1. NATIONAL BANK OF PAKISTAN
CHAK KHASSA BRANCH JHELUM 1383
SEPTEMBER 16, 2014
HOW TO IMPROVING INTERNAL CONTROL REPORT

2. 1
ACKNOWLEDGEMENT
God Almighty is worthy of all acknowledgments…………..
No one can say that I am perfect, everyone should admit that without the help of ALLAH and His people a
man can’t get anything so I bow my head before almighty Allah Who has given me strength and mentor
capability to accomplish this mammoth task.
I salute to all individuals who have helped me in my project “How to improve internal control”. I humbly
extend my thanks to Mr. Shahid Saleem for his candid guidance and continuous support and
encouragement during the accomplishment of my Project Report on “Internal control in NBP Chak Khassa
Branch Jhelum (Survey of different departments)”. I am thankful to my teacher for giving me this
opportunity and build up confidence. I hope this effort on my part will come up to your expectations.
The last but not least, I would feel incomplete without thanking to my parents who pray for my
brilliant success and bright future.
BY:
ZEE WAQAR ANWAR

3. 2
Introduction
When you walk into a bank as a client to benefit from the services on offer, the transaction may be a simple
cash deposit or as complex as of availing a credit facility. All of these transactions whether simple or
complex are possible due to certain standard procedures and workflows. All of which as much as they may
facilitate us pose a challenge to be monitored round the clock for protection of the interests of all the
stakeholders.
Straddling the formal and informal financial sectors, the microfinance industry also recognizes the
importance of effective internal control. As National Bank (NBP) grow and more operate as regulated
financial intermediaries, internal control becomes essential to long-term institutional viability. The number
and types of stakeholders concerned with the NBP financial well-being increases: donors desire to support
sustainable microfinance project; board members want to protect their reputations and fulfill their
obligations; investors are interested in preserving capital; borrowers are concerned with continuous access
to loans; depositors want to ensure the safety of their savings; and regulators want to protect the financial
environment and depositors’ interests.
1. To verify the efficiency and effectiveness of the operations;
2. To assure the reliability and completeness of financial and management information; and
3. To comply with applicable law and regulations.
Objective of internal control
1. Efficiency and effectiveness of activities (performance objectives)
2. Reliability, completeness and timelines of financial and management
3. Information (information objectives)
4. Compliance with applicable laws and regulations (compliance objectives)
5. Accountability to the board
Practitioners often confuse internal control with internal audit, which is an integral part of internal control.
While internal audit focuses solely on evaluating risk management “ex-post” (after operations), internal
control comprises both the “ex-ante” and “ex-post” (before and after operations) measures to control risks.
In other words, internal audit is just one component of the internal control process. This document uses the
following concise definitions to discuss risk management
Risk management is a systematic approach to identifying, measuring, monitoring and managing business
risks in an institution. Internal control comprises the institution’s mechanisms to monitor risks before and
afteroperations. Internal audit is a systematic “ex-post” appraisal of an institution’s operations and financial
reports.
National Bank use internal control mechanisms to ensure that staff respecttheir organizational policies and
procedures. However, internal control alone cannot ensure that the NBP is adequately minimizing its risk
exposures. Only if the NBP risk management strategies are effectively integrated into its policies and
procedures can the internal control function support risk minimization. For example, an NBP experiencing
increasing arrears might decide to reduce its exposure to credit risks, by developing stricter lending
requirement or limiting increases in loan sizes for renewals. The NBP links internal control to risk
management by creating mechanisms to evaluate the results of these delinquency reduction efforts, such as
by requiring branches to regularly monitor portfolio quality and conduct client visits to verify loan officers’
adherence to the new policies.

4. 3
Internal control and internal audit play important roles in the risk management feedback loop, in which the
information generatedin the internal control processis reported back to the board and management. Internal
control mechanisms work to improve decision making by ensuring that information is accurate,complete
and timely so that the board and management can respond to control issues promptly as they arise. In
addition, if the NBP links its internal control mechanisms to risk management, internal control can identify
remaining risk exposures and inform management.
We will discussed some points we saw in NBP Branch Chak Khassa Jhelum.
Checking of the Peoples come into the Bank
The law and order situation of the country is well non to everyone. So, it is necessary that every person
should be thoroughly checked and assured that he has no bad intention. Such a checking should also be
made for the person living the bank when the time is over. It is made assured that no one is carry anything
out of the bank which can be harmful to the bank in future.
Transaction
While dealing with cash transaction the bank officer should strictly fallow regular and regulations and
SOP’s of the NBP issued from time to time. In case of any doubt about the person who is before the bank
officer it is necessary that his identification be made satisfied by checking his/her signature and through
other sources such person should not be dealt causally.
Cheque Verification
The should be verified by telling the signature with the given specimen in case of any doubt. In case a
person is producing a cheque of other person, his identification should be made clear by heaving his
signature duly attested by the owner of the cheque and also collecting his I.D card etc.
Cashier Protection
When a cashier is dealing with the customers, no other person maybe a bank employee or an ex-employee
of the bank what so ever, should no enter his cabin when the time is over, before leaving the cabin, the
cashier should collect and deposit the remaining cash in the strong room. He should also complete his
voucher regularly every day.
Cashier should maintain in his cash book daily and should submit to its copy to the manager. Thus this cash
book will go through two persons and a chance of any mistake will vanish.
Favoritism / Latitude
A bank officer of NBP must be well aware of the rules and regulation given by the State Bank of Pakistan.
He should work according to these rules. He should never take in to the account of his customer’s
circumstances weather he is neighbor, a very old person, sick and needy, relative or his old friend etc. he
should deal all cases according to the rules.
“Sometime a customer desires that the pension of his father may be paid to him. His father being a very old
person has become insane and his not able to come to the bank. The cashier becomes lenient & shows
negligent to the banks SOP and pays the pension to the unauthorized pensioner. Whereas the customer
should provide the bank a medical certificate andauthority letter by his fatherduly attestedby the competent
authority as per bank’s SOP. But this care has not been observed.”

5. 4
Account Opening
A bank officer becomes very happy when a new customer comes to open his bank account. Sometimes
account from are filled in casually and sometimes certain columns are left unfilled to be completed or next
day or other this practices should be stopped all information about the new customer should be collected
completely column the rule and regulation of the bank.
Remittance
A great number of peoples come to the bank to collect the remittances sent by their relatives abroad. Before
making the payment, a bank officer should satisfy himself about the identification of the beneficiary
according to the SOP and other rules of the bank.
Documentations
Sometime a customer comes to activate his or his wife and his mother in law’s joint dormant account. In
this case he should go through a procedure to activate a dormant account given by the State Bank. When
his going through this producer he has been paid his desire cheque whereas the desire papers or not yet
been provided by the customer.
Gold Loan
A gold loan is considered an easytask in this bank. In many casesloan hasbeen issued whereasthe relevant
documentation has not been fully completed. If in a case the signature of the witness has been committed
and then other case the verification of the customer has not been cared.
Advance Salary Loan
The loan against salary has been dealt very causally. In some cases the witness oblige guarantor has never
appeared in the bank. The customer simply provides a copy of the ID card and signature of the guarantor.
In some cases the documentations has not been completed perfectly.
Running Finance
In case of running finance it is observed that the bank rules and SOP are not strictly fallow by the dealing
officer. Sometimes the signature or documents of the witness or left supposing that these think should be
collected tomorrow or the day of after tomorrow. In such cases the documentation is often left incomplete.
It is necessary that the witness and the barrower,all concerned person should appear before bank manager
for heaving alone. All type of casual attitude should be avoided.
Pensioners
The payment of the pension is a very delicate affair of the bank. Sometimes the pension of the deceased
pensioners is drawn by the bank officials and sometimes the pension of the deceased person is availed of
by their relatives etc. with the consent of the bank officials. This is a very serious crime which should be
handled with iron hand.
The officer who signs the certificate that the pensioner is alive on the date of pension and has signed the
pension bill in my presences, should be held responsible in any misshapen. A bank manager should be
careful of deceased pensioners. If in a month, for an example 450 draw their pension instead of 500
registered pensioners with the bank, he should collect the particulars of 50 missing pensioners. If he found

6. 5
that 35 out of 50 are dead and they are not truing back to the bank since last some months, so he should
inform the head office about 35 dead pensioners well in time. Even then some case of found that the dead
pensioners have not been inform to the head office the bank manager should be held responsible.
In some cases a pensioner is very old or he is ill and can’t come to the bank so the person who wishes to
draw the pension in his place, should provide an authority latter from the pensioner or a medical certificate
of the pensioner duly attested by the relevant court. Any type of favoritism and a casual attitude should be
strictly avoided.
Review of Documents
Review documents is very important role in improving to internal control. The branch manager should
review the documents before closing the office daily.
Non-Financial Report
Any change in the title of an account specially when a dormant account becomes active again, should be in
the notice of the branch manager. All relevant documents in this regard should be properly maintained and
nothing should be left black are postponed for the other day.
Large Report (ATS)
The bank officials should maintain the large report (ATS) in proper order they should give remarks against
every transaction which is 300000 or above, that the beneficiary has been identified properly and all
documents pertaining to him has been properly filled in and maintained. The branch managershould review
these documents at the end of the day.
Effective MIS system
An effective management information system (MIS) is one that focuses on a few key indicators for each’s
level of responsibility and produces accurate, timely and relevant information. Additionally, the MIS can
incorporate early warning flags for management. For example, NBP branch managers receive daily reports
on delinquent accounts per loan officer ranked by number of days delinquent. An aging report such as this
allows the branch manager to monitor more closely the work of those loan officers whose portfolios are
experiencing increasing delinquencies. Refer to CGAP’s Handbook for Management Information Systems
for NBP for more information on good reporting.
Clear accounting systems
In general, NBP should follow standard accounting practices and make efforts to clarify non-standard
practices. NBP uses a cash-based accounting system, which records income and expenses only when cash
changes hands, because it considers it more transparent than the traditional accrual-based accounting.
Accrualaccounting records transactions when they come due as opposed to when the cash actually changes
hands. NBP that use the accrual method should be careful to record accrued interest in conjunction with
delinquency to avoid reporting unrealistic income. Whether an NBP uses a cash or accrual system, or a
hybrid of the two, the key is to ensure that the accounting method used is transparent and consistent.
Simplicity
NBP can reduce the chance for fraud and errors in operations if procedures are simple, clear and well
communicated to employees and clients.

7. 6
Simple products and procedures
To increase transparency and to reduce the need for sophisticated staff oradvanced training, NBP has
simple products and maintains simple procedures and systems for its operational staff. For example, NBP
Head Office has maintained a standard system procedures for all its products while account mapping is a
necessary in all products which helps the bank to calculate markups on daily basis on all products where
branch staff has to input the mandatory data like interest rate, markup accrualfrequency & the time period
for which loan has been given to the customer, system automatically calculates the earnings on daily basis
& also mark every loan in sub-standards, doubt-full & loss. NBP should weigh the benefits of using simple
procedures against the potential loss of flexibility and reduced customer satisfaction.
Clearly written operations manual
As in traditional financial institutions, National Bank of Pakistan has developed different operations
manuals for each type of banking facility offered to its client’s i.e.
 Operations Manual for Branch Day to Day Work
 Credit Manual to deal with all the Credits facilities offered to client
 Credit Administration Manual which helps the bank officials to look after the pre & post
disbursement lapses at branch level
 Compliance Manual helps bank officials to regularly check the transactions at branch level & also
helps them to comply with the bank’s instructions
 STANDARD PROCEDURAL MANUAL 2008 Revised has all the issues discussed regarding the
duties & obligations of bank’s staff
Whereas this is the changing world so do the bank’s change as well. NBP regularly reviews all the manuals
& banking procedure. It updates its staff members down the line by issuing the instructions circulars which
are totally based after analyzing the market scenario.
Security
Another important element of risk management is to protect physical assets from harm. The following
security measures are common in NBP.
Safes, locks, and guards
NBP that store cash in the branch or unit office safeguard it by storing it in a safe or strong box. A safe
directly into the branch office building so that thieves cannot steal the branch’s money by confiscating the
entire safe. NBP has a two-key system whereby the unit manager and one other unit employee each hold
one of the two keys required to open the safe. Security measures should match the risk. For example, all
NBP units have locks on doors and windows, security alarms and a night guard, but units that are located
in cities where crime is prevalent also have bars covering the windows.
The physical fitness of the security guard and the proper working of their arms should be checked by a
police officer from time to time and a report in this regard should be submitted to the manager as well as to
the DPO.
Back-up files
NBP should have some system whereby branch information is protected from destruction or loss. NBP that
maintain a computerized database should create daily back-up files and store them off- site. NBP canprotect
non-computerized information systems by storing duplicate copies in another location. The proper working

8. 7
of the computers installed in NBP should me monthly checked by the IT department so that any fiber crime
and any disturbance in the computer due to any fault maybe avoided.
Camera
CCTV is very important at the branch level. In case of any accident this recorded video can be very helpful
to find solutions. With the advancement of technology and the recording system daily footage can be stored
and used effectively in future. This system provides evidents regarding any hazard. Use of this technology
enabled a secure and progressive system in an organization.
Insurance
The NBP has a very strong financial background it is a very good quality that the bank is itself insured with
top level insurance companies. In case of fire, theft and robbery the loss will be paid by the insurance
companies and will not be shifted to its customers. On the other hand the bank provides insurance policies
to his customers against the natural calamities like flood, fire and earthquake etc.
Password Sharing
Password sharing is used to keep a personal secret if other person’s share that password and the owner of
the password is not serious about it than any type of accident can take places. If there is a need to have any
common word for the other user then it should be made assured that in case of any sort of accident/incident
the all user will be held responsible of the loss etc.
Addressing fraud risks
In some cases,clients or loan officers provide inadequate, false or misleading data used for making the
loan decision with the intent to defraud the NBP. The most common types of fraud by employees are
fictitious loans, kickbacks, and misallocation of client funds.
Minimizing transaction risk
In the processing of loans, NBP expose themselves to transaction risk since its employees are human and
therefore make mistakes that can result in financial loss. For example, a loan officer may accidentally
register a loan payment as a deposit in the client’s savings account. While computerization can reduce the
risk of human error in making calculations, systems are limited by the data entered by the employees. NBP
can reduce the transaction risk involved in loan processing by hiring competent employees and making
sure that they understand all steps involved in processing loans. The simpler the products, procedures and
systems, the less likely employees will make errors that result in financial loss to the NBP.
Common internal controls
Common internal control measures inherent in policies and procedures include the segregation of duties,
setting limits on cash or expenditures, signature requirements, physical controls and regular operational
crosschecks. These controls are built into daily operations to minimize risk before it occurs. These controls
are frequently applied to manage credit and transaction risks in NBP.
Segregation of duties
Segregation of duties involves the separation of responsibilities for two or more tasks that could result in
error or encourage dishonest behavior if only handled by one employee. For example, many NBP assign
the responsibility for procurements and checkwriting to two different employees. Unless the two employees

9. 8
collude to defraud the institution, this control reducesthe risk of purchasesbeing made based on self-interest
or for purposes outside of the organization’s interests.
Limits
Limits are used to set parameters of normal behavior. A common operational limit is to put a cap on the
amount of cash allowed in a branch at any point in time.
Signature requirements
NBP can use signature requirements to protect the institution from unauthorized transactions. For example,
NBP now requires branch managers to sign off on all loan disbursements to avoid a repeat of fake loans
being issued by a loan officer.
Physical controls
Physical controls are measures taken to verify the existence of assets reported on the NBP books. For
example, like NBP count the cash in the vault and reconciles it with the amount recorded in the cashbook
on a daily basis.
Crosschecks
NBP require crosschecks as an assurance that policies and procedures are respected. For example, regional
managersat NBP visit clients to verify thatloan officersfollowed proper lending procedures and adequately
assessed client risk.
Dual controls
Dual controls act as backstops to decision making by having at least one other employee check or approve
a transaction. For example, some banks assign the authority for loan approvals to a credit committee,
thereby spreading the responsibility over several individuals.
Computer-related controls
If its operations are computerized, the NBP exposes itself to two types of risk that require additional
controls: integrity risk - the risk that non-authorized individuals will gain access to sensitive data, and
management information systems risk - the risk of losing key information in the event the system crashes.
Systems fraud, involving employee manipulation ofthe database or the computer system, can be the
most costly to NBP
A strict policy has already been introduced in the bank regarding the system passwords sharing in the
branch, strict disciplinary action is been introduced in the bank to avoid the systematic fraud.
Integrity risk controls
Bank has already been following policy to authorize different users with different authorities, bank has
introduced a system while branch manager, operations managers, officers, compliance officers & other
officials has been using the bank’s computer systems with their respective authorities designated by the
competent authorities and allowed by the regional data center at respective regions and head office.

10. 9
MIS risk controls
NBP mitigate the risk of losing key information from the database by creating back-up files and storing
them at one or more other locations, such as at the home of one of the employees or at another branch or
headquarters. These controls are known as management information system risk controls.
Integrating Controls into Operations
Next, the NBP should solicit employee and client feedback to understand the full effects of the internal
controls selected. Once the NBP is confident of its selection of internal controls, it can begin to implement
them into operations. In so doing, the NBP assigns responsibility to management to oversee their effective
implementation and to monitor staff adherence to related policies and procedures.
Soliciting Feedback
Employees can offer valuable feedback on the potential repercussions of implementing specific internal
controls.
CONCLUSIONS AND
RECOMMENDATIONS
National Bank of Pakistan grow and become formal financial institutions, the need for internal control
systems increases. NBP has a unique risk profile and operational structure that determine which types of
controls are appropriate, this chapter presents general conclusions and recommendations that apply to the
NBP.
Conclusions
 It is necessary for the bank’s management to develop an HR policy for recruitment in the bank.
 Local staff hiring is highly recommended in the bank in order to develop a competitive business &
operational workforce.
 It is very important to train the staff with the new banking systems introduced in the bank.
 Staff transferfrom one branch to another branch afterthree years must be made sure by the regional
management to avoid the fraudulent activity in the bank.
 To avoid the frauds and forgery a strict compliance is required in the bank.
 Check all vouchers daily bases
 Verify all documents with the relevant evident
 Staff should be efficient and hard-worker
 Branch fallows the Rules, Policies and SOP
 Hire more Staffs for improving internal control
 Every Documents should keep in safe properly
 Everybody know job description and define job boundaries
 Increase staff for improve internal control