CP10 (Full Document) - European Banking Authority

this requirement is to ensure that the results of the external audit
review are not incorrectly taken to apply to the subsidiaries.
406. The management of an institution (subsidiary or otherwise) is
responsible for, and has full, independent control over the review of
the institution, regardless of whether that review is performed by an
internal or external unit. The management of the institution should
communicate directly with the assessment unit at all stages, and the
assessment unit in turn should report directly to the management of
the institution during the review.
407. The external auditor may perform an independent assessment of a
vendor’s technology only if there are no relationships (including
commercial and/or marketing relationships) between any parts of the
two companies that could compromise the independence of the
assessment.
408. An institution using a vendor’s methodology should also perform a
review through its own Internal Audit or other internal assessment
unit, to ensure a thorough understanding of the vendor’s
methodologies. Such a review should be considered reliable only if it
is performed by a unit (internal or external) that is sufficiently
familiar with all aspects of the reviewed systems and methodologies.
4. Supervisor’s assessment of the application concerning the
minimum requirements of the CRD – Operational risk
4.1. Partial use combinations
409. The CRD allows a broad range of partial use possibilities, including
the combined use of the Business Indicator Approach (BIA) and the
Standardised Approach (TSA) (Annex X, Part 4, Section 2), and the
use of the Advanced Measurement Approach (AMA) in combination
with other approaches (Annex X, Part 4, Section 1). The question
arises of how the different approaches can be aggregated to
calculate the regulatory capital requirement.
410. The CRD text does not distinguish between group (consolidated) and
legal­entity (solo) calculations, creating a need for coherent
interpretation. Moreover, the CRD does not explicitly either allow or
prohibit the practice ­ specifically recognised in Paragraphs 682 and
683 of the Basel II text – of allowing institutions to include (on a
permanent basis) the results of the AMA calculation of a subsidiary to
be included in the consolidated capital requirement of a parent
company that otherwise uses a non­advanced approach.
411. The following definitions are provided for clarification:
· ‘Partial use at consolidated level’ means that different operational
risk approaches are used simultaneously by the parent and its
Page 96 of 123