To download the entire guide, click on the print icon on the top right-hand corner of this page.
How to complete the RPAT
The Risk Potential Assessment Tool (RPAT) template contains 21 mandatory questions – 7 relating to Strategic Context and 14 relating to Implementation Complexity.
The questions are designed to enable consistent consideration of risk sources at the pre Government decision stage, within a standard evidence based document.
Guidance to answer each question is provided below. Responses to questions must reflect pre-mitigation levels of risk and be developed in line with this guidance.
Each question in Section A and B is answered by entering 2 pieces of information: the Risk Rating and Justification.
Each question requires one choice from
- VERY LOW
- LOW
- MEDIUM
- HIGH
- VERY HIGH
A brief text prompt specific to each question is provided to guide the selection.
The Justification field is used to state assumptions underpinning the selection of a Risk Rating for that question. Ensure text is succinct – approximately 250 characters is recommended.
The Top 5 Risks table will automatically populate from answers to the 21 questions.
The Top 5 Risks are ranked in order of individual question Risk Rating, for example, all the VERY HIGHs are extracted first, then the HIGHs and so on. Then, the order in which the extracted Top 5 Risks are presented is based on the question ordering (for example, Q1 will be presented before Q2 if both are VERY HIGH).
Example of a Top Five Risks table (Steps 3, 4 and 5)
RISK | JUSTIFICATION | MITIGATION | RESIDUAL RISK |
---|---|---|---|
#1 GOVERNMENT PRIORITY VERY HIGH | This text is carried forward for the Justification fields in the RPAT question. | Mitigation text is entered directly here by the drafting entity. | Very High |
#2 CITIZENS VERY HIGH | This text is carried forward from the Justification field in the RPAT question. | Mitigation text is entered directly here by the drafting entity. | HIgh |
#3 STAKEHOLDERS HIGH | This text is carried forward from the Justification field in the RPAT question. | Mitigation text is entered directly here by the drafting entity. | Medium |
#4 INFORMATION TECHNOLOGY HIGH | This text is carried forward from the Justification field in the RPAT question. | Mitigation text is entered directly here by the drafting entity. | Medium |
#5 FINANCIAL MEDIUM | This text is carried forward from the Justification field in the RPAT question. | Mitigation text is entered directly here by the drafting entity. | Medium |
Risk mitigation is the process of developing options and actions to enhance opportunities and reduce threats to project objectives.
Once the Top 5 Risks table is populated, enter mitigation information into the table. If appropriate alter the Residual Risk rating, which may affect the Overall Risk (including mitigation) in the Risk Summary.
Mitigation, or the risk treatment, should be directly related to implementation risks which may arise assuming the proposal proceeds.
Although only the Top 5 Risks require mitigation actions to be entered in the RPAT, you must consider mitigation for all risks outlined in the RPAT. Consider the strengths and weaknesses of each mitigation action entered.
Residual Risk is the risk remaining after mitigation (risk treatment). The Overall Risk (including mitigation) rating may be reduced after the mitigation is applied.
While some questions in the RPAT can have mitigation strategies leading to a lower risk rating, there are some categories where the risk rating will not reduce (for example, if the proposal is for a signature reform, which attracts a VERY HIGH risk rating for Government Priority, the residual risk can only be lowered if the Government Priority is lowered).
The detailed guidance for each question in the RPAT provides advice on risks unlikely to have a lower Residual Risk.
You must only lower the Residual Risk where there is evidence to suggest the options for treating the risk would lower the likelihood of it occurring.
The Strategic Context rating is determined by the answers to the questions in Section A of the RPAT.
The Implementation Complexity rating is determined by the answers to the questions in Section B of the RPAT.
The Legal Risk rating, if HIGH, will affect the Level of Risk (before mitigation) and the Overall Risk (including mitigation) so that the minimum rating for these 2 indicators will be HIGH.
The Level of Risk (before mitigation) is calculated by the intersection of Strategic Context and Implementation Complexity. This rating is highlighted and bolded in the Risk Summary table as it is the risk that is used to determine if Finance requires the completed RPAT.
Overall Risk (including mitigation) is calculated from the potentially lowered residual risk ratings applied to the Top 5 Risks. The Overall Risk (including mitigation) will often not be different to the Level of Risk (before mitigation), as the RPAT form only has provision for 5 of the 21 questions to have their residual risks lowered.
Please note Finance will consider the Level of Risk (before mitigation) in deciding whether to recommend assurance reviews for the proposal.
Example of a Risk Summary table
The Risk Summary is calculated by the RPAT form. | |
---|---|
Strategic Context | Medium |
Implementation Complexity | High |
Legal Risk | Medium |
Level of Risk (before mitigation) | High |
Overall Risk (including mitigation) | Medium |
Guidance for answering the 21 mandatory questions
Section A: Strategic Context analysis
RPAT Questions A1 to A7
Very Low
Very low government profile. | Low | Med
Moderate government interest. | High | Very High
Very high government interest/ priority. |
Identify the strategic priority placed on this proposal by government. If you are unsure about the answer to this question, consult your central entity contact.
Mitigation and Residual Risk for Question A1
Mitigation strategies are unlikely to affect the Government’s priority; this can only occur if the Government changes their strategic priorities for Budget. Therefore, the residual risk would normally remain the same as the pre-mitigation Level of Risk.
- Risk treatment is unlikely to reduce the Level of Risk.
Very Low
Exposure of public funds, less than $50m. | Low
| Med
Exposure of public funds $250-$500m. | High
| Very High
Exposure of public funds greater than $1 billion. |
Indicate the level of cost and financial exposure associated with the proposal. In determining direct costs give consideration to:
- using the gross cost estimate (do not adjust down for any offsets)
- including both administered and departmental costs over the forward estimates
- whether all costs have been considered
- any contingent liabilities that may accrue to government as a result of implementation; and
- whether the proposal is likely to require additional funding.
Mitigation and Residual Risk for Question A2
As these are estimates being put forward as part of the New Policy Proposal, it is not possible to change them through mitigation measures. Therefore, the residual risk will normally be the same as the pre-mitigation Level of Risk.
- Risk treatment is unlikely to reduce the Risk Rating.
Very Low
Low impact on small number of citizens. | Low | Med
Medium impact on moderate number of citizens. | High | Very High
Large impact on large number of citizens. |
Assess the level of impact on citizens, both in terms of number of citizens affected, or impact on groups of citizens. Citizens are defined as an Australian Citizen or Australian Resident. Consider the effect the proposal will have on the citizens if fully delivered, partially delivered or if delivery fails. The text explanation should include which segments of the public will be affected and the degree to which each segment will be affected.
Mitigation and Residual Risk for Question A3
- Risk treatment may reduce the Risk Rating.
Very Low
Minimal impact on private sector. | Low
| Med
Moderate negative or positive impact on private sector. | High | Very High
Significant negative or positive impact on private sector. |
Determine the effect on the private sector, or markets. Specify which sectors will be affected positively or negatively and the size of the effect on each sector. Consider the capacity of the private sector to take on any responsibilities associated with the proposal, the level of interest and opposition in the private sector as well as the size of the market in relation to government intervention.
Highlight and detail if there is an impact on the small to medium enterprise (SME) market.
Mitigation and Residual Risk for Question A4
- Risk treatment may reduce the Risk Rating.
Very Low
Straight forward stakeholder arrangement or no opposition of stakeholders expected. | Low
| Med
Multiple stakeholders or some stakeholder opposition expected. | High | Very High
Complex stakeholder arrangements or significant stakeholder opposition expected. |
Identify what issues exist in dealing with stakeholders for this proposal. Consider who the stakeholders are, identify what positions or expectations they may have in relation to the proposal and the complexity associated with stakeholder management. Include stakeholders represented through interest groups and/or the media.
When determining a Strategic Context rating, consider:
- complexity and number of different stakeholder groups;
- diverse range of views and their impact on the proposal; and
- the potential consequences of stakeholder opposition.
Mitigation and Residual Risk for Question A5
- Risk treatment may reduce the Risk Rating.
Very Low
AGS legal risk ratings (where relevant) are Low, and contracting risk is Very Low. | Low | Med
AGS legal risk ratings (where relevant) are Medium, or contracting may involve indemnities, warranties or guarantees. | High | Very High
AGS legal risk ratings (where relevant) are High, stakeholders are litigious, or contracting creates significant risks to the Commonwealth. |
Identify the legal issues which may impact on the policy design, or implementation of the proposal. Explain the legal risks which arise from: Australian Government Solicitor (AGS) advice; contingent liabilities such as warranties, guarantees and indemnities; personal injury or property damage arising from implementation; or a highly litigious stakeholder group.
Mitigation and Residual Risk for Question A6
- Risk treatment may reduce the Risk Rating. Mitigation for the risks that arise in AGS advice can only reduce the residual risk rating in consultation with AGS.
Very Low
Very Low other risk. | Low
| Med
Medium other risk. | High | Very High
Proposal specific risk to be highlighted for cabinet. |
Identify any other risk in the Strategic Context not covered in the above categories specific to a policy of this type. The intent of this section is to alert Cabinet to significant issues not already captured in previous questions. Examples of risks that could be covered here are significant Security, Environmental, International and Location constraints and/or issues. These categories of risk which can have consequences for government are the most common risks which do not have a specific question in the RPAT.
Mitigation and Residual Risk for Question A7
- Risk treatment may reduce the Risk Rating.
Section B – Implementation Complexity
RPAT Questions B1 to B14
Very Low
No other jurisdictions, entities or other business units involved. | Low
| Med
Some involvement across other jurisdictions, entities or business areas. | High
| Very High
Complex involvement across jurisdictions, entities or business units. |
Assess the degree to which the proposal cuts across other jurisdictions, entities, and business areas. Specify what involvement jurisdictions/entities/business areas have to the proposal and how this involvement may add complexity or difficulty to the implementation of the proposal.
Multiple entity involvement in the delivery of a proposal would be likely to attract a MEDIUM or higher rating. In addition, where any involvement with States or Territories is included or the potential for Inter-Governmental Agreements, National Partnership Agreements and National Cabinet involvement, the proposal would likely attract a HIGH or VERY HIGH rating.
Mitigation and Residual Risk for Question B1
- Risk treatment may reduce the Risk Rating.
Very Low Less than $50m. | Low
| Med $250m - $500m. | High
| Very High Greater than $1b. |
Indicate the size of the expected financial benefit to be derived from the proposal. Consider any additional revenue from the proposal, greater efficiencies, long term reductions in costs or other benefits that are clearly identified and quantified in the proposal.
Mitigation and Residual Risk for Question B2
- Risk treatment is unlikely to reduce the Level of Risk.
Very Low
Limited impact on operations or staff. | Low
| Med
Some organisational restructuring, retraining or transfer of staff/ outsourcing. | High | Very High
Very significant impact on operations or staff. Rectifying high profile operational failure. |
Determine what transformation or alterations to entity structure and practices/culture will occur in order to implement the proposal.
Proposals which require the establishment, merger or closure of an entity would likely attract a HIGH or VERY HIGH rating.
Mitigation and Residual Risk for Question B3
- Risk treatment may reduce the Risk Rating.
Very Low
Involves no new technology, development, methods, production or tools.
| Low
| Med
Involves new techniques but with a stable application or known techniques but with new application. | High | Very High
Use of new or untried technology, development, methods, production or tools with high degree of complexity or uncertainty. |
Determine how much innovation will be incorporated into the proposal. Assess the inherent risks in developing and delivering proposals that involve significant new or untried methods of practice/technology.
Consider what innovative tools or applications are to be used in the proposal, if this innovative approach has been previously used and, if so, whether the previous use was a success.
Mitigation and Residual Risk for Question B4
- Risk treatment may reduce the Risk Rating.
Very Low
No IT component. | Low
| Med
Infrastructure required/packaged software/data migration/some links to other internal/external systems. | High
| Very High
Significant infrastructure requirements/ complex data migration/ extensive and/or complex links to internal/external systems. |
Determine the level of complexity and structure of the proposed ICT and how this is incorporated into the proposal.
The examples provided in the risk rating boxes above are not an exhaustive list. Consider all other potential complexities associated with the ICT component within the proposal, which may include the technical skills and availability required to implement the proposed ICT.
Proposals subject to the ICT Investment Approval Process would likely attract a HIGH or VERY HIGH rating for this question.
Mitigation and Residual Risk for Question B5
- Risk treatment may reduce the Risk Rating.
Very Low
No procurement. | Low
| Med
Delivery of complex products/services. | High | Very High
Significant customised element. Multi stage procurement process. |
Determine the extent of formal procurement or tendering envisaged for the proposal. The text explanation should incorporate all related procurement and the complexity associated with each of the procurement processes proposed.
Particular attention should be given to:
- known instances where similar procurements have failed;
- budget overruns; or
- instances where market capability has been unable to meet the procurement needs as specified.
Mitigation and Residual Risk for Question B6
- Risk treatment may reduce the Risk Rating.
Very Low
No construction requirements. | Low
| Med
New construction using non-standard construction. | High
| Very High
Unique Commonwealth construction or other construction with extensive customised elements. |
Determine the level and nature of construction in the proposal. Reflect all construction and the complexity associated for each construction proposed.
There are many aspects of construction which may add complexity, such as:
- heritage/architectural value;
- proximity to environmentally fragile areas, endangered species and the like;
- proximity to areas associated with indigenous culture/identity; and
- proposed usage for a highly sensitive activity.
Proposals subject to the Two Stage Capital Works Approval Process would likely attract a HIGH or VERY HIGH rating for this question.
Mitigation and Residual Risk for Question B7
- Risk treatment may reduce the Risk Rating.
Very Low
No contract/ delivery arrangements required. | Low
| Med
Multiple suppliers but with single prime contractor. Separate service delivery entity. | High | Very High
Complex commercial arrangements. Multiple suppliers without prime contractor or multiple service delivery partners. |
Determine the nature and level of commercial or service delivery arrangements associated with this proposal. The text explanation should address how contracts or agreements for delivery are set up and the private sector or other delivery partner’s capacity to meet supply needs. Indicate the effect that contract and supply arrangements may have on the industry or service delivery segment.
Where multiple suppliers or another Commonwealth entity is providing service delivery arrangements for the proposal, this is likely to attract a MEDIUM, HIGH or VERY HIGH rating. It is expected that early consultation has occurred with the service delivery entity and they have informed this assessment.
Mitigation and Residual Risk for Question B8
- Risk treatment may reduce the Risk Rating.
Very Low
Straight forward and stable governance structure. | Low
| Med
Some governance issues identified and actions developed to correct them. | High | Very High
Complex governance structures likely to change during life of the project/ program. |
Determine the complexity of the governance arrangements for the proposal. Consider whether the structures involve cross-entity or interdepartmental committees, inter-jurisdictional governance arrangements or external representation in the governance arrangements.
Mitigation and Residual Risk for Question B9
- Risk treatment may reduce the Risk Rating.
Very Low
Fully resourced and skilled team and management. No recruitment requirement or specialist training. | Low | Med
Key skills/experience in place but recruitment or training required for staff. | High | Very High
Key skills/experience lacking or not available. Significant new resources or training required. |
Determine the resources allocated to, or available to implement the proposal. Consider the level of team and management experience for the proposal and whether this needs to be imported, difficulties that may arise in relation to recruitment or training and any complexity associated with sourcing the skills externally or internally.
Mitigation and Residual Risk for Question B10
- Risk treatment may reduce the Risk Rating.
Very Low
No challenge in meeting timetables. | Low
| Med
Compressed or extended timeframe for delivery. | High | Very High
Schedules very difficult, no contingency allowed. Uncontrolled changes to deadlines likely. |
Determine whether there are timing constraints which add complexity to the proposal, for example, fixed dates for commencement of proposal and how these constraints will impact delivery of the proposal on time, on budget and to expectations.
Mitigation and Residual Risk for Question B11
- Risk treatment may reduce the Risk Rating.
Very Low
No dependence on success of other projects/ | Low
| Med
Some dependence on successful delivery of other projects/ | High | Very High
Fully dependant on successful delivery of other projects/ |
Assess the level of dependence or interdependence of this proposal to other projects/programs for successful implementation. Consider the nature of the other projects/programs that this proposal is dependent on, the current status of these projects/programs and the level of dependence.
Mitigation and Residual Risk for Question B12
- Risk treatment may reduce the Risk Rating.
Very Low
There is clarity of policy and high level of policy development assurance. | Low | Med
Developing clarity of policy and some level of policy development assurance. | High | Very High
Lack of clarity of policy and low level of policy development assurance. |
Determine how well-developed and understood the policy intent for the proposal is. Consider the level of policy development that is planned, the level of detail or direction given by Government for the proposal, and whether all parties are committed and have a common understanding of the proposal’s intent (for example, States and Territories, or if industry input is envisaged for final program design).
Mitigation and Residual Risk for Question B13
- Risk treatment may reduce the Level of Risk.
Very Low
Entity has extensive experience with previous comparable outputs. | Low | Med
Entity experience with comparable projects but with new complexities for delivery. | High | Very High
No previous experience with this kind of proposal. |
Determine how proficient/experienced the entity is in delivering this type of proposal. Consider the capability demonstrated in the delivery of similar outputs by the entity, if the entity has retained relevant capabilities and what lessons have been learned about prior initiatives.
Consideration should be given to:
- outcomes from recent entity capability reviews;
- capability improvement strategies;
- workforce planning and the impact on the entity implementing the proposal;
- whether the implementation of the policy initiative is managed by an entity as “business as usual” or using project management disciplines;
- the implications this initiative will have for the entity’s workforce (capacity, capability, location, functional alignment to business delivery);
- the new skills or capabilities that will become important to achieve business outcomes and how will they be acquired (developed internally or attracted from external sources);
- the current availability of these new skills and capabilities in the external labour market and, the level of impact if they are not available at critical time points in the implementation; and
- the skills and capabilities that will no longer be required and how this surplus will be managed.
Mitigation and Residual Risk for Question B14
- Risk treatment may reduce the Risk Rating.
Resources
The RPAT is a Microsoft Excel template
Example of the Top 5 Risks and Risk Summary Tables
These resources can also be found under Tools and templates in the right hand menu.