Document ID: chunk:federal_register_of_legislation:F2019L01578:body:0:p5
Version: federal_register_of_legislation:F2019L01578
Segment Type: other
Provision Reference: 
Character Range: 11843–15077

and

           (v)          the process for ensuring continued alignment between the risk management framework and the business plan;

       (c)          the role and responsibilities of the risk management function;

       (d)          the relationships between the Board, board committees and senior management with respect to the risk management framework;

       (e)          those with managerial responsibility for the risk management framework, and their roles and responsibilities;

       (f)           the approach to ensuring all persons within the RSE licensee's business operations have awareness of the risk management framework and for instilling an appropriate risk culture across the RSE licensee's business operations; and

       (g)          the process by which the risk management framework is reviewed and the intended coverage and timing for these reviews.

    23.         APRA may require an RSE licensee to amend its RMS or develop and maintain a separate RMS with respect to one or more RSEs within its business operations where APRA considers that the RSE licensee's RMS does not adequately cover the risks to that RSE.[14]

Risk management function
    24.         An RSE licensee must have a designated risk management function that, at a minimum:

       (a)          is responsible for assisting the Board, board committees and senior management to develop and maintain the risk management framework;

       (b)          is appropriate to the size, business mix and complexity of the RSE licensee's business operations and is operationally independent from the business units of the RSE licensee;

       (c)          is resourced with staff who have clearly defined roles and responsibilities and who possess appropriate experience and qualifications to exercise those responsibilities;

       (d)          has access to all aspects of the RSE licensee's business operations that have the potential to generate material risk, including information technology systems and systems development resources;

       (e)          has the necessary authority and reporting structure to the Board, board committees and senior management to conduct its risk management activities in an effective and independent manner; and

       (f)           is required to notify the Board of any material deviation from, or material breach of, the risk management framework.

    25.         An RSE licensee that is part of a corporate group may rely on a risk management function located in another entity in the group where the risk management function satisfies the criteria set out in paragraph 24 in respect of the RSE licensee's business operations.

    26.         An RSE licensee may engage the services of an external service provider to perform all or part of the risk management function where the RSE licensee can demonstrate to APRA that the external risk management function meets the requirements in paragraph 24.[15]

Review of the risk management framework
    27.         An RSE licensee must ensure that the appropriateness, effectiveness and adequacy of its risk management framework are subject to a comprehensive review by operationally independent, appropriately trained and