General considerations
Competent authorities should assess whether or not an institution’s internal governance arrangements are adequate for and commensurate with the institution’s risk profile, business model, nature, size and complexity. They should identify the extent to which the institution complies with the applicable EU and national requirements regarding sound internal governance arrangements and identify any shortcomings. Competent authorities should evaluate, in particular, whether or not the internal governance arrangements ensure the sound management of risks and include appropriate internal controls and oversight. Competent authorities should establish if there are material risks posed by poor internal governance arrangements and their potential effect on the risk profile and sustainability of the institution.
For SREP, the assessment of institution’s internal governance and institution-wide controls should include an assessment of the following areas:
the overall internal governance framework, which should include a clear organisational structure;
the composition, organisation and functioning of the management body and its committees, where established;
corporate and risk culture;
remuneration policies and practices;
the internal control framework, which should include well-functioning independent risk management, compliance and internal audit functions;
the risk management framework, including ICAAP, ILAAP, new product approval process, including material changes to products, systems and processes and exceptional transactions;
the integrity of administrative and accounting procedures;
outsourcing policy and strategy;
information and communication technologies and business continuity; and
the recovery plan.
The assessment of internal governance should inform the specific assessment of risk management and controls as specified in Titles 6 and 8, as well as the assessment of ICAAP and ILAAP in the SREP capital assessment (Title 7) and the SREP liquidity assessment (Title 9). Likewise, a risk-by-risk analysis of ICAAP calculations/capital estimates reviewed under Title 7, and any deficiencies identified thereby, should inform the assessment of the overall ICAAP framework assessed under this title.
In line with the EBA Guidelines on internal governance(18), the assessment of the internal governance framework should include the verification of the existence of governance arrangements and mechanisms to ensure that the institution complies with applicable AML/CFT requirements and take into account any supplementary information received from the AML/CFT supervisor on the assessment of these arrangements and mechanisms.