Document ID: chunk:federal_register_of_legislation:F2019L00669:body:0:p10
Version: federal_register_of_legislation:F2019L00669
Segment Type: other
Provision Reference: 
Character Range: 25986–29201

must outline the circumstances that are particular to that institution and include details of, and supporting reasons for, these arrangements. APRA may approve alternative arrangements for the institution if satisfied that those arrangements, in APRA's view, achieve the objectives of this Prudential Standard.
42.         An APRA-regulated institution may engage the services of an external service provider to perform part of the risk management function where the APRA-regulated institution can demonstrate to APRA that the risk management function meets the requirements in paragraph 37.[8]

Compliance function
43.         An APRA-regulated institution must have a designated compliance function that assists senior management of the institution in effectively managing compliance risks. The compliance function must be adequately staffed by appropriately trained and competent persons who have sufficient authority to perform their role effectively, and have a reporting line independent from business lines.

Review of the risk management framework
44.         An APRA-regulated institution must ensure that compliance with, and the effectiveness of, the risk management framework of the institution is subject to review by internal and/or external audit at least annually. The results of this review must be reported to the institution's Board Audit Committee, the senior officer outside of Australia or Compliance Committee, as relevant.
45.         An APRA-regulated institution must, in addition to paragraph 44, ensure that the appropriateness, effectiveness and adequacy of the institution's risk management framework are subject to a comprehensive review by operationally independent, appropriately trained and competent persons (this may include external consultants) at least every three years.[9] The results of this review must be reported to the institution's Board Risk Committee, the senior officer outside Australia or Compliance Committee, as relevant.
46.         The scope of the comprehensive review must have regard to the size, business mix and complexity of the institution, the extent of any change to its operations or risk appetite, and any changes to the external environment in which the institution operates.
47.         The comprehensive review of the risk management framework must, at a minimum, assess whether:
       (a)          the framework is implemented and effective;
       (b)          it remains appropriate, taking into account the current business plan;
       (c)          it remains consistent with the Board's risk appetite;
       (d)          it is supported by adequate resources; and
       (e)          the RMS accurately documents the key elements of the risk management framework that give effect to the strategy for managing risk.
48.         Where a material change to the size, business mix and complexity of the operations is identified outside the review required in paragraph 45, the APRA-regulated institution must assess whether any amendment to, or a review of, the risk management framework is necessary to take account of these developments at that time.

Risk management declaration
49.         The Board of an APRA-regulated institution must