The Austrian Financial Market Authority (FMA) today published the revised “FMA Minimum Standards on Internal Auditing (MS-IR)” (“FMA-Mindeststandards für die interne Revision (MS-IR)”) for credit institutions and financial institutions. The previous version from 2005 was revised and extended. The new version of the MS-IR apply with effect from today, 2 January 2020.<\/p>
The revised MS-IR considers the internal audit function as one of the internal control functions of banks, thereby enhancing the governance of a bank. Due to the internal audit function’s positioning at the core of the credit institution and its ongoing audit activity, it is frequently able to identify risks before the bank auditor and the supervisory authority is able to do so. The new MS-IR emphasises the significance of communications between the banks internal audit function and the supervisory authority and thereby forms a basis for intensified dialogue. At the same time, the internal audit function is clearly located within the bank’s internal control functions. The Basel Committee on Banking Supervision’s concept of the “three lines of defense” the internal audit function, is the third downstream control body (“third line of defence”) after the operative departments (“first line of defence”), with risk management including the compliance function and the AML function forming the “second line of defence”.<\/p>
The revised MS-IR also take into account the new mandatory size criteria set forth in Article 42 para. 6 of the Banking Act (BWG; Bankwesengesetz), which are more strongly aligned to the principle of proportionality. They form a connex to the outsourcing regime that was recently revised by the European Banking Authority (EBA) by specifying whether and when tasks of the internal audit function may be outsourced.<\/p>
The enhanced suitability requirements for the heads of the internal audit function are also derived from EBA standards, which are also associated with corresponding notification requirements towards the competent supervisory authority. These standards are also presented in the revised MS-IR.<\/p>