Policies and procedures

35. The policies and procedures required under subparagraph 30(b) must include:

(a) the process for identifying and assessing material risks and controls;

(b) the process for the validation, approval and use of any models to measure components of risk;

(c) the process for establishing, implementing and testing mitigation strategies and control mechanisms for material risks;

(d) the process for monitoring, communicating and reporting risk issues, including escalation procedures for the reporting of material events and incidents;

(e) the process for identifying, monitoring and managing potential and actual conflicts of interest;

(f) the mechanisms in place for monitoring and ensuring ongoing compliance with all prudential requirements[7];

(g) the process for ensuring consistency across the risk management framework, including the components identified under paragraph 23;

(h) the process for establishing and maintaining appropriate contingency arrangements (including robust and credible recovery plans where warranted) for the operation of the risk management framework in stressed conditions; and

(i) the process for review of the risk management framework.

36. An APRA-regulated institution must monitor the date when each policy or procedure was last revised, the date that it is next due for review, and who is responsible for the review.