5.3.3 Third line of defence controls

1. Overview

Summary	Regulation
98. The third line of defence, the independent internal audit function, should have sufficient NPE …	The third line of defence, the independent internal audit function, should have sufficient NPE workout expertise to perform its periodic control activities on the efficiency and effectiveness of the NPE framework, including the first- and second-line controls.
99. With regard to the NPE framework, the internal audit function should, at least, perform regular …	With regard to the NPE framework, the internal audit function should, at least, perform regular assessments to monitor adherence to internal NPE-related policies (see Annex 4) and to this guidance. This should also include random and unannounced inspections and credit file reviews.
100. In determining the frequency, scope and scale of the controls to be carried out, credit …	In determining the frequency, scope and scale of the controls to be carried out, credit institutions should take into account the level of NPEs and whether significant irregularities and weaknesses have been identified by recent audits.
101. Based on the results of its controls, the internal audit function should make recommendations …	Based on the results of its controls, the internal audit function should make recommendations to the management body, bringing possible improvements to their attention.

Requirements
Source	Requirement

Standards
Source	Requirement