(a)

the corporate governance arrangements specify at least the organisation, scope, purpose, and functioning of the governance bodies of the external reviewer, including clear reporting lines, responsibilities of roles and communication channels;

(b)

there is an internal control framework;

(c)

the organisational arrangements ensure continuity and regularity in the performance of assessment activities, safeguarding of the confidentiality and security of records of the services provided, sound administrative and accounting procedures, and adequate information processing systems;

(d)

the anonymity of whistleblowers is safeguarded and reprisals are prohibited;

(e)

transactions with related parties, employee personal account dealing, outside business activities and the acceptance of gifts and hospitality are reviewed consistently;

(f)

the independence of the employees subject to variable compensation arrangements is ensured;

(g)

the board of the external reviewer adopts the policies and procedures in compliance with this Regulation.

(a)

the internal control mechanisms are adapted to the nature, scale and complexity of the external reviewer;

(b)

the persons responsible for internal controls are able to obtain the information necessary to perform their function and report their findings to the board of the external reviewer;

(c)

the internal control functions are independent and clearly segregated from the business lines performing the assessment activities.