Commonwealth Risk Management Policy

The purpose of this policy is to embed risk management into the culture and work practices of entities to improve decision making in order to maximise opportunities and better manage uncertainty.

The elements of this policy outline its requirements. Entities should tailor their risk management arrangements to suit the nature of their operations and the risks they face.

This document is intended to be used within Commonwealth entities by all staff and officials at all levels, including:

1. accountable authorities 
2. senior executives 
3. risk practitioners 
4. officials responsible for government operations, projects, programs and regulations 
5. audit and/or risk committee members.

Scope and application

This document sets out the principles and mandatory requirements for managing risk in undertaking the activities of government.

Non-corporate Commonwealth entities must comply with this policy.

Corporate Commonwealth entities are not required to comply with this policy, but should align their risk management frameworks and systems with this policy as a matter of good practice.

This policy supports section 16 of the Public Governance, Performance and Accountability Act 2013 (PGPA Act) which states that ‘the accountable authority of a Commonwealth entity must establish and maintain an appropriate system of risk oversight, management and internal control for the entity.’

Embedding risk management into the decision making activities of an entity enables risk to be managed in a repeatable and consistent way when designing, implementing, delivering and undertaking government initiatives. The level of complexity in how risk management is embedded into decision making should be proportionate to the nature and severity of the risks faced. It should also consider the maturity of the entity’s culture and framework for managing risk.

It is particularly important that risk management is embedded into an entity’s activities including projects, strategic and operational planning, governance arrangements, performance management, regulatory oversight, program and policy design and implementation.

An entity’s risk management framework is a set of components and arrangements that articulate the directions and approach for managing risk. It should be practical and tailored to the entity. Risk management frameworks will differ depending on the size and the operations of an entity as well as the nature and complexity of the risks they face.

An entity’s risk management framework should include a risk management policy and a risk appetite statement. A risk management policy is a statement of the overall intentions and direction of an organisation in relation to risk management. A risk appetite statement describes the overarching amount and types of risk an entity is willing to accept in order to achieve its objectives. It is supported by risk tolerance statements that operationalise an entity’s risk appetite by specifying the levels of risk taking that are acceptable.

An entity’s culture should promote an open and proactive approach to risk that fosters collaboration, encourages debate and values independent views. In order for risk management to be effective, it needs to align with the entity’s strategic goals and be part of the organisational culture, internal policies, decision making and individual’s behaviour.

Culture is shaped by the behaviours and attitudes of leaders. The desired culture for managing risk should be clearly defined and demonstrated by the executive in a form that is communicated and actively promoted to staff. An entity’s internal policies should also be aligned to its desired culture.

The responsibility for a consistent approach to the management of risk lies with officials at all levels. What good risk management looks like will vary dependent on an individual’s role, the nature of their work and the seniority of the position they hold.

Responsibility for managing risks should be clearly defined and should include at a minimum:

Entities should ensure that:

1. the controls in place are effective and proportionate to the level of risk to be managed
2. that preventative, detective or corrective controls are in place
3. each control has a clearly designated owner who regularly reports on the implementation, testing and effectiveness of the control.

Entities should ensure that risks are periodically reviewed and monitored. Risks are ultimately managed through controls. The success of managing risks relies on the effectiveness of controls and these controls being monitored. The frequency of control reviews should be guided by the nature, velocity and severity of the risks.

Shared risks are those risks extending beyond a single entity which require a collaborative effort of shared oversight and management. These include risks that extend across entities and may involve other sectors and jurisdictions.

The management of shared risks should be agreed by all parties involved. Accountability and responsibility for the management of these risks should be identified and accepted by those best positioned to manage them.

Considering and planning for emerging risks is an important part of the risk management process. Identifying and monitoring emerging risk enables entities to manage the uncertainty and impact of these risks.

Entities should consider seeking a range of perspectives on emerging risks and incorporate the consideration of these emerging risks into their risk management framework and governance arrangements.

Effective risk management requires an entity to maintain an appropriate level of capability to administer its risk management framework and to manage its risks. The nature and scale of this capability includes governance, processes, staffing, education and systems.

Risk management capability must be regularly considered in the context of an entity’s current resource and capability profile and be commensurate with the characteristics and complexity of its risk profile.

A process of continual review is important to ensure an entity’s risk management framework, approach and controls are relevant, effective and address emerging risks and changes in an entity’s operating environment.

Reviews should be conducted regularly and be informed by experience and lessons learned.