Banco Nacional de Comercio Exterior, S. N. C. has implemented an Internal Control System based on its organizational governance structure. This structure is headed by of the Board of Directors and several committees that make decisions on the various aspects of the institution’s operation, such as comprehensive risk management, credit activities, investment services, human resources and institutional development, IT systems, audit, and internal affairs. Periodic evaluations carried out at various supervision levels that assist the institution’s managerial development.
The office of the Director General is responsible of the implementation and continuity of all internal control measures, its governing bodies, executives and employees of the Institution, as well. Compliance, supervision, and updating of internal control measures is an ongoing, periodic practice in processes and areas of the Institution.
The Audit Committee is an entity that that depends on the Board of Directors, which is in charge of evaluating and monitoring the activities of the institution within the framework of the Internal Control System (SCI). It is composed of independent consultants and assisted by the statutory auditors.
Based on the above and in response to the General Provisions issued by the Mexican National Banking and Securities Commission (As known as Comisión Nacional Bancaria y de Valores, in Spanish) applicable to to Credit Institutions, BANCOMEXT has an Institutional Internal Control Model (MICI). This model was updated and approved by the Board of Directors in November 2016, which includes goals and guidelines aimed at establishing a general framework for the personnel of the Institution, to implement the SCI in areas and processes under their responsibility. The components of the model are outlined as follows:
Objectives
- Operations
- Information
- Compliance
Components
- Environment Control
- Risks Evaluation
- Control Activities
- Information and communication system
- Monitoring and Surveillance Activities
Identity structure
- General Director and Deputies
- Department Directors
- Operational area
- Functions
The purpose of the MICI model is to assist in the generation of an environment that fosters a reasonable fulfillment of institutional goals, an orderly operational performance, adequate risk management, observance of the law, and the evolution of processes by using resources efficiently, reliable institutional information, and resource loss prevention.
A Three-Line-Of-Defense model was designed to support the MICI which foresees its implementation in three working groups with three workgroups, in order to mitigate in a reasonable manner the risks by establishing and performing internal controls.
The first line of defense involves the participation management level officials mainly from business areas, to manage their risks and establish their controls. The second line of defense refers the functions of risk supervision, controls, and compliance with policies and standards set by the Institution, dealing with cross-sectional, general and specific risks. The third line of defense is carried out by Internal Auditing, which offers supervision that is independent of the two prior lines of defense, evaluates the ICS, and identifies weaknesses and recommends improvements. Internal Auditing reports directly to the Audit Committee.
It is worth mentioning that the operation of the internal control system is evaluated annually and, as a result, the institutional internal control annual report is prepared and submitted to Bancomext's Board of Directors and Audit Committee , as well as to different audit instances. The areas of opportunity that are detected through the evaluation are attended by the different administrative units according to their area of competence.
Moreover, control routines involving the implementation of a standardized evaluation method are in place, involving applying periodically self-control mechanisms in critical processes of banking operations, through questionnaires that allow for verification at checkpoints and, if necessary, be able to identify possible incidents that motivate the corresponding adjustment of such processes.
Additionally, there are guidelines and strategies in in matters of Information Security (SGSI), which regulate the use of information technology (IT) equipment and services, in order to contribute to the fulfillment of the Mission, Vision, and Objectives of the Institution.
Likewise, the SGSI is the basis for designing, implementing and evaluating information security measures and focusing their efforts toward the improvement and consolidation of the system.