Citibank 2015 Annual Report Download - page 84

66
Third Line of Defense: Internal Audit
Citi’s Internal Audit function independently reviews activities of the first two
lines of defense based on a risk-based audit plan and methodology approved
by the Audit Committee of the Citigroup Board of Directors. Internal Audit
also provides independent assurance to the Citigroup Board of Directors, the
Audit Committee of the Board, senior management and regulators regarding
the effectiveness of Citi’s governance and controls designed to mitigate Citi’s
exposure to risks and to enhance Citi’s culture of compliance and control.
The Chief Auditor reports functionally to the Chairman of the Citigroup
Audit Committee and administratively to the CEO of Citigroup. Internal
Audit’s responsibilities are carried out independently under the oversight of
the Audit Committee. Internal Audit’s employees accordingly report to the
Chief Auditor and do not have reporting lines to front-line units or senior
management. Internal Audit’s staff members are not permitted to provide
internal-audit services for a business line or function in which they had
business line or function responsibilities within the previous 12 months.
Three Lines of Defense
Business Management Accountability
Independent Assessment by Internal Audit
Oversight by Independent Control Functions
Business
Owns its risks
and is responsible for
managing its risks.
In-Business Risk Management
Identify and report risks
as they emerge and
communicate these risks to
Independent Risk Management and
other Control Functions.
The Independent Control Functions establish the second line of defense to enhance
the effectiveness of controls across products, business lines, and regions.
Internal Audit
Recommends enhancements on an ongoing basis and provides independent assessment and evaluation.
Functional Specialists
Advise on, contribute to,
execute, and/or oversee key
controls in support of the efficient
and effective management
of risk.
Risk
Compliance
Human Resources
Legal
Finance
1st
2nd
3rd
Citigroup Board of Directors and Committees of
the Board
Citigroup’s Board of Directors oversees Citi’s risk-taking activities. To do so,
directors review risk assessments and reports prepared by Risk, Compliance,
Human Resources, Legal, Finance and Internal Audit and exercise
independent judgment to question, challenge, and when necessary, oppose
recommendations and decisions made by senior management that could
cause Citi’s risk profile to exceed its risk appetite or jeopardize the safety and
soundness of the firm.
The standing committees of the Citigroup Board of Directors are the
Executive Committee, Risk Management Committee, Audit Committee,
Personnel and Compensation Committee, Ethics and Culture Committee,
Operations and Technology Committee and Nomination, Governance and
Public Affairs Committee. In addition to the standing committees, the Board
creates ad hoc committees from time to time in response to regulatory, legal,
or other requirements.