General considerations
When assessing the internal governance and institution-wide controls, competent authorities should evaluate inter alia the compliance of the institution with the legal acts published separately on the EBA website as referred to in paragraph 12.
Competent authorities should assess the adequacy of the institution’s internal governance arrangements, taking into account the nature, scale and complexity of the risks inherent in the business model and the institution’s activities. Competent authorities should identify the extent to which the institution complies with the applicable legal and regulatory requirements regarding sound internal governance arrangements, including those listed in the previous paragraph, and identify any deficiencies. Competent authorities should assess whether material risks are posed due to poor internal governance arrangements and their potential effect on the risk profile, operational resilience and sustainability of the institution. For these purposes, the following areas should be assessed, in accordance with the proportionality principle and supervisory engagement outlined in Title 2:
organisational structure, management body and its committees;
risk culture and business conduct;
remuneration policies and practices;
internal control functions;
risk management framework;
ICT systems, risk data aggregation and risk reporting;
ML/TF risks and prudential concerns;
recovery planning governance.
Competent authorities should take into account ESG risks, giving priority to environmental transition and physical risks, when assessing the areas covered by points (a) to (f) of the previous paragraph.
The assessment of internal governance should inform the specific assessment of risk management and controls as specified in Titles 6 and 8, as well as the assessment of ICAAP and ILAAP in the SREP capital assessment (Title 7) and the SREP liquidity and funding assessment (Title 8). Likewise, a risk-by-risk analysis of ICAAP calculations/capital estimates reviewed under Title 7, and any deficiencies identified through that analysis, should inform the assessment of the overall ICAAP framework assessed under this Title.
As part of the overall assessment of internal governance and institution-wide controls, competent authorities should evaluate the institution’s ability to effectively and timely remedy the deficiencies identified and/or supervisory concerns expressed by competent authorities. In conducting this evaluation, competent authorities should consider whether the institution’s track record demonstrates its ability and intention to address supervisory concerns and/or identified deficiencies in an effective and timely manner, and whether this has been already taken into account in the assessment of other SREP areas. For this purpose, competent authorities should leverage the assessment of the following elements:
the role of management body in (i) assessing the effectiveness of the institution’s governance arrangements, in particular relating to the remediation actions, and (ii) taking appropriate measures to address supervisory concerns and/or deficiencies (effective reaction to supervisory concerns);
the risk culture within the institution;
the adequacy and timeliness of information provided and exchanged with the competent authority;
the quality of internal reporting on remediation actions to the management body, senior management and internal control functions;
the role of internal control functions in reviewing the adequacy and effectiveness of the remediation actions undertaken.
When conducting the assessment of internal governance and institution-wide controls at subsidiary level, in addition to the elements listed in this title, competent authorities should assess whether group-wide policies and procedures are implemented consistently at subsidiary level, and whether group entities have taken appropriate measures to ensure that their activities are compliant with all applicable laws and regulations.