5.2 Information on risk governance and management framework

On the set-up and governance of risk management and control frameworks, competent authorities should ensure that they receive from institutions the following:

• a. description of the overall governance arrangements, including the roles and responsibilities within the risk management and control organisation, including at the level of management body and senior management across the group, covering:
• i. risk taking, risk management and risk control, in general;
• ii. ICAAP and ILAAP and their key components, including inter alia risk identification, risk measurement, stress testing, capital and liquidity planning, limit structures, limit breaches, escalation procedures etc.);
• b. description of reporting lines and frequency of regular reporting to the management body covering the risk management and control of the risks;
• c. description of interaction between risk measurement and monitoring and actual risk taking practice (e.g. limit setting, monitoring, dealing with breaches etc.);
• d. description of processes and arrangements that ensure that the institution has in place a robust and integrated framework for the management of its material risks and their evolution, including (1) the interaction and integration of capital and liquidity management, including interaction between ICAAP and ILAAP, (2) interaction between management of various risk categories and institution-wide risk management, (3) integration of ICAAP and ILAAP into the risk management and the overall management of an institution, including in the pricing and performance management;
• e. where appropriate, description of separation of tasks within the group, institutional protection scheme or cooperative network concerning risk management.