Risk management strategyRisk management strategy

Risk management strategy

21. An RSE licensee must maintain an up–to-date RMS for its business operations that covers each material risk identified under paragraphs 10 to 13 inclusive. The RMS must be approved by the Board.

22. An RMS is a strategic document that describes the RSE licensee’s strategy for managing risk and the key elements of the risk management framework that give effect to this strategy. At a minimum, an RSE licensee’s RMS must describe:

(a) each material risk identified under paragraphs 10 to 13 inclusive and the RSE licensee’s approach to managing these risks;

(b) the policies and procedures dealing with the following risk management matters, including the date when each policy or procedure was last revised, the date that it is next due for review and who is responsible for the review:

(i) the processes for identifying and assessing material risks and controls;

(ii) the process for establishing, implementing and testing mitigation strategies and control mechanisms for material risks;

(iii) the process for monitoring, communicating and reporting risk issues, including escalation procedures for the reporting of material events and incidents;

(iv) the mechanisms in place for monitoring and ensuring ongoing compliance with all prudential requirements[13]; and

(v) the process for ensuring continued alignment between the risk management framework and the business plan;

(c) the role and responsibilities of the risk management function;

(d) the relationships between the Board, board committees and senior management with respect to the risk management framework;

(e) those with managerial responsibility for the risk management framework, and their roles and responsibilities;

(f) the approach to ensuring all persons within the RSE licensee’s business operations have awareness of the risk management framework and for instilling an appropriate risk culture across the RSE licensee’s business operations; and

(g) the process by which the risk management framework is reviewed and the intended coverage and timing for these reviews.

23. APRA may require an RSE licensee to amend its RMS or develop and maintain a separate RMS with respect to one or more RSEs within its business operations where APRA considers that the RSE licensee’s RMS does not adequately cover the risks to that RSE.[14]