APRA DRAFT PRUDENTIAL STANDARDS FOR SUPERANNUATION – WHAT DO THEY MEAN FOR YOUR RSE? APRA PS APRA’s key requirements1 Key differences to the Discussion Paper?2 Transitional application? Impact for your RSE Draft SPS 114 – Operational Risk Financial Requirements This prudential standard will require RSE Licensees to maintain adequate financial resources to address losses arising from operational risks that may affect business operations. The operational risk financial requirement (ORFR) is the target amount of financial resources that the RSE licensee determines is necessary to respond to these losses. An RSE Licensee must: This prudential standard generally reflects the principles outlined in the Discussion Paper, however, APRA would have the power to extend the three year transition period. Yes – 3 years with a power for APRA to extend if justified by an RSE Licensee. The board of the RSE Licensee is ultimately responsible for ensuring that all requirements are met, including ensuring that the RSE Licensee holds and has access to financial resources in the form of an operational risk reserve, operational risk trustee capital (or a combination) to meet the ORFR. Have a documented strategy that sets out the RSE Licensee’s approach to determining, implementing, managing and maintaining the ORFR. Have suitable policies and procedures to manage the financial resources held to meet the ORFR. Determine the tolerance limit below the ORFR that, if financial resources held to meet the ORFR were to breach this limit, would require the RSE licensee to notify APRA and implement a replenishment plan. APRA flags guidance on how insurance can be used to mitigate risks. Conditional relaxation of prohibition on the use of ORFR for administration deficiencies not identified by the RSE Licensee as an operational risk. APRA’s expectation of an ORFR target amount of “at least .25 per cent of funds under management” does not appear in the prudential standard and RSE Licensees will need to plan for more than .25% to accommodate non-operational risks. Risk management framework is critical as the amount of ORFR will be in inverse proportion to amount of residual risk. Consider potential for risk mitigation through insurance, due diligence of service providers and employer covenants for DB funds. Ensure the RSE Licensee has monitoring systems and ongoing compliance arrangements. Ensure that financial resources held to meet the ORFR are only used for 1 This column replicates the “Objectives and key requirements of this Prudential Standard” section in each draft APRA prudential standard dated April 2012. This column is a comparison of APRA’s Response to Submissions paper of April 2012 and the draft prudential standards of April 2012 with APRA’s Discussion Paper “Prudential Standards for Superannuation” of September 2011. 2 1 APRA PS APRA’s key requirements1 Key differences to the Discussion Paper?2 Transitional application? losses arising from operational risk. Impact for your RSE Read with: Proposed covenants in s52(2) (e) and (f) of the SIS Act to act fairly in dealing with beneficiaries of and within a class. SPS 220 – Risk Management. Prudential Practice Guide 200 – Risk Management. Prudential Practice Guide 110 – Capital. Proposed guidance on use of insurance policies to mitigate risks, impact of employer covenants on ORFR for defined benefit funds, reliance of due diligence on service providers to mitigate risk and use of the ORFR. APRA’s refinement of the conglomerate proposals contained in Discussion Paper: Supervision of Conglomerate Groups in the context of their application to RSE licensees. Draft SPS 160 – Defined benefit matters This prudential standard establishes the requirements for an RSE Licensee of a defined benefit fund to manage the fund in such a way that the RSE Licensee will be able, out of the assets of the fund, to meet liabilities of the fund as and when they become due. The requirements in the prudential standard also apply to defined benefit sub-funds. In September 2011, APRA proposed to focus on funding and solvency. However, the prudential standard covers funding to the vested benefits level, treatment of sub-funds and self insurance only. No Ensure ongoing compliance with the prudential standard including actuarial and auditing requirements. Read with: SPS 250 – Insurance in Superannuation. Part 9 of the SIS Regulations. Modification Declaration 23. 2 APRA PS APRA’s key requirements1 Key differences to the Discussion Paper?2 Transitional application? Impact for your RSE This prudential standard generally reflects the principles outlined in the Discussion Paper. No, but note the earlier application of proposed risk covenant in the SIS Act. RSE Licensees will need to adapt their current risk management framework to the new requirements. An RSE Licensee must: Arrange for the undertaking of, and reporting on, regular actuarial investigations into the financial position of a defined benefit fund. Arrange for an interim actuarial investigation in circumstances where the financial position of a defined benefit fund deteriorates below a shortfall limit set by the RSE Licensee. Implement a program to restore a defined benefit fund to a satisfactory financial position, so that the vested benefits of beneficiaries are fully funded, and submit the program to, and report to, APRA. If the fund is permitted to self-insure benefits, arrange for regular actuarial oversight, attest annually that the self insurance continues to be in the best interests of beneficiaries, and develop a contingency plan for an orderly wind up of the self insurance arrangements. Draft SPS 220 – Risk Management This prudential standard establishes requirements for an RSE Licensee to have systems for identifying, assessing, managing, mitigating and monitoring material risks that may affect its ability to meet its obligations to beneficiaries. Stronger Super reforms create new risks (both financial and non-financial) that will 3 APRA PS APRA’s key requirements1 These systems together with the structure, policies, processes and people supporting them, comprise an RSE Licensee’s risk management framework. The risk management framework must also be aligned with the RSE Licensee’s business plan. An RSE Licensee must: Have a written business plan that sets out the high level strategic direction of the RSE Licensee’s approach to managing its business operations. Maintain a board approved risk appetite statement. Maintain a board approved risk management strategy that describes the key elements of the risk management framework that give effect to the RSE Licensee’s strategy for managing risk. Have a designated risk management function responsible for assisting in the development, implementation and maintenance of the risk management framework. Ensure that the risk management framework is subject to effective and comprehensive review at least every 3 years and subject to a regular compliance audit. Key differences to the Discussion Paper?2 Transitional application? Impact for your RSE require identification. Licensees should consider new risks from other related reforms (FoFA, 2012 Budget and FATCA). There is a strong link between this standard and the Operational Risk Financial Requirements standard (see above). The better the risk management framework, the less residual risk and therefore the less ORFR required. There is a substantial, financial value-add from strong risk management, due diligence of service providers, fit and proper assessments. Timing – the requirement for a risk management strategy under new s52(8)(a) will apply from the effective date of the legislation, but SPS 220 will only apply from 1/7/13. Timing – a Licensee’s risk management framework will need to be well advanced in time for its MySuper application. Risk management appetite is a new and individualised concept that will require close consideration from RSE Licensees. Licensees should consider creating a designated risk management function within their business if they do not already have one. 4 APRA PS APRA’s key requirements1 Key differences to the Discussion Paper?2 Transitional application? Notify APRA when the RSE Licensee becomes aware of a significant breach of, or material deviation from, the risk management framework or discovers that the risk management framework does not adequately address a material risk. Impact for your RSE Read with: Section 52(8)(a) of the SIS Act. SPS 114 – Operational Risk Financial Requirements. MySuper authorisation application. Prudential Practice Guide SPG 200 – Risk Management. Submit a risk management declaration on an annual basis. Prudential Practice Guide SPG 233 Pandemic Planning and Risk Management. Maintain adequate technical, human and financial resources at a level that is adequate for the RSE Licensee’s business operations. Prudential Practice Guide SPG 234 – Management of Security Risk in Information and Information Technology. Proposed guidance on types of risks envisaged, consideration of systemic risks and risk appetite including consideration of risk appetites for different risk types, coverage of low frequency, high impact events and how different risks interact. Draft SPS 231 – Outsourcing This prudential standard aims to ensure that all outsourcing arrangements involving material business activities entered into by an RSE Licensee are subject to appropriate due diligence, approval and ongoing monitoring. All risks arising from outsourcing material business activities must be appropriately managed to ensure that the RSE Licensee is able to meet its This prudential standard generally reflects the principles outlined in the Discussion Paper. The Discussion Paper did not, however, articulate the requirement to consult with APRA prior to entering into any offshoring agreement involving a material Yes Review and assess existing contracts to determine materiality. Set up a contracts register. Consider your process for assessing potential contracts and whether they fall within the prudential standard. Consider implications of the transitional period. 5 APRA PS APRA’s key requirements1 obligations to its beneficiaries. An RSE Licensee must: Key differences to the Discussion Paper?2 Transitional application? business activity. Impact for your RSE Read with: Prudential Practice Guide 200 – Risk Management. Have a policy, approved by the board, relating to outsourcing of material business activities. Cross Industry Circular No 1 – Custodian Requirements. Have sufficient monitoring processes in place to manage the outsourcing of the RSE’s material business activities. SPS 232 – Business Continuity Management. SPS 114 – ORFR Have a legally binding agreement is in place for all outsourcing of material business activities. SPS 220 – Risk Management Consult with APRA prior to entering into agreements to outsource material business activities to service providers that conduct their activities outside Australia. SPS 520 – Fit and Proper SPS 310 – Audit & related matters SPS 510 – Governance SPS 521 – Conflicts of Interest Notify APRA after entering into agreements to outsource material business activities. Draft SPS 232 – Business Continuity Management This prudential standard aims to ensure that each RSE Licensee implements a whole of business approach to business continuity management, appropriate to the size, business mix and complexity of an RSE Licensee’s business operations. Further, that business continuity management increases resilience to business disruption arising from internal and external events and may reduce the impact of a business disruption on the This prudential standard generally reflects the principles outlined in the Discussion Paper. Yes Review or draft, (as appropriate), a Business Continuity Management (BCM) Policy. Review existing contracts - do all contracts require the provider to confirm they have an appropriate BCP? Review existing BCP for compliance with prudential standard (and the BCM) or draft new BCP that reflects organisational capacity of the RSE. Consider implications of transitional 6 APRA PS APRA’s key requirements1 Key differences to the Discussion Paper?2 Transitional application? Impact for your RSE period. business operations of an RSE Licensee. An RSE Licensee must: Read with: SPS 231-Outsourcing. Identify, assess and manage potential business continuity risks to ensure that it is able to protect the interests, and meet the reasonable expectations, of beneficiaries and protect the financial position of the RSE Licensee, any of its RSEs or connected entities. Prudential Practice Guide 200 – Risk Management. Prudential Practice Guide 233 – Pandemic Planning and Risk Management. Prudential Practice Guide 234 – Management of Security Risk in Information and Information Technology. Consider business continuity risks and controls as part of its overall risk management framework and approve a Business Continuity Management Policy. Develop and maintain a business continuity plan that documents procedures and information which enables the RSE Licensee to manage business disruptions. Review the business continuity plan annually and periodically arrange for its review by the internal audit function or an appropriate external expert. Notify APRA in the event of certain disruptions. Draft SPS 250 – Insurance in Superannuation This prudential standard establishes requirements for an RSE Licensee with respect to the offering of insured benefits to, and the acquisition of This prudential standard largely reflects the principles outlined in the Yes Develop and implement an insurance management framework (or amend the existing one) which includes as a minimum: 7 APRA PS APRA’s key requirements1 insurance for the benefit of beneficiaries. Key requirements include: The requirement for the RSE Licensee to have an insurance management framework. What the insurance management framework must include. The requirement to document the insurance strategy. The requirements for selecting an insurer and due diligence of selected insurers. The requirements for the insurance policy or policies and any related agreements. Monitoring requirements for the relationship with the insurer. Key differences to the Discussion Paper?2 Discussion Paper. The Discussion Paper did not envisage RSE Licensees being required to maintain detailed information about the beneficiaries in its RSEs and its claims experience as well as data about the sums insured and premiums paid. The Discussion Paper did not foreshadow the transitional application of the prudential standard to insurance policies and related agreements entered into prior to the registration of the prudential standard on the Federal Register of Legislative Instruments (expected to be December 2012). Transitional application? Impact for your RSE The insurance strategy required by section 52(7) of the SIS Act. The required inclusions in its insurance policies covering the RSE’s members for the permitted insurance products death, total and permanent disablement, partial disablement and terminal illness. A policy for administering the election by a member to opt out of the benefits provided by the RSE Licensee. Policies to ensure that all staff who are employed in the insurance activities of the RSE are fully aware of the framework. Develop and implement a policy for insurer selection and monitoring which includes the selection process (including conducting a due diligence review, analysis of the prospective insurer’s terms and conditions and premiums), appropriate allocation of resources to manage and monitor the RSE Licensee’s relationship with the insurer and the insurer’s performance. Review administration systems to ensure that they can accurately record: The data that RSE Licensees are required to retain for 5 years under the standard. Elections by members to opt out of benefits provided by the RSE Licensee. 8 APRA PS APRA’s key requirements1 Key differences to the Discussion Paper?2 Transitional application? Impact for your RSE Review insurance policies and offerings now to: Ensure that they address the requirements of the prudential standard and where they do not, take steps to renegotiate them. Identify the expiry of contracts in relation to non permitted insurance products to enable them to be phased out under a process and timeframe to be agreed with APRA. Read with: Section 52(7) of the SIS Act. Draft SPS 310 – Audit & related matters This prudential standard establishes requirements for the provision to the Board and senior management of an RSE Licensee of independent advice in relation to the operations, financial position and risk controls of the business operations of the RSE Licensee. This advice is designed to assist the Board and senior management in carrying out their responsibilities for the sound and prudent management of the business operations of the RSE Licensee. The prudential standard outlines the roles and responsibilities of the approved auditor of an RSE Licensee. It also outlines the obligations of an RSE Licensee to make arrangements The requirements relating to internal audit have been moved to SPS 510 – Governance. No RSE Licensees will need to appoint an auditor in accordance with the prudential standards, confirming that fitness and propriety standard is met. Ensure the auditor provides reports as required by prudential standard. Consider any new auditor terms of engagement carefully. Prepare for APRA and auditors finding their way with the intersection between SPS 310 and Australian Auditing Standards. The content of auditor reports for both Annual return forms and the prudential audit are not provided in the Draft SPS. They are to be completed after consultation in mid 2012. 9 APRA PS APRA’s key requirements1 Key differences to the Discussion Paper?2 Transitional application? to enable its approved auditor to fulfil his or her responsibilities. An RSE Licensee must: Impact for your RSE Read with: SPS 520 – Fit and Proper. SPS 510 – Governance. Make arrangements to enable its approved auditor to undertake his or her role and responsibilities. SPS 231 – Outsourcing. Prudential Practice Guide 100 – Capital. Submit to APRA all reports required to be prepared by an auditor under this prudential standard. Prudential Practice Guide 200 – Risk Management. The approved auditor: Auditor reports for both annual return forms and the prudential audit to be released. Prudential Practice Guide 520 – Fitness and Propriety. Must audit the financial statements and certain APRA annual return forms in relation to each RSE. Must review other aspects of that RSE and provide a report to the RSE Licensee. The audit and review must cover the RSE Licensee’s business operations in respect of the RSE. May also be required to undertake special purpose engagements. Draft SPS 510 – Governance APRA states that it is essential that an RSE Licensee has a sound governance framework and conducts its affairs with a high degree of integrity. A culture that promotes good governance benefits all stakeholders of an RSE Licensee and helps to maintain public confidence in the entity. APRA states that SPS-510 sets out Removal of the requirement that board assessment be “objective” and “independent”, which raised concerns that external reviews were to be mandated. Clarification of meaning of “non-executive director” in No Review board delegations and mechanisms for monitoring the exercise of delegations. Ensure there is a mechanism for the board to be satisfied of skills of directors and senior management. Consider ensuring the board has access to external consultants and advisers to 10 APRA PS APRA’s key requirements1 minimum foundations for good governance of an RSE Licensee’s business operations. It aims to ensure that an RSE Licensee’s business operations are managed soundly and prudently by a competent board, which can make reasonable and impartial business judgments in the best interests of beneficiaries. APRA considers that governance of an RSE Licensee builds on these foundations in ways that take account of the size, business mix and complexity of the RSE Licensee’s business operations. Key requirements include: That the board must have a policy on board renewal and procedures for assessing board performance. That the RSE Licensee must have a Remuneration Policy that aligns remuneration with risk management. That a Board Remuneration Committee must be established. That a Board Audit Committee must be established. That an RSE Licensee must have a dedicated internal audit function. Independence requirements for auditors consistent with those in the Corporations Act. Key differences to the Discussion Paper?2 relation to membership of Audit and Remuneration Committees. RSE Licensees can apply for relief from the Committee requirements if, for example, a Remuneration Committee is not required because of the nature of their remuneration structure, or if the board has neither independent nor non-executive directors. The Chair of any board committee on prudential matters must be a director. Remuneration policy will only cover remuneration received in relation to a person’s role with the fund regardless of the source. Internal audit moved to this SPS from SPS-310. It can be outsourced without APRA’s approval, but SPS231 outsourcing applies and selection of the provider is the responsibility of the Board Audit Committee. RSE Licensee can apply for an exemption from or modification of the internal audit requirement. Scope of Transitional application? Impact for your RSE supplement its skills and knowledge. Board performance assessment – can senior management carry out an effective assessment? SPS-510 requires a certain level of detail in the board renewal policy requirement to deal with how the board will remain open to new ideas and independent thinking while retaining expertise. Remuneration policy – review now to identify who it covers (including service providers) and to ensure it encourages behaviour to support stated goals. Don’t wait until disclosure time to identify issues. Internal audit – RSE Licensees will need to revise the scope of internal audit and the appointment process if it uses an external service provider. Existing whistleblowing laws are effectively expanded to include former officers and employees and contractors of RSE Licensee. RSE Licensees will need to reconsider employment contracts and service contracts to consider strategies to protect itself. Read with: SPS 520 – Fit and Proper. SPS 310 – Audit and Related Matters. SPS 231 – Outsourcing. SPS 220 – Risk Management. 11 APRA PS APRA’s key requirements1 Key differences to the Discussion Paper?2 Transitional application? Impact for your RSE Prudential Practice Guide 200 – Risk Management. internal audit narrowed. Prudential Practice Guide 230 – Adequacy of Resources. Prudential Practice Guide 520 – Fitness and Propriety. Proposed PPG 520 – regarding the standard of independence for directors and the chair. Proposed PPG 520 – regarding remuneration policy. Draft SPS 520 – Fit and proper APRA states that persons who are responsible for the management and oversight of an RSE Licensee’s business operations need to have appropriate skills, experience and knowledge, and act with honesty and integrity. These skills and qualities strengthen the protection afforded to beneficiaries and other stakeholders. To this end, RSE Licensees need to prudently manage the risk that persons in positions of responsibility might not be fit and proper. This prudential standard establishes minimum requirements for RSE Licensees in determining the fitness and propriety of individuals to hold positions of responsibility. Key requirements include that: An RSE Licensee must have and The Discussion Paper covered the proposed requirements to require the RSE Licensee to undertake an annual assessment of the fitness and propriety of all responsible persons and a separate assessment of the collective skill required to effectively govern the RSEs under trusteeship and criteria for auditors and actuaries. No Ensure the RSE Licensee has a Fit and Proper Policy that meets the requirements of the prudential standard. Determine assessment and monitoring processes for fit and proper persons, including where deemed not to be fit and proper. “Responsible person” captures considerably more people than “responsible officer”, so RSE Licensees should allow time for identification and assessment / re-assessment. The requirement to assess collective skill has not been included in the APRA PS draft. A review of the Australian Standard on Employment Screening would assist in developing the Fit and Proper Policy. Read with: Additional provisions concerning whistleblowing have been included. SPS 510 – Governance. SPS 521 – Conflicts of Interest. Proposed new definitions to be inserted 12 APRA PS APRA’s key requirements1 implement a Fit and Proper Policy that meets the requirements of this prudential standard. The fitness and propriety of a responsible person must generally be assessed prior to initial appointment and then re-assessed annually. Key differences to the Discussion Paper?2 Transitional application? APRA acknowledges the value of third party attestations of fitness and propriety but note RSE Licensee must be satisfied of relevant matters. Impact for your RSE into the SIS Act – senior manager, actuary and approved auditor. Proposed new sections126H (6) and 130D (5) of the SIS Act. Proposed new covenants in section 52(2) (b) and 52A (2) (b) (care, skill and diligence as a prudent superannuation trustee). An RSE Licensee must take all prudent steps to ensure that a person is not appointed to, or does not continue to hold, a responsible person position for which they are not fit and proper. Regulation 4.14 of the SIS Regulations. Prudential Practice Guide 520 – Fitness and Propriety. Additional requirements must be met for approved auditors and certain actuaries. Certain information must be provided to APRA regarding responsible persons and the RSE Licensee’s assessment of their fitness and propriety. Draft SPS 521 – Conflicts of interest This prudential standard establishes requirements for the identification, avoidance and management of conflicts of duty and interest. These requirements are essential to ensure that an RSE Licensee and its responsible persons meet legislative obligations in Part 6 of the SIS Act. The conflicts management framework must be approved by the board. This prudential standard generally reflects the principles outlined in the Discussion Paper. There are no express statements about the use of related service providers but there is also no apparent change of No Conflicts framework and policy must be applied to the RSE Licensee, directors and “responsible person(s)” as broadly defined in SPS 520 – Fit and Proper. The latter will require significant changes to current frameworks and policies. The standard is directed at creating a cultural change of conflict identification and management throughout the 13 APRA PS APRA’s key requirements1 An RSE Licensee must: Key differences to the Discussion Paper?2 Transitional application? position. Impact for your RSE business. Develop, implement and review a conflicts management policy that is approved by the board. The maintenance and disclosure of register of material interest could create stakeholder management issues. Identify all relevant duties and relevant interests. There will be considerable ongoing management and reporting obligations. Develop and publicly disclose register of relevant duties and relevant interests. Training will be required across business operations to ensure cultural change. The RSE Licensee will need to consider conflicts arising from related services providers. Read with: Proposed general covenants in s52 and s52A of the SIS Act. SPS 520 – Fit and Proper. Prudential Practice Guide 520 – Fitness and Propriety. Proposed guidance on conflicts management including materiality thresholds. ASIC RG181 Managing Conflicts of Interest. Draft SPS 530 – Investment governance This prudential standard establishes requirements for an RSE Licensee to implement a sound investment governance framework and to manage investments to protect the interests, and meet the reasonable expectations, of beneficiaries. Further, this investment governance Fees, costs and valuation independence and timing requirements and performance fees are omitted from SPS 530 because of their inclusion in the Act. Requirement to articulate No RSE Licensees face the challenge of articulating, monitoring and maintaining investment objectives and benchmarks. RSE Licensees should note that these obligations apply to both MySuper and choice products. Timing – many critical aspects will be dealt with in forthcoming guidance, 14 APRA PS APRA’s key requirements1 framework must include the investment strategies for the whole of each RSE and for each investment option, as required by the SIS Act. An RSE Licensee must: Formulate specific and measureable investment objectives for each investment option, including return and risk objectives. Develop appropriate measures to monitor the performance of investments on an ongoing basis. Review the investment objectives and investment strategies on a periodic basis. Formulate a liquidity management plan. Key differences to the Discussion Paper?2 an investment philosophy has been removed as it is acknowledged it would have little additional benefit. Transitional application? Impact for your RSE which means the RSE Licensee may need to make informed decisions prior to guidance based on advice and consultation with their APRA supervisor. RSE Licensees will likely need to develop more formal responsibility and reporting structures, and incorporate external investment functions into these structures. RSE Licensees will need to consider the application of Outsourcing and Fit and Proper standards to external investment managers and determine how many levels of investment managers need to be considered. RSE Licensees may find it challenging to deal with different rules (e.g. fees) in MySuper and Choice products. Alternative asset classes will present challenges in both valuation and the monitoring of performance. RSE Licensees will likely need to make substantive changes to terms of engagement of service providers including asset consultants, fund managers and custodians. Fund Managers may need to make changes to their products and to their reporting functions to accommodate the requirements of RSE Licensees. Read with: New investment covenants, in particular 15 APRA PS APRA’s key requirements1 Key differences to the Discussion Paper?2 Transitional application? Impact for your RSE s52(6)(c) to ensure investment options allow adequate diversification. SPS 231 – Outsourcing. Prudential Practice Guide 200 – Risk Management. Prudential Practice Guide 520 – Fitness and Propriety. “Standard risk measure guidance paper for trustees” July 2011, Financial Services Council and ASFA. Proposed APRA guidance on fees, costs and valuation requirements in the Act and also performance fees. 16