Get a plain-English read of Risk management framework
Turn the raw legal text into a practical explanation grounded in Insurance (prudential standard) determination No. 10 of 2012 - Prudential Standard GPS 220 - Risk Management.
A regulated institution must at all times have a risk management framework to manage the risks arising from its business.
The regulated institution’s risk management framework must provide a reasonable assurance that the regulated institution’s risks are being prudently and soundly managed, having regard to such factors as the size, business mix and complexity of the regulated institution's operations.
A regulated institution’s ‘risk management framework’ must, at a minimum, include:
(a) a written ‘Risk Management Strategy’ (RMS) that complies with this Prudential Standard, is approved by the Board and in regard to which the Board is satisfied that:
(i) it describes the key elements of the risk management framework (including the risk appetite, policies, procedures, management responsibilities and controls referred to in paragraphs 12(b) and (c), and the other matters that this Prudential Standard requires to be included in an RMS);
(ii) the risk management framework described in the RMS is appropriate and provides reasonable assurance that the regulated institution's risks are being prudently and soundly managed having regard to such factors as the size, business mix and complexity of the regulated institution's operations; and
(iii) it describes the review referred to in paragraph 14;
(b) risk management policies and procedures to identify, assess, monitor, report on and mitigate all material risks, financial and non-financial, likely to be faced by the regulated institution having regard to such factors as the size, business mix and complexity of the regulated institution’s operations, and a review process to ensure that the risk management framework remains effective; and
(c) clearly defined managerial responsibilities and controls.
The material risks referred to in paragraph 12(b) above must, at a minimum, include:
(a) asset risk, including asset and liability mismatch and credit risk;
(b) asset concentration risk;
(c) operational risk (requirements for outsourcing and business continuity management are contained in Prudential Standard CPS 231 Outsourcing and Prudential Standard CPS 232 Business Continuity Management);
(d) insurance risk;
(e) insurance concentration risk, including concentrations due to portfolio composition, geographical exposures and reinsurance arrangements; and
(f) strategic and tactical risks that arise out of the regulated institution’s Business Plan.
The regulated institution must ensure that its risk management framework is subject to effective and comprehensive review by operationally independent, appropriately trained and competent staff (including external consultants), and that the frequency and scope of this review is appropriate having regard to such factors as the size, business mix, complexity of the regulated institution's operations and the extent of any change to its business profile or its risk appetite. The review must include:
(a) a review of the risk management function (or role);
For the purposes of paragraph 14, a person is deemed not to be operationally independent if the person has played, or is playing, a significant role in the development or implementation of the risk management framework.
Risk management function
A regulated institution must have a ‘risk management function’ (or role) within the regulated institution that:
(a) is appropriate to the nature, scale and diversity of its operations;
(b) is sufficiently resourced; and
(c) has the necessary authority to conduct its activities in an effective and independent manner.
The risk management function (or role) is responsible for assisting the Board, any Board committee and senior management in developing and maintaining the risk management framework.
Business Plan
A regulated institution must at all times maintain a ‘Business Plan’ approved by the Board:
a) prior to its adoption; and
b) at any time it is revised during its operational cycle.
Paragraph 18 does not apply to a run-off insurer provided that the run-off insurer maintains at all times a ‘run-off plan’[2] (including a description of the run-off insurer’s approach to capital management) according to this Prudential Standard.
The regulated institution’s Business Plan must be a three-year rolling plan and be reviewed at least annually.
A regulated institution must submit to APRA:
(a) a Business Plan after each annual review; and
(b) any revised Business Plan within 10 business days of Board approval.
Run-off plan
Subject to paragraphs 52 and 53 of Prudential Standard GPS 320 Actuarial and Related Matters (GPS 320), a run-off insurer must at all times maintain a ‘run-off plan’ (including a description of the run-off insurer’s approach to capital management), unless otherwise agreed to by APRA.
The run-off plan must be approved by the Board:
(a) prior to its adoption; and
(b) at any time it is amended during its operational cycle.
The run-off insurer’s run-off plan must be a three-year rolling plan and the run-off insurer must review it at least annually (or as close to annually as is practicable). Under GPS 320, the Appointed Actuary of the run-off insurer must also review the run-off plan according to the requirements of GPS 320.
The run-off insurer must submit to APRA:
(a) a run-off plan after each annual review; and
(b) any amended run-off plan within 10 business days of Board approval.
APRA may, in writing, specify that a run-off plan be:
(a) a rolling plan of more or less than three years; and
(b) reviewed less frequently than as required in paragraph 24
if, having regard to the particular circumstances of the run-off insurer, APRA considers it unnecessary for the purposes of the prudential supervision of the run-off insurer.
A run-off insurer that is both a Category C insurer and a run-off insurer must prepare a run-off plan in respect of the Australian branch operation but with consideration given to the ability of the insurer to transfer assets into Australia in order to ensure that the requirements in Prudential Standard GPS 110 Capital Adequacy (GPS 110) are met.
A run-off plan must include the matters listed in Attachment A.
Risk Management Strategy
The RMS is a high level, strategic document intended to describe the key elements of a regulated institution’s risk management framework set out in paragraph 12(a)(i).
The regulated institution must review its RMS at least annually to ensure that it accurately documents the regulated institution’s risk management framework.
Where there are material changes to the operations of a regulated institution, it must review and amend its risk management framework and, if appropriate, it’s RMS to take account of the changes. Such RMS must be approved by the Board and submitted to APRA within 10 business days of Board approval.
A regulated institution must not intentionally deviate in a material way from its RMS except where this deviation has been approved by the Board and notified to APRA prior to the deviation occurring.
Where there are institutional, operational or other developments relating to the regulated institution’s operations that materially affect the risk profile of the regulated institution, the regulated institution must notify APRA as soon as practicable after the event has happened and amend its risk management framework and, if appropriate, the RMS to take account of the change.
A regulated institution’s RMS must, at a minimum:
(a) outline the risk governance relationship between the Board, Board committees and senior management;
(b) describe the processes for identifying and assessing risks;
(c) describe the process for establishing mitigation and control mechanisms for individual risks;
(d) describe the process for monitoring and reporting risk issues (including communication and escalation mechanisms);
(e) describe the approach to ensuring relevant staff have an awareness of risk issues and instilling an appropriate risk culture, including the level of accessibility of the RMS;
(f) identify those persons and their positions in the regulated institution, or groups of persons with managerial responsibility for the risk management framework, and set out their roles and responsibilities;
(g) describe the process by which the risk management framework (including the RMS) is reviewed, and outline the broad coverage for these reviews;
(h) provide an overview of the mechanisms in place for monitoring and ensuring continual compliance with the Prudential Capital Requirement (PCR);
(i) provide an overview of the processes and controls in place for ensuring compliance with all prudential requirements;
(j) if the regulated institution is part of an Australian or global corporate group, or is a Category C insurer:
(i) include a summary of the group policy objectives and strategies;
(ii) state whether the local RMS is derived wholly or partially from the group risk management arrangements;
(iii) summarise the linkages and significant differences between the local RMS and group risk management arrangements, including relevant local business and other conditions;
(iv) outline the process for monitoring by, or reporting to, the parent entity or head office. A summary of the key procedures, the frequency of reporting and the approach to reviews must be provided;
(v) where any element of a regulated institution’s risk management framework is controlled by another entity in the group, or by head office, describe how this arrangement works; and
(vi) where a regulated institution:
(A) is part of a global insurance group where the head office or ultimate holding company is outside of Australia; or
(B) is a Category C insurer,
include a summary of the home regulator’s supervisory arrangements regarding risk management; and
(k) cover both the Australian operations and the risks arising from the overseas operations of the regulated institution that could impact on the Australian operations of the regulated institution.