Document ID: chunk:federal_register_of_legislation:F2023L01242:body:0:p4
Version: federal_register_of_legislation:F2023L01242
Segment Type: other
Provision Reference: 
Character Range: 8847–12175

tolerance levels through severe disruptions; and
       (c)          manage the risks associated with the use of service providers.
13.         An APRA-regulated entity must identify, assess and manage operational risks that may result from inadequate or failed internal processes or systems, the actions or inactions of people or external drivers and events. Operational risk is inherent in all products, activities, processes and systems.
14.         An APRA-regulated entity must, to the extent practicable, prevent disruption to critical operations, adapt processes and systems to continue to operate within tolerance levels in the event of a disruption and return to normal operations promptly once a disruption is over.
15.         An APRA-regulated entity must not rely on a service provider unless it can ensure that in doing so it can continue to meet its prudential obligations in full and effectively manage the associated risks.

Risk management framework
16.         As part of its risk management framework required under Prudential Standard CPS 220 Risk Management (CPS 220) and Prudential Standard SPS 220 Risk Management (SPS 220), an APRA-regulated entity must develop and maintain:
       (a)          governance arrangements for the oversight of operational risk;
       (b)          an assessment of its operational risk profile, with a defined risk appetite supported by indicators, limits and tolerance levels;
       (c)          internal controls that are designed and operating effectively for the management of operational risks;
       (d)          appropriate monitoring, analysis and reporting of operational risks and escalation processes for operational incidents and events;
       (e)          business continuity plan(s) (BCPs) that set out how the entity would identify, manage and respond to a disruption within tolerance levels and are regularly tested with severe but plausible scenarios; and
       (f)           processes for the management of service provider arrangements.
17.         As part of the required reviews of the risk management framework under CPS 220 and SPS 220, an APRA-regulated entity must review its operational risk management.[5] The reviews must cover those aspects of operational risk management set out in paragraph 16.
18.         Operational risk management must be integrated into an APRA-regulated entity's overall risk management framework and processes. Business continuity planning must be consistent with, and not conflict or undermine, an APRA-regulated entity's recovery and exit planning.[6]
19.         Where APRA considers that an APRA-regulated entity's operational risk management has material weaknesses, APRA may:
       (a)          require an independent review of the entity's operational risk management;
       (b)          require the entity to develop a remediation program;
       (c)          require the entity to hold additional capital, as relevant;[7]
       (d)          impose conditions on the entity's licence; and
       (e)          take other actions required in the supervision of this Prudential Standard.

Roles and responsibilities
20.         The Board of an APRA-regulated entity is ultimately accountable for oversight of an entity's operational risk management. This includes business continuity and the management of