Risk management frameworkRisk management framework

Risk management framework

6. An insurer must at all times have a risk management framework to manage the risks arising from its business.

7. The insurer’s risk management framework must provide a reasonable assurance that the insurer’s risks are being prudently and soundly managed, having regard to such factors as the size, business mix and complexity of the insurer's operations.

8. For the purposes of this Prudential Standard:

(a) the risk management framework is the totality of systems, structures, processes and people within the insurer that identify, assess, mitigate and monitor all internal and external sources of risk that could have a material impact on an insurer’s operations; and

(b) a reference to the insurer’s operations is a reference to its operations in Australia and overseas through a branch.

9. An insurer’s risk management framework must, at a minimum, include:

(a) a written Risk Management Strategy (RMS) that complies with this Prudential Standard, is approved by the Board[2] and in regard to which the Board is satisfied that:

(i) it describes the key elements of the risk management framework (including the risk appetite, policies, procedures, management responsibilities and controls referred to in subparagraphs (b) and (c) and the other matters that this Prudential Standard requires to be included in an RMS);

(ii) the risk management framework described in the RMS is appropriate and provides reasonable assurance that the insurer's risks are being prudently and soundly managed having regard to such factors as the size, business mix and complexity of the insurer's operations; and

(iii) it describes the review referred to in paragraph 11;

(b) risk management policies and procedures to identify, assess, monitor, report on and mitigate all material risks, financial and non-financial, likely to be faced by the insurer having regard to such factors as the size, business mix and complexity of the insurer’s operations, and a review process to ensure that the risk management framework remains effective; and

(c) clearly defined managerial responsibilities and controls.

10. The material risks referred to in subparagraph 9(b) above must, at a minimum, include:

(a) balance sheet and market risk;

(b) credit risk;

(c) operational risk (requirements for outsourcing and business continuity management are contained in Prudential Standard GPS 221 Outsourcing and Prudential Standard GPS 222 Business Continuity Management);

(d) insurance risk;