Unofficial translation
In accordance with the Laws of the Republic of Kazakhstan dated August 31, 1995 "On Banks and Banking Activities in the Republic of Kazakhstan", dated November 20, 1998 "On Audit Activity", dated December 18, 2000 "On Insurance Activities", dated July 2, 2003 "On the Securities Market ", dated July 4, 2003" On State Regulation, Control and Supervision of Financial Market and Financial Organizations" the Board of the National Bank of the Republic of Kazakhstan hereby RESOLVED as follows:
1. To establish:
1) The list of the issues subject to audit of other information, according to Appendix 1 to this resolution;
2) Requirements to the content, terms of representing the audit report by an audit organization on audit of other information according to Appendix 2 to this resolution;
3) Requirements to auditors in the audit organization, involved in the audit of other information, according to Appendix 3 to this resolution.
2. This resolution shall apply to the conduct of verification of other information in a manner other than an audit in a bank, a branch of a non-resident bank of the Republic of Kazakhstan, an insurance (reinsurance) organization, a branch of an insurance (reinsurance) organization-non-resident of the Republic of Kazakhstan, a professional participant in the securities market.
Footnote. Paragraph 2 - is in the wording of the Resolution of the Board of the Agency of the Republic of Kazakhstan for Regulation and Development of the Financial Market dated 24.02.2021 No. 43 (shall be enforced upon expiry of ten calendar days after the day of its first official publication).3. The Department for Financial Market Methodology (D. N. Salimbayev) in accordance with the legislation of the Republic of Kazakhstan shall:
1)jointly with the Legal Department (N.V. Sarsenova) ensure the state registration of this resolution with the Ministry of Justice of the Republic of Kazakhstan;
2) within ten calendar days from the date of State registration of this resolution, send a copy hereof both in Kazakh and Russian languages to the Republican State Enterprise on the Right of Economic Management "Republican Center of Legal Information of the Ministry of Justice of the Republic of Kazakhstan" for official publication and inclusion in the Reference Control Bank of Regulatory Legal Acts of the Republic of Kazakhstan;
3) place this resolution on the Internet resource of the National Bank of the Republic of Kazakhstan after its official publication;
4) within ten working days after the state registration of this resolution, submit to the Legal Department the information on the implementation of measures provided for in subparagraphs 2), 3) of this paragraph and paragraph 4 of this resolution.
4. The Directorate for the Protection of the Rights of Consumers of Financial Services and External Communications (A.L. Terentyev) shall, within ten calendar days after the state registration of this resolution, send its copy for the official publication in periodicals.
5. Control over execution of this resolution shall be entrusted to Deputy Chairman of the National Bank of the Republic of Kazakhstan O. A. Smolyakova.
6. This resolution shall enter into force from January 1, 2019 and shall be subject to official publication.
| Chairman of the National Bank | D. Akishev |
"AGREED"
Ministry of Finance
of the Republic of Kazakhstan
Smailov A.A.
dated October 31, 2018
| Appendix 1 to resolution of the Board of the National Bank of the Republic of Kazakhstan № 245 dated October 29, 2018 |
List of issues subject to verification as part of an audit of other information
1. As part of the assessment of the risk management and internal control system in a bank, a branch of a non-resident bank of the Republic of Kazakhstan, an insurance (reinsurance) organization, a branch of an insurance (reinsurance) organization of a non-resident of the Republic of Kazakhstan, a professional participant in the securities market (hereinafter-a financial organization), the following issues shall be subject to verification:
1) the adequacy of determining the risk profile of a financial institution based on the chosen business model and development strategy of the financial institution;
2) the adequacy of determining the aggregate level (levels) of risk appetite (acceptable level of risk) and levels of risk appetite for each type of risk of a financial organization;
3) compliance of strategic and budget planning with economic goals and risks assumed by a financial organization;
4) the quality of forecasting the main financial indicators of a financial organization;
5) the quality of internal procedures for assessing the adequacy of equity capital (assets of a branch of a non-resident bank of the Republic of Kazakhstan, accepted as a reserve), and liquidity to cover the risks inherent in the activities of a financial organization;
6) an action plan aimed at restoring the activities of a financial organization in the event of unforeseen circumstances;
7) the quality and implementation of internal policies and procedures for managing risks inherent in the activities of a financial organization and for internal control;
8) the adequacy of the limit values of quantitative and qualitative limits for various types of risks within the framework of a multi-level system of limits;
9) quality of collateral;
10) the effectiveness of the internal rating assessment of borrowers (scoring);
11) the effectiveness of procedures for identifying and managing assets with signs of impairment in accordance with international financial reporting standards;
12) the effectiveness of the early warning system aimed at timely response to changes in internal and (or) external risk indicators;
13) the quality and effectiveness of stress testing, as well as an assessment of the adequacy of integrating its results into the risk management system;
14) completeness, reliability and timeliness of management information submitted to the collegiate bodies of the financial organization within the framework of the risk management system;
15) the effectiveness of functioning of the system of three lines of defence.
Footnote. Paragraph 1 - is in the wording of the Resolution of the Board of the Agency of the Republic of Kazakhstan for Regulation and Development of the Financial Market 24.02.2021 No. 43 (shall be enforced upon expiry of ten calendar days after the day of its first official publication).2. Within the framework of the evaluation of strategy and business model, the system of corporate management of verification shall be subject to the following issues:
1)quality and effectiveness of managerial decisions;
2)quality of remuneration policy of executives of financial organization;
3) compliance of the corporate governance structure of the selected business model and the risk profile of the financial organization;
4 effectiveness of measures to resolve the conflict of interest;
5) staff qualification level.
3. Within the framework of the assessment of risk management system of information technology, the effectiveness of security system shall be subject to the following questions:
1) effectiveness of the information technology risk assessment process;
2) completeness and effectiveness of common computer controls, including the operational effectiveness of existing controls;
3) completeness of automated controls, as well as operational efficiency of automated controls in business processes;
4) sufficiency of computer capacity for current and future needs of financial organizations;
5) effectiveness of the process of risk assessment of information security;
6) effectiveness of the existing control in the field of information security;
7) effectiveness of monitoring and analysis of information security incidents, as well as responding to information security incidents;
8) efficiency of the process of management of continuity activity of financial organization.
4. Within the framework of evaluation of the effectiveness of the internal control system in the sphere of counteraction to legalization (laundering) of proceeds of crime and financing of terrorism, the following issues shall be verified:
1) exposure of the financial organization to the risk of legalization (laundering) of proceeds of crime and financing of terrorism;
2) "Know your Client" procedures, adequacy of assessment of risk of legalization (laundering) of proceeds of crime and financing of terrorism by client type;
3) identification of operations subject to financial monitoring;
4) efficiency of interaction of subdivisions of financial organization on the issues of counteraction to legalization (laundering) of proceeds of crime and financing of terrorism;
5) adequacy and sufficiency of measures taken by the financial organization to minimize the risks of legalization (laundering) of proceeds of crime and financing of terrorism;
6) vulnerability of services provided by the financial organization, as well as ways of providing them with risks of legalization (laundering) of proceeds of crime and financing of terrorism.
5. if systems and/or processes are transferred to external performers, the audit organization shall assess sufficiency and effectiveness of the audited issues and (or) measures taken by the financial institution to assess the effectiveness of the management system risk and internal control of the respective external executor.
6. Detailed list of the issues to be verified in the audit of other information shall be determined in the decision on the direction of the financial organization of the requirement to conduct audit of other information, adopted by the collegial body of the authorized body for regulation, supervision and control of the financial market and financial organization (hereinafter referred to asthe authorized body), which composition shall be approved by the Board of the authorized body, according to the results of the implementation by the financial organization of measures determined by the plan of activities, drawn up following the discussion with the authorized body of risks and deficiencies identified by the authorized body in the activities of the financial organization under risk-oriented supervision.
| Appendix 2 to resolution of the Board of the National Bank of the Republic of Kazakhstan № 245 dated October 29, 2018 |
Requirements to the content, terms of representing the audit report by an audit organization
on the audit of other information
1. An auditor's report on the audit of other information in a bank, a branch of a non-resident bank of the Republic of Kazakhstan, an insurance (reinsurance) organization, a branch of an insurance (reinsurance) organization-non-resident of the Republic of Kazakhstan, a professional participant in the securities market (hereinafter-a financial institution) contains:
1) information about the financial organization, in respect of which the audit of other information was carried out;
2) information on the qualifications and work experience of auditors as part of an audit organization that conducted the audit of other information;
3) information on the list of issues checked by the audit organization;
4) information on the list and volume of verified information, including internal documents, reporting and systems, as well as tests performed to identify risks and deficiencies, which are the basis for the conclusions of the audit organization;
5) the audited period;
6) information on the methods, principles and standards that guided the audit organization when conducting an audit of other information;
7) a statement on compliance with the requirements of international auditing standards and the Code of Ethics for Auditors of the Republic of Kazakhstan by the audit organization;
8) clearly expressed conclusions in the form of an independent opinion and (or) observations and recommendations of the audit organization regarding the results of the analysis and assessment of issues subject to verification, formed taking into account the best applicable international practice, the results of the assessment and analysis of information provided for in part five of paragraph 9 of Article 57 of the Law of the Republic of Kazakhstan dated August 31, 1995 "On Banks and Banking Activities in the Republic of Kazakhstan", part five of paragraph 13 of Article 20 of the Law of the Republic of Kazakhstan dated December 18, 2000 "On Insurance Activity", part five of paragraph 9 of Article 55-1 of the Law of the Republic of Kazakhstan dated July 2, 2003 "On the Securities Market", and corresponding to the principles provided for in paragraph 2 of these Requirements, and the factors provided for in paragraph 3 of these Requirements;
9) the date of signing the auditor's report on the audit of other information;
10) signature of the head of the audit other information;
11) the actual location of the audit organization that conducted the audit of other information.
The requirement of subparagraph 7) of this paragraph shall not apply to the case of verification of other information in a manner other than an audit.
Footnote. Paragraph 1 - is in the wording of the Resolution of the Board of the Agency of the Republic of Kazakhstan for Regulation and Development of the Financial Market dated 24.02. 2021 No. 43 (shall be enforced upon expiry of ten calendar days after the day of its first official publication).2. The conclusions contained in the audit report on other information shall be formed taking into account the following principles:
(1) appropriateness: the results of the audit shall be relevant and credible for subsequent use by prospective users;
2) completeness: the analysis and evaluation of the issues to be verified shall be sufficient and reflect all the information that shall allow the authorized body to make a decision;
3) reliability: the use of reliable internal and external sources for the formation of audit evidence, as well as the establishment of several levels of control in the analysis and evaluation of issues to be verified;
4) neutrality: obtaining and using unbiased objective information to analyze and evaluate issues to be verified;
5) understandability: the presentation of the information on verifiable issues in an accessible form for subsequent use by prospective users;
6) independence: exclusion of a situation where there shall be a possibility of influence of the audit organization's interest on the conclusions.
3. The conclusions contained in the audit report of other information shall be formed in compliance with the following factors, taken into account in order to reduce the audit organization risks of underestimation of unusual circumstances, excessive generalizations, and the use of improper assumptions that could lead to possible distortion of conclusions:
1) availability of evidence contrary to other evidence obtained;
(2) availability of information that call into question the reliability of documents and responses to inquiries that shall be used as evidence;
3) availability of circumstances which stipulate the necessity of carrying out of additional researches for definition of possible unfair actions of the financial organization.
4. The terms of the audit report submission by the audit organization on the audit of other information to the authorized body for regulation, supervision and control of the financial market and financial organizations (hereinafter referred to as the authorized body) shall be established in the request of the authorized body to conduct the audit of other information, taking into account the need to perform the procedures provided for in paragraph 5 of these requirements, and shall depend on the list of issues to be verified and the amount of information to be verified.
5. Deadlines for submission of audit report on audit of other information, indicated in the requirement of the authorized body for the audit of other information shall be established taking into account the following activities:
1) within 30 (thirty) working days from the date of receipt of the request of the authorized body for audit of other information the financial organization shall send to the authorized body:
Notification of the preliminary selection of the audit organization with the application of the audit plan for other information (hereinafter referred to as the Verification plan) and the list of auditors involved in the audit in the audit organization and their compliance with the requirements to auditors in the audit organization, involved in the audit of other information established according to Appendix 3 to this resolution, (hereinafter referred to as the notification) or;
a petition for verification of other information by an organization which shall not be an audit, in other way than audit, with the application of the verification plan and indication of the information provided by the paragraph of the second present subparagraph (hereinafter referred to as the petition).
The verification plan shall contain a detailed description of the expected directions, scope, nature of the audit, peculiarities of the methods and standards used in the audit.
The term specified in the first paragraph of this subparagraph shall be extended for a period of not more than 30 (thirty) working days in case the financial organization submitted to the authorized body the justification of the need for renewal;
2) in the case provided by the paragraph 3 of subparagraph 1) of this paragraph, the authorized body shall send the financial organization the results of the examination of the petition within 5 (five) working days from the date of its receipt.
In case of a negative result of consideration of the petition, the financial institution shall submit a petition or notice to the authorized body not later than 10 (ten) working days from the date of receipt of such result;
3) within a period of not more than 30 (thirty) working days after the date of receipt by the authorized body of the audit plan, the authorized body shall discuss with the audit organization the verification plan with a view to its finalization, as well as the approval of the revised verified plan
4) within a period not later than 10 (ten) working days after the date of conclusion of the contract for the audit of other information, the financial organization shall send to the authorized body notification of the choice of an audit organization;
5) within the period not later than 20 (twenty) working days before the end of the period of submission of the audit report on the audit of other information determined in the request of the authorized body, the audit organization shall submit to the authorized body working materials on the audited issues within the framework of audit of other information.
| Appendix 3 | |
| to the Resolution of the | |
| Board of the National Bank | |
| of the Republic of Kazakhstan | |
| dated October 29, 2018 No. 245 |
Requirements for the auditors as part of an audit organization involved in the audit of other information
Footnote. Appendix 3 - is in the wording of the Resolution of the Board of the Agency of the Republic of Kazakhstan for Regulation and Development of the Financial Market dated 24.02.2021 No. 43 (shall be enforced upon expiry of ten calendar days after the day of its first official publication).
Auditors who are members of an audit organization, which did not carry out the audit of financial reporting of an audited bank, a branch of a non-resident bank of the Republic of Kazakhstan, an insurance (reinsurance) organization, a branch of an insurance (reinsurance) organization - a non-resident of the Republic of Kazakhstan, a professional participant in the securities market (hereinafter-a financial organization) for the period to be audited within the framework of the audit of other information, and which is not an organization designated by the audited financial organization for conducting an audit of financial reporting (reporting according to the accounting data) during the period of the audit of other information, or which was not an organization involved by an audited financial organization to provide advisory services in the areas subject to audit, as well as meeting the following requirements, depending on the issues being audited:
1) to verify the issues specified in paragraph 1 of the List of issues subject to verification as part of the audit of other information, established in accordance with Appendix 1 to this resolution, at least two auditors and the head of the audit of other information shall have one of the full ACCA qualifications (Association of Chartered Certified Accountants ), CPA (Certified Public Accountant), CIA (Certified Internal Auditor), FRM (Financial Risk Manager), PRM (Professional Risk Manager), CRMA (Certification in Risk Management Assurance), CFSA (Certified Financial Services Auditor), CCSA (Certification in Control Self-Assessment), COSO Internal Control Certificate, APRM (Associate Professional Risk Manager), MLARM (Market, Liquidity and Asset Liability Management Risk Manager), ORM (Operational Risk Manager), СFA (Chartered Financial Analyst), CIIA (Certified International Investment Analyst), CIRM (Chartered Insurance Risk Manager), PECB Certified ISO 31000 Risk Manager, including one of the auditors shall have one from full qualifications in risk management issues specified in this subparagraph;
2) to verify the issues specified in paragraph 2 of the List of issues subject to verification as part of the audit of other information, established in accordance with Appendix 1 to this resolution, at least two auditors and the head of the audit of other information shall have one of the full ACCA qualifications (Association of Chartered Certified Accountants ), CPA (Certified Public Accountant), CIA (Certified Internal Auditor), CFSA (Certified Financial Services Auditor), CCSA (Certification in Control Self-Assessment), COSO Internal Control Certificate, APRM (Associate Professional Risk Manager), MLARM (Market , Liquidity and Asset Liability Management Risk Manager), CFA (Chartered Financial Analyst), CIIA (Certified International Investment Analyst), CRMA (Certification in Risk Management Assurance), including one of the auditors shall have one of the full qualifications in the issues of corporate governance, specified in this subparagraph;
3) to verify the issues specified in paragraph 3 of the List of issues subject to verification as part of the audit of other information, established in accordance with Appendix 1 to this resolution, at least two auditors and the head of the audit of other information shall have one of the full ITIL qualifications (Information Technology Infrastructure Library), COBIT (Control Objectives for Information and Related Technologies), ISO 27001 LA (ISO 27001 Lead Auditor), CISA (Certified Information Systems Auditor), CISM (Certified Information Security Manager), CRISC (Certified in Risk and Information Systems Control), TOGAF (The Open Group Architecture Framework), CISSP (Certified Information Systems Security Professional);
4) to verify the issues specified in paragraph 4 of the List of issues subject to verification as part of the audit of other information, established in accordance with Appendix 1 to this resolution, at least two auditors and the head of the audit of other information shall have one of the full qualifications of ACAMS (Association of Certified Anti- Money Laundering Specialists), CAMS Audit (Advanced AML Audit Certification);
5) at least two auditors and the head of the audit of other information shall have an experience of at least 2 (two) years to assess the relevant issues subject to verification, and have not been the employees of the financial organization, in relation to which the audit of other information is being conducted within the last 3 (three) years;
6) at least two auditors shall have experience of at least 2 (two)years in the sphere of economy, and (or) finance, and (or)internal audit, and (or) risk management, and (or)information technologies, and (or) internal control in the sphere of counteraction to legalization (laundering) of proceeds from crime and financing of terrorism, and have not been employees of a financial organization in relation to which the audit of other information is being conducted within the last three (3) years;
7) the head of the audit of other information shall have an experience of work not less than 5 (five) years in the sphere of economy, and (or) finance, and (or) internal audit, and (or) risk-management, and (or) information technologies, and (or) internal control in the sphere of counteraction to legalization(laundering) of proceeds from crime and financing of terrorism, and has not been an employee of a financial organization in relation to which the audit of other information is being conducted within the last three (3) years;
