1. Member States shall require IORPs to have in place the following key functions: a risk-management function, an internal audit function, and, where applicable, an actuarial function. IORPs shall enable the holders of key functions to undertake their duties effectively in an objective, fair and independent manner.

2. IORPs may allow a single person or organisational unit to carry out more than one key function, with the exception of the internal audit function referred to in Article 26, which shall be independent from the other key functions.

3. The single person or organisational unit carrying out the key function shall be different from the one carrying out a similar key function in the sponsoring undertaking. Member States may, taking into account the size, nature, scale and complexity of the activities of the IORP, allow the IORP to carry out key functions through the same single person or organisational unit as in the sponsoring undertaking, provided that the IORP explains how it prevents or manages any conflicts of interest with the sponsoring undertaking.