Risk management functionRisk management function

Risk management function

25. An RSE licensee must have a designated risk management function that, at a minimum:

(a) is responsible for assisting the Board, board committees and senior management to develop and maintain the risk management framework;

(b) is appropriate to the size, business mix and complexity of the RSE licensee’s business operations and is operationally independent from the business units of the RSE licensee;

(c) is resourced with staff who have clearly defined roles and responsibilities and who possess appropriate experience and qualifications to exercise those responsibilities;

(d) has access to all aspects of the RSE licensee’s business operations that have the potential to generate material risk, including information technology systems and systems development resources;

(e) has the necessary authority and reporting structure to the Board, board committees and senior management to conduct its risk management activities in an effective and independent manner; and

(f) is required to notify the Board of any material deviation from, or material breach of, the risk management framework.

26. An RSE licensee that is part of a corporate group may rely on a risk management function located in another entity in the group where the risk management function satisfies the criteria set out in paragraph 25 in respect of the RSE licensee’s business operations.

27. An RSE licensee may engage the services of an external service provider to perform all or part of the risk management function where the RSE licensee can demonstrate to APRA that the external risk management function meets the requirements in paragraph 25.[14]