7-June 2018

Professional Level – Business Planning: Banking - June 2018
MARK PLAN AND EXAMINER’S COMMENTARY
The marking plan set out below was that used to mark this question. Markers were encouraged to use
discretion and to award partial marks where a point was either not explained fully or made by implication.
More marks were available than could be awarded for each requirement. This allowed credit to be given for a
variety of valid points which were made by candidates.
Question 1
Total Marks: 40
General comments
The candidate is placed in the role of an ICAEW Chartered Accountant working for Coleman and Partners
auditing loans and advances at Gillespie Bank. The focus is on IAS 39 and IFRS 9 treatment of loans and
advances and impairments.
Candidates’ knowledge of both IAS 39 and IFRS 9 is tested using three issues:
 Choice of classification category based on the business model for holding investments;
 Forbearance offered to a borrower and the treatment of a potential impairment; and
 Purchase of a sub-prime mortgage book.
Candidates must identify risks for the following year’s audit arising from IFRS 9 implementation in the
context of the issues above and background information provided in the question.
Ethics is tested through the request for IFRS 9 implementation advice based on no agreed engagement
terms and the provisions of the FRC Ethical Standard on public interest entities (PIEs). There is also a
conflict of interest arising from the potential to use a competitor bank’s bespoke software for IFRS 9
implementation.
1.1
1. Other loans and advances
IAS 39
Tradeable assets classified as other loans and advances could be classified as available for sale (AFS) or
fair value through profit or loss (FVTPL) financial assets. The classification must be made on initial
recognition.
The financial assets are recognised initially at fair value. The transaction costs for AFS investments are
capitalised and transaction costs for FVTPL investments are expensed.
The balance is restated to fair value at each year end with movements being taken to other
comprehensive income for AFS investments or profit or loss for FVTPL investments. Interest is recognised
in profit or loss using the effective interest rate. If the financial assets are classified as AFS, the cumulative
gains or losses are recycled to profit or loss on disposal of the investments.
Gillespie has decided to classify these balances as loans and receivables (L&R) and to measure at
amortised cost with effective interest recognised in the statement of profit or loss which may not be the
correct classification.
AFS or FVTPL may be more appropriate if the financial assets were acquired for the purpose of selling in
the short term or for which there is a recent pattern of short-term profit taking. If sales are made
sporadically as deposits are called, the L&R classification may be appropriate.
IFRS 9
Under IFRS 9 the investments must be classified according to the cash flow characteristics and the
business model under which Gillespie holds them.
Copyright © ICAEW 2018. All rights reserved Page 1 of 14

Debt instruments held are classified at either amortised cost or fair value through other comprehensive
income (FVTOCI) if the contractual cash flows are solely payments of principal and interest on the amount
outstanding (SPPI).
Debt instruments held within a business model whose objective is to collect contractual cash flows and sell
the instruments, which is the case for Gillespie, are classified at FVTOCI. Fair value gains and losses are
recognised through OCI and recycled to profit or loss on disposal.
On initial recognition, 12-month expected credit losses must be recognised.
Infrequent sales (even if significant) or sales which are insignificant in value (individually and in aggregate)
do not affect the amortised cost classification. Further information is required on how the business model
is applied in practice.
2. Forbearance extended to UK corporates
IAS 39
As a financial asset, classified as loans and receivables, the loan to Bold is measured at amortised cost
using the effective interest rate. Gillespie must assess at each reporting date whether there are indicators
of impairment. Impairment allowances are recognised when there is objective evidence that impairment
has occurred. The recoverable amount is calculated by discounting the expected future cash flows at the
loan’s original effective rate.
The extension of forbearance terms to Bold does not necessarily indicate that an impairment must be
recognised. The loss of a key customer and subsequent cash flow problems are a possible indicator of
impairment.
Gillespie should compare the carrying amount of the loan to Bold to its recoverable amount calculated as
the present value of the future cash flows, discounted at the loan’s original effective interest rate.
However, the recoverable amount is equal to the carrying amount of the loan because effective interest
continues to accrue at 5.5% per annum.
The carrying amount of the loan at 30 November 2018 is £14.3 million (13.55 million x 1.055).
IAS 39 does not require an impairment loss to be recognised unless the recoverable amount falls below
the financial asset’s carrying amount.
IFRS 9
On 1 December 2014, Gillespie must recognise 12-month expected credit losses (ECL) against the loan to
Bold of £434,000. This is stage 1 of the impairment model under IFRS 9. The loan to Bold would remain in
stage 1, recognising 12-month ECL, unless there is a significant increase in credit risk.
The extension of forbearance has almost doubled the 12-month PD from 3% to 5.5% which implies that
there was a significant increase in credit risk and the impairment loss should be increased to recognise
lifetime expected losses (LEL) based on PD of 12%. The LEL are £750,000 (12% x 50% x £12.5m).
Therefore impairment losses would be increased under IFRS 9 in the year ended 30 November 2016 by
£316,000 (750,000 – 434,000).
A significant increase in credit risk is not solely based on the increase in PD but should also reflect
reasonable and supportable information that is available without undue cost or effort. It is relative to the
initial credit risk and should focus on forward looking information.
Forbearance was withdrawn on 30 November 2017 and interest payments were expected to restart. The
relevance to the figures at 30 November 2018 is whether the loan to Bold should be transferred back to
stage 1 or whether it should remain in stage 2.
Gillespie must consider whether a period of stable interest payments is needed before the financial asset
reverts to stage 1. The close monitoring indicates that immediate reversion would be premature.

3. Purchase of sub-prime mortgage book
IAS 39
The mortgage book should be classified as loans and receivables as it is an unquoted investment and is
not held for trading. It is initially recognised in May 2018 at its fair value of £14.5 million and subsequently
measured at amortised cost.
Any significant loans must be assessed individually for impairment. The remaining balance is assessed for
collective impairment.
IAS 39 requires impairment losses to be recognised only if the recoverable amount falls below the carrying
amount of the loans. Gillespie acquired the mortgage book at a “substantial discount to face value” which
implies that the initial recognition at fair value reflects an up-to-date valuation. No impairment is required
unless the valuation has deteriorated at 30 November 2018.
Gillespie should monitor the situation closely and ensure that the valuation of security in the event of
foreclosure remains up-to-date.
IFRS 9
Under IFRS 9 the purchase of credit-impaired financial assets is recognised by using a credit adjusted
effective interest rate. No impairment loss allowance is recognised on initial recognition.
No further impairment is required at year end unless there are subsequent changes in credit risk which
would affect profit or loss.
Examiner’s comment
Candidates provided good answers to the treatment of the first two issues. Candidates structured their
answers clearly and the majority of candidates were able to explain the IFRS 9 treatment of the
classification and impairment issues.
A significant minority of candidates performed substantially better on the IAS 39 explanations compared
with IFRS 9 explanations. The importance of IFRS 9 is highlighted in the learnings materials.
The impairment in issue two required candidates to apply their IFRS 9 knowledge to the scenario
provided. Many answers simply presented a summary of the IFRS 9 rules which limited the marks that
could be awarded. Candidates were also very quick to return the asset to stage 1 of the impairment model
without requiring a period of time to assess if credit risk had indeed reduced.
A large number of candidates drew incorrect conclusions about the impairment because, despite there
being no reduction in the present value of the future cash flows, they attempted to calculate an impairment
and recognise it. However, these candidates were still able to gain marks for the correct approach to the
question.
There were many incorrect answers to the third issues on the purchase of sub-prime debt. However,
stronger candidates presented technically perfect answers to this issue. A common error was to conclude
that the asset should be in stage 2 on initial recognition because of the high probability of default. An
increase in credit risk should be assessed compared with the probability of default on initial recognition
rather than the absolute figure.
Total possible marks 21

Maximum full marks 18
1.2
Gillespie is “not overly concerned” about the implementation of IFRS 9 but this is a major challenge to
banks and will require substantial work to deal with the transition from IAS 39. Alia Khan’s statement
should increase the professional scepticism applied to the audit and plans for implementation should be
analysed thoroughly by Coleman.

Alia intends to use data directly from its existing regulatory reporting systems to generate expected loss
data for impairment calculations. The regulatory internal models are a useful starting point but the figures
for IFRS 9 require a different focus and an unbiased approach. Regulatory information inherently contains
a downturn bias to ensure that sufficient capital is held by Gillespie.
The UK mortgage book is assessed for impairment on a collective basis and segmentation is based on the
number of days past due. Whilst this is a useful metric, the segmentation does not appropriately capture
risks by loan type or loan quality. For example, loans may be categorised based on affordability measures
such as loan to income ratios or on credit ratings for corporate loans. Loan types may include interest-
only, repayment, buy-to-let etc which generate different default rates. There is a risk that the limited
segmentation does not adhere to IFRS 9 and potentially does not identify all impairment losses on a timely
basis nor enable accurate probability of default calculations for different segments of loans. Also, under
IFRS 9, Gillespie may need to assess whether there is a significant increase in credit risk for UK loans on
a collective basis and these portfolios will need to be segmented on a more granular basis to assess the
different extents of risks to which each segment is exposed.
The risk committee assesses the internal credit risk models annually. This is not sufficiently frequent to
update models for changing macro-economic conditions. There is therefore a risk that models do not
reflect up-to-date PDs if the review does not coincide closely with the reporting date.
PD for Basel purposes is based on long-run averages using historical data. However, IFRS 9 requires the
best estimate of PD at the reporting date for the remaining life of the financial asset i.e. a forward-looking
approach. There is therefore a risk that PD is not appropriate using only the existing models. Additional
variables will need to be built into the models to reflect economic forecasts.
PD for Basel purposes uses a 12-month time horizon. IFRS 9 requires 12-month expected credit losses
only for stage 1 exposures. Lifetime expected losses for stage 2 and 3 exposures will require different
calculations.
There is a risk that LGD figures are not current because property valuations may no longer be up to date.
This could affect LGD positively if house prices have risen and the loan is well covered, or negatively if
house prices have fallen and Gillespie would suffer a greater loss in the event of default.
Basel measures for LGD are based on losses suffered during an economic downturn i.e. stressed
realisable values. IFRS 9 requires an unbiased, neutral estimate of LGD based on forward-looking
economic data.
Exposure at default requires an estimate of the outstanding amount at the point in time the customer
defaults. There is a risk that the current carrying amount misstates this amount. Mortgage prepayments
should be modelled into the future.
This also raises the questions regarding whether Gillespie has a complete data set available for all
calculations required. Also, whether Gillespie employs finance, IT and risk staff with sufficient expertise to
identify the challenges posed by IFRS 9.
New systems, controls and processes are required that will need to be incorporated into the audit over the
next 12 months as part of understanding the business. The change in business processes must be
sufficiently understood by the audit team.
Gillespie should be further along in its thinking about new processes required. For example, the
identification of a significant increase in credit risk is fundamental to the IFRS 9 model and must be well
established and tested before 30 November 2018. Gillespie needs to have systems in place to identify the
credit risk on initial recognition of a financial asset and to monitor its credit risk over its life. Similarly,
Gillespie needs to be able to identify when the financial asset has defaulted, for which there is no IFRS 9
definition. The additional variables required, including forecast macroeconomic data, must be identified
and included in updated models. These forecasts must be updated on an ongoing basis.
There is an audit risk that Gillespie may not classify loans and advances correctly under IFRS 9, given the
judgement that must be applied to classification of financial assets. There is a question over whether other
loans and advances in Exhibit 2 should be measured at amortised cost or FVTOCI.

The significant increase in credit risk related to the loan to Bold is provided in terms of the increase in
probability of default. Gillespie must ensure that is has sufficient systems in place to monitor credit risk on
initial recognition and changes thereof. There is a risk that data will be difficult to obtain for loans and
advances which were extended a number of years ago. Gillespie must use forward looking information to
assess whether credit risk has increased and this data may not yet be fully captured.
Regulatory data may fail to adequately assess the business model in which the assets are held.
A significant minority of candidates presented audit procedures in addition to audit risks despite not being
required. These candidates wasted time and generally did not generate sufficient volume nor quality of
audit risks.
Other candidates clearly found the requirement challenging but made a solid attempt because it is a core
part of the BP:B syllabus.
Strong candidates presented a number of well explained risks that were pertinent to the question.
A common error was to assert that the data used to generate expected losses is inaccurate but without the
associated explanation of why this is the case.

1.3
There are a number of ethical issues arising for Coleman on the Gillespie audit. Coleman is an ICAEW
firm of chartered accountants and must adhere to the Financial Reporting Council (FRC) Ethical Standard.
Kerry Willis has been appointed as the new engagement partner. Kerry has worked on the IFRS 9
implementation of a competitor bank during the last year and wishes to use the knowledge she gained to
assist Gillespie.
There is an ethical issue because Kerry must demonstrate professional due care and competence in her
dealings with Gillespie. Her experience in IFRS 9 will enable her to do this effectively. However, bespoke
software developed by another client may not be offered, directly or indirectly, to Gillespie as this presents
a conflict of interest.
FRC Ethical Standard, revised 2016, states that key audit partner rotation every five years is mandatory
for public interest entities (PIEs). The Ethical Standard also states that the partner may not participate in
the audit for a further five years. This means that Riley Roberts should not be involved in the Gillespie
audit in terms of quality control, consultation on technical issues nor in any way directly influence the
outcome of the audit. Riley’s intention to “observe” the audit appears to contravene the ethical standard
rules, implying that he intends to perform unofficial quality control and to become involved if he deems
necessary.
The FRC offers some flexibility to extend the key audit partner involvement to up to seven years, if
required to safeguard the quality of the audit engagement. This does not appear to be the case here as
Kerry has sufficient experience and expertise to perform the audit.
Coleman may not provide non-audit or additional services to Gillespie, which is a PIE. Prohibited
additional services involve playing any part in the management or decision making of Gillespie; internal
control or risk management; or financial IT systems. As such, Coleman is limited in the extent of IFRS 9
assistance it can provide to Gillespie.
Actions required are as follows:
Kerry must not use the bespoke software developed by another client as this would, at the very least, be a
breach of confidentiality. It could be an illegal infringement of intellectual property rights.

Riley must remove himself from the Gillespie audit completely. His rest period of five years means he has
no influence over the audit. It would be good practice to inform Alia Khan that Kerry is the key audit
partner to communicate with.
If Gillespie requires specific assistance to implement IFRS 9 this work should be performed by a separate
audit firm. The statutory auditor may not prepare accounting records and financial statements for PIEs as
this is prohibited by the FRC Ethical Standard.
Candidates identified a number of ethical issues that were relevant to the question and generated
appropriate actions to respond to the issues.
A significant minority of candidates were unclear whose ethical issues were being requested and talked
about Gillespie’s manager in addition to the audit firm. This has been mentioned in previous examiner
comments.


Question 2
Total Marks: 35 marks
General comments
The candidate works in the risk management department of Mawashi. Mawashi trades over-the-counter
(OTC) derivatives with approved counterparties. OTC derivatives are not traded on exchanges, so they do
not have the related protection against credit risk.
Mawashi is considering approving Geri Bank (Geri) as a counterparty and must analyse Geri’s financial
and operational information for this purpose.
2.1
Ratios calculated from financial statements
2018 2017
Cost income ratio 180.57% 166.22%
Net interest margin (total assets) 0.76% 1.01%
Net interest margin (interest bearing assets) 0.94% 1.25%
Return on assets (0.74%) (0.71%)
Return on equity (19.09%) (17.18%)
Loan-to-deposit ratio 1.24 0.89
Note: 2018 figures are based on average balances where applicable. 2017 figures are based on year end
assets or equity in the absence of 2016 balances.
Geri intends to increase its use of derivatives to actively manage its interest rate and currency risk. If Geri
is added to Mawashi’s list of acceptable counterparties for OTC derivatives, Mawashi will be exposed to
counterparty risk arising from the potential for Geri to fail to fulfill its obligations. This will need to be
addressed by increasing the premium for credit valuation adjustment (CVA) in the pricing of bilateral
trades.
Given Mawashi’s expectation that a large amount of business could be generated from Geri, its obligations
to Mawashi under such OTC derivative contracts could become significant. Credit Risk Committee
members will also need to consider whether the level of counterparty risk is within Mawashi’s risk appetite.
Performance
Losses have increased in 2018, despite much lower levels of expenses related to customer redress. The
losses are partly a consequence of non-recurring expenditure in 2018 related to branch closures and
online banking development. If these are stripped out, losses in 2018 would have been £52.1m (152.1 -
100) with a cost income ratio of 132%; an improvement on 2017.
The cost income ratio (excluding customer redress) deteriorated in 2018 as income fell faster than
operating expenses.
Net interest margin also deteriorates in 2018. This is likely to have been the consequence of the increased
interest rate offered to existing customers through loyalty bonuses. Net interest margin is also likely to
have been adversely impacted by the change in funding mix. Geri has an increased proportion of deposits
by banks and the interest payable on these is likely to exceed that paid to depositing customers.
As a consequence of these factors, returns on equity (ROE) and return on assets (ROA) are negative and
worsening. ROE deteriorated faster as equity was eroded by losses and replaced by greater leverage.
However, if non-recurring expenses in 2018 are stripped out:
ROE is -6.15% (-152.1+100)/((725.4+100+867.8)/2); and

ROA is -0.25% (-152.1+100)/((19,824.1+100+21,098.5)/2)
These ratios show considerable improvement on the prior year. It could be argued that customer redress
should also be stripped out.
Geri has suffered losses due to unhedged interest rate and currency risk in 2018. If it is more successful in
actively managing these risks going forward this may improve profitability and returns.
The tax expense in 2017 despite generating losses should be investigated.
Funding
The loan to deposit ratio has significantly increased to 1.24 as a result of the 33% drop in customer
deposits which considerably exceeds the fall in loans. This indicates a deterioration in Geri’s ability to
attract deposits, most likely a consequence of reputational damage following adverse publicity in 2018.
Geri may be vulnerable to further shrinkage of its deposit base. Loyalty bonuses may prove inadequate to
retain customers, particularly if continued poor financial performance damages Geri’s reputation further.
Geri’s funding mix shows an increase of £4,705.6 million (5,821.0 – 1,115.4) in the amount of funding from
interbank market which is less stable. If participants in the interbank market become concerned about
Geri’s credit risk this form of funding may dry up or at least become more expensive. Interbank lending
tends to be overnight and short tenor placements.
If the issue of shares by Geri is successful, this could replace interbank funding improving the stability of
its funding. The success of the share issue is not guaranteed because of Geri’s failing reputation.
The leverage ratio based on the financial statements shows a marked decrease as losses erode equity
outweighing the reduction in the total assets.
Regulatory capital ratios
Regulatory capital ratios have fallen due to the impact of losses on equity without a commensurate
reduction in risk weighted assets (RWA).
In 2018, CET1 fell significantly and at the year end, only exceeded its minimum requirement by £17.6
million ((13.1%-12.75%) x 5035) It will be visible to counterparties and investors that Geri is at risk of
breaching its CRD IV buffers. Therefore, it would need to submit a capital restoration plan to the Prudential
Regulation Authority (PRA).
Continued losses are likely to reduce the CET1 ratio further, unless action is taken to reduce RWA.
Management’s intention to raise £5,000 million through the issue of ordinary shares would add to CET1
however, given its poor reputation and its potential breach of its CRD IV buffers, equity investors will not
be keen to invest given that Geri will not be able to pay any (or limited) dividends.
The PRA leverage ratio has also fallen to only just above the 3% minimum required. This too would be
improved if £5,000 million is raised by a successful share issue later in the year.
Falling below minimum required thresholds could lead to the PRA restricting or limiting its regulatory
permissions to conduct business.
Conclusion
Geri is a loss-making bank with deteriorating performance. However, if non-recurring costs are stripped
out, Geri has improving performance under the new management team’s strategy.
Signs of a deteriorating deposit franchise are evident, although this may have been ended at the cost of
loyalty bonus interest to depositors. We would need further evidence to determine whether the deposit
base is continuing to reduce.

The shrinkage in the deposit base has also led to the replacement of funding from customer deposits with
less stable interbank deposits. Geri’s regulatory capital position is currently weak and the bank is likely to
find it challenging to operate with the current amount of capital. It is almost breaching its CRD IV buffers
and therefore will not be able to pay any or limited dividends. Both debt and equity investors will therefore
be wary of investing in the bank.
Although there are signs that Geri’s performance is improving, the success of its new strategy cannot yet
be determined. Geri has reduced funding stability and a weak regulatory capital position. These factors
create a heightened risk of Geri failing to meet its obligations under OTC derivative contracts it enters with
us. However, a successful share issue later this year would improve funding and regulatory capital
considerably. Mawashi could wait until this occurs before accepting Geri as a counterparty for OTC
derivatives.
Candidates generated a wide range of answers from some very brief summaries, to comprehensive
reports. The information provided in the question was well used in the case of more complete answers.
Candidates who used the headings from the requirement were able to generate more marks than those
who did not use them effectively.
Common errors included comparing Geri’s CET1 capital to the minimum 4.5% rather than the 12.75%
individual capital guidance provided in the question. Some candidates also did not seem to realise that
they were analysing a bank and calculated ratios, such as the current ratio, that would be appropriate for a
non-financial company, instead of the loans to deposits ratio.
A significant minority of candidates treated capital as cash and explained the fall in capital adequacy by
the payment of conduct redress to customers. If the misconduct provision had already been provided for,
the cash payment would have no impact on capital.
Candidates requested additional information that was often outside the remit of a potential trading
counterparty and would more likely be requested as part of a due diligence assignment or statutory audit.

2.2
Nature of a master netting agreement
The International Swaps and Derivatives Association (ISDA) Master Agreement is a framework agreement
between two parties under which individual derivatives transactions may be carried out. The ISDA Master
Agreement is divided into two parts. The first part constitutes a standard set of non-commercial terms and
conditions. The terms and conditions include representations, undertakings, events of default, termination
events, change of law provisions and transaction netting provisions. The second part constitutes a
schedule which allows the parties to tailor the first part and agree certain commercial terms.
 OTC derivative transactions create obligations to pay and receive cash between the parties over time
 Where counterparties enter a number of transactions with each other this will lead to multiple
separate payment and receipt obligations
 A master netting agreement (MNA) permits the settlement of offsetting obligations between two
parties with a single net sum
 Settlement netting takes place whilst the parties to the MNA are both solvent meaning that only a
single net amount passes between the parties on each settlement date
 Close-out netting occurs where one party defaults and enables cancellation of all open unperformed
contracts between the parties with a single net payment
Impact of a master netting agreement with Geri on counterparty risk
Agreeing that all transactions with Geri are done under an MNA such as the ISDA MNA would entitle
Mawashi to net off amounts receivable and payable.

In the absence of an MNA, if Geri were to default on its derivative obligations, Mawashi still has to meet its
obligations to pay, but may take a long while to recover amounts due to it from Geri. Whereas, under an
MNA, in the event of Geri’s default, Mawashi would be entitled to offset any amount owed to it by Geri
against any amount payable thereto.
This reduces Mawashi’s exposure in the event of Geri defaulting on derivative obligations.
A reasonably well answered requirement. Master netting agreements are included in the learning
materials and a significant amount of candidates clearly used the index and used the open book text to
access and apply this information in writing their answer.

2.3
Mawashi could mitigate Geri’s counterparty risk using a combination of the following factors:
Collateral
Mawashi could require counterparties for OTC derivative trades such as Geri to place collateral with them.
Collateral would cover the counterparty’s unrealised losses. This is possible if an ISDA Master Agreement
is in place which is the case for most European counterparties.
Cash or government bonds would represent the most secure forms of collateral.
Use of central counterparty
If OTC derivative trades with Geri are on standard terms and fall within the EMIR (the regulation on OTC
derivatives, central counterparties and trade repositories) then they will have to be centrally cleared.
Central clearing limits the counterparty risk to the central counterparty or clearing house.
Exposure limits
Mawashi can set trading limits on the exposure to Geri that Mawashi is prepared to accept within its risk
appetite.
Mawashi would monitor the limits and take action as necessary if limits are exceeded. The structure of the
limits would require assessment of expected and potential future exposures and the instruments that
Mawashi decides to trade with Geri.
Mawashi should also consider its trading with other counterparties to minimize concentration risk.
Hedging
Counterparty risk can be hedged using credit derivatives. Taking out credit derivatives with a third party on
Geri will reduce Mawashi’s exposure in the event of default.
Strong candidates were able to generate a number of well explained strategies for reducing counterparty
risks. Weaker candidates simply stated the definition of counterparty risk, which was not required.
Requesting further due diligence procedures gained limited marks as this has been undertaken in
requirement 2.1.


Question 3
Total Marks: 25
General comments
Mancroft LLP is performing controls testing on Fitzgerald Bank (Fitzgerald) in respect of its futures
contracts trade processing and settlement. Controls over this area were found to be ineffective in the prior
year audit and have been outsourced in the current year to Capable Service Centre (CSC) in India.
An audit senior has visited CSC to perform some controls testing and his conclusions are provided in the
Exhibit under the headings of CSC staff access rights, trade validation and reconciliations.
3.1 (a)
Mancroft must follow ISA 315 Identifying and Assessing the Risks of Material Misstatement Through
Understanding the Entity and its Environment by discussing the controls in place for the current
accounting period rather than simply following the prior year audit approach.
This is particularly appropriate because a new director was appointed at the beginning of the current
accounting period and controls may have been amended by him/her. The new director was appointed in
November 2017 and may not have implemented controls immediately. Therefore, even if some controls
are deemed to be effective at the year end, they may not have been operating effectively throughout the
12-month period.
Mancroft must gain an understanding of the extent of outsourced functions and their relevance to the
financial statements. Fitzgerald is responsible for ensuring Mancroft has appropriate access to records,
information and explanations from CSC. This is a requirement and if CSC had not been helpful in making
information available, Fitzgerald must ensure that Mancroft has relevant access.
Per ISA 402 Audit Considerations Relating to an Entity Using a Service Organisation, the responsibility for
ensuring that the futures contract trade processing and settlement controls are adequate remains with
Fitzgerald. The bank must have appropriate controls in place over these arrangements including a risk
assessment prior to contracting with CSC, which includes:
 proper due diligence and periodic review of the appropriateness of the arrangement;
 appropriate contractual agreements or service level agreements;
 contingency plans should CSC fail in delivery of its services;
 appropriate management information and reporting from CSC;
 appropriate controls over counterparty information; and
 right of access of Fitzgerald’s internal audit to test CSC’s internal controls.
Mancroft must assess whether Fitzgerald has addressed its relationship with CSC fully in accordance with
these points. It is concerning that Fitzgerald’s internal audit department have not yet examined CSC due
to the new arrangement in the current year.
Due to ongoing IT access control failures, tests carried out in May can not be relied upon for the 31
October 2018 year end.
The team sent to India to audit the controls in CSC must have sufficient experience to perform their task
competently. The team was sent without an audit manager which could mean that Mancroft may not
perform the control testing appropriately, increasing detection and audit risk.
Henry has not commented on controls over settlement, trade confirmation and automatic posting which
are all processes performed by CSC. This may be because there are no control deficiencies, but this is
unlikely given the deficiencies identified in other processes.

3.1 (b)
CSC staff access rights
Individual logins and passwords are appropriate access controls, but the following weaknesses have been
identified because the controls are not used effectively:
 Passwords should automatically require a reset on a regular basis e.g. every two months.
 The administrative login should not be known by staff without the appropriate level of authority.
Any breaches of this must be communicated to IT so that the administrative password can be
changed immediately.
 Highly privileged access (e.g. to sign off on reconciliations) should be restricted to appropriate
staff.
 New joiners access requests should be properly reviewed and authorised to ensure their access is
specific to their individual role
 Application user access rights should be removed on a timely basis when an individual leaves or
moves role.
 Access rights to applications should be periodically monitored for appropriateness.
There appears to be a lack of strong control environment in CSC. The importance of stringent controls
over access and change do not appear to be communicated by management and understood by all staff
members.
CSC should operate a system of least privilege meaning that staff have access to only the resources
absolutely necessary to perform their own responsibilities.
Access to payment systems should be particularly tightly controlled.
Controls to restrict, log and monitor individuals’ access to applications and supporting infrastructure are
important. These controls ensure that only appropriate individuals have access and that this access is
monitored to mitigate the risk of fraud or error and to ensure the integrity of automated business controls.
Trade validation
The fact that back office processes are offshored is an effective segregation of duties between front and
back office.
If the counterparty cannot be found on the system as an approved counterparty for Fitzgerald, there is a
risk that the trade is fraudulent. The settlement of the trade via a suspense account and payment
increases the risk of non-existent trades remaining undetected.
The agreement of executed trades to corporate client’s orders should not be undertaken by front office.
Unauthorised proprietary trading may be taking place by front office without sufficient controls in this area.
Reconciliations
It is an effective control that bank reconciliations are performed by a different CSC team than the rest of
trade processing. However, there are some control deficiencies and therefore risks arising from a lack of
authorisation for payments and review to ensure that confirmations are agreed before payments are
made.
There should be segregation of duties between those settling and accounting for trades.
With regards to bank reconciliations, the following weaknesses are identified:
 Reconciling items must be dealt with on a much quicker timescale than once a month. An error
made on the first day on the month could be outstanding for a full month before it is rectified. This
could mean interest accruing on a failed trade for 30 calendar days.
 There should be physical sign off on daily reconciliations to prove they have been seen by
management. The appropriateness of reconciling items should be agreed by a second level of line
manager and signed off.

Suspense account reconciliations should be performed on at least a monthly basis to identify errors in
processing. These should be reviewed by an appropriate level of management.
This requirement was well answered by most candidates. The deficiencies were identified clearly by the
majority of candidates and the reasons for the deficiencies were normally provided, rather than simply a
list of headings. Concerns around the approach to controls testing were identified particularly well with
candidates outlining Henry’s lack of experience and supervision, and the change in the control
environment since the prior year.
A common error was for candidates to identify that passwords should be changed regularly without
explaining why this is a control deficiency. A number of candidates interpreted identical new joiner access
to mean that new joiners are issued identical passwords, rather than identical access to systems. This lost
minimal marks, but candidates are reminded to read the question carefully.

3.2
If Mancroft finds that controls over futures trade processing and settlement are ineffective, either mitigating
controls must be found and tested and/or substantive procedures must be performed to gain assurance
over the financial statements of Fitzgerald.
If Mancroft is unable to obtain sufficient, appropriate audit evidence concerning CSC as an outsourced
operation, Mancroft should consider whether it is necessary to report the matter directly to the PRA (ISA
250 section B).
Additional testing that could be performed includes:
 where inappropriate access was identified, understand the nature of the access, and, where
possible, obtained additional evidence on the appropriateness of the activities performed.
 identify how trades concluded after the cut-off time for settlement (late trades) are marked
included in that day's positions (including subsequent settlement).
 determine how Pricing issues, legal issues, trade and settlement queries as well as error and
claims management are being handled and the communication which is taking place between
CSC and Fitzgerald.
 additional substantive testing should be performed on specific year-end reconciliations i.e.
confirmation, bank account and suspense account reconciliations.
 testing should be performed on compensating controls such as business performance reviews
and trade confirmations to ensure that all trades are captured and recorded.
 a list of users with access to systems was obtained and manually compared to other access lists
where segregation of duties was deemed to be of higher risk, for example users having access to
both core banking and payments systems.
Substantive testing is still required in addition to controls testing, in particular in relation to auditing journal
adjustments and their validity.
Audit assurance is gained through a combination of controls testing and substantive testing (tests of
detail). If controls are found to be deficient, this will increase the amount of substantive work that needs to
be performed. If controls are found to be ineffective, Mancroft needs to determine whether they are key
controls. If they are key controls Mancroft must determine the financial statement assertion the deficient
controls affect and plan additional substantive testing on these assertions.
Mancroft will need to discuss control deficiencies with management and suggest recommendations. These
can be formally communicated in the letter to those charged with governance provided at the end of the
audit.
The auditors should consider whether the findings affect the audit opinion.

Candidates must take care when reading the requirement because a large number of candidates
misinterpreted this requirement and answered how Fitzgerald Bank should deal with poor controls in its
outsourced supplier, rather than how the audit firm, Mancroft, should respond.
The candidates who responded appropriately to the requirement often scored full marks. The letter to
those charged with governance was mentioned by most candidates and a large proportion also
considered reporting the matter to the regulator.

3.3
Operational risk forms part of the Pillar 1 minimum capital requirement. The operational risk capital
requirement is calculated using one of three methods.
The basic indicator approach calculates 15% of the annual gross income of the bank over the previous
three years. The standardised approach apportions a minimum capital requirement of between 12% - 18%
to each business line’s gross income. If outsourcing saves costs, gross income will increase, thereby
increasing the operational risk capital requirement.
The advanced measurement approach relies on the bank’s own operational risk model and may only be
used with the approval of the PRA. Its use is limited to very large global banks. If Fitzgerald were to use
this method, its internal model must reflect the risks associated with outsourcing to CSC which would
necessarily increase the requirement.
Additionally, the PRA may set additional minimum requirements under Pillar 2A for risks not captured by
Pillar 1. This is very likely to include outsourcing and control risks. This is relevant where Fitzgerald uses
the basic indicator or standardised approach, which is the case for the majority of banks.
ICAAP ensures banks have their own processes in place to ensure its capital is sufficient for its risk profile.
Candidates had varying degrees of success but a significant minority scored very well with full marks.
A minority of candidates provided only definitions of pillar 1 and pillar 2 requirements which gained
minimal marks because the capital requirements were not applied to the question. Those candidates who
attempted to apply the requirements were awarded credit.
Candidates who discussed the methods to calculate the operational risk capital requirement accessed the
potential to gain marks for the impact of outsourcing on profits and the likely impact of internal models (in
the rare event that the advanced measurement approach may be used).


7-June 2018

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

7-June 2018

Uploaded by

Copyright:

Available Formats

Professional Level – Business Planning: Banking - June 2018

MARK PLAN AND EXAMINER’S COMMENTARY

1. Other loans and advances

Copyright © ICAEW 2018. All rights reserved Page 1 of 14

On initial recognition, 12-month expected credit losses must be recognised.

2. Forbearance extended to UK corporates

Copyright © ICAEW 2018. All rights reserved Page 2 of 14

3. Purchase of sub-prime mortgage book

Total possible marks 21

Copyright © ICAEW 2018. All rights reserved Page 3 of 14

Copyright © ICAEW 2018. All rights reserved Page 4 of 14

Total possible marks 18

Actions required are as follows:

Copyright © ICAEW 2018. All rights reserved Page 5 of 14

Total possible marks 8

Copyright © ICAEW 2018. All rights reserved Page 6 of 14

Total Marks: 35 marks

Ratios calculated from financial statements

ROE is -6.15% (-152.1+100)/((725.4+100+867.8)/2); and

Copyright © ICAEW 2018. All rights reserved Page 7 of 14

ROA is -0.25% (-152.1+100)/((19,824.1+100+21,098.5)/2)

The tax expense in 2017 despite generating losses should be investigated.

Regulatory capital ratios

Copyright © ICAEW 2018. All rights reserved Page 8 of 14

Total possible marks 23

Nature of a master netting agreement

Impact of a master netting agreement with Geri on counterparty risk

Copyright © ICAEW 2018. All rights reserved Page 9 of 14

Total possible marks 7

Use of central counterparty

Total possible marks 8

Copyright © ICAEW 2018. All rights reserved Page 10 of 14

Copyright © ICAEW 2018. All rights reserved Page 11 of 14

CSC staff access rights

Access to payment systems should be particularly tightly controlled.

With regards to bank reconciliations, the following weaknesses are identified:

Copyright © ICAEW 2018. All rights reserved Page 12 of 14

Total possible marks 17

Additional testing that could be performed includes:

Copyright © ICAEW 2018. All rights reserved Page 13 of 14

Total possible marks 8

Total possible marks 5

Copyright © ICAEW 2018. All rights reserved Page 14 of 14

You might also like