Review and audit

1. An RSE licensee must review the appropriateness of its ORFR target amount and tolerance limit at least annually and following a material operational risk incident or material change to the RSE licensee’s business operations. The findings of the review must be reported to the Board.
2. An RSE licensee must implement satisfactory internal audit procedures and external audit arrangements to ensure compliance with, and the adequacy and effectiveness of, the ORFR strategy.[8]
3. APRA may require the appointment of an external expert to provide an assessment of, and report on, the adequacy and effectiveness of, the RSE licensee’s approach to meeting the requirements of this Prudential Standard. The report must be paid for by the RSE licensee and must be made available to APRA, together with the Board’s preliminary response within 30 business days after it has been provided to the RSE licensee.