Review of the risk management framework

44. An APRA-regulated institution must ensure that compliance with, and the effectiveness of, the risk management framework of the institution is subject to review by internal and/or external audit at least annually. The results of this review must be reported to the institution’s Board Audit Committee, the senior officer outside of Australia or Compliance Committee, as relevant.

45. An APRA-regulated institution must, in addition to paragraph 44, ensure that the appropriateness, effectiveness and adequacy of the institution’s risk management framework are subject to a comprehensive review by operationally independent, appropriately trained and competent persons (this may include external consultants) at least every three years.[9] The results of this review must be reported to the institution’s Board Risk Committee, the senior officer outside Australia or Compliance Committee, as relevant.

46. The scope of the comprehensive review must have regard to the size, business mix and complexity of the institution, the extent of any change to its operations or risk appetite, and any changes to the external environment in which the institution operates.

47. The comprehensive review of the risk management framework must, at a minimum, assess whether:

(a) the framework is implemented and effective;

(b) it remains appropriate, taking into account the current business plan;

(c) it remains consistent with the Board’s risk appetite;

(d) it is supported by adequate resources; and

(e) the RMS accurately documents the key elements of the risk management framework that give effect to the strategy for managing risk.

48. Where a material change to the size, business mix and complexity of the operations is identified outside the review required in paragraph 45, the APRA-regulated institution must assess whether any amendment to, or a review of, the risk management framework is necessary to take account of these developments at that time.