Prudential Regulation Authority Rulebook

5.1

1. (1) A firm must provide for an effective internal audit function.
2. (2) The internal audit function must:
1. (a) include an evaluation of the adequacy and effectiveness of the internal control system and other elements of the system of governance; and
2. (b) be objective and independent from the operational functions.
3. (3) A firm must ensure that any findings and recommendations of the internal audit function are reported to the firm’s governing body which must:
1. (a) determine what actions are to be taken with respect to each of the internal audit findings and recommendations; and
2. (b) ensure that those actions are carried out.

[Note: Art. 47 of the Solvency II Directive]

5.2

A firm must ensure that the internal audit function referred to in 5.1 includes all of the following tasks:
(1) establishes, implements and maintains an audit plan setting out the audit work to be undertaken in the upcoming years, taking into account all activities and the complete system of governance of the firm;
(2) takes a risk-based approach in deciding its priorities;
(3) reports the audit plan to the governing body;
(4) issues recommendations based on the result of work carried out in accordance with 5.2(1) and submits a written report on its findings and recommendations to the governing body on at least an annual basis; and
(5) verifies compliance with the decisions taken by the governing body on the basis of those recommendations referred to in 5.2(4).

5.3

A firm must ensure that any person carrying out the internal audit function does not assume responsibility for any other function.

5.4

Notwithstanding 5.3, and in particular by respecting the principle of proportionality, a firm may allow the persons carrying out the internal audit function to carry out other key functions, where all of the following conditions are met:

1. (1) this is appropriate with respect to the nature, scale and complexity of the risks inherent in the firm’s business;
2. (2) no conflict of interest arises for the persons carrying out the internal audit function; and
3. (3) the costs of maintaining persons for the internal audit function that do not carry out other key functions would impose costs on the firm that would be disproportionate with respect to the total administrative expenses.