necessary, to ensure that they have sufficient knowledge to support or challenge decisions. finally, as i mentioned earlier, independence is of course essential. institutions should have a sufficient number of independent directors to contribute to decision - making in an objective manner and to ensure a neutral attitude within the board. they should be appointed in recognition of their personal and professional repute, and perform their duties without being perceived as biased due to any relationship with the institution, its significant shareholders or its management team. moreover, institutions should guarantee independence in order to avoid groupthink. the board of directors as a whole should have sufficient knowledge, skills and expertise to keynote speech by frank elderson https : / / www. bankingsupervision. europa. eu / press / speeches / date / 2022 / html / ssm. sp220611 ~ fa99fcbb52. en. html. properly understand the institution's activities, ensuring the board's effective ability to take decisions independently and autonomously in the best interests of the institution. risk culture another aspect i would like to emphasise is the importance of promoting a strong risk culture across the institution. the elements i mentioned earlier ( challenge, involvement and independence ) are the cornerstones of a good internal organisation structure. an appropriate risk culture emanates from the board of directors, but it has to be properly embedded across the organisation, especially among senior management. i would call this “ tone from the top and echo from the middle ”. decisions such as excessive risk taking, putting the bank ’ s short term interests ahead of its longer - term interests, can damage an organisation ’ s reputation and culture. the board of directors is responsible for setting the strategy and defining the sustainable business model that is right for the institution, without getting bogged down in the details. that is the job of senior management. banking is a sector that is very vulnerable to uncertainty and reputational issues. therefore, in addition to the other elements i mentioned earlier, such as risk controls and data quality, a clear and sound risk culture is also needed. this was an important element in the recent financial turmoil, particularly the episode triggered by the collapse of silicon valley bank, although many of the underlying factors in that case have yet to be properly analysed. nevertheless, some aspects can be highlighted : shortcomings in banks ’ risk management, ineffective governance and an inappropriate business model, including in terms of interest rate risk, asset / liability management profile, liquidity risk

even more challenging. of course, we cannot talk about digital transformation and it environments without mentioning data quality. reliable data is the starting point for properly quantifying, identifying and monitoring any risk, to ensure that potential weaknesses can be identified in a timely manner and that any necessary measures can be coordinated. climate and environmental risks are another area that supervisors have identified as a source of risk in the medium term, which should be closely monitored in order to properly understand and recognise these risks. overall, both esg and regulatory compliance are becoming more relevant due to their high reputational impact, and banks need to pay close attention to them. internal control functions another issue i would like to highlight is the key role of internal control functions in the smooth functioning of institutions, complementing the role of the first line of defence. the board of directors must have full and direct access to the heads of the internal control functions ( risk management function, compliance function and internal audit ). in other words, the interaction between the board of directors and the heads of the internal control functions should not have to go through an intermediary level of executive management. reporting to the board should be supported by agile internal systems capable of producing reliable information to facilitate meaningful discussion and effective decision - making processes. overall, the internal audit and risk management functions are more mature in their functioning than the compliance function, whose role has changed / increased in recent years. there is therefore more room for improvement in the compliance function. the main focus areas identified by the ssm related to internal control functions are : ( i ) the board ’ s challenging capacity and ownership in addressing deficiencies. ( ii ) in most ssm institutions, the heads of the internal control function have direct access and report any concerns directly to the board of directors, in line with the eba guidelines on internal governance. however, the frequency and level of detail of the information provided is also a focus area. ( iii ) the right balance between sufficient involvement and independence. ( iv ) the stature of the control functions, with the internal audit function performing better and the compliance function worse or even inadequately. ( v ) the central steering and oversight of the control functions of group subsidiaries. ( vi ) there has been a slight increase in the staffing of control functions ( especially compliance ), but there are still shortages of qualified staff in some specialised areas ( e. g. cyber, digitalisation, internal models ). ( vii ) the scope covered by compliance is often not comprehensive