56. The activities of the internal audit function ( ), where established, or the internal audit …

The activities of the internal audit function (⁵² ), where established, or the internal audit review should cover, following a risk-based approach, the independent review of functions provided by TPSPs. The audit plan (⁵³ ) and programme should include the third-party arrangements supporting critical or important functions. With regard to the third-party arrangement process, the internal audit review should at least ascertain:

• a. that the financial entity ’ s framework for third-party arrangements, including the policy on third-party risk management, is correctly and effectively implemented and is in line with the applicable laws and regulation, the risk strategy, and the decisions of the management body;
• b. the adequacy, quality, and effectiveness of the assessment of the criticality or importance of functions;
• c. the adequacy, quality, and effectiveness of the risk assessment for third-party arrangements and that the risks remain in line with the financial entity ’s risk strategy;
• d. the appropriate involvement of governance bodies; and
• e. the appropriate monitoring and management of third-party arrangements.

⁵² Regarding the responsibilities of the internal audit function, institutions should refer to Section 22 of the EBA Guidelines on internal governance (https://eba.europa.eu/regulation-and-policy/internal-governance/guidelines-on-internal-governance-revised-), investment firms should refer to Section 20 of the EBA Guidelines on internal governance under Directive (EU) 2019/2034, issuers of ARTs to Section 16 of the EBA Guidelines on the minimum content of the governance arrangements for issuers of asset-referenced tokens under Regulation (EU) 2023/1114, and payment institutions should refer to Guideline 5 of the EBA guidelines on the authorisation of payment institutions and e-money institutions under PSD 2 (Guidelines on authorisation and registration under PSD 2).

⁵³ See also EBA Guidelines on the supervisory review and evaluation process: https://eba.europa.eu/regulation-and-policy/supervisory-review-and-evaluation-srep-and-pillar-2/guidelines-for-common-procedures-and-methodologies-for-the-supervisory-review-and-evaluation-process-srep-and-supervisory-stress-testing.

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Standards

2. Identifizierte Anforderungen

3. Zugehörige Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/