Home >> Assurance Reviews and Risk Assessments >> Risk Potential Assessment Tool (RPAT)

Risk Potential Assessment Tool (RPAT)

Download Instructions

• Risk Potential Assessment Tool [ 1.3MB]
• Risk Potential Assessment Tool Guidance [ 267KB]

The RPAT is a Word 2003 template and REQUIRES MACROS TO BE ENABLED in order to work.

Q	Strategic Context – Section 1	Intent of Question
A1	Government Priority	How important is this for the Government?
A2	Financial Impact	What is the extent of exposure of public monies?
A3	Citizens	How will citizens be impacted?
A4	Market	How will markets and the private sector be impacted?
A5	Stakeholder Impact	How complex are the stakeholders?
A6	Other	Is there a significant risk not captured adequately elsewhere which needs to be highlighted to ministers? (eg Security, Environment, International)

Q	Implementation Complexity – Section 2	Intent of Question
B1	Other Jurisdictions / Agencies / Business Areas	How many government entities are involved?
B2	Benefits	What is the extent of benefits?
B3	Organisational/cultural change	What is the extent of change for the agency?
B4	Innovation	Is there a significant innovative implementation component envisaged?
B5	Information and Communication Technology	What is the extent of the ICT enablement?
B6	Procurement	How complex is the procurement envisaged?
B7	Construction	Is there a construction element?
B8	Contractual/Service Delivery Arrangements	How complex are the delivery arrangements, including Service Delivery partners?
B9	Governance	What entities are involved (or will be involved) in the implementation.
B10	Management/team experience	Does the agency have access to experienced resources to implement this type of proposal?
B11	Timing Constraints	Are there scheduling or program/project management challenges?
B12	Dependencies	What project/program dependencies exist? Does the proposal require new or amended legislation?
B13	Clarity of Policy	Are the policy scope and detail developed?
B14	Agency Capability	Is the agency capable of delivering the requirement?

Section A – Strategic Context analysis

Q A1) Government Priority

A1. Government priority	Very Low Low Government profile.	Low	Med Moderate Government interest.	High	Very High High Government interest/priority.

This question is directed at identifying Strategic priority placed on this proposal by Government.  If you are unsure about the answer to this question, consult your Central Agency contact.

Justification comments could include the importance or priority to the Government of the policy; what are the consequences arising for Government through non-delivery, cost blow-outs, delay, or not meeting announced or election commitments?

• What is the importance to the government of this proposal being implemented well?

Mitigation and Residual Risk for QA1

Government Priority is set by government. Any Mitigation measure which had the effect of reducing the residual risk, would have resulted in the government changing its priority. It would be expected therefore, that the Level of Risk for QA1 would remain the same pre-and post- Mitigation.

Mitigation could demonstrate appropriate agency planning and prioritisation of the initiative; and broad implementation consideration.

Mitigation does not mean supporting the merits of agreeing to the proposal. For example, do not offer mitigations such as “the HIGH risk rating of this government election commitment will be mitigated to LOW when the proposal is agreed to and implemented”. Assume the proposal will be agreed to, and focus mitigation measures (if any) on the subsequent implementation.

• Risk treatment is unlikely to reduce the Level of Risk.

Back to top

Q A2) Financial 

A2. Financial	Very Low Exposure of public funds, less than $50m.	Low	Med Exposure of public funds $250-$500m.	High	Very High Exposure of public funds, greater than $1 billion.

This question is directed at indicating what the level of potential cost and financial exposure is associated with the proposal.  In determining direct costs give consideration to:

• Use the gross cost estimate. Do not adjust down for any offsets.
• Include both administered and departmental costs over the forward estimates
• Has the proposal been costed to consider all costs?
• Any contingent liabilities that maybe taken on by Government as a result of implementation?
• Is there potential for the proposal requiring additional funding?
• Justification comments would include a brief financial snapshot of the proposal, and how the estimates were arrived at.

Mitigation and Residual Risk for QA2

The exposure of public funds for the RPAT ratings ranges from less than $50m – VERY LOW to greater than $1b VERY HIGH. As these are estimates being put forward as part of the NPP, it is not possible to change them through mitigation measures. Therefore, the residual risk will normally be the same as the pre-mitigation Level of Risk.

Mitigation could demonstrate appropriate agency planning and financial controls in place, or projected to be applied. Estimates could be firmed up over time through, for example, public tendering or competitive capped grants. The Two Pass processes may also be applied to develop the most cost effective solution.

• Risk treatment is unlikely to reduce the Risk Rating.

Back to top

Q A3) Citizens 

A3. Citizens	Very Low Low impact on small number of citizens.	Low	Med Medium impact on moderate number of citizens.	High	Very High Large impact on large number of citizens.

This question is directed towards assessing the level of impact on citizens, both in terms of quantum of citizens affected, or level of impact on groups of citizens. Citizens also refers to the public at large. Drafters should consider the effect the proposal will have on the public if fully delivered, partially delivered or if delivery fails. The answer should incorporate which segments of the public will be affected and the degree to which each segment will be affected.

Mitigation and Residual Risk for QA3

Mitigation could demonstrate appropriate agency planning for communication and activities which would make for successful implementation.  Consultation envisaged could be outlined.

• Risk treatment may reduce the Risk Rating, leading to a lower residual risk.

Back to top

Q A4) Market 

A4. Market	Very Low Minimal impact on private sector.	Low	Med Moderate negative or positive impact on private sector.	High	Very High Significant negative or positive impact on private sector.

 This question is aimed at determining the effect on the private sector, or markets.  The answer to this question should incorporate which sectors will be affected positively or negatively and the size of the effect on each sector.

 The Justification should also describe the capacity of the private sector to take on any responsibilities associated with the proposal, the level of interest and opposition in the private sector as well as the size of the market in relation to government intervention.

• Is there an impact on the Small to Medium Enterprise (SME) market?

Mitigation and Residual Risk for QA4

Mitigation could demonstrate appropriate agency planning for communication and activities which would make for successful implementation.  Consultation envisaged could be outlined.
Risk treatment may reduce the Risk Rating.

Back to top

Q A5) Stakeholders 

A5. Stakeholders	Very Low Straightforward stakeholder arrangement or no opposition of stakeholders expected.	Low	Med Multiple stakeholders or some stakeholder opposition expected.	High	Very High Complex stakeholder arrangements or significant stakeholder opposition expected.

This question is aimed at identifying the extent of  issues in dealing with stakeholders for this proposal.  The Justification should reflect on who the stakeholders are, identify what positions or expectations they have in relation to the proposal and explain what actions will be undertaken to consult with stakeholders. Include stakeholders represented through interest groups and/or the media.

When determining a strategic Context rating, drafters should consider:

• Whether there are a large number of different stakeholder groups;
• What are the consequences of them having a diverse range of views;
• What is the consequence of stakeholder opposition?

Mitigation and Residual Risk for QA5

Mitigation could demonstrate appropriate agency planning, for example development of a Stakeholder Management Strategy, including communication and activities which would make for successful implementation.  Outline consultation envisaged with stakeholders.

• Risk treatment may reduce the Risk Rating. 

Back to top

Q A6) Other

A6. All Other	Very Low	Low	Med	High	Very High Proposal specific risk to be highlighted for Cabinet

This question is aimed at identifying other risks in the strategic context not covered in the above categories specific to a policy of this type. This section should be used to draw Cabinet’s attention to any issues that are likely to be missed without a specific focus.

Examples of “Other Risks” are significant Security, Environmental, International and Location constraints and/or issues. These categories of risk which can have consequences to government are the most common risks which do not have a specific question in the RPAT.

If you wish the entry in “All Other” to appear in the Top Five Risks within the NPP and therefore to be highlighted in the NPP, provide a rating high enough for this question (VERY HIGH or HIGH) in order for it to outrank the other questions.

Mitigation and Residual Risk for QA6

Mitigation could demonstrate appropriate agency planning to address the risk.

• Risk treatment may reduce the Risk Rating

Back to top

Section B – Implementation Complexity

Q B1) Other Jurisdictions/Agencies/Business Areas

B1. Other jurisdictions/Agencies/ business areas	Very Low No other jurisdictions, agencies or other business units involved.	Low	Med Some involvement across other jurisdictions, agencies or business areas.	High	Very High Complex involvement across jurisdictions, agencies or business units.

This question is aimed at assessing the degree to which the proposal cuts across other jurisdictions, agencies, and business areas.  The answer to this question should incorporate what involvement jurisdictions/agencies/business areas have to the proposal and how this involvement may add complexity or difficulty to the proposal.

Cross agency proposals would be likely to attract a MEDIUM or higher answer.

In addition, any involvement with States or Territories should be thoroughly addressed. If there is COAG involvement, Inter-Governmental Agreements or National Partnership Agreements envisaged, the answer to this question would likely be HIGH or VERY HIGH.

Mitigation and Residual Risk for QB1

Mitigation could demonstrate appropriate agency planning, consultation and formalisation of agreement to address the additional complexity of the involvement of multiple entities.

• Risk treatment may reduce the Risk Rating.

Q B2) Financial Benefits 

Back to top

B2. Benefits	Very Low Less than $50m.	Low	Med $250m - $500m.	High	Very High Greater than $1b.

This question is seeking information on the size of the expected financial benefit which would flow from the proposal.  The answer should incorporate all anticipated financial benefits which would flow from the life of the proposal and an explanation of how these benefits would arrive.

Benefits may include additional revenue from the proposal, greater efficiencies, long term reductions in costs or other benefits that are clearly identified and captured by the proposal.

Mitigation and Residual Risk for QB2

Mitigation could demonstrate appropriate agency planning, such as development of a Benefits Realisation Strategy or Value Management approach.  The focus would be on how achieving the benefits will be managed.

• Risk treatment may reduce the Risk Rating.

Back to top

Q B3) Organisational/Cultural Change

B3. Organisational/cultural change	Very Low Limited impact on operations or staff.	Low	Med Some organisational restructuring, retraining or transfer of staff/ outsourcing.	High	Very High Very significant impact on operations or staff.  Rectifying high profile operational failure.

This question is aimed at determining what transformation or alterations to agency structure and practices/culture will occur in order to implement the proposal.  The answer should also include information on what restructuring or practice/culture changes will be occurring and why/how these changes relate to the proposal.

Proposals which require the establishment, merger or closure of an agency would likely attract a HIGH or VERY HIGH rating.

Mitigation and Residual Risk for QB3

Mitigation could demonstrate appropriate agency planning, such as development of a Change Management Strategy and staff consultation.

• Risk treatment may reduce the Risk Rating. 

Back to top

Q B4) Innovation

B4. Innovation	Very Low Involves no new technology, development, methods, production or tools.	Low	Med Involves new techniques but with a stable application or known techniques but with new application.	High	Very High Use of new or untried technology, development, methods, production or tools with high degree of complexity or uncertainty.

This question is designed to determine how much innovation will be incorporated into the proposal. This aims to capture the inherent risks in developing and delivering proposals that involve significant new or untried methods of practice/technology.

• What innovative tools or applications are to be used in the proposal and has this innovation been previously been used and the success of this previous use?

Mitigation and Residual Risk for QB4

Mitigation could demonstrate appropriate agency planning, such as development of a Risk Management Strategy, contingency planning and a Blueprint for the expected end state.

• Risk treatment may reduce the Risk Rating.

Back to top

Q B5) Information Technology 

B5. Information Technology	Very Low No IT component.	Low	Med Infrastructure required/ Packaged software /data migration/some links to other internal/external systems.	High	Very High Significant infrastructure requirements/complex data migration/extensive and/or complex links to internal/external systems.

This question is directed at determining the level and complexity of ICT for the proposal.  The answer to the question should provide information on the complexity and structure of proposed ICT and how this ICT is incorporated into the whole proposal.

The information provided in the answer boxes is advisory as there are many other potential complexity areas around ICT which should all be discussed within the answer. 
Drafters should also consider;

• the levels of skills required to implement the proposed ICT
•  and the availability of those skills

Mitigation and Residual Risk for QB5

Mitigation could demonstrate appropriate agency ICT planning, such as adherence to whole-of-government policies on commercial-off-the-shelf software and data centres. Proposals subject to the ICT Two Pass process would likely attract a HIGH or VERY HIGH rating.

• Risk treatment may reduce the Risk Rating. 

Back to top

Q B6) Procurement 

B6. Procurement	Very Low No procurement.	Low	Med Delivery of complex products/services.	High	Very High Significant customised element. Multi stage procurement process.

This question is designed to determine the extent of formal procurement or tendering out envisaged for the proposal.   The answer to this question should incorporate all connected procurement and the complexity associated with each of the procurement processes proposed.

Particular attention should be given to:

• known instances where similar procurements have failed
•  exceeded budget
•  or where market capability has been unable to meet the specified procurement.

Mitigation and Residual Risk for QB6

Mitigation could demonstrate appropriate agency planning, such as adherence to the Commonwealth Procurement Guidelines and the tendering approach.
Risk treatment may reduce the Risk Rating.

Back to top

Q B7) Construction 

B7. Construction	Very Low No construction requirements.	Low	Med New construction using non-standard construction.	High	Very High Unique Commonwealth construction or other construction with extensive customised elements.

This question is designed to determine the level and nature of construction in the proposal.  The answer to this question should incorporate all  construction and the complexity associated for each construction proposed.
There are many areas of construction which may add complexity, such as:

• heritage/architectural value,
•  proximity to areas associated with indigenous culture/identity,
•  to be used for highly sensitive activity and a wide variety of other issues which should be all addressed within the Justification.

Proposals subject to the Two Pass and/or Public Works Committee process would likely attract a HIGH or VERY HIGH rating for this question.

Mitigation and Residual Risk for QB7

Mitigation could demonstrate appropriate agency planning, such as adherence to the Commonwealth’s Property Management Framework. 

• Risk treatment may reduce the Risk Rating. 

Back to top

Q B8) Contractual/Service Delivery Arrangements 

B8. Contractual/Service Delivery arrangements	Very Low No contract/ delivery arrangements required.	Low	Med Multiple suppliers but with single prime contractor. Separate Service Delivery entity.	High	Very High Complex commercial arrangements.  Multiple suppliers without prime contractor or multiple Service Delivery partners.

This question is designed to determine the nature and level of commercial or Service Delivery arrangements associated with this proposal.  The answer to this question should address how contracts or agreements for delivery are set-up and the private sector or other delivery partner’s capacity to meet supply needs.  It should also indicate the effect that contract and supply arrangements may have on the industry or service delivery segment.

Where another Commonwealth agency is providing Service Delivery for the proposal, this is likely to attract a MEDIUM, HIGH or VERY HIGH rating. It would be expected that early consultation had occurred with service delivery agency.

Mitigation and Residual Risk for QB8

Mitigation could demonstrate appropriate agency engagement with the Service Delivery partner, or Procurement Strategy planning.

• Risk treatment may reduce the Risk Rating.

Back to top

Q B9) Governance 

B9. Governance	Very Low Straight forward and stable governance structure.	Low	Med Some governance issues identified and actions developed to correct them.	High	Very High Complex governance structures likely to change during life of implementation.

How complex are the governance arrangements for the proposal? How mature is the decision making structure envisaged? Are there complex structures such as cross agency or interdepartmental committees, inter jurisdictional governance arrangements or external representation in the governance arrangements?

The answer to this question should address any issues which would add to the likelihood of governance complexity leading to implementation challenges. 

Mitigation and Residual Risk for QB9

Mitigation could demonstrate appropriate agency planning, such as establishment of Project or Program Boards, Steering Committee or an Inter Departmental Committee.

• Risk treatment may reduce the Risk Rating.

Back to top

Q B10) Management/team experience 

B10. Management/ team experience	Very Low Fully resourced and skilled team and management.  No recruitment requirement or specialist training.	Low	Med Key skills/experience in place but recruitment or training required for staff.	High	Very High Key skills/experience lacking or not available.  Significant new resources or training required.

This question is aimed at determining the resources allocated to, or available to implement the proposal. What is the level of team and management experience for the proposal?  The Justification to this question should indicate what level of skills and experience are expected and how/if the current management and team fill this.

What difficulties may arise for recruiting staff/management currently missing skills/experience? The ease of importing the skills externally or internally should be considered.

Mitigation and Residual Risk for QB10

Mitigation could demonstrate appropriate agency resource planning, including how project/program and technical resources would be recruited or assigned. 

• Risk treatment may reduce the Risk Rating. 

Back to top

Q B11) Timing Constraints 

B11. Timing Constraints	Very Low No challenge in meeting timetables.	Low	Med Compressed or extended timeframe for delivery.	High	Very High Schedules very difficult, no contingency allowed.  Uncontrolled changes to deadlines likely.

The question is aimed at determining if there are timing constraints which add complexity to the proposal.  The answer to this question should incorporate any timing constraints (for example fixed dates for commencement of proposal) and how these constraints will add complexity to ensuring delivery of the proposal on time, on budget and to expectations.

Mitigation and Residual Risk for QB11

Mitigation could demonstrate appropriate agency planning, such as development of project/program timelines; risk management and contingency planning.

• Risk treatment may reduce the Risk Rating. 

Back to top

Q B12) Dependencies 

B12. Dependencies	Very Low No dependence on success of other projects/programs and no legislation required.	Low	Med Some dependence on successful delivery of other projects/programs OR existing legislation required.	High	Very High Fully dependant on successful delivery of other projects/programs OR new or amended legislation required.

This question is directed towards understanding the level of dependence of this proposal on successful implementation of other projects/programs or on the passage of legislation.  .
Consideration needs to be given to dependant projects/programs, including:

• what other projects/programs this proposal is dependent on,
•  and the current status of these projects/programs and the level of dependence.

If new or amended legislation is required, drafters should choose Very High as the answer. This will normally have the effect of promoting Q12 Dependencies into the Top Five Risks, and would consequently be included in the NPP.

Further, arising from the recent High Court judgement in Williams v Commonwealth [2012] HCA 23, agencies must consider whether the NPP:

• has or will require legislative authority to spend; and
• is within the scope of Commonwealth legislative power.

Mitigation and Residual Risk for QB12

Mitigation could demonstrate appropriate agency engagement with legislative drafters and planning for timely progress through Parliament. Cross program planning, possibly through agency Portfolio Management, could also demonstrate proposed management of dependencies.

• Risk treatment may reduce the Risk Rating. 

Back to top

Q B13) Clarity of Policy 

B13. Clarity of Policy	Very Low There is clarity of policy and high level of policy development assurance.	Low	Med Developing clarity of policy and some level of policy development assurance.	High	Very High Lack of clarity of policy and low level of policy development assurance.

This question is aimed at uncovering how well developed and well understood the proposal is. The level of policy development assurance planned should be taken into account when determining this.
The Justification to this question should consider:

• the detail of direction given by Government for the proposal (detailed or very high level),
• if all parties signed up understand the proposal in the same way (e.g. States and Territories, or if industry input is envisaged for final program design)
•  and what mechanisms are in place to manage this.

Mitigation and Residual Risk for QB13

Mitigation could demonstrate appropriate agency planning, such as timing of government response to reports, Green/White paper progress, COAG or other inter jurisdictional agreement progress and contingency planning if policy expectations change.

• Risk treatment may reduce the Level of Risk, leading to a lower residual risk.

Back to top

Q B14) Agency Capability 

B14. Agency Capability	Very Low Agency has extensive experience with previous comparable outputs.	Low	Med Agency experience with comparable projects but with new complexities for delivery.	High	Very High No previous experience with this kind of proposal.

This question is directed to answering how proficient/experienced an agency is in delivering this type of proposal.  The answer to this question should incorporate capability demonstrated in the delivery of similar outputs by the agency, if the agency has retained relevant capabilities since the last similar delivery and what lessons have been learned about prior initiatives.

Agencies may include;

• outcomes from recent agency capability reviews, or P3M3 assessments
•  capability improvement strategies.
•  consideration should be given to Workforce Planning, and the impact on the agency of implementing the proposal

Whether the implementation of a new policy initiative is managed by an agency as “business as usual” or via project management disciplines, there will be a wide variance in capability, skills and expertise required to ensure success. In determining workforce impact and associated risks, give consideration to the following:

• What implications does this initiative have for the agency’s workforce (capacity, capability, location, functional alignment to business delivery)?
• What new skills or capabilities will become important to achieve business outcomes and how will they be acquired (developed internally or attracted from external sources)?
• What is the current availability of these new skills and capabilities in the external labour market and what is the level of impact if they are not available at critical time points in the implementation?
• What skills and capabilities will no longer be required and how will this surplus be managed?

Mitigation and Residual Risk for QB14

Mitigation could demonstrate appropriate agency workforce and organisational planning.

• Risk treatment may reduce the Risk Rating.

---

Contact for information on this page: Assurance Reviews

---

Back to top