Use of group risk management by an APRA-regulated institution

10. An APRA-regulated institution that is part of a group or other corporate group may meet requirements of this Prudential Standard using group risk management frameworks, policies, procedures or functions, provided that the Board of the institution is satisfied that the requirements are met in respect of that institution.

11. For the avoidance of doubt, compliance by a group with the requirements of this Prudential Standard does not relieve an APRA-regulated institution within the group from the need to comply with any prudential requirements of that institution.

12. Where an APRA-regulated institution is part of a group and any element of the risk management framework is controlled or influenced by another entity in the group, the institution’s risk management framework must specifically take into account risks arising from the group framework, and clearly identify:

(a) whether the APRA-regulated institution’s risk management framework is derived wholly or partially from group risk management frameworks, policies, procedures or functions;

(b) the linkages and significant differences between the institution’s and the group’s risk management framework;

(c) how these linkages and significant differences change the risk profile of the institution; and

(d) the process for monitoring by, or reporting to, the group on risk management including the key procedures, the frequency of reporting and the approach to reviews of the risk management framework.

13. Where APRA is of the view that the fulfilment of a requirement of this Prudential Standard by a group does not adequately address the requirement for an APRA-regulated institution within that group, APRA may require that institution to meet the requirement on a separate basis within a reasonable timeframe specified by APRA.