Banco Nacional de Comercio Exterior, S. N. C. has an Internal Control System that is based on its corporate governance structure, which is composed of the Board of Directors, and of several committees that make decisions on the various aspects of the institution’s operation, such as: integral risk management, credit activities, investment services, human resources and institutional development, IT systems, audit, and internal control; it also relies on a periodic evaluation performed by different levels of supervision which aid in the management of the Institution.
The implementation and continuity of internal control measures is the responsibility of the office of the Director-General of the BANCOMEXT, as well as of its governing bodies, and of the executives and employees of the Institution. Compliance, supervision and updating of internal control measures is an ongoing, periodic practice in processes and areas of the Institution.
The Audit Committee is a body that depends on the Board of Directors, which is in charge of evaluating and monitoring the activities of the institution within the framework of the Internal Control System (SCI). It is composed of independent consultants and is assisted by the statutory auditors.
As per the foregoing and pursuant to the General Provisions set forth by the Mexican National Banking and Securities Commission (Spanish: Comisión Nacional Bancaria y de Valores) which apply to Credit Institutions, BANCOMEXT has an Institutional Internal Control Model (MICI), which was updated and approved by the Board of Directors in October of 2018, and includes goals and guidelines with the purpose of establishing a general framework for the personnel of the Institution to implement the SCI in areas and processes under their responsibility. The components of the model are outlined in the following graph.
INSTITUTIONAL INTERNAL CONTROL MODEL (MICI)
Conceptual outline
Objectives
- Operations
- Information
- Compliance
Components
- Environment Control
- Risks Evaluation
- Control Activities
- Information and communication system
- Monitoring and Surveillance Activities
Identity structure
- General Director and Deputies
- Department Directors
- Operational area
- Functions
The purpose of the MICI model is to assist in the generation of an environment that fosters a reasonable fulfillment of institutional goals, orderly operational performance, adequate risk management, observance of the law, the evolution of processes by using resources efficiently, reliable institutional information, and resource loss prevention.
A Three-Line-Of-Defense model was designed to support the MICI model. It is to be implemented on three workgroups, with specific activities and responsibilities, with the purpose of reasonably mitigating risk by establishing and performing internal controls.
The first line of defense involves the participation of executive officers, mostly belonging to business areas, to manage their risks and establish their controls. The second line of defense involves the functions of risk supervision, controls, and compliance with policies and standards set forth by the Institution, dealing with cross-sectional, general and specific risks. The third line of defense is undertaken by Internal Auditing, which offers supervision that is independent of the two prior lines of defense, evaluates the ICS, and identifies weaknesses and recommends improvements. Internal Auditing reports directly to the Audit Committee.
It is worth mentioning that the effectiveness of the internal control system is evaluated every year, and as a result, the institutional internal control annual status report is prepared and submitted to the Board of Directors and the Audit Committee of the BANCOMEXT, as well as to several levels of supervision. The areas of opportunity detected as a result of the evaluation are addressed by one of several administrative units, depending on their areas of responsibility.
Moreover, control routines involving the implementation of a standardized evaluation method are in place, which consist of periodically applying self-control mechanisms in critical processes of banking operations, through questionnaires that allow for verification at checkpoints and, if necessary, have the capacity to identify possible incidents that justify making reasonable adjustments to said processes.
Additionally, the Information Security Guidelines and Strategies (SGSI) govern the use of IT equipment and services in order to contribute to the fulfillment of the Mission, Vision, and Objectives of the Institution.
Likewise, the SGSI is the basis for designing, implementing and evaluating information security measures and focusing their efforts toward the improvement and consolidation of the system.