The bank must embed risk management in its culture and ensure compensation is not unduly tied to short-term accounting profit but to long-term capital preservation, using risk-adjusted performance measures, with adequate disclosure to stakeholders (SRP35.1). The board must actively oversee the design and operation of the compensation system, which should not be controlled mainly by the CEO and management, and the relevant board members and staff need independence and expertise in risk and compensation (SRP35.2). The board must monitor and review the system to confirm it has adequate controls and works as intended, regularly comparing compensation outcomes with risk measures and outcomes (SRP35.3). Staff in finance and risk control must be independent, properly empowered and paid independently of the businesses they oversee (SRP35.4). Pay must be adjusted for all risk types, including hard-to-measure liquidity and reputation risk, using both quantitative measures and judgement (SRP35.5). Outcomes must be symmetric with risk outcomes, bonus pools linked to firm-wide performance (SRP35.6), payouts deferred in line with the time horizon of risks (SRP35.7), and the mix of cash, equity and other forms consistent with risk alignment and explainable (SRP35.8). Supervisors review compensation rigorously and expect prompt remediation (SRP35.9). Public disclosure follows DIS35.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.