128. Competent authorities should assess whether the institution should has in place a well-documented NPAP, approved by the management body, that addresses the development of new markets, products and services, and significant changes to existing ones, as well as exceptional transactions.
129. Competent authorities should assess whether the internal risk management function and compliance function are appropriately involved in approving new products or significant changes to existing products, processes and systems.