16. Internal audit function

Where established, the internal audit function (IAF) should be independent and have sufficient authority, stature and resources. In particular, issuers of ARTs should ensure that the qualification of the IAF’s staff members and the IAF’s resources, in particular its auditing tools and risk analysis methods, are adequate for the issuer of ARTs size and locations, and the nature, scale and complexity of the risks associated with the issuer of ARTs ’ business model, activities, risk culture and risk appetite.

The IAF should be independent of the audited activities. Therefore, the IAF should not be combined with other functions.

The IAF should, following a risk-based approach, independently review and provide objective assurance of the compliance of all activities and units of an issuer of ARTs, including the use of third-party entities, with the issuer of ARTs ’ policies and procedures and with external regulatory requirements.

The IAF should not be involved in designing, selecting, establishing or implementing specific internal control policies, mechanisms, procedures or risk limits. However, this should not prevent the management body in its management function from requesting input from internal audit on matters relating to risk, internal controls and compliance with applicable rules.

The IAF should assess whether the issuer of ARTs ’ internal control framework as set out in Title V is both effective and efficient. In particular, the IAF should assess:

• a. the appropriateness of the issuer of ARTs’ governance framework;
• b. whether existing policies and procedures remain adequate and comply with legal and regulatory requirements and with the risk strategy and risk appetite of the issuer of ARTs;
• c. the compliance of the procedures with the applicable laws and regulations and with decisions of the management body;
• d. whether the procedures are correctly and effectively implemented (e.g. compliance of transactions, the level of risk effectively incurred, etc.); and
• e. the adequacy, quality and effectiveness of the controls carried out and the reporting conducted by the business units (first line of defence) and the risk management and compliance functions.

The IAF should verify, in particular, the integrity of the processes ensuring the reliability of the issuer of ARTs ’ methods and techniques for risk quantification, including models. It should also evaluate the quality and use of qualitative risk identification and assessment tools and the risk mitigation measures taken.

The IAF should review the adequateness of the processes for the development of white papers, their approval and the processes how ARTs are offered to the public.

The IAF should have unfettered issuer-wide access to all the records, documents, information and buildings of the issuer of ARTs. This should include access to management information systems and minutes of all committees and decision-making bodies.

The IAF should adhere to national and international professional standards. An example of the professional standards referred to here is the standards established by the Institute of Internal Auditors.

Internal audit work should be performed regularly in accordance with an audit plan and a detailed audit programme following a risk-based approach.

An internal audit plan should be drawn up at least once a year on the basis of the annual internal audit control objectives. The internal audit plan should be approved by the management body.

All audit recommendations should be subject to a formal follow-up procedure by the appropriate levels of management, communicated to the management body of the issuer of ARTs and made available to the competent authority to ensure and report on their effective and timely resolution.