Independence of the validation function
1. When assessing the independence of the validation function for the purposes of Article 144(1)(f), Article 174(d), Article 185 and Article 188 of Regulation (EU) No 575/2013, competent authorities shall verify that the unit responsible for the validation function or, where there is no separate unit dedicated only to the validation function, the staff performing the validation function fulfils all of the following:
(a)
the validation function is independent from the personnel and management function responsible for originating or renewing exposures and for the model design or development;
(b)
the staff performing the validation function is different from the staff responsible for the design and development of the rating system, and from the staff responsible for the credit risk control function;
(c)
it reports directly to senior management.
2. For the purposes of paragraph 1, where the unit responsible for the validation function is organisationally separate from the credit risk control unit and each unit reports to different members of the senior management, competent authorities shall verify, both of the following:
(a)
that the validation function has adequate resources, including experienced and qualified personnel to perform its tasks;
(b)
that the remuneration of the staff and senior managers responsible for the validation function is not linked to the performance of the tasks relating to either credit risk control or to originating or renewing exposures.
3. For the purposes of paragraph 1, where the unit responsible for the validation function is organisationally separate from the credit risk control unit, and both units report to the same member of the senior management, competent authorities shall verify all of the following:
(a)
that the validation function has adequate resources, including experienced and qualified personnel to perform its tasks;
(b)
that the remuneration of the staff and senior managers responsible for the validation function is not linked to the performance of the tasks relating to either credit risk control or to originating or renewing exposures;
(c)
that there is a decision-making process in place to ensure that the conclusions, findings and recommendations of the validation function are properly taken into account by the senior management of the institution;
(d)
that no undue influence is exercised on the conclusions, findings and recommendations of the validation function;
(e)
that all necessary corrective measures to address the conclusions, findings and recommendations of the validation function are decided and implemented in a timely manner;
(f)
that internal audit regularly assesses the fulfilment of the conditions referred to in points (a) to (e).
4. For the purposes of paragraph 1, where there is no separate unit responsible for the validation function, competent authorities shall verify all of the following:
(a)
that the validation function has adequate resources, including experienced and qualified personnel to perform its tasks;
(b)
that the remuneration of the staff and senior managers responsible for the validation function is not linked to the performance of the tasks relating to either credit risk control or to originating or renewing exposures;
(c)
that there is a decision-making process in place to ensure that the conclusions, findings and recommendations of the validation function are properly taken into account by the senior management of the institution;
(d)
that no undue influence is exercised on the conclusions, findings and recommendations of the validation function;
(e)
that all necessary corrective measures to address the conclusions, findings and recommendations of the validation function are decided and implemented in a timely manner;
(f)
that internal audit regularly assesses the fulfilment of the conditions referred to in points (a) to (e);
(g)
that there is effective separation between the staff performing the validation function and the staff performing the other tasks;
(h)
that the institution is not a global or other systemically important institution in the meaning of Article 131 of Directive 2013/36/EU.
5. When assessing the independence of the validation function, competent authorities shall also assess whether the choice of the institution with regard to the organisation of the validation function as referred to in paragraphs 2, 3 and 4 is adequate, taking into account the nature, size and scale of the institution and the complexity of the risks inherent in its business model.
Completeness and frequency of the validation process
1. When assessing the completeness of the validation function for the purposes of the requirements laid down in Article 144(1)(f), Article 174(d), Article 185 and Article 188 of Regulation (EU) No 575/2013, competent authorities shall verify that:
(a)
the institution has defined and documented a complete validation process for all rating systems;
(b)
the institution performs the validation process referred to in point (a) with an adequate frequency.
2. When assessing the completeness of the validation process as referred to in paragraph 1(a), competent authorities shall verify that the validation function:
(a)
critically reviews all the aspects of the specification of the internal ratings and risk parameters, including the procedures for data collection and data cleansing, the choices of the methodology and model structure, and the process for the selection of the variables;
(b)
verifies the adequacy of the implementation of internal ratings and risk parameters in IT systems and that grade and pool definitions are consistently applied across departments and geographic areas of the institution;
(c)
verifies the performance of the rating systems taking into account at least risk differentiation and quantification and the stability of the internal ratings and risk parameters and the model specifications;
(d)
verifies all changes relating to internal ratings and risk parameters and their materiality in accordance with the Delegated Regulation (EU) No 529/2014 and that it consistently follows up on its own conclusions, findings and recommendations.
3. When assessing whether the frequency of the validation process referred to in paragraph 1(b) is adequate, competent authorities shall verify that the validation process is performed regularly for all rating systems of the institution following an annual work plan and that:
(a)
for all rating systems the processes required by Article 185(b) and Article 188(c) of Regulation (EU) No 575/2013 (‘back-testing’) are performed at least once annually;
(b)
for the rating systems covering material types of exposures, the verification of the performance of the rating systems as referred to in paragraph 2(c), takes place at least once annually.
4. Where an institution applies for permission to use the internal ratings and risk parameters of a rating system or for any material changes to internal ratings and risk parameters of a rating system, competent authorities shall verify that the institution performs the validation referred to in paragraph 2(a), (b) and (c) before the rating system is used for the calculation of own funds requirements and for internal risk management purposes.
Adequacy of the methods and procedures of the validation function
When assessing the adequacy of the validation methods and procedures for the purposes of the requirements laid down in Article 144(1)(f), Article 174(d), Article 185 and Article 188 of Regulation (EU) No 575/2013, competent authorities shall verify that those methods and procedures allow for a consistent and meaningful assessment of the performance of the internal rating and risk estimation systems, and shall verify that:
(a)
the validation methods and procedures are appropriate for assessing the accuracy and consistency of the rating system;
(b)
the validation methods and procedures are appropriate to the nature, degree of complexity and range of application of the institution’s rating systems and data availability;
(c)
the validation methods and procedures clearly specify the validation objectives, standards and limitations, contain a description of all validation tests, data sets, and data cleansing processes, set out data sources and reference time periods, and set the fixed targets and tolerances for defined metrics, for the initial and regular validation respectively;
(d)
the validation methods used, and in particular the tests performed, the reference data set used for the validation and the respective data cleansing, are applied consistently over time;
(e)
the validation methods include back-testing, and benchmarking as set out in Article 185(c) and Article 188(d) of Regulation (EU) No 575/2013;
(f)
the validation methods take account of the way business cycles and the related systematic variability in default experience are considered in the internal ratings and risk parameters, especially regarding PD estimation.
Soundness of the reporting process and the process for addressing the validation conclusions, findings and recommendations
When assessing the soundness of the reporting process and the process to address the validation conclusions, findings and recommendations, for the purposes of the requirements laid down Article 144(1)(f), Article 174(d), Article 185 and Article 188 of Regulation (EU) No 575/2013, competent authorities shall verify that:
(a)
the validation reports identify and describe the validation methods used, the tests performed, the reference data set used and the respective data cleansing processes and include the results of those tests, the conclusions of the validation, the findings and the respective recommendations;
(b)
the conclusions, findings and recommendations of the validation reports are directly communicated to senior management and to the management body of the institution or to the committee designated by it;
(c)
the conclusions, findings and recommendations of the validation reports are reflected in changes and improvements in the design of internal ratings and risk estimates, including in the situations described in the first sentence of Article 185(e) and Article 188(e) of Regulation (EU) No 575/2013;
(d)
the decision-making process of the institution takes place at the appropriate management level.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
