Please refer to BSD Circular No. 07 of 2004 on ‘Guidelines on Internal Controls’, BSD Circular No. 05 of 2009, BSD Circular No. 03 of 2010 and other instructions issued on the subject of Internal Controls over Financial Reporting (ICFR) from time to time.

2. In order to facilitate banks/ DFIs in effective implementation of ICFR, the following minimum set of instructions is being issued for their meticulous compliance:

2.1 Banks/ DFIs, which are yet to complete ICFR roadmap, shall complete the same by September 30, 2014, and meanwhile undertake the following activities:

2.1.1 Submit to Off-Site Supervision and Enforcement Department (OSED), a quarterly stage-wise status report on the extent of ICFR roadmap completed, duly approved by at least Board’s Audit Committee, till completion of the roadmap. The timeline for submission of ICFR status report for first and third quarters shall be within one month following the quarter to which it relates; while for second quarter, it shall be within two months of close of the quarter.

2.1.2 Statutory Auditors shall issue Long Form Report (LFR) on ICFR roadmap as of December 31, 2013, irrespective of stages completed, which shall be submitted to OSED.

2.2 After completion of ICFR roadmap and submission of LFR by statutory auditors thereupon, the bank/ DFI may apply to the State Bank of Pakistan (SBP) for exemption from the requirement of statutory auditors’ assessment. The SBP will review and decide on exemption subject to satisfactory level of compliance or otherwise .

2.3 In case, the SBP allows above exemption, Audit Committee of the Board will be responsible for submission of annual assessment report on efficacy of the ICFR to OSED within three months of the year end. In case of foreign banks operating in branch mode, their Head of Internal Audit/ Internal Audit Controlling Function will submit ICFR’s assessment report. In order to avail this option, the foreign banks will have to submit evidence of functional independence of their internal audit from the local management.

2.4 Banks/ DFIs, having incomplete ICFR roadmap; or which desire to continue with the statutory auditors’ assessment; or have not been allowed exemption by SBP till 31 st December of the given year, shall continue to submit annual LFR of that year issued by statutory auditors within three months of the year end .

3. All banks/ DFIs are also required to follow the requirements as prescribed in 'Annexure – A’ to this Circular regarding (a)ICFR Disclosure in Annual Report and (b)Governance Structure – Roles and Responsibilities of Key Stakeholders of ICFR.

4. Moreover, to facilitate implementation of ICFR, some additional guidance at ‘Annexure – B’ of this Circular is being provided based on the findings of Long Form Reports received from the banks/ DFIs.

5. The Long Form Report by statutory auditors or assessment report by the Board’s Audit Committee for the year ended December 31, 2013 shall be submitted by June 30, 2014. However, the said reports for the year ending December 31, 2014 and onwards shall be submitted as per the timelines prescribed in para 2.3 and 2.4 above.

6. All banks/ DFIs are required to follow above instructions, failing which punitive action shall be taken under provisions of the Banking Companies Ordinance, 1962. All other instructions on the subject shall remain unchanged.

Please acknowledge receipt.

Annex-A   Annex-B