Fraud and Risk Management

Barwon Trial Site

s22(1)(a)(ii) - irrelevant material August 2014

[redacted — s22(1)(a)(ii)]

Session Outline

What is Risk/Risk Management?
Why is it important?
The Agency’s approach to Risk Management
What is your role?
Fraud in the Commonwealth
The Agency’s approach to Fraud Control
What is your role?

What is Risk?

“Risk is the effect of uncertainty on objectives”

AS/NZS ISO31000:2009

Page 257 of 292

Risk Management

Risk Management is the process of identifying, analysing and evaluating risks with a view to ensuring the effective management of potential opportunities while reducing or avoiding adverse effects.

Page 258 of 292

Why is it important?

To minimise the negative impact of risks upon achievement of objectives; and
To maximise the Agency’s ability to realise potential opportunities

Prevention is better than the cure.

Risk management is a proactive attempt to identify potential risks and incidents before they happen in order to develop prevention and response strategies.

Risk Management: Benefits

Increase the likelihood of the Agency achieving strategic and business objectives;
Encourage a high standard of accountability at all levels of the organisation;
Support more effective decision making through better understanding of risk exposures;
Create an environment that enables the Agency to deliver timely services and meet performance objectives in an efficient and cost effective manner;
Safeguard the Agency’s assets — human, property and reputation; and
Meet compliance and governance requirements.

Agency Approach

Requirements:
- CAC Act/PGPA Act;
- NDIS — Risk Management Rules
- APRA CPS 220 (Board policy)
Risk is part of the way we do business in the Agency, not another thing to do

Agency Approach - Components

Risk Management Framework
Risk Management Strategy
Risk Management Manual — Tools and templates
Intranet site
Risk Management Champions

Page 263 of 292

Risk Management Framework

Systematic approach to risk identification & management
Consistent risk assessment criteria
Accurate and concise risk information, for decisions
Cost effective and efficient risk treatment strategies
Ensure risk exposure remains within acceptable level
Includes the culture, processes and structures that are directed towards realising potential opportunities while managing adverse effects

Risk Management Strategy

Approved by CDRC
Covers:
- Risk Governance
- Processes to identify, mitigate and control risks
- Monitoring and reporting risks
- Risk communication and risk culture
- Roles and Responsibilities
- Review process

Governance Arrangements

[Image not converted to Markdown – “Governance Arrangement Diagram” – check the source PDF page for the actual content]

COAG Disability Reform Council

NDIA Board

Sustainability Committee

Scheme Actuary

Chief Risk Officer

Audit and Risk Committee

Chief Executive Officer

Executive Management Team

NDIA staff

Commonwealth Minister (CAC/PGPA Act)

External Auditor (ANAO)

Internal Audit/Independent Review

Independent Advisors (e.g. APRA, Review Actuary)

Assurance, Audit and Risk Committee

Page 266 of 292

Risk Management Processes

[redacted]

Communicate and consult

Risk context Risk identification Risk analysis Risk evaluation Risk treatment

Objectives *What can *Review controls *Evaluate risks *Further
Stakeholders happen? eAssess *Rank risks mitigation
Assessment *How can it happen? *Assess likelihood *Risk acceptance activities criteria *Define key risk elements Determine ‘current risk level (yes/no) *Risk escalation, monitoring and assurance

Determine ‘target’ risk level

Monitor and review

Page 267 of 292

Monitoring & Reporting

Three levels of monitoring
- Strategic risks
- Operational risks
- Project risks

Integrated Risk Management

FOI 20/21-0879

[Image of a flowchart depicting integrated risk management]

Strategic Plan

Strategic Risks
Strategic Risk Management
Operational Risks
Operational Risk Management
Significant Projects

Corporate Business Plan

Divisional Business Plans

Branch/Site Business Plans

Business as usual

Significant projects

Individual Performance Agreements

Page 269 of 292

Reporting & Monitoring

Strategic Risks

Strategic Risk Treatment Actions Report (quarterly)
Risks to the delivery of strategic plans or achievement of corporate goals

Operational Risks

Operational Risk Treatment Actions Report (monthly)
Risks to the delivery of day to day operations or services
Specialist risk assessments (e.g fraud, WHS)

Project Risks

Project Risk Treatment Actions Report (fortnightly)
Risks to the delivery of individual projects

CRO reviews and prepares summary report for CEO, Board, Strategic Risk Committee, Audit Fraud Risk and Compliance Committee, and/or Audit and Risk Committee as appropriate

Page 270 of 292

Strategic Risks

People with disability are in control and have choices, based on the UN Convention on the Rights of Persons with Disabilities

The Agency fails to build the capacity of people with disability to exercise choice and control
The Agency fails to promote the independence and social and economic participation of people with disability
The Agency fails to establish mechanisms which effectively measure social and economic outcomes and exercise of choice and control

Page 271 of 292

Strategic Risks (2)

The National Disability Insurance Scheme (NDIS) is financially sustainable and governed using insurance principles

The Agency fails to meet support package needs within available funding envelopes
The Agency fails to deliver operational capability within available funding envelopes
The Agency fails to identify and mobilise IT resources to meet the needs of actuarial and management reporting
The scope and scale of participation exceeds Scheme design — more people with permanent and significant disabilities
The scope and scale of supports exceed Scheme design — cost of reasonable and necessary supports
A reduction occurs in the level of family and community supports and in personal responsibility
The Agency fails to invest in a lifetime approach, including early intervention