Risk Management Framework

Document control

1. Purpose

This Framework sets out how [Organisation] identifies, assesses, manages, monitors and reports the risks that could affect its objectives, its customers and the community. It ensures that:

2. Scope and application

This Framework applies to all employees, contractors, directors and officers of [Organisation] and its subsidiaries, to all business units, products, services, systems and locations, and to risks arising from service providers and other third parties. CPS 220 para 20 describes the risk management framework as the totality of systems, structures, policies, processes and people that identify, measure, evaluate, monitor, report and control or mitigate all internal and external sources of material risk; SPS 220 para 6 uses similar wording (identify, assess, manage, mitigate and monitor). This document is the top of that framework.

3. The core idea

Risk appetite + effective controls = management of risk. Everything else in this Framework, and in every other RiskFA document, is how we speak about, document and report it.

4. Principles

The Framework applies the risk management principles in AS ISO 31000:2018 clause 4. Risk management at [Organisation] is:

5. Risk governance and the three lines of accountability

The Board is ultimately responsible for the risk management framework and for overseeing its operation by management (CPS 220 para 9; SPS 220 para 7). [Organisation] uses three lines of accountability, so that every risk has an owner, independent challenge and independent assurance.

5.1 Board and committee structure

6. Roles and responsibilities

7. The document hierarchy

Risk management documents fit in one hierarchy. A lower document must not conflict with a higher one. Appendix E shows the hierarchy in full.

8. Risk taxonomy

9. Risk appetite

Risk appetite is the amount and type of risk [Organisation] is willing to accept in pursuit of its objectives. It is set by the Board and written in the RiskFA Risk Appetite Statement. Risk tolerances / limits are the measurable boundaries that put appetite into practice.

9.1 How appetite is used

• Cascade. Board-level appetite statements and metrics are cascaded into limits for business units, portfolios and risk types, owned by named executives.
• Decisions. Strategy, business plans, new products, major changes and material service provider arrangements must show their effect on the risk profile against appetite (CPS 220 para 33; CPS 230 para 25).
• Monitoring. Each appetite metric has an early warning trigger and a tolerance limit, monitored through KRIs (section 14).
• Breaches. A tolerance or limit breach is escalated by the risk owner to the CRO within [24 hours], and by the CRO to the Board Risk Committee chair within [2 business days], with an action plan to return within appetite (RiskFA Risk Appetite Statement section 17). Breaches are recorded as issues under the RiskFA Incident & Issues Management Standard.
• Review. The Risk Appetite Statement is reviewed at least [annually] and when strategy or the external environment changes materially.

10. The risk management process

[Organisation] follows the risk management process in AS ISO 31000:2018 clause 6. It applies to enterprise risks, business unit risks, projects, change, new products and individual decisions.

11. Rating risks

All risks are rated on the RiskFA common rating scale: Critical, High, Medium, Low. The same scale is used for risks, incidents and issues, so that a High risk and a High incident mean the same level of concern.

11.1 How to rate a risk

1. Rate the consequence on each of the six impact categories in Appendix B: Financial; Customers; Regulatory and legal; Operations and critical operations; Information security and privacy; Reputation. Use the realistic worst case, not the worst imaginable case. The consequence level is the highest reached in any one category.
2. Rate the likelihood of that consequence occurring over the next [12 months], using Appendix C.
3. Read the rating from the 5×5 matrix in Appendix A.
4. Record the reasons for each rating, the information relied on and its limitations (CPS 220 para 9(g) requires the Board to recognise the uncertainties, limitations and assumptions in measuring material risks).

11.2 Inherent, residual and target risk

11.3 Response by residual rating

12. Controls

A control is any measure that maintains or modifies risk (AS ISO 31000). CPS 220 para 19 requires a risk management framework that enables the entity to develop and implement strategies, policies, procedures and controls to manage material risks. CPS 230 requires internal controls designed and operating effectively (para 15(c)), designed, implemented and embedded in line with risk appetite (para 28), and regularly monitored, reviewed and tested (para 29). ASIC expects AFS licensees to establish controls designed to manage or mitigate risks and to fully implement and monitor them to ensure they are effective (RG 104.62).

12.1 Types of control

12.2 Key controls

A key control is a control that, on its own or with a small number of others, keeps a material risk within appetite, so that if it failed the residual risk would rise by at least one rating level or move outside appetite. Every Critical or High inherent risk must have identified key controls. Key controls are tested by second or third line at least [annually], and the Board oversees the effectiveness of key internal controls in keeping operational risk within appetite (CPS 230 para 21(a)).

12.3 Design and operating effectiveness

12.4 Control monitoring and testing

• Control owner attestation (first line): control owners confirm [quarterly] that their key controls operated, with evidence.
• Control testing: first line quality assurance, second line assurance reviews and Internal Audit test design and operating effectiveness. Testing frequency must be commensurate with the materiality of the risk (CPS 230 para 29); as a guide, key controls for Critical and High inherent risks are tested at least [annually], others at least every [2–3 years].
• Test methods include inquiry, observation, inspection of evidence, re-performance and automated or continuous testing of system data. Samples are sized to the frequency of the control.
• Results of testing are reported to senior management, and gaps or deficiencies are fixed in a timely manner (CPS 230 para 29), through issues under the RiskFA Incident & Issues Management Standard.
• Triggers to reassess a control: an incident or near miss, a KRI breach, a change to the process, system or service provider, an audit or regulator finding, or a change in the risk.

13. Risk and control self-assessment (RCSA)

The RCSA is how the first line regularly assesses its risks and controls, with second line challenge. It supports the comprehensive assessment of the operational risk profile required by CPS 230 para 26, and the identification and assessment of material risks and controls required by CPS 220 para 35(a) and SPS 220 para 22(b)(i).

14. Key risk indicators (KRIs)

A key risk indicator is a measure that gives early warning of a change in a risk's likelihood or consequence, or in the effectiveness of its controls. KRIs link day-to-day data to risk appetite.

15. Scenario analysis and stress testing

Scenario analysis and stress testing test whether the organisation could withstand severe events and whether its appetite, capital, liquidity and controls are adequate.

16. Emerging risks

An emerging risk is a new or changing risk whose likelihood, consequence or timing is uncertain and that could become material, such as new technology, new regulation, geopolitical change or a shift in customer behaviour.

17. Change, new products and strategic decisions

• Strategic objectives and the business plan must be assessed for the material risks they create, and those risks managed through this Framework, including how changing the plans affects the risk profile (CPS 220 para 33; SPS 220 para 18).
• The impact of business and strategic decisions on the operational risk profile and operational resilience, including new products, services, geographies and technologies, must be assessed as part of planning (CPS 230 para 25).
• New products, material changes to products, systems or processes, new material service providers, outsourcing and acquisitions follow the [New Product and Change Approval Policy]: a risk assessment using this Framework, second line review and approval at the right level before launch.
• A material change to the size, business mix or complexity of operations triggers an assessment of whether this Framework needs to change (CPS 220 para 48; SPS 220 para 31).

18. Incidents, issues and risk acceptance

• Incidents, near misses and issues are identified, recorded, rated, escalated, notified, investigated and closed under the RiskFA Incident & Issues Management Standard, using the rating scale in this Framework. CPS 230 para 31 requires incidents and near misses to be taken into account in the assessment of the operational risk profile and control effectiveness in a timely manner.
• Every Critical or High incident and every issue is linked to the affected risks and controls, and the RCSA is updated.
• A risk outside appetite may be accepted only formally, by a person with the right authority, with reasons, interim controls and a review date of no more than [12 months]. Acceptances outside appetite need Board Risk Committee approval. A risk acceptance can never be used for a breach of law or for ongoing customer harm.

19. Risk culture

Risk culture is the shared values, beliefs and behaviours that shape how people identify, discuss and act on risk. The Board must form a view of the risk culture, and the extent to which it supports the organisation operating within its risk appetite, identify any desirable changes and ensure steps are taken to address them (CPS 220 para 9(b)). The Risk Management Strategy must outline how all persons are made aware of the framework and how an appropriate risk culture is instilled (CPS 220 para 30(e); SPS 220 para 22(f)). ASIC expects fund operators to foster a strong risk management culture (RG 259.37).

20. Risk reporting and the Board

The management information system must give the Board, Board committees and senior management regular, accurate and timely information on the risk profile, in normal conditions and in stress (CPS 220 paras 23(g), 25; SPS 220 para 16(f)). CPS 230 para 21(a) requires the Board to receive regular updates on the operational risk profile.

21. Review, assurance and regulatory obligations

21.1 Reviews of this Framework

21.2 Risk management declaration

• ADIs and insurers: the Board makes an annual risk management declaration to APRA covering the matters in CPS 220 Attachment A, signed by the Board chair and the Board Risk Committee chair (para 49). It must be qualified if there has been a significant breach of, or material deviation from, the framework (para 50). It is submitted within four months of the annual balance date for an ADI or authorised banking NOHC that is not a disclosing entity and for a Level 3 Head, otherwise within three months (para 51).
• RSE licensees: the Board provides an annual risk management declaration signed by two directors covering SPS 220 Attachment A (para 32), on or before the day annual information is due under APRA's reporting standards (para 33). A qualified declaration describes any material deviation and the steps to remedy it (para 34).
• [Organisation] supports the declaration with: the annual Framework report; certifications from executives and accountable persons on risks and controls in their areas; the results of the annual and comprehensive reviews; and a list of significant breaches and material deviations.

21.3 Notifications to APRA about the Framework

21.4 How CPS 220 and CPS 230 fit together

• CPS 220 (or SPS 220) sets the enterprise risk management framework for all material risks. CPS 230 sets specific requirements for operational risk, business continuity and service providers.
• Operational risk management must be developed and maintained as part of the risk management framework required under CPS 220 and SPS 220 (CPS 230 para 15) and integrated into the overall framework and processes (para 17). It is not a separate framework.
• CPS 230 applies to RSE licensees as well as ADIs and insurers (CPS 230 para 2(e)). The reissued CPS 230 (determination No. 1 of 2026) commenced on 1 July 2026 (para 6).
• This Framework provides the shared elements both standards rely on: governance, appetite, taxonomy, rating scale, controls, RCSA, KRIs, incidents and issues, and reporting. The RiskFA Operational Risk Management Policy, the RiskFA Business Continuity Policy and [Service Provider Management Policy] add the CPS 230 specifics.

22. Accountability and compliance with this Framework

• Every material risk has a named risk owner, and every key control a named control owner. For FAR accountable entities, the risk and control responsibilities of accountable persons are consistent with their accountability statements and the accountability map (FAR Act ss33–34).
• Breaches of this Framework (for example operating outside appetite without escalation, failing to record risks or incidents, or not testing key controls) are recorded as issues, reported to the CRO and managed under the RiskFA Consequence Management Framework.
• Exemptions from this Framework need the written approval of the CRO, are time-limited and are reported to the Board Risk Committee.

23. Related documents

• RiskFA Risk Appetite Statement
• RiskFA Incident & Issues Management Standard
• [Risk Management Strategy], [Business Plan], the RiskFA Operational Risk Management Policy, the RiskFA Compliance and Breach Reporting Policy, the RiskFA Cyber Security Policy, [Service Provider Management Policy], the RiskFA Business Continuity Policy, [New Product and Change Approval Policy]
• the RiskFA Whistleblower Policy, the RiskFA Remuneration Policy and the RiskFA Consequence Management Framework
• APRA: CPS 220 Risk Management and CPG 220 Risk Management; SPS 220 Risk Management; CPS 230 Operational Risk Management and CPG 230; CPS 234 Information Security; CPS 510 and SPS 510 Governance; SPS 515 Strategic Planning and Member Outcomes; CPS 511 Remuneration; CPG 229 Climate Change Financial Risks
• Legislation: Financial Accountability Regime Act 2023; Corporations Act 2001 s912A
• ASIC: RG 104 AFS licensing: Meeting the general obligations; RG 259 Risk management systems of fund operators
• Standards: AS ISO 31000:2018 Risk management — Guidelines

Appendix A. Rating matrix

Read the rating where the likelihood row meets the consequence column. Likelihood is defined in Appendix C and consequence in Appendix B.

Appendix B. Consequence descriptors

Rate each impact category, then take the highest. Columns 5 to 2 are the same thresholds as Critical, High, Medium and Low in section 8 of the RiskFA Incident & Issues Management Standard.

Appendix C. Likelihood scale

Rate the likelihood of the consequence you rated (not of any event at all) over the assessment period of [12 months]. Use the description, the frequency or the probability, whichever fits the information available.

Appendix D. Glossary of core terms

Appendix E. Document hierarchy

Appendix F. Map to CPS 220 and SPS 220 requirements

Use this map to show where each minimum element of the risk management framework is met. Elements met outside this Framework are named in the right-hand column.