© 2026 Zoe. All rights reserved.
Zoe is a legal information platform. Always consult the Federal Register of Legislation for authoritative text.
Commonwealth legislation
This Act has been repealed and is no longer in force. It is retained for historical reference.
This Prudential Standard requires every life company (including friendly societies and eligible foreign life insurers) to have and maintain a documented risk management framework and high‑level Risk Management Strategy (RMS), approved by the Board or compliance committee, aligned with its internal capital adequacy process, and subject to independent review. It also requires an annual Risk Management Declaration to APRA. The rule changes how life insurers organise, document and report risk oversight, imposing ongoing governance and documentation obligations on boards and senior managers.
Want the full deep dive?
Zoe can write the in-depth analysis on top of the summary above: how it works, who it affects and what each part actually does.
Direct links to the current provisions in Life Insurance (prudential standard) determination No. 9 of 2012 - Prudential Standard LPS 220 - Risk Management.
Interpretation
In this Determination:
APRA means the Australian Prudential Regulation Authority.
friendly society has the meaning given in section 16C of the Act.
life company has the meaning given in the Dictionary to the Act.
Schedule
| Objective and key requirements of this Prudential StandardThis Prudential Standard sets out the requirements for a life company to maintain a risk management framework and strategy that is appropriate to the nature and scale of its operations.The ultimate responsibility to maintain the risk management framework and strategy rests with the Board of directors of the life company or, in the case of an eligible foreign life insurance company, with the Compliance Committee.A life company’s systems, processes, structures, policies and people involved in identifying, assessing, mitigating and monitoring risks are referred to in this Prudential Standard as the risk management framework.The key requirements of this Prudential Standard include that a life company must:maintain a risk management framework which is aligned with the life company’s internal capital adequacy assessment process and includes:(a) a documented Risk Management Strategy;(b) sound risk management policies and procedures;(c) clearly defined managerial responsibilities and controls; and(d) a documented business plan;ensure that its risk management framework is subject to effective and comprehensive review; andsubmit a Risk Management Declaration to APRA on an annual basis. |
|---|
Authority
This Prudential Standard applies to all life companies including friendly societies (together referred to as life companies) registered under the Act.[1]
Nothing in this Prudential Standard prevents a life company from applying a risk management framework, Risk Management Strategy (RMS) or business plan that is also used in a related company, provided that the risk management framework, RMS or business plan has been approved by the life company for its purposes and meets the requirements of this Prudential Standard.
Interpretation
The role of the Board
The Board of directors (the Board) is ultimately responsible for the risk management framework of the life company.[2] The Board must ensure that a life company has, at all times, a risk management framework to prudently manage the risks arising in the life company and the risks to the policy owners of the statutory funds.
The Board is responsible for the risk management framework whether or not risk management and business operations are outsourced or are part of a corporate group.[3]
The Board must approve a written RMS for the life company and must be satisfied that the RMS complies with this Prudential Standard.
The Board must be notified of any material deviation from the life company’s RMS.
For the purposes of this Prudential Standard, the risk management framework is the totality of systems, structures, policies, processes and people within the life company that identify, assess, mitigate and monitor all internal and external sources of risk that could have a material impact on the life company’s operations.
A life company’s risk management framework must, at a minimum, include:
(a) an RMS;
(b) risk management policies, controls and procedures which identify, assess, monitor, report on and mitigate all material risks, financial and non-financial, likely to be faced by the life company having regard to such factors as the size, business mix and complexity of the life company’s operations;
(c) a written business plan , that is approved by the Board prior to its adoption and at any time that it is materially revised. The business plan must be reviewed by the life company at least annually;
(d) clearly defined managerial responsibilities and controls for the risk management framework; and
(e) a review process to ensure that the risk management framework remains effective.
(a) asset risk, including asset and liability mismatch risk;
(b) asset concentration risk;
(c) operational risk[5];
(d) insurance risk, including insurance concentration risks; and
(e) strategic and tactical risks that arise out of the life company’s business plan.
(a) the life company’s strategy for managing risk;
(b) the extent and circumstances under which the life company is prepared to accept risk; and
(c) the key elements of the risk management framework which give effect to the strategy for managing risk.
(a) detail the life company’s approach to the matters listed in paragraph 14;
(b) identify the policies and procedures dealing with the following risk management matters, including the date when each policy or procedure was last revised, the date that it is next due for revision and the position responsible for its maintenance:
(i) the processes for identifying and assessing material risks;
(ii) the process for establishing and implementing mitigation and control mechanisms for material risks;
(iii) the process for the monitoring and reporting of risk issues (including communication and escalation mechanisms);
(iv) the mechanisms in place for monitoring and ensuring continual compliance with all prudential requirements;
(v) the life company’s approach to management of capital;[6] and
(vi) the life company’s approach to business continuity management (refer to Prudential Standard CPS 222 Business Continuity Management) and outsourcing (refer to Prudential Standard CPS 231 Outsourcing);
(c) describe the relationships within the risk management framework between the Board, Board committees and senior management;
(d) identify those positions with managerial responsibility for the risk management framework, and set out their roles and responsibilities;
(e) describe the approach to ensuring relevant staff have an awareness of the risk management framework and instilling an appropriate risk culture across the life company; and
(f) describe the process by which the risk management framework (including the RMS) is reviewed and the intended coverage and timing for these reviews.
(a) the group (or head office) policy objectives and strategies;
(b) whether the life company’s RMS is derived wholly or partially from the group (or head office) risk management arrangements;
(c) the linkages and significant differences between the life company RMS and group (or head office) risk management arrangements including relevant life company business and other conditions; and
(d) the process for monitoring by, or reporting to, the group or head office. A summary of the key procedures, the frequency of reporting and the approach to reviews must be provided.
Under Prudential Standard LPS 110 Capital Adequacy (LPS 110), a life company is required to have an Internal Capital Adequacy Assessment Process (ICAAP). An ICAAP involves an integrated approach to capital and risk management for a life company, aimed at ensuring that the capital held is adequate in the context of the risk profile and risk appetite of that life company. A life company’s ICAAP must be developed having regard to its risk management framework.
A life company is not required to duplicate content between its ICAAP summary statement or ICAAP report required under LPS 110 and its RMS. Cross-references are appropriate to facilitate integration between the two documents.
The life company must ensure that its risk management framework is subject to effective and comprehensive review by operationally independent, appropriately trained and competent persons. The frequency and the scope of the review should be appropriate to the life company, having regard to such factors as the size, business mix and complexity of the life company’s operations and the extent of any change to its business profile or its risk appetite.
The review of the risk management framework must include:
(a) a review of the RMS, to ensure that:
(i) the strategy for the management of risk remains appropriate to the company’s business, its policyholder profile and its financial circumstances; and
(ii) the RMS accurately documents the life company’s risk management framework;
(b) a review of the policies and processes described in subparagraph 11(b); and
(c) a review of the people and functions involved in risk management.
The Appointed Actuary must include an assessment of the suitability and adequacy of the risk management framework as part of the Financial Condition Report required under Prudential Standard LPS 320 Actuarial and Related Matters.
Life companies must implement satisfactory internal audit procedures and/or external audit arrangements to ensure compliance with, and the effectiveness of, the risk management framework.
Where there are institutional, operational or other developments that materially affect the life company’s risk profile, the life company must assess whether any amendments to, or a review of, its risk management framework (including the RMS) are necessary to take account of the change.
In the event that a life company:
(a) is aware of a material breach of, or material deviation from, the risk management framework; or
(b) discovers that the risk management framework did not adequately address a material risk
the life company should notify APRA as soon as practicable.
The Board must provide APRA with a declaration on risk management (Risk Management Declaration), relating to each financial year of the life company, signed by two directors or, in the case of an EFLIC, two members of the compliance committee. This declaration must satisfy the requirements set out in Attachment A to this Prudential Standard.
The Risk Management Declaration must be submitted to APRA on, or before, the day that the life company’s annual regulatory financial statements are required to be submitted to APRA.
If the Board qualifies the Risk Management Declaration, the qualified Risk Management Declaration must include a description of any material deviation from the life company’s risk management obligations, and the steps taken, or proposed to be taken, to remedy those breaches.
Attachment A
The Board must (by the time provided for in paragraph 26 of this Prudential Standard) provide APRA with a Risk Management Declaration stating that, to the best of its knowledge and belief, having made appropriate enquiries:
(a) the life company has systems in place for the purpose of ensuring compliance with the Act, the Life Insurance Regulations 1995, prudential standards, reporting standards, the Financial Sector (Collection of Data) Act 2001, authorisation conditions, directions issued by APRA pursuant to the Act and any other requirements imposed by APRA under law;
(b) the Board is satisfied with the efficacy of the processes and systems surrounding the production of financial information at the life company;
(c) the life company has in place an RMS, developed in accordance with the requirements of this Prudential Standard, setting out its approach to risk management; and
(d) the systems that are in place for managing and monitoring risks, and the risk management framework, are appropriate to the life company, having regard to such factors as the size, business mix and complexity of the life company’s operations.
| Objective and key requirements of this Prudential StandardThis Prudential Standard sets out the requirements for a life company to maintain a risk management framework and strategy that is appropriate to the nature and scale of its operations.The ultimate responsibility to maintain the risk management framework and strategy rests with the Board of directors of the life company or, in the case of an eligible foreign life insurance company, with the Compliance Committee.A life company’s systems, processes, structures, policies and people involved in identifying, assessing, mitigating and monitoring risks are referred to in this Prudential Standard as the risk management framework.The key requirements of this Prudential Standard include that a life company must:maintain a risk management framework which is aligned with the life company’s internal capital adequacy assessment process and includes:(a) a documented Risk Management Strategy;(b) sound risk management policies and procedures;(c) clearly defined managerial responsibilities and controls; and(d) a documented business plan;ensure that its risk management framework is subject to effective and comprehensive review; andsubmit a Risk Management Declaration to APRA on an annual basis. |
|---|
Authority
This Prudential Standard applies to all life companies including friendly societies (together referred to as life companies) registered under the Act.[1]
Nothing in this Prudential Standard prevents a life company from applying a risk management framework, Risk Management Strategy (RMS) or business plan that is also used in a related company, provided that the risk management framework, RMS or business plan has been approved by the life company for its purposes and meets the requirements of this Prudential Standard.
Interpretation
The role of the Board
The Board of directors (the Board) is ultimately responsible for the risk management framework of the life company.[2] The Board must ensure that a life company has, at all times, a risk management framework to prudently manage the risks arising in the life company and the risks to the policy owners of the statutory funds.
The Board is responsible for the risk management framework whether or not risk management and business operations are outsourced or are part of a corporate group.[3]
The Board must approve a written RMS for the life company and must be satisfied that the RMS complies with this Prudential Standard.
The Board must be notified of any material deviation from the life company’s RMS.
For the purposes of this Prudential Standard, the risk management framework is the totality of systems, structures, policies, processes and people within the life company that identify, assess, mitigate and monitor all internal and external sources of risk that could have a material impact on the life company’s operations.
A life company’s risk management framework must, at a minimum, include:
(a) an RMS;
(b) risk management policies, controls and procedures which identify, assess, monitor, report on and mitigate all material risks, financial and non-financial, likely to be faced by the life company having regard to such factors as the size, business mix and complexity of the life company’s operations;
(c) a written business plan , that is approved by the Board prior to its adoption and at any time that it is materially revised. The business plan must be reviewed by the life company at least annually;
(d) clearly defined managerial responsibilities and controls for the risk management framework; and
(e) a review process to ensure that the risk management framework remains effective.
(a) asset risk, including asset and liability mismatch risk;
(b) asset concentration risk;
(c) operational risk[5];
(d) insurance risk, including insurance concentration risks; and
(e) strategic and tactical risks that arise out of the life company’s business plan.
(a) the life company’s strategy for managing risk;
(b) the extent and circumstances under which the life company is prepared to accept risk; and
(c) the key elements of the risk management framework which give effect to the strategy for managing risk.
(a) detail the life company’s approach to the matters listed in paragraph 14;
(b) identify the policies and procedures dealing with the following risk management matters, including the date when each policy or procedure was last revised, the date that it is next due for revision and the position responsible for its maintenance:
(i) the processes for identifying and assessing material risks;
(ii) the process for establishing and implementing mitigation and control mechanisms for material risks;
(iii) the process for the monitoring and reporting of risk issues (including communication and escalation mechanisms);
(iv) the mechanisms in place for monitoring and ensuring continual compliance with all prudential requirements;
(v) the life company’s approach to management of capital;[6] and
(vi) the life company’s approach to business continuity management (refer to Prudential Standard CPS 222 Business Continuity Management) and outsourcing (refer to Prudential Standard CPS 231 Outsourcing);
(c) describe the relationships within the risk management framework between the Board, Board committees and senior management;
(d) identify those positions with managerial responsibility for the risk management framework, and set out their roles and responsibilities;
(e) describe the approach to ensuring relevant staff have an awareness of the risk management framework and instilling an appropriate risk culture across the life company; and
(f) describe the process by which the risk management framework (including the RMS) is reviewed and the intended coverage and timing for these reviews.
(a) the group (or head office) policy objectives and strategies;
(b) whether the life company’s RMS is derived wholly or partially from the group (or head office) risk management arrangements;
(c) the linkages and significant differences between the life company RMS and group (or head office) risk management arrangements including relevant life company business and other conditions; and
(d) the process for monitoring by, or reporting to, the group or head office. A summary of the key procedures, the frequency of reporting and the approach to reviews must be provided.
Under Prudential Standard LPS 110 Capital Adequacy (LPS 110), a life company is required to have an Internal Capital Adequacy Assessment Process (ICAAP). An ICAAP involves an integrated approach to capital and risk management for a life company, aimed at ensuring that the capital held is adequate in the context of the risk profile and risk appetite of that life company. A life company’s ICAAP must be developed having regard to its risk management framework.
A life company is not required to duplicate content between its ICAAP summary statement or ICAAP report required under LPS 110 and its RMS. Cross-references are appropriate to facilitate integration between the two documents.
The life company must ensure that its risk management framework is subject to effective and comprehensive review by operationally independent, appropriately trained and competent persons. The frequency and the scope of the review should be appropriate to the life company, having regard to such factors as the size, business mix and complexity of the life company’s operations and the extent of any change to its business profile or its risk appetite.
The review of the risk management framework must include:
(a) a review of the RMS, to ensure that:
(i) the strategy for the management of risk remains appropriate to the company’s business, its policyholder profile and its financial circumstances; and
(ii) the RMS accurately documents the life company’s risk management framework;
(b) a review of the policies and processes described in subparagraph 11(b); and
(c) a review of the people and functions involved in risk management.
The Appointed Actuary must include an assessment of the suitability and adequacy of the risk management framework as part of the Financial Condition Report required under Prudential Standard LPS 320 Actuarial and Related Matters.
Life companies must implement satisfactory internal audit procedures and/or external audit arrangements to ensure compliance with, and the effectiveness of, the risk management framework.
Where there are institutional, operational or other developments that materially affect the life company’s risk profile, the life company must assess whether any amendments to, or a review of, its risk management framework (including the RMS) are necessary to take account of the change.
In the event that a life company:
(a) is aware of a material breach of, or material deviation from, the risk management framework; or
(b) discovers that the risk management framework did not adequately address a material risk
the life company should notify APRA as soon as practicable.
The Board must provide APRA with a declaration on risk management (Risk Management Declaration), relating to each financial year of the life company, signed by two directors or, in the case of an EFLIC, two members of the compliance committee. This declaration must satisfy the requirements set out in Attachment A to this Prudential Standard.
The Risk Management Declaration must be submitted to APRA on, or before, the day that the life company’s annual regulatory financial statements are required to be submitted to APRA.
If the Board qualifies the Risk Management Declaration, the qualified Risk Management Declaration must include a description of any material deviation from the life company’s risk management obligations, and the steps taken, or proposed to be taken, to remedy those breaches.
Attachment A
The Board must (by the time provided for in paragraph 26 of this Prudential Standard) provide APRA with a Risk Management Declaration stating that, to the best of its knowledge and belief, having made appropriate enquiries:
(a) the life company has systems in place for the purpose of ensuring compliance with the Act, the Life Insurance Regulations 1995, prudential standards, reporting standards, the Financial Sector (Collection of Data) Act 2001, authorisation conditions, directions issued by APRA pursuant to the Act and any other requirements imposed by APRA under law;
(b) the Board is satisfied with the efficacy of the processes and systems surrounding the production of financial information at the life company;
(c) the life company has in place an RMS, developed in accordance with the requirements of this Prudential Standard, setting out its approach to risk management; and
(d) the systems that are in place for managing and monitoring risks, and the risk management framework, are appropriate to the life company, having regard to such factors as the size, business mix and complexity of the life company’s operations.
This Prudential Standard sets out the requirements for a life company to maintain a risk management framework and strategy that is appropriate to the nature and scale of its operations.
The ultimate responsibility to maintain the risk management framework and strategy rests with the Board of directors of the life company or, in the case of an eligible foreign life insurance company, with the Compliance Committee.
A life company’s systems, processes, structures, policies and people involved in identifying, assessing, mitigating and monitoring risks are referred to in this Prudential Standard as the risk management framework.
The key requirements of this Prudential Standard include that a life company must:
(a) a documented Risk Management Strategy;
(b) sound risk management policies and procedures;
(c) clearly defined managerial responsibilities and controls; and
(d) a documented business plan;
Authority
This Prudential Standard applies to all life companies including friendly societies (together referred to as life companies) registered under the Act.[1]
Nothing in this Prudential Standard prevents a life company from applying a risk management framework, Risk Management Strategy (RMS) or business plan that is also used in a related company, provided that the risk management framework, RMS or business plan has been approved by the life company for its purposes and meets the requirements of this Prudential Standard.
Interpretation
The role of the Board
The Board of directors (the Board) is ultimately responsible for the risk management framework of the life company.[2] The Board must ensure that a life company has, at all times, a risk management framework to prudently manage the risks arising in the life company and the risks to the policy owners of the statutory funds.
The Board is responsible for the risk management framework whether or not risk management and business operations are outsourced or are part of a corporate group.[3]
The Board must approve a written RMS for the life company and must be satisfied that the RMS complies with this Prudential Standard.
The Board must be notified of any material deviation from the life company’s RMS.
For the purposes of this Prudential Standard, the risk management framework is the totality of systems, structures, policies, processes and people within the life company that identify, assess, mitigate and monitor all internal and external sources of risk that could have a material impact on the life company’s operations.
A life company’s risk management framework must, at a minimum, include:
(a) an RMS;
(b) risk management policies, controls and procedures which identify, assess, monitor, report on and mitigate all material risks, financial and non-financial, likely to be faced by the life company having regard to such factors as the size, business mix and complexity of the life company’s operations;
(c) a written business plan , that is approved by the Board prior to its adoption and at any time that it is materially revised. The business plan must be reviewed by the life company at least annually;
(d) clearly defined managerial responsibilities and controls for the risk management framework; and
(e) a review process to ensure that the risk management framework remains effective.
(a) asset risk, including asset and liability mismatch risk;
(b) asset concentration risk;
(c) operational risk[5];
(d) insurance risk, including insurance concentration risks; and
(e) strategic and tactical risks that arise out of the life company’s business plan.
(a) the life company’s strategy for managing risk;
(b) the extent and circumstances under which the life company is prepared to accept risk; and
(c) the key elements of the risk management framework which give effect to the strategy for managing risk.
(a) detail the life company’s approach to the matters listed in paragraph 14;
(b) identify the policies and procedures dealing with the following risk management matters, including the date when each policy or procedure was last revised, the date that it is next due for revision and the position responsible for its maintenance:
(i) the processes for identifying and assessing material risks;
(ii) the process for establishing and implementing mitigation and control mechanisms for material risks;
(iii) the process for the monitoring and reporting of risk issues (including communication and escalation mechanisms);
(iv) the mechanisms in place for monitoring and ensuring continual compliance with all prudential requirements;
(v) the life company’s approach to management of capital;[6] and
(vi) the life company’s approach to business continuity management (refer to Prudential Standard CPS 222 Business Continuity Management) and outsourcing (refer to Prudential Standard CPS 231 Outsourcing);
(c) describe the relationships within the risk management framework between the Board, Board committees and senior management;
(d) identify those positions with managerial responsibility for the risk management framework, and set out their roles and responsibilities;
(e) describe the approach to ensuring relevant staff have an awareness of the risk management framework and instilling an appropriate risk culture across the life company; and
(f) describe the process by which the risk management framework (including the RMS) is reviewed and the intended coverage and timing for these reviews.
(a) the group (or head office) policy objectives and strategies;
(b) whether the life company’s RMS is derived wholly or partially from the group (or head office) risk management arrangements;
(c) the linkages and significant differences between the life company RMS and group (or head office) risk management arrangements including relevant life company business and other conditions; and
(d) the process for monitoring by, or reporting to, the group or head office. A summary of the key procedures, the frequency of reporting and the approach to reviews must be provided.
Under Prudential Standard LPS 110 Capital Adequacy (LPS 110), a life company is required to have an Internal Capital Adequacy Assessment Process (ICAAP). An ICAAP involves an integrated approach to capital and risk management for a life company, aimed at ensuring that the capital held is adequate in the context of the risk profile and risk appetite of that life company. A life company’s ICAAP must be developed having regard to its risk management framework.
A life company is not required to duplicate content between its ICAAP summary statement or ICAAP report required under LPS 110 and its RMS. Cross-references are appropriate to facilitate integration between the two documents.
The life company must ensure that its risk management framework is subject to effective and comprehensive review by operationally independent, appropriately trained and competent persons. The frequency and the scope of the review should be appropriate to the life company, having regard to such factors as the size, business mix and complexity of the life company’s operations and the extent of any change to its business profile or its risk appetite.
The review of the risk management framework must include:
(a) a review of the RMS, to ensure that:
(i) the strategy for the management of risk remains appropriate to the company’s business, its policyholder profile and its financial circumstances; and
(ii) the RMS accurately documents the life company’s risk management framework;
(b) a review of the policies and processes described in subparagraph 11(b); and
(c) a review of the people and functions involved in risk management.
The Appointed Actuary must include an assessment of the suitability and adequacy of the risk management framework as part of the Financial Condition Report required under Prudential Standard LPS 320 Actuarial and Related Matters.
Life companies must implement satisfactory internal audit procedures and/or external audit arrangements to ensure compliance with, and the effectiveness of, the risk management framework.
Where there are institutional, operational or other developments that materially affect the life company’s risk profile, the life company must assess whether any amendments to, or a review of, its risk management framework (including the RMS) are necessary to take account of the change.
In the event that a life company:
(a) is aware of a material breach of, or material deviation from, the risk management framework; or
(b) discovers that the risk management framework did not adequately address a material risk
the life company should notify APRA as soon as practicable.
The Board must provide APRA with a declaration on risk management (Risk Management Declaration), relating to each financial year of the life company, signed by two directors or, in the case of an EFLIC, two members of the compliance committee. This declaration must satisfy the requirements set out in Attachment A to this Prudential Standard.
The Risk Management Declaration must be submitted to APRA on, or before, the day that the life company’s annual regulatory financial statements are required to be submitted to APRA.
If the Board qualifies the Risk Management Declaration, the qualified Risk Management Declaration must include a description of any material deviation from the life company’s risk management obligations, and the steps taken, or proposed to be taken, to remedy those breaches.
| Objective and key requirements of this Prudential StandardThis Prudential Standard sets out the requirements for a life company to maintain a risk management framework and strategy that is appropriate to the nature and scale of its operations.The ultimate responsibility to maintain the risk management framework and strategy rests with the Board of directors of the life company or, in the case of an eligible foreign life insurance company, with the Compliance Committee.A life company’s systems, processes, structures, policies and people involved in identifying, assessing, mitigating and monitoring risks are referred to in this Prudential Standard as the risk management framework.The key requirements of this Prudential Standard include that a life company must:maintain a risk management framework which is aligned with the life company’s internal capital adequacy assessment process and includes:(a) a documented Risk Management Strategy;(b) sound risk management policies and procedures;(c) clearly defined managerial responsibilities and controls; and(d) a documented business plan;ensure that its risk management framework is subject to effective and comprehensive review; andsubmit a Risk Management Declaration to APRA on an annual basis. |
|---|
Authority
This Prudential Standard applies to all life companies including friendly societies (together referred to as life companies) registered under the Act.[1]
Nothing in this Prudential Standard prevents a life company from applying a risk management framework, Risk Management Strategy (RMS) or business plan that is also used in a related company, provided that the risk management framework, RMS or business plan has been approved by the life company for its purposes and meets the requirements of this Prudential Standard.
Interpretation
The role of the Board
The Board of directors (the Board) is ultimately responsible for the risk management framework of the life company.[2] The Board must ensure that a life company has, at all times, a risk management framework to prudently manage the risks arising in the life company and the risks to the policy owners of the statutory funds.
The Board is responsible for the risk management framework whether or not risk management and business operations are outsourced or are part of a corporate group.[3]
The Board must approve a written RMS for the life company and must be satisfied that the RMS complies with this Prudential Standard.
The Board must be notified of any material deviation from the life company’s RMS.
For the purposes of this Prudential Standard, the risk management framework is the totality of systems, structures, policies, processes and people within the life company that identify, assess, mitigate and monitor all internal and external sources of risk that could have a material impact on the life company’s operations.
A life company’s risk management framework must, at a minimum, include:
(a) an RMS;
(b) risk management policies, controls and procedures which identify, assess, monitor, report on and mitigate all material risks, financial and non-financial, likely to be faced by the life company having regard to such factors as the size, business mix and complexity of the life company’s operations;
(c) a written business plan , that is approved by the Board prior to its adoption and at any time that it is materially revised. The business plan must be reviewed by the life company at least annually;
(d) clearly defined managerial responsibilities and controls for the risk management framework; and
(e) a review process to ensure that the risk management framework remains effective.
(a) asset risk, including asset and liability mismatch risk;
(b) asset concentration risk;
(c) operational risk[5];
(d) insurance risk, including insurance concentration risks; and
(e) strategic and tactical risks that arise out of the life company’s business plan.
(a) the life company’s strategy for managing risk;
(b) the extent and circumstances under which the life company is prepared to accept risk; and
(c) the key elements of the risk management framework which give effect to the strategy for managing risk.
(a) detail the life company’s approach to the matters listed in paragraph 14;
(b) identify the policies and procedures dealing with the following risk management matters, including the date when each policy or procedure was last revised, the date that it is next due for revision and the position responsible for its maintenance:
(i) the processes for identifying and assessing material risks;
(ii) the process for establishing and implementing mitigation and control mechanisms for material risks;
(iii) the process for the monitoring and reporting of risk issues (including communication and escalation mechanisms);
(iv) the mechanisms in place for monitoring and ensuring continual compliance with all prudential requirements;
(v) the life company’s approach to management of capital;[6] and
(vi) the life company’s approach to business continuity management (refer to Prudential Standard CPS 222 Business Continuity Management) and outsourcing (refer to Prudential Standard CPS 231 Outsourcing);
(c) describe the relationships within the risk management framework between the Board, Board committees and senior management;
(d) identify those positions with managerial responsibility for the risk management framework, and set out their roles and responsibilities;
(e) describe the approach to ensuring relevant staff have an awareness of the risk management framework and instilling an appropriate risk culture across the life company; and
(f) describe the process by which the risk management framework (including the RMS) is reviewed and the intended coverage and timing for these reviews.
(a) the group (or head office) policy objectives and strategies;
(b) whether the life company’s RMS is derived wholly or partially from the group (or head office) risk management arrangements;
(c) the linkages and significant differences between the life company RMS and group (or head office) risk management arrangements including relevant life company business and other conditions; and
(d) the process for monitoring by, or reporting to, the group or head office. A summary of the key procedures, the frequency of reporting and the approach to reviews must be provided.
Under Prudential Standard LPS 110 Capital Adequacy (LPS 110), a life company is required to have an Internal Capital Adequacy Assessment Process (ICAAP). An ICAAP involves an integrated approach to capital and risk management for a life company, aimed at ensuring that the capital held is adequate in the context of the risk profile and risk appetite of that life company. A life company’s ICAAP must be developed having regard to its risk management framework.
A life company is not required to duplicate content between its ICAAP summary statement or ICAAP report required under LPS 110 and its RMS. Cross-references are appropriate to facilitate integration between the two documents.
The life company must ensure that its risk management framework is subject to effective and comprehensive review by operationally independent, appropriately trained and competent persons. The frequency and the scope of the review should be appropriate to the life company, having regard to such factors as the size, business mix and complexity of the life company’s operations and the extent of any change to its business profile or its risk appetite.
The review of the risk management framework must include:
(a) a review of the RMS, to ensure that:
(i) the strategy for the management of risk remains appropriate to the company’s business, its policyholder profile and its financial circumstances; and
(ii) the RMS accurately documents the life company’s risk management framework;
(b) a review of the policies and processes described in subparagraph 11(b); and
(c) a review of the people and functions involved in risk management.
The Appointed Actuary must include an assessment of the suitability and adequacy of the risk management framework as part of the Financial Condition Report required under Prudential Standard LPS 320 Actuarial and Related Matters.
Life companies must implement satisfactory internal audit procedures and/or external audit arrangements to ensure compliance with, and the effectiveness of, the risk management framework.
Where there are institutional, operational or other developments that materially affect the life company’s risk profile, the life company must assess whether any amendments to, or a review of, its risk management framework (including the RMS) are necessary to take account of the change.
In the event that a life company:
(a) is aware of a material breach of, or material deviation from, the risk management framework; or
(b) discovers that the risk management framework did not adequately address a material risk
the life company should notify APRA as soon as practicable.
The Board must provide APRA with a declaration on risk management (Risk Management Declaration), relating to each financial year of the life company, signed by two directors or, in the case of an EFLIC, two members of the compliance committee. This declaration must satisfy the requirements set out in Attachment A to this Prudential Standard.
The Risk Management Declaration must be submitted to APRA on, or before, the day that the life company’s annual regulatory financial statements are required to be submitted to APRA.
If the Board qualifies the Risk Management Declaration, the qualified Risk Management Declaration must include a description of any material deviation from the life company’s risk management obligations, and the steps taken, or proposed to be taken, to remedy those breaches.
Attachment A
The Board must (by the time provided for in paragraph 26 of this Prudential Standard) provide APRA with a Risk Management Declaration stating that, to the best of its knowledge and belief, having made appropriate enquiries:
(a) the life company has systems in place for the purpose of ensuring compliance with the Act, the Life Insurance Regulations 1995, prudential standards, reporting standards, the Financial Sector (Collection of Data) Act 2001, authorisation conditions, directions issued by APRA pursuant to the Act and any other requirements imposed by APRA under law;
(b) the Board is satisfied with the efficacy of the processes and systems surrounding the production of financial information at the life company;
(c) the life company has in place an RMS, developed in accordance with the requirements of this Prudential Standard, setting out its approach to risk management; and
(d) the systems that are in place for managing and monitoring risks, and the risk management framework, are appropriate to the life company, having regard to such factors as the size, business mix and complexity of the life company’s operations.
Sourced from the Federal Register of Legislation (legislation.gov.au), CC BY 4.0.
Interpretation
In this Determination:
APRA means the Australian Prudential Regulation Authority.
friendly society has the meaning given in section 16C of the Act.
life company has the meaning given in the Dictionary to the Act.
Schedule
| Objective and key requirements of this Prudential StandardThis Prudential Standard sets out the requirements for a life company to maintain a risk management framework and strategy that is appropriate to the nature and scale of its operations.The ultimate responsibility to maintain the risk management framework and strategy rests with the Board of directors of the life company or, in the case of an eligible foreign life insurance company, with the Compliance Committee.A life company’s systems, processes, structures, policies and people involved in identifying, assessing, mitigating and monitoring risks are referred to in this Prudential Standard as the risk management framework.The key requirements of this Prudential Standard include that a life company must:maintain a risk management framework which is aligned with the life company’s internal capital adequacy assessment process and includes:(a) a documented Risk Management Strategy;(b) sound risk management policies and procedures;(c) clearly defined managerial responsibilities and controls; and(d) a documented business plan;ensure that its risk management framework is subject to effective and comprehensive review; andsubmit a Risk Management Declaration to APRA on an annual basis. |
|---|
Authority
This Prudential Standard applies to all life companies including friendly societies (together referred to as life companies) registered under the Act.[1]
Nothing in this Prudential Standard prevents a life company from applying a risk management framework, Risk Management Strategy (RMS) or business plan that is also used in a related company, provided that the risk management framework, RMS or business plan has been approved by the life company for its purposes and meets the requirements of this Prudential Standard.
Interpretation
The role of the Board
The Board of directors (the Board) is ultimately responsible for the risk management framework of the life company.[2] The Board must ensure that a life company has, at all times, a risk management framework to prudently manage the risks arising in the life company and the risks to the policy owners of the statutory funds.
The Board is responsible for the risk management framework whether or not risk management and business operations are outsourced or are part of a corporate group.[3]
The Board must approve a written RMS for the life company and must be satisfied that the RMS complies with this Prudential Standard.
The Board must be notified of any material deviation from the life company’s RMS.
For the purposes of this Prudential Standard, the risk management framework is the totality of systems, structures, policies, processes and people within the life company that identify, assess, mitigate and monitor all internal and external sources of risk that could have a material impact on the life company’s operations.
A life company’s risk management framework must, at a minimum, include:
(a) an RMS;
(b) risk management policies, controls and procedures which identify, assess, monitor, report on and mitigate all material risks, financial and non-financial, likely to be faced by the life company having regard to such factors as the size, business mix and complexity of the life company’s operations;
(c) a written business plan , that is approved by the Board prior to its adoption and at any time that it is materially revised. The business plan must be reviewed by the life company at least annually;
(d) clearly defined managerial responsibilities and controls for the risk management framework; and
(e) a review process to ensure that the risk management framework remains effective.
(a) asset risk, including asset and liability mismatch risk;
(b) asset concentration risk;
(c) operational risk[5];
(d) insurance risk, including insurance concentration risks; and
(e) strategic and tactical risks that arise out of the life company’s business plan.
(a) the life company’s strategy for managing risk;
(b) the extent and circumstances under which the life company is prepared to accept risk; and
(c) the key elements of the risk management framework which give effect to the strategy for managing risk.
(a) detail the life company’s approach to the matters listed in paragraph 14;
(b) identify the policies and procedures dealing with the following risk management matters, including the date when each policy or procedure was last revised, the date that it is next due for revision and the position responsible for its maintenance:
(i) the processes for identifying and assessing material risks;
(ii) the process for establishing and implementing mitigation and control mechanisms for material risks;
(iii) the process for the monitoring and reporting of risk issues (including communication and escalation mechanisms);
(iv) the mechanisms in place for monitoring and ensuring continual compliance with all prudential requirements;
(v) the life company’s approach to management of capital;[6] and
(vi) the life company’s approach to business continuity management (refer to Prudential Standard CPS 222 Business Continuity Management) and outsourcing (refer to Prudential Standard CPS 231 Outsourcing);
(c) describe the relationships within the risk management framework between the Board, Board committees and senior management;
(d) identify those positions with managerial responsibility for the risk management framework, and set out their roles and responsibilities;
(e) describe the approach to ensuring relevant staff have an awareness of the risk management framework and instilling an appropriate risk culture across the life company; and
(f) describe the process by which the risk management framework (including the RMS) is reviewed and the intended coverage and timing for these reviews.
(a) the group (or head office) policy objectives and strategies;
(b) whether the life company’s RMS is derived wholly or partially from the group (or head office) risk management arrangements;
(c) the linkages and significant differences between the life company RMS and group (or head office) risk management arrangements including relevant life company business and other conditions; and
(d) the process for monitoring by, or reporting to, the group or head office. A summary of the key procedures, the frequency of reporting and the approach to reviews must be provided.
Under Prudential Standard LPS 110 Capital Adequacy (LPS 110), a life company is required to have an Internal Capital Adequacy Assessment Process (ICAAP). An ICAAP involves an integrated approach to capital and risk management for a life company, aimed at ensuring that the capital held is adequate in the context of the risk profile and risk appetite of that life company. A life company’s ICAAP must be developed having regard to its risk management framework.
A life company is not required to duplicate content between its ICAAP summary statement or ICAAP report required under LPS 110 and its RMS. Cross-references are appropriate to facilitate integration between the two documents.
The life company must ensure that its risk management framework is subject to effective and comprehensive review by operationally independent, appropriately trained and competent persons. The frequency and the scope of the review should be appropriate to the life company, having regard to such factors as the size, business mix and complexity of the life company’s operations and the extent of any change to its business profile or its risk appetite.
The review of the risk management framework must include:
(a) a review of the RMS, to ensure that:
(i) the strategy for the management of risk remains appropriate to the company’s business, its policyholder profile and its financial circumstances; and
(ii) the RMS accurately documents the life company’s risk management framework;
(b) a review of the policies and processes described in subparagraph 11(b); and
(c) a review of the people and functions involved in risk management.
The Appointed Actuary must include an assessment of the suitability and adequacy of the risk management framework as part of the Financial Condition Report required under Prudential Standard LPS 320 Actuarial and Related Matters.
Life companies must implement satisfactory internal audit procedures and/or external audit arrangements to ensure compliance with, and the effectiveness of, the risk management framework.
Where there are institutional, operational or other developments that materially affect the life company’s risk profile, the life company must assess whether any amendments to, or a review of, its risk management framework (including the RMS) are necessary to take account of the change.
In the event that a life company:
(a) is aware of a material breach of, or material deviation from, the risk management framework; or
(b) discovers that the risk management framework did not adequately address a material risk
the life company should notify APRA as soon as practicable.
The Board must provide APRA with a declaration on risk management (Risk Management Declaration), relating to each financial year of the life company, signed by two directors or, in the case of an EFLIC, two members of the compliance committee. This declaration must satisfy the requirements set out in Attachment A to this Prudential Standard.
The Risk Management Declaration must be submitted to APRA on, or before, the day that the life company’s annual regulatory financial statements are required to be submitted to APRA.
If the Board qualifies the Risk Management Declaration, the qualified Risk Management Declaration must include a description of any material deviation from the life company’s risk management obligations, and the steps taken, or proposed to be taken, to remedy those breaches.
Attachment A
The Board must (by the time provided for in paragraph 26 of this Prudential Standard) provide APRA with a Risk Management Declaration stating that, to the best of its knowledge and belief, having made appropriate enquiries:
(a) the life company has systems in place for the purpose of ensuring compliance with the Act, the Life Insurance Regulations 1995, prudential standards, reporting standards, the Financial Sector (Collection of Data) Act 2001, authorisation conditions, directions issued by APRA pursuant to the Act and any other requirements imposed by APRA under law;
(b) the Board is satisfied with the efficacy of the processes and systems surrounding the production of financial information at the life company;
(c) the life company has in place an RMS, developed in accordance with the requirements of this Prudential Standard, setting out its approach to risk management; and
(d) the systems that are in place for managing and monitoring risks, and the risk management framework, are appropriate to the life company, having regard to such factors as the size, business mix and complexity of the life company’s operations.
| Objective and key requirements of this Prudential StandardThis Prudential Standard sets out the requirements for a life company to maintain a risk management framework and strategy that is appropriate to the nature and scale of its operations.The ultimate responsibility to maintain the risk management framework and strategy rests with the Board of directors of the life company or, in the case of an eligible foreign life insurance company, with the Compliance Committee.A life company’s systems, processes, structures, policies and people involved in identifying, assess
This is an opening excerpt, not the complete document.