Directive 2006/49/EC of the European Parliament and of the Council (repealed)Show full title

2. Recognition shall only be given if the competent authority is satisfied that the institution's risk‐management system is conceptually sound and implemented with integrity and that, in particular, the following qualitative standards are met:

(a)

the internal risk‐measurement model is closely integrated into the daily risk‐management process of the institution and serves as the basis for reporting risk exposures to senior management of the institution;

(b)

the institution has a risk control unit that is independent from business trading units and reports directly to senior management. The unit must be responsible for designing and implementing the institution's risk‐management system. It shall produce and analyse daily reports on the output of the risk‐measurement model and on the appropriate measures to be taken in terms of trading limits. The unit shall also conduct the initial and on-going validation of the internal model;

(c)

the institution's board of directors and senior management are actively involved in the risk‐control process and the daily reports produced by the risk‐control unit are reviewed by a level of management with sufficient authority to enforce both reductions of positions taken by individual traders as well as in the institution's overall risk exposure;

(d)

the institution has sufficient numbers of staff skilled in the use of sophisticated models in the trading, risk‐control, audit and back‐office areas;

(e)

the institution has established procedures for monitoring and ensuring compliance with a documented set of internal policies and controls concerning the overall operation of the risk‐measurement system;

(f)

the institution's model has a proven track record of reasonable accuracy in measuring risks;

(g)

the institution frequently conducts a rigorous programme of stress testing and the results of these tests are reviewed by senior management and reflected in the policies and limits it sets. This process shall particularly address illiquidity of markets in stressed market conditions, concentration risk, one way markets, event and jump‐to‐default risks, non-linearity of products, deep out‐of‐the‐money positions, positions subject to the gapping of prices and other risks that may not be captured appropriately in the internal models. The shocks applied shall reflect the nature of the portfolios and the time it could take to hedge out or manage risks under severe market conditions; and

(h)

the institution must conduct, as part of its regular internal auditing process, an independent review of its risk‐measurement system.

The review referred to in point (h) of the first paragraph shall include both the activities of the business trading units and of the independent risk‐control unit. At least once a year, the institution must conduct a review of its overall risk‐management process.

The review shall consider the following:

(a)

the adequacy of the documentation of the risk‐management system and process and the organisation of the risk‐control unit;

(b)

the integration of market risk measures into daily risk management and the integrity of the management information system;

(c)

the process the institution employs for approving risk‐pricing models and valuation systems that are used by front and back‐office personnel;

(d)

the scope of market risks captured by the risk‐measurement model and the validation of any significant changes in the risk‐measurement process;

(e)

the accuracy and completeness of position data, the accuracy and appropriateness of volatility and correlation assumptions, and the accuracy of valuation and risk sensitivity calculations;

(f)

the verification process the institution employs to evaluate the consistency, timeliness and reliability of data sources used to run internal models, including the independence of such data sources; and

(g)

the verification process the institution uses to evaluate back‐testing that is conducted to assess the models' accuracy.