Reporting institutions must set up a second-level control or internal audit system. The organization of the internal audit function must make it possible to verify, at appropriate intervals, the regularity and compliance of operations and the effectiveness of first-level systems, in particular their adequacy in relation to the nature of all the risks associated with operations.
Reporting institutions are required to draw up an internal audit charter which defines in particular:
- The position, powers and objectives of the internal audit function.
- The responsibilities of this function and the nature of its work.
- The procedures for communicating the results of its audit assignments.
- This charter is communicated to the general secretariat of the banking commission.