13. Internal control functions

The internal control functions should include an effective and permanent internal compliance function, and where appropriate and proportionate, taking into account the criteria listed in Title I, a risk management function and an internal audit function. Where issuers of ARTs do not establish and maintain a risk management function and an internal audit function, they should be able to demonstrate upon request that the policies and procedures adopted and implemented for an internal control framework effectively achieve the same outcome as the guidelines provided in this Title V.

Issuers of significant ARTs are encouraged to establish internal risk management and internal audit functions. Where the issuer of ARTs does not establish an internal risk management function (RMF) or internal audit function (IAF), the responsibilities of these functions as set out in these guidelines are with the management body, who may delegate the operational tasks internally or externally to a third-party provider, e.g. in form of an outsourcing arrangement¹⁹ .

¹⁹ The outsourcing of operational tasks of compliance may still be possible.