Banco Nacional de Comercio Exterior S. N. C. (Bancomext, National Credit Society) has an Internal Control System (SCI for its acronym in Spanish) based on its corporate governance structure, made up of the Governing Board and various committees that make decisions on different issues regarding the institutional operation, such as comprehensive risk management, credit activities, investment services, human resources and institutional development, IT systems, auditing and comptrolling. In addition, it has the regular evaluation carried out by different inspection bodies that help with the development of the Institution’s operations.
Establishing and maintaining comptroller functions is under the responsibility of the Institution’s General Director’s Office, as well as of the Institution’s Governing Bodies, officials and employees. Compliance, overview and update of comptroller functions is an ongoing and periodic practice in the Institution’s processes and areas.
On the other hand, the Auditing Committee is a body under the authority of the Governing Board in charge of evaluating and following up on the institutional activity within the framework of the SCI. Said committee is made up of independent advisors and features the participation of commissioners.
Accordingly, and pursuant to the overall provisions applicable to credit institutions, issued by the National Banking and Securities Commission, the Institution has the Institutional Model for Internal Control (MICI for its acronym in Spanish), which was updated and approved by the Governing Board in December 2021, which also includes goals and guidelines, and whose objective is to establish the general framework so that the Institution’s staff may carry out the implementation of the SCI in the areas and processes under its responsibility.
The elements of the model are described in the following chart:
The MICI has the purpose of contributing to generate an environment that fosters the reasonable compliance with institutional goals, the orderly performance of operations, adequate risk management, the observance of regulations, reliability on institutional information and the development of processes by means of the efficient use of resources.
To support the MICI, we started defining a model with Three Lines that plans its implementation in three work groups, with well-defined activities and responsibilities, in order to mitigate risks in a reasonable manner, by establishing and executing internal controls.
The first line refers to the participation of high-level officials, mainly from the business areas, to manage their risks and establish their own controls.
The second line refers to the functions of risk supervision, controls and compliance with policies, as well as to standards established in the Institution, addressing cross-cutting, general and specific risks.
The third line is carried out by the Internal Audit Director’s Office (DAI for its acronym in Spanish), by independently overviewing the first two lines, evaluating the SCI, identifying weaknesses and recommending improvements. The DAI reports directly to the Auditing Committee.
It is worth mentioning that every year the functioning of the comptroller system is evaluated and, as a result of this, the Annual Report on the State of the Institutional Internal Control is produced, which is then presented to the Institution’s Governing Board and to its Auditing Committee, as well as to different inspection bodies. This way, the areas of opportunity detected by the evaluation are addressed by the different administrative units, based on their scope of competence.
On the other hand, control routines are implemented by establishing a standardized assessment methodology, which consists in periodically applying self-evaluation mechanisms in the critical processes of banking operations by means of questionnaires and operative samples that allow verifying compliance with regulations and controls and, given the case, identifying potential incidents that may lead to carrying out corresponding adjustments to said processes.
In addition, there are guidelines and strategies in terms of managing information security, that regulate the use of Information and Communications Technologies systems and services, this way contributing to the compliance of the Institution’s mission, vision and goals.
In the end, the Information Security Management System is the basis for designing, implementing and evaluating the information security measures and for focusing its efforts on improving and consolidating the system.
