98. Competent authorities should assess whether the institution has established an appropriate risk management framework and risk management processes. Competent authorities should review, at least:
a. whether the risk strategy, risk appetite and risk management framework are appropriate and implemented on an individual and a consolidated basis;
b. the ICAAP and ILAAP frameworks;
c. stress testing capabilities and results;
d. whether the institution has established an independent risk management function covering the whole institution, which is actively involved in drawing up the institution’s risk strategy and all material risk management decisions, and which provides the management body and business units with all relevant risk-related information;
e. whether the institution has a head of the risk management function with sufficient expertise, independence and seniority, and, where necessary, direct access to the management body in its supervisory function;
f. whether the indepen
…