When assessing the institution’s corporate governance as referred to in Article 189 of Regulation (EU) No 575/2013, competent authorities shall verify that:
(a)
the decision-making process of the institution, its hierarchy, reporting lines- and levels of responsibility are clearly laid down in the internal documentation of the institution and consistently reflected in the minutes of its internal bodies;
(b)
both the management body or the committee designated by it and the senior management approve at least the following material aspects of the rating systems:
(i)
all relevant policies relating to the design and implementation of rating systems and the application of the IRB Approach, including the policies relating to all material aspects of the rating assignment and risk parameter estimation and validation processes;
(ii)
all relevant risk management policies, including those relating to IT infrastructure and contingency planning;
(iii)
the risk parameters of all rating systems used in internal risk management processes and in the calculation of own funds requirements;
(c)
the management body or the committee designated by it sets an appropriate organisational structure for the sound implementation of the rating systems by way of a formal decision;
(d)
the management body or the committee designated by it approves by way of a formal decision the specification of the acceptable level of risk, taking into account the internal rating system scheme of the institution;
(e)
the senior management has a good understanding of all rating systems of the institution, of their design and operation, of the requirements for the IRB Approach and of the institution’s approach to meeting those requirements;
(f)
the senior management notifies the management body or the committee designated by it of material changes to or exceptions from established policies that materially impact the operations of the institution’s rating systems;
(g)
the senior management is in a position to ensure on an ongoing basis the good functioning of the rating systems;
(h)
the senior management takes relevant measures where weaknesses of the rating systems are identified by the credit risk control, the validation, the internal audit or any other control function.
When assessing the adequacy of the management reporting as referred to in Article 189 of Regulation (EU) No 575/2013, competent authorities shall verify that:
(a)
the management reporting includes information about all of the following:
(i)
the risk profile of the obligors or exposures, by grade;
(ii)
the migration across grades;
(iii)
an estimation of the relevant risk parameters per grade;
(iv)
a comparison of realised default rates, and, where own estimates are used, of realised LGDs and realised conversion factors against expectations;
(v)
stress test assumptions and results;
(vi)
the performance of the rating process, areas needing improvement and the status of efforts to improve previously identified deficiencies of the rating systems;
(vii)
validation reports;
(b)
the form and the frequency of management reporting are adequate having regard to the significance and the type of the information and to the level the recipient occupies in the hierarchy, taking into account the institution’s organisational structure;
(c)
the management reporting facilitates the senior management’s monitoring of the credit risk in the overall portfolio of exposures covered by the IRB Approach;
(d)
the management reporting is proportionate to the nature, size, and degree of complexity of the institution’s business and organisational structure.
1. When assessing the internal governance and oversight of the institution in relation to the credit risk control unit referred to in Article 190 of Regulation (EU) No 575/2013, competent authorities shall verify that:
(a)
the credit risk control unit or units are separate and independent of the personnel and management functions responsible for originating or renewing exposures;
(b)
the credit risk control unit or units are functional and adequate for their tasks.
2. For the purposes of the verification under paragraph 1(a), competent authorities shall verify that:
(a)
the credit risk control unit or units are distinct organisational structures within the institution;
(b)
the head of the credit risk control unit or the heads of such units are part of the senior management;
(c)
the credit risk management function is organised taking into account the principles set out in Article 76(5) of Directive 2013/36/EU;
(d)
the staff and the senior management responsible for the credit risk control unit or units are not responsible for originating or renewing exposures;
(e)
senior managers of the credit risk control unit or units and of units responsible for originating or renewing exposures report to different members of the management body of the institution or of the committee designated by it;
(f)
the remuneration of the staff and senior management responsible for the credit risk control unit or units is not linked to the performance of the tasks relating to originating or renewing exposures.
3. For the purposes of the verification under paragraph 1(b), competent authorities shall verify that:
(a)
the credit risk control unit or units are proportionate to the nature, size and degree of complexity of the business and organisational structure of the institution, and in particular to the complexity of the rating systems and their implementation;
(b)
the credit risk control unit or units have adequate resources, and experienced and qualified personnel to undertake all relevant activities;
(c)
the credit risk control unit or units are responsible for the design or selection, implementation and oversight and the performance of the rating systems, as required by the second sentence of Article 190(1) of Regulation (EU) No 575/2013, and that the areas of responsibility of that unit or those units include those listed in Article 190(2) of that Regulation;
(d)
the credit risk control unit or units regularly inform the senior management of the performance of the rating systems, of areas needing improvement, and of the status of efforts to improve previously identified deficiencies.
1. When assessing the internal governance and oversight of the institution in relation to the internal audit or another comparable independent auditing unit, as referred to in Article 191 of Regulation (EU) No 575/2013, competent authorities shall verify that:
(a)
the internal audit or the other comparable independent auditing unit reviews the following, at least annually:
(i)
all rating systems of the institution;
(ii)
the operations of the credit risk control function;
(iii)
the operations of the credit approval process;
(iv)
the operations of the internal validation function;
(b)
the review under point (a) facilitates the specification in the annual work plan of areas that require a detailed review of compliance with all requirements applicable to the IRB Approach laid down in Articles 142 to 191 of Regulation (EU) No 575/2013;
(c)
the internal audit or the other comparable independent auditing unit are functional and adequate for their tasks.
2. For the purposes of the verification under paragraph 1(c), competent authorities shall verify that:
(a)
the internal audit or the other comparable independent auditing unit provides sufficient information to the senior management and the management body of the institution on the compliance of the rating systems with all applicable requirements for the IRB Approach;
(b)
the internal audit or the other comparable independent auditing unit is proportionate to the nature, size and degree of complexity of the institution’s business and organisational structure, and in particular to the complexity of the rating systems and their implementation;
(c)
the internal audit or the other comparable independent auditing unit has adequate resources, and experienced and qualified personnel to undertake all relevant activities;
(d)
the internal audit or the other comparable independent auditing unit is not involved in any aspect of the operation of the rating systems which it reviews in accordance with paragraph 1(a);
(e)
the internal audit or the other comparable independent auditing unit is independent from the personnel and management responsible for originating or renewing exposures and reports directly to senior management;
(f)
the remuneration of the staff and senior management responsible for the internal audit function is not linked to the performance of the tasks relating to originating or renewing exposures.
