Risk management function

37. An APRA-regulated institution must have a designated risk management function for the institution that, at a minimum:

(a) is responsible for assisting the Board of the APRA-regulated institution, board committees of the APRA-regulated institution and senior management of the institution to maintain the risk management framework;

(b) is appropriate to the size, business mix and complexity of the institution;

(c) is operationally independent;

(d) has the necessary authority and reporting lines to the Board of the APRA-regulated institution, board committees of the APRA-regulated institution and senior management of the institution to conduct its risk management activities in an effective and independent manner;

(e) is resourced with staff who have clearly defined roles and responsibilities and who possess appropriate experience and qualifications to exercise those responsibilities;

(f) has access to all aspects of the institution that have the potential to generate material risk, including information technology systems and systems development resources; and

(g) is required to notify the Board of any significant breach of, or material deviation from, the risk management framework.

38. An APRA-regulated institution must designate a person to be responsible for that function, referred to in this standard as a CRO. The CRO must be involved in, and have the authority to provide effective challenge to, activities and decisions that may materially affect the institution’s risk profile.

39. The CRO must be independent from business lines, other revenue-generating responsibilities and the finance function. The CRO must not be the Chief Executive Officer (CEO), Chief Financial Officer, Appointed Actuary or Head of Internal Audit.

40. The CRO must have a direct reporting line to the CEO, and have regular and unfettered access to the Board and the Board Risk Committee.

41. Where an APRA-regulated institution believes that the requirements in paragraphs 39 and 40 are inappropriate for its particular circumstances, it may propose alternative arrangements to APRA. Proposals for alternative arrangements must outline the circumstances that are particular to that institution and include details of, and supporting reasons for, these arrangements. APRA may approve alternative arrangements for the institution if satisfied that those arrangements, in APRA’s view, achieve the objectives of this Prudential Standard.

42. An APRA-regulated institution may engage the services of an external service provider to perform part of the risk management function where the APRA-regulated institution can demonstrate to APRA that the risk management function meets the requirements in paragraph 37.[8]