Principle 17: Banking supervisors must have regular contact with bank management and a thorough understanding of the institution's operations.

Principle 18: Banking supervisors must have a means of collecting, reviewing and analysing prudential reports and statistical returns from banks on a solo and consolidated basis.

Principle 19: Banking supervisors must have a means of independent validation of supervisory information either through on-site examinations or use of external auditors.

Principle 20: An essential element of banking supervision is the ability of the supervisors to supervise the banking group on a consolidated basis.

Supervision requires the collection and analysis of information. This can be done on or off-site. An effective supervisory system will use both means. In some countries, on-site work is carried out by examiners and in others by qualified external auditors. In still other countries, a mixed system of on-site examinations and collaboration between the supervisors and the external auditors exists. The extent of on-site work and the method by which it is carried out depend on a variety of factors.

Regardless of their mix of on-site and off-site activities or their use of work done by external accountants, banking supervisors must have regular contact with bank management and a thorough understanding of the institution's operations. Review of the reports of internal and external auditors can be an integral part of both on-site and off-site supervision. The various factors considered during the licensing process should be periodically assessed as part of on-going supervision. Banks should be required to submit information on a periodic basis for review by the supervisors, and supervisors should be able to discuss regularly with banks all significant issues and areas of their business. If problems develop, banks should also feel that they can confide in and consult with the supervisor, and expect that problems will be discussed constructively and treated in a confidential manner. They must also recognise their responsibility to inform supervisors of important matters in a timely manner.

1. Off-site surveillance

Supervisors must have a means of collecting, reviewing and analysing prudential reports and statistical returns from banks on a solo and consolidated basis. These should include basic financial statements as well as supporting schedules that provide greater detail on exposure to different types of risk and various other financial aspects of the bank, including provisions and off-balance sheet activities. The supervisory agency should also have the ability to obtain information on affiliated non-bank entities. Banking supervisors should also make full use of publicly-available information and analysis.

These reports can be used to check adherence to prudential requirements, such as capital adequacy or single debtor limits. Off-site monitoring can often identify potential problems, particularly in the interval between on-site inspections, thereby providing early detection and prompting corrective action before problems become more serious. Such reports can also be used to identify trends not only for particular institutions, but also for the banking system as a whole. These reports can provide the basis for discussions with bank management, either at periodic intervals or when problems appear. They should also be a key component of examination planning so that maximum benefit is achieved from the limited time spent conducting an on-site review.

2. On-site examination and/or use of external auditors

Supervisors must have a means of validating supervisory information either through on-site examinations or use of external auditors. On-site work, whether done by examination staff of the banking supervisory agency or commissioned by supervisors but undertaken by external auditors, should be structured to provide independent verification that adequate corporate governance exists at individual banks and that information provided by banks is reliable.

On-site examinations provide the supervisor with a means of verifying or assessing a range of matters including:

• the accuracy of reports received from the bank
• the overall operations and condition of the bank
• the adequacy of the bank's risk management systems and internal control procedures
• the quality of the loan portfolio and adequacy of loan loss provisions and reserves
• the competence of management
• the adequacy of accounting and management information systems
• issues identified in off-site or previous on-site supervisory processes
• bank adherence to laws and regulations and the terms stipulated in the banking licence.

The supervisory agency should establish clear internal guidelines related to the frequency and scope of examinations. In addition, examination policies and procedures should be developed in order to ensure that examinations are conducted in a thorough and consistent manner with clear objectives.

Depending on its use of examination staff, a supervisory agency may use external auditors to fulfil the above functions in whole or in part. In some cases, such functions may be part of the normal audit process (e.g. assessing the quality of the loan portfolio and the level of provisions that need to be held against it). In other areas, the supervisor should have adequate powers to require work to be commissioned specifically for supervisory purposes (e.g. on the accuracy of reports filed with supervisors or the adequacy of control systems.) However, the work of external auditors should be utilised for supervisory purposes only when there is a well-developed, professionally independent auditing profession with skills to undertake the work required. In these circumstances, the supervisory agency needs to reserve the right to veto the appointment of a particular firm of external auditors where supervisory reliance is to be placed on the firm's work. In addition, supervisors should urge banking groups to use common auditors and common accounting dates throughout the group, to the extent possible.

It is also important that the supervisors and external auditors have a clear understanding of their respective roles. Before problems are detected at a bank, the external auditors should clearly understand their responsibilities for communicating with the supervisory agency and should also be protected from personal liability for disclosures, in good faith, of such information. A mechanism should be in place to facilitate discussions between the supervisors and the external auditors. In many instances, these discussions should also include the bank.

In all cases, the supervisory agency should have the legal authority and means to conduct independent checks of banks based on identified concerns.

3. Supervision on a consolidated basis

An essential element of banking supervision is the ability of the supervisors to supervise the consolidated banking organisation. This includes the ability to review both banking and non-banking activities conducted by the banking organisation, either directly or indirectly (through subsidiaries and affiliates), and activities conducted at both domestic and foreign offices. Supervisors need to take into account that non-financial activities of a bank or group may pose risks to the bank. Supervisors should decide which prudential requirements will be applied on a bank-only (solo) basis, which ones will be applied on a consolidated basis, and which ones will be applied on both bases. In all cases, the banking supervisors should be aware of the overall structure of the banking organisation or group when applying their supervisory methods. Banking supervisors should also have the ability to coordinate with other authorities responsible for supervising specific entities within the organisation's structure.