1. The internal audit function of a CSD shall ensure the following:

(a) establish, implement and maintain an all-encompassing audit plan to examine and evaluate the adequacy and effectiveness of the CSD's systems, risk-management processes, internal control mechanisms, remuneration policies, governance arrangements, activities and operations, including outsourced activities;

(b) review and report the audit plan to the competent authority at least annually;

(c) establish a comprehensive risk-based audit;

(d) issue recommendations based on the result of work carried out in accordance with point (a) and verify compliance with those recommendations;

(e) report internal audit matters to the management body;

(f) be independent from the senior management and report directly to the management body;

(g) ensure that special audits may be performed at short notice on an event-driven basis.

2. Where the CSD belongs to a group, the internal audit function may be carried out at group level provided that the following requirements are complied with:

(a) it is separate and independent from other functions and activities of the group;

(b) it has a direct reporting line to the management body of the CSD;