Internal audit, internal control, and risk management activities at Ziraat Bank are performed by the Board of Inspectors, the Internal Control & Compliance Department, and the Risk Management Department. These units’ duties and responsibilities, which are strictly segregated from one another, are coordinated by the Assistant General Manager for Internal Systems.

This organization is structured so as to embrace all Bank units and branches as well as Bank-owned subsidiaries subject to the Bank’s oversight. Its purpose is to minimize any risks that might adversely affect the thoroughgoing and secure conduct of banking operations, the fulfillment of long-term profit targets, the reliability of financial and administrative reporting, and/or the Bank’s reputation and financial stability.

Internal Audit System
The Board of Inspectors takes a risk-focused approach in the fulfillment of its responsibilities to ensure that the activities and operations of the Bank’s headquarters units, domestic and international branches, and subsidiaries comply with the requirements of laws and regulations and are compatible with the Bank’s own strategies, policies, principles, and objectives. The board conducts its activities in such a way as both to keep the Bank’s senior management informed and to contribute to their decision-making processes.

The Board of Inspectors has 185 Bank inspectors on its staff. The board conducts its activities in line with internationally-accepted internal auditing standards. Besides checking the Bank’s operations for their compliance with statutorily mandated procedures, in 2015 the board also reviewed and assessed the effectiveness and efficiency of the transaction procedures involved in both primary and secondary processes. In addition, processes governed by Banking Regulation and Supervision Agency (BDDK) regulations pertaining to information systems and banking processes were also audited by information technology inspectors in line with the Bank’s own practices.

Board of Inspectors activities in 2015

• The Central Audit Team continued its intensive operations in 2015 by performing scenario analyses which not only identify irregularities that may have occurred but which are also influential in preventing potential ones from being committed. The team reviewed the effectiveness of its existing scenarios and developed new ones to cope with the possible abuses made possible by newly-introduced business processes. It has also begun developing systematic procedures aimed at minimizing risks arising from the remaining manually-conducted processes involved in internal audit.
  
  
• The R&D Team kept a close watch on all of the Bank’s other business units, revised and kept the auditing module up to date in light of changes in business processes and the regulatory framework, and modified auditing points as made necessary by laws, BDDK decisions, and changes demanded by Bank’s senior management and headquarters units. Improvements also continued to be made in all processes from the development of an auditing index to the monitoring of audit findings. Systemic changes that make it possible for inspection findings concerning critically important transactions to be drawn to the attention of business units increased the effectiveness of the finding follow-up process and had a beneficial impact on the overall percentage of findings subjected to corrective action.
  
  The majority of recommendations that inspectors in the field included in their reports or made with respect to a particular transaction or practice were also circulated among the business units concerned and the outcomes of such recommendations were observed.
  
  A Global Auditing Module project was initiated at Ziraat Bank in the last quarter of 2015. Work on this module’s operating system has largely been completed, as have also the task analyses for adapting it to different banking systems.
  
  
• The Inspection Scenario Team that was set up and charged with formulating scenarios both to identify shortcomings in bank processes and to develop and improve the effectiveness of such processes and with submitting these scenarios to the appropriate business unit so as to ensure that speedy and effective solutions for dealing with them are devised throughout the bank continued to operate in 2015. Keeping a close watch on what action business units took and what improvements they made with respect to these scenarios, the team observed that action was taken in more than 90% of the completed scenarios.

• During 2015, the Central Inspection Team that was set up to increase the frequency and effectiveness of inspections by constantly and centrally monitoring designated branch groups performed centralized inspections on 343 of the Bank’s branches in accordance with the same criteria employed for on-site inspections.

Inspectors are given the opportunity to constantly improve their professional knowledge and experience by conducting inspections at different Bank units from time to time. They also continued to be provided with training on personal and professional issues at regular intervals during 2015.

The practice of recruiting qualified human resources for the Bank’s administrative staff by allowing inspectors to transfer to such positions continued in 2015. Twenty inspectors were in this way. Last year thirty-four new assistant inspectors were also recruited and hired by the Bank.

In keeping with its strong sense of responsibility and awareness of its duties, the Board of Inspectors will continue to execute the internal auditing plan in line with goals and policies set forth by Ziraat Bank’s senior management and within the framework of current auditing approaches, to report its findings to the Board of Directors through the Audit Committee, and to observe what action is taken on the basis of its reports.

Internal Control & Compliance System
Internal control activities at Ziraat Bank are structured so as to embrace the operations of all headquarters units and of all domestic and international branches as required by BDDK’s “Regulation on bank internal system and intrinsic capital adequacy assessment processes”.

Such activities are conducted so as to be compatible with the Bank’s primary objectives and strategies from the standpoint of their scope and methodology; however a proactive approach is adopted in order to more readily accommodate changes in strategies and conditions arising from altered risk perceptions and from the changeover to a new service model.

Work has been finalized on the New Control Model that was introduced and put into effect in 2014: it is no longer just a reporting model but one that requires action to be taken. The goal of this more proactive structure is to help ensure that Ziraat Bank’s operations exceed sectoral norms and that they are conducted in a manner that is compatible with both internal and external regulations as well as with the demands of competition.

Domestic branch checks are performed both on location and centrally within the framework of a program that is prepared taking into account branches’ current levels of risk exposure. Control functions, which for the most part are structured so as to be technology-intensive and centralized, are intended to ensure that commonly-occurring mistakes are quickly corrected at the appropriate business-unit level.

Taking full advantage of the improvements in the Bank’s technological infrastructure, the Ziraat Bank Instant Control Project is unique in the Turkish banking industry. This system is now being used to check operational transactions and their accounting in real time. Transactions are evaluated in light of specific scenarios and if a transaction is deemed to be in error, it can be corrected the same day. Based on the principle of preventing errors and omissions from occurring when assets and liabilities are recorded and subsequently being used as input for financial reporting, the Instant Control System has become an integral part of the Bank’s day-to-day activities because of the significant improvement in operational effectiveness that is achieved by checking transactions immediately rather than in retrospect.
Headquarters unit control cycles are determined taking into account the units’ functions, potential risks, terms of reference, and impact on the Bank’s balance sheet. These cycles are revised as needs may require.

Internal control operations at Ziraat Bank branches located outside Turkey are carried out in line with control programs that are prepared for each year.

The findings ascertained as a result of all of these activities are periodically circulated among appropriate business units and the members of senior management.

Besides performing their internal control functions in 2015, internal control personnel also continued to prepare and issue reports containing suggestions of ways to improve existing processes at the Bank and to mitigate the risks inherent in them. The aim of this practice is to preclude risks by spotting them in advance, to make the Bank more competitive by improving its business processes, and to increase customer satisfaction while also taking measures to cut costs.

As a result of a complete change in the internal controller recruitment process, Ziraat Bank began recruiting such personal from among its existing personnel in 2015. By taking advantage of the Bank-specific knowledge and experience that employees already have and thereby accelerating their adaptation to the department’s work processes, this new procedure significantly reduces the time it takes to train new internal controllers. One natural outcome of this is that they also become more productive in their new duties sooner. The other is that the internal control department and its team benefit significantly from their banking and field experience.

The practice of recruiting qualified human resources for the Bank’s administrative staff by allowing internal control personnel to transfer to such positions continued in 2015.

In addition to such matters, compliance reviews were also carried out by internal control personnel as required by article 18 of BDDK Regulation on bank internal system and intrinsic capital adequacy assessment processes. In the course of these reviews, all operations conducted or planned by the Bank as well as new transactions and products are checked to be sure that they comply with laws and regulations, with the Bank’s own policies and rules, and with generally-accepted banking practices. During such compliance reviews, existing Bank-internal rules and proposed changes in them are also examined and views concerning them are circulated among appropriate units.

Activities to prevent money-laundering in accordance with the compliance program that was formulated at Ziraat Bank as per BDDK Regulation concerning programs to comply with obligations to prevent money-laundering and terrorism financing are conducted as required by national and international guidelines. Ziraat Bank’s anti-money laundering and terrorism financing policy is publicly disclosed on the Bank’s corporate website. All Ziraat Bank personnel are also provided with training on issues related to the prevention of money-laundering and terrorism-financing.

Risk Management System
Ziraat Bank risk management activities are conducted subject to the requirements of BDDK’s Regulation on bank internal system and intrinsic capital adequacy assessment processes and other pertinent regulations as well as of BDDK Best Practices Guidelines. They are carried out with the aim of aligning the Bank’s risk management functions with best practices by fostering a risk culture throughout the entire and constantly improving system and human resources. The principal risk categories are defined as “Credit Risk”, “Market Risk”, “Operational Risk”, and “Balance Sheet Risks”, the last including the interest rate risks and liquidity risks to which the Bank is exposed on account of its banking business operations. Care is given to ensure that all risk management system activities are coordinated through the involved participation of the operational branches with which each type of risk is associated.

Under the heading of credit risk management, Basel III-compatible methods are used to define, measure, monitor, and report credit risk. The Bank has been calculating its core credit risk exposure and reporting it monthly on the basis of its solo and consolidated accounts to BDDK ever since this practice was mandated by law as of 1 July 2012.

Under the heading of measuring creditworthiness using advanced quantification methods, work is currently being carried out at the Bank based on the results generated by applying scoring models to different loan portfolios. Statistical methods are employed both to verify these rating models and to quantify the effectiveness of their performance. Credit risk limits approved by the Board of Directors are also monitored while scenario analyses and stress tests are carried out based on non-performing loan ratios.

Under the heading of market risk management, such risk is measured, analyzed, reported, and monitored. Analyses are supported by conducting stress tests. Risk measurements are performed on all accounts whose inclusion in the Bank’s capital adequacy ratio calculation is mandatory as well as by means of the “value-at-risk” (VaR) methodology. The results of VaR measurements are validated by means of backtest analyses. The values on which market risk is calculated are periodically reviewed and compared with of Board of Directors-approved limits while senior management is kept informed about the results of mandatory and internal limit monitoring.

Under the heading of operational risk management, the operational risks to which the Bank is exposed are defined, classified, quantified, and analyzed. Operational risk limits approved by the Board of Directors are also monitored at regular intervals. The operational risk loss database in the Finart environment allows actual instances of operational risk to be tracked. Information technology risks and associated actions are followed up. Risk exposure assessments are conducted for companies providing outsourced support services as required by current BDDK regulations.

Under the heading of balance sheet risk management, liquidity and interest rate risks arising from banking business accounts are measured, analyzed, delimited, reported, and monitored. Analyses are also supported by means of stress tests. Such liquidity risk limits as may be approved by the Board of Directors are also monitored at regular intervals. The results of mandatory and internal limit monitoring and of liquidity and interest rate gap analyses are circulated among appropriate units for presentation at Asset & Liability Committee (ALCO) meetings. A “Liquidity Coverage Ratio” is now being calculated as per BDDK regulations published in line with Basel III criteria. Reporting of this ratio has been mandatory since the beginning of 2015.

Besides the stress test analyses that are the subject of periodic reporting within the Bank, year-end Stress Test and Internal Capital Adequacy Assessment Process (ICAAP) reports are also prepared and sent to BDDK. In the latter reports, the Bank’s capital adequacy is analyzed over the next three-year period on the basis of a set of Base/Negative/Overly Negative scenarios not supplied by BDDK.

The results of the risk management analyses and the associated risk indicators are reported to the Board of Directors and to the Audit Committee at six-month intervals and to executive units and internal system units on a daily, weekly, and monthly basis.

Ziraat Bank will continue to make use of internationally-recognized advanced risk management techniques in order to carry out its risk management activities for all risk categories and to make such risk management an integral part of its strategic decision-making processes in the future as well.

Muharrem KARSLI Chairman of the Board & Member of the Audit Committee	Feyzi ÇUTUR Member of the Audit Committee