The risk management system applied by Sberbank is based on standards and tools recommended by the Basel Committee on Banking Supervision and complies with the requirements of the world’s best practices. The main objectives of the integrated risk management system as an integral part of Sberbank’s management processes are the introduction of risk management standards, principles, limits, and restrictions, monitoring of the risk level and generation of risk reports, ensuring compliance of the level of assumed risks to fixed risk appetite limits, and the modeling and creation of a common risk profile.
To ensure the effective planning and control of accepted risks, risk management functions are distributed among the Supervisory Board, the Chairman of the Board, the CEO, the Executive Board, the supervisor of the Risk Unit (Head of the Risk Management Service of Sberbank), specialized committees of the Executive Board, business units of the Risk Unit, and other business units of Sberbank and members of the Group.
The Internal Audit Service is intended to support Sberbank’s control bodies in achieving their objectives and ensure the efficiency and high performance of Sberbank’s operations and operates in compliance with the principles of constant activity, independence, impartiality, fairness, objectivity, and professional competence. The Internal Audit Service is an independent structural unit that performs inspections of the entire system of internal control functioning; it is accountable to the Supervisory Board and is administratively subordinate to the CEO, Chairman of the Executive Board. The Head of the Internal Audit Service is appointed to and removed from office by the Supervisory Board.
In August 2016, OOO PricewaterhouseCoopers Advisory (PwC) conducted an external assessment of the Internal Audit Service of Sberbank for compliance with International Internal Audit Professional Standards. Main conclusions of external assessment: “The results of the analysis of internal audit performance make it possible to state that the activity of Sberbank Internal Audit Service is continuously improving. The strong points of the Bank’s Internal Audit Service are the qualification level of its employees and the quality of its audit reports.”
Sberbank shall take the necessary measures to ensure the independence and fairness of the Internal Audit Service and the seamless and efficient performance of the Internal Audit Service’s functions.
The Internal Audit Service conducts audits in all areas of Sberbank’s activities and monitors the effectiveness of the department and control body measures that reduce identified risks following audit results.
The Head of the Internal Audit Service provides the Supervisory Board with the Service’s reports on the implementation of the Yearly Audit Plan as approved by the Supervisory Board and on the results of Sberbank audits for the respective periods.
In its work, the Internal Audit Service uses the best internal audit practices, including the international fundamentals of the professional internal audit practice
To implement internal controls, assist the control bodies of Sberbank in ensuring the compliance of Sberbank’s activities to the laws, regulations, and best practices, as well as to create and apply effective methods and mechanisms for managing the risk of losses incurred by Sberbank as a result of noncompliance with the laws of Russia, internal documents of Sberbank, standards of self-regulatory organizations and/or sanctions, and/or other enforcement measures on the part of supervisory authorities, Sberbank established its Internal Control Service to comprise the structural business units and employees of Sberbank acting in accordance with the Regulations on the Internal Control Service.
The Internal Control Service acts in accordance with the principles of independence, continuity, objectivity, impartiality, and professional competence.
The Internal Control Service is accountable to the Supervisory Board, CEO, Chairman of the Executive Board and Executive Board of Sberbank. At least once annually, the Internal Control Service provides reports on completed work to Sberbank’s executive bodies and in certain cases to the Supervisory Board.
For the purpose of managing risks, Sberbank established the Risk Management Service, which comprises the structural units and committees of Sberbank, the main functions of which include risk management. To avoid any conflicts of interest, Sberbank ensured the independence of business units responsible for risk management from business units engaged in operations/transactions exposed to risks