Corporate governance

Internal Control, Auditing and Accounting

Internal control
Internal Control at Arion Bank is organized into three lines of defence with the aim of ensuring effectiveness, defining responsibility and coordinating risk management. This structure is also designed to foster a sense of risk awareness and responsibility among all employees of the Bank.

The set-up distinguishes between the following roles: 

• People who bear and manage risk
• People who monitor and check internal controls
• People who perform an independent survey of the effectiveness of internal controls

The first line of defence is made up of people who have day-to-day supervision of the relevant business and its organization. They are responsible for maintaining effective internal controls and managing risk in day-to-day operations. This involves identifying and evaluating risks, putting in place appropriate management tools and countermeasures and supervising the implementation of internal rules and processes, while also ensuring that everything is in compliance with established rules and procedures so that objectives are met. Finally, they are responsible for taking appropriate corrective action in response to conceivable failures or deficiencies.

The second line of defence is set up to ensure that the first line of defence has established adequate internal controls and that it works as intended. Risk Management and Compliance are the main participants in the second line of defence, although other units may also be assigned specific monitoring roles.

The third line of defence is Internal Audit, which keeps the Board and management fully informed of the quality of corporate governance, risk management and internal controls, including how the first and second lines of defence meet their objectives, and by performing independent and objective audits.

Compliance and measures against money laundering and terrorist financing 
Arion Bank seeks to detect any risk of failure to fulfil its legal obligations and has taken appropriate measures to minimize such risks. 

The Bank employs an independent Compliance Officer in accordance with a charter from the Board of Directors. The role of the Compliance Officer includes the following: 

Risk Management 
A central feature of the activities of all financial companies is carefully calculated risk-taking according to a predetermined strategy. Arion Bank thus takes risk which is compatible with its risk appetite which is regularly reviewed and approved by the Board of Directors. The Bank’s risk appetite, set by the Board, is translated into exposure limits and targets that are monitored by Risk Management. The Board is responsible for Arion Bank’s internal capital adequacy assessment process, the main objective of which is to ensure that Arion Bank understands its risk profile and has systems in place to assess, quantify and monitor its total risk exposure. 

Risk Management is managed by the Chief Risk Officer. The division is an independent unit and reports directly to the CEO. Risk Management comprises five departments whose role is to analyze, monitor and regularly report to the CEO and Board of Directors on the risks faced by the Bank.

Further information on risk management and capital management is contained in the section on Risk Management and in the Bank’s risk report.

Internal Audit 
The Internal Auditor is appointed by the Board of Directors and reports directly to the Board. The Board sets the Internal Auditor a charter which lays out the responsibilities associated with the position and the scope of the work. The mission of the Internal Auditor is to provide independent and objective assurance and advice designed to add value and improve the Bank’s operations. The scope of the audit is the Bank, most of its subsidiaries and pension funds serviced by Arion Bank.

The audit is governed by the audit charter, directive No. 3/2008 issued by the FME on the internal audit function in financial institutions and international standards on internal auditing. All audit work is completed by issuing an audit report with deadlines for the implementation of audit findings. Implementations are followed up by the Internal Audit every quarter. 

Internal Audit had eight employees at the end of 2014.

Auditing and accounting 
The Bank’s Finance division is responsible for the preparing the accounts and this is done in accordance with the International Financial Reporting Standards (IFRS). The Bank publishes its financial statement on a quarterly basis and management statements are generally submitted to the Board 10 times a year. The Board Audit and Risk Committee examines the annual financial statement and interim financial statements, while the external auditors review and audit the accounts twice a year. The Board Audit and Risk Committee gives its opinion on the accounts to the Board of Directors, which then approves and endorses the accounts.

Customers' Ombudsman

The Customers’ Ombudsman is appointed by the Chief Executive Officer. The role of the Ombudsman is to ensure fairness and objectivity, prevent discrimination against the customer and make certain that the process for handling cases is transparent and documented. The Customers' Ombudsman examined 202 cases in 2014, compared with 186 cases in 2013.

Cornerstones, code of ethics and corporate social responsibility

Arion Bank’s Cornerstones are names used to describe its core principles. The Cornerstones are designed to provide guidance when making decisions and in everything else employees say and do. They refer to the Bank’s role, attitude and conduct. Arion Bank’s Cornerstones are: We make a difference. We get things done. We say what we mean. 

The management and employees of Arion Bank are conscious of the fact that the Bank’s activities affect different stakeholders and society at large. The Bank’s code of ethics is designed to serve as a key to responsible decision-making at Arion Bank. The code of ethics is approved by the Board of Directors. 

One of the fundamental principles of corporate social responsibility is to align the interests of companies with those of the wider community. Arion Bank is a responsible member of Icelandic society and as such takes an active role in its construction and future development. Corporate social responsibility means that the Bank must perform its role conscientiously, ensuring that its customers receive first-rate services and get the support they need. In addition Arion Bank supports a select number of causes which it believes benefit and improve the community, such as: Innovation, environmental issues, financial education, sports, culture and charities. Many of these projects require the active participation of employees, which is the key to achieving results.