Risk Taxonomy
One taxonomy. Everything connected.
The common set of risk categories and risk types for Australian financial services. Every RiskFA standard and every obligation in the register is mapped to it, so a risk, the standard that manages it and the obligations that apply are always one click apart.
Risk Taxonomy11 categories, 57 risk types. What can go wrong, named once for the industry.→
Standards17 frameworks, policies, standards and plans that manage each risk type.→
Operations13 typical industry processes mapped from measures of success to causes, risks, controls and obligations.→
Obligations422 regulatory obligations, each tagged to the risk types it addresses and linked from every standard that applies it.
Open a risk type to see its definition, the RiskFA standards that manage it and the obligations that apply. Codes (for example OPS-CYB) are stable, so you can use them in your own risk register. The taxonomy is the one set out in the RiskFA Risk Management Framework.
STRStrategic
The risk that the organisation's strategic objectives, business plan or business model fail or are not achieved, including risks arising from changing those plans.
10 obligations · 2 standards · 4 risk types
STR-BUSBusiness model and strategy2 standards 8 obligations
The risk that the business model or strategy is not viable or is poorly executed.
Obligations
- CPS 230 para 25 Assess change and strategic decisions
- CPS 220 paras 31–33 Business plan and strategic risk
- CPS 220 para 54 Notify APRA of material changes to size, business mix and complexity
- SPS 220 para 18 Strategic and business plan risks
- SPS 220 para 36 Notify APRA of material changes (RSE licensees)
STR-CMPCompetition and market change0 standards 0 obligations
The risk from competitors, new entrants, technology change or changing customer needs.
RiskFA standards
Covered by the Risk Management Framework.Obligations
STR-CAPCapital planning2 standards 3 obligations
The risk that capital is insufficient for the strategy, regulatory requirements or stress.
STR-MNAMergers, acquisitions and major investments0 standards 0 obligations
The risk that major transactions or investments do not deliver the expected value or introduce unplanned risk.
RiskFA standards
Covered by the Risk Management Framework.Obligations
CRDFinancial: credit
The risk of loss from a borrower or counterparty failing to meet its obligations.
8 obligations · 2 standards · 4 risk types
CRD-DEFCounterparty default2 standards 1 obligations
Loss from a borrower or counterparty failing to pay or perform.
CRD-CONCredit concentration0 standards 0 obligations
Loss from large exposures to a single counterparty, sector or region.
RiskFA standards
Covered by the Risk Management Framework.Obligations
CRD-QLTCredit quality and lending standards0 standards 7 obligations
Loss from deteriorating credit quality or weak lending standards.
RiskFA standards
Covered by the Risk Management Framework.In business operations
Banking: Home lending: application to settlementFinance: Consumer lending and financial hardshipObligations
- NCCP Act ss128–129 Assess unsuitability before entering a credit contract or increasing a credit limit
- NCCP Act s130 Make reasonable inquiries and take reasonable steps to verify the consumer's financial situation
- NCCP Act ss131, 133 Assess as unsuitable, and do not enter, unsuitable credit contracts
- Banking Code paras 67–72 Appropriate lending and co-borrower protections (industry code)
- RG 209 RG 209.43–RG 209.172 Reasonable inquiries, verification and use of benchmarks (guidance)
CRD-COLCollateral0 standards 0 obligations
Loss from collateral that is insufficient, unenforceable or falls in value.
RiskFA standards
Covered by the Risk Management Framework.In business operations
Banking: Home lending: application to settlementObligations
MKTFinancial: market and investment
The risk of loss, or of poor outcomes for members, from movements in market prices, rates or investment values.
8 obligations · 2 standards · 4 risk types
MKT-IRBInterest rate risk in the banking book0 standards 0 obligations
Loss of earnings or value from interest rate movements on banking book positions.
RiskFA standards
Covered by the Risk Management Framework.Obligations
MKT-TRDTraded market risk0 standards 0 obligations
Loss on trading positions from movements in market prices.
RiskFA standards
Covered by the Risk Management Framework.Obligations
MKT-INVInvestment performance2 standards 8 obligations
Poor outcomes for investors or members from investment decisions and market movements.
In business operations
Superannuation: Investment management and unit pricing / crediting ratesInvestment: Fund management: investment decision to trade settlementObligations
- Corporations Act s601FC(1)(i)–(k), s601FC(2) Scheme property: identify, hold separately, value regularly and pay out properly
- MIR (Securities Markets) Rules 3.8.1, 3.9.1–3.9.3 Best execution: take reasonable steps to obtain the best outcome for clients
- SIS Act s52(6) Investment covenants: investment strategy for the fund and each option
- SIS Act s52(9) Annual member outcomes assessment
- SPS 515 paras 23–32 Monitoring, annual business performance review and remedial action
MKT-FXForeign exchange0 standards 0 obligations
Loss from movements in exchange rates.
RiskFA standards
Covered by the Risk Management Framework.Obligations
LIQFinancial: liquidity
The risk of being unable to meet obligations, including payments to depositors, policyholders or members, as they fall due.
4 obligations · 2 standards · 3 risk types
LIQ-FNDFunding2 standards 0 obligations
Being unable to obtain or roll over funding at an acceptable cost.
Obligations
LIQ-INVLiquidity of investment options0 standards 4 obligations
Being unable to meet redemptions, switches or benefit payments from investment options.
RiskFA standards
Covered by the Risk Management Framework.In business operations
Superannuation: Investment management and unit pricing / crediting ratesInvestment: Fund management: investment decision to trade settlementObligations
- RG 259 RG 259.89–RG 259.102 Monitor, review and stress test (including liquidity risk)
- Corporations Act s601KA(3)–(6), with s601GA(4) and ss601KB–601KE Withdrawals only in accordance with the constitution and liquidity status
- SIS Act s52(6) Investment covenants: investment strategy for the fund and each option
- SPS 530 paras 30–38 Investment stress testing and liquidity management plan
LIQ-COLCollateral and margin calls0 standards 0 obligations
Being unable to meet collateral or margin calls as they fall due.
RiskFA standards
Covered by the Risk Management Framework.Obligations
INSFinancial: insurance
The risk of loss from inadequate pricing, reserving or claims experience, or (for RSE licensees) from insurance arrangements for members.
15 obligations · 2 standards · 4 risk types
INS-UWPUnderwriting and pricing2 standards 4 obligations
Loss from risks accepted on inadequate terms or prices.
In business operations
Insurance: Underwriting and policy issueObligations
- Insurance Contracts Act s13 Duty of utmost good faith (including in claims handling)
- Insurance Contracts Act s20B Consumer insurance: insured's duty to take reasonable care not to misrepresent
- Insurance Contracts Act s21 Non-consumer contracts: duty of disclosure and insurer must explain it
- Insurance Contracts Act s33H Life insurance underwriting must not use protected genetic information
INS-RESReserving0 standards 1 obligations
Loss from claims reserves that prove inadequate.
RiskFA standards
Covered by the Risk Management Framework.INS-REIReinsurance0 standards 0 obligations
Loss from inadequate or failed reinsurance arrangements.
RiskFA standards
Covered by the Risk Management Framework.Obligations
INS-MEMInsurance for members0 standards 10 obligations
Poor outcomes for superannuation members from group insurance arrangements.
RiskFA standards
Covered by the Risk Management Framework.In business operations
Superannuation: Contributions processing and member administrationSuperannuation: Benefit payments, including death benefits and early releaseObligations
- SIS Act s52(7) Insurance covenants: insurance strategy, cost and pursuing claims
- SIS Act s52(9) Annual member outcomes assessment
- SIS Act s68AA Default death and permanent incapacity cover for MySuper members
- SIS Act s68AAA No insurance on accounts inactive for 16 months unless the member elects
- SIS Act s68AAB No insurance on low-balance accounts (under $6,000) unless the member elects
OPSOperational
The risk of loss from inadequate or failed internal processes or systems, the actions or inactions of people, or external drivers and events (drawn from CPS 230 para 12).
183 obligations · 12 standards · 11 risk types
OPS-PRCProcess execution4 standards 38 obligations
Loss or harm from errors or failures in processing, transactions and operations.
RiskFA standards
Risk Management FrameworkRisk Appetite StatementIncident & Issues Management StandardOperational Risk Management PolicyIn business operations
Banking: Home lending: application to settlementBanking: Payments processingSuperannuation: Contributions processing and member administrationSuperannuation: Investment management and unit pricing / crediting ratesInvestment: Fund management: investment decision to trade settlementInvestment: Unit pricing and fund valuationObligations
- CPS 230 paras 11, 13 Key principles of operational resilience
- CPS 230 para 12 Identify, assess and manage operational risks
- CPS 230 para 15 Operational risk elements of the risk management framework
- CPS 230 paras 16–17 Review and integrate operational risk management
- CPS 230 para 21 Board oversight, approvals and reporting
OPS-PPLPeople2 standards 10 obligations
Loss or harm from the actions, capability, capacity or availability of people.
Obligations
- Corporations Act s912A(1)(d) Have adequate resources
- Corporations Act s912A(1)(e)–(f) Maintain competence and train representatives
- RG 271 RG 271.142–RG 271.153 Resource and empower the IDR function
- Fair Work Act s117 (with s123(1)(b)) Give written notice of termination or payment in lieu
- Fair Work Act ss382–387 Unfair dismissal: protection and criteria (context)
OPS-TECTechnology4 standards 6 obligations
Loss or harm from failures, outages or inadequacy of technology systems.
RiskFA standards
Operational Risk Management PolicyBusiness Continuity PolicyCyber Security PolicyQuantum Risk and Post-Quantum Cryptography StandardIn business operations
Banking: Payments processingObligations
- CPS 230 para 24 IT capability and technology risk
- Corporations Act s912A(1)(d) Have adequate resources
- ISM ISM-1917 New cryptographic products support post-quantum algorithms by 2030
- Essential Eight Maturity Level Two: patch applications and operating systems Patching timeframes (Maturity Level Two)
- SIS Regulations reg 7.07G Allocate or refund contributions within 3 business days
OPS-CYBInformation security and cyber7 standards 63 obligations
Loss or harm from compromise of the confidentiality, integrity or availability of information assets.
RiskFA standards
Risk Appetite StatementIncident & Issues Management StandardCrisis Management PlanCyber Security PolicyCyber Incident Response PlanData Breach Response PlanQuantum Risk and Post-Quantum Cryptography StandardObligations
- CPS 230 para 24 IT capability and technology risk
- CPS 234 paras 13–14 Board responsibility and information security roles
- CPS 234 paras 15, 17 Maintain information security capability
- CPS 234 paras 16, 22 Assess third-party and related-party information security
- CPS 234 paras 18–19 Information security policy framework
OPS-DATData4 standards 14 obligations
Loss or harm from poor data quality, data loss or misuse of data.
RiskFA standards
Operational Risk Management PolicyCyber Security PolicyData Breach Response PlanAI Risk Management PolicyIn business operations
Superannuation: Contributions processing and member administrationInvestment: Unit pricing and fund valuationObligations
- CPS 230 para 26(a)–(b) Operational risk profile, information systems and process mapping
- CPS 234 para 20 Classify information assets
- CPS 220 para 25 Management information system and risk data
- CPG 235 whole guide Guidance on managing data risk
- Corporations Act s912EC Keep records of notify, investigate and remediate compliance
OPS-CHGChange management1 standards 2 obligations
Loss or harm from failed or poorly controlled change to products, processes, systems or the organisation.
OPS-TPRThird party and service provider6 standards 27 obligations
Loss or harm from the failure or poor performance of service providers, including material service providers.
RiskFA standards
Risk Appetite StatementOperational Risk Management PolicyBusiness Continuity PolicyCyber Security PolicyAI Risk Management PolicyQuantum Risk and Post-Quantum Cryptography StandardIn business operations
Finance: Collections and recoveriesInsurance: Claims handling and settlementInvestment: Fund management: investment decision to trade settlementInvestment: Unit pricing and fund valuationObligations
- CPS 230 para 14 Reliance on service providers
- CPS 230 para 27 Risk assessment before providing a material service
- CPS 230 paras 46–47 Service provider management policy
- CPS 230 paras 48–51 Register of material service providers
- CPS 230 para 52 Due diligence before entering or materially modifying a material arrangement
OPS-FRDFraud (internal and external)2 standards 8 obligations
Loss from dishonest acts by employees or external parties, including scams.
In business operations
Banking: Home lending: application to settlementBanking: Customer onboarding and account openingBanking: Payments processingSuperannuation: Contributions processing and member administrationSuperannuation: Benefit payments, including death benefits and early releaseInsurance: Claims handling and settlementObligations
- Corporations Act s912D(2) Additional reportable situations: gross negligence and serious fraud
- NCCP Act s50A(2) Additional reportable situations: gross negligence and serious fraud (credit)
- Privacy Act s20K Credit reporting ban period on request by a fraud victim
- AML/CTF Act ss28–29 Complete initial customer due diligence before providing a designated service
- CCA Part IVF ss58BD–58BZF (SPF principles) Scams Prevention Framework principles: govern, prevent, detect, report, disrupt and respond
OPS-BCMBusiness continuity5 standards 23 obligations
Disruption to critical operations beyond tolerance levels.
RiskFA standards
Incident & Issues Management StandardOperational Risk Management PolicyBusiness Continuity PolicyCrisis Management PlanCyber Incident Response PlanIn business operations
Insurance: Claims handling and settlementObligations
- CPS 230 paras 19–20 Board accountability and senior manager roles
- CPS 230 para 21 Board oversight, approvals and reporting
- CPS 230 para 22 Senior management information on resilience impacts
- CPS 230 para 26(c) Scenario analysis
- CPS 230 para 27 Risk assessment before providing a material service
OPS-AIArtificial intelligence and models2 standards 10 obligations
Loss or harm from the design, use or failure of AI systems and models.
Obligations
- APRA AI letter letter (30 April 2026) Board AI literacy and oversight of AI strategy
- APRA AI letter attachment to letter (30 April 2026) AI governance, security and supplier expectations
- REP 798 pp 33–36 Governance of AI use should lead AI adoption
- Privacy Act Sch 1, APP 1.7–1.9 Disclose automated decisions in the privacy policy
- VAISS 10 guardrails Voluntary AI Safety Standard: 10 guardrails (voluntary)
OPS-LEGLegal1 standards 22 obligations
Loss from legal claims, unenforceable contracts or litigation.
RiskFA standards
Operational Risk Management PolicyIn business operations
Finance: Consumer lending and financial hardshipSuperannuation: Benefit payments, including death benefits and early releaseObligations
- CPS 230 para 23 Manage the full range of operational risks
- CPS 230 paras 53–54 Formal agreement for material arrangements
- Privacy Act s13G Civil penalty for serious interference with privacy (context)
- Privacy Act s13H Civil penalty for interference with privacy (not serious) (context)
- Privacy Act s13K Administrative civil penalties, infringement and compliance notices (context)
CMPCompliance and regulatory
The risk of failing to comply with laws, regulations, licence conditions, industry codes or internal policies.
160 obligations · 12 standards · 7 risk types
CMP-LICLicence and prudential obligations4 standards 53 obligations
Failing to meet licence conditions, general licensee obligations or prudential standards.
RiskFA standards
Risk Management FrameworkRisk Appetite StatementOperational Risk Management PolicyCompliance and Breach Reporting PolicyIn business operations
Banking: Home lending: application to settlementBanking: Payments processingFinance: Collections and recoveriesFinance: Consumer lending and financial hardshipFinance: Consumer lending and financial hardshipSuperannuation: Benefit payments, including death benefits and early releaseInsurance: Underwriting and policy issueInvestment: Client onboarding and personal financial adviceInvestment: Fund management: investment decision to trade settlementInvestment: Unit pricing and fund valuationObligations
- CPS 230 para 23 Manage the full range of operational risks
- CPS 220 para 43 Compliance function
- Banking Act s62A Notify APRA of financial soundness concerns and significant breaches (ADIs)
- Insurance Act s38AA Notify APRA of breaches and adverse financial matters (general insurers)
- Life Insurance Act s132A Notify APRA of breaches and adverse financial matters (life insurers)
CMP-BRPBreach and regulatory reporting6 standards 69 obligations
Failing to identify, assess or report breaches and other matters to regulators on time.
RiskFA standards
Incident & Issues Management StandardCyber Incident Response PlanData Breach Response PlanCompliance and Breach Reporting PolicyComplaints Handling PolicyCustomer Remediation PolicyIn business operations
Superannuation: Contributions processing and member administrationInvestment: Client onboarding and personal financial adviceInvestment: Unit pricing and fund valuationObligations
- CPS 230 para 32 Notify APRA of material operational risk incidents
- CPS 230 para 41 Notify APRA of a disruption to a critical operation outside tolerance
- CPS 230 para 60 Notify APRA of critical-operation service agreements and offshoring
- CPS 234 para 35 Notify APRA of material information security incidents
- CPS 234 para 36 Notify APRA of material control weaknesses
CMP-FCRFinancial crime (AML/CTF, sanctions)1 standards 14 obligations
Being used for money laundering, terrorism financing or sanctions breaches, or failing AML/CTF obligations.
RiskFA standards
Compliance and Breach Reporting PolicyIn business operations
Banking: Customer onboarding and account openingBanking: Payments processingInvestment: Client onboarding and personal financial adviceObligations
- AML/CTF Act ss26C–26E Undertake, review and keep current an ML/TF risk assessment
- AML/CTF Act ss26F–26G Develop, maintain and comply with AML/CTF policies
- AML/CTF Act s26F(4)(f) Independent evaluation of the AML/CTF program
- AML/CTF Act s26H Governing body oversight of AML/CTF risk and compliance
- AML/CTF Act ss26J–26M Designate an AML/CTF compliance officer and notify AUSTRAC
CMP-PRVPrivacy5 standards 35 obligations
Mishandling personal information or failing privacy and data breach obligations.
RiskFA standards
Incident & Issues Management StandardCyber Security PolicyCyber Incident Response PlanData Breach Response PlanAI Risk Management PolicyIn business operations
Banking: Customer onboarding and account openingInsurance: Underwriting and policy issueObligations
- Privacy Act Sch 1, APP 1.2 Implement practices, procedures and systems to comply with the APPs
- Privacy Act Sch 1, APP 1.3–1.6 Maintain a clearly expressed, up-to-date APP privacy policy
- Privacy Act Sch 1, APP 1.7–1.9 Disclose automated decisions in the privacy policy
- Privacy Act Sch 1, APP 3 Collect only reasonably necessary personal information; consent for sensitive information
- Privacy Act Sch 1, APP 5.1 Notify individuals about collection of personal information
CMP-DISMarket disclosure0 standards 3 obligations
Failing continuous disclosure or other market disclosure obligations.
RiskFA standards
Covered by the Risk Management Framework.Obligations
- ASX Listing Rules Listing Rule 3.1 Immediately disclose price-sensitive information to ASX
- ASX Listing Rules Listing Rule 3.1A Exception to continuous disclosure (context)
- ASX Listing Rules Listing Rule 3.1B Correct or prevent a false market on ASX request
CMP-TAXTax1 standards 4 obligations
Failing tax obligations, including tax whistleblower and reporting requirements.
RiskFA standards
Whistleblower PolicyObligations
- TAA Part IVD ss14ZZT–14ZZV Recognise tax whistleblower disclosures
- TAA Part IVD s14ZZW Keep tax whistleblowers' identity confidential
- TAA Part IVD ss14ZZX–14ZZY Protect tax whistleblowers from liability and victimisation
- TFN Rule rule 11 Protect and destroy TFN information
CMP-WHSWork health and safety0 standards 4 obligations
Failing work health and safety duties to workers and others.
RiskFA standards
Covered by the Risk Management Framework.CONConduct
The risk that the behaviour of the organisation or its people causes poor outcomes for customers or members, or damages market integrity.
105 obligations · 8 standards · 7 risk types
CON-PDDProduct design and distribution3 standards 10 obligations
Products that are not designed for, or not distributed to, the right customers.
RiskFA standards
Risk Management FrameworkRisk Appetite StatementCompliance and Breach Reporting PolicyIn business operations
Insurance: Underwriting and policy issueInvestment: Client onboarding and personal financial adviceObligations
- Corporations Act s994B Make a target market determination before distribution
- Corporations Act s994C Review TMDs and stop distribution when a review trigger occurs
- Corporations Act s994E(1), s994E(3) Take reasonable steps for distribution consistent with the TMD
- Corporations Act s994F Keep DDO records and report distribution information to issuers
- Corporations Act s994G Notify ASIC of significant dealings inconsistent with the TMD
CON-SALSales practices1 standards 8 obligations
Inappropriate sales practices or incentives that harm customers.
RiskFA standards
Remuneration PolicyIn business operations
Insurance: Underwriting and policy issueObligations
- Corporations Act s912A(1)(a) Provide financial services efficiently, honestly and fairly
- NCCP Act s47(1)(a) Engage in credit activities efficiently, honestly and fairly
- Corporations Act s994E(1), s994E(3) Take reasonable steps for distribution consistent with the TMD
- NCCP Act ss158LA–158LB Mortgage brokers: act in the best interests of the consumer and prioritise the consumer's interests
- MIR (Securities Markets) Rules 3.8.1, 3.9.1–3.9.3 Best execution: take reasonable steps to obtain the best outcome for clients
CON-ADVAdvice1 standards 25 obligations
Personal advice that is not in the customer's best interests or is poorly provided.
RiskFA standards
Customer Remediation PolicyIn business operations
Investment: Client onboarding and personal financial adviceObligations
- Corporations Act s912A(1)(ca) Take reasonable steps to ensure representatives comply
- Corporations Act s912A(1)(cc) Comply with the Reference Checking and Information Sharing Protocol
- Corporations Act s912A(1)(e)–(f) Maintain competence and train representatives
- Corporations Act s912DAB Report reportable situations about other licensees' financial advisers
- Corporations Act s912EA Notify affected advice clients of a reportable situation
CON-CMPComplaints handling1 standards 26 obligations
Complaints that are not handled fairly, consistently or within required timeframes.
RiskFA standards
Complaints Handling PolicyIn business operations
Insurance: Claims handling and settlementObligations
- Corporations Act s912A(1)(g), s912A(2) Have a dispute resolution system (IDR and AFCA membership)
- ASIC Instrument 2024/620 s5 IDR civil penalty contraventions not deemed significant on that basis alone
- NCCP Act s47(1)(h)–(i), (ha) Have IDR, give ASIC IDR data and be an AFCA member (credit)
- ASIC Instrument 2022/205 s5 (s912A(1)(g)(ii)) Report IDR data to ASIC each six months
- RG 271 RG 271.27–RG 271.44 Treat every expression of dissatisfaction meeting the definition as a complaint
CON-VULVulnerable customers2 standards 17 obligations
Poor outcomes for customers experiencing vulnerability.
In business operations
Banking: Customer onboarding and account openingFinance: Collections and recoveriesFinance: Consumer lending and financial hardshipSuperannuation: Benefit payments, including death benefits and early releaseObligations
- RG 271 RG 271.86–RG 271.102 Credit complaints: default notices, hardship and enforcement
- RG 271 RG 271.124–RG 271.141 Accessible, free IDR process
- NCCP Act ss131, 133 Assess as unsuitable, and do not enter, unsuitable credit contracts
- National Credit Code ss72–73 Respond to hardship notices within the statutory timeframes
- National Credit Code ss88, 89A Give a default notice, and respond to any hardship notice, before beginning enforcement
CON-COIConflicts of interest1 standards 12 obligations
Conflicts that are not identified or managed, including conflicted remuneration.
RiskFA standards
Remuneration PolicyIn business operations
Investment: Client onboarding and personal financial adviceInvestment: Fund management: investment decision to trade settlementObligations
- CPS 511 para 40 (SFIs); para 83 (non-SFIs) Conflicts of interest in remuneration design
- CPS 511 para 53 Remuneration of risk and financial control personnel (SFIs)
- Corporations Act s912A(1)(aa) Manage conflicts of interest
- Corporations Act s963E (with s963A) Do not accept conflicted remuneration
- Corporations Act s963F Take reasonable steps so representatives do not accept conflicted remuneration
CON-REMCustomer remediation3 standards 29 obligations
Customers who suffered loss not being remediated fairly and promptly.
RiskFA standards
Incident & Issues Management StandardComplaints Handling PolicyCustomer Remediation PolicyIn business operations
Finance: Collections and recoveriesInsurance: Claims handling and settlementInvestment: Unit pricing and fund valuationObligations
- Corporations Act s912B Have compensation arrangements for retail clients
- Corporations Act s912EA Notify affected advice clients of a reportable situation
- Corporations Act s912EB(1)–(4) Investigate reportable situations that may affect advice clients
- Corporations Act s912EB(5) Notify affected advice clients of the investigation outcome
- Corporations Act s912EB(8) Compensate affected advice clients
GOVGovernance and accountability
The risk that governance, accountability, remuneration or culture fail to support sound risk management. Includes the governance and investment governance risks required by SPS 220 para 12(a) and (b) for RSE licensees.
130 obligations · 7 standards · 8 risk types
GOV-BRDBoard and governance2 standards 34 obligations
Ineffective board oversight, committees or governance arrangements.
Obligations
- CPS 230 paras 19–20 Board accountability and senior manager roles
- CPS 230 para 21 Board oversight, approvals and reporting
- CPS 230 para 22 Senior management information on resilience impacts
- CPS 230 para 45 Internal audit assurance over the BCP
- CPS 230 para 61 Internal audit review of outsourcing a critical operation
GOV-RMFRisk management framework2 standards 49 obligations
A risk management framework, appetite or reporting that is inadequate for the organisation's risks.
Obligations
- CPS 230 paras 11, 13 Key principles of operational resilience
- CPS 230 para 12 Identify, assess and manage operational risks
- CPS 230 para 15 Operational risk elements of the risk management framework
- CPS 230 paras 16–17 Review and integrate operational risk management
- CPS 230 para 26(c) Scenario analysis
GOV-ACCAccountability4 standards 18 obligations
Unclear or ineffective accountability, including under the Financial Accountability Regime.
RiskFA standards
Risk Management FrameworkCompliance and Breach Reporting PolicyConsequence Management FrameworkRemuneration PolicyObligations
- CPS 230 paras 19–20 Board accountability and senior manager roles
- CPS 234 paras 13–14 Board responsibility and information security roles
- CPS 220 paras 37–40 Risk management function and Chief Risk Officer
- SPS 220 paras 24–26 Risk management function (RSE licensees)
- CPS 511 paras 48–52 (SFIs); para 87 (non-SFIs) Specified roles: recommendations and approvals
GOV-REMRemuneration2 standards 17 obligations
Remuneration that rewards poor risk outcomes or is not adjusted for risk and conduct.
Obligations
- CPS 511 para 21 (SFIs); para 74 (non-SFIs) Remuneration framework objectives
- CPS 511 para 22 (SFIs); para 75 (non-SFIs) Documented remuneration policy
- CPS 511 paras 23–24 (SFIs); paras 76–77 (non-SFIs) Board responsibility and approval of the remuneration policy
- CPS 511 paras 25–32 Board Remuneration Committee (SFIs)
- CPS 511 paras 33–34 (SFIs); para 78 (non-SFIs) Variable remuneration design and non-financial measures
GOV-CULRisk culture and consequence management4 standards 10 obligations
A culture or consequence framework that does not support speaking up and sound risk behaviour.
RiskFA standards
Risk Management FrameworkIncident & Issues Management StandardWhistleblower PolicyConsequence Management FrameworkObligations
- CPS 230 para 31 Identify, escalate and record incidents and near misses
- CPS 220 para 9(b) Board view of risk culture
- CPS 511 paras 33–34 (SFIs); para 78 (non-SFIs) Variable remuneration design and non-financial measures
- CPS 511 paras 35–36 (SFIs); para 79 (non-SFIs) Malus and clawback
- CPS 511 paras 37–39 (SFIs); paras 80–82 (non-SFIs) Adjustment criteria, downward adjustment and investigations
GOV-FNPFit and proper0 standards 6 obligations
Responsible persons who are not fit and proper for their roles.
RiskFA standards
Covered by the Risk Management Framework.Obligations
- CPS 520 paras 12–15 Fit and Proper Policy
- CPS 520 paras 41–44 Fit and proper assessments
- CPS 520 paras 54–57 Not fit and proper persons and APRA notifications
- Corporations Act s912A(1)(cc) Comply with the Reference Checking and Information Sharing Protocol
- NCCP Act s47(1)(ea) Comply with the Reference Checking and Information Sharing Protocol (credit)
GOV-WBLWhistleblowing1 standards 18 obligations
Failing to protect whistleblowers or act on protected disclosures.
RiskFA standards
Whistleblower PolicyObligations
- CPS 510 paras 88–89 Do not constrain disclosures to APRA
- Corporations Act s1317AI(1)–(4) Have and make available a whistleblower policy
- Corporations Act s1317AI(5) Required content of the whistleblower policy
- RG 270 RG 270.41–RG 270.63 Policy: who is protected and which disclosures qualify
- RG 270 RG 270.64–RG 270.86 Policy: to whom and how disclosures can be made
GOV-INVInvestment governance (superannuation)0 standards 4 obligations
Weak investment governance for superannuation members.
RiskFA standards
Covered by the Risk Management Framework.In business operations
Superannuation: Investment management and unit pricing / crediting ratesObligations
- SIS Act s52(6) Investment covenants: investment strategy for the fund and each option
- SPS 530 paras 10–29 Investment governance framework, objectives, selection and performance monitoring
- SPS 530 paras 30–38 Investment stress testing and liquidity management plan
- SPS 530 paras 39–41 Valuation governance framework and valuation policy
REPReputational
The risk of loss of trust or standing with customers, members, regulators, investors or the community. Usually a consequence of other risks.
4 obligations · 3 standards · 1 risk types
REP-STKStakeholder trust3 standards 4 obligations
Loss of trust or standing with customers, members, regulators, investors or the community.
Obligations
- CPS 511 paras 63–73 (SFIs); paras 91–98 (non-SFIs) Public remuneration disclosure
- VAISS Guardrail 6 Inform end-users about AI-enabled decisions and AI-generated content (voluntary)
- VAISS Guardrail 10 Engage stakeholders (voluntary)
- Insurance Contracts Act s13 Duty of utmost good faith (including in claims handling)
CLMClimate and sustainability
The risk of loss or harm from climate change and the transition to a low-carbon economy. Usually acts through other categories.
0 obligations · 2 standards · 4 risk types
CLM-PHYPhysical risk1 standards 0 obligations
Loss from acute or chronic physical effects of climate change.
RiskFA standards
Risk Management FrameworkObligations
CLM-TRNTransition risk2 standards 0 obligations
Loss from policy, technology or market changes in the transition to a low-carbon economy.
Obligations
CLM-LIALiability risk0 standards 0 obligations
Loss from claims relating to climate change or climate disclosures.
RiskFA standards
Covered by the Risk Management Framework.Obligations
CLM-NATNature-related risk0 standards 0 obligations
Loss from the degradation of nature and biodiversity.