CP10 (Full Document) - European Banking Authority

357. Annex VII, Part 4, Paragraphs 123 to 126 use the terms ‘board of
directors’ and ‘senior management.’ The use of these terms is not
intended to advocate any particular board structure, recognising that
there are significant differences in legislative and regulatory
frameworks across EU countries regarding the structure and
functions of the management body referred to in the CRD.
358. Within an institution there are two distinct functions that must be
fulfilled: supervision and management. Roughly half of all EU
member states have a one­tier board structure in which both
functions are performed within the board of directors. The
supervisory function is performed by the non­executive directors and
the management function is performed by the executive directors.
The other half of EU members states have a two­tier board structure.
In a majority of these member states, the supervisory function is
performed by the board of directors and the management function is
performed by the managing director together with some key
executives. (Both the managing director and the key executives are
appointed by the board of directors.) This executive group, including
the managing director, is usually called the ‘senior management.’
359. When the term ‘management body’ is used in this paper, it is meant
to encompass both one­tier and two­tier board structures. The
guidelines always make clear which function (supervisory,
management, or both) is being referred to.
360. Annex VII, Part 4, Paragraph 127 refers to the ‘Credit Risk Control
Unit’ (CRCU). It is useful at this point to distinguish between the
organisational part and the functional part (the Credit Risk Control
function) of this term. As part of the internal control function, the
Credit Risk Control function should be independent from the business
lines it monitors and controls. It is designed and implemented to
address the risks that the institution identifies through the risk
assessment process.
361. Large, complex, and sophisticated institutions should establish a risk
control function to monitor each of the material risks (within material
business lines) to which the institution is exposed. The risk control
function should report to the management body (management
function) and other relevant staff.
362. Although in most cases the organisational part of the CRCU and the
CRC function would be identical (and consequently the CRCU would
encompass only people responsible for fulfilling the Credit Risk
Control function), the CRCU could, as an organisational unit,
encompass both people responsible for the design of the model and
people responsible for the independent review of the model.
363. As far as the design of the rating models is concerned, the CRD
affirms that the CRCU “shall be responsible for the design or
selection, implementation, oversight and performance of the rating
Page 86 of 123