金融機構公司治理與內部控制——制度與組織之間

有鑒於銀行、金融控股公司、保險公司近期層出不窮之裁罰案件在在顯示金融機構未能有效建置或發揮內控制度應有之機能，故基於落實良好之金融機構公司治理之目的，本文即透過內部控制之制度設計、人事組織等兩道途徑之分析與重新形塑，期能具體描繪金融機構內部自律機制應有之典範架構。首先，本文回顧內部控制之制度發展脈絡後，析出內部牽制、風險控制及權責劃分等三項基本原則，作為改善現行內控制度本身失靈之核心概念。再者，本文以銀行內控制度三道防線基本架構為示例，分析銀行之日常業務經營、報導之編製與揭露、法令規章之遵循等內部控制三項主要目標後，得出法令遵循係內部控制核心目標之觀點。基於前揭觀點，本文透過探討內控制度、法令遵循及風險管理之意涵與彼此間之互動關係後，確立內部控制運作之GRC整合架構，並提內部控制程序應納入PDCA動態循環之芻議，作為本文對於內部控制制度設計之具體構想。本文同時點出內控制度之侷限在於人為執行時所生之不利影響，故金融機構內部應重為合理之人事組織安排與權責分配，方能充分發揮內控制度之實效。抑且，現今金融機構之規模與業務種類漸趨龐雜，為落實妥適之權責劃分與營運活動之分工，其內部監督決策與業務執行兩者之組織結構應重新調整。因此本文主張，董事會應定位為監控機關，俾利其履行建置與確保內控制度運作之監督責任，亦得提升獨立董事制度之成效。再者，經營管理階層除了須負擔業務單位職員日常營運活動之管理責任以外，尚須協助具體落實董事會訂定之政策目標、形塑誠信經營之良好組織文化。本文最終指出，內控制度作為確保金融機構運作係符合組織政策、作業程序、具體目標或規範標準之重要治理機制，須經由內部全體成員之通力配合實施與執行，始能完整發揮其制度機能。

關鍵字

內部控制；金融機構；公司治理；風險管理；法令遵循；監督型董事會

並列摘要

The fact that the Financial Supervisory Commission of Taiwan frequently imposes administrative requirements and enforcement on Taiwan’s banks, financial holding companies, insurers and so forth, obviously indicates poor corporate governance in these financial institutions. Therefore, after an in-depth examination of the internal control system of financial institutions in Taiwan, its current approach and organizational structure, this thesis aims at outlining an internal corporate governance paradigm that will address the existing problems. Through examining the history of internal controls, I firstly identify three main principles for a well-functioning internal control system in financial institutions, which are internal checks, risk control, and the delegation of authorization and duties. Then, taking the “Three Line of Defense” principle in banks for example, the focus of the present research will shift to the analysis of the three basic objectives of internal controls: effectiveness and efficiency of operations, preparation and disclosure of reporting, and compliance with applicable rules and regulations. Subsequently, based on the findings that compliance should be the core objective of internal controls, I will discuss the concept of legal compliance and risk management and their cross-relationship with the internal control system. In this regard, I propose that governance, risk management, and compliance (“GRC”) should be an essential foundation of a system designing and the “PDCA Cycle” could serve as a feasible methodology for continuous improvement of internal control systems. This thesis also identifies the limitations of the current internal control system as a result of imperfect execution and proposes that financial institutions should adopt a strong organizational structure with specified roles to fully reap the effectiveness of the internal control system. Furthermore, considering the large scale of modern financial institutions and the diversity of business activities conducted, supervisory and operational roles should be segregated. After surveying internal control system and related best practices, I will deliver three key proposals for improvement: first, reinforcing the position of the supervisory and monitory board in the financial institutions, which will impose upon the board of directors the ultimate responsibility of ensuring the establishment and maintenance of an appropriate and effective internal control system, and at the same time improving the function of the independent director system; second, other than managing the businesses’ daily operations, the management should also play a main role in reinforcing good culture in financial services and continually educating personnel regarding policies, procedures, and ethical standards in place; lastly, this thesis submits that since an effective internal control system is essential to good corporate governance, the burden of ensuring that it works effectively should not only rest on the shoulders of the management, but also on all employees.