Document ID: chunk:federal_register_of_legislation:F2023L01242:body:0:p5
Version: federal_register_of_legislation:F2023L01242
Segment Type: other
Provision Reference: 
Character Range: 11882–15221

take other actions required in the supervision of this Prudential Standard.

Roles and responsibilities
20.         The Board of an APRA-regulated entity is ultimately accountable for oversight of an entity's operational risk management. This includes business continuity and the management of service provider arrangements.[8]
21.         The Board must ensure that the APRA-regulated entity sets clear roles and responsibilities for senior managers[9] for operational risk management, including business continuity and the management of service provider arrangements.
22.         The Board must:
       (a)          oversee operational risk management and the effectiveness of key internal controls in maintaining the entity's operational risk profile within risk appetite. The Board must be provided with regular updates on the APRA-regulated entity's operational risk profile and ensure senior management takes action as required to address any areas of concern;
       (b)          approve the BCP and tolerance levels for disruptions to critical operations, review the results of testing and oversee the execution of any findings; and
       (c)          approve the service provider management policy, and review risk and performance reporting on material service providers.
23.         Senior management of an APRA-regulated entity must provide clear and comprehensive information to the Board on the expected impacts on the entity's critical operations when the Board is making decisions that could affect the resilience of critical operations.

Operational risk management
24.         An APRA-regulated entity must manage its full range of operational risks, including but not limited to legal risk, regulatory risk, compliance risk, conduct risk, technology risk, data risk and change management risk. Senior management are responsible for operational risk management across the end-to-end process for all business operations.
25.         An APRA-regulated entity must maintain appropriate and sound information and information technology (IT) capability to meet its current and projected business requirements and to support its critical operations and risk management. In managing technology risks, an APRA-regulated entity must monitor the age and health of its information assets and meet the requirements for information security in Prudential Standard CPS 234 Information Security (CPS 234).

Operational risk profile and assessment
26.         An APRA-regulated entity must assess the impact of its business and strategic decisions on its operational risk profile and operational resilience, as part of its business and strategic planning processes.[10] This must include an assessment of the impact of new products, services, geographies and technologies on its operational risk profile.
27.         An APRA-regulated entity must maintain a comprehensive assessment of its operational risk profile. As part of this, an APRA-regulated entity must:
       (a)          maintain appropriate and effective information systems to monitor operational risk, compile and analyse operational risk data and facilitate reporting to the Board and senior management;
       (b)          identify and document the processes and resources needed to deliver critical operations, including people, technology, information, facilities and