Document ID: chunk:federal_register_of_legislation:F2019L00669:body:0:p9
Version: federal_register_of_legislation:F2019L00669
Segment Type: other
Provision Reference: 
Character Range: 22975–26270

with all prudential requirements[7];
       (g)          the process for ensuring consistency across the risk management framework, including the components identified under paragraph 23;
       (h)          the process for establishing and maintaining appropriate contingency arrangements (including robust and credible recovery plans where warranted) for the operation of the risk management framework in stressed conditions; and
       (i)            the process for review of the risk management framework.
36.         An APRA-regulated institution must monitor the date when each policy or procedure was last revised, the date that it is next due for review, and who is responsible for the review.

Risk management function
37.         An APRA-regulated institution must have a designated risk management function for the institution that, at a minimum:
       (a)          is responsible for assisting the Board of the APRA-regulated institution, board committees of the APRA-regulated institution and senior management of the institution to  maintain the risk management framework;
       (b)          is appropriate to the size, business mix and complexity of the institution;
       (c)          is operationally independent;
       (d)          has the necessary authority and reporting lines to the Board of the APRA-regulated institution, board committees of the APRA-regulated institution and senior management of the institution to conduct its risk management activities in an effective and independent manner;
       (e)          is resourced with staff who have clearly defined roles and responsibilities and who possess appropriate experience and qualifications to exercise those responsibilities;
       (f)           has access to all aspects of the institution that have the potential to generate material risk, including information technology systems and systems development resources; and
       (g)          is required to notify the Board of any significant breach of, or material deviation from, the risk management framework.
38.         An APRA-regulated institution must designate a person to be responsible for that function, referred to in this standard as a CRO. The CRO must be involved in, and have the authority to provide effective challenge to, activities and decisions that may materially affect the institution's risk profile.
39.         The CRO must be independent from business lines, other revenue-generating responsibilities and the finance function. The CRO must not be the Chief Executive Officer (CEO), Chief Financial Officer, Appointed Actuary or Head of Internal Audit.
40.         The CRO must have a direct reporting line to the CEO, and have regular and unfettered access to the Board and the Board Risk Committee.
41.         Where an APRA-regulated institution believes that the requirements in paragraphs 39 and 40 are inappropriate for its particular circumstances, it may propose alternative arrangements to APRA. Proposals for alternative arrangements must outline the circumstances that are particular to that institution and include details of, and supporting reasons for, these arrangements. APRA may approve alternative arrangements for the institution if satisfied that those arrangements, in APRA's view, achieve the objectives of