5.5 Internal control framework and functions

Competent authorities should assess whether the investment firm has an internal control framework appropriate to the nature, scale and complexity of the investment firms’ activities, in accordance with the provisions laid down in EBA Guidelines on internal governance. This assessment should include, at least whether:

• a. investment firms implement the internal control framework covering the whole organisation, including the management body’s responsibilities and tasks, and the activities of all business lines and internal units, including internal control functions, outsourced activities and distribution channels;
• b. investment firms establish, maintain and regularly update adequate written internal control policies, mechanisms and procedures, which should be approved by the management body;
• c. investment firms’ business lines are responsible for managing the risks they incur in conducting their activities and have controls in place that aim to ensure compliance with internal and external requirements;
• d. the management body is responsible for establishing and monitoring the adequacy and effectiveness of the internal control framework, processes and mechanisms, and for overseeing all business lines and internal units, including internal control functions;
• e. where applicable, the internal control framework of the investment firm is adapted on an individual basis to the specificity of its business, its complexity and the associated risks, taking into account the group context;
• f. there is a clear, transparent and documented decision-making process and a clear allocation of responsibilities and authority within its internal control framework, including its business lines, internal units and internal control functions;
• g. there is exchange of the information necessary, including policies, mechanisms and procedures and their updates, in a timely manner that ensures that the management body, each business line and internal unit, including each internal independent control function, is able to carry out its duties;
• h. internal control functions regularly submit to the management body timely, accurate, concise, comprehensive, clear and useful written reports on major identified deficiencies and such reports include, for each new identified major deficiency, the relevant risks involved, an impact assessment, recommendations and corrective measures to be taken;
• i. internal control functions have access and can report directly to the management body in its supervisory function, to raise concerns if necessary;
• j. the management body follows up on the findings of the internal control functions in a timely and effective manner and requires adequate remedial actions and a formal follow-up procedure on findings and corrective measures taken.

5.5.2 Internal control functions

Competent authorities should assess whether the investment firm has an effective and permanent internal compliance function and, where appropriate and proportionate, a risk management function and internal audit function, with sufficient authority, stature, resources and, where necessary, direct access to the management body in its supervisory function and its committees, where established, including in particular the risk committee.

Competent authorities should assess whether the investment firm’s compliance function, and, where established, risk management function and internal audit function comply with the provisions of Title 5 of the EBA Guidelines on internal governance.