Superannuation (prudential standard) determination No. 3 of 2019

SPS 220 organises risk governance around a small set of recurring legal concepts and operational deliverables that the instrument defines and then operationalises.

• Risk management framework (RMF): Defined as the totality of systems, structures, policies, processes and people that identify, assess, manage, mitigate and monitor material risks to business operations and beneficiary interests (para 6). The RMF is the central object that must be documented, implemented and kept up to date (paras 14-16, 27-31).

• Material risk and materiality assessment: Materiality is assessed in the context of the RSE licensee’s entire business operations and each RSE within those operations, with reference to impacts on obligations to beneficiaries (para 11). SPS 220 lists categories that must be covered as material risks (para 12) and requires the RMF to cover both financial and non‑financial material risks (para 10).

• Board responsibility and solvency duty: The Board is designated as ultimately responsible for the RMF and maintaining solvency and adequate resources for activities under the RSE licence (paras 7-8). The Board must approve the risk appetite statement and RMS (paras 19, 21) and provide an annual risk‑management declaration signed by two directors (para 32).

• Risk appetite and tolerances: The risk appetite statement must articulate the degree of risk acceptable in pursuit of strategy and set, where possible, measurable risk tolerances (para 20(a)-(b)). It must also set processes for setting, monitoring and revising tolerances and actions on breaches (para 20(c)-(e)).

• Risk management strategy (RMS): The RMS is described as the strategic document explaining how the RSE manages each material risk and must include specified policy descriptions, responsibility matrices, reporting processes, mechanisms for prudential compliance and alignment to business plans (paras 21-22). APRA may require amendment or a separate RMS for particular RSEs (para 23).

• Designated risk management function: An operationally independent function appropriate to the entity’s size, mix and complexity, with authority, reporting lines and staff with suitable experience, and access to all business areas and IT systems (para 24). Group or external provision of this function is permitted where the criteria are met (paras 25-26).

• Management information system (MIS) and stress considerations: MIS must be adequate under normal circumstances and during stress to measure, assess and report on all material risks (para 16(f)). This embeds expectations of capability for stress testing and escalation reporting.

• Review, audit and assurance: A comprehensive review of the RMF by operationally independent competent persons is required at least every three years, with interim annual reviews in non‑comprehensive years, and internal and external audit arrangements to attest to effectiveness (paras 27-30). Reviews must cover adequacy of resources, RMS, policies, controls and internal control systems (para 29).

• Declarations and notifications: The Board must make an annual declaration to APRA covering compliance, adequacy of systems and resources, outsourcing risk assessment, efficacy of financial information processes, and accuracy of data provided to APRA (para 32, Attachment A). The RSE licensee must notify APRA within prescribed time frames for significant breaches, material deviations or material changes to size, mix or complexity (paras 35-36).

• APRA discretion and tailoring: APRA may require changes to an RMS, require separate RMSs per RSE, or adjust or exclude specific prudential requirements by notice (paras 23, 37). This gives APRA a tailoring power to respond to perceived inadequacy or particular circumstances.

These concepts are expressed in operational terms rather than abstract duties, specifying deliverables (RMS, appetite statement, declarations), process obligations (reviews, notifications), and governance architecture (Board sign‑off, designated function, MIS). The Standard uses conceptually broad terms such as “material”, “appropriate”, “adequate” and “significant”, which will require judgement by Boards and APRA in application (paras 10-11, 15-16, 35).

By operation of paras 1-4, SPS 220 applies to all RSE licensees under the SIS Act. The instrument explicitly imports the statutory definition of “RSE licensee” by reference to section 10(1) of the SIS Act (Attachment A, Determination text). The effect is that every entity holding an RSE licence will be required to comply with the Standard in full unless APRA expressly indicates otherwise (para 3). The principal parties and roles directly affected are:

• Boards of RSE licensees: The Standard places ultimate responsibility on the Board for the RMF, solvency and ensuring adequate resources (paras 7-8). Boards must approve the risk appetite statement and RMS (paras 19, 21) and sign the annual risk‑management declaration by two directors (para 32). Board decisions about reliance on group policies or outsourcing are subject to specific approval obligations (para 9, Attachment A(c)).

• Senior management and board committees: The RMS must describe the relationships between Board, board committees and senior management with respect to RMF (para 22(d)). Senior management is the operational implementer of approved policies and must ensure reporting and escalation mechanisms are in place (para 22(b)(iii)).

• Designated risk management function staff and heads of risk: The Standard requires a designated risk management function that is operationally independent, suitably resourced and with access to all relevant systems (para 24). Where a group or external provider supplies the function, those staff and governance arrangements must meet the criteria (paras 25-26).

• Internal and external auditors and independent reviewers: The RMF must be subjected to comprehensive review by operationally independent competent persons at least every three years, and the RSE must implement satisfactory internal audit procedures and external audit arrangements to attest to effectiveness (paras 27-30). These review and audit providers therefore have a recurring engagement role.

• Group corporate functions and related entities: Where an RSE is part of a corporate group and uses group policies or functions, the Board must approve their use and ensure those group arrangements appropriately serve the RSE’s operations (para 9). The RMF must set out how group‑derived frameworks apply, their linkages and differences, and the reporting and monitoring processes with the group (para 17).

• Outsourcing and external service providers: The Standard contemplates the use of external service providers for the risk management function provided the RSE can demonstrate to APRA that the external function meets para 24 requirements (para 26). Attachment A requires the RSE to have assessed outsourcing risks (Attachment A(c)), bringing service providers and their contractual controls into scope.

• APRA and its delegates: APRA is the recipient of annual declarations and breach notifications (paras 32-36) and is empowered to require RMS amendments, separate RMSs for particular RSEs, or to adjust/exclude prudential requirements in relation to an RSE (paras 23, 37). APRA’s supervisory and administrative functions will therefore be a constant counterpart.

Indirectly affected parties include trustees and fiduciaries of funds administered by RSE licensees, insurers providing group insurance arrangements (insurance risk is a specified material risk, para 12(e)), investment managers whose products have liquidity characteristics that must be considered (para 12(c)), and members/beneficiaries whose interests are the reference point for materiality and risk appetite (para 11, para 20(a)).

The Standard therefore operationally affects governance actors (boards, committees), risk and audit personnel, group functions and external vendors, along with the regulator that oversees compliance and can require changes. The obligations are entity‑level and apply across the full population of RSE licensees without exemption except via express APRA adjustment or exclusion (paras 3, 37).

SPS 220 imposes duties that are primarily governance, documentation, monitoring, assurance and notification obligations on RSE licensees and reserves several discretionary rights and powers to APRA.

Key duties imposed on RSE licensees and their Boards

• Maintain an RMF at all times that identifies, assesses, manages, mitigates and monitors material risks to business operations and beneficiaries (paras 5-6, 14-16). The RMF must give reasonable assurance that material risks are being prudently and soundly managed, considering the size, business mix and complexity of operations (para 15).

• Board ultimate responsibility: The Board is ultimately responsible for the RMF and for maintaining solvency and adequate resourcing for licensee activities (paras 7-8). The Board must approve the risk appetite statement and RMS (paras 19, 21).

• Produce and maintain specific deliverables: A Board‑approved risk appetite statement (para 19-20) that articulates acceptable risk and measurable tolerances where possible; an up‑to‑date RMS covering all material risks with specified content (paras 21-22); and documentation of the role and responsibilities for the RMF (para 22(c)-(e)).

• Designate and resource a risk management function: The licensee must have a risk management function that is operationally independent, appropriately resourced, has access to relevant systems, and has authority and reporting structures to carry out its responsibilities (para 24). Group or external provision is allowed if criteria are met (paras 25-26).

• Management information systems and escalation procedures: Establish an MIS adequate in normal and stress conditions and procedures for monitoring, communicating and reporting risk issues and escalation for material events (paras 16(f), 22(b)(iii)).

• Reviews, audit and assurance: Conduct comprehensive independent reviews of the RMF at least every three years and annual reviews in intervening years, and maintain internal and external audit arrangements to attest to adequacy and effectiveness (paras 27-30).

• Annual declaration and breach reporting: Provide an annual Board declaration to APRA signed by two directors covering matters in Attachment A (paras 32-33, Attachment A), and notify APRA within 10 business days of becoming aware of significant breaches or material deviations from the RMF or discovering that the RMF did not adequately address a material risk (para 35). Notify APRA as soon as practicable of material changes to size, business mix or complexity (para 36).

Express rights and powers given to APRA by the Standard

• Power to require amendment of an RMS or to require separate RMSs for particular RSEs where APRA considers the RMS does not adequately cover risks to that RSE (para 23). This is an affirmative supervisory power allowing APRA to compel changes in documentation and approach.

• Power to adjust or exclude a specific prudential requirement in relation to an RSE by written notice (para 37). This gives APRA discretion to tailor requirements to specific entities.

Procedural constraints and permitted flexibilities for licensees

• Where the RSE is part of a corporate group, the Board must approve reliance on group policies and must ensure such policies are appropriate (para 9). The RMF must identify linkages and differences between group and RSE frameworks and the monitoring/reporting process with the group (para 17).

• Outsourcing and external provision of risk functions are permitted provided the RSE can demonstrate the external function meets the para 24 criteria and that outsourcing risks have been assessed (paras 25-26, Attachment A(c)).

Observable burdens and control duties

• Ensure MIS adequacy in stress scenarios and maintain documented processes, dated policy review cycles and named accountability for reviews (para 22(b)). Establish escalation procedures for material events and incidents, and implement mechanisms for monitoring ongoing prudential compliance (para 22(b)(iii)-(iv)).

Limitations in the Standard

• The Standard sets duties and process obligations, but it does not itself specify sanctions, monetary penalties or criminal offences. It provides APRA with powers to require amendments and to adjust or exclude requirements, and to receive declarations and notifications (paras 23, 32-37). Any enforcement consequences beyond these supervisory powers are outside the text of SPS 220 and would derive from APRA’s broader statutory powers under the SIS Act and other legislation, which are not detailed in SPS 220.

Overall, SPS 220 creates affirmative duties for boards and management to design, resource, document, review and assure a risk framework, and it reserves to APRA the right to intervene by requiring changes or varying requirements for particular licensees.

SPS 220 sets out supervisory obligations, reporting and APRA’s discretionary powers to vary requirements, rather than specifying penalties or enforcement mechanisms within the Standard itself.

What the Standard requires APRA to receive and what it may do

• Declarations and notifications: The Board must provide an annual risk‑management declaration signed by two directors to APRA (paras 32-33, Attachment A). RSE licensees must notify APRA within 10 business days of becoming aware of a significant breach or material deviation from the RMF, or of discovering that the RMF did not adequately address a material risk (para 35). They must also notify APRA as soon as practicable of material changes to size, business mix and complexity (para 36). These duties create reporting triggers that put APRA on notice.

• APRA supervisory powers in the Standard: APRA may require an RSE licensee to amend its RMS or develop and maintain a separate RMS for one or more RSEs where APRA considers the RMS does not adequately cover the risks to that RSE (para 23). APRA may, by written notice, adjust or exclude a specific prudential requirement in this Standard in relation to an RSE licensee (para 37). These are positive powers permitting APRA to impose remedial documentation or to tailor requirements.

What the Standard does not do (within its text)

• SPS 220 does not itself prescribe fines, civil penalties, criminal sanctions, licence cancellation procedures, directions powers, or suspension powers. The Standard’s text is silent on monetary penalties or criminal enforcement mechanisms. Any use of those regulatory sanctions would derive from APRA’s broader statutory toolkit under the SIS Act and other statutes, which SPS 220 references as the enabling authority (para 1), but does not elaborate.

Practical enforcement implications drawn from the text

• The Standard creates a regime of supervisory oversight: the Board’s annual signed declaration and the prescribed breach/changes notifications establish an evidentiary flow to APRA that supports supervisory review and potential intervention using the powers expressed in the Standard (paras 32-37). The ability to require amendment of the RMS or separate RMSs (para 23) and to adjust/exclude prudential requirements (para 37) are the explicit remedies contained in the Standard.

• Compliance validation and attestation: The RSE must maintain internal and external audit arrangements to enable it to attest to the effectiveness and adequacy of risk management and internal control systems (para 30). Failures exposed by audit or review could trigger APRA’s exercise of the powers described above.

• Timeframes and immediacy: The Standard imposes a 10 business‑day notification obligation for significant breaches or material deviation (para 35), which restricts the time available for remediation before APRA is informed and may act.

Limits on inference from the Standard

• Because SPS 220 does not itself describe APRA’s wider enforcement toolkit or the standards for escalation to formal supervisory action (outside requiring RMS amendments or varying requirements), readers should not assume additional enforcement steps, such as licence suspensions or penalty notices, are specified here. Those are matters contained elsewhere in the SIS Act and APRA’s broader regulatory framework, which are not reproduced in SPS 220.

In short, SPS 220 establishes monitoring, reporting and remediation powers and requires RSEs to provide specified attestations and notifications to APRA. The Standard’s explicit enforcement instruments within its text are APRA’s powers to require RMS amendments or to adjust/exclude requirements and the administrative leverage APRA gains from declarations and notifications. The Standard does not itself list monetary penalties or criminal sanctions.

SPS 220 is an APRA prudential standard enacted under the SIS Act and explicitly references other statutory frameworks for reporting obligations. The text both draws on and situates itself alongside these statutory instruments.

Statutory basis and reporting interaction

• Enabling statute: SPS 220 is made under section 34C of the SIS Act (para 1). That establishes the instrument as a prudential standard with statutory provenance under the SIS regulatory architecture.

• Reporting timing and data regimes: The annual risk‑management declaration must be submitted to APRA on or before the day the RSE licensee is required to submit annual information under reporting standards made by APRA under the Financial Sector (Collection of Data) Act 2001 (FS(COD) Act) (para 33). Attachment A(h) also requires that information provided to APRA accurately represent transactions and financial position at year end in accordance with the SIS Act and the FS(COD) Act. Thus SPS 220 embeds and coordinates with APRA’s data collection timetable and accuracy obligations under the FS(COD) Act reporting regime.

Supervision, statutory powers and prudential architecture

• APRA discretion to tailor requirements: SPS 220 includes express powers for APRA to require RMS amendments or separate RMSs for particular RSEs (para 23) and to adjust or exclude specific prudential requirements by written notice (para 37). Those provisions operate within the statutory supervisory remit in the SIS Act framework and allow APRA to align prudential expectations with entity‑specific circumstances.

• Interaction with trustee and fiduciary obligations: The Standard repeatedly frames materiality and risk assessment in terms of “the interests of beneficiaries” and obligations to beneficiaries (paras 6, 11, 20(a)). While SPS 220 is an APRA instrument and not trustee law, it intersects with trustee duties under the SIS Act and trust law because it obliges Boards to consider beneficiary interests when setting risk appetite and assessing materiality (para 20(a), para 11). The Standard requires the RMF to be aligned with the business plan, which in turn connects to trustees’ broader statutory duties to act in beneficiaries’ best interests.

Operational and contractual interactions

• Outsourcing and service provider oversight: SPS 220 requires the RSE to assess outsourcing risks and permits external providers to deliver the risk management function where the RSE can demonstrate to APRA that the outsourced function satisfies para 24 criteria (para 26, Attachment A(c)). This interacts with contractual, procurement and operational risk frameworks and with any separate prudential standards or guidance APRA has for outsourcing or operational resilience (although SPS 220 does not itself cross‑reference other specific prudential standards by number).

• Group arrangements and cross‑jurisdictional groups: Where an RSE licensee is part of a corporate group and uses group policies or functions, the Board must approve that use and the RMF must document linkages and differences and specify processes for monitoring and reporting to the group (paras 9, 17). That requires attention to internal group governance arrangements, shared services agreements, legal entity boundaries and allocation of responsibilities, and could intersect with corporate law duties and intra‑group service contracts.

Audit, accounting and data obligations

• Internal and external audit interactions: The requirement for satisfactory internal audit procedures and external audit arrangements to enable attestation that risk management and control systems are effective (para 30) aligns SPS 220 with auditing standards and obligations to produce accurate financial and statistical information to APRA (Attachment A(f)-(g)). Those obligations implicate auditors’ workpapers, attestations and the coordination between audit cycles and APRA reporting cycles.

Limits and gaps in statutory cross‑referencing

• SPS 220 does not itself set out enforcement provisions beyond APRA’s powers to require amendments and to vary requirements (paras 23, 37). It does not detail how its duties intersect with criminal or civil sanction regimes, although it sits within the SIS Act statutory framework as the enabling instrument (para 1). Practitioners should therefore map SPS 220 obligations to the broader SIS Act enforcement provisions and other APRA standards and guidance when assessing legal risk.

In sum, SPS 220 is positioned as a prudential governance standard that integrates with APRA’s data collection regime (FS(COD) Act), the SIS Act trustee and licensing environment, auditing and reporting obligations, and group/outsourcing contractual arrangements. It creates operational touchpoints with those frameworks through timing, attestation, and supervisory tailoring powers.

The instrument as provided contains its inception and immediate predecessor context. The text in Attachment A records the administrative acts by which the current Standard was made and the earlier Standard revoked.

• Revocation and determination: The Determination recorded in Attachment A states that Heidi Richards, delegate of APRA, revoked Superannuation (prudential standard) determination No. 2 of 2012, including Prudential Standard SPS 220 Risk Management made under that Determination, and determined Prudential Standard SPS 220 Risk Management in the form set out in the Schedule (Attachment A, Determination text). That instrument is identified as Superannuation (prudential standard) determination No. 3 of 2019.

• Commencement date: The Determination took effect on 1 January 2020 (Attachment A, Determination text; para 4). The date on the Determination is 4 December 2019 (Attachment A, Determination text).

• Authority and enabling clause: The Standard is made under subsection 34C(1) and subsection 34C(6) of the SIS Act as referenced in the Determination preamble (Attachment A, Determination text; para 1). The Determination both revokes the 2012 standard and establishes the 2019 version as the operative SPS 220.

• No subsequent amendments recorded in the provided text: The document provided does not include any further amendment history beyond the 2019 Determination revoking the 2012 instrument and fixing commencement on 1 January 2020. The Standard’s text itself contemplates APRA discretion to adjust or exclude specific requirements for particular RSEs (para 37) and to require RMS amendments or separate RMSs (para 23), but those are supervisory powers rather than legislative amendments.

Practical consequences of the amendment history as recorded

• Transitional and continuity considerations: Revocation of the 2012 Determination and establishment of the 2019 Determination suggest that SPS 220 as of 1 January 2020 replaced the earlier standard; RSE licensees were required to ensure compliance with the new text by that commencement date (para 4). The Determination is the formal instrument recording that change (Attachment A).

• APRA’s ongoing ability to tailor: Although the text shows a one‑time revocation and replacement in 2019, the Standard itself gives APRA the continuing ability to require changes in an RMS for specific RSEs or to adjust/exclude requirements (paras 23, 37). Those supervisory actions would not be amendments to the Standard itself but entity‑specific variations effected by APRA notices.

• Evidence trail in governance and compliance: When considering compliance and audit trails, the Determination’s date and commencement are the relevant points for retrospective compliance assessments or historical risk management reviews. Boards and auditors should reference the 2019 Determination and the 1 January 2020 commencement when reviewing historical processes and remedial steps.

The provided text does not present any later amendments, consultative drafts, or subsequent determinations. If practitioners need a complete legislative history beyond revocation of the 2012 Determination and the 2019 Determination setting the Standard, they should consult APRA records and the Federal Register of Legislation for any instruments or variations issued after the Determination date.

The text of SPS 220 and its Determination record do not provide any litigation history or judicial decisions interpreting the Standard. The instrument itself contains no references to cases, judicial reviews, or past enforcement proceedings. Therefore, the document does not supply examples of contested applications of its provisions or appellate authority clarifying ambiguous terms within the Standard.

What the absence of litigation detail means in practice

• No precedents stated in the text: The Standard’s drafters did not annotate it with examples of APRA enforcement actions, disputes or judicial determinations. Practitioners cannot rely on the instrument itself for case law or precedent about how terms like “material”, “appropriate”, “adequate”, “significant breach” or “material deviation” have been interpreted by courts or tribunals.

• Potential for administrative dispute: The Standard gives APRA discretion to require amendments to RMSs (para 23) and to adjust or exclude requirements by notice (para 37). Disagreements between APRA and RSE licensees about whether an RMS is adequate, or whether a prudential requirement should have been varied, could give rise to administrative decisions subject to merits or judicial review. The Standard does not, however, record whether any such reviews have occurred.

• Reliance on broader jurisprudence: Because SPS 220 is an instrument under the SIS Act, any litigation that engages its provisions would likely involve arguments founded on statutory interpretation of the enabling powers in the SIS Act, APRA’s exercise of discretion, procedural fairness, and adequacy of reasons. The Standard itself does not contain case references or guidance on dispute resolution pathways.

Practical steps for lawyers and compliance officers given the lacuna

• Expect that legal interpretation issues will arise on the margins: Ambiguities in terminology (for example, the meaning and measurement of “material” or “significant breach”) will likely be resolved by reference to administrative law principles, APRA supervisory practice, and any relevant case law under the SIS Act or analogous prudential standards. However, the Standard does not provide in‑text guidance or precedent.

• Keep contemporaneous records: Given the absence of in‑text litigation history, RSE licensees should document decisions, Board approvals, risk assessments and remediation steps carefully to preserve evidence of good faith compliance in the event of APRA query or dispute.

• Monitor APRA guidance and decisions elsewhere: Because the Standard contains broad terms and supervisory discretions, any APRA guidance notes, regulatory determinations, or decisions in other prudential contexts may be informative. The Standard itself does not supply that material.

In short, the document contains no litigation history. Any judicial treatment or administrative review of SPS 220’s application will need to be sourced from case law, tribunal decisions, or APRA determinations external to the Standard.

SPS 220 uses operationally demanding and judgment‑sensitive language and sets hard timing obligations for reporting. Several areas are likely to cause compliance friction, ambiguity or unforeseen costs if not handled deliberately.

1. Broad and qualitative standards require judgement

• Terms such as “material risk”, “appropriate”, “adequate”, “reasonable assurance”, “significant breach” and “material deviation” are used repeatedly without numeric thresholds (paras 6, 10, 15, 35). Boards must apply entity‑specific judgement to translate these into measurable criteria. That creates interpretative risk and may invite APRA scrutiny where RSEs’ calibrations differ.

2. Board ultimate responsibility despite group or outsourced arrangements

• Even where the RSE relies on group policies, functions or an external risk function, the Board remains ultimately responsible and must approve reliance on group arrangements (paras 7, 9, 25-26). This means that transferring operational delivery does not reduce Board liability or the need for governance evidence. Boards must be able to demonstrate active oversight and decision‑making about group reliance, including documentation of linkages and differences (para 17).

3. Notification timeframes compress remediation windows

• The 10 business‑day obligation to notify APRA of a significant breach or material deviation (para 35) shortens the window to investigate, remediate and formalise a response before APRA is informed. RSEs need protocols ready to determine whether an event meets the “significant” or “material” threshold and to prepare an immediate notification with sufficient facts.

4. Annual declaration is a contemporaneous representation with two director signatures

• Attachment A requires the Board, via two director signatures, to attest to a set of matters including systems for prudential compliance, adequacy of RMF and outsourcing risk assessment (Attachment A(a)-(c), (e)). A qualified declaration must describe material deviations and steps to remedy them (para 34). Signing directors should ensure that documentary evidence supports every attestation to avoid contradicting statements to APRA.

5. MIS adequacy includes stress conditions

• MIS must be adequate both under normal circumstances and in periods of stress to measure, assess and report on all material risks (para 16(f)). This is more than routine reporting capacity; it implies stress‑testing capability and capacity to escalate and report under stress, which often requires investment in systems and scenario planning.

6. Reviews and audit independence obligations

• Comprehensive reviews must be conducted by operationally independent, competent persons at least every three years (para 27). Internal audits and external audit arrangements are required to enable attestations of effectiveness (para 30). The independence qualifications and competency expectations are not numerically defined, leaving room for APRA challenge if reviewers are insufficiently independent or qualified.

7. APRA’s ability to require separate RMSs or adjust requirements

• APRA may require an RSE to amend its RMS or to produce separate RMSs for specific RSEs where the RMS is deemed inadequate (para 23), and may adjust or exclude a prudential requirement by notice (para 37). RSEs should expect that APRA may tailor requirements in ways that increase workload and complexity, and the Standard does not prescribe appeal paths or timelines for such notices.

8. Outsourcing is permitted but not a de‑risking shortcut

• Paras 25-26 and Attachment A(c) allow group or external provision of the risk function, but only where the function satisfies the operational independence, access and authority criteria in para 24. Boards must evidence their assessment of outsourcing operational capability and controls, which can be resource‑intensive and expose the RSE to third‑party vendor risks.

9. Alignment with APRA reporting cycles required

• The annual declaration is due to APRA on the day the RSE is required to submit annual information under APRA reporting standards under the FS(COD) Act (para 33). Failure to align corporate reporting cycles with APRA’s timetable may result in late or qualified submissions.

10. Contagion risks from non‑superannuation business

• If the RSE conducts non‑superannuation business, the RMF must cover material contagion risks from that business to the superannuation business (para 13). That requires cross‑business scenario analysis and may generate additional control and separation requirements.

These points translate into concrete tasks: the need for measurable risk tolerances, documented approval of group policies, a fast breach‑notification playbook, upgraded MIS and stress testing capability, third‑party risk due diligence protocols, and calendar coordination with APRA reporting. Boards should be prepared to justify calibrations and to support attestations with contemporaneous evidence.

This section translates SPS 220’s prescriptive elements into a compliance checklist and practical sequence of activities tied to the Standard’s paragraphs. The objective is to produce documentary evidence, governance decisions and operational capability that align with SPS 220.

1. Establish and document the RMF (paras 5-6, 14-16)

   • Produce a formal RMF document that describes systems, structures, policies, processes and people for identifying, assessing, managing, mitigating and monitoring material risks (para 6).
   • Ensure the RMF demonstrates reasonable assurance that material risks are prudently and soundly managed considering size, business mix and complexity (para 15).
   • Include a documented review process for the RMF (para 16(g)).

2. Determine material risks and calibrate materiality (paras 10-13, 11)

   • Map risks to the mandatory categories: governance, investment governance, liquidity (including liquidity characteristics of investment options), operational, insurance, and strategic/tactical risks (para 12).
   • For entities with non‑superannuation business, assess and document contagion risks to the superannuation business (para 13).
   • Record the materiality assessment methodology and its application across each RSE and the combined business operations (para 11).

3. Draft and approve the risk appetite statement (paras 19-20)

   • Prepare a Board‑approved risk appetite statement covering business operations and each category of material risk (para 19).
   • Articulate risk appetite in relation to beneficiary interests and where possible set measurable risk tolerances and limits (para 20(a)-(b)).
   • Document the process for setting and reviewing tolerances and breach responses (para 20(c)-(e)).
   • Board minutes should record approval and the basis for chosen tolerances.

4. Prepare the RMS and ensure Board approval (paras 21-22)

   • Draft an RMS that describes the entity’s strategy for managing each material risk, policies, procedures and last revision/next review dates and responsible owners (para 22(a)-(b)).
   • Include processes for identifying/assessing risks and controls, establishing/testing mitigants, escalation for material incidents, mechanisms for ongoing prudential compliance, and alignment with business plans (para 22(b)(i)-(v)).
   • Clearly define roles and responsibilities for the RMF, and the relationships between Board, board committees and senior management (paras 22(c)-(d)).

5. Designate and resource the risk management function (para 24)

   • Appoint a risk management function that is operationally independent and appropriately resourced with staff who have defined roles and suitable experience (para 24(a)-(c)).
   • Ensure the function has access to all relevant systems, including IT, and has authority to report to Board/committees/senior management (para 24(d)-(e)).
   • Put a formal requirement for the function to notify the Board of material deviations or breaches (para 24(f)).
   • If relying on a group or external provider, document how the provider satisfies para 24 criteria and obtain Board approval for group policy reliance (paras 9, 25-26).

6. Build an MIS and stress reporting capability (para 16(f))

   • Implement an MIS capable of measuring, assessing and reporting on material risks in normal operations and under stress (para 16(f)).
   • Document the data sources, reporting frequency, escalation thresholds and stress scenarios used.

7. Implement policies, procedures and controls (paras 16(d), 22(b))

   • Maintain a policy library with review dates and owners, covering identification/assessment, mitigation, testing, incident reporting, and prudential compliance (para 22(b)(i)-(iv)).
   • Record evidence of implementation and control effectiveness.

8. Set up reviews and audit arrangements (paras 27-30)

   • Schedule comprehensive independent reviews at least every three years and interim annual reviews in other years (paras 27-28).
   • Ensure reviewers are operationally independent, trained and competent and document their qualifications (para 27).
   • Establish internal audit procedures and external audit arrangements to support attestations (para 30).
   • In the event of material changes outside review cycles, conduct prompt assessments (para 31).

9. Prepare for the annual risk‑management declaration and board sign‑off (paras 32-34, Attachment A)

   • Compile evidence covering Attachment A items: systems for prudential compliance, appropriateness of systems/resources, outsourcing risk assessment, effectiveness of control systems, RMS compliance, reliability of financial information, adequacy of reporting systems and accuracy of information provided to APRA (Attachment A(a)-(h)).
   • Prepare a template declaration and Board pack timed to APRA’s FS(COD) Act reporting schedule so it can be submitted as required (para 33).
   • Ensure two directors sign the declaration and that any qualified declaration includes descriptions of material deviations and remediation steps (para 34).

10. Put in place notification procedures (paras 35-36)

    • Create event assessment protocols to decide whether an incident is a “significant breach” or “material deviation” and require notification to APRA within 10 business days (para 35).
    • Maintain a register of notifications and communications with APRA and ensure timely follow‑up.

11. Document group reliance and outsourcing decisions (paras 9, 17, 25-26, Attachment A(c))

    • Where using group policies or relying on group or external risk functions, prepare documentation showing Board approval, an analysis of linkages and differences, monitoring/reporting processes to the group, and evidence the outsourced function meets para 24 requirements (paras 9, 17, 25-26).
    • Document outsourcing risk assessments as required by Attachment A(c).

12. Maintain change control and readiness for APRA direction (paras 23, 37)

    • Keep records in a way that allows rapid RMS amendment if APRA requires changes or separate RMSs for particular RSEs (para 23).
    • Record procedures for responding to an APRA adjustment or exclusion notice and for seeking clarifications where required (para 37).

13. Evidence trail and record retention

    • Maintain minutes of Board approvals for the RMF, risk appetite, RMS and any reliance on group/external functions.
    • Keep reviewer and auditor reports, evidence of remediation, stress test results, MIS output, and copies of all submissions and notifications to APRA.

14. Practical sequencing and timelines

    • Align RMS and risk appetite review cycles with annual reporting deadlines to ensure the Board’s declaration is supported by up‑to‑date materials (para 33).
    • Schedule the three‑year comprehensive review and interim annual reviews so there is a continuous audit trail.

This compliance roadmap should be converted into concrete policies, owner responsibilities and calendars. Boards should ensure that two directors have the necessary information to sign the annual declaration and that the RMF records are sufficiently detailed to withstand APRA scrutiny under the Standard’s requirements.