Document ID: chunk:federal_register_of_legislation:F2019L01578:body:0:p6
Version: federal_register_of_legislation:F2019L01578
Segment Type: other
Provision Reference: 
Character Range: 14774–17974

the requirements in paragraph 24.[15]

Review of the risk management framework
    27.         An RSE licensee must ensure that the appropriateness, effectiveness and adequacy of its risk management framework are subject to a comprehensive review by operationally independent, appropriately trained and competent persons at least every three years.

    28.         An RSE licensee must also undertake, for each year during which a comprehensive review does not take place, a review of the appropriateness, effectiveness and adequacy of the risk management framework.

    29.         The scope of the comprehensive review of an RSE licensee's risk management framework must have regard to the size, business mix and complexity of the RSE licensee's business operations, the extent of any change to those operations or its risk appetite and any changes to the external environment in which the RSE licensee operates. The review of the risk management framework must, at a minimum, include a review of:

       (a)          whether the risk management framework remains appropriate for the RSE licensee's business operations;

       (b)          the specific resources utilised, at a minimum, to undertake the risk management activities required by this Prudential Standard and whether these activities are supported by adequate resources;

       (c)          the risk appetite statement;

       (d)          the RMS, to ensure that it accurately documents the RSE licensee's risk management framework and the RSE licensee's strategy for managing risk;

       (e)          all risk management policies and procedures; and

       (f)           all risk management and internal control systems.

    30.         An RSE licensee must implement satisfactory internal audit procedures and external audit arrangements to ensure compliance with the risk management framework and enable the RSE licensee to attest that the risk management and internal control systems in place are operating effectively and are adequate.[16]

    31.         Where institutional, operational or other developments that materially affect the size, business mix and complexity of an RSE licensee's business operations are identified outside the comprehensive review required in paragraph 27, the RSE licensee must assess whether any amendment to, or a review of, the risk management framework is necessary to take account of these developments.

Risk management declaration
    32.         The Board must, on an annual basis, provide APRA with a declaration on risk management (risk management declaration) signed by two directors that satisfies the requirements set out in Attachment A of this Prudential Standard.

    33.         An RSE licensee must submit the risk management declaration to APRA on, or before, the day that the RSE licensee is required to submit annual information under reporting standards made by APRA under the Financial Sector (Collection of Data) Act 2001.

    34.         If the Board qualifies the risk management declaration, the qualified declaration must include a description of any material deviation from the RSE licensee's risk management framework and the steps taken, or