Directive (EU) 2016/2341 of the European Parliament and of the CouncilShow full title

Section 2 U.K. Key functions

Article 24 U.K. General provisions

1. Member States shall require IORPs to have in place the following key functions: a risk-management function, an internal audit function, and, where applicable, an actuarial function. IORPs shall enable the holders of key functions to undertake their duties effectively in an objective, fair and independent manner.

2. IORPs may allow a single person or organisational unit to carry out more than one key function, with the exception of the internal audit function referred to in Article 26, which shall be independent from the other key functions.

3. The single person or organisational unit carrying out the key function shall be different from the one carrying out a similar key function in the sponsoring undertaking. Member States may, taking into account the size, nature, scale and complexity of the activities of the IORP, allow the IORP to carry out key functions through the same single person or organisational unit as in the sponsoring undertaking, provided that the IORP explains how it prevents or manages any conflicts of interest with the sponsoring undertaking.

4. The holders of a key function shall report any material findings and recommendations in the area of their responsibility to the administrative, management or supervisory body of the IORP which shall determine what actions are to be taken.

5. Without prejudice to the privilege against self-incrimination, the holder of a key function shall inform the competent authority of the IORP if the administrative, management or supervisory body of the IORP does not take appropriate and timely remedial action in the following cases:

(a) where the person or organisational unit carrying out the key function has detected a substantial risk that the IORP will not comply with a materially significant statutory requirement and reported it to the administrative, management or supervisory body of the IORP and where this could have a significant impact on the interests of members and beneficiaries; or

(b) where the person or organisational unit carrying out the key function has observed a significant material breach of the laws, regulations or administrative provisions applicable to the IORP and its activities in the context of the key function of that person or organisational unit and reported it to the administrative, management or supervisory body of the IORP.

6. Member States shall ensure the legal protection of persons informing the competent authority in accordance with paragraph 5.

Article 25 U.K. Risk-management

1. Member States shall require IORPs, in a manner that is proportionate to their size and internal organisation, as well as to the size, nature, scale and complexity of their activities, to have in place an effective risk-management function. That function shall be structured in such a way as to facilitate the functioning of a risk-management system for which the IORPs shall adopt strategies, processes and reporting procedures necessary to identify, measure, monitor, manage and report to the administrative, management or supervisory body of the IORP regularly the risks, at an individual and at an aggregated level, to which the IORPs and the pension schemes operated by them are or could be exposed, and their interdependencies.

That risk-management system shall be effective and well-integrated into the organisational structure and in the decision-making processes of the IORP.

2. The risk-management system shall cover, in a manner that is proportionate to the size and internal organisation of IORPs, as well as to the size, nature, scale and complexity of their activities, risks which can occur in IORPs or in undertakings to which tasks or activities of an IORP have been outsourced, at least in the following areas, where applicable:

(a) underwriting and reserving;

(b) asset–liability management;

(c) investment, in particular derivatives, securitisations and similar commitments;

(d) liquidity and concentration risk management;

(e) operational risk management;

(f) insurance and other risk-mitigation techniques;

(g) environmental, social and governance risks relating to the investment portfolio and the management thereof.

3. Where, in accordance with the conditions of the pension scheme, members and beneficiaries bear risks, the risk management system shall also consider those risks from the perspective of members and beneficiaries.

Article 26 U.K. Internal audit function

Member States shall require IORPs in a manner that is proportionate to their size and internal organisation, as well as to the size, nature, scale and complexity of their activities, to provide for an effective internal audit function. The internal audit function shall include an evaluation of the adequacy and effectiveness of the internal control system and other elements of the system of governance, including, where applicable, outsourced activities.

Article 27 U.K. Actuarial function

1. Where an IORP itself provides cover against biometric risks or guarantees either an investment performance or a given level of benefits, Member States shall require that IORP to provide for an effective actuarial function to:

(a) coordinate and oversee the calculation of technical provisions;

(b) assess the appropriateness of the methodologies and underlying models used in the calculation of technical provisions and the assumptions made for this purpose;

(c) assess the sufficiency and quality of the data used in the calculation of technical provisions;

(d) compare the assumptions underlying the calculation of the technical provisions with the experience;

(e) inform the administrative, management or supervisory body of the IORP of the reliability and adequacy of the calculation of technical provisions;

(f) express an opinion on the overall underwriting policy in the event of the IORP having such a policy;

(g) express an opinion on the adequacy of insurance arrangements in the event of the IORP having such arrangements; and

(h) contribute to the effective implementation of the risk management system.

2. Member States shall require IORPs to designate at least one independent person, inside or outside the IORP, who is responsible for the actuarial function.