This is because there is always room for improvement and governance should not be seen as a static element. On the contrary, as new challenges arise (climate risks, ESG, digitalisation, etc. ), governance needs to be updated to properly address them. How can we keep encouraging our institutions to improve their governance framework? I believe that we need to continue our supervisory activities, placing greater emphasis on a structured escalation of our supervisory interventions (escalation ladder), and insist that a strong board of directors is key to the smooth functioning of banks. We should therefore continue to strengthen governance regulations to make them clearer, in particular as regards fit and proper processes and diversity, to build strong boards for sound decisionmaking. Non-executive directors In this decision-making process, non-executive directors (NEDs) play a crucial role. They should oversee management and focus on the key issues that are of concern to all stakeholders. These of course include the usual financial activities, but also emerging risks that could severely impact banks that are not properly prepared for them. In today’s complex business environment, new technologies and digital transformation are a key focus for all institutions, specifically for NEDs. We are in a situation of continuous and very fast change on the digital front, so it is crucial for organisations to be prepared and simultaneously adapt to new applications. I would like to highlight two key elements in this regard: First of all, the importance of defining the digitalisation strategy for the institution.

The board of directors must have full and direct access to the heads of the internal control functions (risk management function, compliance function and internal audit). In other words, the interaction between the board of directors and the heads of the internal control functions should not have to go through an intermediary level of executive management. Reporting to the board should be supported by agile internal systems capable of producing reliable information to facilitate meaningful discussion and effective decision-making processes. Overall, the internal audit and risk management functions are more mature in their functioning than the compliance function, whose role has changed/increased in recent years. There is therefore more room for improvement in the compliance function. The main focus areas identified by the SSM related to internal control functions are: (i)  the board’s challenging capacity and ownership in addressing deficiencies. (ii)  in most SSM institutions, the heads of the internal control function have direct access and report any concerns directly to the board of directors, in line with the EBA guidelines on internal governance. However, the frequency and level of detail of the information provided is also a focus area. (iii)  the right balance between sufficient involvement and independence. (iv)  the stature of the control functions, with the internal audit function performing better and the compliance function worse or even inadequately. (v)  the central steering and oversight of the control functions of group subsidiaries.