Article 190
Credit risk control
1.
The credit risk control unit shall be independent from the personnel and management functions responsible for originating or renewing exposures and report directly to senior management. The unit shall be responsible for the design or selection, implementation, oversight and performance of the rating systems. It shall regularly produce and analyse reports on the output of the rating systems.
2.
The areas of responsibility for the credit risk control unit or units shall include:
(a)
testing and monitoring grades and pools;
(b)
production and analysis of summary reports of the institution's rating systems;
(c)
implementing procedures to verify that grade and pool definitions are consistently applied across departments and geographic areas;
(d)
reviewing and documenting any changes to the rating process, including the reasons for the changes;
(e)
reviewing the rating criteria to evaluate if they remain predictive of risk. Changes to the rating process, criteria or individual rating parameters shall be documented and retained;
(f)
active participation in the design or selection, implementation and validation of models used in the rating process;
(g)
oversight and supervision of models used in the rating process;
(h)
ongoing review and alterations to models used in the rating process.
3.
Institutions using pooled data in accordance with Article 179(2) may outsource the following tasks:
(a)
production of information relevant to testing and monitoring grades and pools;
(b)
production of summary reports of the institution's rating systems;
(c)
production of information relevant to a review of the rating criteria to evaluate if they remain predictive of risk;
(d)
documentation of changes to the rating process, criteria or individual rating parameters;
(e)
production of information relevant to ongoing review and alterations to models used in the rating process.
4.
Institutions making use of paragraph 3 shall ensure that the competent authorities have access to all relevant information from the third party that is necessary for examining compliance with the requirements and that the competent authorities may perform on-site examinations to the same extent as within the institution.