Draft Prudential Practice Guide

CPG 220 – Risk Management

January 2014

www.apra.gov.au
Australian Prudential Regulation Authority
Disclaimer and copyright
This prudential practice guide is not legal advice and
users are encouraged to obtain professional advice
about the application of any legislation or prudential
standard relevant to their particular circumstances and
to exercise their own skill and care in relation to any
material contained in this guide.
APRA disclaims any liability for any loss or damage
arising out of any use of this prudential practice guide.
© Australian Prudential Regulation Authority (APRA)
This work is licensed under the Creative Commons
Attribution 3.0 Australia Licence (CCBY 3.0).
This licence allows you to copy,
distribute and adapt this work, provided you attribute
the work and do not suggest that APRA endorses you
or your work. To view a full copy of the terms of this
licence, visit www.creativecommons.org/licenses/
by/3.0/au/.

Australian Prudential Regulation Authority 2

About this guide

Prudential practice guides (PPGs) provide guidance on

APRA’s view of sound practice in particular areas. PPGs
frequently discuss legal requirements from legislation,
regulations or APRA’s prudential standards, but do not
themselves create enforceable requirements.
This PPG aims to assist APRA-regulated institutions
in complying with Prudential Standard CPS 220 Risk
Management (CPS 220) and, more generally, to outline
prudent practices in relation to risk management.
CPS 220 sets out requirements in relation to the
risk management framework of an APRA-regulated
institution, and Level 2 and Level 3 groups. These
requirements include the need for an institution
and group to have a risk management framework
that is consistent and integrated with the risk profile
and capital strength of the organisation, supported
by a risk management function and subject to
comprehensive review.
In this PPG, the term ‘APRA-regulated institution’
refers to an authorised deposit-taking institution,
a general insurer, a life company or an authorised
non-operating holding company (NOHC) and, where
applicable, Level 2 and Level 3 groups.
This PPG is designed to be read together with
CPS 220 and does not address all prudential
requirements in relation to risk management.
Subject to meeting CPS 220, an APRA-regulated
institution has the flexibility to configure its approach to
risk management in a manner best suited to achieving
its business objectives. Not all of the practices outlined
in this PPG will be relevant for every institution and
some aspects may vary depending upon the size,
business mix and complexity of the institution.

Australian Prudential Regulation Authority 3

Contents

Introduction 5

Risk governance 5

Role of the Board 6

Risk management culture 6

Group risk management 7

Risk management framework 7

Material risks 9

Strategic and business planning 9

Risk appetite statement 9

Risk management strategy 11

Risk management function 11

Compliance function 13

Outsourcing 13

Monitoring and reporting 13

Review of the risk management framework 14

Risk management declaration 16

APRA notification requirements 16

Appendix A – Three lines-of-defence risk governance model 18

Australian Prudential Regulation Authority 4

Introduction independent from the first line-of-defence. The
second line-of-defence supports the Board of
1. The information in this guide supports compliance directors (the Board)2 in three key areas, by:
with Prudential Standard CPS 220 Risk Management
(CPS 220). (a) developing risk management policies,
systems and processes to facilitate a
consistent approach to the identification,
Risk governance
assessment and management of risks;
2. R
isk governance refers to the formal structure
(b) providing specialist advice and training to
used to support risk-based decision-making
the Board and first line-of-defence on risk
and oversight across all operations of an APRA-
related matters;
regulated institution. This typically consists of
board committees and management committees, (c) objective review and challenge of:
delegations, management structures, and related
(i) the consistent and effective
reporting.
implementation of the risk management
3. The risk governance structure will be dependent framework throughout the APRA-
on the size, business mix and complexity of the regulated institution; and
APRA-regulated institution. The concepts of risk
(ii) the data and information captured as
ownership, functionally independent review and
part of the risk management framework
challenge, and independent assurance provide a
which are used in the decision-
sound basis for ensuring risks are appropriately
making processes within the business,
identified, assessed and managed.
in particular the completeness and
4. An effective risk governance model contains appropriateness of the risk identification
checks and balances to support appropriate and analysis, ongoing effectiveness of
consideration of risk management throughout risk controls, and prioritisation and
the APRA-regulated institution. APRA considers management of action plans; and
the three lines-of-defence risk management
(d) oversight of the risk profile and its reporting
and assurance model1 to be one that facilitates
and escalation to the Board.
an effective risk governance model for risk
management. This model provides assurance 7. The third line-of-defence comprises the
that there are clearly defined risk ownership independent assurance function and Board Audit
responsibilities with functionally independent Committee, each of whom provides independent
levels of oversight and independent assurance. assurance to the Board that:
5. The first line-of-defence comprises the business (a) the risk management framework is
management who assume ownership of risks. appropriate for the APRA-regulated
Accordingly, business management are responsible institution, consistently implemented and
for day-to-day risk management decision-making operating effectively. This includes an
involving risk identification, assessment, mitigation, assessment of the overall framework and the
monitoring and management. APRA expects effectiveness of risk management practices,
the roles and responsibilities of risk owners including its influence on decision-making; and
to be clearly defined and, where appropriate, (b) the policies, procedures and systems are
incorporated into performance reviews. appropriately designed and consistently
6. The second line-of-defence comprises the specialist implemented to operate effectively.
risk management function(s) and responsible
Board Risk Committee(s) that are functionally
1 For further details refer to Appendix A - Three lines-of-defence risk 2 For the purposes of this PPG, a reference to the Board, in the case of
governance model. a foreign ADI, Category C insurer or an Eligible Foreign Life Insurance
Company, is a reference to the Senior Officer Outside of Australia or
Compliance Committee (as applicable) as referred to in Prudential
Standard CPS 510 Governance (CPS 510).
Australian Prudential Regulation Authority 5
Role of the Board Risk management culture
8. The Board is ultimately responsible for the 13. APRA’s view is that a sound risk management
risk management framework of the APRA- culture (risk culture) is a core element of an
regulated institution. CPS 220 requires a Board to effective risk management framework. Risk culture
ensure that an institution has, at all times, a risk is the combined set of individual and corporate
management framework that governs the way the values, attitudes, competencies and behaviours
institution manages risks arising in the institution. that determine an APRA-regulated institution’s
commitment to, and style of, risk management.
9. The Board may delegate responsibilities to its
committees and senior management but this 14. CPS 220 requires a Board to ensure that a
will not absolve the Board from ensuring its sound risk culture is established and maintained
responsibilities are fulfilled. APRA expects that any throughout the APRA-regulated institution. An
delegation of responsibilities will be accompanied institution’s risk culture is strongly influenced by
by clearly documented roles and reporting the ‘tone at the top’. APRA expects the Board
structures to ensure Board oversight is maintained. and senior management to demonstrate their
commitment to risk management and foster a
10. The Board is directly responsible for the broader
sound risk management environment, in which staff
strategy of the APRA-regulated institution and, in
would be actively engaged with risk management
particular, approving the risk appetite statement,
processes and outcomes, and a risk management
business plan, and risk management strategy.
function that is influential and respected.
Effective design of these documents and related
processes will facilitate their integration, with each 15. The Board influences and communicates its
process appropriately supporting the other. desired risk culture through the APRA-regulated
institution’s business strategy, risk appetite, and
11. The Board of the APRA-regulated institution is
understanding of key risks and capabilities, as well as
responsible for the risk management framework,
how risk management behaviours are encouraged
whether or not risk management and business
and rewarded. In fostering an effective risk culture,
operations are outsourced to a third party or are
it is important that there is consideration of the
performed by another part of a group.
culture across the whole organisation.
12. In determining whether the Board has met its
16. A sound risk culture:
responsibilities, APRA will assess the steps taken by
the Board to ensure, to the best of its knowledge (a) supports transparency and openness of risks,
and having made appropriate enquiries, it meets the internal control environment, events and
its responsibilities. For example, APRA expects a issues, and ensures there are well-designed
Board would determine when risk issues should be processes and effective risk reporting;
escalated to it. Where risk issues have failed to be
(b) encourages awareness of risks and
appropriately escalated, APRA expects the Board
responsibility for managing those risks;
to remedy the failure. APRA takes a pragmatic
approach to assessing whether a Board is fulfilling (c) ensures that appropriate actions are taken
its responsibilities in practice, and will assess steps in a timely manner for issues and risks
taken by the Board to support an appropriate risk identified that are outside of set thresholds
management framework. and tolerances/limits. For example, risk
indicators that remain ‘red’ for extended
periods of time could indicate complacency or
a lack of funding in the overall management of
risk; and

Australian Prudential Regulation Authority 6

 (d) rewards staff for appropriate risk 22. If the APRA-regulated institution is part of an
management behaviours. Typically, this would Australian or international corporate group,
be achieved through incorporating risk APRA expects the institution to assess the
management as a core responsibility within appropriateness of links with the group’s risk
individual roles and responsibilities. management framework and be able to provide a
summary of this assessment.
17. APRA considers that the development of the
desired risk culture would be assisted by a Code of 23. If an APRA-regulated institution is part of an
Conduct, ongoing risk education and awareness international insurance or banking group where
training programs, processes to ensure behaviour the head office or ultimate holding company is
is monitored and managed within risk appetite, outside Australia, and the institution uses the
and robust and prudent risk management policies. group’s risk management framework, APRA
expects the institution to have a documented
18. Remuneration policies will positively influence
summary of how the group framework meets
the desired risk culture if they are designed to
APRA’s requirements for that institution.
encourage and provide incentives to employees
to act responsibly and with integrity, in a manner
consistent and integrated with the APRA-regulated Risk management framework
institution’s risk management framework.3 24. A risk management framework enables an APRA-
regulated institution to identify, analyse and
Group risk management manage the current and emerging material risks
within its business. Effective approaches to risk
19. CPS 220 allows an APRA-regulated institution that
management provide meaningful information
is part of a group to meet the requirements of the
that appropriately supports decision-making and
standard on a group basis, provided that the Board
oversight at each level within the institution. The
of the institution is satisfied that the requirements
risk management framework will ideally support
are met in respect to that institution.
an institution in:
20. APRA expects that the appropriateness of
(a) identifying, analysing and understanding
using a group risk management framework
each of the material risks at all levels of the
would be assessed by that APRA-regulated
institution;
institution according to the size, business mix
and complexity of that institution’s business (b) ensuring that appropriate strategies,
operations. The purpose of this assessment is policies, effective operating controls
to ensure that the group’s framework is ‘fit for and other mitigants are in place and
purpose’ for the institution. operating effectively;
21. APRA expects this assessment by the APRA- (c) p
roviding reliable and meaningful risk
regulated institution to be conducted prior information (reporting) to decision-makers;
to using the group’s framework and after any
(d) ensuring that there is adequate oversight
changes to the group or the institution that
of the risk profile and management
may materially impact on the risk management
framework; and
framework. The institution needs to have a clear
understanding of the reliance on, and interaction (e) facilitating a proactive risk culture.
with, the group’s risk management framework,
and understand the consequences of these
arrangements for the risk profile of the institution.

3 Refer to CPS 510 and Prudential Practice Guide PPG 511 Remuneration on
the design of remuneration policies.

Australian Prudential Regulation Authority 7

25. This is achieved, in part, through a clearly Integration of risk management framework and
articulated risk appetite statement that outlines Internal Capital Adequacy Assessment Process
the APRA-regulated institution’s risk appetite and
29. The risk management framework supports the
risk tolerances within its risk capacity.4
Board and senior management in obtaining
26. APRA expects that the primary focus of an APRA- an appropriate view of the APRA-regulated
regulated institution’s risk management framework institution’s overall risk profile. Reporting
would be the management of risks in a way that is facilitates decision-making and oversight, taking
consistent with both the best interests of depositors into consideration the overall structure and
and/or policyholders and the maintenance of the nature of business and different approaches to
sound financial position of the institution. managing different material risks. In understanding
27. APRA expects the Board and senior management the overall risk profile of the institution, specific
to know and understand the APRA-regulated consideration would be given to:
institution’s operational structure and associated (a) identifying risks throughout the institution
risks. Risk can arise from structures that impede that, in combination, may have a material
transparency, such as special-purpose or related impact on the institution;
structures. APRA expects the Board and senior
(b) understanding the interaction of material
management to consider the implications of
risks throughout the institution. For example,
the institution’s structure in facilitating effective
a failure in processes or systems (operational
risk management.
risk) may result in excess claims being paid
28. Stress testing, including both scenario analysis (underwriting risk); and
and sensitivity analysis, is used to assess a range
(c) risks of contagion arising from issues
of potential impacts on different material risks.
identified with related parties (including any
Stress testing is important in considering potential
non-APRA-regulated activities).
changes that could occur in the external operating
environment, and provides a more forward- 30. APRA requires an APRA-regulated institution,
looking view of an APRA-regulated institution’s risk excluding foreign ADIs, to have an Internal Capital
profile. APRA expects that stress testing would be Adequacy Assessment Process (ICAAP).5 An
based on a combination of robust modelling and ICAAP involves an integrated approach to capital
informed expert judgement, with effective senior adequacy and risk management, aimed at ensuring
management engagement and Board oversight. that the capital held is adequate in the context of
the risk profile and risk appetite of that institution.
An institution’s risk management framework and
ICAAP are required to be integrated and consistent.

5 Refer to Prudential Standard APS 110 Capital Adequacy, Prudential Standard

GPS 110 Capital Adequacy, Prudential Standard LPS 110 Capital Adequacy,
Prudential Standard 3PS 110 Capital Adequacy, and Prudential Practice Guide
4 Refer to CPS 220 for the definitions of risk appetite and risk tolerance.
CPG 110 Internal Capital Adequacy Assessment Process and Supervisory Review.
Risk capacity is the maximum risk an institution can bear.

Australian Prudential Regulation Authority 8

31. An APRA-regulated institution is not required prioritisation and allocation of resources). APRA
to duplicate content between its ICAAP also expects that the relevant components of the
summary statement or ICAAP report and its risk risk management framework would be reviewed
management strategy. However, APRA expects in the context of the institution’s strategic and
that the risk management strategy would contain business planning processes.
sufficient detail to provide a holistic view of the
35. CPS 220 requires a rolling business plan of at
institution’s strategy for managing risk without
least three years’ duration that is reviewed at least
having to source other documents. Where other
annually. A rolling plan supports a medium to
documentation contains additional detail, APRA
long-term view of business objectives, while the
expects that cross-references will be clear and
annual review ensures it is dynamic and updated
up-to-date to facilitate consistency and integration
to reflect current goals.
between the documents.
36. APRA expects the APRA-regulated institution’s
Material risks business plan review process would consider
the impact on the risk profile of the institution’s
32. CPS 220 identifies categories of risk that the risk business operations and identify the potential
management framework must, at a minimum, changes to the material risks. This might include
cover. APRA’s view is that the emphasis on each formal consideration of issues arising from
risk category is likely to differ according to the planned material changes to the institution’s
size, business mix and complexity of the APRA- business operations and risks.
regulated institution. APRA expects that an
institution would be able to demonstrate how it
Risk appetite statement
determines ‘materiality’ of risk categories and to
identify the key risk drivers within each category. 37. The risk appetite statement is used to
Communicating what the institution views as communicate the Board’s expectations of how
material is important to ensure that its approach is much risk on the APRA-regulated institution it is
understood by its staff and is consistently applied willing to accept. APRA’s view is that a reasonable
across its business operations. and easily understood risk appetite statement that
aligns to the approaches used to identify, assess
Strategic and business planning and manage material risk is fundamental to risk
management.
33. CPS 220 requires an APRA-regulated institution to
maintain a business plan that sets out its approach 38. The articulation of risk appetite and risk tolerances
for the implementation of its strategic objectives. is central to a risk appetite statement. Risk
The business plan is an important management appetite is the degree of risk an APRA-regulated
and control tool that enables an institution to institution is prepared to accept in pursuit of
identify how it will achieve its strategic objectives. its strategic objectives and business plan. Risk
tolerances translate risk appetite into operational
34. Fundamental to an effective risk management limits for the day-to-day management of material
framework is a sound business plan that risks, where possible.
is consistent and integrated with the risk
management strategy and risk appetite statement. 39. The development and review of an APRA-
APRA expects that the APRA-regulated regulated institution’s risk appetite statement will
institution’s risk management framework generally be performed as part of the strategic
will provide relevant information to senior and business planning process. The risk appetite
management and the Board to facilitate the statement would provide relevant information
strategy and business planning process (e.g. areas on the Board’s expectations regarding the risk
of increased risk, changes in the environment, appetite, and would in turn be updated to reflect
any changes as a result of the strategic and
business planning process.

Australian Prudential Regulation Authority 9

40. APRA expects that the Board would be actively 43. An APRA-regulated institution would generally
engaged in developing and reviewing the risk use a variety of approaches and processes to
appetite statement, and would be able to assess different material risks. An institution
demonstrate ownership of the statement. APRA with the capability to use risk quantification
considers that this might be achieved, in part, techniques would generally use them in the setting
through reporting and communication processes and monitoring of its risk appetite statement.
and structures that enable the Board and Board Risk quantification techniques may provide an
Risk Committee to: institution with assurance that the risk does not
(a) identify the APRA-regulated institution’s exceed the institution’s risk tolerance and/or risk
overall current risk profile and how capacity. These techniques may not be appropriate
this compares to its risk appetite and for all types of risk. APRA expects that the results
capital strength; of such analysis and testing would be reported
to the Board and/or Board Risk Committee
(b) understand how senior management and be taken into account when establishing
interprets and applies risk tolerances; or reviewing the risk appetite statement. APRA
(c) be satisfied that senior management’s expects the Board to understand the limitations
interpretation and application of the risk and assumptions relating to any models used to
appetite is appropriate; measure components of risk that could materially
affect its decision-making.
(d) appropriately align risk appetite to the
approach adopted in the risk management 44. Where an international insurance or banking group
framework for assessing, monitoring and operates a subsidiary and a branch in Australia,
managing the different material risks; and APRA requires each APRA-regulated institution to
have a risk appetite statement that is tailored to
(e) take factors (a), (b), (c) and (d) into account its risk profile. Although risk appetite may be set
when reviewing the risk appetite statement. by the overseas group on a divisional basis, APRA
41. APRA expects an APRA-regulated institution nevertheless expects the branch risk appetite
to communicate appropriate aspects of its risk statement to provide an overview of the aggregate
appetite statement throughout its business risk profile of the Australian branch operation.
operations to ensure that the risk appetite
statement is understood and consistently Risk appetite
implemented, as appropriate. An appropriate 45. Risk appetite expresses the aggregate level and
summary of the risk appetite statement types of risk that an APRA-regulated institution is
would include relevant information for the willing to assume to achieve its strategic objectives
intended audience. and business plan before breaching its obligations
42. Risk appetite is a key consideration in developing or constraints determined by regulatory capital
policies in relation to key decision-making and liquidity needs.
processes. For example, when an APRA-regulated 46. In APRA’s experience, risk appetite can be
institution develops a business case or agrees to expressed in a number of ways to ensure that
contractual and service level agreements for a it is commonly understood and consistently
material outsourced arrangement, APRA expects applied across an APRA-regulated institution’s
that the risk management framework would be business operations. Generally, the risk appetite
used to identify and assess risks, and that the risk is expressed in the form of high-level qualitative
appetite is considered in the decision-making and statements that clearly capture the institution’s
implementation process. attitude and level of acceptance of different risks.
Where appropriate, the risk appetite statement
may include quantitative measures.

Australian Prudential Regulation Authority 10

Risk tolerance 52. APRA expects that a risk management strategy
would contain sufficient information to
47. Risk tolerances are established for each material
communicate, in general terms, the APRA-regulated
risk, taking into consideration the risk appetite.
institution’s approach to risk management. This
Risk tolerances are based on the maximum level
includes how it identifies, measures, evaluates,
of acceptable risk. To facilitate implementation
monitors, reports, and controls or mitigates the
and monitoring of the risk appetite in day-to-day
material risks of its operations. CPS 220 requires
business activities, an APRA-regulated institution
that the risk management strategy list the policies
may also decide to set risk limits for more granular
and procedures dealing with risk management
risks within each material risk.
matters. Where these policies and procedures
48. Risk tolerances can be expressed in a number require Board approval under other prudential
of different forms depending on the nature of standards, approval of the strategy does not
the risk being managed. They can act as triggers negate the Board’s responsibility to approve those
for considering whether action is necessary in individual documents.
relation to the risk. Where possible, risk tolerance
would be expressed as a measurable limit to Risk management function
enable a clear and transparent monitoring process
that ensures the APRA-regulated institution 53. A key role of an APRA-regulated institution’s risk
remains within the determined risk tolerance. An management function is to assist the Board and
institution may also define key indicators with senior management by providing independent
thresholds around the risk tolerance. and objective review and challenge, oversight,
monitoring and reporting in relation to risks to
49. APRA recognises that, for some risks, the institution’s business operations. An additional
a qualitative risk tolerance may be appropriate. responsibility is to provide technical support
In these circumstances, the APRA-regulated and assist the Board and senior management
institution would be expected to ensure the to develop, implement and maintain the risk
tolerance is well-articulated to enable consistent management framework.
implementation across the institution’s business
operations and to determine when the risk 54. APRA expects that the risk management
tolerance has been exceeded. function would also assist the Board in building
risk management capabilities throughout the
50. Where a risk exposure falls outside the APRA- APRA-regulated institution by providing specialist
regulated institution’s risk tolerance, APRA expects education, training and advice to directors, senior
that the institution would develop and implement management and staff of the institution. It would
a plan of action to review the risk and reduce it to a also typically facilitate the development and
level that is within its acceptable tolerance. implementation of the Board’s desired risk culture
throughout the institution’s business operations.
Risk management strategy 55. APRA expects the roles and responsibilities of
51. CPS 220 requires an APRA-regulated institution the risk management function would be clearly
to formulate, maintain and give effect to a risk defined and documented as part of the risk
management strategy that provides an overview management framework. These responsibilities
of how the risk management framework addresses include assisting with the development and
each material risk for the institution, with reference maintenance of the risk management framework.
to the relevant policies, standards and procedures.

Australian Prudential Regulation Authority 11

56. APRA expects a risk management function to 60. CPS 220 requires an APRA-regulated institution
be appropriately structured to fulfil its roles and to have a process for identifying, monitoring and
responsibilities. This may include placing risk managing perceived, potential and actual conflicts
management personnel within business line of interest. APRA’s requirement for a ‘designated’
divisions or functions. For example, personnel rather than ‘dedicated’ CRO provides scope for
who focus on market risk may be located within the person to have other roles and responsibilities,
a specialist market risk team that is aligned to so long as there is no conflict of interest.
the relevant trading/investment functions.
61. CPS 220 sets out requirements for the
Where risk management personnel are located
independence of the CRO and specifies roles that
across the APRA-regulated institution, these
cannot also be performed by the CRO. CPS 220
personnel would still form part of the overall risk
recognises that an APRA-regulated institution
management function’s reporting structure. It
may seek approval for alternative arrangements to
is important that the roles and responsibilities
those required. This may be where the institution
are clearly understood with clear reporting and
is materially constrained in appointing a CRO who
escalation lines to the designated head of the risk
is free from conflicts of interest, or for reasons
management function, referred to as the Chief
particular to that institution. APRA expects
Risk Officer (CRO), and responsible committees.
these instances to be limited to smaller and less
complex institutions. Where an institution seeks
Chief Risk Officer
an alternative arrangement under CPS 220, the
57. APRA expects the risk management function to Board is expected to demonstrate to APRA that
have sufficient stature, authority and resourcing to it has undertaken a process to identify conflicts,
support sound risk-based decision-making. This is has established structural oversight and controls
reflected in the requirement in CPS 220 that the to mitigate the additional risk, and is satisfied that
CRO, must have authority to provide effective the risk management framework will ensure these
challenge to activities and decisions that may mitigants are adhered to. APRA will assess the
materially affect the institution’s risk profile. appropriateness of alternative arrangements on a
58. This can be further evidenced by a CRO who case-by-case basis. APRA expects that the Board
is appropriately skilled, unencumbered by would take into account the following controls
conflicts of interest with their risk management and other mitigating factors that manage conflicts
role, and can speak with candour to the Chief of interests including, but not limited to:
Executive Officer (CEO), the Board and relevant (a) alternative sources of risk-based challenge to
committees. Under a three lines-of-defence business lines;
model, the role and responsibilities of the CRO are
(b) the resources allocated to risk management;
clearly within the second line.
(c) executive level engagement in risk issues;
59. The stature and authority of the CRO would
be supported by their being a senior executive, (d) the strength of compliance and audit
having an ability to influence material decisions mechanisms;
and remuneration appropriate to their (e) oversight from the Board and its committees;
responsibilities. APRA expects that the CRO’s
authority and participation in decision-making (f) the experience and capabilities of the other
would support risk-based considerations that risk management function personnel; and
are consistent with the institution’s risk appetite (g) the robustness of the regulated institution’s
statement, risk management strategy and business and, where appropriate, the group’s risk
plan. It is important that the CRO provides management framework.
effective challenge as part of their participation
in the decision-making process, ensuring that
material decisions are risk-based.

Australian Prudential Regulation Authority 12

62. CPS 220 requires that the risk management Compliance function
function, via a CRO, has direct and unfettered
access to the CEO, Board, Board Risk Committee 65. CPS 220 requires a designated compliance
and senior management. CPS 220 also requires the function to have a reporting line independent
reporting line for the risk management function to from business lines to support clear and timely
be independent from business lines, which requires reporting of compliance risks. APRA envisages
the CRO to directly report to the CEO. Where that the CRO would be able to provide this
an APRA-regulated institution is part of a group, independent reporting line and that they may
including a Level 2 and/or Level 3 group, the CRO have responsibility for the compliance function.
of that institution may report to the group CRO as Where a CRO is also the head of the compliance
long as the group CRO reports directly to the group function, he or she is expected to effectively fulfil
CEO. Further, the Board of the Level 1 institution the responsibilities for each function.
is expected to demonstrate that the group CRO is 66. Where an APRA-regulated institution combines
fulfilling his or her responsibilities to that institution its risk and compliance functions, APRA expects
on a Level 1 basis. that the institution would allocate sufficient
63. CPS 220 recognises that an Australian branch resourcing to fulfil the roles and responsibilities
operation may seek an alternative arrangement of each function.
for the requirement that the CRO report to the
CEO. A number of Australian branch operations Outsourcing
use a regional or global CRO who assumes the risk 67. APRA does not expect that outsourcing the risk
responsibilities for the branch. Due to their regional management and/or compliance functions would
or global reporting lines, it may be impractical be a common practice. Where an APRA-regulated
to require the CRO to report to the Australian institution considers there is adequate justification,
branch’s CEO. Where this is the case, APRA expects this is considered to be a material business activity
that the designated CRO has sufficient oversight for the purposes of Prudential Standard CPS 231
of, and involvement with, the management of risk Outsourcing (CPS 231).
in the branch. APRA expects the branch would be
able to demonstrate that the CRO can fulfil his
or her roles and responsibilities to the Australian
Monitoring and reporting
institution, evidenced by regular and unfettered
Oversight and escalation processes
access to the Australian branch Senior Officer
Outside of Australia or Compliance Committee. 68. APRA expects an APRA-regulated institution’s risk
management framework to ensure that the Board
64. For the avoidance of doubt, CPS 220 does
and senior management receive regular, concise
not require the designated head of the risk
and meaningful assessment of actual risks relative
management function to be called a CRO.
to the institution’s risk appetite, and the operation
and effectiveness of controls.
69. An APRA-regulated institution’s formal escalation
procedures would ordinarily cover reporting of
exceptions to risk appetite, risk tolerances and
more granular risk limits. This reporting would
include sufficient commentary to facilitate
management review and understanding of the
report content, where necessary.

Australian Prudential Regulation Authority 13

Information systems for business reporting (f) be reviewed regularly to assess the timeliness
70. APRA expects that an APRA-regulated institution and relevance of information generated and
would, as part of its risk management framework, the adequacy, quality and accuracy of the
establish, maintain and document effective system’s performance over time.
Management Information Systems (MIS)
commensurate with the size, business mix and Review of the risk management
complexity of its business operations. framework
71. Effective MIS provide appropriate information at 74. CPS 220 requires an APRA-regulated institution
each level of management and decision-making to have two types of reviews of its risk
within the APRA-regulated institution. Such management framework:
information systems assist in the management,
(a) an annual review that covers compliance
communication and reporting of risk issues and
with, and effectiveness of, the risk
outcomes and assist the management of the
management framework by internal and/or
institution to appropriately monitor and manage
external audit; and
different material risks. The MIS would be
sufficiently flexible to support decision-making (b) a three-year comprehensive review on the
during periods of stress, when the institution’s risk appropriateness, effectiveness and adequacy
profile may significantly change. of the framework by independent experts.
72. APRA envisages that an APRA-regulated institution Annual review
would implement controls for ensuring data in
information and reporting systems is current, 75. APRA will accept annual reviews that explore
accurate and complete. Internal information and particular elements of the risk management
reporting systems would be secure and supported framework in depth and on a rotational basis.
by adequate business continuity and disaster For example, if an institution’s risk management
recovery arrangements.6 framework has six material elements, it may
choose to review two of these every year. The
73. A well-functioning information and reporting annual review signoff would include those
system would typically: reviews conducted during the previous year.
(a) produce appropriate risk and compliance However, APRA expects that all elements of the
data and reports; risk management framework would be subject to
this annual review at least every three years. For
(b) incorporate information that is relevant to
insurers, the annual review required by CPS 220
decision-making;
is separate from the assessment of the suitability
(c) report accurate, reliable and timely and adequacy of the risk management framework
information; conducted by the Appointed Actuary.7 This review
(d) allow the institution to identify, assess must be reported to the Board Audit Committee
and monitor business activities, existing and or, in the case of a Category C insurer, foreign
emerging risks, financial position ADI, or Eligible Foreign Life Insurance Company
and performance; to the Senior Officer Outside of Australia or the
Compliance Committee.
(e) allow the institution to monitor the
effectiveness of, and compliance with, its 76. APRA envisages that some branch operations would
internal control systems and report any be subject to group internal audits of compliance
exceptions that arise; and with, and effectiveness of, its risk management
framework. APRA may approve alternative timing
6 Refer to Prudential Practice Guide CPG 235 Managing Data Risk for further 7 Refer to Prudential Standard GPS 320 Actuarial and Related Matters
guidance. (GPS 320) and Prudential Standard LPS 320 Actuarial and Related Matters
(LPS 320).

Australian Prudential Regulation Authority 14

 to this annual review, such as on a biennial basis, if Committee to oversee the implementation
satisfied that those arrangements will, in APRA’s and appropriateness of the institution’s risk
view, achieve the objectives of this requirement. management framework, while any compliance
APRA will assess the appropriateness of alternative issues identified would be reported to the Board
arrangements on a case-by-case basis with Audit Committee.
considerations including, but not limited to, the:
79. APRA expects these reviews would include
(a) size, business mix and complexity of the an assessment as to whether the framework
branch operations; remains appropriate for the institution and the
risks it faces, whether the framework has been
(b) process the Senior Officer Outside of
consistently implemented, whether there are
Australia or Compliance Committee has
appropriate procedures in place to ensure that
undertaken to satisfy themselves that an
the framework addresses any new risks or changes
alternate timing of review is appropriate;
to existing risks, including lessons learnt from risk
(c) additional controls in place to mitigate the incidents and near misses, and consideration as to
risk of non-compliance in interim years; and whether the framework is effective in providing
(d) robustness of the branch operations and, appropriate, effective and timely information to
where appropriate, the robustness of the inform decision-makers.
group’s risk management framework. 80. An APRA-regulated institution may coordinate
the comprehensive review with the review of its
Comprehensive review ICAAP. Capital management is an essential part of
77. CPS 220 requires the comprehensive review to an APRA-regulated institution’s risk management
be conducted by operationally independent, framework. APRA expects the comprehensive
appropriately trained and competent persons review would not simply be a review of the ICAAP,
at least every three years. This review must be but would assess how the ICAAP is integrated
reported to the Board Risk Committee or, in with other elements of the risk management
the case of a Category C insurer, foreign ADI, framework that are beyond capital management.
or Eligible Foreign Life Insurance Company to 81. In considering whether a person is operationally
the Senior Officer Outside of Australia or the independent, an APRA-regulated institution
Compliance Committee. would take into account any role that the person
78. APRA expects the comprehensive review to may have in connection with the development
include a comparison of the institution’s current or implementation of the framework, or the
practice against better practice. Where any activities under review, that may impact on their
gaps are identified, APRA expects the review ability to perform an objective review. Where an
to outline steps to address these differences or institution is using the group risk management
identify why changing current practice is not framework, APRA expects that a person would not
considered appropriate. The review may draw be operationally independent if they have been
upon the APRA-regulated institution’s internal involved in the development or implementation
resources, such as internal audit reports, to the of that framework.
extent that the independence of the review is not
undermined. For insurers, the Financial Condition
Report assessment of the risk management
framework8 would be taken into account, but
not solely relied upon, for the purposes of the
comprehensive review. This forward-looking
review is intended to assist the Board Risk
8 Refer to GPS 320 and LPS 320.

Australian Prudential Regulation Authority 15

Difference between the annual and qualification to identify whether it related to the
comprehensive review Level 1 institution or the group’s risk management
framework. A qualification for the institution may
82. The difference between the annual and not mean that a group-wide qualification needs
comprehensive review is the depth and scope to be made, and vice-versa. However, where
of the assessment. The annual review is focused a group’s Board has taken the decision that a
on particular elements of the risk management qualification at the institution level does not result
framework. Given the depth of the review, in a group declaration qualification, the reason for
APRA expects internal and/or external audit this decision would be articulated.
would cover all aspects of the risk management
framework according to a rolling audit plan. 86. CPS 220 requires the risk management declaration
to be submitted to APRA in accordance with
83. In contrast, the three-year review provides reporting standards made under the Financial
a holistic, institution-wide view of the risk Sector (Collection of Data) Act 2001, which include:
management framework, including the interaction
between its constituent elements. While (a) for a general insurer - on, or before, the day
the annual review is focused on the current the yearly statutory accounts or group’s
state of the risk management framework, the annual accounts (as appropriate) are required
comprehensive review is to provide an assessment to be submitted to APRA;
and recommendations on the appropriateness (b) for a life insurer - on, or before, the day the
of the framework going forward. APRA expects annual regulatory financial statements are
that the comprehensive review would draw upon required to be submitted to APRA; and
the annual review reports when assessing how
the particular elements of the risk management (c) for an authorised deposit-taking institution -
framework interact. within three months of the annual
balance date or group’s annual accounts
(as appropriate) are required to be submitted
Risk management declaration to APRA.
84. CPS 220 requires the Board to provide APRA
with a risk management declaration on an APRA notification requirements
annual basis. While this declaration does not
have to be audited, APRA expects that the two 87. CPS 220 requires an APRA-regulated institution
directors of the APRA-regulated institution to notify APRA of material changes to the size,
who sign the declaration would have obtained business mix and complexity of the institution’s
reasonable assurance and, if necessary, considered business operations. APRA expects that this would
independent advice on the matters upon which include, but not be limited to, the following
they have made a declaration. material changes:

85. CPS 220 allows an APRA-regulated institution’s (a) events such as proposals relating to major
risk management declaration to be encompassed modifications to, or the re-organisation of,
in the risk management declaration the functions of the institution;
documentation of a Level 2 and/or Level 3 group, (b) proposed acquisitions;
where applicable. Where a Level 1 institution’s
declaration is encompassed within the group (c) changes to business lines and products;
declaration, the Level 1 institution’s Board (d) changes in organisational structure; and
remains responsible for any qualifications in the
(e) deviations from the risk management strategy.
declaration that relate to that institution. Where a
risk management declaration is made on a Level 2
and/or Level 3 group basis, CPS 220 requires any

Australian Prudential Regulation Authority 16

88. CPS 220 requires an APRA-regulated institution
that conducts business outside of Australia to
notify APRA when it becomes aware that its right
to conduct business in any other jurisdiction
has been materially affected. A restriction on
the ability of an institution to conduct business
overseas could impact on its Australian operations,
and may have resulted from weaknesses in risk
management. APRA expects to be informed, at a
minimum, when the institution’s right to conduct
business has:
(a) ceased in a jurisdiction;
(b) been limited by a law of any jurisdiction in
which business is being conducted;
(c) been otherwise materially affected under a
law of any jurisdiction in which business is
being conducted;
(d) otherwise been withdrawn; or
(e) where applicable, changes to the ability
of a group member to conduct business
that materially impacts on the Australian
operation’s risk profile.
89. APRA expects that an APRA-regulated institution
would be in regular dialogue with its supervisors
about potential material changes to the institution.
APRA expects that, at the latest, notification in
accordance with the requirements in CPS 220
would be made within 10 business days of the
Board becoming aware of a current or proposed
material change to the institution’s risk profile or
business operations.

Australian Prudential Regulation Authority 17

Appendix A – Three lines-of-defence risk governance
model
First line-of-defence Second line-of-defence
1. Business management typically includes all levels 5. In order to be effective, the Board would ensure
of management responsible for the business that risk management functions have:
decision making. The first line-of-defence also
(a) adequately experienced staff with relevant
includes management committees and forums.
technical knowledge and experience to
2. A key tenet of the three lines-of-defence model facilitate the development, ongoing review
is that business management cannot abrogate its and validation of the risk management
responsibility for risk management. The first line- framework; and
of-defence is responsible for:
(b) appropriate seniority and authority,
(a) effective implementation of the risk with independent reporting lines to the
management framework, including reporting responsible board committees.
and escalation of the relevant information to
6. Smaller and less complex APRA-regulated
the Board, board committees and responsible
institutions often combine risk management roles
senior management, as appropriate; and
with other roles or functions. Where such dual
(b) managing risk in a way that is consistent roles exist, APRA expects that appropriate care
and integrated with the risk management would be taken to ensure that the independence
framework. of the risk management function is maintained.
3. Executive and senior business management would
ensure risk ownership is clearly defined and that Third line-of-defence
the risk management framework is effectively 7. The application of the third line-of-defence
implemented and supports decision-making. This would vary depending on the size, business mix
would usually include reporting, escalation and and complexity of an APRA-regulated institution.
monitoring procedures that are appropriate for The independent assurance function could, for
the management of different risk categories. example, include internal audit, a third-party
4. The first line-of-defence would have clearly assurance provider or a combination of the
defined and documented roles and responsibilities, two. A key consideration would be ensuring
including the risks that individuals are accountable appropriate independence, technical knowledge
for. These roles and responsibilities would be and experience.
tailored to reflect the risk owner’s ability to 8. While findings raised by the third line-of-defence
control the risk to which they are accountable. would typically be utilised by management to
increase business efficiency and inform decision-
making these benefits are secondary to the
primary assurance objective.
9. CPS 510 requires the separation of the Board Risk
Committee and Board Audit Committee. The
separation of these committees aligns with the
distinct responsibilities for audit’s role in the third
line-of-defence and risk management’s role in the
second line-of-defence for independent assurance
and risk management, respectively.

Australian Prudential Regulation Authority 18

10. Below is a graphical representation of a three lines-of-defence risk governance model:

BOARD
• Establishes a governance structure (board sub- • Sets the institution’s risk appetite and ensure
committees, executive responsibilities and risk that it is clearly communicated.
management and assurance functions.)
• Oversees the institution’s risk profile.
• Oversees the effectiveness of the risk
• Establishes a sound risk management culture.
management framework.

1st line-of-defence 2nd line-of-defence 3rd line-of-defence

Risk owners Review and challenge Independent assurance

Executive and management Board Risk Committee Board Audit Committee

committees, forums and
delegated authority Risk management and Internal audit function/
compliance function(s) 3rd party
Senior management

Implementation and ongoing Independent oversight of the Independent assurance on the

maintenance of the risk management risk profile and risk management appropriateness, effectiveness and
framework, including: framework, including: adequacy of the risk management
framework, including that:
• identification and effective • effective challenge to activities and
management/mitigation of risks; decisions that materially affect the • the framework is used to support
and institution’s risk profile; decision-making;
• issues identification, recording, • assistance in developing and • 1st and 2nd lines-of-defence
escalation and management. maintaining the risk management operate effectively; and
framework; and
• improvements to the 1st and 2nd
• independent reporting lines to lines-of-defence are identified and
appropriately escalate issues. recommended.

Oversight of Management of
Responsibilities
implementation implementation

Australian Prudential Regulation Authority 19

Telephone
1300 55 88 49

Email
[email protected]

Website
PPG_CPG220_012014

www.apra.gov.au

Mail
GPO Box 9836
in all capital cities
(except Hobart and Darwin)