22 Internal audit function

Institutions should set up an independent and effective internal audit function (IAF), taking into account the proportionality criteria set out in Title I, and should appoint a person to be responsible for this function across the entire institution. The IAF should be independent and have sufficient authority, stature and resources. In particular, the institution should ensure that the qualification of the IAF ’s staff members and the IAF’s resources, in particular its auditing tools and risk analysis methods, are adequate for the institution ’s size and locations, and the nature, scale and complexity of the risks associated with the institution ’s business model, activities, risk culture and risk appetite.

The IAF should be independent of the audited activities. Therefore, the IAF should not be combined with other functions.

The IAF should, following a risk-based approach, independently review and provide objective assurance of the compliance of all activities and units of an institution, including outsourced activities, with the institution ’ s policies and procedures and with regulatory requirements. Each entity within the group should fall within the scope of the IAF.

The IAF should not be involved in designing, selecting, establishing and implementing specific internal control policies, mechanisms and procedures, and risk limits. However, this should not prevent the management body in its management function from requesting input from internal audit on matters related to risk, internal controls and compliance with applicable rules.

The IAF should assess whether the institution ’s internal control framework as set out in Section 15 is both effective and efficient. In particular, the IAF should assess:

• a. the appropriateness of the institution ’ s governance framework;
• b. whether existing policies and procedures remain adequate and comply with legal and regulatory requirements and with the risk strategy and risk appetite of the institution;
• c. the compliance of the procedures with the applicable laws and regulations and with decisions of the management body;
• d. whether the procedures are correctly and effectively implemented (e.g. compliance of transactions, the level of risk effectively incurred, etc.); and
• e. the adequacy, quality and effectiveness of the controls performed and the reporting done by the defence business units and the risk management and compliance functions.

The IAF should verify, in particular, the integrity of the processes ensuring the reliability of the institution ’s met hods and techniques, and the assumptions and sources of information used in its internal models (e.g. risk modelling and accounting measurements). It should also evaluate the quality and use of qualitative risk identification and assessment tools and the risk mitigation measures taken.

The IAF should have unfettered institution-wide access to all the records, documents, information and buildings of the institution. This should include access to management information systems and minutes of all committees and decision-making bodies.

The IAF should adhere to national and international professional standards. An example of the professional standards referred to here is the standards established by the Institute of Internal Auditors.

Internal audit work should be performed in accordance with an audit plan and a detailed audit programme following a risk-based approach.

An internal audit plan should be drawn up at least once a year on the basis of the annual internal audit control objectives. The internal audit plan should be approved by the management body.

All audit recommendations should be subject to a formal follow-up procedure by the appropriate levels of management to ensure and report on their effective and timely resolution.