APRA has released for consultation a proposed cross-industry prudential standard to harmonise and consolidate its risk management requirements for ADIs and insurers– Prudential Standard CPS 220 Risk Management (CPS 220).

The proposed CPS 220 will replace the existing industry-specific risk management standards for general insurers and life insurers, and will include the risk management requirements for ADIs that are currently spread across a number of ADI prudential standards.

CPS 220 will not apply to the superannuation industry. Instead, RSE licensees must comply with the superannuation-specific risk management prudential standard due to commence on 1 July 2013.

The most important changes contained in CPS 220 are the requirements for:

• a Chief Risk Officer (CRO) who is independent from business lines, the finance function and other revenue-generating capabilities. The CRO must not be the Chief Executive Officer, the Chief Financial Officer, Appointed Actuary or Head of Internal Audit; and
• the establishment of a separate Board Risk Committee that provides objective non-executive oversight of the implementation and on-going operation of the institution’s risk management framework. The Committee must be chaired by an independent director who is not the chair of the Board.The chair of the Board Audit Committee may also chair the Board Risk Committee.

APRA is proposing that the Risk Committee must operate under a different charter than the Board Audit Committee, although APRA’s composition requirements will not prohibit the same people sitting on both committees.

The Board Risk Committee is required to provide prior endorsement for the appointment or removal of the CRO. If the CRO is removed from their position, the reasons for removal must be discussed with APRA as soon as practicable, and no more than 10 business days, after the Committee’s endorsement is agreed upon.

The Board Risk Committee must invite the CRO to attend all relevant sections of meetings of the Committee.

APRA proposes that the chair of the Board and the chair of the Board Risk Committee make an annual attestation as to the adequacy and effectiveness of its risk management framework.

Prudential Standard CPS 510 Governance will also be changed to require the Board Audit Committee to provide prior endorsement for the appointment or removal of the APRA-regulated institution’s auditor and Head of Internal Audit. If the auditor or Head of Internal Audit is removed from their position, the reasons for removal must be discussed with APRA as soon as practicable, and no more than 10 business days, after the Committee’s endorsement is agreed upon.

APRA expects to finalise the proposed CPS 220, updated CPS 510 and a prudential practice guide prior to their implementation date of 1 January 2014.