CP10 (Full Document) - European Banking Authority

effectiveness and soundness of the IRB system. The problem is how
to ensure and enforce independence. A control function can generally
be regarded as independent if the following conditions are met:
· The staff of the control function should not have any tasks to
perform that fall within the scope of the activities that the control
function is assigned to monitor and control;
· The control function should be organisationally separate from the
activities it is assigned to monitor and control. The head of the
control function should be subordinated to a person who has no
responsibility for the activities that are being monitored and
controlled.
· The head of the control function should report directly to the
management body (both supervisory and management functions)
and/or the audit committee.
· The remuneration of the control function staff should not be
linked to the performance of the activities that the control
function is assigned to monitor and control.
386. There is no single way to achieve independence, but rather different
options. One option is to make the CRCU depend directly on the
Management body (management function). Another option could be
to maintain a separation between the control functions and the
commercial area/relationship managers, up to the level of the
responsible member of senior management.
387. Whatever option is adopted by the institution, part of the duties of
Internal Audit should be to determine the ‘real’ degree of
independence of the CRC function.
388. A strict separation between the commercial function and the CRC
unit (but not the CRC function) could have undesirable effects. For
example, models developed by risk managers without the
contribution of relationship managers could be rejected by the latter,
or staff from the commercial lines could be tempted to force some of
the model’s inputs (especially qualitative inputs) in order to ‘adjust’
the model’s outcome to their assessments (affecting the use test).
Consequently, staff from the credit risk control unit and commercial
department should co­operate actively in the development of the
model. In order to ensure the desired independence after model
development is complete, the exchange of information could best be
through committees.
3.6.3. Role of Internal Audit
389. The Internal Audit function reviews whether the institution’s control
systems for internal ratings and related parameters are robust
(Annex VII, Part 4, Paragraph 130). As part of its review of control
mechanisms, Internal Audit will evaluate the depth, scope, and
quality of the Credit Risk Control function’s work. Internal Audit will
also conduct tests to ensure that Credit Risk Control function’s
Page 92 of 123