Decision No. 37/2006/QD-NHNN on the issuance of the Regulation on internal audit of credit institutions

DECISION

ON THE ISSUANCE OF THE REGULATION ON INTERNAL AUDIT OF CREDIT INSTITUTIONS

THE GOVERNOR OF THE STATE BANK

- Pursuant to the Law on the State Bank of Vietnam issued in 1997; the Law on the amendment, supplement of several articles of the Law on the State Bank issued in 2003;

- Pursuant to the Law on Credit Institutions issued in 1997; the Law on the amendment, supplement of several articles of the Law on Credit Institutions issued in 2004;

- Pursuant to the Decree No.52/2003/ND-CP dated 19/5/2003 of the Government providing for the function, assignment, authority and organizational structure of the State Bank of Vietnam;
Upon the proposal of the Director of Banks and Non-bank Credit Institution Department,

DECIDES:

Article 1. To issue in conjunction with this Decision the “Regulation on internal audit of credit institutions”.

Article 2. This Decision shall be effective after 15 days since its publication on the Official Gazette and replace the Decision No.03/1998/QD-NHNN3 dated 03/01/1998 of the Governor of the State Bank on the issuance of the “Regulation on internal inspection, audit of credit institutions”.

Article 3. The Director of Administrative Department, Director of Banks and Non-bank Credit Institution Department, Heads of related units of the State Bank of Vietnam, General Manager of the State Bank branches in provinces, cities under the Central Government’s management and the Chairperson of the Board of Directors, General Director (Director) of credit institutions shall be responsible for the implementation of this Decision.

REGULATION

ON THE INTERNAL AUDIT OF CREDIT INSTITUTIONS
(Issued in conjunction with the Decision No. 37/2006/QD-NHNN dated 01 August 2006 of the Governor of the State Bank)

Chapter I

GENERAL PROVISIONS

Article 1. Governing scope and subjects of application

This Regulation stipulates the performance of internal audit at credit institutions which are established and operate in accordance with the Law on Credit Institutions (including branches of foreign banks operating in Vietnam).

Article 2. Interpretation

In this Regulation, following terms shall be construed as follows:

1. “Internal audit” is an act of independent, objective inspection, verification, assessment for the internal inspection, control system; independent assessment of the appropriateness and compliance with policies, procedures and process which are set up in the credit institutions, whereby the unit performing internal audit shall provides proposals, advices for the purpose of enhancing the operation effectiveness, efficiency of systems, processes, provisions, making contribution to the assurance of the prudential, efficient and lawful operation of credit institutions.

2. “Internal audit department” is a specialized and responsible unit which performs the internal audit of a credit institution;

3. “Small-scaled credit institutions” are credit institutions which have the total officers of less than 30 people.

4. “Manager” shall be the General Director (Director), Deputy General Director (Deputy Director), Head, Deputy Head of units, managing, professional operation departments of credit institutions.

Article 3. Objectives of internal audit

Major objectives and functions of internal audit include:

1. To independently valuate the appropriateness and compliance with policies, procedures, processes which are drawn up in the credit institution.

2. To inspect, verify, valuate the sufficiency, effectiveness and efficiency of the internal inspection, control system for the purpose of improving and completing the internal inspection, control system. With a view to performing this objective, units performing the internal audit are encouraged to perform consultant activity, participate in the process of building, improving and completing the internal inspection, control system, providing that principle of independence, objectiveness as stipulated in this Regulation is not violated.

Article 4. Basic principles of internal audit activity

1. Independence: the internal audit department shall operate independently compared with units, managing, professional operation departments of the credit institution; the internal audit activity shall be independent of activities of management, professional operation of the credit institution;

2. Objectiveness: the internal audit department, internal auditors must assure the objectiveness, truthfulness, fairness, non-prejudice when they perform the task of internal audit.

3. Speciality: internal auditors shall be those who have necessary knowledge, standard and skills of internal audit and do not concurrently undertake other posts and specialized works of the credit institution.

Article 5. Requirements for assuring the independence and objectiveness

1. Internal auditors must have fair, unprejudiced attitude and avoid any interest conflict. Each internal auditor shall have the right and obligation to make report to the Chief of internal auditor on all issues that may affect his independence and objectiveness prior to and during the performance of assigned internal audit work.

2. The Chief of internal auditor must thoroughly understand, follow up and ensure the independence and objectiveness of the internal auditors. In case where the independence or objectiveness is affected or likely to be affected, the Chief of internal auditor shall report to the Controllers Committee.

3. The credit institution must thoroughly grasp the implementation of the internal audit activity under the following principles, provisions in order to ensure the independence and objectiveness, prevent the lack of fairness, prejudice and interest conflicts:

a. To restrain maximally the participation by internal auditors in the audit of activities, departments that those very auditors were responsible for performing activities or managing those departments within 03 (three) years previously.

b. Internal auditor shall not be entitled to perform the audit for a process that he takes the major responsibility for the building up of the process thereof.

c. To assure that internal auditor has no interest conflict with the audited unit, department; the internal auditor shall not be permitted to perform the audit for the unit, department, of which the manager is a relative of the internal auditor. Relative of the internal auditor in this case shall be construed as father (mother), father (mother) in law, foster father (mother), spouse, children, adoptive children, siblings of that auditor and their spouse.

d. To rotate internal auditors, one internal auditor shall not be permitted to perform the audit for a specific unit, department within many consecutive years.

dd. It is required to take measures of inspection in order to ensure the independence and objectiveness of the internal audit work right during the implementation of the internal audit work at the units, departments to be audited and during the period of preparation and submission of auditing report;

e. Auditing comments in the report on internal audit shall be carefully analyzed basing on collected data, information for ensuring the objectiveness;

f. Results of the duty performance of the Chief of Internal Auditor must be regularly inspected, verified and valuated by the Controllers Committee.

Article 6. Performance method of the internal audit activity

1. Performance method of the internal audit is “risk-oriented” auditing method, priority shall be given to resources concentration for auditing units, departments, processes which are considered as highly risky.

2. Internal auditor must define, analyse, valuate risks and draw up a risk file for each activity of the credit institution. The risk file includes the entire of the potential risks, possible effects of those risks on the operation of the credit institution and possibility of the occurrence of those risks. Basing on the valuation of the effect, possibility of the risk occurrence; each risk shall be classified into high, or medium or low risks. The valuation, classification of risks must be performed at least once a year.

3. The result of risk valuation shall be the basis so as the Chief of internal auditor can work with the Controllers Committee, the General Director and the Board of Directors during the process of preparing the annual internal audit plan. All the risks shall be graded under descending order, activities which are considered as highly risky shall be given the priority to concentrate more resources, more time on the auditing, priority to perform the auditing first and more regular than those with low risk exposures.

4. The internal audit plan must be drawn up basing on the risk valuation results and must be updated, changed, adjusted in line with the development, changes in the operation of the credit institution and changes of accompanied risks.

Chapter II

SPECIFIC PROVISIONS

Section 1. ORGANIZATION, OPERATION OF INTERNAL AUDIT DEPARTMENT

Article 7. Internal audit apparatus

1. The internal audit department of the credit institution is organized in a uniform system under the vertical industry, shall directly belong to and be subject to the direct instruction of the Controllers Committee.

2. Basing on the scale, set level and characteristics of the credit institution’s operation and upon the proposal of the Controllers Committee, the Board of Directors shall make decision on the organization of the internal audit apparatus, the regime on salary, bonus, responsibility allowances applicable to persons engaging in the internal audit work.

3. The credit institution shall be entitled to outsource specialists, organizations which have full capability, professional level to perform a part of the internal audit work for the activities the internal audit department is not yet qualified for performing the audit providing that the compliance with the principles, provisions in this Regulation shall be ensured.

4. The internal audit activity of local People’s Credit Funds, branches of foreign banks, small scaled credit institutions may be undertaken by the internal audit department of the head office or local office (in respect of foreign bank branches), or by external organizations, independent auditing organizations providing that the compliance with the principles, provisions in this Regulation must be ensured.

Article 8. Standards for persons engaging in the internal audit work

1. Internal auditors must fully satisfy the following standards:

a. Having honest character, consciousness of compliance with applicable laws and ability of objective recognition

b. Having general knowledge, understanding about the laws, business administration and banking operations;

c. Having bachelor degree in appropriate speciality, having adequate knowledge and regularly being updated with areas they are assigned to perform internal audit;

d. Being capable of collecting, analyzing, assessing and synthesizing information;

dd. Having the knowledge, skills of the internal audit

e. Other standards provided for by the credit institution

2. Besides above mentioned conditions and standards, the Chief of Internal auditor and the Deputy Chief of Internal auditor must, at least, have bachelor degree in banking or economic or financial major and have worked in banking area for at least 3 years.

Article 9. Appointment, dismissal of titles of internal auditor

1. The head of the internal audit apparatus of a credit institution (hereinafter referred to as the Chief of Internal Auditor) shall be appointed, dismissed by the Board of Directors of the credit institution upon the request of the Head of the Controllers Committee; or by a competent person of the parent bank for foreign bank branches.

2. The Deputy Chief of Internal Auditor and other titles of the internal audit shall be appointed, dismissed, upon the request of the Chief of Internal Auditor, by the Board of Directors; or by the General Manager (Manager) of foreign bank branches.

Article 10. Scope of internal audit activity

1. Scope of internal audit activity includes:

a. Auditing all activities, professional processes and units, departments of the credit institution;

b. Performing special audit and providing advices upon the request of the Board of Directors, Controllers Committee;

2. The internal auditors should ensure the independence, objectiveness when performing the audit for activities, processes, departments they provided advices before. In this case, the leaders of the units, departments to be audited shall take full responsibility for the activities, processes and departments the internal auditors provided advices before. The internal auditors shall have the right and obligation to analyze and assess fully the procedures, processes, system of internal inspection, control which were set up by the leaders of audited units, departments regardless of the fact that the internal auditors provided the leaders of these units, departments with advices.

Article 11. Operation contents of the internal audit activity

Main contents of the internal audit activity shall be to inspect, assess the adequacy, effectiveness and efficiency of the internal inspection, control system. Depending on the scale, level of risks as well as specific requirements of each credit institution, the internal auditors may check, assess the following contents:

1. The level of adequacy, the effectiveness and efficiency of the internal inspection, control system

2. The application, the effectiveness and efficiency of identification processes, measuring method and method of risk management, capital valuation

3. Management information system and financial information system including electronic information system and electronic banking service

4. The adequacy, timeliness, honesty and the accuracy of the accounting system and financial statements

5. The regime on the assurance of the compliance with provisions of applicable laws, provisions on prudential ratios in the credit institution’s activities, internal provisions, professional operation processes, rules, professional virtue rules

6. Regime, provisions, processes on management, administration, professional operation of the credit institution

7. Measures for ensuring the assets’ security

8. Assessing the economicalness and efficiency of the activities, the economicalness of the use of resources, by which the appropriateness level between achieved operation results and proposed operation objectives shall be determined.

9. Performing other contents relating to the function, assignment of the internal auditors upon request of the Controllers Committee, the Board of Directors.

Section 2. ASSIGNMENT, AUTHORITY AND RESPONSIBILITY OF THE INTERNAL AUDIT DEPARTMENT

Article 12. Assignments of the Internal Audit Department

1. To draw up the annual internal audit plan and perform internal audit activities in accordance with the plan, approved policies, process and procedures on internal audit, assuring the quality and efficiency.

2. To perform independent, objective inspection, verification, valuation for all units, departments, activities of the credit institution (regime, policy, procedure, process or matters in the operation) basing on the risk level (high, low or medium) and the effect levels on the credit institution’s operation. In respect of any matter that may cause bad effect to the credit institution’s operation, the internal auditor should make timely report on the nature and its effect to the credit institution’s operation and suggest practical recommendations to prevent and overcome these matters.

3. To suggest measures for correcting and overcoming errors; suggest the settlement of violations; recommend measures for completing, enhancing the effectiveness, efficiency of the internal inspection, control system

4. To valuate the correspondence of activities in order to prevent, overcome already reported weak points; activities for the purpose of completing the internal inspection, control system and follow up them till these issues are satisfactorily settled

5. To draw auditing report; inform and submit timely results of internal audit to concerned parties inside and outside the credit institution in accordance with policies, processes, provisions of the credit institution and applicable laws.

6. To continuously develop, correct, supplement, complete the method of internal audit and operation scope of the internal audit activity in order to be able to update, catch up with the development of banking activity

7. To comply with the process of ensuring quality of the internal audit work

8. To set up a file of ability level and requirements necessary for the internal auditor to make basis for recruitment, promotion, transfer of officers and fostering professional knowledge; To work out a plan and organize the training continuously in order to improve and ensure the professional ability of the internal auditors.

9. To maintain the regular consultancy, discussion with the independent auditing organization, the State Bank Inspectorate in order to ensure the efficient cooperation; to be a unit that regulates, coordinates with external agencies for works relating to the function, assignment of the internal auditors.

10. To provide advice to the Managers, the Board of Directors of the credit institution and operational departments to carry out projects on setting up, new application or amendment of important operational processes; managing, administration regime; process of risk identification, measuring and assessment, risk management, method of capital valuation; the accounting, information system; to perform new operations, products providing that the independence of the internal audit activity is not affected.

Article 13. Authorities of the Internal Audit Department

1. To be fully equipped with necessary resources (human resource, financial resource and other equipment)

2. To be entitled to take the initiative in performing their assignment under the approved auditing plan

3. To be fully, timely supplied with all information, documents, files which are necessary for the internal audit activity.

4. To be entitled to approach, study all operational processes, assets in the performance of audit activity.

5. To be entitled to approach, interview all officers, staff of the credit institution for issues relating to the audited contents.

6. To be entitled to attend and receive all meeting minutes of the Management Board relating to the internal audit activity.

7. To be entitled to supervise, evaluate and follow up the correction, overcoming, completion by the leaders of units, departments in respect of issues which are acknowledged and recommended by the internal auditors

Article 14. Responsibilities of the internal audit department

1. To keep secret of the information, documents in accordance with provisions of current laws, provisions of this Regulation, of the Charter and of the Internal Regulation on internal audit of the credit institution.

2. To take responsibility to the Controllers Committee, the Board of Directors for the result of the internal audit activity; for the assessments, conclusions, petitions, proposals in the internal auditing report.

3. To follow up the performance results of petitions after the internal audit of units, departments of the credit institution.

Section III. POLICY AND PROCESS ON THE INTERNAL AUDIT

Article 15. Policy and process on the internal audit

1. Internal audit policy shall be an official basis, foundation and guidance for the internal audit activity and for each internal auditor. The internal audit policy shall include an Internal Regulation on internal audit, a collection of professional virtue rules, internal provisions on the organization and operation of internal audit, internal audit process and related provisions.

2. The internal regulation on internal audit should generalize the guideline, purpose, scope of operation, position, authority, function, assignment of the internal auditors in a credit institution and relationship with other units, departments; of which there are requirements of the independence, objectiveness, fundamental principles, requirements of the professional level and quality assurance of the internal audit activity. The internal regulation on internal audit of the credit institution shall be established on the basis of the conformity with provisions of this Regulation and related provisions of current laws.

3. The process on internal audit shall stipulate processes and provide detailed guidance on the method of risk evaluation, preparation of an annual internal audit plan, plan for each audit session, mode of the audit performance, preparation and submission of an auditing report, archive of internal audit files, materials. The Regulation on internal audit may be provided for in the Internal Regulation on internal audit.

4. Basing on the provisions in this Regulation, credit institutions shall draw up a specific policy and process on internal audit in line with specific operation characteristics of each credit institution. Credit institutions shall be encouraged to apply international rules on internal audit providing that they are not in contrary to provisions of this Regulation.

Article 16. Rules on professional virtue

1. The credit institution must prepare a set of rules on professional virtue and ensure the maintenance of those rules in order to develop culture of professional virtue within the entire credit institution in general, and in the implementation of the internal audit work in particular. All internal auditors shall ensure the right compliance with the rules on professional virtue during the implementation of the internal audit and consultancy work.

2. The internal auditors must implement and maintain at least the following rules on professional virtue:

a. Truthful: The internal auditors shall carry out their work truthfully, carefully and responsibly; comply with the laws and perform all work contents publicly in accordance with provisions of applicable laws and of profession; shall not deliberately involve in any illegal activity, or take part in activities that may result in the loss of prestige for the internal audit profession or for the credit institution; shall always respect and strive to make efficient contribution to proper and lawful objectives of the credit institution.

b. Objective: The internal auditors must show their professional objectiveness at the highest level during the collection, assessment and communication of information about activities or processes, systems that have been or are being audited. The internal auditors should provide their fair assessment for all related issues and not be affected by private objectives, interests or by any person when providing their comment, assessment.

c. Confidential: The internal auditors should respect the value and the ownership of received information, shall not be permitted to disclose the information without the valid authorization unless they are obliged to disclose the information in accordance with provisions of applicable laws and internal provisions of the credit institution.

d. Responsible: The internal auditors must always take full responsibility, strive to learn, apply gained knowledge, skills and experiences for performing the internal audit in the most efficient manner.

3. The Chief of the Internal Auditor shall take measures for following up, assessment, management in order to ensure the compliance with the rules on professional virtue by internal auditors.

Article 17. Annual internal audit plan

1. Basing on the scale, the growth rate, risk level of activities and current resources (human, financial resource, ect), the Chief of Internal Auditor shall draw up an annual internal audit plan.

2. The annual internal audit plan of a credit institution must satisfy following requirements:

a- Risk based orientation: operations and units, managing and professional operation departments with high risk level must be audited at least once a year;

b- Ensuring the all-sided nature: all operational processes, units, managing, professional operation departments of the credit institution shall be audited; processes, units, departments that have been evaluated as having the lowest risk exposure shall be audited on the basis of every five (05) years at the minimum.

c- Credit institution must set up a provisional time fund which is enough for the performance of unexpected audit sessions upon request of the Controllers Committee, or upon availability of information about the signal of violation, signal of high risk of audited subjects.

d- The adjustment may be made where there is a basic change in the operation scale, risk development or current resources.

3. The internal audit plan for the following year must be submitted to the Board of Directors, Controllers Committee, General Director (Director) of the credit institution before 31 December annually; Before 31 December, Controllers Committee of the credit institution must send this audit plan to the State Bank (the State Bank Inspectorate, Banks Departments).

Article 18. Approving policy, process and annual plan on internal audit

1. Internal audit policy, including the Internal Regulation on internal audit shall be discussed with the General Director (Director), Controllers Committee, then shall be approved and signed for issuance by the Chairperson of the Board of Directors of the credit institution.

2. After being approved, the internal audit policy shall be sent to the State Bank (Banks Department) for its knowledge and following up. The State Bank shall have the right to make suggestions or require the amendment of the contents of this policy if it has not satisfied yet the provisions of this Regulation.

3. Process on internal audit (in the event where it is issued separately, is not included in the Internal Regulation on internal audit), the internal audit plan shall be discussed by and between the Controllers Committee and the General Director (Director) and approved by the Chief of Internal Auditors after reporting to the Chairperson of the Board of Directors.

Article 19. Implementing the annual internal audit plan

The Chief of Internal Auditor shall organize the implementation of the annual internal audit plan and special unexpected audit sessions upon the request of the Controllers Committee. Scope, cycle and method of auditing, auditing process must assure that the auditing result truly reflects the actual situation of the audited contents.

Section 4. REGIME ON THE REPORTING AND ARCHIVE OF INTERNAL AUDIT FILES, DOCUMENTS

Article 20. Auditing report

1. The internal audit department of the credit institution must timely draw up, complete and send an auditing report to the Board of Directors, Controllers Committee, General Director (Director) and audited units, departments within a period of one month at the maximum since the ending of each auditing session.

2. The auditing report must clearly state auditing contents, scope of auditing; assessments, conclusions of the audited contents and foundation of the opinions thereof; shortcomings, remains, error, violation, explanations of the subjects of auditing; proposing methods of error correction, overcoming and violation settlement; proposing methods of rationalizing, improving the operational process; completing the risk management mechanism, organizational structure of the credit institution (if any).

3. Auditing report should have the opinion of the leadership of the audited unit, department. In the event where the audited unit does not agree with the auditing result, the internal auditing report, the unit should state clearly its disagreement and the reason thereof.

Article 21. Unexpected report

The Chief of Internal Auditor shall make unexpected report in accordance with following provisions:

1. Making immediate report to the Controllers Committee, Board of Directors, General Director (Director) if any serious violation is detected or where any high risk exposure that may cause bad effect to the operation of the credit institution is realized.

2. Timely informing the Manager of the unit of which the activity is audited if the remains stated in the auditing report are not timely corrected and overcome after an appropriate period of time.

3. After having informed the Manager of the unit of which the activity is audited in accordance with Paragraph 2 in this Article, if the remains thereof have not been corrected and overcome, they must be timely reported in writing to the Controllers Committee, the Board of Directors and General Director (Director) of the credit institution.

Article 22. Annual auditing report

1. After 30 days at the latest since the ending of the fiscal year, the Chief of the internal auditor shall send a general report on the performance result of the internal audit plan in the previous year to the Controllers Committee, the Board of Directors, the General Director (Director). The general report on the performance result of the internal audit plan of the previous year must state clearly: the proposed audit plan; the already performed audit activities; serious shortcomings, violations that have been detected; methods proposed by the internal auditors for the correction and overcoming of the shortcomings, violations; assessment of the internal inspection, control system relating to audited activities and proposals for the perfection of the internal inspection, control system; the performance of methods, petition, proposals of the internal auditors.

2. After 60 days at the latest since the ending of the fiscal year, the Controllers Committee of the credit institution shall send a general report on the performance result of the internal audit plan of the previous year with contents as provided for in Paragraph 1 of this Article to the State Bank of Vietnam (the State Bank’s Inspectorate, Banks Department).

Article 23. Archiving internal audit files, documents

1. Auditing reports and auditing files, documents must be archived at the internal audit department in accordance with provisions of applicable laws.

2. Files, documents in each auditing session must be recorded as written documents, archived by order so that individuals, organizations that are competent to exploit (who have professional standard and knowledge of banking activity) can understand the auditing work, the performance result of the auditing session

Section 5. ASSURING THE QUALITY OF THE INTERNAL AUDIT ACTIVITY

Article 24. Process on assuring the quality of the internal audit activity

A credit institution must have a process on following up and evaluating the quality of the internal audit activity. This process shall include the internal assessment and independent assessment, specifically as follows:

1. Internal assessment means the self-reassessment of the internal audit activities at the end of an audit event, and the self-reassessment on annual basis of the entire internal audit activity performed by the internal audit department for the purpose of assuring the quality of the internal auditing activity. Result of the annual internal assessment must be reported to the Controllers Committee and acknowledged in the Annual Internal Auditing Report.

2. Independent assessment means the annual assessment of the quality of the internal audit activity performed by an independent auditing organization. Result of the independent assessment of the internal auditing quality shall be acknowledged by the independent auditing organization in the Annual report of the credit institution.

Section 6. RESPONSIBILITY OF THE CREDIT INSTITUTION

Article 25. Responsibility of the Board of Directors

1. To check, approve the policy, method of internal audit; to ratify process, plan on internal audit. Pursuant to provisions of applicable laws and this Regulation to issue an internal Regulation on internal audit of their unit, which must provide for target, duty, position, authority, responsibility, reporting regime, relationship with other departments of the credit institution, responsibility and authority of the Chief of Internal auditor; basic principles, requirements of internal audit activity and of the report on internal audit.

2. To make decision on the apparatus organization of the internal audit department; to appoint, dismiss the Chief of Internal Auditors upon the proposal of the Controllers Committee.

3. To equip sufficient resources (human resource, financial resource and other facilities) and facilitate the Internal audit department to complete assignments as provided for in this Regulation.

3. To make decision on the implementation of the petitions of internal auditors. To speed up, follow up professional units in the implementation of petitions of internal auditors, to timely take treatment measures upon the receipt of reports provided for in Article 20, Article 22 of this Regulation or upon proposal, suggestion of the Chief of Controllers Committee, Chief of internal auditor.

4. To make decision on financial regime, mechanism on salary, bonus, allowances for the internal audit department and officers of this department in accordance with the competence.

Article 26. Responsibility of the Controllers Committee

1. Controllers Committee of the credit institution shall be responsible for the direct guidance, management, supervision over activities of the Internal audit department;

2. To check, inspect, evaluate to ensure the efficiency of the internal audit activity; take major responsibility for ensuring the quality of the internal audit activity;

3. To ensure that the internal audit activity has an appropriate position in the credit institution and there are not any unreasonable obstacles for the internal audit activity.

4. To draw up, amend, supplement and regularly perfect the internal audit method, policy, to submit to the Board of Directors for decision.

5. To approve the internal audit process; to approve, adjust the annual internal audit plan upon the proposal of the Chief of Internal auditor, ensure that the internal audit plan is oriented according to the risk.

6. To ensure an efficient coordination with independent auditors and the State Bank Inspectorate

7. To consider, propose the Board of Directors on the appointment, dismissal of the Chief of internal auditor.

8. To carry out the direct reporting to all agencies, all levels inside and outside the credit institution in accordance with provisions of applicable laws and provisions of the credit institution; To send reports to the State Bank in accordance with provisions of this Regulation.

Article 27. Responsibility of the Chief of Internal Auditor

1. To draw up the annual internal audit plan to submit to the Controllers Committee for approval.

2. To organize the implementation of the internal audit plan approved by the Controllers Committee and unexpected audit events assigned by the Controllers Committee.

3. To draw up, amend, supplement and perfect on a regular basis the method, policy, process on internal audit for the submission to the Controllers Committee.

4. To ensure that officers of the Internal audit Department are trained regularly, have sufficient standard, professional capacity to perform the duty of internal audit.

5. To submit the Controllers Committee for approval, adjustment of the plan on internal audit.

6. To request to gather personnel from other departments of the credit institution to participate in internal audit event when necessary, providing that the independence of the internal audit activity is ensured.

7. To attend meetings of the Management Board in accordance with internal provisions of the credit institution and provisions of this Regulation.

8. To report the Controllers Committee, the Board of Directors, the General Director (Director) when weakness, shortcomings, violations of the inspection, control system and of the Manager are detected.

9. To follow up the implementation of petitions after auditing; to draw up and send reports n accordance with provisions in this Regulation;

Article 28. Responsibility of the General Director (Director)

1. To facilitate the Internal Audit Department to perform the assigned duty and conduct units, managing, professional operating departments to coordinate with the Internal audit Department in accordance with provisions of the Internal Regulation on internal audit or upon the direction of the Board of Directors.

2. To speed up units, managing, professional operating departments to perform the proposals agreed with the Internal audit Department or upon the direction of the Board of Directors.

3. To timely give a notice to the Internal audit Department of any case of considerable losses or fraud, or cases which are likely to occur risk, losses, fraud.

4. To ensure that the Internal audit Department is fully informed of changes, newly arisen issues in the activity of the credit institution, new initiative, products for early definition of all related risks.

Article 29. Responsibility of units, managing, professional operation departments

1. To supply any necessary information, documents, files for the work of internal auditors upon request of the Internal audit Division;

2. To report immediately the Internal audit Department when detecting weakness, shortcomings, violations, risks or major losses of assets (or risk of asset losses), or where there is any change in the internal inspection, control system at their units;

3. To implement proposals already agreed with the Internal audit Department and/or in accordance with the direction of the Board of Directors.

Section 7. RESPONSIBILITIES OF UNITS OF THE STATE BANK

Article 30. Responsibility of the State Bank Inspectorate

1. To perform the inspection, supervision over the compliance with provisions on internal audit by credit institutions in accordance with provisions of this Regulation.

2. Annually, to evaluate the efficiency of the internal audit activity of credit institutions, to intensify the advice, coordination with the Internal audit Department of credit institutions for the purpose of improving the efficiency of the internal audit activity, and inspection, supervision activity of credit institutions.

3. To deal with within the competence or propose to the Governor of the State Bank to deal with cases violating the provisions of this Regulation and related provisions of current laws.

Article 31. Responsibility of the Banks and Non-bank Credit Institutions Department

1. To study, submit to the Governor of the State Bank for the consideration, amendment, and supplement of the provisions on internal audit of credit institutions in this Regulation.

2. To provide guidance to credit institutions, branches of the State Bank in provinces, cities under the central Government’s management in the implementation of this Regulation.

Chapter III

IMPLEMENTING PROVISIONS

Article 32. Within the period of six (06) days since the effectiveness of this Regulation, credit institutions must establish an Internal audit Department; draw up, issue and send the Internal Regulation on internal audit to the State Bank of Vietnam (the State Bank’s Inspectorate, Banks Department, State Bank branches where joint stock credit institutions locate their head offices (except for local People’s credit funds, they shall only send to the State Bank branches in province, cities) for registration and serving the inspection, supervision activity.

Article 33. Any organization, which, individual, who violates provisions in this Regulation, depending on the nature and seriousness of the violation, shall be subject to administrative punishment in monetary area and banking activity or prosecuted for criminal liability, and subject to the compensation for any damage caused by them in accordance with provisions of applicable laws.