14.8	Senior management is responsible for directing the business which, for many financial institutions, has become increasingly complex and diverse. What is essentially the same business may now operate in a number of financial centres and marketplaces, through varying legal entities and under different legal and regulatory jurisdictions. Also, the reliance on trading activities to generate an increasing proportion of total revenues has changed the nature of risk for many institutions within the industry. Rapid product innovation and sophisticated technology, alongside vastly improved communication systems, have to be understood and managed actively.
14.9	At Barings, neither the top management nor the relevant members of the management of the FPG had a satisfactory understanding of the business that was purported to be transacted in BFS, despite the significant profits that were reported and the funding that it required.
14.10	Barings' experience shows it to be absolutely essential that top management understand the broad nature of all the material activities of the institution for which they are responsible and that product management have a detailed understanding of all aspects of the activities they manage. This detailed understanding must include a thorough and continuing analysis of the risk and potential return of each product, how they relate to one another, and the type of control systems required to reduce the risk of error or fraud to a level acceptable to the institution. Management must demonstrate in their everyday actions their belief in, and insistence on, the operation of strong and relevant controls throughout the institution. This is particularly important in high volume, volatile products where the associated risks are correspondingly higher. This understanding, which is no less important in the case of an area of business which is perceived to be very profitable, can be gained through an appreciation of the specific market characteristics, the risks the institution faces, the competitive position of the institution in the relevant marketplace, the identity and requirements of customers, and the basis of the reported profits and risks.
14.11	It is important for the relevant managers to make visits with reasonable frequency to overseas offices engaged in trading, especially where the office is geographically remote from the head office. These visits should include discussions with traders, risk managers, office managers and support staff about the activities, and talking to competitors and other institutions in the market (such as exchanges), about the perceptions of the institution's activities and traders. It is only with an understanding and feel for the business that management will be able to ensure that it receives the right information and can ask the right questions. Senior managers at Barings did not have this level of understanding and also did not enquire into the activities of BFS in sufficient depth, even when a number of warning signals arose.

Responsibility for each business activity has to be clearly established and communicated

14.12	We have described in Section 2 of our report the ambiguities that existed in Barings concerning the reporting lines of Leeson. Whatever form of organisational structure is chosen by an institution, clearly defined lines of responsibility and accountability covering all activities must be established and all managers and employees informed of the reporting structure. The identification of accountability extends beyond profit performance to encompass risks, clients, support operations and personnel issues.
14.13	14.13 All institutions should maintain an up-to-date organisational chart which shows clearly all reporting lines and who is accountable to whom and for what. There must be no gaps and no room for any confusion so that the situation of one manager believing another manager has responsibility for an issue, and vice versa, is avoided. Each individual in the institution should have a job description which clearly identifies his or her responsibilities and to whom and for what he or she is accountable. It is often said that the de facto reporting lines are determined by those who propose or set remuneration levels. It is therefore important that this is recognised when forming the organisational structure, especially when a substantial portion of an individual's income is in the form of bonus.
14.14	The need for clarty in accountability becomes increasingly important in a structure where an individual is responsible to one manager for a certain part of the business and to one or other aspects of the business. This form of organisational structure is commonly referred to as a 'matrix' and was used by Barings. We make no criticism of the matrix style of management and, indeed, would observe that many institutions successfully operate such a matrix.
14.15	Nonetheless, there are some specific lessons to be learnt from the Barings collapse for organisations which operate a form of matrix structure. First, in a structure which has responsibility for products on a global basis and responsibility for operations on a local basis, the integrity of the controls over the activities of the local office must not be compromised. This means that the management of the local office must have a clear understanding of the business that is being conducted within the sphere of their geographical responsibility, notwithstanding reporting lines which are established along product lines. While local management may not be involved in day-to-day business decisions, it should have the authority to act to ensure that standards of control prescribed by the organisation are adhered to. Secondly, activities which are out of the mainstream may not find a natural home in the organisational structure and the risks of such activities being unmanaged and unsupervised is thus increased substantially. Close attention must therefore be given to ensuring a proper level of management control is exerted over such activities. Thirdly, because of the distribution of accountabilities and responsibilities in a matrix style organisation which involves dual reporting lines, effective communication between senior managers is essential.
14.16	When an institution is making significant changes to its organisational structure, as the case of Barings during the two years prior to the collapse, the risk of there being a lack of accountability for parts of the business or ambiguities in reporting responsibilities is substantially increased, particularly when the reorganisation involves bringing together business units having very different characteristics and management cultures. It is therefore important when an institution is moving from one structure to another, that senior management ensure lines of responsibility are clear and that there is independent monitoring of internal controls at each stage of transition.

Clear segregation of duties is fundamental to any effective control system

14.17

Perhaps the clearest lesson that emerges from the Barings collapse is that institutions must recognise the dangers of not segregating responsibility for 'front office' and 'back office' functions. Clear segregation of duties is a fundamental principle of internal control in all businesses and has long been recognised as the first line of protection against the risk of fraudulent or unauthorised activities. In the exceptional case of segregation of duties not being feasible due, for example, to the small size of the operation, controls must be established such that they compensate for the increased risks this brings, including close and regular scrutiny by internal audit. Management should also be wary of situations where it is apparent that only one individual is able to field all the key questions about a particular activity.

14.18

The term'back office' typically covers trade entry, settlements and reconciliations. By necessity, it is often the case that 'back office' personnel work closely with traders on a day by day basis. However, this close and necessary working relationship must not develop to the point where the 'back office' becomes subordinate to the traders, as it appears happened in BFS. Institutions should have documented procedures and controls covering all aspects of transaction processing, accounting and reporting. Personnel who are asked to deviate from these should question why, and if they are dissatisfied with the answer given should be encouraged to report the matter immediately to senior management.

Relevant internal controls, including independent risk management, have to be established for all business activities

14.19	A breakdown in, or absence of, internal controls at a basic and fundamental level enabled Leeson to conduct unauthorised activities without detection. Each institution must determine for itself the controls most relevant and applicable to its business. However, we draw attention to aspects of control which the collapse of Barings confirm are of crucial importance.
14.20	A significant lesson concerns the failure of Barings London adequately to establish and verify the purpose of various large payments to BFS before they were processed. A basic principle of prudent management is the maintenance of robust systems of verification and reconciliation in the settlements function, irrespective of whether the payments are to group companies or third parties.
14.21	A particular concern in the case of Barings was that the funding from London to Singapore, much of which purported to be on behalf of clients and which therefore apparently generated client credit exposure, was not subject to the same rigour of checks and verification as if the payments had been drawdowns on a standard loan arrangement. All institutions should ensure that they have controls to identify the point at wich a credit exposure may arise and to ensure that the exposure has been properly approved before payment is made. The sum of individual client loans should be reconciled to the total client loans shown in the balance sheet on a regular basis. Institutions which have acquired or developed securities businesses should take particular care to ensure that they have adequate controls over credit risk, an area which was weak in Barings.
14.22	A related matter concerns the co-mingling of house and client monies in payments made for margin. Institutions should distinguish between payments made on behalf of the house and those on behalf of clients; whenever possible before payment, but, failing that, as soon thereafter as possible, so that the necessary checks can be performed and the correct accounting entries raised.
14.23	A number of industry studies have strongly advocated the establishment within a financial institution of an independent risk management function overseeing all activities, including trading activities, and covering all aspects of risk. We support this view.
14.24	A primary objective of the risk management function is to ensure that limits are set for each business. These limits should reflect the risks being run and the level of risk that management is willing to take. The function also should serve as an independent check to ensure that traders operate within their limits; that exceptions are reported and actioned promptly; that sensitivity to changes in the market and their impact on the value of the position are assessed and reported; and should ensure that profits and losses are regularly recomputed and reconciled to the accounting records and, if necessary, the records maintained by the traders.
14.25	Unlike the situation at Barings, where Group Treasury and Risk focused on market and credit risk, an independent risk management function should oversee all types of risk. These other risks include: liquidity risk, concentration risk, operational risk, legal or documentation risk and reputational risk. Senior management in particular should be concerned about the risk of its institution attracting an adverse reputation and the impact of that on its business.
14.26	For the 'switching' activity, Barings only considered outright market risk (i.e. net long or short positions), reflected in the close of day market risk limit of zero and a small intra-day market risk limit. They did not establish gross position limits for each side of the 'switching' positions. Furthermore, an arbitrage business such as 'switching' attracts basis risk between two different markets (i.e. price movements are not one hundred percent positively correlated) and also exposes the institution to the settlement characteristics of these different markets, creating liquidity and funding risk. The events at Barings show the need for institutions to consider setting gross limits in respect of their arbitrage activities. Institutions should also consider allocating funding limits amongst its activities, relating them to the various risk limits.
14.27	Barings erroneously concluded that BFS's activities were low risk. Higher risk activities not only necessitate stronger and more extensive internal controls but also provide opportunities for higher remuneration levels for employees engaged in, or managing, them. We do not consider it is for us to suggest to institutions how they should reward their management and employees and, if there is a bonus element in the remuneration arrangements, how the bonus should be calculated,shared and paid. However, we would note that the opportunity to earn significant bonus based on revenue or profit, in relation to base salary, emphasises the need for vigilance in the design of the systems of internal controls.

Top management and the Audit Committee have to ensure that significant weaknesses, identified to them by internal audit or otherwise, are resolved quickly

14.28	A few months prior to the collapse, Barings established a group internal audit function. Prior to that the internal audit functions in the bank and in the securities business were separate and there was no effective communication between them.
14.29	For institutions engaged in a variety of activities we consider that the internal audit function should be established or overseen at group level. This would facilitate critic issues or weaknesses being communicated to top management on a timely basis and enable the head of internal audit to plan or review the allocation of resources across the entire group. The greater the size, risk, complexity or geographical spread of the business, the greater the need for experienced internal auditors with strong technical abilities and expertise in the relevant market sectors.
14.30	Internal audit should coordinate its activities with the external auditors and communicate key findings to them. The head of internal audit should have unrestricted access to the Chief Executive Officer, Chairman and the Chairman of the Audit Committee, irrespective of the person to whom he or she reports. Internal audit should be a core part of an institution's control systems and we think it essential that it is accorded a status in the organisation which it often lacks. One of the responsibilities of the Audit Committee should be to satisfy itself on the effectiveness of the internal audit function.
14.31	By the time of the collapse, neither senior management nor internal audit had followed up to ensure the implementation of the management actions as agreed following the recommendations in the October 1994 internal audit report on BFS. In preparing internal audit reports, major control weaknesses should be highlighted, and a management action plan to remedy the weaknesses should be agreed with a timetable It is the responsibility of management to implement internal audit recommendations and, when major issues arise, to ensure they are remedied expeditiously. In the case of weaknesses, internal audit should plan return visits within a short period of the completion of the audit to ensure corrective action has been taken. Failure of nt to implement recommendations within a timeframe agreed with internal audit should be reported to the Audit Committee.