Dear Shareholders,

During 2017, the Audit & Compliance Committee held nine meetings, during which the Committee:

• Assessed the objectivity and effectiveness of the Bank’s financial reporting and disclosure process. This included monitoring of the Bank’s choice of accounting policies, principles and judgements;
• Assessed the performance of the external auditor and recommended the external auditors’ re-appointment;
• Oversaw the activities of the Bank’s Group Compliance and Enterprise Risk Management function, which includes amongst others, regulatory updates, conduct compliance, fraud and operational risk management. The Committee continued to work with the Bank’s Compliance function to ensure implementation of the compliance consultant’s recommendations made in 2016 and reviewed an updated report from the consultant (see details below);
• Considered the performance, effectiveness and activities of the Bank’s Internal Audit function, including the Internal Audit function’s annual plan, budgeting, staffing and training activities and delivery against the plan;
• Reviewed and approved the Bank’s internal audit plan for year 2017 and the Internal Audit Group (IAG) risk assessment process for selection of audit activities;
• Coordinated its activities with those of the Board Risk & Credit Committee and other Board Committees;
• Reviewed and ensured the existence of an effective system of internal controls;
• Reviewed, and discussed with management and the external auditors, the annual audited financial statements, and considered the soundness of the Bank’s specific and general provisions. The Committee noted that the management continued to work (along with the external auditor) on the development of collective impairment models and to assess the impact of, and the Bank’s readiness for implementation of, IFRS 9;
• Reviewed audit observations raised by the internal and external auditors, the Central Bank, the Abu Dhabi Accountability Authority (ADAA), and other regulators, and management’s responses to such observations and ensured that management is taking action to address these observations;
• Reviewed ADAA’s assessment report on the Bank’s internal audit function;
• Evaluated the external auditors’ qualifications, performance, independence and objectivity, including overseeing all of the external auditors’ non-audit activities to ensure that their independence is not compromised. The Committee also reviewed the scope of work proposed by the external auditors for 2017 and ensured that the fees paid to the external auditors were appropriate for the type of work provided;
• Reviewed the Committee’s terms of reference and the policies sponsored by the Committee, such as the external auditor selection policy and procurement policy and ensured that new regulations were reflected, where applicable, in relevant policies;
• Ensured the adequate flow of information between the Committee, internal auditors, external auditors, the Bank’s management and the Board;
• Reviewed the quarterly report on the Bank’s Directors’ holdings in the Bank’s shares (in compliance with SCA’s regulations); and
• Reported regularly to the Bank’s Board of Directors.

The Board approved the 2017 annual accounts at the Committee’s recommendation based on the external auditors’ report and following the Committee’s review. The Committee believes that the Bank remains within its guidelines and policies for provisioning purposes and that the provisions for year 2017 remain at an adequate level.

The Committee continued to regularly meet with the external auditors and internal auditors without the presence of the Bank’s management. In addition, the Committee members attended joint meetings with the members of the Risk & Credit Committee to ensure suitable coordination of activities and discuss risk-related issues.

The Committee considered future challenges including the UAE’s introduction of VAT and the adoption of IFRS 9 and the related implications for the Bank’s financials, methodologies and models.

During 2017, the Committee commissioned a leading global consulting firm (Promontory) to conduct an assessment of the Bank’s Anti-Money Laundering and Sanctions Compliance programmes (the “Programmes”). The Committee was pleased to note that the consultants found the Programmes to be “strongly” designed, documented, and implemented and that the Bank is a “leading player in the region” for compliance purposes. The consultant commended, amongst other things, the Bank’s robust compliance controls and systems, the close monitoring of AML and sanctions’ risks, and the overall compliance governance framework. The Committee considered the consultant’s report in detail and will develop an action plan to address, where applicable, the recommendations made.

The Committee received confirmation from the Bank’s Internal Audit Group that the Bank’s internal controls have been assessed to be effective and are operating as designed.

The Committee was pleased to note that it made positive progress during 2017 towards meeting its responsibilities and objectives.

LOOKING AT 2018

The Committee’s schedule in 2018 contemplates nine meetings focused, amongst other things, on the integrity of the Bank’s financial statements, provisioning models, the activities of the Bank’s Internal Audit function, External Audit and Compliance function and ensuring the adequacy of the Bank’s internal controls and compliance activities. In particular, the Committee will continue to assess the impact of IFRS 9, Basel III and the introduction of VAT on the Bank’s activities and financial statements. The Committee will continue to coordinate its activities with those of the Board Risk & Credit Committee and will work with the Bank’s Compliance function to ensure implementation of the compliance consultant’s recommendations made in 2017.

Dear Shareholders,
During 2017 the Board Risk & Credit Committee continued to focus on the Bank’s risk strategy, appetite and analytics. Although the Committee continued (as required by regulation) to review sensitive or high value credit decisions, the Committee further increased the proportion of its time spent on risk strategy, appetite and analytics rather than on credit decisioning. The chart below breaks down the time spent by the Committee on matters relating to ‘risk strategy’.

The Committee held 37 meetings over the course of 2017. Amongst other things, in 2017, the Committee:

• Reviewed risks in the Bank’s asset portfolios (e.g., retail, small and medium enterprises and mid corporates);
• Considered the Bank’s concentration limits and tolerances in various sectors (such as GREs in Abu Dhabi, Dubai and the region, real estate, contracting and hospitality) and countries, and in foreign exchange and derivative transactions;
• Considered the Bank’s operational risks and operational risk reporting, as well as liquidity risk, credit risk and market risk;
• Reviewed the Bank’s IT, physical security and cyber risks;
• Reviewed UAE economic development and analysed geographic risks;
• Considered the outcome of stress tests and reverse stress tests conducted on various key portfolios, and ensured that outcomes are incorporated into risk-appetite reviews, capital adequacy assessments, budgets and capital and liquidity plans;
• Examined the risk and control deficiencies in the Bank;
• Analysed the formulas, inputs and assumptions used for various risk metrics including the “probability of default” concept, and “loss given default models”;
• Reviewed the Bank’s retail collection losses and processes;
• Considered the Bank’s business continuity plan management;
• Reviewed the Bank’s processes for control and monitoring of financial and non-financial covenants;
• Reviewed the Bank’s processes for underwriting transactions;
• Reviewed the Bank’s counterparty prudential threshold risk appetite;
• Assisted the Board in defining the Bank’s risk appetite and risk strategy, and monitored the independence and effectiveness of the Bank’s risk management functions;
• Ensured that management has implemented processes to promote the Bank’s adherence to risk policies;
• Reviewed the Bank’s contingency funding plan and monitored the Bank’s liquidity risk management;
• Considered the Bank’s unhedged positions against pegged currencies;
• Considered the Bank’s capital adequacy assessment process, including its Internal capital adequacy assessment process (ICAAP) methodology; and,
• Considered its agenda for 2018.

Due to the difficult market environment the Committee increased its focus on stress testing during 2017. To ensure the integrity and effectiveness of the Bank’s stress testing models, the Committee resolved to appoint an external consultant to validate the effectiveness of the Bank’s stress testing methodology and models.

Following the retirement of the Bank’s Group Chief Risk Officer early in 2017, the Committee has also been actively involved in recruiting a suitable replacement.

The Committee was pleased to note that it made positive progress during 2017 towards meeting its responsibilities and objectives.

LOOKING AT 2018

The Committee’s schedule in 2018 contemplates nine meetings focused, amongst other things, on risk strategy, appetite and analytics and stress testing. In line with local regulations, the Committee will continue to consider high value or sensitive credit decisions.