ASIC RG 259 — ASIC Regulatory Guide – RG 259 Risk management systems of fund operators

Page 1 REGULATORY GUIDE 259 Risk management systems of fund operators October 2022 About this guide This guide is for Australian financial services (AFS) licensees that are responsible entities or corporate directors (fund operators). It gives specific guidance on how fund operators may comply with their obligation under s912A(1)(h) of the Corporations Act 2001 (Corporations Act) to maintain adequate risk management systems. Page 2 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 2 About ASIC regulatory documents In administering legislation ASIC issues the following types of regulatory documents. Consultation papers: seek feedback from stakeholders on matters ASIC is considering, such as proposed relief or proposed regulatory guidance. Regulatory guides: give guidance to regulated entities by:  explaining when and how ASIC will exercise specific powers under legislation (primarily the Corporations Act)  explaining how ASIC interprets the law  describing the principles underlying ASIC’s approach  giving practical guidance (e.g. describing the steps of a process such as applying for a licence or giving practical examples of how regulated entities may decide to meet their obligations). Information sheets: provide concise guidance on a specific process or compliance issue or an overview of detailed guidance. Reports: describe ASIC compliance or relief activity or the results of a research project. Document history This guide was issued in September 2022 and is based on legislation and regulations as at the date of issue. Previous versions:  Superseded Regulatory Guide 259 Risk management systems of responsible entities, issued March 2017 Disclaimer This guide does not constitute legal advice. We encourage you to seek your own professional advice to find out how the Corporations Act and other applicable laws apply to you, as it is your responsibility to determine your obligations. Examples in this guide are purely for illustration; they are not exhaustive and are not intended to impose or imply particular rules or requirements. Page 3 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 3 Contents A Overview .................................................................................................4 Legislative obligation ...............................................................................4 What this guide covers ............................................................................4 Who this guide applies to.........................................................................9 B Establishing risk management systems ...........................................10 Risk management systems....................................................................10 Developing risk management systems ..................................................11 Implementation and review of risk management systems.....................12 Setting risk management in context ......................................................13 Policy or statement on risk appetite.......................................................13 Risk management culture ......................................................................14 Structure and risk ownership .................................................................15 Liquidity risk management .....................................................................16 Relevant industry, local and international guidance ..............................17 Good practice guidance .........................................................................17 C Identifying and assessing risks .........................................................20 Identifying risks ......................................................................................20 Risks relevant to the business and the funds ........................................21 Strategies for assessing risks ................................................................22 Selecting risk identification and assessment methodologies ................23 Good practice guidance .........................................................................23 D Managing risks.....................................................................................24 Determining appropriate risk treatments ...............................................24 Controls or measures to manage or mitigate risks ................................25 Use of technology ..................................................................................25 Compliance with other relevant obligations as an AFS licensee ...........25 Residual risks ........................................................................................27 Monitoring and review............................................................................27 Stress testing and scenario analysis .....................................................28 Good practice guidance .........................................................................30 Appendix: Examples of risks and risk treatments ...................................31 Strategic risk ..........................................................................................31 Governance risk.....................................................................................32 Operational risk ......................................................................................33 Market and investment risk ....................................................................39 Liquidity risk ...........................................................................................43 Key terms .....................................................................................................47 Related information .....................................................................................49 Page 4 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 4 A Overview Key points As Australian financial services (AFS) licensees, responsible entities of registered managed investment schemes (registered schemes) and corporate directors of corporate collective investment vehicles (CCIVs) are legally obliged to have adequate risk management systems. These systems are fundamental to mitigating exposure to relevant risks and informing business decision making. This guide provides guidance on how fund operators may comply with this obligation, including: • establishing and maintaining risk management systems that are suitable for the fund operator’s business and the funds operated (see Section B); • identifying and assessing risks (see Section C); and • managing risks (see Section D). Legislative obligation RG 259.1 Under s912A(1)(h) of the Corporations Act 2001 (Corporations Act), responsible entities of registered schemes and corporate directors of CCIVs (fund operators) have an ongoing obligation to maintain adequate risk management systems. RG 259.2 In Regulatory Guide 104 AFS licensing: Meeting the general obligations (RG 104), we set out our general guidance for AFS licensees on what is required to comply with s912A(1)(h). RG 259.3 This guide provides guidance on specific areas to improve the risk management systems of fund operators. What this guide covers RG 259.4 This guide outlines our expectations of fund operators when complying with the obligation within s912A(1)(h). RG 259.5 While RG 104 gives guidance on risk management systems for AFS licensees generally, this guide focuses specifically on the business of fund operators, the registered schemes and CCIVs (funds) they operate and the particular risks they face. RG 259.6 The sections of this guide detail our expectations for fund operators to have: (a) overarching risk management systems in place (Section B); Page 5 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 5 (b) processes for identifying and assessing risks (Section C); and (c) processes for managing risks (Section D). We expect these systems and processes to be appropriate for the nature, scale and complexity of the business and funds operated. RG 259.7 We have also included in this guide additional good practice guidance. This guidance is not mandatory; it is intended to help fund operators improve their risk management systems to operate at a level above their statutory obligations. RG 259.8 Table 1 provides a summary of our expectations of fund operators and the good practice guidance. Page 6 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 6 Table 1: Summary of guidance Section Expectations for compliance with s912A(1)(h) Good practice guidance (not mandatory) Section B (Establishing a risk management system) Fund operators should:  maintain documented risk management systems that include: − clearly defined roles and responsibilities; − policies and procedures for identifying, assessing and understanding each of the material risks of the fund operator’s business and funds operated; − policies and procedures for ensuring there are adequate controls in place to manage the risks identified; − policies and procedures for ensuring there is adequate oversight of the risk management systems by both the party responsible for ownership of the risk and the compliance function, including appropriate reporting; and − a policy or statement on the fund operator’s risk appetite and the risk tolerance for each material risk identified;  foster a strong risk management culture;  take into account relevant industry, local and international guidance;  include, as a component of the risk management systems, a liquidity risk management process;  review their risk management systems—to ensure that they are current, relevant, effective and complied with—as frequently as appropriate, given the nature, scale and complexity of the fund operator’s business and the funds it operates (at a minimum, annually); and  if relying on external service providers for risk management functions, maintain a strong understanding of risk management and have sufficient skills to independently monitor and assess the performance and ongoing suitability of the service provider. Fund operators may:  at least every three years, conduct a comprehensive independent review of the appropriateness, effectiveness and adequacy of the risk management systems;  segregate functions to allow for independent checks and balances;  establish a designated risk management function and/or risk management committee;  appoint a chief risk officer; and  publicly disclose a summary of the key aspects of the fund operator’s risk management systems. Page 7 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 7 Section Expectations for compliance with s912A(1)(h) Good practice guidance (not mandatory) Section C (Identifying and assessing risks) Fund operators should:  maintain one or more risk registers as part of their risk identification and assessment process;  ensure that their risk management systems address all material risks—including (but not limited to) strategic risk, governance risk, operational risk, market and investment risk, and liquidity risk—at both the fund operator and fund level;  when choosing methodologies for identifying and assessing risks, take into account: − the nature, scale and complexity of the business; − processes based on forward-looking analysis; − ensuring an appropriate level of human input; − ensuring senior management involvement in the process; and − whether different processes should be used for different funds; and  adopt appropriate methods to assess risks, which may include: − self-assessment; − stress testing and/or scenario analysis; − loss data analysis; − change management; and − digital systems. Fund operators may use risk indicators and regularly report on these to the board and senior management. Page 8 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 8 Section Expectations for compliance with s912A(1)(h) Good practice guidance (not mandatory) Section D (Managing risks) Fund operators should:  implement appropriate strategies for managing each of the material risks identified, including: − a control monitoring and assurance process; − conducting stress testing and/or scenario analysis of liquidity risks of the funds they operate as part of their risk management systems as frequently as appropriate, given the nature, scale and complexity of the business (at a minimum, annually); − reviewing their framework for stress testing and/or scenario analysis—to ensure the tested scenarios are relevant and appropriate in light of the business and market conditions—as frequently as appropriate, given the nature, scale and complexity of the business (at a minimum, annually); and − if stress testing and/or scenario analysis is not conducted, document why this is the case, keep appropriate internal records of this rationale and review this decision regularly;  have adequately experienced staff regularly review and monitor the risks identified;  ensure there is regular reporting and escalation of issues to the board, risk committee and compliance committee, as appropriate; and  ensure compliance with other relevant obligations as an AFS licensee. Fund operators may:  conduct regular stress testing and/or scenario analysis of all material risks of the business and the funds they operate;  have a written risk treatment plan; and  include in the compliance plan for their funds additional procedures for ensuring that the material risks identified for the fund are relevant and managed on an ongoing basis. Page 9 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 9 RG 259.9 In the appendix to this guide we give examples of risks and risk treatments that we consider are particularly relevant to fund operators, based on our regulatory experience. These examples may help operators establish and review their arrangements to identify, assess and manage risks, and may be considered by operators as part of these processes. RG 259.10 The examples of risks in this guide are not intended to be exhaustive. We expect that, through the application of a structured and systematic process, fund operators will identify, assess and manage risks relevant to their business and the funds they operate in an ongoing and dynamic way. Who this guide applies to RG 259.11 This guide is for responsible entities of registered schemes and corporate directors of CCIVs but is also relevant for: (a) AFS licensees not currently operating a fund; (b) investor directed portfolio services (IDPS) and managed discretionary account (MDA) operators; and (c) entities operating unregistered managed investment schemes. Other entities that may benefit from this guidance RG 259.12 We expect all AFS licensees authorised to operate a fund to consider this guide, even if they are not currently operating any funds. This will help ensure they have in place compliant risk management systems that can be applied to the funds on commencement of their operation. RG 259.13 We expect IDPS and MDA operators to consider this guidance when establishing and reviewing their risk management systems, as these services would need to be registered schemes if they could not rely on our relief for IDPSs and MDAs. RG 259.14 All aspects of this guide may not be relevant to entities operating unregistered managed investment schemes. However, we recommend that operators of such schemes consider this guidance when establishing and reviewing their risk management systems. Page 10 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 10 B Establishing risk management systems Key points A fund operator should ensure its risk management systems comprise documented processes to identify, assess and treat risks, and that these systems are suitable for its business and the funds it operates: see RG 259.15–RG 259.16. This section sets out our guidance for fund operators on: • developing risk management systems (see RG 259.17–RG 259.25); • implementing and reviewing risk management systems (see RG 259.26–RG 259.29); • setting risk management in context (see RG 259.30–RG 259.31 and Table 2); • risk appetite (see RG 259.32–RG 259.36); • the role of culture and structure in risk management systems (see RG 259.37–RG 259.45); • liquidity management (see RG 259.46–RG 259.49); and • relevant industry, local and international guidance (see RG 259.50– RG 259.53). This section also sets out our good practice guidance for establishing risk management systems: see RG 259.54–RG 259.62. Risk management systems RG 259.15 The international standard for risk management defines risk as the ‘effect of uncertainty on objectives’ and risk management as ‘coordinated activities to direct and control an organization with regard to risk’: see International Standard ISO 31000:2018 Risk management—Guidelines. RG 259.16 Effective risk management needs to: (a) be integrated; (b) be structured and comprehensive; (c) be customised; (d) be inclusive; (e) be dynamic; (f) use the best available information; (g) consider human and cultural factors; and (h) have continual improvement. Page 11 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 11 Developing risk management systems RG 259.17 Risk management systems include all structures, systems and subsystems, policies, procedures, and staff that a fund operator uses to identify, assess and treat risks or to monitor and review the relevant controls or measures. It may be regarded as a framework comprising all elements that allow the fund operator to perform its risk management functions as required by the Corporations Act. RG 259.18 Adequate risk management systems enable material risks faced by the fund operator and the funds it operates to be identified, analysed and treated in a comprehensive and systematic way. Sound corporate governance and management oversight are an essential part of any effective risk management systems. RG 259.19 The adequacy of a fund operator’s risk management systems will depend on the nature, scale and complexity of its business and the funds it operates. RG 259.20 We consider the following to be core processes that are essential to adequate risk management systems in any fund operator’s business: (a) setting out the scope, context and criteria in which the risk management systems operate, including a policy or statement on the fund operator’s risk appetite (see RG 259.30–RG 259.36); (b) identifying and assessing risks (see Section C); and (c) managing risks, including reviewing and monitoring the risk management systems (see Section D and RG 259.26–RG 259.29). RG 259.21 A fund operator should maintain documented risk management systems that include: (a) clearly defined roles and responsibilities; (b) policies and procedures for identifying, assessing and understanding each of the material risks of the fund operator’s business and funds operated; (c) policies and procedures for ensuring there are adequate controls in place to manage the risks identified; (d) policies and procedures for ensuring there is adequate oversight of the risk management systems by both the party responsible for ownership of the risk and the compliance function, including appropriate reporting; and (e) a policy or statement on the fund operator’s risk appetite and the risk tolerance for each material risk identified. RG 259.22 We expect fund operators to maintain a strong understanding of risk management in the context of the business, even if the establishment and the monitoring of the risk management systems are done by a small group of employees or external third-party service providers (e.g. compliance and risk Page 12 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 12 management consultants). We expect those who carry out the risk management function to have appropriate knowledge and skills. RG 259.23 Where external third-party service providers are used, we expect fund operators to have sufficient skills to independently identify material risks and to monitor and assess the service provider’s performance and ongoing suitability. We note that responsible entities retain ultimate responsibility for the operation of a scheme (see s601FB) and corporate directors have responsibility for the operation of a CCIV (see s1224M). RG 259.24 We understand that if a fund operator is part of a corporate group, the risk management systems of the fund operator, or the policies and procedures for its risk management systems, may be subject to the overarching approach of the corporate group or form part of its risk management framework. Some fund operators may rely on the risk management systems of a related entity to assist with complying with their risk management obligations. RG 259.25 This may be appropriate for businesses that are part of a larger corporate group; however, if this approach is adopted, each fund operator should take into consideration their specific individual risks and requirements. The fund operator should carefully assess the risk management systems of the corporate group or related entity to ensure that they are appropriate and tailored as necessary. Implementation and review of risk management systems RG 259.26 Risk management systems are most effective if applied and adhered to in day-to-day decision making at all levels. Therefore, it is essential that a fund operator ensures that all processes, policies and procedures that form part of its risk management systems are implemented and applied to the day-to-day operation of its business and the funds it operates. RG 259.27 We consider that the development of adequate risk management systems is not a ‘set and forget’ or one-off process. The systems should adapt and evolve to take into account internal changes within the fund operator and the funds it operates, as well as changes in the external environment. RG 259.28 To ensure that risk management systems are always current, relevant, effective and complied with, they should be monitored and reviewed as frequently as appropriate, given the nature, scale and complexity of the business and the funds operated. This should be at least annually. See also RG 259.89– RG 259.90. RG 259.29 We consider that the fund operator’s senior management has a specific role in ensuring that: (a) this review is undertaken; Page 13 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 13 (b) the risk management systems are current, relevant, effective and complied with on an ongoing basis; and (c) the risk management systems remain appropriate to the business and funds operated. Setting risk management in context RG 259.30 A fund operator should consider and document the context in which its risk management systems are developed. That is, the internal and external environment in which its business operates, including the objectives of the business. RG 259.31 Adequate risk management systems require a thorough understanding of the internal and external factors that could affect the fund operator’s ability to achieve its goals and objectives. Table 2 lists some examples of these factors. Table 2: Examples of internal and external factors Internal factors External factors  Vision, missions, value, goals and objectives in the strategic and business plans, including the objectives of the relevant funds (e.g. whether a fund will be a liquid fund offering redemptions on demand or an illiquid fund). Particular business strategies may create specific risks affecting the business.  Capabilities of the organisation (e.g. financial, human and technological resources).  Information flow and decision-making processes.  Culture of the fund operator.  Interdependencies and interconnections.  Business, financial, competitive, political, economic, social, cultural, technological and environmental factors the business faces.  Expectations of external stakeholders (including shareholders) about the operation of the business.  Legal and regulatory changes that affect the operation of the business and the funds.  New product offerings in the market that compel a fund operator to compete more effectively.  Contractual relationships and commitments.  The complexity of networks and dependencies. Policy or statement on risk appetite RG 259.32 A fund operator should document its risk appetite in a policy or statement. This policy or statement should outline the fund operator’s attitude towards risk taking while carrying out its business plans, including the amount of risk (which may refer to the level of losses) it is willing to take to pursue its business strategies and achieve its objectives. It should also address the risks relevant to the fund operator’s overall strategy to achieve its objectives and set out the limits to these risks. In undertaking this process we consider it is important for the fund operator to take into account any differences in the risk profile of the funds operated. Page 14 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 14 RG 259.33 The fund operator may have one such policy or statement setting out its risk appetite in aggregate, or separate policies and statements. The policy or statement should be approved by the board or its delegate. RG 259.34 During this process the risk tolerance for each material risk should be identified. This can be expressed in qualitative or quantitative terms, where appropriate. The risk tolerance will reflect the risk appetite. RG 259.35 A fund operator should ensure its risk appetite is reviewed at appropriate intervals and that it takes into account changes in the internal and external context in which the business operates, including changes to the objectives and strategic direction of the business. RG 259.36 Fund operators may adopt the following approach in setting and applying a policy or statement on risk appetite: (a) senior management sets the policy or statement on risk appetite for the business; (b) the board or its delegate approves the policy or statement on risk appetite; (c) based on this statement, risk tolerance is set and documented for each material risk, broken down into clearly defined limits or thresholds for particular activities of the business to support the decision-making process; and (d) risk management processes, policies and procedures to implement and monitor the limits and thresholds are developed and communicated to staff, so that they are applied to support day-to-day operational decision making. Risk management culture RG 259.37 We expect fund operators to foster a strong risk management culture throughout their organisations. The effectiveness of adequate risk management systems depend on the whole organisation understanding the value of managing risks effectively, and acting accordingly. RG 259.38 We expect fund operators to ensure that all relevant staff understand the purposes of risk management, including ensuring legal and regulatory compliance, as well as its value to the organisation. This can be done through induction, training and education programs. RG 259.39 The board and senior management have specific responsibilities to ensure that a fund operator, as an AFS licensee, complies with its obligation to have adequate risk management systems. We acknowledge that the board may not be directly involved in the day-to-day operation of the policies, procedures and processes for the risk management systems and may delegate the Page 15 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 15 supervision of these roles. However, the board’s commitment to fostering a strong risk management culture within the organisation is especially important, as the board is in a position to provide leadership and make sure that relevant measures are implemented effectively. RG 259.40 An effective risk management culture may include: (a) communicating with staff about the importance of managing risks to achieve strategic business objectives; (b) providing sufficient resources for all risk management functions; (c) relevant staff receiving ongoing training about risk management (e.g. general risk management training and/or training that is relevant to a staff member’s role and responsibilities) to help them identify risks and understand how they can be managed; (d) discouraging breaches of any risk management procedures by staff through adequate consequence management; (e) supporting, recognising and/or rewarding employees who demonstrate their commitment to effective risk management; and (f) assigning a designated director the responsibility of making sure the risk management systems for the fund operator and funds it operates are adequate (or designated directors having responsibility over particular parts of the risk management system). RG 259.41 We expect fund operators to implement and maintain remuneration policies that are aligned with, and supportive of, the risk management systems of their business, including the funds they operate. Structure and risk ownership RG 259.42 A fund operator’s risk management systems should include details of the functions, roles and responsibilities for implementing and carrying out specific risk management activities. RG 259.43 We consider that an adequate risk structure requires: (a) staff who perform risk management functions to have the appropriate knowledge and skills; (b) decision making that is cognisant of the risk management systems; (c) key staff to take responsibility for owning risks and developing processes to mitigate them; (d) regular reviews; and (e) that risk owners regularly monitor and report on those risks. Page 16 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 16 RG 259.44 We expect fund operators’ risk management systems to require relevant staff to report internally to identified escalation points (e.g. the risk management committee, the designated risk management function or the board) about compliance with risk management processes, policies and procedures on a regular basis, and whenever any issues are identified (e.g. exceeding the risk tolerance for a particular risk, or a failure to follow the relevant processes). Such reporting increases the risk-related information available in the organisation, to assist decision making and improve risk management systems where systemic issues about their operation are identified. RG 259.45 We also consider that fund operators should implement processes for regular reporting and escalation of issues to the board and/or any risk or compliance committee established. Liquidity risk management RG 259.46 Effective liquidity risk management is important for a fund operator to ensure the financial obligations and needs of the business and funds operated are met, including: (a) investor redemptions; (b) payment of distributions; (c) changes in operational needs; and (d) unexpected expenses. RG 259.47 We expect risk management systems of fund operators to include a liquidity risk management process, designed to ensure there are adequate financial resources to meet the financial obligations and needs of the fund operator and the funds operated. RG 259.48 At the fund level, we expect this will include stress testing or scenario analysis (see RG 259.91–RG 259.98). We also expect it will include fund operators assessing available liquidity management tools and considering whether these are appropriate to use. For example, redemption fees, suspension of withdrawal requests, redemption gates (a limit on the amount of redemptions), in specie transfers (transferring assets of an equivalent amount instead of providing cash proceeds), swing pricing (applying higher transaction costs adjustments on redemptions, reflecting the lack of an offsetting issue of fund interests or shares), minimum or maximum limits on withdrawals, or satisfying withdrawals on a partial or staggered basis. RG 259.49 At the fund operator level, we expect this will include an ongoing assessment of whether the fund operator is complying with the financial requirements of its AFS licence and is able to meet its financial obligations and needs. Page 17 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 17 Relevant industry, local and international guidance RG 259.50 In developing, implementing and reviewing its risk management systems, we consider that a fund operator should take into account relevant industry, local and international guidance. RG 259.51 We appreciate that in many cases compliance with the guidance may not be mandatory and a wide range of material may exist. We expect, at a minimum, that fund operators will consider whether the guidance that exists for the material risks identified for the business and funds operated would be useful to adopt. RG 259.52 We consider liquidity a material risk for funds. In developing their liquidity risk management process, fund operators should consider the following international guidance, which outline tools to help fund operators manage liquidity risk: (a) the International Organization of Securities Commissions’ (IOSCO) Recommendations for Liquidity Risk Management for Collective Investment Schemes; and Note: See IOSCO, Recommendations for liquidity risk management for collective investment schemes: Final report (PDF 363 KB), February 2018. (b) the Financial Stability Board’s (FSB) Policy Recommendations to Address Structural Vulnerabilities from Asset Management Activities. Note: See FSB, Policy recommendations to address structural vulnerabilities from asset management activities, January 2017. RG 259.53 We encourage industry bodies and associations to develop standards on risk management, to further assist fund operators to meet their obligation under s912A(1)(h). Good practice guidance RG 259.54 Additional strategies that may be implemented by fund operators in establishing and maintaining risk management systems include: (a) supplementary review of the risk management systems (see RG 259.55– RG 259.56); (b) segregating functions to allow for independent checks and balances (see RG 259.57); (c) designating a risk management function and committee (see RG 259.58–RG 259.60); (d) appointing a chief risk officer (see RG 259.61); and (e) publicly disclosing a summary of key aspects of their risk management systems (see RG 259.62). Page 18 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 18 Review of risk management systems RG 259.55 Fund operators may undertake an additional independent comprehensive review of the appropriateness, effectiveness and adequacy of the risk management systems (at least every three years). RG 259.56 The above review should be carried out by an independent, appropriately trained and competent person. This does not require an external party and can be done internally, as long as the fund operator is satisfied that any other roles carried out by the person reviewing the risk management systems do not have an impact on their ability to perform an objective review and will not limit the robustness of the review. Segregation of functions to allow for independent checks and balances RG 259.57 Depending on the nature, scale and complexity of the business, we encourage fund operators to segregate functions to allow for independent checks and balances. This may include, for example, segregating the internal function in charge of valuing assets from the investment management function. We consider this will help manage conflicts of interests that may arise, and builds in an additional level of oversight to identify any issues. Designated risk management function and committee RG 259.58 Depending on the nature, scale and complexity of the business, we consider it is good practice for fund operators to establish a designated risk management function and/or risk management committee. We understand that this may not be feasible for some operators. RG 259.59 The designated risk management function may have a hands-on role in ensuring the day-to-day operation of a fund operator (including the funds it operates) is conducted in alignment with its risk management systems. To achieve this, the designated risk management function may be independent from the operating units of the fund operator’s business. It may also have the specific responsibility of monitoring compliance with risk management processes, policies and procedures, as well as reporting to the board and any risk management committee all significant breaches of the processes, policies and procedures. RG 259.60 The responsibilities of a risk management committee may include: (a) helping senior management develop the risk management systems; (b) reviewing the effectiveness of the risk management systems; (c) reporting to the board and/or senior management on breaches of risk tolerance or risk management processes, policies and procedures, according to the fund operator’s escalation policy; and Page 19 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 19 (d) reporting to the board and/or senior management on the risk management systems and their performance. Appointing a chief risk officer RG 259.61 Depending on the nature, scale and complexity of the business, we consider it is good practice for fund operators to appoint a dedicated chief risk officer. Generally, the chief risk officer will be a key member of senior management to ensure they have sufficient stature and authority to influence risk-based decision making. It is important for any chief risk officer to communicate freely and have direct and unfettered access to the board, senior management and any risk or compliance committee established. Disclosure of risk management policies RG 259.62 In addition to its obligation to disclose information about significant risks in the Product Disclosure Statement (PDS) under Pt 7.9 of the Corporations Act, an issuer may provide additional transparency to investors about its arrangements by publicly disclosing a summary of the key aspects of the risk management systems of the fund operator—for example, on its website or in its annual report. Page 20 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 20 C Identifying and assessing risks Key points This section sets out our guidance for fund operators on identifying and assessing risks, including: • the processes for identifying risks, documenting the processes, policies and procedures used to identify these risks, and maintaining one or more risk registers to record material risks (see RG 259.64–RG 259.68). The processes should be suitable for the business’s objectives and operations, including for the funds it operates; • ensuring their risk management systems address all material risks (see RG 259.69–RG 259.70) for their business and each fund operated. These may include strategic risk, governance risk, operational risk, market and investment risk, and liquidity risk; • strategies for assessing identified risks and documenting its risk assessment processes (see RG 259.71–RG 259.75); and • taking into account certain factors when selecting risk identification and assessment methodologies (see RG 259.76). It also sets out our good practice guidance for identifying and assessing risks: see RG 259.77. Identifying risks RG 259.63 Risk identification is the process used by fund operators to identify risks that will affect their ability to pursue business strategies and achieve the objectives of their business. RG 259.64 We do not consider that any one particular method for identifying risks is the most appropriate and applicable for all fund operators. RG 259.65 Fund operators should adapt the processes for risk identification in their risk management systems as the business develops and business risk profiles change, over time and in different market conditions. Risks need to be identified at any given point in time to ensure fund operators can effectively manage them in the operation of their business and day-to-day decision making. RG 259.66 There are different ways to identify the risks that can affect a fund operator’s business. For example, evidence-based methods that rely on reviewing audit reports, post-event reports, historical data or risk registers can help to identify existing and emerging risks that the fund operator may face. Observations from our regulatory experience indicate that incorporating this approach to risk identification in strategic and business planning is particularly helpful in identifying risks. Fund operators may use a systematic Page 21 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 21 team approach that uses focus groups and brainstorming to identify risks. Purpose-built software can also be used. RG 259.67 A fund operator should document the processes, policies and procedures it uses to identify risks. RG 259.68 We expect fund operators to maintain one or more risk registers for recording material risks to the business and funds operated as part of their risk identification process. A fund operator should select the format of the risk register(s) that is most suitable for the business and funds operated. Fund operators are not required to keep separate risk registers at the fund operator and fund level, or for each fund they operate, as long as the material risks for the business and each fund operated are identified and addressed in the registers maintained. Risks relevant to the business and the funds RG 259.69 We appreciate that the risks identified by fund operators as part of their risk management systems will depend on the nature, scale and complexity of their business and risk profile, and will be different for each fund operator. Our regulatory experience suggests that certain types of funds (e.g. unlisted property funds, mortgage funds, agribusiness funds, quoted funds, hedge funds and novel funds) are subject to more complex risks. RG 259.70 A fund operator should ensure that its risk management systems address all the material risks faced by the business and each fund operated. These may include, but are not limited, to the following risks: (a) Strategic risk—Any risk that arises out of a fund operator’s business strategies and business plan. (b) Governance risk—Any risk that threatens the ability of a fund operator to make reasonable and impartial business decisions in the best interests of members. This risk may arise if a fund operator does not have the appropriate processes in place to: (i) support sound and transparent decision making that is not influenced by conflicts of interests; and (ii) ensure that decisions related to the funds are in the best interest of members. (c) Operational risk—The risk of loss, for the business or funds, resulting from inadequate or failed internal processes, people and systems or from external events. (d) Market and investment risk—The risk that a fund operated by a fund operator will not meet its objectives. Specific investment risks include those relating to investment governance and structure, market Page 22 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 22 conditions, counterparty failure, product suitability, and valuation and pricing. (e) Liquidity risk—The risk that the fund operator will not have adequate financial resources to meet its financial obligations and needs, either at the fund operator level or at the fund level (including meeting the fund’s objectives and members’ expectations for redemptions). As previously outlined, we consider that liquidity risk is a material risk for funds. Note: For a detailed description of these risks (including examples of specific risks) and treatments to manage these risks based on our regulatory experience, see the appendix to this guide. Strategies for assessing risks RG 259.71 Risk assessment is the process of describing identified risks, including by reference to the inherent risk, and determining the likelihood of a risk eventuating and the significance of its potential impact. This process can help a fund operator determine whether the identified risks are acceptable in light of its risk appetite and develop appropriate treatments for those risks. RG 259.72 Examples of different methods that fund operators may adopt for assessing risks include the following: (a) Self-assessment––The fund operator, its senior management and those in the designated risk management function (if applicable) assess risks through the business and the funds it operates. This may include risk mapping, where risks are prioritised according to the significance of the risk and likelihood of a risk eventuating and mapped into four quadrants. (b) Stress testing and/or scenario analysis—The fund operator uses techniques such as stress testing and/or scenario testing to assess how it will be impacted by different scenarios. See also RG 259.91–RG 259.98. (c) Loss data analysis—The fund operator implements processes to analyse observed incidents to evaluate the actual losses caused by risks. (d) Change management—The fund operator implements processes to assess how the business and funds operated are affected by change, to ensure objectives are still met. (e) Digital systems––The fund operator uses purpose-built software to assess risks. RG 259.73 Fund operators may also seek expert advice and appoint an external consultant to help in the process of assessing the likelihood of a risk eventuating and the significance of its potential impact. Page 23 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 23 RG 259.74 We do not consider that any one particular approach for assessing risks will be the most appropriate and applicable to the operation of all fund operators. RG 259.75 A fund operator should document its risk assessment processes. Documenting the reasons why particular assessments are made, including the thinking that led to the decisions about identified risks, provides a useful context for future risk assessment. Selecting risk identification and assessment methodologies RG 259.76 When considering which approach or combination of approaches to adopt in identifying and assessing risks, fund operators may consider: (a) the nature, scale and complexity of the business; (b) incidents and complaints, trends or developments in the industry, and changes to the business environment; (c) processes based on a forward-looking analysis in accordance with strategic and business plans (e.g. when assessing the risk of not having adequate technological or human resources, identification of risks should be based on forward planning); (d) the need to ensure there is an appropriate level of human input in the process—sole or disproportionate reliance on digital systems may not be adequate; (e) senior management involvement in the process (e.g. any determination about whether an identified risk is at an acceptable level in light of the policy or statement on risk appetite); and (f) if applicable, whether different processes should be used to identify and assess risks for different funds in light of the operation of each particular fund. Good practice guidance RG 259.77 Fund operators may use risk indicators to provide an early signal of increasing risk exposures in various areas of the business. Regular reporting on the risk indicators can give the board and senior management an insight into the changes in the external and internal environment that may indicate risk concerns. It can also help ensure that risk levels are managed within defined tolerances. Page 24 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 24 D Managing risks Key points This section sets out our guidance for fund operators on managing risks, including: • determining appropriate risk treatments (see RG 259.78–RG 259.80); • controls or measures to manage or mitigate risk (see RG 259.81– RG 259.83; • use of technology (see RG 259.84); • compliance with other relevant obligations as an AFS licensee (see RG 259.85 and Table 3); • dealing with residual risks (see RG 259.86); • monitoring and review (see RG 259.87–RG 259.90); and • stress testing and scenario analysis (see RG 259.91–RG 259.98). It also sets out our good practice guidance for managing risks: see RG 259.99–RG 259.102. Determining appropriate risk treatments RG 259.78 A fund operator should determine the appropriate treatment for each material risk identified and document how the risk will be treated. RG 259.79 There are different ways that fund operators may manage risks. For example, they may: (a) do nothing if the identified risk is within acceptable risk tolerance levels; (b) avoid the risk by not undertaking the relevant activities that give rise to the risk; (c) prevent the eventuation of the risk through specific actions, such as developing rules and documented policies and procedures; (d) reduce or mitigate the consequences or impact of realised risks (e.g. through contingency, emergency or business continuity plans); and/or (e) transfer the risks to other parties, through insurance, outsourcing or indemnification. RG 259.80 Risks faced by the business should be considered as a whole, given that some risks may be interrelated (e.g. liquidity and valuation risks). Page 25 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 25 Controls or measures to manage or mitigate risks RG 259.81 We expect fund operators to have adequate controls to manage or mitigate risks (e.g. performance standards for external service providers). It is also important for the fund operator to implement a control monitoring and assurance process that considers the: (a) adequacy of coverage of controls and whether appropriate remediation and response strategies are in place for material risks; (b) effectiveness of internal controls designed to ensure risks have been mitigated; and (c) appropriateness of monitoring strategies and ongoing testing (e.g. self- assessment, real-time transaction monitoring and reporting, and control assurance reviews by independent teams). RG 259.82 The appendix to this guide includes examples of controls and measures for treating the risks that we consider are most relevant to the business of a fund operator. The examples of risk treatments in the appendix are not mandatory, unless otherwise specified in the guidance. RG 259.83 Nor are the risk management strategies exhaustive. We expect fund operators to implement strategies for managing risks that are appropriate to the nature, scale and complexity of the business and funds operated. Use of technology RG 259.84 There are a variety of technological resources that can be used to help fund operators manage risks. These technologies come in a variety of forms and can help by analysing and storing data, automating compliance processes, monitoring trading, and streamlining regulatory reporting. External service providers may be used to facilitate this process and also to store data. The use of these technologies may result in enhanced and more cost-effective management of risks. However, it is important to ensure that there is appropriate human oversight and review of any technological resources used. Compliance with other relevant obligations as an AFS licensee RG 259.85 Apart from the obligations contained within s912A(1)(h), we expect fund operators to comply with their other existing obligations as an AFS licensee. As outlined in Table 3, many of these obligations are also relevant to assisting the management of risks. Page 26 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 26 Table 3: Other relevant AFS licence obligations Obligation Explanation Further guidance Compensation for retail clients: s912B If financial services are provided to retail clients, an AFS licensee must have arrangements for compensating those persons for loss or damage suffered due to breaches by the licensee or its representatives. We consider adequate professional indemnity (PI) insurance is another important measure to manage operational risk. Regulatory Guide 126 Compensation and insurance arrangements for AFS licensees (RG 126) Adequate financial resources: s912A(1)(d) An AFS licensee must have adequate financial resources. All fund operators must comply with minimum financial requirements. We consider these requirements are another important measure to assist in managing liquidity risk affecting the fund operator itself. We expect operators to ensure that their financial resources will be adequate to carry on their business in compliance with their licensee obligations, or to wind up their business in an orderly manner. Regulatory Guide 166 AFS licensing: Financial requirements (RG 166), Class Order [CO 13/760] Financial requirements for responsible entities and operators of investor directed portfolio services and ASIC Corporations (Financial Requirements for Corporate Directors of Retail Corporate Collective Investment Vehicles) Instrument 2022/449. Adequate records of scheme operation: s601HA(1)(e) The compliance plan of a registered scheme must set out the arrangements for ensuring adequate records of the scheme’s operations are kept. In complying with this obligation, we expect that a responsible entity will ensure that it keeps adequate records of the establishment, implementation and review of its risk management systems for the schemes operated. The compliance plan of a CCIV must set out adequate measures that the corporate director will apply when fulfilling its responsibilities in relation to the CCIV to ensure compliance with the Corporations Act and the CCIV’s constitution: see s1226A. Regulatory Guide 132 Funds management: Compliance and oversight (RG 132) Adequate technological resources: s912A(1)(d) An AFS licensee must have adequate technological resources. We expect that in complying with this obligation a fund operator will maintain secure and stable information systems. This will assist in managing relevant risks, including system failure and malicious cyber activity. Report 429 Cyber resilience: Health check (REP 429) Page 27 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 27 Obligation Explanation Further guidance Reportable situations: s912DAA An AFS licensee must report to ASIC, in writing, all reportable situations within 30 calendar days after the licensee first knows that there are reasonable grounds to believe a reportable situation has arisen. We expect that a fund operator will ensure that it reports any breach of s912A(1)(h). We consider processes to identify, escalate, report and analyse breaches (including trends) can help manage risks. Regulatory Guide 78 Breach reporting by AFS licensees and credit licensees (RG 78) Residual risks RG 259.86 Residual risks often remain, even after measures to treat risks have been applied. Understanding the concept of residual risk is an important consideration when identifying, assessing and managing risks, as it determines whether residual risks are within acceptable risk tolerance levels or require further treatment. It can also help inform future risk assessments. Monitoring residual risks can help ensure they do not increase to a level above the fund operator’s risk appetite, and determine whether further treatment should be applied to manage those risks. Monitoring and review RG 259.87 A fund operator should ensure that staff members follow the processes, policies and procedures put in place to manage risks. RG 259.88 We expect fund operators to have adequately experienced staff who regularly review and monitor the risks identified. We also expect operators to ensure there is regular reporting and escalation of issues to the board, risk committee and compliance committee, as appropriate. RG 259.89 As previously outlined, we consider that a fund operator should review and monitor its risk management systems as frequently as appropriate—given the nature, scale and complexity of the business and funds operated—to ensure they are current, relevant, effective and complied with. We expect this to be done at least on an annual basis. The nature, scale and complexity of the business and the funds operated will also determine the level of detail of the review. If the review is undertaken internally, a fund operator should consider appropriate steps to ensure that the review is objective. RG 259.90 Such reviews may: (a) comprehensively cover all aspects of the fund operator’s risk management systems, including the policy and statement on risk Page 28 REGULATORY GUIDE 259: Risk management systems of fund operators © Australian Securities and Investments Commission October 2022 Page 28 appetite and all processes, policies and procedures related to these systems; (b) take into account changes affecting the fund operator’s business and the funds it operates, including changes to: (i) the operation of the fund operator or its funds; (ii) the context in which the fund operator operates the business or funds; (iii) the fund operator’s risk appetite or strategic business objectives; (iv) laws that affect the business or funds; and (v) business plan objectives, including starting any new business; (c) monitor compliance with the risk management systems, including the processes, policies and procedures put in place to identify, assess and manage risks; (d) ensure information systems are effective and up to date; (e) ensure escalation policies and procedures are operating and effective; and (f) ensure reporting of breaches is occurring, document the review process and any issues identified, and report to the board or senior management. Stress testing and scenario analysis RG 259.91 We expect a fund operator to conduct stress testing and/or scenario analysis of the liquidity risks identified for the funds it operates as frequently as appropriate—given the nature, scale and complexity of the business—and to update or revise its arrangements if required in response to the testing or analysis results. At a minimum, we expect this to be undertaken annually. We consider liquidity risk a material risk for which fund operators should undertake stress testing and/or scenario analysis. RG 259.92 We also expect fund operators to review their framework for stress testing and scenario analysis as frequ