The criteria for assessing whether external reviewers monitor and evaluate the adequacy and effectiveness of their systems, resources and procedures, as referred to in Article 26(2) of Regulation (EU) 2023/2631, shall be the following:
the monitoring and evaluation is carried out by a function that is independent of the business lines;
measures to address deficiencies identified in the monitoring assessments include:
recording in an electronically stored medium breaches, errors, complaints, incidents and near misses;
determining remediation actions for breaches, errors, complaints, incidents and near misses;
attributing an entity or person responsible for addressing each deficiency;
reporting to senior management, the supervisory body, or the management body the progress in addressing identified deficiencies;
ensuring that the management body oversees the timely implementation of corrective actions.