Background

1. The Public Governance, Performance and Accountability Act 2013 (PGPA Act) places a duty on Accountable Authorities¹ of Commonwealth entities to establish and maintain appropriate systems of risk oversight and management for the entity.² To promote a coherent approach to discharging these duties and to assist Commonwealth entities to understand the requirements for managing risk, the Australian Government released the Commonwealth Risk Management Policy (Commonwealth Policy) on 1 July 2014 as an element of the Public Management Reform Agenda (PMRA).

2. One of the guiding principles of the PMRA reforms is that ‘engaging with risk is a necessary first step in improving performance’, and one of the lasting benefits that the reforms are seeking to deliver is ‘a more mature approach to risk across the Commonwealth’.³ The effective management of risks assists Commonwealth entities and companies to:

• set and achieve strategic objectives;
• comply with legal and policy obligations;
• improve decision making; and
• allocate and utilise resources.

3. The Joint Committee of Public Accounts and Audit (JCPAA) highlighted, in its recent report on Commonwealth Risk Management, that risk management should be an integral part of the way the Australian public sector conducts business.⁴

Commonwealth Risk Management Policy

4. The Commonwealth Policy defines risk as ‘the effect of uncertainty on objectives’ and risk management as the ‘coordinated activities to direct and control an organisation with regard to risk’.⁵ The goal of the Commonwealth Policy is to embed risk management as part of the culture of Commonwealth entities where the shared understanding of risk leads to well informed decision making.⁶

5. The Commonwealth Policy advises that risk culture is the set of shared attitudes, values and behaviours that characterise how an entity considers risk in its day-to-day activities. A positive risk culture: promotes an open and proactive approach to managing risk that considers both threat and opportunity; and is one where risk is appropriately identified, assessed, communicated and managed across all levels of the entity.⁷

6. Non-corporate Commonwealth entities, which include departments of state and most regulatory bodies, must comply with the Commonwealth Policy. Corporate Commonwealth entities are not required to comply with the policy, but are expected to review and align their risk management frameworks and systems with the policy as a matter of good practice.

7. The Commonwealth Policy mandates 22 specific requirements organised in nine policy elements. The policy elements are summarised in Box 1 and reproduced in Appendix 2.

Audit objective and criteria

8. The objective of the audit was to assess how effectively selected public sector entities manage risk. To form a conclusion against the audit objective, the ANAO adopted the following high-level audit criteria:

• the selected entities’ risk management policies and frameworks meet the requirements of the Commonwealth resource management framework, including the Commonwealth Risk Management Policy;
• the selected entities’ business operations and key business processes are informed by considerations of risk; and
• the selected entities have established a supporting risk culture.

9. This performance audit is one of three audits in the ANAO’s work program that address key aspects of the implementation of the Public Governance, Performance and Accountability Act 2013 (PGPA Act). These audits have been identified by the Joint Committee of Public Accounts and Audit (JCPAA) as priorities of the Parliament and will assist in keeping the Parliament, government and the community informed on implementation of the resource, risk and performance management frameworks introduced by the PGPA Act.

10. Four non-corporate Commonwealth entities were selected for inclusion in the audit: the Department of Employment (Employment), the Department of Health (Health), the Australian Communications and Media Authority (ACMA), and the Australian Fisheries Management Authority (AFMA).

Conclusion

11. The four entities involved in the audit have met or mostly met the majority of the 22 specific requirements of the Commonwealth Risk Management Policy, with further work required by three entities (Health, ACMA and AFMA) to fully realise the Policy’s goal of embedding risk management as part of the entity’s culture, where the shared understanding of risk leads to well-informed decision making.

• Employment has a mature and integrated approach to the identification and management of risk and has implemented a range of measures to build its risk capability, including an enterprise-wide risk management system. There is entity-level oversight of the operation of the risk management policy and framework through an internal governance committee which has reported regularly to the department’s Executive Committee on the adequacy of the risk framework and associated processes.
• Health has an ongoing program to strengthen and fully operationalise its risk management framework and capability, following reviews in 2014 and 2016 which identified scope for improvement. Key risks are regularly considered by Health’s Executive Committee in its consideration of specific departmental strategies and plans. There remains scope for a more structured approach to reporting on and reviewing enterprise-level risks and the status of risk controls and treatments.
• ACMA’s key risks are reviewed quarterly by the senior executive as part of a regular cycle, and the Authority is in the process of reviewing its risk management policy. ACMA included a risk tolerance statement in its 2015 risk management guide but has not yet developed a risk appetite statement. ACMA’s risk management guidance provides a high-level description of risk management, but limited practical guidance on how staff should manage risk.
• Sustainability risks were regularly considered by the AFMA Commission in its consideration of specific fisheries management strategies and plans. As with Health, there remains scope for a more structured approach to reporting on and reviewing enterprise-level risks, controls and treatments. Risk management guidance available on the Authority’s intranet was minimal and not up to date, and AFMA does not have formal learning and development programs in risk management for staff. The Authority should address these impediments to the development of a positive risk management culture.

12. Each of the selected entities has continued to develop its risk management policies, framework and capability since the release of the Commonwealth Policy in July 2014. As a result of these efforts Employment has met, and Health and ACMA have mostly met, the requirement of policy element five and the overarching goal of the Commonwealth Policy—relating to the development of a positive and embedded risk culture. AFMA has partly met the requirement of policy element five and the overarching policy goal.

13. A number of areas for improvement have been identified for the selected entities, and more general matters which may also warrant attention by other Commonwealth entities. The two categories of learnings address: for the selected entities, measures which would improve compliance with the policy requirements; and, for all public sector entities, key learnings focusing on strengthening risk management capability, culture and performance.

Supporting findings

Implementation

14. The four selected entities have met or mostly met the majority of the 22 mandated requirements of the Commonwealth Risk Management Policy (Commonwealth Policy)⁸:

• the Department of Employment (Employment) met 19 and mostly met two of the requirements (total 21/22 or 95 per cent);
• the Department of Health (Health) met 10 and mostly met 10 of the requirements (total 20/22 or 91 per cent);
• the Australian Communications and Media Authority (ACMA) met six and mostly met 10 of the requirements (total 16/22 or 73 per cent); and
• the Australian Fisheries Management Authority (AFMA) met 13 and mostly met two of the requirements (total 15/22 or 68 per cent).

Risk policy and framework

15. Each of the selected entities released an updated risk policy and framework within 12 months of the release of the Commonwealth Risk Management Policy. The selected entities have also continued to update elements of their policy and framework (Employment and AFMA) or have plans to do so (Health and ACMA).

Stakeholder consultation

16. The selected entities’ risk management frameworks were developed with extensive internal consultation, including with audit committees. There remains scope for entities to include, in their risk framework documentation, their arrangements for communicating, consulting and reporting on risk to both their internal and external stakeholders.

Responsibilities

17. For three entities, responsibilities for managing and reporting on risk are clearly identified (Employment, Health and AFMA). ACMA has documented some, but not all, responsibilities.

Defining risk appetite and tolerance

18. Three of the selected entities developed new or revised risk appetite and tolerance statements following the release of the Commonwealth Policy (Employment, Health and AFMA). One entity included a risk tolerance statement in its 2015 risk management guide, but has not developed a risk appetite statement (ACMA).

Considering risk in business decisions and operations

19. The risk framework and key risks were regularly considered at senior levels within the selected entities. There is scope for a more structured approach to reporting on and reviewing enterprise-level risks and the status of risk controls and treatments (Health and AFMA). At present there is limited management reporting to the Executive Committee (Health) or Commission (AFMA) on enterprise-level risks, and no reporting on operational risks to the Audit and Risk Committee (Health and AFMA).

20. The ANAO’s review of a selection of business activities in each entity indicates that risk management also informs normal business operations. Risk was considered when key business decisions were made or advice was provided to senior management or government in the areas selected for review.

Managing shared risk

21. The identification and management of shared risks is one of the least mature elements of entities’ implementation of the Commonwealth Policy. Shared risks are not routinely identified and managed as such in the context of entities’ risk management policies and frameworks (Health, ACMA and AFMA).

Risk management capability

22. The selected entities have implemented a range of measures to build their risk management capability. Key measures include:

• regular internal reporting on the entity’s risk profile and risk framework (Employment and ACMA);
• risk management guidance, templates and dedicated risk hot lines or email addresses (Employment, Health and ACMA);
• staff resources dedicated to risk management (Employment, Health);
• custom-built risk management systems (Employment); and
• learning and development programs which address risk management, including eLearning modules (Employment, Health and ACMA).

Review activity

23. The selected entities’ risk management policies include a commitment to regularly review the risk framework, and each of the entities has continued to review its risk management policies and framework since the Commonwealth Policy was released in July 2014.

Corporate plans

24. The selected entities were at different levels of maturity in their implementation of the corporate plan requirement relating to risk, with further work required in all entities to fully embed the requirement.

Areas for improvement and key learnings

25. Based on the audit findings, the Australian National Audit Office has identified areas for improvement on a range of matters which warrant further attention by the selected entities, and key learnings that could be applied by other public sector entities. The two categories of learnings presented in Box 2 and Box 3 address the Commonwealth Policy’s goal of embedding risk management as part of an entity’s culture, where the shared understanding of risk leads to well informed decision making.

Summary of entity responses

26. The Department of Employment, the Department of Health, the Australian Communications and Media Authority, the Australian Fisheries Management Authority, and the Department of Finance were provided with a copy of the proposed audit report, and the Australian Public Service Commission was provided with an extract of the proposed report for comment. A summary of the responses received from entities is provided below, with the full responses provided at Appendix 1.

Department of Employment

The Department of Employment (the Department) welcomes the overall findings of the Australian National Audit Office’s (the ANAO) Performance Audit of the Management of Risk by Public Sector Entities (the audit).

The Department recognises risk management is a cornerstone of good corporate governance and organisational success. Managing risk well enables us to achieve our outcomes and promotes the efficient, effective and ethical use of Australian Government resources. The audit concludes the Department has a mature and integrated approach to the identification and management of risk and has implemented a range of measures to build its risk capability. The Department has consciously invested in its risk management framework and I am pleased the ANAO has identified the positive returns from this investment.

The process of mature risk management is ongoing and we will take action in relation to areas for improvement identified in the audit that relate to the Department.

Department of Health

I am pleased that the ANAO found that the Department of Health (Health) has met a substantial number of the requirements of the Commonwealth Risk Management Policy. The report demonstrates the progress Health has made to improve its risk management approach and shift to a more risk aware culture. Shifting an organisation’s risk culture requires significant commitment from all levels within the organisation and takes time.

In April 2017, Health’s Accountability Authority endorsed and released a revised Risk Management Policy. This Policy articulates our approach to building a culture of effective risk engagement, where each of us has the skills and confidence to identify and manage risks appropriately.

The report has highlighted several areas for improvement in order to strengthen the systems and culture that are required to embed a risk aware culture. Health agrees with these findings and will implement actions to facilitate improvement in these areas.

Australian Communications and Media Authority

The findings are timely as the ACMA Risk Management Framework is currently under review and we will keep the ANAO’s findings front of mind while making refinements to this framework.

As part of our review, we have already taken steps to address some of the areas for improvement identified by the ANAO. Our Executive Group is releasing a revised Risk Appetite Statement and we are working to ensure our agency has the capability to engage effectively with risk.

The Executive Group has started the discussion to establish an enduring policy position on the identification and management of shared risk.

We have appointed a Chief Risk Officer to drive improvements to the Risk Management Framework and provide additional support to staff.

There is a strong culture of risk management within the ACMA. The insights provided by the ANAO will help us to refine our Risk Management Framework in a way that best supports and builds on that culture.

Australian Fisheries Management Authority

The Australian Fisheries Management Authority (AFMA) acknowledges the supported findings and areas of improvement outlined in this report. AFMA has recently reviewed our Risk Management Policy and Risk Management Guidelines and the report will greatly assist in their full implementation.

Department of Finance

The Department of Finance supports the findings of this report.

Introduction

1.1 The Public Governance, Performance and Accountability Act 2013 (PGPA Act) places a duty on Accountable Authorities⁹ of Commonwealth entities to establish and maintain appropriate systems of risk oversight and management for the entity.¹⁰ To promote a coherent approach to discharging these duties and to assist Commonwealth entities to understand the requirements for managing risk, the Australian Government released the Commonwealth Risk Management Policy (Commonwealth Policy) on 1 July 2014 as an element of the Public Management Reform Agenda (PMRA).

1.2 One of the guiding principles of the PMRA reforms is that ‘engaging with risk is a necessary first step in improving performance’, and one of the lasting benefits that the reforms are seeking to deliver is ‘a more mature approach to risk across the Commonwealth’.¹¹ The effective management of risks assists Commonwealth entities and companies to:

• set and achieve strategic objectives;
• comply with legal and policy obligations;
• improve decision making; and
• allocate and utilise resources.

1.3 The Joint Committee of Public Accounts and Audit (JCPAA) highlighted, in its recent report on Commonwealth Risk Management, that risk management should be an integral part of the way the Australian public sector conducts business.¹²

Commonwealth Risk Management Policy

1.4 The Commonwealth Policy defines risk as ‘the effect of uncertainty on objectives’ and risk management as the ‘coordinated activities to direct and control an organisation with regard to risk’.¹³ The Commonwealth Policy has 22 requirements organised in nine policy elements. The nine elements of the Commonwealth Policy are presented in Figure 1.1.

Figure 1.1: Elements of the Commonwealth Risk Management Policy

 

 

Note: Elements 1–3 of the Commonwealth Policy are comprised of multiple requirements. The mandatory requirements of the Commonwealth Policy are outlined at Appendix 2.

Source: ANAO presentation of the Commonwealth Risk Management Policy.

1.5 The goal of the Commonwealth Policy is to embed risk management as part of the culture of Commonwealth entities where the shared understanding of risk leads to well informed decision making.¹⁴ Element five of the policy also provides that an entity’s risk management framework must support the development of a positive risk culture.

1.6 The policy advises that risk culture is the set of shared attitudes, values and behaviours that characterise how an entity considers risk in its day-to-day activities. A positive risk culture: promotes an open and proactive approach to managing risk that considers both threat and opportunity; and is one where risk is appropriately identified, assessed, communicated and managed across all levels of the entity.¹⁵

1.7 Professor Peter Shergold AC has observed that the PGPA Act ‘represents a significant and positive step towards developing better risk practice and culture. The risk management policy established under the PGPA Act is designed to assist Accountable Authorities … to engage positively with risk, in order to embed risk practice into business processes’.¹⁶

1.8 Non-corporate Commonwealth entities, which include all departments of state, must comply with the Commonwealth Policy. Corporate Commonwealth entities are not required to comply with the policy, but are expected to review and align their risk management frameworks and systems with the policy as a matter of good practice.

1.9 A review of the Commonwealth Policy was originally scheduled to occur in 2015—a year after its release. This was deferred following recognition that entities needed time to align their frameworks to the Commonwealth Policy. The review is now scheduled to align with the review of the PGPA Act.¹⁷

Related requirements

1.10 The PGPA Act also introduced the requirement that entities produce annual corporate plans and report on entity performance in annual performance statements. The PGPA Rule 2014, made pursuant to the Act, provides that an entity’s corporate plan must provide a summary of the risk oversight and management systems of the entity for each reporting period covered by the plan (section 16E).

1.11 The PGPA Rule 2014 also provides that the functions of an entity’s audit committee must include reviewing the appropriateness of the accountable authority’s system of risk oversight and control.¹⁸

Comparison with the Australian/New Zealand Risk Standard and risk management frameworks in other jurisdictions

1.12 The Commonwealth Risk Management Policy references relevant risk standards¹⁹ and is consistent with the standard jointly published by Standards Australia and Standards New Zealand, Risk management—principles and guidelines.²⁰

1.13 Other jurisdictions in Australia and internationally also publish public sector risk management policies and/or guidance to assist entities. This material is framed by each jurisdiction’s legislative framework and policy responsibilities. The Commonwealth Policy and associated guidance is broadly consistent with the risk management material published by other jurisdictions that was reviewed by the ANAO.²¹ For example, defining risk appetite and/or tolerance, the importance of communication, consultation and shared risks are common elements of policy and guidance in a number of jurisdictions, such as NSW and Canada.

1.14 While risk management is not new to the Commonwealth public sector²², the implementation of a mandated risk management policy is a new development and not one that has been adopted and tested in comparable administrative systems. The United Kingdom for instance released a risk management framework in January 2017, which provides high level guidance rather than a mandated policy.²³ Similarly, the Canadian and New Zealand Governments each have a broad, principled framework for the management of risk rather than a policy with mandatory requirements.

Surveys of risk management practices in the Australian Public Sector

1.15 Australian Government entities are required to submit a self-assessment of their risk management capability for the purposes of Comcover’s annual Risk Management Benchmarking Survey. In addition the Australian Public Service Commission (APSC) undertakes the annual Australian Public Service (APS) employee census and the annual agency survey, which have included questions on risk management.

Risk Management Benchmarking Survey

1.16 The Department of Finance (Comcover)²⁴ has conducted an annual benchmarking program since 2001. The Risk Management Benchmarking Survey is a tool to assist entities self-assess their risk management capability against each of the nine elements outlined in the Commonwealth Policy (see Figure 1.1).

1.17 The 2016 Risk Management Benchmarking Survey (the survey) was open for completion from 18 January to 4 March 2016. A total of 143 Australian Government (non-Corporate) entities participated in the survey in 2016 by submitting a self-assessment rating of their risk management capability using a six level risk maturity model, as illustrated in Figure 1.2.

Figure 1.2: Six level risk maturity model rating

 

 

Note: While a risk maturity rating level indicates where there is still scope to improve risk management capabilities, it is not a ‘compliance rating’.

Source: Risk Management Benchmarking Program 2016: Comcover’s Key Findings Report.

1.18 Entities are encouraged to adopt risk maturity ratings that are fit for purpose for their organisation. Not all entities are expected to achieve an ‘optimal’ rating, and entity maturity levels are not a ‘compliance’ rating.

1.19 In the 2016 survey, 67 per cent of entities self-reported a maturity level of Systematic or Integrated, and 30 per cent of entities reported achievements of Advanced or Optimal maturity. Comcover observed in its key findings report that a general shift towards higher overall risk maturity levels across the entities in 2016 from 2015 (Figure 1.3) indicates that many entities have made progress in building their risk management capability over the last year.

1.20 The distribution of the maturity levels achieved by participating entities in the 2016 benchmarking survey is illustrated in Figure 1.3.

Figure 1.3: Distribution of maturity levels achieved by participating entities— Comcover risk benchmarking survey

 

 

Source: ANAO reproduction of data presented in the Risk Management Benchmarking Program 2016: Comcover’s Key Findings Report.

1.21 Comcover has observed that the findings of the 2016 survey indicate that 88 per cent of entities have a risk management policy that has been endorsed by their accountable authority and is aligned with their corporate plan and objectives. According to Comcover, the survey indicates that ‘while there are pockets of well embedded risk management practice, there is still room to improve how well risk management is embedded into strategic planning, governance arrangements and program delivery.’

1.22 Comcover noted that the 2016 survey results indicate that the highest performing elements of the Commonwealth Policy across the population of entities were:

• Element 1 – Establishing a risk management policy;
• Element 3 – Defining responsibility for managing risk; and
• Element 4 – Embedding systematic risk management into business processes.

1.23 Comcover further noted that the 2016 survey results indicated that the Commonwealth Policy elements that were the lowest scoring elements across the population of entities were:

• Element 5 – Developing a positive risk culture;
• Element 7 – Understanding and managing shared risk; and
• Element 8 – Maintaining risk management capability.

1.24 Key insights and the maturity distribution across the surveyed population of entities for each element of the Commonwealth Risk Management Policy are illustrated in Figure 1.4.

Figure 1.4: Key insights and maturity distribution across the surveyed population for each element of the Commonwealth Risk Management Policy

 

 

Source: Risk Management Benchmarking Program 2016: Comcover’s Key Findings Report.

Australian Public Service Commission data

1.25 The Australian Public Service Commission (APSC) surveys APS agencies and employees annually on a range of workforce management issues. Both surveys have included a number of questions relating to risk management.

1.26 The self-assessments by APS agencies indicate that:

• 48 per cent of surveyed entities had plans to improve risk management during 2016;
• 39 per cent of surveyed entities considered that no action was necessary to improve risk management in their entity;
• 19 per cent of surveyed entities reported that no barriers existed to improving risk management capability in 2016; and
• the main challenges to improving risk management capability were:
  • resource availability and consistency of risk management practices (17 per cent);
  • limited resource availability (15 per cent); and
  • enhancing risk management frameworks and practices (11 per cent); and
• surveyed employees were less positive in 2016 compared with 2015 about entities’ risk management practices.

1.27 A summary of the results of the APS employee census is presented in Figure 1.5.

Figure 1.5: Summary results for all employees surveyed by the APSC in 2016

 

 

Source: ANAO analysis of 2016 APS employee census responses.

Audit coverage

1.28 This performance audit is one of three audits in the ANAO’s work program that address key aspects of the implementation of the Public Governance, Performance and Accountability Act 2013 (PGPA Act). The other two audits are:

• Report No.54 2016–17 Corporate Planning in the Australian Public Sector. This performance audit is the second in a series of audits that assessed progress in implementing the corporate planning requirement under the PGPA Act. The first in the series was Report No.6 2016–17 Corporate Planning in the Australian Public Sector; and
• Report No.58 2016–17 Implementation of the Annual Performance Statements Requirements 2015–16. This audit assessed the performance statements included in the 2015–16 Annual Reports of the Department of Agriculture and Water Resources and the Australian Federal Police.

1.29 These audits have been identified by the Joint Committee of Public Accounts and Audit as priorities of the Parliament and will assist in keeping the Parliament, government and the community informed on implementation of the resource, risk and performance management frameworks introduced by the PGPA Act.

Entities selected for inclusion in the audit

1.30 Four non-corporate Commonwealth entities were selected for inclusion in the audit:

• two departments of state—the Department of Employment (Employment) and the Department of Health (Health); and
• two regulatory bodies— the Australian Communications and Media Authority (ACMA) and the Australian Fisheries Management Authority (AFMA).

1.31 Table 1.1 contains additional information about the selected entities.

Table 1.1: Information about the selected entities

Source: ANAO analysis of data in entities’ 2016–17 Corporate Plans.

Audit objective and scope

1.32 The objective of the audit was to assess how effectively selected public sector entities manage risk. To form a conclusion against the audit objective, the ANAO adopted the following high-level audit criteria:

• the selected entities’ risk management policies and frameworks meet the requirements of the Commonwealth resource management framework, including the Commonwealth Risk Management Policy;
• the selected entities’ business operations and key business processes are informed by considerations of risk; and
• the selected entities have established a supporting risk culture.

1.33 In undertaking the audit, the ANAO:

• sought representations from entity management on entities’ performance in relation to the audit objective;
• reviewed relevant documents, including the risk management policies and frameworks of the four entities;
• interviewed staff and reviewed relevant risk management records in a sample of business areas; and
• interviewed the chairs of entity audit committees.

1.34 In addition, the ANAO has drawn on:

• information obtained by the Australian Public Service Commission (APSC) through its data collections; and
• interviews with Department of Finance staff and records held by Finance in the context of its responsibilities as the policy owner of the resource management framework and Comcover’s risk management responsibilities.

1.35 The ANAO applied part of its methodology developed for the recent series of audits of Corporate Planning in the Australian Public Sector.²⁵ The relevant part of the methodology was used to assess the maturity of the risk oversight and management section of entities’ corporate plans.²⁶

1.36 The audit was conducted in accordance with the ANAO Auditing Standards at a cost to the ANAO of approximately $526 000.

1.37 The team members for this audit were Russell Coleman, Alex Doyle, Deanne Allan, Renée Hall and Michelle Page.

Have entities implemented the Commonwealth Risk Management Policy?

2.1 The Minister for Finance issued the Commonwealth Risk Management Policy (Commonwealth Policy) on 1 July 2014. Non-corporate Commonwealth entities must implement the Commonwealth Policy, which has 22 specific requirements organised in nine policy elements.

2.2 The ANAO’s review of the selected entities’ implementation of the Commonwealth Policy indicated that entities have met or mostly met the following percentage of requirements: Employment, 95 percent; Health, 91 percent; ACMA, 73 percent; AFMA, 68 percent. Table 2.1 summarises the number of requirements met or mostly met by the selected entities.

Table 2.1: Number of mandated requirements met or mostly met by selected entities

Source: ANAO analysis.

2.3 Table 2.2 presents the ANAO’s summary assessment of the selected entities’ implementation of the nine policy elements of the Commonwealth Risk Management Policy.

Table 2.2: ANAO’s summary assessment of selected entities’ implementation of the Commonwealth Risk Management Policy

 

 

Source: ANAO analysis.

2.4 The ANAO’s review of the selected entities’ implementation of the Commonwealth Policy indicated that specific matters which warrant further attention relate to:

• defining the entity’s risk appetite in the risk management policy (ACMA);
• enhancing risk management capability (Health, AFMA and ACMA);
• improving the identification and management of shared risks (all entities);
• developing arrangements for communicating and consulting on risk with external stakeholders (all entities);
• improving arrangements to regularly review risks, risk management frameworks and the application of risk management practices (Health, AFMA and ACMA);
• seeking formal assurance from managers in preparing the responses to the Comcover survey of risk maturity (all entities);
• fully embedding the corporate plan requirement relating to risk (all entities); and
• assigning responsibility for risk management to individuals or positions, rather than work areas (Health, ACMA and AFMA).

2.5 To assess the selected entities’ implementation of the overarching goal of the Commonwealth Policy²⁷ and its policy element five—developing a positive risk culture²⁸—the ANAO had regard to: entities’ implementation of the Commonwealth Policy requirements (summarised in Table 2.2 above); risk management in a selection of business activities in each entity; and the consideration of risk by senior leaders.

2.6 The ANAO’s review of a selection of business activities²⁹ indicates that risk management informs normal business operations in the selected entities. Risk was considered when key business decisions were made or advice was provided to senior management or government by the areas selected for review. Further, the risk framework and key risks were regularly considered at senior levels within the selected entities (see paragraph 2.33).

2.7 In summary, the ANAO’s review indicated that Employment has met, and Health and ACMA have mostly met, the requirement of policy element five and the overarching goal of the Commonwealth Policy. AFMA has partly met the requirement of policy element five and the overarching Policy goal.

2.8 The selected entities’ implementation of the Commonwealth Risk Management Policy is discussed in more detail later in this chapter.

Comcover Risk Management Benchmarking surveys

2.9 In 2015 and 2016, Comcover conducted a Risk Management Benchmarking survey that provided participating entities the opportunity to assess their level of maturity against each of the nine elements of the Commonwealth Risk Management Policy and to obtain an overall level of maturity based on their responses to the surveys. The six level risk maturity model is illustrated in Figure 2.1.

Figure 2.1: Six level risk maturity model rating

 

 

Source: Risk Management Benchmarking Program 2016: Comcover’s Key Findings Report.

2.10 While entities’ maturity levels and targets indicate where there remains scope for improvement in risk management capabilities, they are not a compliance rating. Accountable authorities are responsible for entity risk settings having regard to their business and operating environment. Maturity levels and targets may therefore differ between entities, and are not mandated.

Selected entities’ self-assessment

2.11 Table 2.3 presents the selected entities’ self-assessment of their risk maturity levels against the nine elements of the Commonwealth Policy for 2016, and their target level of maturity for the following year.

Table 2.3: Entities’ 2016 self–assessment of their risk maturity levels, and targets for 2017, against the nine elements of the Commonwealth Policy.

Note: * Entities self-assessed as Advanced, while the ANAO’s assessment was ‘partly met’.

Source: Risk Management Benchmarking Program 2016: Comcover’s Key Findings Report.

2.12 The ANAO’s review indicates that there is broad alignment on the majority of elements between the ANAO’s assessment of the selected entities’ implementation of the Commonwealth Risk Management Policy (Table 2.2) and entities’ 2016 self-assessment of their risk maturity levels (Table 2.3).³⁰

2.13 As part of its review, the ANAO sought information to support the selected entities’ responses to the 2016 survey.

2.14 Entities provided the ANAO with a range of documentation that supported the majority of their survey responses. To strengthen the level of assurance provided to senior leaders, entities could consider:

• improving the level of documentation they maintain in support of responses to future surveys; and
• obtaining formal management sign-offs to support entity responses to survey questions that relate to risk management practices in operational areas.

Key Findings Report on 2016 Risk Management Benchmarking Survey

2.15 The Key Findings Report prepared for Comcover, following the 2016 Risk Management Benchmarking Survey, summarised the key observations relating to the self-assessment of 143 Australian Government (non-Corporate) entities. The report’s key findings are in Box 4.

Source: Risk Management Benchmarking Program 2016: Comcover’s Key Findings Report.

Did entities update their risk policy and framework in a timely manner following the issue of the Commonwealth Risk Management Policy?

2.16 As discussed, the Commonwealth Risk Management Policy was issued on 1 July 2014 by the Minister for Finance. Elements One and Two of the Commonwealth Policy require entities to establish a risk management policy and framework.

2.17 Key issue dates of entities’ risk management policy and framework (Employment, Health and AFMA), guide and instructions (ACMA) are illustrated in Figure 2.2 and discussed in the following paragraphs.

Figure 2.2: Issue dates of entities’ risk management policy and framework

 

 

Source: ANAO analysis.

2.18 Each entity released an updated risk policy and framework within 12 months of the release of the Commonwealth Policy:

• Employment had issued its first departmental risk management policy and framework in December 2013. In July 2014—and in response to the release of the Commonwealth Policy—the department released a Secretary’s Instruction on its risk management policy and framework. The department updated its 2013 risk management policy and framework in February 2015. This update reflected the department’s most recent thinking around risk appetite and tolerance. The department had identified that the application of the risk matrix released in 2013 was resulting in some risks being rated as ‘high’ that were not significant risks. In September 2016, the risk policy and framework were revised further to include a detailed Risk Appetite Statement.
• Health issued a revised departmental risk management policy and framework in October 2014, three months after the release of the Commonwealth Policy. The department’s 2014 risk management policy states that the policy should be reviewed and updated annually.³¹ In December 2016, Health released a new Risk Appetite following extensive internal consultation.
• ACMA issued a revised risk management guide and management instruction in July 2015, 12 months after the release of the Commonwealth Policy. ACMA’s 2015 risk management guidance states that the policy should be reviewed and updated annually. The guide was due to be reviewed in the second half of 2016. ACMA advised the ANAO that it has decided to await the outcomes of this audit before finalising its review.
• AFMA issued a revised risk management framework in February 2015, seven months after the release of the Commonwealth Policy. AFMA’s 2013 risk management framework states that the framework should be reviewed in February and August each year. The authority released an updated risk management policy, which included a risk appetite statement, in November 2016. AFMA issued risk management operational guidelines in February 2017.

2.19 Elements One and Two of the Commonwealth Policy have a number of additional detailed requirements which overlap to some extent with other elements of the Commonwealth Policy. These requirements relate to building a risk management framework and culture and include:

• internal and external consultations;
• embedding risk management into business processes;
• managing shared risks; and
• reviewing and improving the risk management framework.

2.20 The application of these specific requirements is discussed in the remainder of this chapter in the context of the relevant element.

Are entities’ risk management frameworks developed with relevant stakeholder consultation, including arrangements to consult in a timely and effective manner?

2.21 An entity’s risk management framework is required to include how the entity will report risks to both internal and external stakeholders. Each entity must also implement arrangements to communicate and consult about risk in a timely and effective manner to both internal and external stakeholders (See Elements Two and Six of the Commonwealth Policy).

2.22 Each of the selected entities’ frameworks was developed with extensive internal consultation, including with entities’ audit committees³², although entity frameworks do not explicitly outline arrangements for communicating and consulting about risk with internal and external stakeholders. None of the selected entities outlined arrangements for reporting on risk to stakeholders. Entities advised the ANAO that in practice consultation on risk occurs as part of the routine consultation and interaction with external stakeholders (for all entities), research and scientific expert groups (ACMA and AFMA) and other Commonwealth entities (for all entities).

2.23 There is scope for entity frameworks to outline arrangements for communicating, consulting and reporting on risk to internal and external stakeholders (all entities). These arrangements could be considered as part of the regular review of an entity’s risk policy and framework.

Are responsibilities and accountabilities for risk management clearly defined?

2.24 The Commonwealth Policy requires that responsibilities for managing risk be defined within an entity’s risk management policy (see Elements One and Three of the Commonwealth Policy).

2.25 For Employment, Health and AFMA, the responsibilities for managing and reporting on risk are clearly outlined as part of their risk management framework. Their risk frameworks address key responsibilities relating to:

• the review and update of the risk management policy and framework, and individual risk plans and risk treatments; and
• descriptions of key positions, including senior executives, program/policy/project managers and risk owners; department committees (such as the Executive Committee and the Audit Committee); and business areas.

2.26 The responsibilities for managing and reporting on departmental risks are less well defined for ACMA. ACMA had documented specific expectations of some of its executive and senior management staff, including for the review of risk registers and controls. There would also be benefit in defining the responsibilities of the Governance Board and its supporting committees, and the Strategic Risk and Planning Section.

2.27 Each of the selected entities’ risk management frameworks provide that responsibility for risk plans, individual risks and risk treatments should be assigned to an individual person or position. This approach is consistent with the Australian/New Zealand Standard Risk Management–principles and guidelines. In practice there was variability in the application of this approach within some entities, and responsibilities were often assigned to work areas. Entities should consistently assign responsibility to individuals or positions, in line with the requirement of their frameworks (Health, ACMA and AFMA).

Are entities’ risk appetite and risk tolerance defined?

2.28 The Commonwealth Policy requires that entities define their risk appetite and tolerance (see Element One).³³ According to Comcover, the development of a risk appetite statement that incorporates risk tolerances that are tailored to an entity’s particular circumstances would be an important milestone in enhancing an entity’s risk management framework.³⁴ The statement would: provide a platform to assist in making informed decisions; provide the potential for consistent risk management practices; and help to guide discussions on risks and risk treatments.³⁵

2.29 Documenting an entity’s risk appetite and tolerance is a necessary first step to developing a risk framework that reflects the entity’s particular circumstances and which can directly assist in decision making.

2.30 Employment, Health and AFMA have developed new or revised risk appetite and tolerance statements as a key element of their respective risk management frameworks introduced following the release of the Commonwealth Policy.

• Employment’s current risk management policy and framework were issued in September 2016. A revised risk appetite statement was a key element of the framework, and includes risk tolerances for a range of risk categories and sub-categories. The statement is readily accessible from the department’s Intranet.
• Health conducted a review of its risk appetite and risk tolerance from October 2014 to late 2016, and released an updated risk appetite statement in December 2016. The updated risk appetite statement classifies risks against seven risk themes: people, fraud, policy, delivery, governance, regulatory and information. Health’s enterprise-level risks have been updated and are aligned with the seven risk themes (see Appendix 4 for Health’s enterprise risk appetite statement).
• AFMA released an updated risk management policy in November 2016 which included its risk appetite and risk tolerance statements. AFMA’s policy describes five ascending levels of appetite: averse; minimal; cautious; open; and hungry. According to AFMA’s risk policy, ‘AFMA is generally open to risk, in that it is willing to consider all options and choose the one most likely to result in successful delivery while also providing an acceptable level of reward and value for money.’ However, within this broad approach, a number of key risk areas have different risk appetites.

Note a: Available at <http://www.finance.gov.au/comcover/policy/resources.html> [Accessed 28 February 2017].

2.31 ACMA included a risk tolerance statement in its 2015 risk management guide, but has not developed a risk appetite statement. ACMA’s risk tolerance statement is adopted from the Work Health and Safety Act 2011 and details the principle of managing risks to a level that is ‘as low as reasonably practicable’ (ALARP).³⁶

Is risk considered as part of key business decisions and operations?

2.32 The Commonwealth Policy requires that each entity must ensure that the systematic management of risk is embedded in key business processes (Element 4).

2.33 The risk framework and key risks were regularly considered at senior levels within the selected entities—including the executive committee (Employment and Health), senior executive (ACMA) and the Commission (AFMA). Further, the ANAO’s review of a selection of business activities in each entity indicated that their activities were informed by considerations of risk. Risk was considered when key business decisions were made or advice was provided to senior management or government by the areas selected for review.³⁷

• Employment’s Risk and Implementation Committee (ERIC) met six times each year in 2014, 2015 and 2016 to consider and oversight the operations of the department’s risk management policy and framework, and reported quarterly to the department’s executive committee on the adequacy of the risk framework and associated processes. Following a 2016 review of governance committees, ERIC was disbanded in December 2016 and the Finance and Business Services Committee (FABS) was given responsibility to advise the Secretary on: risks identified in relation to the department’s ability to meet its business goals, as per the Risk Management Framework; and work to improve the department’s risk and policy framework, and lead the application of risk management across the department. At its meeting in March 2017, the FABS: noted that the department’s Executive had participated in a workshop to review entity strategic risks in February 2017; and considered an entity-level risk monitoring report. The department’s Performance and Integrity Sub Committee for Employment Services (PISCES) provides a high-level forum to support and advise on maximising the performance and integrity of all contracted employment services under jobactive.³⁸ The department’s Audit Committee also regularly receives updates from management on aspects of the department’s risk framework and obtains presentations from time to time from responsible departmental managers on the management of risks in respect of specific programs or activities. The operational divisions reviewed by the ANAO employed the department’s enterprise-wide risk management system (RiskActive) to assist in managing risk.³⁹
• Key risks were regularly considered by Health’s executive committee in its consideration of specific departmental strategies and plans. There is scope for a more structured approach to reporting on and reviewing enterprise-level risks and the status of risk controls and treatments. The three operational divisions examined by the ANAO had established a range of local mechanisms to monitor, report on and manage risk.
• ACMA’s key risks were reviewed quarterly by the senior executive as part of a regular cycle. Staff were also able to show that an assessment of risk informed local decision making processes, and that risk conversations at the senior and middle management levels took place. At an operational level, delegations for decision making relating to broadcasting and datacasting investigations were based on the assessed level of risk of each investigation.
• Sustainability risks were regularly considered by the AFMA Commission in its consideration of specific fisheries management strategies and plans. Available records indicated that the operational branch selected for review had produced a range of risk assessments and guidance on risk management. There is scope for a more structured approach to reporting on and reviewing enterprise-level risks, controls and treatments.

2.34 The ANAO’s review of the selected entities’ records, and discussions with a range of officials, indicated that project and program risks are routinely discussed at regular management and work place meetings, and with other entities and contracted service providers, although records of such operational meetings are often not maintained by entities.

Have entities established arrangements to manage shared risks?

2.35 The Commonwealth Policy provides that an entity must establish a risk management framework which includes how the entity contributes to managing any shared or cross-jurisdictional risks, and must implement arrangements to understand and contribute to the management of shared risks (Elements Two and Seven).

2.36 The Commonwealth Policy defines a shared risk as a risk with no single owner, where more than one entity is exposed to or can significantly influence the risk.⁴⁰ Shared risks are those extending beyond a single entity, which require shared oversight and management. Accountability and responsibility for the management of shared risks should include any risks that extend across entities and may involve other sectors, the community, industry or other jurisdictions.⁴¹

2.37 The Comcover 2016 Benchmarking Survey noted that understanding how to identify what is a shared risk is a concept that entities find challenging. Understanding and managing shared risk is important for effective policy and program design and implementation.

2.38 A useful starting point in considering shared risk is to focus on shared outcome risks, rather than low-level transactional risks. A risk management strategy can usefully identify areas where an entity is reliant on others to achieve its outcomes, or whose actions and activities will impact on the achievement of entity outcomes.

2.39 Entities have in place arrangements, such as steering and consultative committees, which contribute to managing risks that relate to programs and activities which involve other entities or external parties. These risks are not routinely identified and managed as shared risks in the context of entities’ risk management policies and frameworks.

• Employment did not routinely categorise and manage shared risks other than risks relating to the Shared Services Centre.⁴² It is not evident that other risks are recognised in departmental risk registers and managed as shared risks, and risk reporting does not include reporting on shared risks.
• Health’s risk management policy defines shared risks and the department’s risk register templates make provision for recording them. The ANAO’s review identified that some of the assigned shared risks were intra-entity—such as risks shared with other areas of the department—whereas the Commonwealth Policy defines a shared risk as one extending beyond the entity.
• ACMA does not refer to shared risk in its risk guidance and instruction, and there is no explanation of how shared risks should be identified and managed. In practice, ACMA and its portfolio department have created a shared risk register for their joint steering committee. ACMA advised the ANAO that arrangements for identifying and managing shared risks will be developed as part of a planned review of the risk framework.
• AFMA is in the early stages of implementing its risk guidelines and its approach to external consultation and shared risks. AFMA’s 2017 risk management guidelines addressed the issue of establishing shared risks through external consultation processes:
  

  External consultation will establish shared risks through engagement with other Commonwealth agencies, cross-jurisdictional entities, industry and interest groups. Once every 12 months AFMA’s Risk Manager will engage with external stakeholders to establish the register of shared risks and report the findings to the Audit and Risk Committee and the AFMA Commission.

Do entities have relevant capability to underpin the management of risk?

2.40 The Commonwealth Risk Management Policy provides that entities must maintain an appropriate level of capability to both implement the entity’s risk management framework and manage its risks (Element Eight).

2.41 The ANAO reviewed the following aspects of the selected entities’ risk management capability:

• governance and reporting arrangements;
• supporting guidance, systems and processes; and
• learning and development programs, individual performance development, and awards and incentives.

Governance and reporting arrangements

2.42 The risk management policies developed by Employment, Health and AFMA outline governance arrangements for risk management, including a summary of key roles and responsibilities for internal committees and individual management positions with risk responsibilities. At the time of the audit, there was:

• limited management reporting to the executive committee (Health) or Commission (AFMA) on the status of enterprise-level risks, as part of a structured process of regular review of enterprise-level risks, controls and treatments; and
• no reporting of operational (division-level) risks to the Audit and Risk Committee, including the status of risk controls and treatments (Health and AFMA).^{43 44}

2.43 ACMA’s Executive Group receives a quarterly report on risk management. These reports discuss current risks and emerging risks and risks that have been retired and removed. These reports also provide an update on risk metrics (such as the number of risks and the level of risks) and a summary of other relevant information. Divisional reports on the operation of the risk management framework and processes are also submitted to the Audit Committee every quarter.

2.44 Employment records indicate that risks, risk plans and risk treatments are actively managed by risk owners, and there is regular reporting to the senior executive and audit committee on the status of risks and risk treatments.⁴⁵

Supporting guidance, systems and processes

2.45 Employment has placed extensive risk management guidance on its Intranet to assist staff to manage risks and risk treatments. The department operates and maintains an integrated, enterprise-wide risk management systems to assist in managing its risks—RiskActive. The system is mature and provides the department with the capability to record, manage and report on risks, risk treatments, risk events and risk plan owners.⁴⁶

2.46 Health requires that risk registers should be used by operational divisions to identify and classify risks, and to list controls and risk treatments. Health does not have in place arrangements to provide assurance that risk registers are regularly reviewed in accordance with the department’s risk management policy.

2.47 ACMA’s risk management guidance provides a high-level description of risk management, but limited practical guidance on how staff should manage risk. ACMA has a formal process for divisions to identify, manage and report risks. Templates are provided to the divisions, and support is provided when required to assist with the process.

2.48 Risk management guidance available on AFMA’s Intranet was minimal and not up to date.⁴⁷ This is an impediment to the development of a positive risk management culture. Other risk-related guidance available on the Intranet focussed on project management, and did not include guidance for business as usual activities. Project management templates, including a register, were available to identify, monitor and report on project risks.

Learning and development

2.49 Employment’s learning and development program includes offerings on risk management including a number of risk management eLearning modules.⁴⁸ Departmental officials are regular participants in risk management forums and seminars organised by Comcover and departmental officials are encouraged to attend and participate in external risk management seminars and courses. Risk management is also identified as one of the criteria used to judge the recipients of the Secretary’s award for innovation.

2.50 Health and ACMA have a variety of learning and development programs available for staff, including eLearning courses developed by Comcover and entity-specific workshops.

• Health held a variety of Comcover Risk workshops for its senior executives on risk, controls and shared risk in 2016 and 2017. Health also introduced an e-learning module in January 2017, but there has been limited uptake of this training module⁴⁹; and
• 79 per cent of ACMA employees had completed the compulsory risk management e-learning module in 2016 with plans to add risk-specific guidance to its induction program.

2.51 AFMA does not have formal learning and development programs in risk management for staff, a further impediment to the development of a positive risk management culture. The ANAO was advised by AFMA that work had commenced to implement a training package for staff on the Public Governance, Performance and Accountability (PGPA) Act 2013, including a risk management module.⁵⁰

Are entities’ risk management frameworks reviewed to continuously improve the management of risks?

2.52 The Commonwealth Policy provides that each entity must review its risks, its risk management framework and the application of its risk management practices on a regular basis, and implement improvements arising out of such reviews (see Element Nine).

Review

2.53 The selected entities’ risk management policies include a commitment to regularly review the risk framework.

• As discussed in paragraph 2.18, Employment has twice revised or updated its risk policy since 2014 (in 2015 and 2016).
• Aspects of Health’s risk management were reviewed as part of the 2014 Health Capability Review, which observed that the department needed to foster a culture that appropriately embraces and manages risks within agreed tolerances. In response, the department initiated a review of the risk management component of the Health Capability Program in July 2016. The 2016 review commented that more work needed to be done. The department has an ongoing program to address the recommendations of the two reviews. A key focus of the capability program is to fully operationalise the department’s risk management framework.
• As discussed in paragraph 2.43, ACMA has established processes for executive review of division-level risks and conducted reviews of its risk registers in 2015 and 2016;
• AFMA conducted a review of the authority’s risk management framework in June 2015, and has implemented or partially implemented seven of the ten recommendations arising from the review (at February 2017).

2.54 Regular review of entities’ risk frameworks and practices improves the effectiveness of risk management, and should be factored into internal planning processes.

Escalating and recording issues

2.55 The selected entities did not systematically record and analyse risk incidents, issues and events to inform their periodic evaluation of the risk management framework, and there was variability in processes for escalating risk.

• Employment has developed a process for the escalation of high and extreme risks. Departmental staff interviewed by the ANAO indicated that in their experience, senior management adopted a supportive and constructive approach when risk events and incidents are reported. Departmental procedures include a requirement for ‘plan events’ to be recorded in RiskActive and for such events to trigger a review of the relevant Risk Plan. The guidance outlines detailed actions to be taken depending on whether the event was, or was not, previously identified as a risk. The ANAO’s review of a selection of risk events indicates that a number of the events recorded are events or developments that have occurred but are not related to the risks or risk treatments outlined in the relevant risk plan and it was not evident that risk events routinely triggered a review of the risk plan.
• Health has limited guidance in the risk template which advises staff on the escalation of high and extreme risks. Departmental staff interviewed by the ANAO indicated that in their experience the attitude to reporting and escalating risks has improved significantly in the past two years, and the focus is now on identifying issues, finding solutions and learning lessons from the risk events.
• The ANAO was advised by ACMA that it is developing a new risk escalation process. ACMA does not record risk incidents to assist in monitoring the adequacy of its risk framework. However, some of the ACMA End Project Reports reviewed by the ANAO identified project risks and noted whether the risks materialised or not.
• AFMA’s risk guidance documented a pathway for the annual review and escalation of risks, but did not provide guidance for the escalation of high and extreme risks as they emerged. AFMA employees interviewed by the ANAO indicated that reporting on risks occurred on a case-by-case basis, and as needed.

2.56 Recording and analysing risk incidents and lessons learned can provide valuable insights to management and the audit committee on risk management performance and the effectiveness of the risk management framework.

Reporting on risk management performance

2.57 The selected entities do not have mechanisms in place to measure risk management performance:

• Employment’s records do not indicate that the department assesses and reports on the performance of the risk management framework in accordance with the approach outlined in the risk management policy.
• Health, ACMA and AFMA advised the ANAO that they rely on the results from the annual Comcover Benchmarking survey to assess the performance of their risk management frameworks. With the exception of this survey, these entities do not have any mechanisms in place to measure risk management performance.

Other reporting on risk management performance

2.58 The Australian Public Service Commission (APSC) surveys APS agencies and employees annually on a range of workforce management issues. Both surveys have included a number of questions relating to risk management. The 2016 APS employee census included four questions relating to entities’ risk management.

2.59 Figure 2.3 presents the survey results for the selected entities (blue) compared to the results for all agencies surveyed (red). This analysis indicates that a higher proportion of employees in Employment, ACMA and AFMA agreed with the risk-related statements in the 2016 survey, when compared with the combined results for all entities surveyed. A lower proportion of Health employees agreed with those statements.

Figure 2.3: Staff responses to the risk-related questions in the 2016 APS employee census, compared to the overall score for all entities surveyed

 

 

Source: ANAO analysis of data provided by the APSC.

2.60 The relatively high level of agreement indicated by Employment staff to the four questions is consistent with the department’s implementation of an integrated risk management system across the department, as reported in this audit. The relatively low level of agreement indicated by Health staff is consistent with that department’s state-of-play in fully operationalising its risk framework across the department, as reported in this audit.

2.61 All the selected entities (Employment, Health, ACMA and AFMA) advised the ANAO that the data provided by the APSC is not used in a substantive sense as part of management reporting and/or to assist in the review of their enterprise risk management framework.

2.62 Health also conducts a Pulse Survey every six months, which aims to complement the annual APSC survey. A summary of relevant results is presented in Table 2.4.

Table 2.4: Results for the risk-related question in Health’s 2016 pulse surveys

Source: ANAO, drawing on Department of Health records.

Was risk addressed in entity corporate plans?

2.63 The PGPA Rule requires entity corporate plans to include a summary of the risk oversight and management systems of the entity for each reporting period covered by the plan (including the measures that will be implemented to ensure compliance with the finance law).

2.64 The 2016 Finance Guidance noted that:

As a strategic planning document, the corporate plan needs to demonstrate that effective systems of risk oversight and management have been implemented. Entities should explain how their approach to managing risk will support the achievement of their purposes.⁵¹

2.65 The 2017 Finance Guidance similarly noted that:

Entities should explain how risk management will underpin their approach to achieving their purposes… As a strategic planning document, the corporate plan should demonstrate that effective risk management priorities have been considered and implemented.⁵²

2.66 As part of the audit, the ANAO assessed the maturity of the risk oversight and management section of the selected entities’ 2016–17 corporate plans using the methodology used in the ANAO’s Report No.6 (2016–17) Corporate Planning in the Australian Public Sector and Report No.54 (2016–17) Corporate Planning in the Australian Public Sector.

2.67 The ANAO’s assessment of the maturity of the risk oversight and management section of the selected entities’ 2016–17 corporate plan is presented in Table 2.5.

Table 2.5: Assessment of the maturity of the risk oversight and management section of the selected entities’ 2016–17 corporate plan

 

 

Source: ANAO analysis.

2.68 The selected entities were at different levels of maturity in their implementation of the corporate plan requirement relating to risk, with further work required in all entities to fully embed the requirement. There would be benefit in the selected entities reviewing the Department of Finance’s guidance on preparing corporate plans, which indicates that a mature approach to addressing risk in the corporate plan may include a discussion of:

• how the key sources of risk to an entity’s purposes are being managed in the context in which the entity operates, the activities undertaken and the purposes the entity seeks to achieve;
• the capability and environment components of the corporate plan, and how those components impact the risk profile of the entity;
• key sources of emerging risks that may impact its ability to achieve its purposes in the future; and
• the risks an entity faces in the context in which the entity operates, the activities undertaken and the purposes it seeks to achieve.^{53 54}

Areas for improvement

2.69 The ANAO has not made any recommendations in this audit, but has highlighted a range of matters relating to the audited entities’ risk management which warrant further attention. The matters highlighted below may also warrant attention by other Commonwealth entities.

2.70 Specific matters which warrant further attention by the selected entities relate to:

• defining the entity’s risk appetite in the risk management policy (ACMA);
• enhancing risk management capability (Health, ACMA and AFMA);
• improving the identification and management of shared risks (all entities);
• developing arrangements for communicating, consulting and reporting on risk with internal and external stakeholders (all entities);
• improving arrangements to regularly review risks, risk management frameworks and the application of risk management practices (Health, ACMA and AFMA);
• seeking formal assurance from managers in preparing responses to the Comcover survey of risk maturity (all entities);
• fully embedding the corporate plan requirement relating to risk (all entities); and
• assigning responsibility for risk management to individuals or positions, rather than work areas (Health, ACMA and AFMA).

Appendix 1 Responses from the selected entities

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Appendix 2 The Commonwealth Risk Management Policy requirements

Element 1: Establishing a risk management policy – four requirements

An entity must establish and maintain an entity specific risk management policy that:

1. defines the entity’s approach to the management of risk and how this approach supports its strategic plans and objectives;
2. defines the entity’s risk appetite and risk tolerance;
3. contains an outline of key accountabilities and responsibilities for managing and implementing the entity’s risk management framework; and
4. is endorsed by the entity’s accountable authority.

Element 2: Establishing a risk management framework – nine requirements

An entity must establish a risk management framework which includes:

1. an overarching risk management policy (Element One);
2. an overview of the entity’s approach to managing risk;
3. how the entity will report risks to both internal and external stakeholders;
4. the attributes of the risk management culture that the entity seeks to develop, and the mechanisms employed to encourage this;
5. an overview of the entity’s approach to embedding risk management into its existing business processes;
6. how the entity contributes to managing any shared or cross jurisdictional risks;
7. the approach for measuring risk management performance; and
8. how the risk management framework and entity risk profile will be periodically reviewed and improved.

The risk management framework must be endorsed by the entity’s accountable authority.

Element 3: Defining responsibility for managing risk – three requirements

Within the risk management policy, the accountable authority of an entity must define the responsibility for managing risk by:

1. defining who is responsible for determining an entity’s appetite and tolerance for risk;
2. allocating responsibility for implementing the entity’s risk management framework; and
3. defining entity roles and responsibilities in managing individual risks.

Element 4: Embedding systematic risk management into business processes

Each entity must ensure that the systematic management of risk is embedded in key business processes.

Element 5: Developing a positive risk culture

An entity’s risk management framework must support the development of a positive risk culture.

Element 6: Communicating and consulting about risk

Each entity must implement arrangements to communicate and consult about risk in a timely and effective manner to both internal and external stakeholders.

Element 7: Understanding and managing shared risk

Each entity must implement arrangements to understand and contribute to the management of shared risks.

Element 8: Maintaining risk management capability

Each entity must maintain an appropriate level of capability to both implement the entity’s risk management framework and manage its risk.

Element 9: Reviewing and continuously improving the management of risk

Each entity must review its risks, its risk management framework and the application of its risk management practices on a regular basis, and implement improvements arising out of such reviews.

Source: The Commonwealth Risk Management Policy, 1 July 2014.

Appendix 3 ANAO assessment of the selected entities’ application of the Commonwealth Risk Management Policy elements

Appendix 4 Health’s Enterprise Risk Appetite statement