Regulation 21 - Risk Management Committee.

Risk Management Committee requirement mandates listed entities to establish a committee with specified composition, meetings, cybersecurity role and investigative powers.

The board must constitute a Risk Management Committee of at least three members with a board-member majority and at least one independent director; certain entities require a higher proportion of independent directors. The Chairperson must be a director, meetings must occur at least twice yearly with a specified quorum and maximum interval, and the committee's role-as defined by the board-may include delegated monitoring and review of the risk management plan, expressly covering cybersecurity. The committee applies to specified large and high-value debt listed entities and may seek information, external advice, and expert attendance.