Authority
Authority
Authority
- This Prudential Standard is made under section 34C of the Superannuation Industry (Supervision) Act 1993 (SIS Act).
//
© 2026 Zoe. All rights reserved.
Zoe is a legal information platform. Always consult the Federal Register of Legislation for authoritative text.
Commonwealth legislation
This Act has been repealed and is no longer in force. It is retained for historical reference.
This APRA rule requires all RSE licensees to establish and maintain comprehensive systems to identify, manage and monitor risks that could harm members’ retirement savings. It places ultimate accountability with the board, mandates an independent risk capability, ongoing oversight and assurance, and prompt reporting of material failures. The goal is to ensure proactive protection of members’ money and to limit excessive or unmanaged risk across Australia’s superannuation system.
Want the full deep dive?
Zoe can write the in-depth analysis on top of the summary above: how it works, who it affects and what each part actually does.
Direct links to the current provisions in Superannuation (prudential standard) determination No. 2 of 2012 - Prudential Standard SPS 220 - Risk Management.
Authority
This Prudential Standard applies to all registrable superannuation entity (RSE) licensees (RSE licensees) under the SIS Act.[1]
All RSE licensees must comply with this Prudential Standard in its entirety, unless otherwise expressly indicated.
This Prudential Standard commences on 1 July 2013.
An RSE licensee must at all times have a risk management framework to appropriately manage the risks to its business operations.[2]
For the purposes of this Prudential Standard, the risk management framework is the totality of systems, structures, policies, processes and people within an RSE licensee’s business operations that identify, assess, manage, mitigate and monitor all internal and external sources of inherent risk that could have a material impact on the RSE licensee’s business operations or the interests of beneficiaries (material risks).[3]
The Board of the RSE licensee (the Board) is ultimately responsible for the risk management framework.[4]
An RSE licensee must, at a minimum, ensure that its risk management framework covers all material risks, both financial and non-financial, to the RSE licensee’s business operations, having regard to the size, business mix and complexity of those operations.
An RSE licensee must assess the materiality of each risk with reference to its business operations as a whole, each RSE within those operations and the impact of the risk on the obligations of the RSE licensee to its beneficiaries.
An RSE licensee’s risk management framework must, at a minimum, cover:
(a) governance risk[6];
(b) investment governance risk[7];
(c) liquidity risk, including the liquidity characteristics of investment options offered or proposed to be offered[8];
(d) operational risk[9];
(e) insurance risk[10];
(f) strategic and tactical risks that arise out of the RSE licensee’s strategic and business plans; and
(g) other risks that may have a material impact on the RSE licensee’s business operations.
13. Where an RSE licensee conducts business that has a purpose other than superannuation[\[11\]](#_ftn11), its risk management framework must cover all material contagion risks that any non\-superannuation business conducted by the RSE licensee might have on the superannuation business.
An RSE licensee’s risk management framework must enable the RSE licensee to develop and implement strategies, policies, procedures and controls to appropriately manage different types of material risk.
An RSE licensee’s risk management framework must provide reasonable assurance that each material risk to the RSE licensee’s business operations is being prudently and soundly managed, having regard to the size, business mix and complexity of those operations.
An RSE licensee’s risk management framework must, at a minimum, include:
(a) the risk appetite statement;
(b) the risk management strategy (RMS);
(c) a designated risk management function that meets the requirements of paragraph 25;
(d) all risk management policies, procedures and controls to identify, assess, monitor, report on, mitigate and manage each material risk;
(e) clearly defined and documented roles, responsibilities and formal reporting structures for the management of material risks throughout the RSE licensee’s business operations; and
(f) a review process to ensure that the risk management framework remains effective.
(a) whether the RSE licensee’s risk management framework is derived wholly or partially from group risk management policies or functions;
(b) the linkages and significant differences between the RSE licensee’s risk management framework and group risk management policies or functions; and
(c) the process for monitoring by, or reporting to, the group on risk management including the key procedures, the frequency of reporting and the approach to reviews.
An RSE licensee must have a written plan that sets out the strategic direction of the RSE licensee’s approach to managing its business operations (business plan). The business plan must cover the entirety of the RSE licensee’s business operations, be aligned with the risk management framework and be approved by the Board prior to its adoption and at any time that it is materially revised. The business plan must be a rolling plan of at least three, but no more than five, years’ duration that is reviewed at least annually (or as close to annually as is practical), with the results of the review reported to the Board.
An RSE licensee’s strategic and business planning process must:
(a) identify and consider those material risks associated with the RSE licensee’s strategic objectives and business plan that are required to be explicitly addressed and managed through the risk management framework; and
(b) consider the material risks that have been identified by the risk management framework.
An RSE licensee must maintain an up-to-date risk appetite statement that covers the RSE licensee’s business operations and each category of material risk. The risk appetite statement must be approved by the Board.
An RSE licensee’s risk appetite statement must, at a minimum, articulate:
(a) the degree of risk that the RSE licensee is prepared to accept in pursuit of its strategic objectives, giving consideration to the interests of beneficiaries (risk appetite);
(b) for each material risk, the maximum level of risk that the RSE licensee is willing to operate within expressed as a risk limit that, where possible, is based on a measurable limit of the risk remaining, after taking into account the mitigants for the risk where appropriate (risk tolerance);
(c) the process for ensuring that risk tolerances are set at an appropriate level, based on an estimation of the impact on the interests of beneficiaries in the event that a risk tolerance is breached and the likelihood that each material risk is realised;
(d) the process for monitoring compliance with each risk tolerance and taking appropriate action in the event of a breach of the RSE licensee’s risk tolerance; and
(e) the timing and process for review of the risk appetite and risk tolerances.
An RSE licensee must maintain an up–to-date RMS for its business operations that covers each material risk identified under paragraphs 10 to 13 inclusive. The RMS must be approved by the Board.
An RMS is a strategic document that describes the RSE licensee’s strategy for managing risk and the key elements of the risk management framework that give effect to this strategy. At a minimum, an RSE licensee’s RMS must describe:
(a) each material risk identified under paragraphs 10 to 13 inclusive and the RSE licensee’s approach to managing these risks;
(b) the policies and procedures dealing with the following risk management matters, including the date when each policy or procedure was last revised, the date that it is next due for review and who is responsible for the review:
(i) the processes for identifying and assessing material risks and controls;
(ii) the process for establishing, implementing and testing mitigation strategies and control mechanisms for material risks;
(iii) the process for monitoring, communicating and reporting risk issues, including escalation procedures for the reporting of material events and incidents;
(iv) the mechanisms in place for monitoring and ensuring ongoing compliance with all prudential requirements[12]; and
(v) the process for ensuring continued alignment between the risk management framework and the business plan;
(c) the role and responsibilities of the risk management function;
(d) the relationships between the Board, board committees and senior management with respect to the risk management framework;
(e) those with managerial responsibility for the risk management framework, and their roles and responsibilities;
(f) the approach to ensuring all persons within the RSE licensee’s business operations have awareness of the risk management framework and for instilling an appropriate risk culture across the RSE licensee’s business operations; and
(g) the process by which the risk management framework is reviewed and the intended coverage and timing for these reviews.
(a) is responsible for assisting the Board, board committees and senior management to develop and maintain the risk management framework;
(b) is appropriate to the size, business mix and complexity of the RSE licensee’s business operations and is operationally independent from the business units of the RSE licensee;
(c) is resourced with staff who have clearly defined roles and responsibilities and who possess appropriate experience and qualifications to exercise those responsibilities;
(d) has access to all aspects of the RSE licensee’s business operations that have the potential to generate material risk, including information technology systems and systems development resources;
(e) has the necessary authority and reporting structure to the Board, board committees and senior management to conduct its risk management activities in an effective and independent manner; and
(f) is required to notify the Board of any material deviation from, or material breach of, the risk management framework.
An RSE licensee that is part of a corporate group may rely on a risk management function located in another entity in the group where the risk management function satisfies the criteria set out in paragraph 25 in respect of the RSE licensee’s business operations.
An RSE licensee may engage the services of an external service provider to perform all or part of the risk management function where the RSE licensee can demonstrate to APRA that the external risk management function meets the requirements in paragraph 25.[14]
An RSE licensee must ensure that the appropriateness, effectiveness and adequacy of its risk management framework are subject to a comprehensive review by operationally independent, appropriately trained and competent persons at least every three years.
An RSE licensee must also undertake, for each year during which a comprehensive review does not take place, a review of the appropriateness, effectiveness and adequacy of the risk management framework.
The scope of the comprehensive review of an RSE licensee’s risk management framework must have regard to the size, business mix and complexity of the RSE licensee's business operations, the extent of any change to those operations or its risk appetite and any changes to the external environment in which the RSE licensee operates. The review of the risk management framework must, at a minimum, include a review of:
(a) whether the risk management framework remains appropriate for the RSE licensee’s business operations;
(b) the specific resources utilised, at a minimum, to undertake the risk management activities required by this Prudential Standard;
(c) the risk appetite statement;
(d) the RMS, to ensure that it accurately documents the RSE licensee’s risk management framework and the RSE licensee’s strategy for managing risk;
(e) all risk management policies and procedures; and
(f) all risk management and internal control systems.
An RSE licensee must implement satisfactory internal audit procedures and external audit arrangements to ensure compliance with the risk management framework and enable the RSE licensee to attest that the risk management and internal control systems in place are operating effectively and are adequate.[15]
Where institutional, operational or other developments that materially affect the size, business mix and complexity of an RSE licensee’s business operations are identified outside the comprehensive review required in paragraph 28, the RSE licensee must assess whether any amendment to, or a review of, the risk management framework is necessary to take account of these developments.
The Board must, on an annual basis, provide APRA with a declaration on risk management (risk management declaration) signed by two directors that satisfies the requirements set out in Attachment A to this Prudential Standard.
An RSE licensee must submit the risk management declaration to APRA on, or before, the day that the RSE licensee is required to submit annual information under reporting standards made by APRA under the Financial Sector (Collection of Data) Act 2001.
If the Board qualifies the risk management declaration, the qualified declaration must include a description of any material deviation from the RSE licensee’s risk management framework and the steps taken, or proposed to be taken, to remedy those deviations.
An RSE licensee must maintain financial resources at a level adequate to ensure its ongoing solvency and adequate liquidity to support its business operations. This requirement is in addition to the operational risk financial requirement required in SPS 114.
An RSE licensee must maintain human resources at a level adequate for its business operations, where ‘human resources’ includes, but is not limited to, adequate levels of personnel with the necessary knowledge, skills and expertise to enable the RSE licensee to effectively carry out its operations and support its risk management framework, including its business continuity and disaster recovery plans.[16]
An RSE licensee must maintain technical resources at a level adequate for its business operations, where ‘technical resources’ includes, but is not limited to:
(a) technical systems, including adequate hardware, data quality and software;
(b) systems and resources to ensure protection, security and privacy of confidential, personal and sensitive material;
(c) resources to handle transaction processing and other operations;
(d) technical resources to handle any significant changes or increases in size, business size or complexity that are planned, forecast or likely to occur;
(e) a business continuity plan; and
(f) records maintenance systems.
An RSE licensee must be able to demonstrate to APRA that it has a process to determine the levels of resources that are adequate based on an assessment of the business plan, risk management framework and the size, business mix and complexity of the RSE licensee’s business operations.
An RSE licensee may hold the resources required in paragraphs 35 to 37 inclusive itself or have the resources available under an enforceable agreement.
(a) becomes aware of a significant breach of, or material deviation from, the risk management framework; or
(b) discovers that the risk management framework did not adequately address a material risk.
View image in the official source
Prudential Standard SPS 220
Risk Management
Objectives and key requirements of this Prudential Standard
This Prudential Standard establishes requirements for an RSE licensee to have systems for identifying, assessing, managing, mitigating and monitoring material risks that may affect its ability to meet its obligations to beneficiaries. These systems, together with the structures, policies, processes and people supporting them, comprise an RSE licensee’s risk management framework.
The Board of an RSE licensee is ultimately responsible for having a risk management framework that is appropriate to the size, business mix and complexity of the RSE licensee’s business operations and that enables the RSE licensee to implement risk management approaches that appropriately manage different types of risk. The risk management framework must also be aligned with the RSE licensee’s business plan.
The key requirements of this Prudential Standard are that an RSE licensee must also:
Authority
This Prudential Standard applies to all registrable superannuation entity (RSE) licensees (RSE licensees) under the SIS Act.[1]
All RSE licensees must comply with this Prudential Standard in its entirety, unless otherwise expressly indicated.
This Prudential Standard commences on 1 July 2013.
An RSE licensee must at all times have a risk management framework to appropriately manage the risks to its business operations.[2]
For the purposes of this Prudential Standard, the risk management framework is the totality of systems, structures, policies, processes and people within an RSE licensee’s business operations that identify, assess, manage, mitigate and monitor all internal and external sources of inherent risk that could have a material impact on the RSE licensee’s business operations or the interests of beneficiaries (material risks).[3]
The Board of the RSE licensee (the Board) is ultimately responsible for the risk management framework.[4]
An RSE licensee must, at a minimum, ensure that its risk management framework covers all material risks, both financial and non-financial, to the RSE licensee’s business operations, having regard to the size, business mix and complexity of those operations.
An RSE licensee must assess the materiality of each risk with reference to its business operations as a whole, each RSE within those operations and the impact of the risk on the obligations of the RSE licensee to its beneficiaries.
An RSE licensee’s risk management framework must, at a minimum, cover:
(a) governance risk[6];
(b) investment governance risk[7];
(c) liquidity risk, including the liquidity characteristics of investment options offered or proposed to be offered[8];
(d) operational risk[9];
(e) insurance risk[10];
(f) strategic and tactical risks that arise out of the RSE licensee’s strategic and business plans; and
(g) other risks that may have a material impact on the RSE licensee’s business operations.
13. Where an RSE licensee conducts business that has a purpose other than superannuation[\[11\]](#_ftn11), its risk management framework must cover all material contagion risks that any non\-superannuation business conducted by the RSE licensee might have on the superannuation business.
An RSE licensee’s risk management framework must enable the RSE licensee to develop and implement strategies, policies, procedures and controls to appropriately manage different types of material risk.
An RSE licensee’s risk management framework must provide reasonable assurance that each material risk to the RSE licensee’s business operations is being prudently and soundly managed, having regard to the size, business mix and complexity of those operations.
An RSE licensee’s risk management framework must, at a minimum, include:
(a) the risk appetite statement;
(b) the risk management strategy (RMS);
(c) a designated risk management function that meets the requirements of paragraph 25;
(d) all risk management policies, procedures and controls to identify, assess, monitor, report on, mitigate and manage each material risk;
(e) clearly defined and documented roles, responsibilities and formal reporting structures for the management of material risks throughout the RSE licensee’s business operations; and
(f) a review process to ensure that the risk management framework remains effective.
(a) whether the RSE licensee’s risk management framework is derived wholly or partially from group risk management policies or functions;
(b) the linkages and significant differences between the RSE licensee’s risk management framework and group risk management policies or functions; and
(c) the process for monitoring by, or reporting to, the group on risk management including the key procedures, the frequency of reporting and the approach to reviews.
An RSE licensee must have a written plan that sets out the strategic direction of the RSE licensee’s approach to managing its business operations (business plan). The business plan must cover the entirety of the RSE licensee’s business operations, be aligned with the risk management framework and be approved by the Board prior to its adoption and at any time that it is materially revised. The business plan must be a rolling plan of at least three, but no more than five, years’ duration that is reviewed at least annually (or as close to annually as is practical), with the results of the review reported to the Board.
An RSE licensee’s strategic and business planning process must:
(a) identify and consider those material risks associated with the RSE licensee’s strategic objectives and business plan that are required to be explicitly addressed and managed through the risk management framework; and
(b) consider the material risks that have been identified by the risk management framework.
An RSE licensee must maintain an up-to-date risk appetite statement that covers the RSE licensee’s business operations and each category of material risk. The risk appetite statement must be approved by the Board.
An RSE licensee’s risk appetite statement must, at a minimum, articulate:
(a) the degree of risk that the RSE licensee is prepared to accept in pursuit of its strategic objectives, giving consideration to the interests of beneficiaries (risk appetite);
(b) for each material risk, the maximum level of risk that the RSE licensee is willing to operate within expressed as a risk limit that, where possible, is based on a measurable limit of the risk remaining, after taking into account the mitigants for the risk where appropriate (risk tolerance);
(c) the process for ensuring that risk tolerances are set at an appropriate level, based on an estimation of the impact on the interests of beneficiaries in the event that a risk tolerance is breached and the likelihood that each material risk is realised;
(d) the process for monitoring compliance with each risk tolerance and taking appropriate action in the event of a breach of the RSE licensee’s risk tolerance; and
(e) the timing and process for review of the risk appetite and risk tolerances.
An RSE licensee must maintain an up–to-date RMS for its business operations that covers each material risk identified under paragraphs 10 to 13 inclusive. The RMS must be approved by the Board.
An RMS is a strategic document that describes the RSE licensee’s strategy for managing risk and the key elements of the risk management framework that give effect to this strategy. At a minimum, an RSE licensee’s RMS must describe:
(a) each material risk identified under paragraphs 10 to 13 inclusive and the RSE licensee’s approach to managing these risks;
(b) the policies and procedures dealing with the following risk management matters, including the date when each policy or procedure was last revised, the date that it is next due for review and who is responsible for the review:
(i) the processes for identifying and assessing material risks and controls;
(ii) the process for establishing, implementing and testing mitigation strategies and control mechanisms for material risks;
(iii) the process for monitoring, communicating and reporting risk issues, including escalation procedures for the reporting of material events and incidents;
(iv) the mechanisms in place for monitoring and ensuring ongoing compliance with all prudential requirements[12]; and
(v) the process for ensuring continued alignment between the risk management framework and the business plan;
(c) the role and responsibilities of the risk management function;
(d) the relationships between the Board, board committees and senior management with respect to the risk management framework;
(e) those with managerial responsibility for the risk management framework, and their roles and responsibilities;
(f) the approach to ensuring all persons within the RSE licensee’s business operations have awareness of the risk management framework and for instilling an appropriate risk culture across the RSE licensee’s business operations; and
(g) the process by which the risk management framework is reviewed and the intended coverage and timing for these reviews.
(a) is responsible for assisting the Board, board committees and senior management to develop and maintain the risk management framework;
(b) is appropriate to the size, business mix and complexity of the RSE licensee’s business operations and is operationally independent from the business units of the RSE licensee;
(c) is resourced with staff who have clearly defined roles and responsibilities and who possess appropriate experience and qualifications to exercise those responsibilities;
(d) has access to all aspects of the RSE licensee’s business operations that have the potential to generate material risk, including information technology systems and systems development resources;
(e) has the necessary authority and reporting structure to the Board, board committees and senior management to conduct its risk management activities in an effective and independent manner; and
(f) is required to notify the Board of any material deviation from, or material breach of, the risk management framework.
An RSE licensee that is part of a corporate group may rely on a risk management function located in another entity in the group where the risk management function satisfies the criteria set out in paragraph 25 in respect of the RSE licensee’s business operations.
An RSE licensee may engage the services of an external service provider to perform all or part of the risk management function where the RSE licensee can demonstrate to APRA that the external risk management function meets the requirements in paragraph 25.[14]
An RSE licensee must ensure that the appropriateness, effectiveness and adequacy of its risk management framework are subject to a comprehensive review by operationally independent, appropriately trained and competent persons at least every three years.
An RSE licensee must also undertake, for each year during which a comprehensive review does not take place, a review of the appropriateness, effectiveness and adequacy of the risk management framework.
The scope of the comprehensive review of an RSE licensee’s risk management framework must have regard to the size, business mix and complexity of the RSE licensee's business operations, the extent of any change to those operations or its risk appetite and any changes to the external environment in which the RSE licensee operates. The review of the risk management framework must, at a minimum, include a review of:
(a) whether the risk management framework remains appropriate for the RSE licensee’s business operations;
(b) the specific resources utilised, at a minimum, to undertake the risk management activities required by this Prudential Standard;
(c) the risk appetite statement;
(d) the RMS, to ensure that it accurately documents the RSE licensee’s risk management framework and the RSE licensee’s strategy for managing risk;
(e) all risk management policies and procedures; and
(f) all risk management and internal control systems.
An RSE licensee must implement satisfactory internal audit procedures and external audit arrangements to ensure compliance with the risk management framework and enable the RSE licensee to attest that the risk management and internal control systems in place are operating effectively and are adequate.[15]
Where institutional, operational or other developments that materially affect the size, business mix and complexity of an RSE licensee’s business operations are identified outside the comprehensive review required in paragraph 28, the RSE licensee must assess whether any amendment to, or a review of, the risk management framework is necessary to take account of these developments.
The Board must, on an annual basis, provide APRA with a declaration on risk management (risk management declaration) signed by two directors that satisfies the requirements set out in Attachment A to this Prudential Standard.
An RSE licensee must submit the risk management declaration to APRA on, or before, the day that the RSE licensee is required to submit annual information under reporting standards made by APRA under the Financial Sector (Collection of Data) Act 2001.
If the Board qualifies the risk management declaration, the qualified declaration must include a description of any material deviation from the RSE licensee’s risk management framework and the steps taken, or proposed to be taken, to remedy those deviations.
An RSE licensee must maintain financial resources at a level adequate to ensure its ongoing solvency and adequate liquidity to support its business operations. This requirement is in addition to the operational risk financial requirement required in SPS 114.
An RSE licensee must maintain human resources at a level adequate for its business operations, where ‘human resources’ includes, but is not limited to, adequate levels of personnel with the necessary knowledge, skills and expertise to enable the RSE licensee to effectively carry out its operations and support its risk management framework, including its business continuity and disaster recovery plans.[16]
An RSE licensee must maintain technical resources at a level adequate for its business operations, where ‘technical resources’ includes, but is not limited to:
(a) technical systems, including adequate hardware, data quality and software;
(b) systems and resources to ensure protection, security and privacy of confidential, personal and sensitive material;
(c) resources to handle transaction processing and other operations;
(d) technical resources to handle any significant changes or increases in size, business size or complexity that are planned, forecast or likely to occur;
(e) a business continuity plan; and
(f) records maintenance systems.
An RSE licensee must be able to demonstrate to APRA that it has a process to determine the levels of resources that are adequate based on an assessment of the business plan, risk management framework and the size, business mix and complexity of the RSE licensee’s business operations.
An RSE licensee may hold the resources required in paragraphs 35 to 37 inclusive itself or have the resources available under an enforceable agreement.
(a) becomes aware of a significant breach of, or material deviation from, the risk management framework; or
(b) discovers that the risk management framework did not adequately address a material risk.
Attachment A
For the purposes of paragraph 32 of this Prudential Standard, an RSE licensee’s risk management declaration must cover the following matters:
(a) the RSE licensee has in place systems for ensuring compliance with all prudential requirements;
(b) the systems and resources that are in place for managing and monitoring risks, and the risk management framework, are appropriate to the RSE licensee, having regard to the size, business mix and complexity of the RSE licensee’s business operations;
(c) the RSE licensee has assessed the risks of outsourcing any business activity, and is satisfied that the risks and relevant controls relating to these risks are appropriate to the RSE licensee, having regard to the size, business mix and complexity of the RSE’s licensee’s business operations and the operational capabilities of the RSE licensee itself;
(d) the risk management and internal control systems in place are operating effectively and are adequate having regard to the risks they are designed to control;
(e) the RSE licensee has an RMS that complies with this Prudential Standard, and that the RSE licensee has complied with each measure and control described in the RMS;
(f) the RSE licensee is satisfied with the efficacy of the processes and systems surrounding the production of financial information for each RSE within its business operations;
(g) the RSE licensee has adequate reporting systems and internal controls supporting the preparation and reporting of accurate financial and statistical information to APRA; and
(h) information provided to APRA accurately represents the transactions for the year and financial position at year end in accordance with the provisions of the SIS Act and FSCOD Act.
Sourced from the Federal Register of Legislation (legislation.gov.au), CC BY 4.0.
Authority
This Prudential Standard applies to all registrable superannuation entity (RSE) licensees (RSE licensees) under the SIS Act.[1]
All RSE licensees must comply with this Prudential Standard in its entirety, unless otherwise expressly indicated.
This Prudential Standard commences on 1 July 2013.
An RSE licensee must at all times have a risk management framework to appropriately manage the risks to its business operations.[2]
For the purposes of this Prudential Standard, the risk management framework is the totality of systems, structures, policies, processes and people within an RSE licensee’s business operations that identify, assess, manage, mitigate and monitor all internal and external sources of inherent risk that could have a material impact on the RSE licensee’s business operations or the interests of beneficiaries (material risks).[3]
The Board of the RSE licensee (the Board) is ultimately responsible for the risk management framework.[4]
An RSE licensee must, at a minimum, ensure that its risk management framework covers all material risks, both financial and non-financial, to the RSE licensee’s business operations, having regard to the size, business mix and complexity of those operations.
An RSE licensee must assess the materiality of each risk with reference to its business operations as a whole, each RSE within those operations and the impact of the risk on the obligations of the RSE licensee to its beneficiaries.
An RSE licensee’s risk management framework must, at a minimum, cover:
(a) governance risk[6];
(b) investment governance risk[7];
(c) liquidity risk, including the liquidity characteristics of investment options offered or proposed to be offered[8];
(d) operational risk[9];
(e) insurance risk[10];
(f) strategic and tactical risks that arise out of the RSE licensee’s strategic and business plans; and
(g) other risks that may have a material impact on the RSE licensee’s business operations.
13. Where an RSE licensee conducts business that has a purpose other than superannuation[\[11\]](#_ftn11), its risk management framework must cover all material contagion risks that any non\-superannuation business conducted by the RSE licensee might have on the superannuation business.
An RSE licensee’s risk management framework must enable the RSE licensee to develop and implement strategies, policies, procedures and controls to appropriately manage different types of material risk.
An RSE licensee’s risk management framework must provide reasonable assurance that each material risk to the RSE licensee’s business operations is being prudently and soundly managed, having regard to the size, business mix and complexity of those operations.
An RSE licensee’s risk management framework must, at a minimum, include:
(a) the risk appetite statement;
(b) the risk management strategy (RMS);
(c) a designated risk management function that meets the requirements of paragraph 25;
(d) all risk management policies, procedures and controls to identify, assess, monitor, report on, mitigate and manage each material risk;
(e) clearly defined and documented roles, responsibilities and formal reporting structures for the management of material risks throughout the RSE licensee’s business operations; and
(f) a review process to ensure that the risk management framework remains effective.
(a) whether the RSE licensee’s risk management framework is derived wholly or partially from group risk management policies or functions;
(b) the linkages and significant differences between the RSE licensee’s risk management framework and group risk management policies or functions; and
(c) the process for monitoring by, or reporting to, the group on risk management including the key procedures, the frequency of reporting and the approach to reviews.
An RSE licensee must have a written plan that sets out the strategic direction of the RSE licensee’s approach to managing its business operations (business plan). The business plan must cover the entirety of the RSE licensee’s business operations, be aligned with the risk management framework and be approved by the Board prior to its adoption and at any time that it is materially revised. The business plan must be a rolling plan of at least three, but no more than five, years’ duration that is reviewed at least annually (or as close to annually as is practical), with the results of the review reported to the Board.
An RSE licensee’s strategic and business planning process must:
(a) identify and consider those material risks associated with the RSE licensee’s strategic objectives and business plan that are required to be explicitly addressed and managed through the risk management framework; and
(b) consider the material risks that have been identified by the risk management framework.
An RSE licensee must maintain an up-to-date risk appetite statement that covers the RSE licensee’s business operations and each category of material risk. The risk appetite statement must be approved by the Board.
An RSE licensee’s risk appetite statement must, at a minimum, articulate:
(a) the degree of risk that the RSE licensee is prepared to accept in pursuit of its strategic objectives, giving consideration to the interests of beneficiaries (risk appetite);
(b) for each material risk, the maximum level of risk that the RSE licensee is willing to operate within expressed as a risk limit that, where possible, is based on a measurable limit of the risk remaining, after taking into account the mitigants for the risk where appropriate (risk tolerance);
(c) the process for ensuring that risk tolerances are set at an appropriate level, based on an estimation of the impact on the interests of beneficiaries in the event that a risk tolerance is breached and the likelihood that each material risk is realised;
(d) the process for monitoring compliance with each risk tolerance and taking appropriate action in the event of a breach of the RSE licensee’s risk tolerance; and
(e) the timing and process for review of the risk appetite and risk tolerances.
An RSE licensee must maintain an up–to-date RMS for its business operations that covers each material risk identified under paragraphs 10 to 13 inclusive. The RMS must be approved by the Board.
An RMS is a strategic document that describes the RSE licensee’s strategy for managing risk and the key elements of the risk management framework that give effect to this strategy. At a minimum, an RSE licensee’s RMS must describe:
(a) each material risk identified under paragraphs 10 to 13 inclusive and the RSE licensee’s approach to managing these risks;
(b) the policies and procedures dealing with the following risk management matters, including the date when each policy or procedure was last revised, the date that it is next due for review and who is responsible for the review:
(i) the processes for identifying and assessing material risks and controls;
(ii) the process for establishing, implementing and testing mitigation strategies and control mechanisms for material risks;
(iii) the process for monitoring, communicating and reporting risk issues, including escalation procedures for the reporting of material events and incidents;
(iv) the mechanisms in place for monitoring and ensuring ongoing compliance with all prudential requirements[12]; and
(v) the process for ensuring continued alignment between the risk management framework and the business plan;
(c) the role and responsibilities of the risk management function;
(d) the relationships between the Board, board committees and senior management with respect to the risk management framework;
(e) those with managerial responsibility for the risk management framework, and their roles and responsibilities;
(f) the approach to ensuring all persons within the RSE licensee’s business operations have awareness of the risk management framework and for instilling an appropriate risk culture across the RSE licensee’s business operations; and
(g) the process by which the risk management framework is reviewed and the intended coverage and timing for these reviews.
(a) is responsible for assisting the Board, board committees and senior management to develop and maintain the risk management framework;
(b) is appropriate to the size, business mix and complexity of the RSE licensee’s business operations and is operationally independent from the business units of the RSE licensee;
(c) is resourced with staff who have clearly defined roles and responsibilities and who possess appropriate experience and qualifications to exercise those responsibilities;
(d) has access to all aspects of the RSE licensee’s business operations that have the potential to generate material risk, including information technology systems and systems development resources;
(e) has the necessary authority and reporting structure to the Board, board committees and senior management to conduct its risk management activities in an effective and independent manner; and
(f) is required to notify the Board of any material deviation from, or material breach of, the risk management framework.
An RSE licensee that is part of a corporate group may rely on a risk management function located in another entity in the group where the risk management function satisfies the criteria set out in paragraph 25 in respect of the RSE licensee’s business operations.
An RSE licensee may engage the services of an external service provider to perform all or part of the risk management function where the RSE licensee can demonstrate to APRA that the external risk management function meets the requirements in paragraph 25.[14]
An RSE licensee must ensure that the appropriateness, effectiveness and adequacy of its risk management framework are subject to a comprehensive review by operationally independent, appropriately trained and competent persons at least every three years.
An RSE licensee must also undertake, for each year during which a comprehensive review does not take place, a review of the appropriateness, effectiveness and adequacy of the risk management framework.
The scope of the comprehensive review of an RSE licensee’s risk management framework must have regard to the size, business mix and complexity of the RSE licensee's business operations, the extent of any change to those operations or its risk appetite and any changes to the external environment in which the RSE licensee operates. The review of the risk management framework must, at a minimum, include a review of:
(a) whether the risk management framework remains appropriate for the RSE licensee’s business operations;
(b) the specific resources utilised, at a minimum, to undertake the risk management activities required by this Prudential Standard;
(c) the risk appetite statement;
(d) the RMS, to ensure that it accurately documents the RSE licensee’s risk management framework and the RSE licensee’s strategy for managing risk;
(e) all risk management policies and procedures; and
(f) all risk management and internal control systems.
An RSE licensee must implement satisfactory internal audit procedures and external audit arrangements to ensure compliance with the risk management framework and enable the RSE licensee to attest that the risk management and internal control systems in place are operating effectively and are adequate.[15]
Where institutional, operational or other developments that materially affect the size, business mix and complexity of an RSE licensee’s business operations are identified outside the comprehensive review required in paragraph 28, the RSE licensee must assess whether any amendment to, or a review of, the risk management framework is necessary to take account of these developments.
The Board must, on an annual basis, provide APRA with a declaration on risk management (risk management declaration) signed by two directors that satisfies the requirements set out in Attachment A to this Prudential Standard.
An RSE licensee must submit the risk management declaration to APRA on, or before, the day that the RSE licensee is required to submit annual information under reporting standards made by APRA under the Financial Sector (Collection of Data) Act 2001.
If the Board qualifies the risk management declaration, the qualified declaration must include a description of any material deviation from the RSE licensee’s risk management framework and the steps taken, or proposed to be taken, to remedy those deviations.
An RSE licensee must maintain financial resources at a level adequate to ensure its ongoing solvency and adequate liquidity to support its business operations. This requirement is in addition to the operational risk financial requirement required in SPS 114.
An RSE licensee must maintain human resources at a level adequate for its business operations, where ‘human resources’ includes, but is not limited to, adequate levels of personnel with the necessary knowledge, skills and expertise to enable the RSE licensee to effectively carry out its operations and support its risk management framework, including its business c
This is an opening excerpt, not the complete document.