INTERNAL REGULATIONS OF THE AUDIT AND COMPLIANCE COMMITEE OF BBVA COLOMBIA

Transcription

1 ANNEX 3 INTERNAL REGULATIONS OF THE AUDIT AND COMPLIANCE COMMITEE OF BBVA COLOMBIA (Hereafter referred to as the Committee) 1

2 INDEX CHAPTER I RULES OF PROCEDURE OF THE BOARD OF DIRECTORS 1 NATURE 3 2. OBJECT 3 3. COMPOSITION 3 4. FUNCTIONS 4 5. INTERNAL AND EXTERNAL COLLABORATION 6 6 MEETINGS QUORUM 8 7 MINUTES AND REPORTS 8 The Committee must submit the following reports: To The Board of Directors and management To the Assembly 8 DOCUMENTATION 8 9 INTERPRETATION AND MODIFICATION 8 2

3 1. NATURE The Committee is a body of the Board of Directors of BBVA Colombia, that supports the management with respect to the implementation, monitoring and evaluation of the entity s internal control, as well as its continuous improvement. 2. OBJECT The Committee supports the Board of Directors in the supervision of the financial statements and in the implementation and evaluation of the function of internal control. It is also the responsibility of the Committee to ensure that the entity is reasonably complying with pertinent laws and regulations, as well as the general business direction, and that it maintains effective controls against conflicts of interest and fraud of employees, reviewing for this purpose the significant cases that arise. However, the responsibilities of the Board of Directors and of the Administration regarding the implementation or adjustment of the Sistema de Control Interno (Hereafter referred to as the SCI) 1, as well as the monitoring, evaluation and improvement of internal control, are not replaced. 3. COMPOSITION The Committee consists of three members of the Board of Directors who must have experience, be aware of issues related to the assigned functions and be independent members, understood as such those who in any case are employees or directors of the Bank or any of its subsidiaries or who have had such qualities during the year immediately prior to the designation, except in cases of re-election. Likewise, for these purposes the independent members must meet the qualifications required by law. Members of the Committee shall serve for a one (1) year period and may be reelected indefinitely. The Committee shall have a Chairman appointed, for the respective period, by the Board of Directors among any of the two independent members. The Secretary- General of the entity will act as Secretary of the Committee, and in his absence such function must be assumed by the person designated by the Committee. 1. The Sistema de Control Interno (Internal Control System) is the set of policies, principles, standards, procedures and mechanisms established by the Bank to verify and evaluate the achievement of the following objectives: i) improve the efficiency and effectiveness of operations supervised by control entities; (ii) prevent and mitigate the occurrence of fraud; (iii) conduct a proper risk management; IV) increase reliability and timeliness within the information generated; (v) comply the rules and regulations applicable. External circular No of the Superintendencia Financiera de Colombia (Colombian Banking Authority, hereafter referred to as the Superintendencia ). 3

4 The meetings of the Committee may be summoned by the Bank s CEO, the Vice- Presidents, the Internal Auditor, the Fiscal Auditor, the Compliance Officer or any other official that the Committee considers appropriate, in order to provide the information which is deemed appropriate on matters within its competence. The Committee may exceptionally meet with the participation of all the members of the Board of Directors, depending on the relevance of the issues to be addressed. 4. FUNCTIONS The Committee shall exercise the following functions: i) Approve the structure, procedures and methodologies necessary for the operation of the SCI. ii) iii) iv) Point out the responsibilities, powers and limits assigned to various positions and areas with respect to the SCI and risk management. Evaluate the Bank s internal control structure. Designed procedures must reasonably protect the assets of the entity, as well as others they manage or oversee, and if there are controls to verify ensure that transactions are being properly licensed, registered and in accordance with the Bank s needs, objectives, goals and strategies (such as efficiency and effectiveness during operations, and adequacy and reliability of the financial information). Ensure that managers provide the information required by the control bodies. v) Ensure compliance with the law and other controls established for the preparation, presentation and disclosure of financial information. vi) Study the financial statements and prepare a report to be submitted for consideration to the Board of Directors, based on the assessment of relevant projects, with their notes, on the opinions and observations of control bodies, on results of evaluations carried out by the competent committees and any other related document. vii) Design, implement and evaluate programs and controls to prevent, detect and respond to fraud (an intentional act committed to obtain an illicit profit) and misconduct (violation of laws, regulations or internal policies) risks. viii) Monitor the functions and activities of the internal audit in order to determine its independence and objectivity in relation to the activities that it audits, determine the existence of limitations that prevent its proper performance and verify if the scope of work meets the needs of the Bank. 4 ix) Follow up on levels of risk exposure, its implications and the measures taken for their control or mitigation, at least every three months or more frequently if deemed appropriate, and report to the Board of Directors the most important aspects.

5 x) Assess internal control reports by internal auditors, compliance officers or other bodies, verifying that the Administration has acted on its suggestions and recommendations. xi) Verify compliance of the instructions given by the Board of Directors in relation to the SCI. xii) Request reports deemed appropriate for the proper performance of its functions. xiii) Analyze the operation, reliability and integrity for decision-making of information systems. xiv) Present to General Assembly, through the Board of Directors, candidates for Fiscal Auditor, without prejudice to the right of the shareholders to present other candidates at the respective meeting. In this regard the Committee s role will be to collect and analyze the information provided by each of the candidates and submit the results of this study. xv) Prepare the report that the Board of Directors shall submit to the General Assembly, with respect to the operation of the SCI, shall include at least: General policies established for the implementation of the SCI. Process used for the assessment of the effectiveness of the SCI and risk management. Relevant activities undertaken by the Committee. Identified material deficiencies, recommendations made and measures taken. Comments made by supervisory bodies and penalties imposed, if any. Evaluation of the work carried out by the internal audit, including at least the completed scope of work, the independence of its function and the as xvi) Define mechanisms to consolidate the information of the supervisory bodies and send it to the Board of Directors. xvii) Review and approve the annual internal audit plan, as well as those other additional infrequent or specific plans that have been put into practice for reasons of regulatory changes or to meet the needs of the Bank s organization, as well as follow up on these matters. xviii) Be aware of the degree of compliance of the audited units and of the corrective measures recommended by the internal audits, and inform to the Board of Directors such cases that may constitute a relevant risk to the Bank or the companies within the Group. xix) Ensure that the internal audit has had training and adequate means to carry out their functions, both in regards to personnel and to elements, materials, systems, procedures and procedural manuals, and to be aware of the failures that could have arisen during the performance of their duties. 5

6 xx) Ensure the transparency of the financial information prepared by the Bank and its appropriate disclosure, establishing policies, criteria and practices which will be used and assess the necessary controls and instruments to ensure that the financial statements reveal the legitimate situation of the Bank and the true value of its assets. xxi) Approve the Fiscal Audit s report on sufficiency and adequacy of internal control measures, which must be presented to the General Assembly of Shareholders. xxii) Monitor compliance with applicable legislation in matters related to money laundering and to ensure effective controls to prevent criminal activities as money laundering, and review the reports that the Compliance Officer must submit to the Board of Directors for this purpose. xxiii) Monitor compliance with applicable legislation in matters relating to the securities market, data protection, and the scope of actions of the institution in the area of protection of the consumer, as well as the requirements of information or actions taken by the relevant official bodies on these matters. xxiv) Comply with the procedural rules of the Board of Directors and its members, as well as those applicable to the conduct within the securities market. xxv) Become acquainted with the external supervisory bodies reports (Superintendencia and other control bodies). The administrative control bodies shall ensure that these reports are duly communicated on time to the Committee s Chairman. xxvi) Examine codes of conduct and corporate governance regulations, and give its opinion prior to proposals being submitted to the entities social bodies. xxvii) Analyze and approve the annual plan of action of the compliance department, as well as its modifications, and monitor its execution. xxviii) Be aware of actions of the members of the Board of Directors of the entity, relating to the compliance of its regulations and those of the securities market, informing the Board of Directors when deemed necessary. xxix) Report its opinion on possible operations to be carried out with economic associates, verifying that they are to be carried out under market conditions and guaranteeing the right of shareholders to the equal treatment. xxx) Other duties as required by the Board of Directors. 5. INTERNAL AND EXTERNAL COLLABORATION 6 The Committee may hire external advisory services for relevant issues when considered that, for reasons of expertise or independence, such services cannot be provided by experts or technicians within the Group.

7 All the services provided by independent auditors, different to those of the Fiscal Audit, must be approved in advance by the Committee. The Committee may request personal assistance and reports from any member of the management team when it deems that these are necessary for the performance of its functions. 6. MEETINGS QUORUM The Committee shall meet at least four times a year, summoned by the CEO through the Secretary of the Committee, or more frequently in special circumstances or when deficiencies are detected in the internal control system that require an evaluation or urgent corrective measures, or when there are significant changes in the policies of the institution or in regulations governing its operations. The Committee will deliberate and decide validly in the presence and with the votes of the majority of its members. 7. MINUTES AND REPORTS The decisions and actions of the Committee must be recorded in minutes which shall be signed by the Chairman and the Secretary, and retained by the Bank s General Secretariat. The Committee must submit the following reports: To the Board of Directors and management - Observations and reports that the Committee produces will be kept on minutes to be presented to the Board of Directors. - When situations of significant importance are detected, special reports will be submitted to the Board of Directors and the CEO. To the General Assembly of shareholders At the end of the fiscal year, the Board of Directors shall submit a report on the work of the Committee. 8. DOCUMENTATION For the proper performance of its functions, the Committee shall meet and/or evaluate at least the following documented material: a) The financial statements. b) The opinion on the financial statements issued by the Fiscal Auditor. 7

8 c) The internal control reports and/or letters of recommendations or comments issued by the Fiscal Auditor. d) The internal audit, area of compliance and Fiscal Audit plans. e) The observations forwarded by the Superintendencia as a result of deficiencies identified in the internal control system. f) The periodic evaluation of the loan portfolio of the institution. g) The report of the Compliance Officer to the Board of Directors on the effectiveness of the mechanisms adopted to prevent criminal activities, in particular money laundering, and the evaluation of the findings of the Superintendencia as a result of the deficiencies identified in the SCI within the prevention of money laundering. During the performance of their duties, the members of the Committee must maintain confidentiality on all issues disclosed, as well as any other information to which they have access. 9. INTERPRETATION AND MODIFICATION The General Assembly of Shareholders delegates to the Board of Directors the opportunity to interpret and make additions, modifications or adjustments to this regulation, which will subsequently be made known to the General Assembly DISCLAIMER: The English version is only a translation from the original in Spanish and should be used for information purposes. In case of discrepancies, the Spanish original shall prevail. 8

9 9

10 10