104. Financial entities should make use of the method referred to in paragraph 102(b) only if they …

Financial entities should make use of the method referred to in paragraph 102(b) only if they:

a. are satisfied with the audit plan for the services provided by TPSPs;
b. ensure that the scope of the certification or audit report covers the systems (i.e. processes, applications, infrastructure, data centres, etc.) and key controls identified by the financial entity and the compliance with relevant regulatory requirements;
c. thoroughly assess the content of the certifications or audit reports, on an ongoing basis and verify that the reports or certifications are not obsolete;
d. ensure that key systems and controls are covered in future versions of the certification or audit report;
e. are satisfied with the aptitude of the certifying or auditing party (e.g. with regard to rotation of the certifying or auditing company, qualifications, expertise, re-performance/verification of the evidence in the underlying audit file);
f. are satisfied that the certifications are issued and the audits are performed against widely recognised relevant professional standards and include a test of the operational effectiveness of the key controls in place;
g. have the contractual right to request the expansion of the scope of the certifications or audit reports to other relevant systems and controls; the number and frequency of such requests for scope modification should be reasonable and legitimate from a risk management perspective; and
h. retain the contractual right to perform individual audits at their discretion with regard to the use of TPSPs to support critical or important functions.

1. Visão geral

Título	Regulamentação

Requisitos
Fonte	Requisito

Normas
Fonte	Requisito