5.3 Control framework

The management body should be responsible for establishing and monitoring the adequacy and effectiveness of the internal control framework. In particular, effective and efficient internal control processes should be implemented for the NPE workout framework in order to ensure full alignment between the NPE strategy and operational plan on the one hand and the credit institution’s overall business strategy, including the NPE strategy and operational plan, and risk appetite on the other hand.

Internal control functions should regularly submit to the management body written reports on NPE management highlighting major identified deficiencies. These reports should include, for each new identified major deficiency, the relevant risks involved, an impact assessment, recommendations and corrective measures to be taken. Where necessary, the heads of internal control functions should be able to have access to and report directly to the management body in its supervisory function to raise concerns and warn the supervisory function, where appropriate, when specific developments affect or may affect the institution. This should not prevent the heads of internal control functions from reporting within regular reporting lines as well.

The management body should follow up on the findings of the internal control functions in a timely and effective manner and require adequate remedial actions. A formal follow-up procedure on findings and corrective measures taken should be put in place.

The internal control framework should involve all three lines of defence in line with the EBA Guidelines on internal governance.³⁰ The roles of the different functions involved should be assigned and documented clearly to avoid gaps or overlaps. Key outcomes of second- and third-line activities as well as defined mitigating actions and progress on those needs should be reported to the management body regularly.

³⁰ Guidelines on internal governance under Directive 2013/36/EU (EBA/GL/2017/11).

In the implementation of the control framework, larger and more complex credit institutions should apply all three lines of defence; the second line of defence does not have to be NPE specific and may be performed by the credit risk (control) function.

In the implementation of the control framework, smaller and less complex credit institutions (e.g. those that are classified in SREP Category 3 or 4) do not necessarily have to have three fully fledged NPE-specific lines of defence, but they have to ensure that any conflict of interest is sufficiently mitigated.

5.3.1 First line of defence controls

5.3.2 Second line of defence controls

5.3.3 Third line of defence controls