human and material resources needed to implement the internal control system,
  
  
• Identifies all sources of internal and external risk, etc.

The executive body draws up an internal control charter, which specifies in particular;

• The constituent elements of each system and the means of implementing them (procedures, internal control tools…..),
  
  
• The rules that ensure the independence of the control systems from the operating units,
  
  
• The different levels of responsibility for control.

The audit committee assists the decision-making body in overseeing the internal control system. It reports regularly to the board on the performance of its duties and informs it without delay of any difficulties encountered.

In particular, the audit committee must ensure that;

• The reliability and clarity of the financial information prepared by the executive body and the external auditors, and an assessment of the relevance and consistency of the accounting methods used to prepare the financial statements,
  
  
• The quality and effectiveness of the internal control systems, in particular the consistency of the systems for measuring, monitoring and controlling risks, and to propose any additional action required in this respect,
  
  
• Monitoring the statutory audit of the annual financial statements and, where applicable, the consolidated financial statements by the statutory auditors etc.

However, the existence of an audit committee does not relieve the deliberative body of its responsibilities as defined in the regulation.

The audit committee must analyze the main areas of risk or uncertainty in the annual or consolidated financial statements (including the half-yearly financial statements) identified by the statutory auditors, and assess their audit approach and any difficulties encountered in the performance of their assignment.

In this respect, the statutory auditors inform the audit committee;

• Their general programme of work and the various tests they have carried out,
  
  
• Any changes which they consider should be made to the accounts to be approved or to the other compatible documents, making any useful observations on the valuation methods used to draw them up,
  
  
• Any irregularities or inaccuracies they may have discovered,
  
  
• The conclusions reached on the basis of the above observations and corrections.

The appointment of directors and the renewal of their terms of office are subject to the prior information of the banking commission within the timeframe set by article 12 of regulation 04/08/CEMAC/UMAC/COBAC relating to corporate governance in CEMAC credit institutions.

The Banking commission assesses the profile and good repute of the directors appointed and ensures that they are able to perform their duties properly.

In particular, it verifies that the appointed directors;

• Have skills required to understand the operations of the reporting institution,
  
  
• Can demonstrate sufficient integrity in the performance of their duties,
  
  
• Are not subject to any of the prohibitions and incompatibilities provided for by the regulations in force.

NOTIFICATION OF INFORMATION TO THE BANKING COMMISSION

• Expiration of the office of directors and auditors,
  
  
• List of shareholders,
  
  
• List of managers,
  
  
• Financial situation of shareholders holding at least 5% of the voting rights.