The role of the Board

9. The Board[3] of an APRA-regulated institution is ultimately responsible for the institution’s risk management framework and is responsible for the oversight of its operation by management. In particular, the Board must ensure that:

(a) it sets the risk appetite within which it expects management to operate and approves the institution’s risk appetite statement and risk management strategy (RMS);

(b) it forms a view of the risk culture in the institution, and the extent to which that culture supports the ability of the institution to operate consistently within its risk appetite, identify any desirable changes to the risk culture and ensures the institution takes steps to address those changes;

(c) senior management of the institution monitor and manage all material risks consistent with the strategic objectives, risk appetite statement and policies approved by the Board;

(d) the operational structure of the institution facilitates effective risk management;

(e) policies and processes are developed for risk-taking that are consistent with the RMS and the established risk appetite;

(f) sufficient resources are dedicated to risk management; and

(g) it recognises uncertainties, limitations and assumptions attached to the measurement of each material risk.