6. The Board shall establish and oversee a documented risk-management framework, which shall:
|
(a)
|
include the SIPS operator’s risk tolerance and risk appetite policy;
|
|
(b)
|
assign responsibilities and accountability for risk decisions;
|
|
(c)
|
address decision making in crises and emergencies;
|
|
(d)
|
address internal control functions.
|
The Board shall establish a risk committee to assist it in discharging its risk-related responsibilities. The risk committee shall advise the Board on the SIPS’s risk management.
The Board shall ensure that there are three clear and effective lines of defence (operations, risk management and internal audit), which are separate from each other and have sufficient authority, independence, resources and access to the Board.