88. Competent authorities should assess whether or not an institution’s internal governance arrangements are adequate for and commensurate with the institution’s risk profile, business model, nature, size and complexity. They should identify the extent to which the institution complies with the applicable EU requirements regarding sound internal governance arrangements. Competent authorities should evaluate in particular whether or not the internal governance arrangements ensure the sound management of risks and include appropriate internal controls. Competent authorities should establish if there are material risks posed by poor internal governance arrangements and their potential effect on the sustainability of the institution.
89. For SREP, the assessment of internal governance and institution-wide controls should include an assessment of the following areas:
a. the overall internal governance framework;
b. the composition, organisation and functioning of the management body and
…