Document ID: chunk:federal_register_of_legislation:F2019L00669:body:0:p8
Version: federal_register_of_legislation:F2019L00669
Segment Type: other
Provision Reference: 
Character Range: 20025–23327

An APRA-regulated institution must maintain an RMS for the institution that addresses each material risk listed under paragraph 26. The RMS must be approved by the Board.
30.         The RMS is a document that describes the strategy for managing risk and the key elements of the risk management framework that give effect to this strategy. At a minimum, an RMS must:
       (a)          describe each material risk identified, and the approach to managing these risks;
       (b)          list the policies and procedures dealing with risk management matters;
       (c)          summarise the role and responsibilities of the risk management function;
       (d)          describe the risk governance relationship between the Board of the APRA-regulated institution, board committees of the APRA-regulated institution and senior management of the institution with respect to the risk management framework; and
       (e)          outline the approach to ensuring all persons within the institution have awareness of the risk management framework as it relates to their role and for instilling an appropriate risk culture across the institution.

Business plan
31.         An APRA-regulated institution must maintain a written plan for the institution that sets out its approach for the implementation of its strategic objectives (business plan).
32.         The business plan must be a rolling plan of at least three years' duration that is reviewed at least annually, with the results of the review reported to the Board. The business plan must cover the entirety of the institution and be approved by the Board.
33.         An APRA-regulated institution must identify and consider the material risks associated with the institution's strategic objectives and business plan, and must explicitly manage these risks through the risk management framework, including how changing these plans affects  the institution's  risk profile.
34.         The requirement for a business plan does not apply to a run-off insurer provided that the run-off insurer complies with Prudential Standard GPS 110 Capital Adequacy.

Policies and procedures
35.         The policies and procedures required under subparagraph 30(b) must include:
       (a)          the process for identifying and assessing material risks and controls;
       (b)          the process for the validation, approval and use of any models to measure components of risk;
       (c)          the process for establishing, implementing and testing mitigation strategies and control mechanisms for material risks;
       (d)          the process for monitoring, communicating and reporting risk issues, including escalation procedures for the reporting of material events and incidents;
       (e)          the process for identifying, monitoring and managing potential and actual conflicts of interest;
       (f)           the mechanisms in place for monitoring and ensuring ongoing compliance with all prudential requirements[7];
       (g)          the process for ensuring consistency across the risk management framework, including the components identified under paragraph 23;
       (h)          the process for establishing and maintaining appropriate contingency arrangements (including robust and credible recovery plans where warranted)