What organisation, risk management and internal audit must an investment firm have?

The Delegated Regulation sets a common checklist. A firm needs procedures for taking decisions and a structure that sets out, clearly and in writing, who reports to whom and who is responsible for what. Its relevant persons must know the procedures they have to follow, and it must employ people with the skills, knowledge and expertise their jobs require. It needs internal control mechanisms at every level, effective internal reporting and communication, and adequate, orderly records of its business and organisation.

Staff may hold several roles, but only if that does not stop them doing any one of them soundly, honestly and professionally. Proportionality runs through all of this: the firm designs each arrangement according to how large and complex its business is and which services it offers, but it cannot skip items on the list. Since 2 August 2022 the firm must also take sustainability risks into account when meeting these requirements. The same organisational rules apply to banks when they provide investment services, with the Central Bank of Cyprus as their supervisor.

Systems and procedures must keep information secure, intact and confidential. A business continuity policy must aim, if systems or procedures are interrupted, to preserve essential data and functions and keep services running or, where that is not possible, to recover them and resume services in good time. Since 17 January 2025 the EU's Digital Operational Resilience Act (DORA) sets the detailed rules for ICT risk, and Law 87 was aligned with it in February 2025.

Accounting policies and procedures must allow the firm, when CySEC asks, to deliver financial reports promptly that give a true and fair view of its financial position and follow the applicable accounting standards. Finally, the firm must monitor these arrangements and evaluate on a regular basis whether they are adequate and effective, and act on any deficiencies.

Every firm needs risk management policies that identify the risks arising from what the firm does and how it operates and, where appropriate, fix how much risk it is prepared to accept; arrangements to manage those risks; and monitoring of whether the policies work, whether staff comply and whether remedial measures are effective. Where appropriate and proportionate, it must set up an independent risk management function that implements the policies and reports to and advises senior management. A firm that has no such function must be able to show, on request, that its policies and procedures still meet these requirements.

Also where appropriate and proportionate, the firm must have an internal audit function that is separate and independent from its other functions and activities. It sets an audit plan to examine the firm's systems, controls and arrangements, issues recommendations, checks that they are followed and reports on its work. It examines and evaluates the firm's systems and controls rather than running them. ESMA's guidelines add that an internal audit function may not be combined with the compliance function. Written reports on risk management and internal audit go to senior management at least annually, as described in What must a CIF's board and senior management do to govern the firm?