1. Competent authorities shall assess the independence of the operational risk management function from the institution's business units by confirming at least the following:
that the operational risk management function undertakes the following tasks separately from the institution's business lines:(i)the design, development, implementation, maintenance and oversight of the operational risk management process and the operational risk measurement system;(ii)the analysis of the operational risk associated with the introduction and development of new products, markets, lines of business, processes, systems and significant changes to existing products;(iii)the oversight of business activities that may give rise to an operational risk exposure that could breach the institution's risk tolerance;
the design, development, implementation, maintenance and oversight of the operational risk management process and the operational risk measurement system;
the analysis of the operational risk associated with the introduction and development of new products, markets, lines of business, processes, systems and significant changes to existing products;
the oversight of business activities that may give rise to an operational risk exposure that could breach the institution's risk tolerance;
that the operational risk management function receives appropriate commitment by the management body and senior management and is of adequate stature within the organization for fulfilling its tasks;
that the operational risk management function is not also responsible for the internal audit function;
that the head of the operational risk management function meets at least the following requirements:(i)an appropriate level of experience to manage the actual and prospective operational risk, as indicated by the operational risk profile;(ii)regular communication with the management body and its committees as mandated by the risk management structure of the institution;(iii)active involvement in the elaboration of the institution's operational risk tolerance and strategy for its management and mitigation;(iv)independence from the operational units and functions reviewed by the operational risk management function;(v)allocation of a budget for the operational risk management function by the head of risk management referred to in the fourth subparagraph of Article 76(5) of Directive 2013/36/EU or a member of the management body in a supervisory capacity and not by a business unit or executive function.
an appropriate level of experience to manage the actual and prospective operational risk, as indicated by the operational risk profile;
regular communication with the management body and its committees as mandated by the risk management structure of the institution;
active involvement in the elaboration of the institution's operational risk tolerance and strategy for its management and mitigation;
independence from the operational units and functions reviewed by the operational risk management function;
allocation of a budget for the operational risk management function by the head of risk management referred to in the fourth subparagraph of Article 76(5) of Directive 2013/36/EU or a member of the management body in a supervisory capacity and not by a business unit or executive function.