Roundtable Discussion with Audit Committee Members Toward more advanced internal auditing

Governance

Roundtable Discussion with Audit Committee Members

Toward more advanced internal auditing

Current status and goals of the Bank's internal auditing

When constructing a sustainable business model, it is essential to ensure the appropriateness of both operational and financial soundness through the effective functioning of governance. With this in mind, the Nanto Bank Group is currently revising its business model to optimize its internal audits.

The Financial Services Agency (FSA) has published the results of its monitoring of financial institutions' internal audits and its observations concerning the issues involved in the publication, "Current Status and Issues for Enhancing the Sophistication of Internal Audits" ("Current Status and Issues" hereinafter).*1 Five Audit and Supervory Committee members, Outside Directors Shuhei Aoki and Yoshihiko Kasuya, Director Takao Handa,*2 Executive Vice President Satoshi Ishida, and Audit Department Executive Director Seiichi Kitazawa, met recently to exchange opinions on the current status, pending issues, and future goals for upgrading the Bank's internal audits.

*1 The standard for internal audits must be raised to the first stage "clerical deficiency audit," the second stage "risk-based audit," the third stage "management audit," and the fourth stage "trusted advisors." Even after the publication of "Current Status and Issues," financial institutions are encouraged to upgrade their internal audits through inspections and monitoring.

*2 As of the date of the roundtable discussion

Upgrading internal audits by financial institutions

Ishida: Since FY2023, the Bank has been strengthening its efforts to raise its internal audits to a higher level from the perspective of maintaining and enhancing corporate value.

Upgrading of our internal audits is an important part of our efforts to build a sustainable business model in an increasingly complex, diverse business environment.

Meanwhile, in October 2023, the Financial Services Agency released its "Progress Report (Interim Report) on Advancement of Internal Auditing at Financial Institutions" ("Interim Report" hereinafter), which presents three perspectives*3 to ensure the appropriateness and financial soundness of operations and increase corporate value through effective internal auditing.

Today, at a time when internal audit reform is a requisite part of corporate governance reform, we would like to engage you in a discussion of the best way to upgrade and enhance our internal audits.

*3 "Support for internal audit departments by management, audit committee members, and corporate auditors," "Efforts to enhance the sophistication of internal audit departments," and "Actions to be taken concerning audited departments."

74 Nanto Report 2024, the integrated report of Nanto Bank

Kitazawa: Originally known as "inspection departments," financial institutions' internal audit departments formerly conducted "clerical deficiency audits" audits to check for deficiencies in documents and deviations from regulations with respect to the rules and regulations governing clerical work.

Despite the discussions we are currently conducting with management aimed at elevating the Bank's internal audits to the second stage, "risk-based audits," and then to the third stage, "management audits," we still tend to focus on traditional

auditing (prevention of fraud and misconduct and identifying clerical deficiencies).

We believe that this reflects the facts that the old perception of the Audit Department as a body that uncovers and corrects past errors remains deeply rooted in both the auditing and audited departments, and that the need for "management auditing," which will be required of internal audits in the future, has not fully penetrated the departments. From the perspective of preventing misconduct, on the other hand, I remain strongly convinced of the necessity of ensuring that "clerical deficiency audits" should also be carried out in connection with "risk-based audits." I would like to take this opportunity to thank you all for your candid feedback today.

Average maturity level of regional financial institutions

Handa: I do not believe that the current status of the Bank's internal audits has advanced beyond the stage of "clerical deficiency audits," although it is on the doorstep of the "risk-based audit" phase. In the eight years since I became an auditor, I have developed a deeper level of dialogue with the Audit Department, and since the FSA released its "Current Status and Issues" in 2019, I have seen the Audit Department become increasingly aware of the need to move up to "risk-based auditing" and take up the struggle of policy change.

Why is the Audit Department struggling to transition fully to the second phase? I have examined the situations at several branches to see how the subjects of the audits perceive the transition to "risk-based auditing."

This examination revealed that the transition of audit policy from "clerical deficiency audits" to "risk-based audits" has not been fully communicated to the subjects of the audits, the branch offices or the Head Office, and that the audited departments are not fully aware of the change.

The audited branch offices continue to see an audit as "an opportunity to check for clerical deficiencies." To change this perception, it will be important to start by seeking a broad understanding of the position and importance of the Audit Department and the nature of internal audits.

Aoki: I believe that the Bank's current internal audits are quite substantial up to the "risk-based audit" stage.

It can be said that "clerical deficiencies audits" and "risk-based audits" are intended to shine a spotlight on the past and present of the Bank's operations. "Management audits," on the other hand, are directly related to the Bank's future, since they are audits of management strategies developed in response to changes in the internal and external environments. Thus, the competencies required for "clerical deficiency audits," "risk-based audits," and "management audits" differ.

The same can be said for the Audit Committee members. "Management audits," for example, require an ability to see whether decisions are being made rationally and promptly.

I believe that the Bank's audits should aim to the stage of "management auditing," even if under pressure, and that the Audit Department can change the mindset of the Audit Department's management by making proposals to management that treat issues as management issues when it perceives problems.

Nanto Report 2024, the integrated report of Nanto Bank 75

Governance

Roundtable Discussion with Audit Committee Members

Kasuya: I have been with the Bank for a year now, and my first impression of banks' audit departments, including us, is that they are maintaining business procedures, ensuring compliance, and generally doing what needs to be done correctly according to the rules, while also ensuring independence and objectivity. We should not be satisfied with this, however, if we wish to increase the effectiveness and efficiency of our organizational activities and operations and raise our corporate value. Formal audit activities are meaningless when it comes to these objectives. As Mr. Aoki mentioned, it is important for management to communicate a clear, easily understandable message explaining why it is necessary to pursue "management auditing" at this time.

Promoting the significance of internal audit for its enhancement

Kitazawa: Internal audits have a strong image of pointing out whether or not practices in accordance with regulations have been "followed or not," and it cannot be said that the audited departments and branches receive sufficient support and clarification

One reason for this is that we have not been able to communicate the fact that auditing is changing. Many staff members in the audit departments, including myself, have lengthy banking experience and tend to focus on auditing's function of eliminating deficiencies, even though they understand the issue in their heads.

Handa: Of course, elimination of deficiencies will continue to be important, but I believe that the key to the evolution of the internal audit is to ensure that the Bank's management policies are fully understood on the frontlines and that the Bank is operating in accordance with those policies. By having the Audit Department compare the direction in which the Bank is heading with the actual situation on the front lines, and by pointing out issues and making recommendations to eliminate gaps through various opinion exchanges, I believe that the audited departments and branches will be more likely to accept the purposes, results, and findings of the audits. At the same time, this will lead to resolution of the issues and increase respect for the Audit Department.

Aoki: The difficulty we face in upgrading internal audits is that we must not cut any corners when correcting the "clerical deficiency audits" and "risk-based audits" and must, instead, continue to enhance them as before, or even more so.

In my opinion, internal audits should focus on the branch offices and the market rather than targeting Headquarters. If instructions from management do not penetrate the market, a gap will be created between the content of the instructions and the market. In other words, the market is a mirror of management. Both good

and bad management are reflected on the sales site. Specifically, I believe that the way work is done in the market is communicated to customers, influencing their choice of a bank, which in turn impacts the Bank's business performance.

It is important that the audited departments be aware that we are viewing management through the market when we conduct audits.

Kasuya: That's right. This is apparent from the perspective of morale at the branch offices, which are on the front lines of face-to-face contact with customers. Of course, strict instructions are necessary, but if the instructions from management or Headquarters are not in line with customers' needs or are too shortsighted, the gap between the two will cause the frontline staff to become complacent and result in low morale. I firmly believe that we must prevent this from happening.

I always consider whether morale is declining and whether the staff are working up to their potential. Conversely, when the frontline staff also express opinions about management and convey them to the Audit Department freely and openly, it can be said that the corporate culture has truly become more open.

76 Nanto Report 2024, the integrated report of Nanto Bank

Ishida: In order for the Bank's internal audits to fully transition to the "risk-based audit" stage, there needs to be a further change in awareness, not only within the Audit Department, but also in management and the audited departments. At present, the Audit Department evaluates risk management systems through verification of internal control activities at the branches, analyzes the causes of risk events that have occurred in order to resolve the issues concerned, and recommends improvements to reduce risk.

The Audit Department also conducts thematic audits with the objective of verifying risks across the board, including those of the Group companies.

The purpose of these initiatives is to verify whether operations are being conducted in a proper manner to achieve management objectives, and to strengthen and improve internal controls. We hope these efforts will enable the Bank to accumulate a fund of "management audit" methods and thinking.

Aiming to build a sound, sustainable business model

Kasuya: Internal audits have the power to move the whole Bank. They do not need to be glamorous or flashy. If we can create an original Nanto-style audit that reflects a strong commitment to preventing problems from occurring and, at the same time, to making the subjects of the audit feel glad to have been audited, I believe we can become an organization in which we all face in the same direction, not at each other as auditee and audited, and that we will receive a warmer reception from the subjects of the audits.

Aoki: In the past, auditors mainly conducted audits under the direction of management and faced in the same direction as management. From now on, however, "management audits" will need to focus on management. Rather than confronting the subjects in the usual way, they will confront management through the subjects. We understand the difficulty of changing the direction we are facing, or our line of sight, but I believe it is our responsibility as Audit Committee members to teach management to do just that.

Handa: Although progress has been made in changing the mindset of our officers and employees, I still feel that the culture of superiors and subordinates is deeply rooted in the Bank's culture. Because many of our officers and employees are earnest people who are eager to contribute to the community, I feel that the degree to which they follow instructions from management and Headquarters is extremely high. From another perspective, I feel at the same time that they may be too obedient. This is why I think it would be better if the Audit Department could confront the frank opinions and true feelings of the people on the frontlines, integrate the unique perspective of the Audit Department with their voices, deepen their dialogue with us Audit Committee members, and make better informed recommendations to Headquarters and management.

This is another reason I believe the role of the Audit Committee is important, as Mr. Aoki stated.

Kitazawa: After talking with all of you today, I have come to realize that for "risk-based auditing" to take root and reach the next stage, "the management audit," we will need to adopt a management position that views banking operations from a bird's-eye perspective. We have also found a number of other issues that need to be addressed. I was reminded that I am General Manager of the Audit Department at a time when the department is facing a change in direction in terms of the role it plays at the Bank and was also reminded that I should refocus my thinking. Although we cannot respond to all the issues at once, I would like to discuss them with all of you, as well as within the department, and create a Nanto-style audit system that is acceptable to both the members of the Audit Department and everyone on the frontlines of our banking operations.

Ishida: Today's exchange of opinions also caused me to think again about the purpose of audits and the relationships they create among management, the Audit Department, the Audit Committee, and the frontline staff. Although the progressive development of internal audits cannot be achieved overnight, I believe it will be essential to

complete and accumulate the requisite roles and functions steadily at each stage, from first-stage "clerical deficiency audits" and second- stage "risk-based audits" to third-stage "management audits."

We members of the management team will raise awareness of the importance and usefulness of internal audits further and ensure the appropriateness of our operations and financial soundness through effective, highly sophisticated internal audits, thereby enhancing corporate value.

Nanto Report 2024, the integrated report of Nanto Bank 77