18.1 Heads of the internal control functions

The heads of internal control functions should be established at an adequate hierarchical level that provides the head of the control function with the appropriate authority and stature needed to fulfil their responsibilities. Where, in accordance with Article 76(6) of Directive 2013/36/EU and under the conditions referred to in paragraph 30, an internal control function is headed by a member of the management body in its management function, the institution should ensure that appropriate safeguards and mitigants are in place to avoid conflicts of interest, such as, but not limited to, an independent mindset of the individual and appropriate key performance indicators, including objective appraisal and remuneration determination.

The heads of internal control functions should have direct access and can report directly to the management body in its supervisory function. They should be able to raise concerns and warn the supervisory function, where appropriate, or where specific risk developments affect or can affect the institution. This should not prevent the heads of internal control functions from reporting within the regular reporting lines as well. These arrangements should be reflected in the institution’s mapping of duties and in the concerned persons’ individual statements referred to in paragraphs 71 and 75.

Institutions should have documented processes in place for assigning the position of the head of an internal control function and for withdrawing their responsibilities. In any case, the heads of internal control functions must not, under Article 76(6) of Directive 2013/36/EU, be removed without the prior approval of the management body in its supervisory function. In significant institutions, competent authorities should be promptly informed about the approval and the main reasons for the removal of a head of an internal control function.