iifl-logo-icon 1

RBL Bank Ltd Auditor Reports

262.75
(-1.28%)
Jul 5, 2024|12:00:00 AM

RBL Bank Ltd Share Price Auditors Report

To the Members of RBL Bank Limited

REPORT ON THE AUDIT OF THE STANDALONE

FINANCIAL STATEMENTS

Opinion

We have audited the accompanying Standalone Financial Statements of RBL Bank Limited ("the Bank"), which comprise the Balance Sheet as at March 31,2023, the Profit and Loss Account and the Cash Flow Statement for the year then ended, and notes to the Standalone Financial Statements including a summary of significant accounting policies and other explanatory information (hereinafter referred to as "Standalone Financial Statements").

In our opinion and to the best of our information and according to the explanations given to us, the aforesaid Standalone Financial Statements give the information required by the Section 29 of the Banking Regulation Act, 1949 and as well as the Companies Act, 2013 ("the Act") and circulars and guidelines issued by the Reserve Bank of India, in the manner so required for the banking companies and give a true and fair view in conformity with the accounting principles generally accepted in India, including the

Accounting Standards prescribed under Section 133 of the Act, read with rules made thereunder, of the state of affairs of the Bank as at March 31, 2023, its profit and its cash flows for the year ended on that date.

Basis for Opinion

We conducted our audit in accordance with Standards on Auditing (SAs) specified under section 143(10) of the Act. Our responsibilities under those Standards are further described in the Auditors Responsibilities for the Audit of the Standalone Financial Statements section of our report. We are independent of the Bank in accordance with the Code of Ethics issued by the Institute of Chartered Accountants of India ("ICAI") together with the ethical requirements that are relevant to our audit of the Standalone Financial Statements under the provisions of the Act and Rules thereunder, and we have fulfilled our other ethical responsibilities in accordance with these requirements and the Code of Ethics. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our opinion on the Standalone Financial Statements.

Key Audit Matters

Key audit matters are those matters that, in our professional judgment, were of most significance in our audit of the Standalone Financial Statements for the current year. These matters were addressed in the context of our audit of the Standalone Financial Statements as a whole, and in forming our opinion thereon, and we do not provide a separate opinion on these matters. We have determined the matters described below to be the key audit matters to be communicated in our report.

Sr. No. Key audit matter(s) (KAM) How our audit addressed the key audit matter
1. Information Technology (IT) Systems, Migration of Data, and controls over financial reporting
The Banks financial accounting and reporting systems are highly dependent on data from various IT applications and Core Banking Solution (CBS) which are interfaced and / or are working independently (the IT applications, CBS, general and related application controls together referred to as "IT Controls Framework"). Extensive volume, variety and complexity of transactions are processed daily and there is a risk that automated accounting procedures and related internal controls may not be accurately designed and operating effectively. There exists a risk that gaps in the IT control environment could result in the financial accounting and reporting records being materially misstated. Appropriate IT controls are required to ensure that the IT applications operate as planned and the changes made are properly authorized, tested and controlled. Our audit outcome is also dependent on the effective operations of these IT systems and controls throughout the year. • We have planned, designed and carried out the desired audit procedures and sample checks, taking into consideration the IT systems of the Bank. The procedures adopted by us are, in our opinion, adequate to provide reasonable assurance on the adequacy of IT controls in place and includes:
• Gaining understanding of IT controls framework through Walkthrough of processes. We also discussed and referred to reports of internal auditors, Internal Financial Control and other assurance functions in carrying out our audit procedures.
• The IT audit specialists (who are integral part of audit team) have carried out testing of effectiveness of general and application controls.
• We also tested key automated and manual business cycle controls and logic for system generated reports relevant to the audit; including testing of compensating controls or performed alternate procedures to assess whether there were any unaddressed IT risks that would materially impact the Financial Statements.
During the year, the bank has migrated to a new Loan Operating System (LOS) for Micro Finance loan portfolio. The migration of loan data from the old system to the new system is a critical aspect of the migration process. The completeness and accuracy of the migrated data will affect the reliability of the loan operating system.
• We have performed testing by selecting a sample of data and tracing the movement of data from the old system to new system to ensure that the migrated data is complete and accurate.
Sr. No. Key audit matter(s) (KAM) How our audit addressed the key audit matter
We have identified IT Controls Framework as a Key Audit Matter as the Bank has various applications apart from CBS from which data is extracted for preparation and presentation of the financial statements. • Reliance on data migration review report of an external vendor/ independent system reviewer on completeness and accuracy of the loan data migrated to the new system.
We have also carried out other audit procedures like substantive testing, analytical procedures etc. to verify the accuracy of the data generated from the IT system.
2. Income recognition asset classification (IRAC) and provisioning on loans, advances and investments as per regulatory requirements
The Bank, as per its governing framework, recognises the performing and non-performing advances/investments provisions based on Managements assessment of the degree of impairment of the advances/investments subject to and guided by minimum provisioning levels prescribed under RBI guidelines. Our audit approach included testing the design, operating effectiveness of internal controls and substantive audit procedures in respect of income recognition, asset classification and provisioning pertaining to advances and investments. In particular:
Advances:
• We have evaluated and understood the Banks internal control system in adhering to the relevant RBI guidelines regarding income recognition, asset classification and provisioning pertaining to advances;
Advances:
Identification of performing and non-performing Advances involves establishment of proper mechanism. The Bank
accounts for all the transactions related to Advances in its Information Technology System (IT System) which also identifies whether the advances are performing or nonperforming and consequent recognition of Income. • We have tested key IT systems/ applications used and their design and implementation as well as operational effectiveness of relevant controls, including involvement of manual process and manual controls in relation to income recognition, asset classification, provisioning pertaining to advances and compliances of other regulatory guidelines issued by the RBI from time to time;
Further, bank placed reliance on the data submitted by the borrowers & lead bank for drawing power calculations, and uses services of experts (Lawyer, valuers etc.) where required to support its assessment for security valuations.
• We have test checked advances to examine the validity of the recorded amounts, loan documentation, examined the statement of accounts, indicators of impairment, impairment provision for non-performing assets, and compliance with income recognition, asset classification and provisioning pertaining to advances in terms of applicable RBI guidelines;
Compliance of relevant prudential norms issued by the Reserve Bank of India (RBI) in respect of income recognition, asset classification and provisioning pertaining to advances. Currently certain processes of the Bank requires manual interventions. Further, the Bank has significant exposure to a large number of borrowers across various sectors, products, industries and geographies and there is a high degree of complexity, uncertainty, significant estimates, judgment involved in determining the recoverability of advances, nature of transactions and estimation of provisions commensurate to the level of risks thereon and identification of accounts to be written off.
• We have evaluated the past trends of management judgement, governance process and review controls over impairment provision calculations and discussed the provisions made with the top and senior management of the Bank.
Investments:
• Understanding the IT system and controls put in place
• Testing on sample basis whether the classification and valuation of investments is carried out as per the guidelines of Reserve Bank of India.
Investments:
Bank has to classify the investments as performing or non performing based on the guidelines/circulars and directives issued by Reserve Bank of India. Identification of performing and non performing investments. The valuation is done as per the guidelines issued by Reserve Bank of India and the valuations are done based on the price quoted on BSE/ NSE, FIMDA / FBIL rates etc. The Income recognition, asset classification and provisioning if not done properly as per the IRAC norms issued by Reserve Bank of India may materially impact the financial statements of the bank.
• Verification on sample basis whether proper provision for depreciation in the value of investments is made as per RBI guidelines.
• Reliance made on the internal audit reports, concurrent audit reports and system audit conducted by the bank
Advances and Investments constitute 60.59% and 24.92% respectively of total assets of the bank. As advances and investments form part of a significant portion of the Banks assets and the regulatory compliances are involved, we have considered this aspect as KAM

Other Information

The Banks Board of Directors and Management are responsible for the other information. The other information comprises the information included in the Directors report, Management Discussion and Analysis, Business Responsibility and Sustainability Report etc. forming part of the Annual Report, but does not include the Standalone Financial Statements, consolidated financial statements and our auditors report thereon and the Pillar III Disclosures under Basel III Capital Regulation, Leverage Ratio, Liquidity Coverage Ratio and Net Stable Funding Ratio.

The Annual report is expected to be made available to us after the date of this auditors report.

Our opinion on the Standalone Financial Statements does not cover the other information and we do not express any form of assurance conclusion thereon.

In connection with our audit of the Standalone Financial Statements, our responsibility is to read the other information identified above when it becomes available and, in doing so, consider whether the other information is materially inconsistent with the Standalone Financial Statements or our knowledge obtained in the audit or otherwise appears to be materially misstated.

When we read the Annual Report, if we conclude that there is a material misstatement therein, we are required to communicate the matter to those charged with governance.

Responsibilities of Management and Those Charged with Governance for the Standalone Financial Statements

The Banks Board of Directors and Management are responsible for the matters stated in section 134(5) of the Act with respect to the preparation of these Standalone Financial Statements that give a true and fair view of the financial position, financial performance and cash flows of the Bank in accordance with the accounting principles generally accepted in India, including the Accounting Standards prescribed under section 133 of the Act, the Banking Regulation Act, 1949 and the circulars, guidelines and directions issued by Reserve Bank of India (RBI) from time to time. This responsibility also includes maintenance of adequate accounting records in accordance with the provisions of the Act for safeguarding of the assets of the Bank and for preventing and detecting frauds and other irregularities; selection and application of appropriate accounting policies; making judgments and estimates that are reasonable and prudent; and design, implementation and maintenance of adequate internal financial controls, that were operating effectively for ensuring the accuracy and completeness of the accounting records, relevant to the preparation and presentation of the Standalone Financial Statements that give a true and fair view and are free from material misstatement, whether due to fraud or error.

In preparing the Standalone Financial Statements, the Banks Board of Directors and Management are responsible for assessing the Banks ability to continue as a going concern, disclosing, as applicable, matters related to going concern and using the going concern basis of accounting unless the management either intends to liquidate the Bank or to cease operations, or has no realistic alternative but to do so.

The Board of Directors are also responsible for overseeing the Banks financial reporting process.

Auditors Responsibilities for the Audit of the Standalone Financial Statements

Our objectives are to obtain reasonable assurance about whether the Standalone Financial Statements as a whole are free from material misstatement, whether due to fraud or error, and to issue an auditors report that includes our opinion. Reasonable assurance is a high level of assurance, but is not a guarantee that an audit conducted in accordance with SAs will always detect a material misstatement when it exists. Misstatements can arise from fraud or error and are considered material if, individually or in the aggregate, they could reasonably be expected to influence the economic decisions of users taken on the basis of this Standalone Financial Statements. As part of an audit in accordance with SAs, we exercise professional judgment and maintain professional skepticism throughout the audit. We also:

• Identify and assess the risks of material misstatement of the Standalone Financial Statements, whether due to fraud or error, design and perform audit procedures responsive to those risks, and obtain audit evidence that is sufficient and appropriate to provide a basis for our opinion. The risk of not detecting a material misstatement resulting from fraud is higher than for one resulting from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control.

• Obtain an understanding of internal control relevant to the audit in order to design audit procedures that are appropriate in the circumstances. Under section 143(3)

(i) of the Act, we are also responsible for expressing our opinion on whether the Bank has adequate internal financial controls with reference to financial statements in place and the operating effectiveness of such controls.

• Evaluate the appropriateness of accounting policies used and the reasonableness of accounting estimates and related disclosures in the Standalone Financial Statements made by The Banks Board of Directors and Management.

• Conclude on the appropriateness of The Banks Board of Directors and Management use of the going concern basis of accounting and, based on the audit evidence obtained, whether a material uncertainty exists related to events or conditions that may cast significant doubt on the Banks ability to continue as a going concern. If we conclude that a material uncertainty exists, we are required to draw attention in our auditors report to the related disclosures in the Standalone Financial Statements or, if such disclosures are inadequate, to modify our opinion. Our conclusions are based on the audit evidence obtained up to the date of our auditors report. However, future events or conditions may cause the Bank to cease to continue as a going concern.

• Evaluate the overall presentation, structure and content of the Standalone Financial Statements, including the disclosures, and whether the Standalone Financial Statements represent the underlying transactions and events in a manner that achieves fair presentation.

We communicate with those charged with governance regarding, among other matters, the planned scope and timing of the audit and significant audit findings, including any significant deficiencies in internal control that we identify during our audit.

We also provide those charged with governance with a statement that we have complied with relevant ethical requirements regarding independence, and to communicate with them all relationships and other matters that may reasonably be thought to bear on our independence, and where applicable, related safeguards.

From the matters communicated with those charged with governance, we determine those matters that were of most significance in the audit of the Standalone Financial Statements of the current year and are therefore the key audit matters. We describe these matters in our auditors report unless law or regulation precludes public disclosure about the matter or when, in extremely rare circumstances, we determine that a matter should not be communicated in our report because the adverse consequences of doing so would reasonably be expected to outweigh the public interest benefits of such communication.

Other Matter

The audit of Standalone Financial Statements for the year ended March 31, 2022, have been audited by one of the predecessor auditors Haribhakti & Co. LLP and continuing joint statutory auditor, CNK and Associates LLP, whose report dated May 12, 2022 had expressed an unmodified opinion. The above report has been furnished to us by the management and has been relied upon by us for the purpose of our audit of the Standalone Financial Statements.

Our opinion is not modified in respect of this matter.

Report on Other Legal and Regulatory Requirements

(1) The Standalone Balance Sheet and the Profit and Loss Account have been drawn up in accordance with the provisions of Section 29 of the Banking Regulation Act, 1949 read with Section 133 of the Act read with relevant rules issued thereunder.

(2) As required by sub-section (3) of section 30 of the Banking Regulation Act,1949 we report that:

a. we have obtained all the information and explanations which, to the best of our knowledge and belief, were necessary for the purpose of our audit and have found them to be satisfactory;

b. the transactions of the Bank, which have come to our notice, have been within the powers of the Bank;

c. The Bank considers its key operations to be automated, with the key applications largely integrated to the Core Banking System, it does not require its branches to submit any financial returns. Accordingly, our audit is carried out centrally at Head Office based on the records and data required for the purpose of Audit being made available to us. During the course of our audit, we have visited and performed select relevant procedures at 20 branches;

d. the profit and loss account shows a true balance of profit for the year then ended

(3) As required by section 143(3) of the Act, we report that:

a. We have sought and obtained all the information and explanations which to the best of our knowledge and belief were necessary for the purposes of our audit;

b. In our opinion, proper books of account as required by law have been kept by the Bank so far as it appears from our examination of those books;

c. The Standalone Balance Sheet, the Standalone Statement of Profit and Loss Account and the Standalone Cash Flow Statement dealt with by this report are in agreement with the books of account;

d. In our opinion, the aforesaid Standalone Financial Statements comply with the Accounting Standards prescribed under Section 133 of the Act read with relevant rules issued thereunder to the extent they are not inconsistent with the guidelines prescribed by RBI;

e. On the basis of the written representations received from the directors as on March 31,2023, and taken on record by the Board of Directors, none of the directors is disqualified as on March 31, 2023 from being appointed as a director in terms of Section 164(2) of the Act;

f. With respect to the adequacy of the internal financial controls with reference to financial statements of the Bank and the operating effectiveness of such controls, refer to our separate report in "Annexure A";

g. With respect to the other matter to be included in the Auditors Report in accordance with the requirements of section 197(16) of the Act, as amended:

In our opinion and to the best of our information and according to the explanations given to us, requirements prescribed under Section 197 of the Act is not applicable by virtue of Section 35B (2A) of the Banking Regulation Act, 1949.

h. With respect to the other matters to be included in the Auditors Report in accordance with Rule 11 of the Companies (Audit and Auditors) Rules, 2014, as amended, in our opinion and to the best of our information and according to the explanations given to us:

(i) The Bank has disclosed the impact of pending litigations on its financial position in its Standalone Financial Statements - Refer Schedule 12 on Contingent Liabilities to the Standalone Financial Statements;

(ii) The Bank has made provision, as required under the applicable law or accounting standards, for material foreseeable losses, if any, on longterm contracts including derivative contracts - Refer Note 48 of Schedule 18 to the Standalone Financial Statements in respect of such items as it relates to the Bank;

(iii) There has been no delay in transferring amounts, required to be transferred, to the Investor Education and Protection Fund by the Bank;

(iv) a. The management has represented that, to the best of its knowledge and belief, other than as disclosed in the Note 49 of Schedule 18 to the Standalone Financial Statements, no funds (which are material either individually or in the aggregate) have been advanced or loaned or invested (either from borrowed funds or share premium or any other sources or kind of funds) by the Bank to or in any other persons or entities, including foreign entities ("Intermediaries"), with the understanding, whether recorded in writing or otherwise, that the Intermediary shall, whether, directly or indirectly lend or invest in other persons or entities identified in any manner whatsoever by or on behalf of the Bank ("Ultimate Beneficiaries") or provide any guarantee, security or the like on behalf of the Ultimate Beneficiaries;

b. The management has represented that, to the best of its knowledge and belief, other than as disclosed in the Note 49 of Schedule 18 to the Standalone Financial Statements, no funds (which are material either individually or in the aggregate) have been received by the Bank from any persons or entities, including foreign entities ("Funding Parties"), with the understanding, whether recorded in writing or otherwise, that the Bank shall, whether, directly or indirectly, lend or invest in other persons or entities identified in any manner whatsoever by or on behalf of the Funding Party ("Ultimate Beneficiaries") or provide any guarantee, security or the like on behalf of the Ultimate Beneficiaries;

c. Based on the audit procedures that are considered reasonable and appropriate in the circumstances, nothing has come to our notice that has caused us to believe that the representations under sub-clause (a) and (b) above, contain any material misstatement.

(v) As stated in note 2 of Schedule 18 to the Standalone Financial Statements, the Board of Directors of the Bank have proposed final dividend for the financial year 2022-2023 which is subject to the approval of the members at the ensuing Annual General Meeting. The amount of dividend proposed is in accordance with Section 123 of the Companies Act.

(vi) As proviso to Rule 3(1) of the companies (Accounts) Rules, 2014 is applicable for the Bank with effect from April 1, 2023, reporting under Rule 11(g) of the Companies (Audit and Auditors) Rules 2014 on using accounting software which has a feature of recording audit trail (edit log) facility is not applicable.

Annexure to the Independent Auditors Report

Annexure A to the Independent Auditors Report of even date on the Standalone Financial Statements of RBL Bank Limited for the year ended March 31, 2023

Report on the Internal Financial Controls with reference to the aforesaid Standalone Financial Statements under Clause (i) of Sub-section 3 of Section 143 of the Companies Act, 2013 ("the Act")

We have audited the internal financial controls with reference to Standalone Financial Statements of RBL Bank Limited ("the Bank") as of March 31, 2023 in conjunction with our audit of the Standalone Financial Statements of the Bank for the year ended on that date.

Managements Responsibility for Internal Financial Controls

The Banks Management and Board of Directors are responsible for establishing and maintaining internal financial controls based on the internal control with reference to financial statements criteria established by the Bank considering the essential components of internal control stated in the Guidance Note on Audit of Internal Financial Controls Over Financial Reporting (the Guidance Note) issued by the Institute of Chartered Accountants of India (the ICAI). These responsibilities include the design, implementation and maintenance of adequate internal financial controls that were operating effectively for ensuring the orderly and efficient conduct of its business, including adherence to the Banks policies, the safeguarding of its assets, the prevention and detection of frauds and errors, the accuracy and completeness of the accounting records, and the timely preparation of reliable financial information, as required under the Companies Act, 2013 ("the Act").

Auditors Responsibility

Our responsibility is to express an opinion on the Banks internal financial controls with reference to Standalone Financial Statements based on our audit. We conducted our audit in accordance with the Guidance Note on Audit of Internal Financial Controls Over Financial Reporting (the Guidance Note) and the Standards on Auditing (the Standards), issued by the ICAI and deemed to be, prescribed under Section 143(10) of the Act, to the extent applicable to an audit of internal financial controls with reference to financial statements, both issued by the ICAI. Those Standards and the Guidance Note require that we comply with ethical requirements and plan and perform the audit to obtain reasonable assurance about whether adequate internal financial controls with reference to financial statements were established and maintained and whether such controls operated effectively in all material respects.

Our audit involves performing procedures to obtain audit evidence about the adequacy of the internal financial controls with reference to Standalone Financial Statements and their operating effectiveness. Our audit of internal financial controls with reference to Standalone Financial Statements included obtaining an understanding of internal financial controls, assessing the risk that a material weakness exists, and testing and evaluating the design and operating effectiveness of internal control based on the assessed risk. The procedures selected depend on the auditors judgment, including the assessment of the risks of material misstatement of the Standalone Financial Statements, whether due to fraud or error.

We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our audit opinion on the Banks internal financial controls with reference to Standalone Financial Statements.

Meaning of Internal Financial Controls with Reference to Financial Statements

A Banks internal financial controls with reference to Standalone Financial Statements is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of Standalone Financial Statements for external purposes in accordance with generally accepted accounting principles. Banks internal financial control with reference to financial statement includes those policies and procedures that

1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the Bank;

2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of Standalone Financial Statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the Bank are being made only in accordance with authorisations of management and directors of the Bank; and

3) provide reasonable assurance regarding prevention or timely detection of unauthorised acquisition, use, or disposition of the Banks assets that could have a material effect on the Standalone Financial Statements.

Inherent Limitations of Internal Financial Controls with Reference to Financial Statements

Because of the inherent limitations of internal financial controls with reference to Standalone Financial Statements, including the possibility of collusion or improper management override of controls, material misstatements due to error or fraud may occur and not be detected. Also, projections of any evaluation of the internal financial controls with reference to Standalone Financial Statements to future periods are subject to the risk that the internal financial control with reference to Standalone Financial Statement become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Opinion

In our opinion the Bank has maintained, in all respects, an adequate internal financial control system with reference to Financial Statements and such internal financial controls with reference to the Financial Statements were operating effectively as at March 31,2023, based on internal control with reference to financial statement criteria established by the Bank considering the essential components of internal control stated in the Guidance Note.

Knowledge Centerplus
Logo

Logo IIFL Customer Care Number
(Gold/NCD/NBFC/Insurance/NPS)
1860-267-3000 / 7039-050-000

Logo IIFL Securities Support WhatsApp Number
+91 9892691696

Download The App Now

appapp
Knowledge Centerplus

Follow us on

facebooktwitterrssyoutubeinstagramlinkedin

2024, IIFL Securities Ltd. All Rights Reserved

ATTENTION INVESTORS
  • Prevent Unauthorized Transactions in your demat / trading account Update your Mobile Number/ email Id with your stock broker / Depository Participant. Receive information of your transactions directly from Exchanges on your mobile / email at the end of day and alerts on your registered mobile for all debits and other important transactions in your demat account directly from NSDL/ CDSL on the same day." - Issued in the interest of investors.
  • KYC is one time exercise while dealing in securities markets - once KYC is done through a SEBI registered intermediary (broker, DP, Mutual Fund etc.), you need not undergo the same process again when you approach another intermediary.
  • No need to issue cheques by investors while subscribing to IPO. Just write the bank account number and sign in the application form to authorise your bank to make payment in case of allotment. No worries for refund as the money remains in investor's account."

www.indiainfoline.com is part of the IIFL Group, a leading financial services player and a diversified NBFC. The site provides comprehensive and real time information on Indian corporates, sectors, financial markets and economy. On the site we feature industry and political leaders, entrepreneurs, and trend setters. The research, personal finance and market tutorial sections are widely followed by students, academia, corporates and investors among others.

RISK DISCLOSURE ON DERIVATIVES
  • 9 out of 10 individual traders in equity Futures and Options Segment, incurred net losses.
  • On an average, loss makers registered net trading loss close to Rs. 50,000.
  • Over and above the net trading losses incurred, loss makers expended an additional 28% of net trading losses as transaction costs.
  • Those making net trading profits, incurred between 15% to 50% of such profits as transaction cost.
Copyright © IIFL Securities Ltd. All rights Reserved.

Stock Broker SEBI Regn. No: INZ000164132, PMS SEBI Regn. No: INP000002213,IA SEBI Regn. No: INA000000623, SEBI RA Regn. No: INH000000248

plus
We are ISO 27001:2013 Certified.

This Certificate Demonstrates That IIFL As An Organization Has Defined And Put In Place Best-Practice Information Security Processes.