Internal controls

With regard to IRRBB control policies and procedures, institutions should have appropriate approval processes, exposure limits, reviews and other mechanisms designed to provide a reasonable assurance that risk management objectives are being achieved.

Institutions should undertake regular reviews and evaluations of their internal control systems and risk management processes, seeking assurance that personnel comply with established policies and procedures. Such reviews should also address any significant changes that may affect the effectiveness of controls, including changes in market conditions, personnel, technology and structures of compliance with exposure limits, and ensure that there are appropriate escalation procedures for any exceeded limits. The reviews and evaluations should be conducted regularly by individuals or units that are independent of the function under review. When revisions or enhancements to internal controls are warranted, there should be an internal review mechanism in place to ensure that these are implemented in a timely manner.

Institutions should have their IRRBB identification, measurement, monitoring and control processes reviewed by an independent auditing function, which may be an internal or external auditor, on a regular basis. In such cases, reports written by internal or external auditors or other equivalent external parties should be made available to relevant competent authorities.