CP10 (Full Document) - European Banking Authority

367. The management body should also check, on a regular basis, that
the control procedures and measurement systems adopted by the
credit risk control unit and Internal Audit are adequate and that the
overall IRB system remains effective over time.
368. The management body (both supervisory and management
functions) is responsible for making formal decisions on the
implementation of the IRB approach. This includes overall approval
of the project, the specification of goals (advanced/foundation
approach), and the appointment of the organisational structures
responsible for implementation. A time schedule of the necessary
steps should be provided with the project approval. The management
body (both supervisory and management functions) is ultimately
responsible for sound governance of the IRB framework, and the
further governance described below should flow from this body.
369. The main goal of the management body (management function) is to
ensure that all components of the IRB system, including controls, are
functioning as intended. This means that the management body
(management function) has to verify, on an ongoing basis, that
control mechanisms and measurement systems adopted by the
credit risk control unit are adequate and that the overall IRB system
remains effective over time. The management body (management
function) should have an extensive understanding of credit policies,
underwriting standards, lending practices, and collection and
recovery practices, and should understand how these factors affect
the estimation of relevant risk parameters. The tasks to be
addressed by the management body (managing function) should
include:
· Ensuring the soundness of risk­taking processes, even in a rapidly
changing environment;
· Determining how internal ratings are used in the risk­taking
processes;
· Informing the management body (supervisory function) – or a
designated committee thereof – of material changes or exceptions
from established policies that will materially impact the operations
of the institution’s rating systems;
· Identifying and assessing the main risk drivers, based on the
information provided by the Credit Risk Control Unit;
· Defining the tasks of the risk control unit and evaluating the
adequacy of its professional skills;
· Monitoring and managing all sources of potential conflicts of
interest;
· Establishing effective communication channels in order to ensure
that all staff are aware of relevant policies and procedures;
· Defining the minimum content of reporting to the management
body (supervisory function) or to different delegated bodies
thereof (e.g., the Risk Committee);
Page 88 of 123