Document ID: chunk:federal_register_of_legislation:F2019L00669:body:0:p7
Version: federal_register_of_legislation:F2019L00669
Segment Type: other
Provision Reference: 
Character Range: 17057–20275

that the risk management framework is effective in identifying, measuring, evaluating, monitoring, reporting, and controlling or mitigating material risks.
24.         The risk management framework must include forward-looking scenario analysis and stress testing programs, commensurate with the institution's size, business mix and complexity, and which are based on severe but plausible assumptions.
25.         The MIS must provide the Board of the APRA-regulated institution, board committees of the APRA-regulated institution and senior management of the institution with regular, accurate and timely information concerning the institution's risk profile. The MIS must be supported by a robust data framework that enables the aggregation of exposures and risk measures across business lines, prompt reporting of limit breaches, and forward-looking scenario analysis and stress testing. Data quality must be adequate for timely and accurate measurement, assessment and reporting on all material risks across the institution and must provide a sound basis for making decisions.

Material risks
26.         The risk management framework must, at a minimum, address:
       (a)          credit risk;
       (b)          market and investment risk;
       (c)          liquidity risk;
       (d)          insurance risk;
       (e)          operational risk;
       (f)           risks arising from the strategic objectives and business plans; and
       (g)          other risks that, singly or in combination with different risks, may have a material impact on the institution.

Risk appetite
27.         An APRA-regulated institution must maintain an appropriate, clear and concise risk appetite statement for the institution that addresses the institution's material risks. The Board is responsible for setting the risk appetite of the institution and must approve the institution's risk appetite statement.
28.         The risk appetite statement must, at a minimum, convey:
       (a)          the degree of risk that the institution is prepared to accept in pursuit of its strategic objectives and business plan, giving consideration to the interests of depositors and/or policyholders (risk appetite);
       (b)          for each material risk, the maximum level of risk that the institution is willing to operate within, expressed as a risk limit and based on its risk appetite, risk profile and capital strength (risk tolerance);
       (c)          the process for ensuring that risk tolerances are set at an appropriate level, based on an estimate of the impact in the event that a risk tolerance is breached, and the likelihood that each material risk is realised;
       (d)          the process for monitoring compliance with each risk tolerance and for taking appropriate action in the event that it is breached; and
       (e)          the timing and process for review of the risk appetite and risk tolerances.

Risk management strategy
29.         An APRA-regulated institution must maintain an RMS for the institution that addresses each material risk listed under paragraph 26. The RMS must be approved by the Board.
30.         The RMS is a document that describes the strategy for managing risk