{"id":"F2009L00011","name":"Insurance (prudential standard) determination No. 16 of 2008 - Prudential Standard GPS 221 - Risk Management: Level 2 Insurance Groups","slug":"insurance-prudential-standard-determination-no-16-of-2008-prudential-standard-gps-221-risk-managemen","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"repealed","isInForce":false,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":76429,"registerId":"commonwealth-F2009L00011-current","compilationNumber":null,"startDate":"2026-04-02","status":"Repealed","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"Prudential Standard GPS 221","sectionType":"part","heading":"Prudential Standard GPS 221","content":"##### ![](image.001.png)\n\n# Prudential Standard GPS 221\n\n# Risk Management: Level 2 Insurance Groups\n\n| Objective and key requirements of this Prudential StandardThis Prudential Standard aims to ensure that a Level 2 insurance group has systems for identifying, assessing, mitigating and monitoring the risks that may affect the ability of APRA-authorised insurers within the group to meet their obligations to policyholders.Level 2 insurance groups must maintain a group-wide risk control framework that includes risk management (including capital management), reinsurance management, business continuity management and outsourcing for Level 2 insurance groups.To meet this Prudential Standard’s requirements, a Level 2 insurance group must:have a risk management framework which includes a documented Risk Management Strategy, sound risk management policies and procedures, clearly defined managerial responsibilities and controls, a dedicated risk management function and a documented Business Plan;annually review its Risk Management Strategy, and submit to APRA when any material changes are made;submit a Risk Management Declaration to APRA on an annual basis;submit a Financial Information Declaration to APRA on an annual basis;have a Reinsurance Management Framework, which includes a documented Reinsurance Management Strategy, sound reinsurance management policies and procedures, clearly defined managerial responsibilities and controls;annually review its Reinsurance Management Strategy, and submit to APRA, when any material changes are made;submit a Reinsurance Arrangements Statement to APRA;submit to APRA details of the effects of limited risk transfer arrangements entered into by foreign entities within the group;ensure that each part of the group has in place Business Continuity Management appropriate to the nature and scale of its operations; andensure that any outsourcing arrangements involving material business activities entered into are subject to appropriate due diligence, approval and on-going monitoring. |\n| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n\n###   \nAuthority\n\n1.  This Prudential Standard is made under paragraph 32 of the Insurance Act 1973 (the Act).\n\nApplication\n\n2. This Prudential Standard applies[\\[1\\]](#_ftn1) to each:\n\n(a) general insurer (insurer);\n\n(b) authorised NOHC; and\n\n(c) subsidiary of an insurer or authorised NOHC\n\nthat is parent entity of a Level 2 insurance group.\n\n3. Insurers and authorised NOHCs must, subject to paragraph 29, comply with this Prudential Standard from 31 March 2009 (effective date).\n\n4. Unless otherwise specified in this Prudential Standard, the following prudential standards apply to a Level 2 insurance group as if references to “insurer” in those prudential standards were references to “Level 2 insurance group”:\n\n(a) Prudential Standard GPS 220 Risk Management (GPS 220);\n\n(b) Prudential Standard GPS 230 Reinsurance Management (GPS 230);\n\n(c) Prudential Standard GPS 231 Outsourcing (GPS 231); and\n\n(d) Prudential Standard GPS 222 Business Continuity Management (GPS 222).\n\n5. In general, Level 2 insurance groups are subject to the same risk management requirements as Level 1 insurers. Where Level 2 insurance groups are subject to additional or alternative prudential requirements, these are specified in this Prudential Standard.\n\n6. Where a requirement is expressed to be imposed on a Level 2 insurance group in this Prudential Standard, the parent entity of the group must ensure that the group meets the requirement.\n\n7. GPS 220 and GPS 230 allow an insurer which is part of an insurance group to meet certain requirements of GPS 220 and GPS 230 on a group basis. Where:\n\n(a) a requirement of GPS 220 or GPS 230 is met on a group basis;\n\n(b) APRA has not required one or more Level 1 insurers within the Level 2 insurance group to comply with the requirement on an individual basis; and\n\n(c) APRA has not required the Level 1 insurer to comply with the requirement in respect of a different insurance group within the wider corporate group\n\nthe Level 2 insurance group is not required to comply with the corresponding requirement of this Prudential Standard separately.[\\[2\\]](#_ftn2)\n\n8. For the purposes of applying the prudential standards referred to in paragraph 4 to a Level 2 insurance group, references to an Appointed Auditor in those prudential standards shall be taken to be references to a Group Auditor[\\[3\\]](#_ftn3) of the group.\n\n9. For the purposes of applying the prudential standards referred to in paragraph 4 to a Level 2 insurance group, references to an Appointed Actuary in those prudential standards shall be taken to be references to a Group Actuary[\\[4\\]](#_ftn4) in the context of the group.\n\n### Interpretation\n\n10. Unless otherwise defined in this Prudential Standard, expressions in bold are defined in Prudential Standards GPS 001 Definitions (GPS 001).\n\n### The role of the Board and senior management\n\n11. The Board of directors (Board) of the parent entity of the Level 2 insurance group is responsible for meeting all of the requirements specified in this Prudential Standard for the Level 2 insurance group.\n\n12. The Board must take a whole-of-business approach in ensuring compliance with this Prudential Standard, including taking into account the Australian business and international business of the group.\n\n13. For the avoidance of doubt, compliance by a Level 2 insurance group with the requirements of this Prudential Standard does not relieve the Board of a Level 1 insurer within the group from the need to comply with any prudential requirements that are specific to the Level 1 insurer.\n\nRisk management framework and risk management strategy (RMS)\n\n14. In addition to the requirements relating to the risk management framework and RMS applicable to a Level 2 insurance group under GPS 220 read with this Prudential Standard, a Level 2 insurance group must ensure that its risk management framework and RMS cover its international business.\n\n### Risk management function\n\n15. Where a Level 2 insurance group complies with the requirement to have a risk management function (or role) within the group under GPS 220 read with this Prudential Standard, a Level 1 insurer within the group does not need to have its own risk management function unless otherwise required to by APRA.\n\nBusiness Plan\n\n16. Where:\n\n(a) a Level 2 insurance group complies with the requirement to maintain a Business Plan under GPS 220 read with this Prudential Standard; and\n\n(b) the Business Plan includes adequate detail about Level 1 insurers within the group\n\nthe Level 1 insurers within the group are not required to maintain separate Business Plans under GPS 220.\n\n17. A Level 2 insurance group must assess the adequacy of capital levels of non-consolidated subsidiaries. Details of this assessment must be included in the group's business plan.\n\nRisk management declaration and financial information declaration\n\n18. In addition to the requirements relating to the risk management declaration and financial information declaration applicable to a Level 2 insurance group under GPS 220 read with this Prudential Standard, a Level 2 insurance group must:\n\n(a) ensure that its risk management declaration and financial information declaration cover its international business; and\n\n(b) make an attestation, in its risk management declaration, as to the compliance of any entity in the group carrying on insurance business in a foreign jurisdiction with the applicable minimum capital requirements, if any, in that jurisdiction. Any instances where an entity of the group does not satisfy the local minimum capital requirements in a foreign jurisdiction must be noted in the attestation. Reasons for not complying with any relevant capital requirements must also be provided.\n\nReinsurance Management Strategy\n\n19. In addition to the requirements relating to REMS applicable to a Level 2 insurance group under GPS 230 read with this Prudential Standard, a Level 2 insurance group must ensure that its REMS covers its international business.\n\nReinsurance Arrangements Statement\n\n20. APRA may vary the requirements of paragraph 28 of GPS 230 in relation to a Level 2 insurance group's Reinsurance Arrangements Statement. A Level 2 insurance group's application for this variation must be made by the parent entity and set out how the proposed content of the Reinsurance Arrangements Statement (as varied) will provide substantiation of the group’s Reinsurance Management Strategy. In deciding whether to vary the requirements of paragraph 28 of GPS 230, APRA must have regard to the matters stated in the application and any other relevant considerations.\n\n21. The requirement for documentation of reinsurance arrangements in paragraphs 29 to 32 of GPS 230 does not apply to the international business of the Level 2 insurance group.\n\n### Reinsurance Declaration\n\n22. A Level 2 insurance group does not need to complete a reinsurance declaration.\n\n### Limited Risk Transfer Arrangements\n\n23. Under GPS 230, all Level 1 insurers within a Level 2 insurance group must submit to APRA details of all proposed Limited Risk Transfer Arrangements for approval prior to entering into such arrangements. A Level 2 insurance group is not required to submit to APRA, for approval, any Limited Risk Transfer Arrangement proposed to be entered into by any entity in the group that is not a Level 1 insurer. However, a Level 2 insurance group must provide details to APRA of the effect of any Limited Risk Transfer Arrangements entered into by any entities that are not Level 1 insurers.\n\n### Business Continuity Management (BCM)\n\n24. For each operational segment identified, a Level 2 insurance group must ensure that each segment's BCM meets the requirements in GPS 222. In addition to the requirements applicable to Level 2 insurance groups under GPS 222, a Level 2 insurance group must:\n\n(a) ensure that each part of the group has in place BCM appropriate to the nature and scale of its operations consistent with the Level 2 insurance group’s RMS;\n\n(b) consistently apply BCM for each part of the group;\n\n(c) apply BCM to risk assessments and risk processes at a functional level in the group, where appropriate;\n\n(d) ensure that the Business Continuity Plan (BCP) required under GPS 222 read with this Prudential Standard is reviewed at least annually by responsible senior management of the parent entity of the group; and\n\n(e) ensure that the BCP is periodically reviewed by the group internal audit function or an external expert.\n\n25. The Board may delegate operational responsibility for the BCM to a responsible committee and/or senior management of the parent entity of the group. The operational responsibility must be clearly expressed in the charter of the committee and/or in the performance objective of the responsible senior management.\n\n### Outsourcing\n\n26. In addition to the requirements on outsourcing under GPS 231 read with this Prudential Standard, a Level 2 insurance group must develop an outsourcing policy that includes a group approach to outsourcing of material business activities for both Australian and international business.\n\n27. For the purposes of GPS 231 read with this Prudential Standard, the international business of a Level 2 insurance group does not constitute offshoring as defined in GPS 231. The requirements relating to offshoring under GPS 231 read with this Prudential Standard do not apply to the international business of a Level 2 insurance group. However, a Level 2 insurance group must comply with any requirement relating to offshoring in respect of any other activity falling within the meaning of offshoring under GPS 231 read with this Prudential Standard.\n\n### Other notification requirements\n\n28. Where a Level 2 insurance group carries on insurance business outside Australia, it must notify APRA, in writing, if it becomes aware that:\n\n(a) its right to conduct business in any foreign jurisdiction has ceased; or\n\n(b) its right to conduct insurance business has been limited by a law of the jurisdiction in which the business is being conducted; or\n\n(c) its right to conduct insurance business has been otherwise materially affected under a law of the jurisdiction in which the business is being conducted; or\n\n(d) its right to conduct insurance business has otherwise been withdrawn.\n\nThe group must provide written notification to APRA within one month of the event occurring.\n\n### Transition, adjustments and exclusions\n\n29. APRA may grant a period of transition to a Level 2 insurance group by determining a later effective date for this Prudential Standard for the group where the parent entity has applied for such transitional relief. The effective date determined by APRA will be no later than 31 December 2009.\n\n30. Where a Level 2 insurance group contains an entity that meets the controlled entity definition over which the parent entity cannot exercise operational or financial control, APRA may adjust or exclude a specific prudential requirement in this Prudential Standard that would otherwise apply in relation to that specific entity within the Level 2 insurance group. The parent entity must apply for such a determination. The application must demonstrate that the Level 2 insurance group does not control the internal operations of an entity and also indicate how it has addressed this situation in its risk management framework.\n\n31. On the application of a Level 2 insurance group, APRA may by notice in writing to the parent entity of the Level 2 insurance group adjust or exclude a specific prudential requirement in this Prudential Standard in relation to that Level 2 insurance group.","sortOrder":0},{"sectionNumber":"Risk Management: Level 2 Insurance Group","sectionType":"part","heading":"Risk Management: Level 2 Insurance Groups","content":"# Risk Management: Level 2 Insurance Groups\n\n| Objective and key requirements of this Prudential StandardThis Prudential Standard aims to ensure that a Level 2 insurance group has systems for identifying, assessing, mitigating and monitoring the risks that may affect the ability of APRA-authorised insurers within the group to meet their obligations to policyholders.Level 2 insurance groups must maintain a group-wide risk control framework that includes risk management (including capital management), reinsurance management, business continuity management and outsourcing for Level 2 insurance groups.To meet this Prudential Standard’s requirements, a Level 2 insurance group must:have a risk management framework which includes a documented Risk Management Strategy, sound risk management policies and procedures, clearly defined managerial responsibilities and controls, a dedicated risk management function and a documented Business Plan;annually review its Risk Management Strategy, and submit to APRA when any material changes are made;submit a Risk Management Declaration to APRA on an annual basis;submit a Financial Information Declaration to APRA on an annual basis;have a Reinsurance Management Framework, which includes a documented Reinsurance Management Strategy, sound reinsurance management policies and procedures, clearly defined managerial responsibilities and controls;annually review its Reinsurance Management Strategy, and submit to APRA, when any material changes are made;submit a Reinsurance Arrangements Statement to APRA;submit to APRA details of the effects of limited risk transfer arrangements entered into by foreign entities within the group;ensure that each part of the group has in place Business Continuity Management appropriate to the nature and scale of its operations; andensure that any outsourcing arrangements involving material business activities entered into are subject to appropriate due diligence, approval and on-going monitoring. |\n| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n\n###   \nAuthority\n\n1.  This Prudential Standard is made under paragraph 32 of the Insurance Act 1973 (the Act).\n\nApplication\n\n2. This Prudential Standard applies[\\[1\\]](#_ftn1) to each:\n\n(a) general insurer (insurer);\n\n(b) authorised NOHC; and\n\n(c) subsidiary of an insurer or authorised NOHC\n\nthat is parent entity of a Level 2 insurance group.\n\n3. Insurers and authorised NOHCs must, subject to paragraph 29, comply with this Prudential Standard from 31 March 2009 (effective date).\n\n4. Unless otherwise specified in this Prudential Standard, the following prudential standards apply to a Level 2 insurance group as if references to “insurer” in those prudential standards were references to “Level 2 insurance group”:\n\n(a) Prudential Standard GPS 220 Risk Management (GPS 220);\n\n(b) Prudential Standard GPS 230 Reinsurance Management (GPS 230);\n\n(c) Prudential Standard GPS 231 Outsourcing (GPS 231); and\n\n(d) Prudential Standard GPS 222 Business Continuity Management (GPS 222).\n\n5. In general, Level 2 insurance groups are subject to the same risk management requirements as Level 1 insurers. Where Level 2 insurance groups are subject to additional or alternative prudential requirements, these are specified in this Prudential Standard.\n\n6. Where a requirement is expressed to be imposed on a Level 2 insurance group in this Prudential Standard, the parent entity of the group must ensure that the group meets the requirement.\n\n7. GPS 220 and GPS 230 allow an insurer which is part of an insurance group to meet certain requirements of GPS 220 and GPS 230 on a group basis. Where:\n\n(a) a requirement of GPS 220 or GPS 230 is met on a group basis;\n\n(b) APRA has not required one or more Level 1 insurers within the Level 2 insurance group to comply with the requirement on an individual basis; and\n\n(c) APRA has not required the Level 1 insurer to comply with the requirement in respect of a different insurance group within the wider corporate group\n\nthe Level 2 insurance group is not required to comply with the corresponding requirement of this Prudential Standard separately.[\\[2\\]](#_ftn2)\n\n8. For the purposes of applying the prudential standards referred to in paragraph 4 to a Level 2 insurance group, references to an Appointed Auditor in those prudential standards shall be taken to be references to a Group Auditor[\\[3\\]](#_ftn3) of the group.\n\n9. For the purposes of applying the prudential standards referred to in paragraph 4 to a Level 2 insurance group, references to an Appointed Actuary in those prudential standards shall be taken to be references to a Group Actuary[\\[4\\]](#_ftn4) in the context of the group.\n\n### Interpretation\n\n10. Unless otherwise defined in this Prudential Standard, expressions in bold are defined in Prudential Standards GPS 001 Definitions (GPS 001).\n\n### The role of the Board and senior management\n\n11. The Board of directors (Board) of the parent entity of the Level 2 insurance group is responsible for meeting all of the requirements specified in this Prudential Standard for the Level 2 insurance group.\n\n12. The Board must take a whole-of-business approach in ensuring compliance with this Prudential Standard, including taking into account the Australian business and international business of the group.\n\n13. For the avoidance of doubt, compliance by a Level 2 insurance group with the requirements of this Prudential Standard does not relieve the Board of a Level 1 insurer within the group from the need to comply with any prudential requirements that are specific to the Level 1 insurer.\n\nRisk management framework and risk management strategy (RMS)\n\n14. In addition to the requirements relating to the risk management framework and RMS applicable to a Level 2 insurance group under GPS 220 read with this Prudential Standard, a Level 2 insurance group must ensure that its risk management framework and RMS cover its international business.\n\n### Risk management function\n\n15. Where a Level 2 insurance group complies with the requirement to have a risk management function (or role) within the group under GPS 220 read with this Prudential Standard, a Level 1 insurer within the group does not need to have its own risk management function unless otherwise required to by APRA.\n\nBusiness Plan\n\n16. Where:\n\n(a) a Level 2 insurance group complies with the requirement to maintain a Business Plan under GPS 220 read with this Prudential Standard; and\n\n(b) the Business Plan includes adequate detail about Level 1 insurers within the group\n\nthe Level 1 insurers within the group are not required to maintain separate Business Plans under GPS 220.\n\n17. A Level 2 insurance group must assess the adequacy of capital levels of non-consolidated subsidiaries. Details of this assessment must be included in the group's business plan.\n\nRisk management declaration and financial information declaration\n\n18. In addition to the requirements relating to the risk management declaration and financial information declaration applicable to a Level 2 insurance group under GPS 220 read with this Prudential Standard, a Level 2 insurance group must:\n\n(a) ensure that its risk management declaration and financial information declaration cover its international business; and\n\n(b) make an attestation, in its risk management declaration, as to the compliance of any entity in the group carrying on insurance business in a foreign jurisdiction with the applicable minimum capital requirements, if any, in that jurisdiction. Any instances where an entity of the group does not satisfy the local minimum capital requirements in a foreign jurisdiction must be noted in the attestation. Reasons for not complying with any relevant capital requirements must also be provided.\n\nReinsurance Management Strategy\n\n19. In addition to the requirements relating to REMS applicable to a Level 2 insurance group under GPS 230 read with this Prudential Standard, a Level 2 insurance group must ensure that its REMS covers its international business.\n\nReinsurance Arrangements Statement\n\n20. APRA may vary the requirements of paragraph 28 of GPS 230 in relation to a Level 2 insurance group's Reinsurance Arrangements Statement. A Level 2 insurance group's application for this variation must be made by the parent entity and set out how the proposed content of the Reinsurance Arrangements Statement (as varied) will provide substantiation of the group’s Reinsurance Management Strategy. In deciding whether to vary the requirements of paragraph 28 of GPS 230, APRA must have regard to the matters stated in the application and any other relevant considerations.\n\n21. The requirement for documentation of reinsurance arrangements in paragraphs 29 to 32 of GPS 230 does not apply to the international business of the Level 2 insurance group.\n\n### Reinsurance Declaration\n\n22. A Level 2 insurance group does not need to complete a reinsurance declaration.\n\n### Limited Risk Transfer Arrangements\n\n23. Under GPS 230, all Level 1 insurers within a Level 2 insurance group must submit to APRA details of all proposed Limited Risk Transfer Arrangements for approval prior to entering into such arrangements. A Level 2 insurance group is not required to submit to APRA, for approval, any Limited Risk Transfer Arrangement proposed to be entered into by any entity in the group that is not a Level 1 insurer. However, a Level 2 insurance group must provide details to APRA of the effect of any Limited Risk Transfer Arrangements entered into by any entities that are not Level 1 insurers.\n\n### Business Continuity Management (BCM)\n\n24. For each operational segment identified, a Level 2 insurance group must ensure that each segment's BCM meets the requirements in GPS 222. In addition to the requirements applicable to Level 2 insurance groups under GPS 222, a Level 2 insurance group must:\n\n(a) ensure that each part of the group has in place BCM appropriate to the nature and scale of its operations consistent with the Level 2 insurance group’s RMS;\n\n(b) consistently apply BCM for each part of the group;\n\n(c) apply BCM to risk assessments and risk processes at a functional level in the group, where appropriate;\n\n(d) ensure that the Business Continuity Plan (BCP) required under GPS 222 read with this Prudential Standard is reviewed at least annually by responsible senior management of the parent entity of the group; and\n\n(e) ensure that the BCP is periodically reviewed by the group internal audit function or an external expert.\n\n25. The Board may delegate operational responsibility for the BCM to a responsible committee and/or senior management of the parent entity of the group. The operational responsibility must be clearly expressed in the charter of the committee and/or in the performance objective of the responsible senior management.\n\n### Outsourcing\n\n26. In addition to the requirements on outsourcing under GPS 231 read with this Prudential Standard, a Level 2 insurance group must develop an outsourcing policy that includes a group approach to outsourcing of material business activities for both Australian and international business.\n\n27. For the purposes of GPS 231 read with this Prudential Standard, the international business of a Level 2 insurance group does not constitute offshoring as defined in GPS 231. The requirements relating to offshoring under GPS 231 read with this Prudential Standard do not apply to the international business of a Level 2 insurance group. However, a Level 2 insurance group must comply with any requirement relating to offshoring in respect of any other activity falling within the meaning of offshoring under GPS 231 read with this Prudential Standard.\n\n### Other notification requirements\n\n28. Where a Level 2 insurance group carries on insurance business outside Australia, it must notify APRA, in writing, if it becomes aware that:\n\n(a) its right to conduct business in any foreign jurisdiction has ceased; or\n\n(b) its right to conduct insurance business has been limited by a law of the jurisdiction in which the business is being conducted; or\n\n(c) its right to conduct insurance business has been otherwise materially affected under a law of the jurisdiction in which the business is being conducted; or\n\n(d) its right to conduct insurance business has otherwise been withdrawn.\n\nThe group must provide written notification to APRA within one month of the event occurring.\n\n### Transition, adjustments and exclusions\n\n29. APRA may grant a period of transition to a Level 2 insurance group by determining a later effective date for this Prudential Standard for the group where the parent entity has applied for such transitional relief. The effective date determined by APRA will be no later than 31 December 2009.\n\n30. Where a Level 2 insurance group contains an entity that meets the controlled entity definition over which the parent entity cannot exercise operational or financial control, APRA may adjust or exclude a specific prudential requirement in this Prudential Standard that would otherwise apply in relation to that specific entity within the Level 2 insurance group. The parent entity must apply for such a determination. The application must demonstrate that the Level 2 insurance group does not control the internal operations of an entity and also indicate how it has addressed this situation in its risk management framework.\n\n31. On the application of a Level 2 insurance group, APRA may by notice in writing to the parent entity of the Level 2 insurance group adjust or exclude a specific prudential requirement in this Prudential Standard in relation to that Level 2 insurance group.","sortOrder":1},{"sectionNumber":"Objective and key requirements of this P","sectionType":"part","heading":"Objective and key requirements of this Prudential Standard","content":"## Objective and key requirements of this Prudential Standard\n\nThis Prudential Standard aims to ensure that a Level 2 insurance group has systems for identifying, assessing, mitigating and monitoring the risks that may affect the ability of APRA-authorised insurers within the group to meet their obligations to policyholders.\n\nLevel 2 insurance groups must maintain a group-wide risk control framework that includes risk management (including capital management), reinsurance management, business continuity management and outsourcing for Level 2 insurance groups.\n\nTo meet this Prudential Standard’s requirements, a Level 2 insurance group must:\n\n-   have a risk management framework which includes a documented Risk Management Strategy, sound risk management policies and procedures, clearly defined managerial responsibilities and controls, a dedicated risk management function and a documented Business Plan;\n\n-   annually review its Risk Management Strategy, and submit to APRA when any material changes are made;\n\n-   submit a Risk Management Declaration to APRA on an annual basis;\n\n-   submit a Financial Information Declaration to APRA on an annual basis;\n\n-   have a Reinsurance Management Framework, which includes a documented Reinsurance Management Strategy, sound reinsurance management policies and procedures, clearly defined managerial responsibilities and controls;\n\n-   annually review its Reinsurance Management Strategy, and submit to APRA, when any material changes are made;\n\n-   submit a Reinsurance Arrangements Statement to APRA;\n\n-   submit to APRA details of the effects of limited risk transfer arrangements entered into by foreign entities within the group;\n\n-   ensure that each part of the group has in place Business Continuity Management appropriate to the nature and scale of its operations; and\n\n-   ensure that any outsourcing arrangements involving material business activities entered into are subject to appropriate due diligence, approval and on-going monitoring.","sortOrder":2},{"sectionNumber":"Authority","sectionType":"division","heading":"Authority","content":"###   \nAuthority\n\n1.  This Prudential Standard is made under paragraph 32 of the Insurance Act 1973 (the Act).\n\nApplication\n\n2. This Prudential Standard applies[\\[1\\]](#_ftn1) to each:\n\n(a) general insurer (insurer);\n\n(b) authorised NOHC; and\n\n(c) subsidiary of an insurer or authorised NOHC\n\nthat is parent entity of a Level 2 insurance group.\n\n3. Insurers and authorised NOHCs must, subject to paragraph 29, comply with this Prudential Standard from 31 March 2009 (effective date).\n\n4. Unless otherwise specified in this Prudential Standard, the following prudential standards apply to a Level 2 insurance group as if references to “insurer” in those prudential standards were references to “Level 2 insurance group”:\n\n(a) Prudential Standard GPS 220 Risk Management (GPS 220);\n\n(b) Prudential Standard GPS 230 Reinsurance Management (GPS 230);\n\n(c) Prudential Standard GPS 231 Outsourcing (GPS 231); and\n\n(d) Prudential Standard GPS 222 Business Continuity Management (GPS 222).\n\n5. In general, Level 2 insurance groups are subject to the same risk management requirements as Level 1 insurers. Where Level 2 insurance groups are subject to additional or alternative prudential requirements, these are specified in this Prudential Standard.\n\n6. Where a requirement is expressed to be imposed on a Level 2 insurance group in this Prudential Standard, the parent entity of the group must ensure that the group meets the requirement.\n\n7. GPS 220 and GPS 230 allow an insurer which is part of an insurance group to meet certain requirements of GPS 220 and GPS 230 on a group basis. Where:\n\n(a) a requirement of GPS 220 or GPS 230 is met on a group basis;\n\n(b) APRA has not required one or more Level 1 insurers within the Level 2 insurance group to comply with the requirement on an individual basis; and\n\n(c) APRA has not required the Level 1 insurer to comply with the requirement in respect of a different insurance group within the wider corporate group\n\nthe Level 2 insurance group is not required to comply with the corresponding requirement of this Prudential Standard separately.[\\[2\\]](#_ftn2)\n\n8. For the purposes of applying the prudential standards referred to in paragraph 4 to a Level 2 insurance group, references to an Appointed Auditor in those prudential standards shall be taken to be references to a Group Auditor[\\[3\\]](#_ftn3) of the group.\n\n9. For the purposes of applying the prudential standards referred to in paragraph 4 to a Level 2 insurance group, references to an Appointed Actuary in those prudential standards shall be taken to be references to a Group Actuary[\\[4\\]](#_ftn4) in the context of the group.","sortOrder":3},{"sectionNumber":"Interpretation","sectionType":"division","heading":"Interpretation","content":"### Interpretation\n\n10. Unless otherwise defined in this Prudential Standard, expressions in bold are defined in Prudential Standards GPS 001 Definitions (GPS 001).","sortOrder":4},{"sectionNumber":"The role of the Board and senior managem","sectionType":"division","heading":"The role of the Board and senior management","content":"### The role of the Board and senior management\n\n11. The Board of directors (Board) of the parent entity of the Level 2 insurance group is responsible for meeting all of the requirements specified in this Prudential Standard for the Level 2 insurance group.\n\n12. The Board must take a whole-of-business approach in ensuring compliance with this Prudential Standard, including taking into account the Australian business and international business of the group.\n\n13. For the avoidance of doubt, compliance by a Level 2 insurance group with the requirements of this Prudential Standard does not relieve the Board of a Level 1 insurer within the group from the need to comply with any prudential requirements that are specific to the Level 1 insurer.\n\nRisk management framework and risk management strategy (RMS)\n\n14. In addition to the requirements relating to the risk management framework and RMS applicable to a Level 2 insurance group under GPS 220 read with this Prudential Standard, a Level 2 insurance group must ensure that its risk management framework and RMS cover its international business.","sortOrder":5},{"sectionNumber":"Risk management function","sectionType":"division","heading":"Risk management function","content":"### Risk management function\n\n15. Where a Level 2 insurance group complies with the requirement to have a risk management function (or role) within the group under GPS 220 read with this Prudential Standard, a Level 1 insurer within the group does not need to have its own risk management function unless otherwise required to by APRA.\n\nBusiness Plan\n\n16. Where:\n\n(a) a Level 2 insurance group complies with the requirement to maintain a Business Plan under GPS 220 read with this Prudential Standard; and\n\n(b) the Business Plan includes adequate detail about Level 1 insurers within the group\n\nthe Level 1 insurers within the group are not required to maintain separate Business Plans under GPS 220.\n\n17. A Level 2 insurance group must assess the adequacy of capital levels of non-consolidated subsidiaries. Details of this assessment must be included in the group's business plan.\n\nRisk management declaration and financial information declaration\n\n18. In addition to the requirements relating to the risk management declaration and financial information declaration applicable to a Level 2 insurance group under GPS 220 read with this Prudential Standard, a Level 2 insurance group must:\n\n(a) ensure that its risk management declaration and financial information declaration cover its international business; and\n\n(b) make an attestation, in its risk management declaration, as to the compliance of any entity in the group carrying on insurance business in a foreign jurisdiction with the applicable minimum capital requirements, if any, in that jurisdiction. Any instances where an entity of the group does not satisfy the local minimum capital requirements in a foreign jurisdiction must be noted in the attestation. Reasons for not complying with any relevant capital requirements must also be provided.\n\nReinsurance Management Strategy\n\n19. In addition to the requirements relating to REMS applicable to a Level 2 insurance group under GPS 230 read with this Prudential Standard, a Level 2 insurance group must ensure that its REMS covers its international business.\n\nReinsurance Arrangements Statement\n\n20. APRA may vary the requirements of paragraph 28 of GPS 230 in relation to a Level 2 insurance group's Reinsurance Arrangements Statement. A Level 2 insurance group's application for this variation must be made by the parent entity and set out how the proposed content of the Reinsurance Arrangements Statement (as varied) will provide substantiation of the group’s Reinsurance Management Strategy. In deciding whether to vary the requirements of paragraph 28 of GPS 230, APRA must have regard to the matters stated in the application and any other relevant considerations.\n\n21. The requirement for documentation of reinsurance arrangements in paragraphs 29 to 32 of GPS 230 does not apply to the international business of the Level 2 insurance group.","sortOrder":6},{"sectionNumber":"Reinsurance Declaration","sectionType":"division","heading":"Reinsurance Declaration","content":"### Reinsurance Declaration\n\n22. A Level 2 insurance group does not need to complete a reinsurance declaration.","sortOrder":7},{"sectionNumber":"Limited Risk Transfer Arrangements","sectionType":"division","heading":"Limited Risk Transfer Arrangements","content":"### Limited Risk Transfer Arrangements\n\n23. Under GPS 230, all Level 1 insurers within a Level 2 insurance group must submit to APRA details of all proposed Limited Risk Transfer Arrangements for approval prior to entering into such arrangements. A Level 2 insurance group is not required to submit to APRA, for approval, any Limited Risk Transfer Arrangement proposed to be entered into by any entity in the group that is not a Level 1 insurer. However, a Level 2 insurance group must provide details to APRA of the effect of any Limited Risk Transfer Arrangements entered into by any entities that are not Level 1 insurers.","sortOrder":8},{"sectionNumber":"Business Continuity Management (BCM)","sectionType":"division","heading":"Business Continuity Management (BCM)","content":"### Business Continuity Management (BCM)\n\n24. For each operational segment identified, a Level 2 insurance group must ensure that each segment's BCM meets the requirements in GPS 222. In addition to the requirements applicable to Level 2 insurance groups under GPS 222, a Level 2 insurance group must:\n\n(a) ensure that each part of the group has in place BCM appropriate to the nature and scale of its operations consistent with the Level 2 insurance group’s RMS;\n\n(b) consistently apply BCM for each part of the group;\n\n(c) apply BCM to risk assessments and risk processes at a functional level in the group, where appropriate;\n\n(d) ensure that the Business Continuity Plan (BCP) required under GPS 222 read with this Prudential Standard is reviewed at least annually by responsible senior management of the parent entity of the group; and\n\n(e) ensure that the BCP is periodically reviewed by the group internal audit function or an external expert.\n\n25. The Board may delegate operational responsibility for the BCM to a responsible committee and/or senior management of the parent entity of the group. The operational responsibility must be clearly expressed in the charter of the committee and/or in the performance objective of the responsible senior management.","sortOrder":9},{"sectionNumber":"Outsourcing","sectionType":"division","heading":"Outsourcing","content":"### Outsourcing\n\n26. In addition to the requirements on outsourcing under GPS 231 read with this Prudential Standard, a Level 2 insurance group must develop an outsourcing policy that includes a group approach to outsourcing of material business activities for both Australian and international business.\n\n27. For the purposes of GPS 231 read with this Prudential Standard, the international business of a Level 2 insurance group does not constitute offshoring as defined in GPS 231. The requirements relating to offshoring under GPS 231 read with this Prudential Standard do not apply to the international business of a Level 2 insurance group. However, a Level 2 insurance group must comply with any requirement relating to offshoring in respect of any other activity falling within the meaning of offshoring under GPS 231 read with this Prudential Standard.","sortOrder":10},{"sectionNumber":"Other notification requirements","sectionType":"division","heading":"Other notification requirements","content":"### Other notification requirements\n\n28. Where a Level 2 insurance group carries on insurance business outside Australia, it must notify APRA, in writing, if it becomes aware that:\n\n(a) its right to conduct business in any foreign jurisdiction has ceased; or\n\n(b) its right to conduct insurance business has been limited by a law of the jurisdiction in which the business is being conducted; or\n\n(c) its right to conduct insurance business has been otherwise materially affected under a law of the jurisdiction in which the business is being conducted; or\n\n(d) its right to conduct insurance business has otherwise been withdrawn.\n\nThe group must provide written notification to APRA within one month of the event occurring.","sortOrder":11},{"sectionNumber":"Transition, adjustments and exclusions","sectionType":"division","heading":"Transition, adjustments and exclusions","content":"### Transition, adjustments and exclusions\n\n29. APRA may grant a period of transition to a Level 2 insurance group by determining a later effective date for this Prudential Standard for the group where the parent entity has applied for such transitional relief. The effective date determined by APRA will be no later than 31 December 2009.\n\n30. Where a Level 2 insurance group contains an entity that meets the controlled entity definition over which the parent entity cannot exercise operational or financial control, APRA may adjust or exclude a specific prudential requirement in this Prudential Standard that would otherwise apply in relation to that specific entity within the Level 2 insurance group. The parent entity must apply for such a determination. The application must demonstrate that the Level 2 insurance group does not control the internal operations of an entity and also indicate how it has addressed this situation in its risk management framework.\n\n31. On the application of a Level 2 insurance group, APRA may by notice in writing to the parent entity of the Level 2 insurance group adjust or exclude a specific prudential requirement in this Prudential Standard in relation to that Level 2 insurance group.","sortOrder":12}],"analysis":{"kimi_summary":{"_metrics":{"model":"kimi-k2.5","source":"moonshot-realtime","completionTokens":3196},"content_quality":"ok","complexity_score":6,"scope_assessment":{"changed":false,"description":"The legislation maintains its original scope of regulating risk management at the Level 2 insurance group level. It consistently applies to parent entities of insurance groups and does not appear to have expanded beyond the original intent of ensuring group-wide risk controls for APRA-authorised insurers."},"complexity_factors":["Extensive cross-referencing to four other prudential standards (GPS 220, 230, 231, 222) with modified application rules","Dual-level application logic distinguishing between Level 1 (individual) insurers and Level 2 (group) requirements","Conditional provisions with multiple nested criteria (e.g., paragraph 7 setting out three conditions for exemption from duplicate compliance)","Defined terms located in external standard GPS 001 rather than defined within the instrument itself","Mixed territorial application with specific carve-outs for international business (e.g., paragraphs 21 and 27 exempting international business from certain documentation and offshoring rules)","Multiple declaration and attestation requirements with specific content mandates (e.g., paragraph 18(b) requiring attestation of foreign capital compliance)","Discretionary powers granted to APRA for variations, transitional relief, and exclusions (paragraphs 20, 29-31)"],"plain_english_summary":"This Prudential Standard requires large insurance groups (Level 2) and their parent entities in Australia to operate group-wide risk management frameworks that identify, assess and manage threats to policyholder claims-paying ability. It covers governance, capital planning, reinsurance, business continuity, outsourcing oversight and annual declarations to APRA, and extends certain prudential rules to the group level.\n\nIt matters because it prevents risks in one part of a global group from undermining Australian insurers and protects policyholders."}},"importantCases":[],"_links":{"self":"/api/acts/insurance-prudential-standard-determination-no-16-of-2008-prudential-standard-gps-221-risk-managemen","history":"/api/acts/insurance-prudential-standard-determination-no-16-of-2008-prudential-standard-gps-221-risk-managemen/history","analysis":"/api/acts/insurance-prudential-standard-determination-no-16-of-2008-prudential-standard-gps-221-risk-managemen/analysis","conflicts":"/api/acts/insurance-prudential-standard-determination-no-16-of-2008-prudential-standard-gps-221-risk-managemen/conflicts","importantCases":"/api/acts/insurance-prudential-standard-determination-no-16-of-2008-prudential-standard-gps-221-risk-managemen/important-cases","documents":"/api/acts/insurance-prudential-standard-determination-no-16-of-2008-prudential-standard-gps-221-risk-managemen/documents"}}