56. The activities of the internal audit function ( ), where established, or the internal audit …

The activities of the internal audit function (⁵² ), where established, or the internal audit review should cover, following a risk-based approach, the independent review of functions provided by TPSPs. The audit plan (⁵³ ) and programme should include the third-party arrangements supporting critical or important functions. With regard to the third-party arrangement process, the internal audit review should at least ascertain:

• a. that the financial entity ’ s framework for third-party arrangements, including the policy on third-party risk management, is correctly and effectively implemented and is in line with the applicable laws and regulation, the risk strategy, and the decisions of the management body;
• b. the adequacy, quality, and effectiveness of the assessment of the criticality or importance of functions;
• c. the adequacy, quality, and effectiveness of the risk assessment for third-party arrangements and that the risks remain in line with the financial entity ’s risk strategy;
• d. the appropriate involvement of governance bodies; and
• e. the appropriate monitoring and management of third-party arrangements.

⁵² Regarding the responsibilities of the internal audit function, institutions should refer to Section 22 of the EBA Guidelines on internal governance (https://eba.europa.eu/regulation-and-policy/internal-governance/guidelines-on-internal-governance-revised-), investment firms should refer to Section 20 of the EBA Guidelines on internal governance under Directive (EU) 2019/2034, issuers of ARTs to Section 16 of the EBA Guidelines on the minimum content of the governance arrangements for issuers of asset-referenced tokens under Regulation (EU) 2023/1114, and payment institutions should refer to Guideline 5 of the EBA guidelines on the authorisation of payment institutions and e-money institutions under PSD 2 (Guidelines on authorisation and registration under PSD 2).

⁵³ See also EBA Guidelines on the supervisory review and evaluation process: https://eba.europa.eu/regulation-and-policy/supervisory-review-and-evaluation-srep-and-pillar-2/guidelines-for-common-procedures-and-methodologies-for-the-supervisory-review-and-evaluation-process-srep-and-supervisory-stress-testing.

1. Pregled

1.1 Reference

1.2 Utvrđeni zahtjevi

1.3 Povezani standardi

2. Utvrđeni zahtjevi

3. Povezani standardi

• EBA -

  EN: Guidelines and other publications of the European Banking Authority (EBA), https://www.eba.europa.eu/. © European Banking Authority. Reproduction is authorised provided the source is acknowledged (EBA legal notice). Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by the EBA are authoritative.

  DE: Leitlinien und weitere Veröffentlichungen der Europäischen Bankenaufsichtsbehörde (EBA), https://www.eba.europa.eu/. © European Banking Authority. Wiedergabe mit Quellenangabe gestattet (Rechtlicher Hinweis der EBA). In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die von der EBA veröffentlichten Fassungen.