Total Number of Subscribers: 1626   

  Date:1^st June 2010

 Compiled by: M Sathya Kumar  

Audit of Data and System Migration in a Bank

Introduction :

Rahul David had recently taken over as the GM — Central Audit and Inspection at Bombay Bank. He had come in at a time when the Bank had implemented a Core Banking Solution and was on the verge of a roll-out. Selected branches had been taken for changeover and the process was under test. In the given circumstances, the GM — IT had requested for a ‘system migration’ audit of select branches as a pilot project.

Rahul had a review of the requirement with his team and considered the competencies within the department. His team consisted of CISAs, IT-experienced auditors and enthusiastic young officers.

A team combining an AGM, a CISA-qualified officer and an IT experienced auditor was formed. This team was given the task to undertake the ‘system migration’ audit.

Methodology :

The team first established the scope and audit methodology of the audit considering the importance of the branch’s activity. This included the following :

Gist of observations :

Term deposits checked for maturity value :

Difference in maturity value of term deposits as per account customer inquiry and deposits masters interest principal charts. 6 accounts out of 160 accounts sampled. Short maturity value reflected by CBS.

Head :

Deposits attributed the differences to tax deduction from the maturity value as reflected in CBS. However, as per the module, both the Gross (Org. Maturity Value) and Net (Curr. Maturity Value) are not matching with the Master Charts.

Term deposits :

Monthly, quarterly, half-yearly and maturity interest — Application and accrual verified. Inconsistent interest credited under ATS schemes for March and April 2005 as against interest for May 2005 onwards. 3 accounts out of 160 accounts sampled.

Head :

Deposits mentioned that interest for the earlier period of March-June 2005 had been incorrectly applied by the system, but recovered/repaid by the DIT subsequently. However, in some cases which were purely representative, recoveries/repayments were not seen in the accounts.

Interest verification on Cash Credit Accounts, Overdraft Accounts and Term loans :

Excess interest charged by the system as against the audit calculation by Rs.0.48 lacs approx. on loans and advances — that is — 14 accounts out of 60 accounts checked that is — over 20% of the accounts checked.

Stock interest levied on Cash Credit Accounts, even though Stock statements submitted in time. 4 accounts out of 10 accounts sampled.

Interest on interest charged on loan schemes for balance on 31st October 2005.

Penal interest levied on staff loan accounts — which are not to be levied.

System charging 100% commission in case of guarantees secured by 100% cash margin/term deposit including third party deposits of Bombay Bank, instead of 15% of normal commission.

These instances will need to be reviewed by DIT. Action plans for remediation and future learning will need to be laid down after identification of the source for differences. Accordingly, rectifications will have to be undertaken at the branch or DIT Level.

The branch is not generating the monthly/quarterly MIS reports from CBS :

Additional man-days (2 days) are being invested in manual preparation of these MIS reports. We were informed that the branch personnel have not been trained in generation and use of the standard CBS reports from DIT.

Validation is being correctly performed for closed, frozen and dormant accounts :

Entries cannot be passed in closed and frozen accounts. Alert message is flashed across the screen. In case of dormant accounts, the system does allow entries to be made, but a message is flashed across the screen prior to the entry being entered for verification.

Verification of stop-payment cheques can be done with higher level passwords only :

Branch officials were not aware of the command option for printing of stop-payment instruction acknowledgments.

Control-related issues at branch :

Sanctity of password and secrecy, verification of audit trails and exceptional transactions at day end. Based on our physical observation and inquiry, we observed that the Branch Accountant User ID and password are being used by Process Owners (Deposits Section) to validate high-level changes and entries. The Branch Accountant explained to us that this is on account of the volume of branch business. To facilitate online banking business and timely day end, this practice is being resorted to. The Deposits section is housed in a separate building. Given the practicality of the situation, the Branch Accountant lends his ID to the Deposits Section, but changes the password frequently. Significant and crucial interest and limit changes can be carried out unanimously by the Loans Officer, without the same being tracked and monitored.

Audit trails are not being generated and checked by the System Administrator. The branch officials are aware of the command option for generation of audit trails, but are not generating the same.Limit level changes in Loan limits and rates of interest are not reflected in any Parameter Change Report at the end of the day. As informed, this option is not available in any of the day end reports. Limit, rate changes are communicated through a standard letter format to the client, but there is no transaction log generated of such changes, mentioning the maker and checker, with time, date seal.

Penal interest discrepancies on housing loans :

Interest is not being charged on the overdue instalments and interest as per the Loans Overdue Position Sub-menu. The basis of penal interest is not clear.

Savings/Current Account :

Minimum balance charges not being levied for SB accounts having chequebook facilities, and balances below Rs.1000. Minimum balance charges not levied in SB & CA Accounts in the month of conversion i.e., Oct 2005.

The branch has delayed the change in savings bank interest rates by one month from 5% to 4.5 % w.e.f. March 2005. As a result, 17879 SB account holders have been paid excess interest for one whole month (March 2005) by 0.5 %. There has been delay in TBA and is not due to migration to CBS.

Conclusion :

Based on the reviews carried out, DIT could plug the loopholes. The training programmes were modified to focus more on ‘people dimension’ and change of mindset. The testing programmes were reviewed to understand the reasons for the errors to have crept in and the IT Software test plans were strengthened.

Overall the Audit Committee meeting appreciated the performance of the Audit Function and it was done in-house with the talent available which helped to keep the cost of the activity low without compromising on quality.

Rahul and his team was applauded for their good performance.

Article by Deepjee Singhal & Manish Pipalia Chartered Accountants

Rewards waiting for feedback at
E-mail : smarttrainee@gmail.com

www.primeonlinetest.com

Prime Academy - In Pursuit of excellence

Click here to contact us, if you are unable to view the content properly