PRU 10.3.2

(1) An Authorised Person must establish and maintain an IRAP which details the processes and procedures by which the firm will identify, assess, aggregate and monitor the risks faced by it.
(2) The firm must conduct the IRAP assessment at least annually giving due regard to the Guidance in Section A11.1 of App11.
(3) The IRAP assessment conducted by the firm pursuant to (2) must be approved by its Governing Body and then submitted to the Regulator within four months from the end of the firm's financial year.
(4) In addition to (2), the firm must conduct an IRAP assessment:
(a) whenever there is material change to the business, strategy, nature or scale of the activities of the firm which may have a significant impact on its risk profile or adequacy of its Capital Resources or Adjusted Capital Resources, as applicable; or
(b) as and when required by the Regulator.
(5) An IRAP assessment conducted by the firm pursuant to (4) must be approved by its Governing Body and then submitted to the Regulator within two months, or such other period as may be specified by the Regulator, from the date of such material change or requirement.