18.2 Independence of internal control functions

In accordance with Article 76(5) and (6) of Directive 2013/36/EU, institutions should have internal control functions independent from the operational functions and from the members of the management body in its management function and from senior management. This independence should not prevent internal control functions from interacting with business lines. Internal control functions should have direct access and can report directly to the management body in its supervisory function. This independence should be achieved by having appropriate and sufficient authority and stature, the ability to access directly and escalate any issue to the management body in its supervisory function where appropriate to fulfil their mission.

For the internal control functions to be regarded as independent as per paragraph 190, the following conditions should be met:

• a. their staff do not perform any operational tasks that fall within the scope of the activities the internal control functions are intended to monitor and control;
• b. they are organisationally separate from the activities they are assigned to monitor and control;
• c. notwithstanding the overall responsibility of members of the management body for the institution, the head of an internal control function should not be subordinate to a person who has responsibility for managing the activities the internal control function monitors and controls; and
• d. the remuneration of the internal control functions’ staff should not be linked to the performance of the activities the internal control function monitors and controls, and should not otherwise compromise their objectivity⁵⁴ .

⁵⁴ See also the EBA guidelines on sound remuneration policies, available at https://www.eba.europa.eu/regulation-and-policy/remuneration/guidelines-on-sound-remuneration-policies.