Fitch Ratings 2024 Form 25-101F1 Library Macros Instructions

Fitch Ratings 2024 Form 25-101F1 Library Macros

Product Information

Specifications:

• Product Name: Internal Control Structure Governing the Determination of Credit Ratings
• Model Number: 2024 Form 25-101F1 Item 9
• Manufacturer: Fitch Group, Inc.
• Website: www.fitchratings.com

Product Usage Instructions

Introduction
The Internal Control Structure Governing the Determination of Credit Ratings is overseen by the Boards of Directors of FRI and FRL within Fitch Group, Inc. The Boards are responsible for managing internal controls, policies, and procedures related to credit ratings globally.

Board Oversight
The Boards oversee various activities including the process and maintenance of internal controls, publishing criteria and methodologies, approval of policies, conflict management,
compensation and promotion processes, and compliance and governance processes.

Policy Framework
All Fitch Ratings policies and procedures adhere to the Code of Conduct & Ethics based on global best practices outlined in the IOSCO Code of Conduct Fundamentals for Credit Rating Agencies. These policies comply with applicable laws, rules, and regulations in each jurisdiction where Fitch Ratings operates.

Three Lines of Defense
Fitch Ratings’ internal control structure follows the model of the three lines of defense:

1. First Line of Defense: Global Analytical Groups, BRM, and Ratings Operations
2. Second Line of Defense: Credit Policy Group, Criteria Review and Approval Group (CRAG), and Compliance Department
3. Third Line of Defense: Internal Audit and external or outsourced third-party audits

Frequently Asked Questions (FAQ)

1. Q: What is the role of the Boards in overseeing the internal control structure?
   A: The Boards govern the credit rating agencies within Fitch Group and are responsible for managing internal controls and ensuring compliance with fiduciary responsibilities and relevant laws.

2. Q: How are conflicts of interest managed within Fitch Ratings?
   A: Fitch Ratings has a program designed to manage conflicts of interest overseen by the Boards as part of their governance processes.

Policies and Procedures re Internal Controls
The following policy has been adopted and implemented with respect to internal controls.

• Internal Control Structure Governing the Determination of Credit Ratings

EXECUTIVE SUMMARY

INTRODUCTION
This document describes Fitch Ratings, Inc.’s (“FRI”) and Fitch Ratings Limited’s (“FRL”), including any of FRI’s and FRL’s subsidiaries that issue credit ratings under the trade name of Fitch Ratings (collectively, “Fitch Ratings”), internal controls related to the issuance of Credit Ratings. The definition of Credit Ratings, along with both other capitalized terms that may be used in this document and other material information pertaining to Credit Ratings, are set forth on Fitch Ratings’ publicly available website at https://www.fitchratings.com/site/definitions.

BOARD OVERSIGHT

The Board of Directors of FRI (the “FRI Board”) and FRL (the “FRL Board”) (collectively, the “Boards”), govern the most senior credit rating agencies within Fitch Group, Inc. (“Fitch Group”), and operate under structured procedures. Each of the Boards performs its oversight activities on behalf of Fitch Ratings globally. In addition, where necessary pursuant to applicable local law, the local boards of directors of other Fitch Ratings’ subsidiaries may perform additional oversight activities. Among other matters, the Boards are responsible for the oversight and management of FRI and FRL in accordance with their fiduciary responsibilities and standards established by the laws of the jurisdictions in which FRI and FRL are organized, including approval of all components of the internal control framework, as well as overseeing that its components are subject to monitoring and regular update by management. The Boards have delegated responsibility for the day-to-day running of FRI and FRL to a senior management team with sufficient skill and experience to ensure the sound and prudent management of FRI and FRL. The senior management team is responsible for the development and performance of controls and for assessing the adequacy and effectiveness of the control environment, establishing, implementing and updating the internal policies and procedures1 supporting the internal control framework. In establishing these policies and procedures, the senior management team has a documented decision-making process and defined roles and responsibilities.

The Boards oversee, among other matters:

• The process and maintenance of internal controls for the determination and issuance of Credit Ratings;
• The publishing of new and materially amended criteria and methodologies pertaining to determining Credit Ratings;
• The approval of new and materially amended policies pertaining to determining Credit Ratings;
• The program designed to manage conflicts of interest;
• The compensation and promotion processes; and
• The compliance and governance processes, including the effectiveness of the criteria review and approval group.

The term “policies and procedures” refer to internal documents that govern or direct how Fitch Ratings or its staff should perform activities that are subject to the requirements of CRAR.

POLICY FRAMEWORK
All Fitch Ratings policies and procedures reflect Fitch Ratings’ Code of Conduct & Ethics, which is based upon the global best practices outlined in the IOSCO Code of Conduct Fundamentals for Credit Rating Agencies, and, with respect to any given jurisdiction in which Fitch Ratings conducts Credit Rating activities, are consistent with all laws, rules and regulations applicable to Fitch Ratings in such jurisdiction. During the policy development or amendment stage, input is gathered from relevant constituents within Fitch Ratings including, where appropriate, the senior management of the Global Analytical Groups, the Credit Policy Group (“CPG”), the Legal Group, Ratings Operations (including Regulatory Affairs, Policies and Procedures), the Business and Relationship Management Group (“BRM”), the Compliance Department (“Compliance”), and any others as may be appropriate. Once a new or amended policy is finalized, it is subject to review and approval in accordance with Fitch Ratings’ internal protocols. Certain of Fitch Ratings’ policies are also subject to review by the Boards.

THREE LINES OF DEFENSE
Fitch Ratings’ internal control structure is designed to ensure that Fitch Ratings employees comply with Fitch Ratings’ policies and procedures relating to or associated with the issuance of Credit Ratings. This control structure follows the model of the three lines of defense (Control Functions), and is ultimately overseen by the Boards:

• First Line of Defense: The Global Analytical Groups, BRM and Ratings Operations (see below in 5);
• Second Line of Defense: Credit Policy Group, the Criteria Review and Approval Group (“CRAG”) and the Compliance Department (see below in 6); and
• Third Line of Defense: Internal Audit (see below in 7) and external or outsourced third-party audits, as needed.

Each of the three lines of defense is further supported by the Information Technology group (“IT”) and the Information Security group (IS) (see below in 8 and 9).

FIRST LINE OF DEFENSE

The overall responsibility to ensure that Fitch Ratings’ policies and procedures relating to or associated with the issuance of Credit Ratings are followed rests with the senior managers and all members of the first line of defense.

Global Analytical Group
The senior managers of the Global Analytical Group are: (i) the Senior Global Group Heads; (ii) the Global Group Heads, each covering the analytical groups; and (iii) the Regional Group Heads covering certain geographical areas.

Business Relationship Management
Fitch Ratings maintains a separate BRM Group which carries out ratings-related commercial and marketing activities independently of the Global Analytical Groups. This structure helps ensure that analytical staff is not influenced by business considerations. All discussions with an issuer, originator, arranger, sponsor, servicer or any other party that interacts with Fitch Ratings on behalf of the issuer concerning rating fees, fee arrangements or billings are handled by BRM, finance and accounting staff, members of the Legal Department, or others who are employed by Fitch Ratings to handle billing or fee collection matters, outside the Global Analytical Groups, BRM staff also follows policies and procedures designed to ensure compliance with anti-money laundering laws, international sanctions, and anti-bribery and corruption laws, as well as other aspects of credit rating agency regulation.

Ratings Operations
Ratings Operations is responsible for developing, implementing and monitoring procedures and controls with respect to the Credit Rating process in response to regulation, Fitch Ratings policy, and senior management guidance Ratings Operations works with members of the Global Analytical Groups, BRM, Compliance, CPG, Human Resources, Legal and IT to identify risks and implement procedural, training and/or technical solutions in support of Fitch Ratings’ control framework and analysts’ compliance with the firm’s policies and procedures. Ratings Operations also produces management reports and analysis to support the Global Analytical Groups’ compliance with the various procedures outlined in the Ratings Process Manual.

SECOND LINE OF DEFENSE

Fitch Ratings’ core control functions of CPG, CRAG and Compliance comprise the Second Line of Defense. These functions operate at a global, rather than local level, with staff based in Fitch Ratings’ offices around the world providing support and oversight to all Fitch Ratings offices globally.

The Credit Policy Group
CPG is independent of the Global Analytical Groups and includes the Chief Credit Officer, Group Credit Officers, Evaluating Committee Robustness and Fitch Wire. The Chief Credit Officer reports to the Chief Risk Officer of Fitch Group (“CRO”). The Chief Credit Officer and Group Credit Officers leverage participation in various committees and discussions to ensure new or developing issues are shared and addressed across Analytical Groups. CPG therefore serves as an oversight function with respect to Fitch Ratings’ analytical work. In fulfilling these responsibilities, CPG conducts the following activities, among others:

• Aggregates risks across ratings by focusing on risk identification and promoting coordination across sectors and regions; and may challenge credit thinking with alternative viewpoints;
• Conducts reviews for assessing ratings performance and ratings comparability; and in conjunction with the Chief Criteria Officer report on the effectiveness of Ratings to the Board;
• Links rating trends with current fundamentals, macro-economic developments and analytically defined expectations by industry or sector;
• Monitors Analytical Groups to ensure consideration of new developments with an appropriate sense of urgency and rigor and reports on and makes recommendations in certain cases;
• Oversees the execution of reviewing unique or complex ratings proposals by the Analytical teams;
• Develops and publishes areas of topical research that address current credit market issues, and/or can be used to frame priorities or identify the next potential credit market development;
• Reviews analytical exceptions, incidents and complaints; and
• Carries out reviews of Committee Papers against Criteria as part of the Evaluating Committee Robustness program.

Criteria Review and Approval Group
CRAG is independent of the Global Analytical Groups and includes the Chief Criteria Officer, Head of Model Validation, Manager of Ratings Performance Analytics and Criteria Officers. The Chief Criteria Officer reports to the Chief Risk Officer (“CRO”) of Fitch Group.]. CRAG serves as an oversight function with respect to Fitch Ratings’ ratings credit criteria and related models.

In fulfilling these responsibilities, CRAG conducts the following activities, among others:

• Oversees the rating criteria (and related models and key assumptions) review and approval process recommending approval to the Board of Directors (Analytical Groups are responsible for proposing suitable criteria that support ratings and supported by back testing) and ensures appropriate inclusion of qualitative and quantitative assumptions, sensitivities and key ratings drivers;
• Conducts regular transition and default studies and develops other quantitative ratings performance indicators to monitor the performance of Fitch Ratings’ ratings over time and across analytical sectors and geographical regions to review the consistency of application of criteria;
• Manages a database of criteria and models to measure compliance with the requirements to review such criteria and models and to ensure only validated models are controlled;
• Reviews criteria back-testing and conducts model validation; and
• Oversees the identification, review, resolution, and reporting of errors related to models and criteria.

In addition to its oversight activities, CPG and CRAG contribute to the development of a training program, the Fitch Credit Academy, to provide a formal structure to develop and assess the knowledge and skills analysts need to be effective in evaluating credit. Analysts are trained on fundamental credit concepts, and in some cases specialized curricula designed to provide relevant knowledge and skills appropriate for each Global Analytical Group, sector and region, as applicable.

The Compliance Department
Compliance is responsible for advising on, supporting and overseeing compliance with the various laws, rules and regulations governing the issuance of Credit Ratings (“CRA Regulations”) promulgated in the jurisdictions in which Fitch Ratings operates, along with those requirements set forth in Fitch Ratings’ Code of Conduct & Ethics and related policies regarding complaints, conflicts of interest and confidentiality (collectively, “Conduct Policies”). Compliance supports, monitors and reports on Fitch Ratings’ compliance with CRA Regulations and the Conduct Policies on an ongoing basis through the functions described below, as well as by analyzing information obtained via Fitch Ratings’ Ethics Hotline and internal incident reporting systems. Compliance is led by the Global Chief Compliance Officer (the “CCO”), who reports jointly into the Chief Risk Officer of Fitch Group, and the Independent Directors of the Board of FRI (the “Independent Directors”), Compliance is present in multiple locations with local Compliance Officers as needed for resources and required by regulations. The CCO informs the Independent Directors and the CRO on the goals, strategy and status of the Compliance Department, the compliance program, and certain other Compliance processes and controls including those undertaken by the Department’s four core functions, which are as follows:
Regulatory Compliance: Regulatory Compliance is responsible for maintaining (either directly or in conjunction with local country management) Fitch Ratings’ license or registration in all jurisdictions where Fitch Ratings is licensed or registered as a credit rating agency. This includes making periodic (e.g. monthly, annual, etc.) reporting and filings and any additional “as needed” reporting, along with making any necessary public or regulatory disclosures of issues or events. In addition, this team manages all regulatory exams and other regulatory requests for documents and information. Further, the team helps coordinate Fitch Ratings’ responses to all exam findings and recommendations, and tracks and monitors Fitch Ratings’ completion of agreed management actions. The team regularly liaises with regulators on a global basis through in-person visits or conference calls. Moreover, Regulatory Compliance is responsible for oversight of the processes regarding the handling and resolution of Conduct Complaints, as defined in Fitch Ratings’ Complaints Handling policy. Finally, Regulatory Compliance conducts outreach to Fitch Ratings’ offices in Latin America, Asia, Europe, and the Middle East through either on-site visits or teleconferences. Regulatory Compliance is overseen by Regional Heads of Regulatory Compliance for EMEA, APAC, Latin America and North America. The Regulatory Compliance team heads in each jurisdiction are responsible for implementing new procedures or disclosures as required by changing regulations. Regulatory Compliance team heads in each region are responsible for disseminating information of regulatory change to members of their own teams and to Regulatory Compliance Officers in other regions as well.
Personal Conflicts Monitoring: The Personal Conflicts Monitoring team (“PCM”) administers Fitch Ratings’ Global Securities Trading and Conflicts of Interest Policy (“Bulletin 13”). Bulletin 13 establishes policies designed to minimize actual and apparent conflicts that may arise from employees’ personal investment activity, outside interests and external relationships, and gifts, business events and entertainment. PCM utilizes a third-party trade surveillance platform to monitor Fitch Ratings employees’ trading activity. PCM also administers the initial securities holdings certification and compliance questionnaire for new hires, as well as an annual compliance recertification of securities holdings and compliance questions for existing staff. Further, PCM is responsible for administering the exceptions and recusals that arise as a result of a potential conflict related to Bulletin 13.
Compliance Testing & Monitoring: The Compliance Testing & Monitoring team (“CTM”) conducts testing throughout Fitch Ratings to assess compliance with Fitch Ratings’ policies and procedures, and the effectiveness of internal controls implemented with respect to its Credit Rating and related regulatory activities. CTM develops annually a risk-based compliance test plan derived from, among other factors, outcomes of compliance risk assessments, previous CTM findings and risks identified through regulatory findings or other issues, incidents or trends. CTM conducts its testing throughout the year and presents its reports, including corrective action plans for issues identified, to senior management. CTM also monitors the aging of previously identified issues, and escalates overdue issues as appropriate. Further, CTM is responsible for performing surveillance of Analytical Group and BRM employees’ email communications. In particular, CTM flags email that could represent breaches or violations of Fitch Ratings’ policies or procedures for review and follow-up, and where appropriate triggers disciplinary or remedial action.
Compliance Communications and Data, Systems and Metrics: Compliance officers sitting outside of the above three functional teams provide support to those teams with respect to managing Fitch Ratings’ policy, procedure and training framework globally, delivering regulatory disclosures, and creating reports and metrics for monitoring the effectiveness of Compliance controls.

INTERNAL AUDIT

Internal Audit (“IA”) is the third line of defense assists senior management and the Boards in protecting the assets and reputation of Fitch Ratings. In particular, IA provides independent and objective assurance as to the adequacy and effectiveness of Fitch Ratings’ internal controls framework, controls and governance processes. The Head of IA reports to the Independent Directors and the CRO. At least annually, the Head of IA submits to the Independent Directors and the CRO an internal audit plan for review and approval. The internal audit plan consists of a work schedule for the following fiscal year. It is developed based on a prioritization of the audit universe using a risk- based methodology, including input from the Independent Directors, the CRO and other members of Fitch Ratings’ senior management. The Head of IA reviews and adjusts the plan, as necessary, in response to changes in Fitch Ratings’ business, risks, operations, programs, systems and controls. Any significant deviation from the approved internal audit plan is communicated to the Independent Directors and the CRO through periodic reporting or direct communication, as applicable. After the conclusion of an internal audit engagement, the Head of IA (or his or her designee) issues and distributes a written report. The audit report includes management’s response and corrective action with regard to the specific findings and recommendations. Management’s response includes a timetable for anticipated completion of corrective actions. IA is also responsible for appropriate follow-up, and all findings remain in an “open issues file” until cleared. The Head of IA periodically reports to the Independent Directors and the CRO on the purpose, authority and responsibility of IA as well as progress and performance regarding the audit plan. IA also oversees the testing of internal controls supporting the ratings process. The testing is done globally and at least semi-annually supporting the assessment of the effectiveness of internal controls under the US SEC Dodd-Frank Control Act and ESMA Guidelines on Internal Controls.

GLOBAL IT STRUCTURE AND SYSTEMS

Fitch Group’s IT function manages the technology infrastructure for Fitch Ratings globally. IT is headed by Fitch Group’s Chief Technology Officer. In addition to typical IT tasks and responsibilities, IT also:

• Maintains and monitors infrastructure including desktops, networks and data applications and process for ongoing operations;
• Plays a material role in supporting business continuity plans, including those related to the issuance and publication of credit ratings;
• Manages and tests disaster recovery plans; and
• Together with Ratings Operations, develops custom applications required to support core ratings activities such as workflow systems, analysis and surveillance systems, and publishing and document management systems, and maintains those applications and systems.

GLOBAL INFORMATION SECURITY STRUCTURE AND SYSTEMS

Fitch Group’s IS function manages the information security infrastructure for Fitch Ratings globally. The IS function is headed by Fitch Group’s Chief Information Security Officer (“CISO”), who reports to Fitch Group’s Chief Risk Officer. IS:

• Creates, manages, and leads the implementation of Fitch Group’s information security program;
• Identifies and addresses the risks associated with Fitch Ratings’ technology processes used in the issuance of credit ratings, along with IT and senior members of the business, legal and Compliance teams;
• Plays a material role in developing operational resilience plans, including those related to the issuance and publication of credit ratings;
• Implements and manages foundational security controls designed to prevent and detect information security threats, and designs and tracks objective metrics tied to those controls;
• Manages access control for all systems, ratings data and applications in compliance with confidentiality and conflict of interest policies.

Owner: Chief Compliance Officer
Supplements: None

References

• Fitch Ratings: Credit Ratings & Analysis For Financial Markets
• Rating Definitions

Read User Manual Online (PDF format)

Download This Manual (PDF format)

Download this manual  >>