The Standard organises risk governance around a handful of core legal and operational concepts and links them to explicit duties.

• Board accountability and risk culture. The Board is explicitly “ultimately responsible” for the institution’s risk management framework and for oversight of management (para 9). The Board must set risk appetite, approve the risk appetite statement and RMS, and form and act on a view of the institution’s risk culture. These are treated as discrete duties that give the Board both supervisory and affirmative responsibilities.

• Risk management framework. Defined as the totality of systems, structures, policies, processes and people that identify, measure, evaluate, monitor, report and control or mitigate material risks (para 20). The framework must be commensurate with size, business mix and complexity, be consistent with the business plan, and include a risk appetite statement, an RMS, a business plan, documented policies and procedures, a designated risk management function, an ICAAP, an MIS and a periodic review process (paras 21-23).

• Material risk taxonomy. The Standard requires the framework to cover credit risk, market and investment risk, liquidity risk, insurance risk, operational risk, risks arising from strategic objectives and business plans, and other risks that could materially impact the institution in combination or alone (para 26). This provides a minimum catalogue institutions must address.

• Risk appetite and tolerances. The Board must maintain an appropriate risk appetite statement that sets the degree of risk the institution will accept, and, for each material risk, a maximum tolerable level expressed as a risk limit and supported by processes for setting tolerances, monitoring compliance, and responding to breaches (paras 27-28).

• Designated functions and independence. The Standard mandates a designated risk management function and a CRO responsible for that function, with independence from business lines and revenue roles, access to information, authority to challenge decisions affecting risk profile, and direct reporting to the CEO and access to the Board (paras 37-41). A separate compliance function is also mandatory (para 43).

• Group‑level coordination and Head of group duties. Where part of a group, institutions may use group frameworks (para 10) but must demonstrate how group arrangements affect the institution (para 12). The Head of a group has additional duties around group risk coordination, notification to APRA, and maintaining a group liquidity management policy (paras 14-18).

• Management information systems and stress testing. The MIS must provide accurate, timely, aggregated information and be supported by a robust data framework to enable limit‑breach reporting, aggregation across business lines and forward‑looking stress testing (paras 24-25). The Standard requires stress testing programs that are severe but plausible and commensurate with the institution’s profile (para 24).

• Reviews and assurance. Annual audit review of compliance and effectiveness is required, and a comprehensive independent review must be completed at least every three years (paras 44-47). The scope and frequency must be adjusted if there are material changes outside those review cycles (para 48).

• Declaration and notification. Boards must annually declare to APRA that, to the best of their knowledge, systems and resources are appropriate and operating effectively, and must notify specified events within strict timelines, commonly 10 business days (paras 49-55, Attachment A).

• APRA discretion and transition. APRA can require institution‑specific action where group arrangements are insufficient, can adjust or exclude requirements, and continues to give effect to prior determinations under earlier prudential standards (paras 13, 56-57).

These concepts function as both compliance obligations and governance tools. The Standard ties them together with concrete procedural requirements, defined timelines and reporting obligations which convert governance statements into operational duties.

The Standard applies to a broad and explicitly defined set of APRA‑regulated institutions. That includes authorised deposit‑taking institutions, foreign ADIs operating through Australian branches, non‑operating holding companies authorised under the Banking Act, general insurers including Category C insurers, non‑operating holding companies authorised under the Insurance Act and parent entities of Level 2 insurance groups, life companies including friendly societies and eligible foreign life insurance companies and registered life NOHCs under the Life Insurance Act, and private health insurers registered under the PHIPS Act (para 2). Application to foreign ADIs, Category C insurers and EFLICs is limited to their Australian branch operations (para 3).

The Standard also reaches groups. If an APRA‑regulated institution is the Head of a group (Level 2 or Level 3 Head as defined and elaborated in para 8), the Head must both comply as an APRA‑regulated institution in its own capacity and ensure the requirements are applied appropriately throughout the group, including to entities that are not APRA‑regulated (para 4). For Heads of groups, multiple paragraphs in the Standard must be read as applying to the Head of a group on a group basis (para 4).

Key officers and corporate functions within affected entities are specifically caught by the Standard. Boards and Board committees must take on enumerated duties (para 9). The Standard requires a designated CRO to lead the risk management function, with specified independence and reporting lines (paras 37-41). A compliance function separate from business lines is mandated (para 43). For Heads of groups, the group CRO cannot perform certain functions for subsidiaries as set out in para 15 and para 39.

Third parties and non‑regulated affiliates are indirectly affected. Where an institution is part of a group and elements of the risk management framework are controlled or influenced by another group entity, the institution must document the linkages and differences and take account of group risks (para 12). The Head of a group must ensure that non‑APRA regulated subsidiaries whose activities create material risks to the group are covered by the risk management framework (para 18). External service providers can be engaged to perform part of the risk management function only where the institution can demonstrate to APRA that the outsourced arrangements meet the Standard’s requirements (para 42).

APRA itself is a decision‑maker under the Standard. It may require separate institution‑level compliance where group compliance is inadequate (para 13), approve alternative CRO arrangements in exceptional circumstances (para 41), adjust or exclude specific requirements (para 56), and continues to recognise determinations made under previous risk management standards (para 57). The Standard therefore affects both regulated institutions and APRA’s supervisory workload.

The Standard converts governance principles into specific duties for boards, senior managers, designated officers and heads of group entities, and creates procedural rights for APRA.

Duties of the Board

• Set and approve the institution’s risk appetite statement and risk management strategy. Ensure senior management monitors and manages material risks in line with these instruments (para 9(a), (c), 29-30).
• Form a view on risk culture and take steps to address desirable changes (para 9(b)).
• Ensure resources are dedicated to risk management and that measurement limitations are recognised (para 9(f)-(g)).
• Approve the institution’s business plan and ensure the risk management framework is consistent with it (paras 21, 31-33).
• Make an annual risk management declaration to APRA, signed by specified board officers, and properly qualify it when breaches or deviations have occurred (paras 49-50, Attachment A).

Duties of senior management and designated functions

• Maintain a risk management framework that identifies and manages all material risks and includes minimum components listed in paragraph 23 (paras 19, 23).
• Provide an MIS that delivers regular, accurate and timely information to the Board and supports aggregation, limit breach reporting and stress testing (para 25).
• Maintain forward‑looking scenario analysis and stress testing programmes commensurate with the institution’s profile (para 24).
• Maintain policies and procedures covering the full life cycle of risk identification, modelling, mitigation, monitoring, escalation and review (para 35).

Duties specific to the risk management function and CRO

• Maintain a designated risk management function appropriate to size and complexity, that is operationally independent, resourced, and with access to all parts of the institution that generate material risk (paras 37(a)-(f)).
• Appoint a CRO who must be independent of business lines and revenue responsibilities, must not be the CEO, CFO, Appointed Actuary or Head of Internal Audit, must report to the CEO and have unfettered access to the Board and Board Risk Committee (paras 38-40).
• Notify the Board of any significant breach of, or material deviation from, the risk management framework (para 37(g)).

Duties of compliance function

• Maintain a designated compliance function with sufficient authority and independence to manage compliance risk (para 43).

Duties on review and assurance

• Ensure at least annual review by internal or external audit of compliance and the effectiveness of the risk management framework, and a comprehensive independent review at least every three years, with specified reporting lines to Board committees (paras 44-47).

Duties of Heads of groups

• Coordinate group wide risk identification, measurement and reporting; ensure the board has a comprehensive group‑wide view of all material risks; maintain a group liquidity management policy and submit that policy to APRA within 10 business days of Board approval (paras 14, 17).
• Notify APRA of the group risk management framework and material changes as required (para 16, 17).

Notification and certification duties

• Submit risk appetite statements, business plans and RMS on adoption and after material revision to APRA within 10 business days of Board approval (para 52).
• Notify APRA within 10 business days of becoming aware of significant breaches or material deviations, inadequate frameworks, material or prospective material changes to size, business mix or complexity, and material changes to the right to operate in other jurisdictions (paras 53-55).
• Provide the annual risk management declaration in accordance with timing rules tied to annual balance dates (para 51).

APRA’s procedural rights and discretions

• APRA may exercise its powers and discretions only in writing (para 7).
• APRA may require institution‑level compliance where group arrangements are inadequate and specify a reasonable timeframe for compliance (para 13).
• APRA may approve alternative arrangements for CRO independence and reporting if satisfied that they achieve the Standard’s objectives (para 41).
• APRA may adjust or exclude specific requirements for an institution (para 56).
• Determinations made under prior prudential standards continue to have effect (para 57).

Rights of institutions are limited and largely procedural. Institutions may propose alternative arrangements for CRO reporting and may use group risk frameworks where justified, but APRA retains the right to require institution‑specific compliance and to vary requirements. Institutions may engage external providers for risk functions only with demonstrable equivalence to the Standard’s requirements (para 42).

The Prudential Standard itself prescribes reporting, governance and procedural obligations rather than criminal sanctions or fixed monetary penalties. Enforcement mechanisms in the text are supervisory and prescriptive, relying on APRA’s regulatory discretion and ongoing supervisory tools.

Supervisory enforcement levers and mechanics

• APRA may require an APRA‑regulated institution to meet a requirement on a separate basis if it considers group compliance does not adequately address the requirement, and APRA will specify a reasonable timeframe for that institution to comply (para 13). This creates a mechanism for supervisor‑imposed remediation tailored to a firm.
• APRA may adjust or exclude specific requirements in relation to an APRA‑regulated institution (para 56). That power operates as a formal means to tailor or relax the Standard in writing.
• APRA continues to give effect to determinations made under previous versions of risk management standards, meaning existing concessions or bespoke arrangements remain effective until otherwise amended (para 57).

Prescriptive reporting, notification and certification that enable regulatory supervision

• The annual risk management declaration requirement and the Board sign‑offs in Attachment A create documented attestations that APRA can use in supervisory assessments and to trigger further action where declarations are qualified (paras 49-50, Attachment A).
• The tight notification timelines, commonly within 10 business days for adoption or material revision of risk appetite/RMS/business plan as well as for significant breaches, material deviations, and material or prospective material changes to size, business mix or jurisdictional rights, provide mandatory early warning to APRA and enable prompt supervisory interventions (paras 17, 52-55).

What the Standard does not do (and thus how enforcement must be read)

• The Standard does not itself create criminal offences or civil penalty amounts; it does not specify fines, licensing revocation conditions, or statutory sanctions inside the text provided. Enforcement therefore depends on the regulatory regime and statutory powers conferred on APRA by the underlying Acts cited in the Authority section (Banking Act 1959, Insurance Act 1973, Life Insurance Act 1995, PHIPS Act 2015) which set out APRA’s enforcement toolbox in law (para 1). The Standard prescribes written exercises of APRA discretion (para 7) and requires compliance but leaves the specification of statutory sanctions to the enabling legislation.

Practical enforcement risks for institutions

• Failure to comply with reporting, notification and declaration duties will enable APRA to employ supervisory remedies, require remediation on a timetable, or exercise discretion under para 56 to impose alternative requirements. Because APRA’s intervention can be institution‑specific and is to be exercised in writing, institutions face implementation risk and regulatory uncertainty if APRA decides bespoke remedial measures are needed (paras 7, 13, 56).

In sum, enforcement under the Standard is supervisory and administrative in nature. The Standard structures APRA’s ability to detect, require remediation and to tailor obligations by way of notification, attestations and the exercise of discretions. The text provided does not supply a standalone penalty scheme.

This Prudential Standard is an instrument made under multiple Acts and interacts directly with other prudential standards and statutory regimes.

Enabling statutes and statutory context

• The Standard is made under section 11AF of the Banking Act 1959, section 32 of the Insurance Act 1973, section 230A of the Life Insurance Act 1995 and section 92 of the Private Health Insurance (Prudential Supervision) Act 2015 (para 1). Those Acts provide the statutory authority for APRA to issue prudential standards and underlie APRA’s supervisory and enforcement powers referenced implicitly by the Standard.

Cross‑references to other prudential standards and regulatory definitions

• Terms defined in other APRA prudential standards (Prudential Standard 3PS 001 Definitions, APS 001, GPS 001, LPS 001, HPS 001) are incorporated by reference and appear in bold on first use (para 6). This links interpretation and concept definitions across APRA’s corpus of prudential rules and means institutions must consult those definition instruments for precise meanings of key terms such as Level 2, Level 3, Head of a group and other regulatory constructs.
• The Standard explicitly preserves determinations and exercises of discretion made under predecessor standards CPS 220, GPS 220, GPS 221 and LPS 220 (para 57), creating continuity with prior regulatory relief or bespoke arrangements.

Interaction with prudential capital and insurance‑specific standards

• The Standard requires an Internal Capital Adequacy Assessment Process (ICAAP) as a component of the risk management framework (para 23(f)). ICAAP is a capital planning and assessment construct that interacts with capital adequacy prudential requirements; institutions will need to align ICAAP outputs with capital rules in APS/GPS/LPS instruments.
• For general insurers, Attachment A requires the Board to confirm that the institution’s Reinsurance Management Strategy complies with Prudential Standard GPS 230 Reinsurance Management (Attachment A 1(e)). The Standard thus requires coordination across prudential instruments governing reinsurance, capital, and insurance risk.

Corporations Act and disclosure interactions

• Timing for submission of the risk management declaration differs based on corporate reporting status under the Corporations Act 2001. For example, ADIs or authorised banking NOHCs that are not disclosing entities have four months from annual balance date to submit the declaration; other institutions have three months (para 51). This creates an interaction between APRA reporting obligations and Corporations Act disclosure regimes.

Group and cross‑border conduct

• The Standard contemplates group arrangements and imposes obligations on Heads of groups, including to ensure non‑APRA regulated subsidiaries whose activity poses material risk are captured by the group framework (paras 4, 12, 14, 18). That requirement intersects with corporate law on duties owed by holding companies, intra‑group contractual arrangements, and capital and funding agreements that affect transferability of funds within groups.
• For institutions operating outside Australia, the Standard requires notification where the institution’s right to conduct business in another jurisdiction has been materially affected by foreign law, or ceased, within 10 business days (para 55). This interacts with foreign licensing regimes and may trigger APRA supervisory action concerning the institution’s overseas operations.

Operational and contractual interfaces

• Requirements for an MIS capable of aggregation and stress testing (para 25), for forward‑looking scenario analysis (para 24) and for policies on validating models (para 35(b)) interact with an institution’s contractual arrangements with technology vendors and model providers. Outsourcing of parts of the risk function is permitted only if the institution can demonstrate to APRA that the requirements are met (para 42), which intersects with outsourcing prudential guidance and any contractual requirement for APRA access to vendor arrangements.

Regulatory discretion and bespoke relief

• APRA’s ability to adjust or exclude requirements (para 56) and to approve alternative CRO arrangements (para 41) means the Standard is designed to operate alongside institution‑specific determinations and previous bespoke arrangements preserved under para 57. Institutions must therefore track both the Standard and any APRA determinations applicable to them.

In practice, compliance will require institutions to map the Standard against their existing prudential obligations under other APRA standards, capital and liquidity rules, Corporations Act reporting timelines and any relevant foreign regulatory obligations.

The instrument as supplied records limited historical points and preserves continuity with predecessor prudential standards, but it does not contain a multi‑stage amendment log in the text provided.

Commencement and continuity

• The Standard commences on 1 July 2019 (para 5). That is the only explicit date of effect included in the text supplied.

Preservation of earlier determinations

• Paragraph 57 provides that exercises of APRA’s discretion under previous versions of risk management prudential standards continue to have effect. The paragraph identifies prior standards: CPS 220 Risk Management, GPS 220 Risk Management, GPS 221 Risk Management: Level 2 Insurance Groups, and LPS 220 Risk Management (para 57). This both recognises a regulatory transition and confirms that earlier bespoke determinations are carried forward, unless amended pursuant to the new Standard or other powers.

Cross‑references to definition instruments

• Paragraph 6(a) ties the Standard’s interpretation to a set of definition prudential standards (Prudential Standard 3PS 001 Definitions, APS 001, GPS 001, LPS 001, HPS 001), effectively making future amendments to those definition standards consequential for the meaning of terms used throughout this Standard. That is an indirect amendment channel whereby changes outside this document will affect its application.

APRA discretion as an amendment channel

• The Standard explicitly permits APRA to adjust or exclude specific requirements for an APRA‑regulated institution (para 56). While not an amendment to the Standard itself, this discretion functions as an instrument for tailoring or relaxing the Standard in specific instances without formal amendment to the text. APRA’s discretion must be exercised in writing (para 7), which creates an administrative record of such modifications.

Alternative arrangements process

• Paragraph 41 allows institutions to propose alternative arrangements to the CRO independence and reporting requirements where the stated requirements are inappropriate for particular circumstances, and authorises APRA to approve alternatives if APRA is satisfied they achieve the Standard’s objectives. Again, this is an institutional amendment mechanism short of formal amending the Standard.

What the text does not provide

• The supplied Standard does not include a cumulative amendment history, versions, or dates for any prior revisions. It does not list later amending instruments or transitional provisions beyond preserving earlier determinations. Practitioners seeking a complete amendment trail must therefore consult APRA’s legislative instruments registry and prior prudential standards CPS 220, GPS 220, GPS 221 and LPS 220 to trace prior wording, determinations and changes leading to this Standard.

Practical implication

• The Standard creates a durable baseline as at 1 July 2019 and leaves scope for APRA to make institution‑specific determinations and for other prudential standards to alter definitional and cross‑referenced provisions. Institutions should maintain a change register that maps APRA determinations, any approved alternative arrangements, and updates to referenced definition standards to ensure they capture the effective operational requirements as they evolve.

The text of the Prudential Standard does not reference any judicial or tribunal decisions, and it does not cite precedent or case law. Paragraph 57 expressly acknowledges prior administrative determinations under predecessor prudential standards, but there is no mention in the instrument of litigation or legal challenges to the Standard or to related APRA determinative acts.

What this means for counsel and compliance teams

• Because the Standard is a regulatory instrument without embedded case references, litigated interpretations will be found, if at all, in challenges to APRA decisions made under the enabling statutes (Banking Act, Insurance Act, Life Insurance Act, PHIPS Act) rather than in the Standard text. The Standard’s prescriptive duties , Board attestations, notification timelines, CRO independence provisions and APRA’s discretion to require institution‑specific arrangements , are the kinds of regulatory actions that could give rise to administrative review or judicial review proceedings if APRA exercises its powers in a contested way. The instrument itself, however, contains no litigation record.

Action points for practitioners

• Where legal advice is required on the application of the Standard, review of APRA’s determinations and any prior bespoke arrangements under earlier standards (paras 56-57) will be necessary. Equally, any contentious enforcement or bespoke decision made by APRA in writing (para 7) should be considered in the context of the enabling statutes cited in the Authority section (para 1).
• Maintain awareness that absence of litigation references in the instrument does not mean the Standard is untested; practitioners should check court and tribunal databases, administrative law decisions, and APRA’s published decisions for any cases involving comparable duties under the predecessor standards CPS 220, GPS 220, GPS 221 or LPS 220.

In sum, the Standard itself contains no litigation history; any judicial or administrative challenges will be external to its text and must be sought via case law and APRA decision records.

The Standard contains several provisions that commonly create implementation risk, uncertainty or operational strain. These are concrete compliance pitfalls and areas where institutions often encounter coordination, resourcing or interpretation frictions.

Tight timelines for notifications and submissions

• Institutions must submit a copy of the risk appetite statement, business plan and RMS on adoption and after material revisions within 10 business days of Board approval (para 52). Heads of groups must submit a group liquidity management policy to APRA within 10 business days of Board approval (para 17). Institutions must also notify APRA of significant breaches, material deviations, material changes in size, business mix and complexity, and adverse changes to rights to operate in foreign jurisdictions within 10 business days (paras 53-55). These short, fixed windows require pre‑planned processes for rapid internal sign‑off and timely regulatory submission.

Board accountability and attestation risk

• The Board and the chair of the Board Risk Committee must sign the annual risk management declaration, which requires the Board to state that systems and resources are appropriate and operating effectively (paras 49, Attachment A 1(a)-(c)). Where there has been a “significant breach” or “material deviation,” the Board must qualify the declaration and describe causal factors and remedial steps (para 50). Boards therefore carry legal and reputational risk when attesting; ambiguity over what constitutes a “significant” breach can create disputes about whether a qualification is required.

Group frameworks do not displace institution‑level obligations

• While group risk management frameworks may be used, APRA may require an institution within the group to meet a requirement separately if group compliance is insufficient (para 13). Paragraph 12 requires institutions to explicitly identify whether their framework is derived from group arrangements and to document linkages, differences and monitoring/reporting procedures. Institutions that over‑rely on centralised group processes without clear institution‑level accountability risk targeted APRA remediation.

CRO independence and resourcing constraints

• The CRO must be independent from business lines and revenue responsibilities, and must not be CEO, CFO, Appointed Actuary or Head of Internal Audit; they must also have direct reporting lines to the CEO and unfettered board access (paras 38-40). These restrictions can create recruitment and organisational challenges for smaller institutions. While the Standard allows proposals for alternative arrangements, APRA approval is required and must demonstrate that the alternatives achieve the Standard’s objectives (para 41). Institutions without clear succession and recruitment plans may find it difficult to satisfy APRA.

Outsourcing and third‑party risk

• Outsourcing parts of the risk management function is permitted only where the institution can demonstrate to APRA that the function, whether performed by an external provider or elsewhere in the group, meets the Standard’s requirements (paras 15, 42). Contractual arrangements with vendors must permit APRA’s supervisory needs, and vendor model validation and data access issues will require careful drafting and operational controls. Outsourcing does not remove the institution’s accountability.

Model validation and MIS expectations

• Policies must cover model validation, approval and use (para 35(b)), and the MIS must support aggregation, limit breaches and forward stress testing (para 25). Many firms underestimate the data quality and architecture investments needed to meet these standards; inadequate systems can result in failure to meet the MIS requirement and prompt APRA intervention.

Review cycles and trigger events

• The Standard requires annual audit reviews of compliance and effectiveness (para 44) and comprehensive independent reviews at least every three years that must be operationally independent (para 45). Additionally, where material changes occur outside scheduled reviews, the institution must assess whether amendments are necessary (para 48). Institutions must therefore maintain change detection and review governance so that ad hoc developments prompt timely reassessment.

Ambiguity in key terms

• The Standard uses terms such as “material risk,” “significant breach,” and “appropriate” or “adequate” resources without quantifying thresholds (paras 20, 37, Attachment A). This requires institutions to translate these qualitative standards into firm‑specific metrics that APRA will accept. Disagreement with APRA on those thresholds can lead to institution‑specific remediation under para 13.

Interplay with other prudential instruments and prior determinations

• Paragraph 57 preserves determinations under previous prudential standards. Institutions with legacy determinations must track which aspects of their arrangements derive from prior APRA permissions and ensure continued compliance with both the preserved determinations and the new Standard. Failure to reconcile legacy permissions with current obligations can lead to gaps.

Signatures and different signatory regimes

• The signatories required on the risk management declaration differ for Category C insurers, foreign ADIs and EFLICs (paras 49-50). Institutions operating in multiple regimes must follow the correct signatory protocol to avoid procedural invalidity.

In short, the operational, resourcing and governance changes required by the Standard are precise and prescriptive. Institutions should prioritise process mapping for notification timelines, formalise Board attestation workflows, ensure independence and resourcing for the CRO and compliance functions, invest in MIS and data quality, and maintain careful records of any APRA determinations or approved alternative arrangements.

Compliance with the Standard requires a programmatic approach that aligns governance, systems, personnel and documentation to the specified timelines and minimum components. The following is an operational checklist mapped to the Standard’s paragraphs.

1. Board governance and attestation

• Ensure the Board formally approves and periodically reviews the risk appetite statement and RMS. Document minutes showing the Board’s view of risk culture and any steps taken to address cultural deficiencies (para 9).
• Prepare the annual risk management declaration per Attachment A and secure required signatures from the chair and chair of the Board Risk Committee, or alternative signatories for Category C insurers, foreign ADIs and EFLICs (paras 49-51, Attachment A). Establish a process to qualify the declaration if there are significant breaches or material deviations, including drafting templates that describe causes and remediation steps (para 50).

2. Risk management framework documentation

• Produce and maintain a single, Board‑approved risk management framework document that integrates the risk appetite statement, RMS, business plan, policies and procedures, ICAAP, MIS description, and a review schedule (paras 21-23). Ensure the framework explicitly addresses each material risk listed in para 26.

3. Business plan alignment

• Maintain a rolling three‑year business plan, reviewed at least annually and approved by the Board. The plan must integrate risk considerations and show how strategic objectives affect the institution’s risk profile (paras 31-33).

4. Policies, procedures and model governance

• Develop and maintain policies covering identification and assessment of material risks, model validation and approval, mitigation strategies, escalation and reporting procedures, conflicts of interest, compliance monitoring, contingency arrangements and periodic reviews (para 35). Track last revision date, next review date and responsible parties (para 36).

5. Designated functions and CRO

• Establish a designated risk management function that is operationally independent, properly resourced and with access across the institution (para 37). Appoint a CRO who meets independence rules and reporting requirements; if an institution considers alternatives to paragraphs 39-40, prepare a written proposal to APRA with justifications and supporting evidence (paras 38-41). Ensure the CRO has authority to notify the Board of significant breaches (para 37(g)).

6. Compliance function

• Maintain a compliance function, separate from commercial business lines, staffed by competent personnel with an independent reporting line (para 43).

7. MIS and data architecture

• Invest in data frameworks and an MIS that aggregate exposures across business lines, support limit monitoring and escalation, enable forward stress testing and provide accurate and timely reporting to Board and management (paras 24-25). Implement data quality controls to ensure timely and accurate measurement of material risks.

8. Stress testing and ICAAP

• Implement forward‑looking scenario analysis and stress testing programmes that are severe but plausible and commensurate with size and complexity (para 24). Ensure the ICAAP is integrated with the business plan and capital management processes and is documented as part of the risk management framework (para 23(f)).

9. Reviews and assurance

• Schedule annual internal or external audit reviews of compliance with and effectiveness of the framework and ensure reporting to the Board Audit Committee or equivalent (para 44). Commission a comprehensive operationally independent review at least every three years and report outcomes to the Board Risk Committee or equivalent (paras 45-47). Maintain a trigger mechanism to perform ad hoc reviews after material changes (para 48).

10. Notifications and submissions to APRA

• Create templates and workflows for required submissions: submit risk appetite statement, business plan and RMS within 10 business days of Board approval; submit group liquidity policy within 10 business days for Heads of groups (paras 17, 52). Establish incident reporting workflows to notify APRA within 10 business days of significant breaches, material deviations, material or prospective material changes in size, business mix and complexity, or material foreign law changes affecting the right to operate (paras 53-55).

11. Group arrangements and documentation

• If using a group framework, document explicitly whether the institution’s framework is derived wholly or partially from group frameworks, identify linkages and differences, assess how these affect the institution’s risk profile, and set out monitoring and reporting processes to the group (para 12). Heads of groups must maintain processes to coordinate group risk management and ensure the Board has a comprehensive group‑wide view (paras 14-17). Where a non‑APRA regulated group entity poses material risk, ensure the group framework covers that risk and records the arrangements (para 18).

12. Outsourcing and external providers

• If outsourcing part of the risk management function, document how the outsourced arrangement meets the requirements in para 37 and be prepared to demonstrate that to APRA; ensure contracts permit APRA access, data sharing and model validation as required (para 42).

13. Track prior determinations and APRA approvals

• Maintain a register of any determinations made under previous standards that continue to apply under para 57, and of any APRA approvals for alternative arrangements or adjustments under paras 41 and 56. Ensure that any APRA communications are in writing as required by para 7.

14. Internal training and risk culture

• Institute training and awareness programmes to ensure that all personnel understand the risk management framework as it relates to their roles and to instil the risk culture the Board expects; document evidence of training and role‑specific responsibilities as required in the RMS (para 30(e)).

15. Practical resourcing and budgeting

• Budget for systems, data and personnel required to meet MIS, stress‑testing and ICAAP requirements. Anticipate costs for external reviews required every three years and for model validation functions (paras 24, 25, 45).

Compliance is operational as much as legal. Institutions should prioritise clear documentation, auditable workflows for the 10 business day submission windows, a robust MIS and data controls, an empowered and independent CRO, scheduled internal and external reviews, and a Board attestation process that can produce timely, supported declarations to APRA consistent with Attachment A.