18% of APRA SPS 220 Risk Management (Superannuation) you already have
ISO/IEC 23894:2023 already covers about 18% of APRA SPS 220 Risk Management (Superannuation), leaving
23 of 28 controls as genuinely new work.
Already covered 4
Likely covered 1
New work 23
What is genuinely new work
Nothing in ISO/IEC 23894:2023 reaches these. This is the list to scope.
SPS220-13Board Risk Responsibility
SPS220-14Member Best Financial Interests
SPS220-15Senior Management Responsibility
SPS220-16Risk Management Function
SPS220-17Risk Management Framework
SPS220-18Scope of Framework
SPS220-19Risk Appetite Statement
SPS220-20Risk Management Strategy
SPS220-23Material Risks Identification
SPS220-25Investment Risk Management
SPS220-26Strategic and Concentration Risk
SPS220-31Outsourcing Risk Management
SPS220-37Three Lines Model
SPS220-42Risk Reporting to Board
SPS220-44Material Risk Event Reporting
SPS220-46Comprehensive Review of RMF
SPS220-48Internal Audit of RMF
SPS220-50Business Continuity Management
SPS220-52Conflicts Management
SPS220-56Whistleblower Arrangements
Show the 5 you already have
SPS220-22Risk Identification and Assessment
SPS220-27Insurance Risk Management
SPS220-28Risk Management Declaration
SPS220-29Operational Risk Management
How this is calculated
Already covered means a mapping runs from a control in ISO/IEC 23894:2023 to that control. Likely
covered means no direct mapping exists but both frameworks map to the same control in a third
standard. New work means neither. We keep those separate rather than adding them into one
friendlier number, because blending them would present a two-hop inference as a verified
fact.
Coverage is not symmetric.
Run it the other way and you will get a
different number; both are correct.
From 332,959 cross-framework control
mappings across 723 frameworks, 531 of them verified against
their source documents. It does not tell you that you are compliant: a mapped control means
the two standards ask for the same thing, not that you have done it.
Try another pair ยท
Today's edition