CAMEL Rating System - Internal Controls

Internal Controls

An area that plays a crucial role in the control of a credit union's risks is its system of internal controls. Effective internal controls enhance the safeguards against system malfunctions, errors in judgment and fraud. Without proper controls in place, management will not be able to identify and track its exposure to risk. Controls are also essential to enable management to ensure that operating units are acting within the parameters established by the board of directors and senior management.

Seven aspects of internal controls deserve special attention:

1. Information Systems. It is crucial that effective controls are in place to ensure the integrity, security, and privacy of information contained on the credit union's computer systems. In addition, the credit union should have a tested contingency plan in place for the possible failure of its computer systems.
2. Segregation of Duties. The credit union should have adequate segregation of duties and professional resources in every area of operation. Segregation of duties may be limited by the number of employees in smaller credit unions.
3. Audit Program. The effectiveness of the credit union's audit program in determining compliance with policy should be reviewed. An effective audit function and process should be independent, reporting to the Supervisory Committee without conflict or interference with management. An annual audit plan is necessary to ensure that all risk areas are examined, and that those areas of greatest risk receive priority. Reports should be issued to management for comment and action and forwarded to the board of directors with management's response. Follow-up of any unresolved issues is essential, e.g., examination exceptions, and should be covered in subsequent reports. In addition, a verification of members' accounts needs to be performed at least once every two years.
4. Record Keeping. The books of every credit union should be kept in accordance with well-established accounting principles. In each instance, a credit union's records and accounts should reflect its actual financial condition and accurate results of operations. Records should be current and provide an audit trail. The audit trail should include sufficient documentation to follow a transaction from its inception through to its completion. Subsidiary records should be kept in balance with general ledger control figures.
5. Protection of Physical Assets. A principal method of safeguarding assets is to limit access by authorized personnel. Protection of assets can be accomplished by developing operating policies and procedures for cash control, joint custody (dual control), teller operations, and physical security of the computer.
6. Education of Staff. Credit union staff should be thoroughly trained in specific daily operations. A training program tailored to meet management needs should be in place and cross-training programs for office staff should be present. Risk is controlled when the credit union is able to maintain continuity of operations and service to members.
7. Succession Planning. The ongoing success of any credit union will be greatly impacted by the ability to fill key management positions in the event of resignation or retirement. The existence of a detailed succession plan that provides trained management personnel to step in at a moment's notice is essential to the long-term stability of a credit union. A succession plan should address the Chief Executive Officer (or equivalent) and other senior management positions (manager, assistant manager, etc.).