Review of the risk management frameworkReview of the risk management framework

Review of the risk management framework

27. An RSE licensee must ensure that the appropriateness, effectiveness and adequacy of its risk management framework are subject to a comprehensive review by operationally independent, appropriately trained and competent persons at least every three years.

28. An RSE licensee must also undertake, for each year during which a comprehensive review does not take place, a review of the appropriateness, effectiveness and adequacy of the risk management framework.

29. The scope of the comprehensive review of an RSE licensee’s risk management framework must have regard to the size, business mix and complexity of the RSE licensee's business operations, the extent of any change to those operations or its risk appetite and any changes to the external environment in which the RSE licensee operates. The review of the risk management framework must, at a minimum, include a review of:

(a) whether the risk management framework remains appropriate for the RSE licensee’s business operations;

(b) the specific resources utilised, at a minimum, to undertake the risk management activities required by this Prudential Standard and whether these activities are supported by adequate resources;

(c) the risk appetite statement;

(d) the RMS, to ensure that it accurately documents the RSE licensee’s risk management framework and the RSE licensee’s strategy for managing risk;

(e) all risk management policies and procedures; and

(f) all risk management and internal control systems.

30. An RSE licensee must implement satisfactory internal audit procedures and external audit arrangements to ensure compliance with the risk management framework and enable the RSE licensee to attest that the risk management and internal control systems in place are operating effectively and are adequate.[16]

31. Where institutional, operational or other developments that materially affect the size, business mix and complexity of an RSE licensee’s business operations are identified outside the comprehensive review required in paragraph 27, the RSE licensee must assess whether any amendment to, or a review of, the risk management framework is necessary to take account of these developments.