15 Implementing an internal control framework

The management body should be responsible for establishing and monitoring the adequacy and effectiveness of the internal control framework, processes and mechanisms, and for overseeing all business lines and internal units, including internal control functions (such as compliance including AML/CFT compliance where separate from the compliance function, and risk management and internal audit functions where established). Investment firms should establish, maintain and regularly update adequate written internal control policies, mechanisms and procedures, which should be approved by the management body. Where no risk management function is established, the management body should be responsible for establishing and monitoring adequate risk management procedures and policies.

An investment firm should have a clear, transparent and documented decision-making process and a clear allocation of responsibilities and authority within its internal control framework, including its business lines, internal units and internal control functions.

Investment firms should communicate these policies, mechanisms and procedures to all staff and every time material changes have been made.

The internal control functions should verify that the policies, mechanisms and procedures set out in the internal control framework are correctly implemented in their respective areas of competence.

Internal control functions should regularly submit to the management body written reports on major deficiencies that have been identified. These reports should include, for each new major deficiency identified, the relevant risks involved, an impact assessment, recommendations and corrective measures to be taken. The management body should follow up on the findings of the internal control functions in a timely and effective manner and require adequate remedial actions. A formal follow-up procedure on findings and corrective measures taken should be put in place.