FOI 20/21-0879 - DOCUMENT 2

SENSITIVE: OFFICIAL BOARD PAPER

Agenda Item 2.5

Recommendation(s) – that the Board:

Note that the Risk Management Framework (Framework) approved by the Board at its September meeting includes the Agency’s written risk management strategy (Strategy) at Chapter 4 (Attachment A).
Agree that the Board submit the entire Framework to the COAG Disability Reform Council (Ministerial Council) seeking approval of the Strategy, to comply with the requirement in the National Disability Insurance Scheme-Risk Management Rules 2013 (Risk Management Rules) that the Agency’s risk management strategy, and any material amendments to it, must be submitted to, and approved by, the Ministerial Council.

The Risk Management Rules require the Board to have a risk management framework that includes a written risk management strategy. The framework does not have to be in writing.
The Risk Management Rules further require that the strategy, and any amendments to it, must be approved by the Ministerial Council, and the Board must submit the strategy or amendments to the Ministerial Council as soon as reasonably practicable after the strategy or amendments have been approved by the Board.
At its September meeting the Board approved the Framework, which includes the Agency’s Strategy at Chapter 4 (see Attachment A).
Given the Strategy is inextricably linked with the Framework approved by the Board, we recommend that the Board submit the entire Framework to the Ministerial Council, seeking approval of the Strategy only, as required by the Risk Management Rules.
The alternative would be to submit only the Strategy at Chapter 4 of the Framework to the Ministerial Council. However: a. this would require the drafting of substantial additional contextual material to support the Strategy – for example, because the Strategy cross-refers to other parts of the Framework, and b. this would lead to the development of an additional stand-alone risk management document, rather than an integrated framework as approved by the Board.

Sensitive – not for further distribution without the agreement of the National Disability Insurance Agency Corporate Secretary. Page 55 of 292

Page 1 of 3

Agenda Item 2.5

The Agency’s Corporate Counsel has advised that submitting the Framework to the Ministerial Council would meet the Board’s obligation under the Risk Management Rules to submit the Strategy for approval.
In addition, following table shows how the Strategy, as articulated in the Framework approved by the Board, meets the minimum requirements specified in section 8(1) of the Risk Management Rules:

The risk management strategy must:	Cross-reference to Agency Risk Management Framework (including Risk Management Strategy) (see Chapter 4)
(a) outline the risk governance relationship between the Board, committees of the Board and the senior management of the Agency	pages 22—29
(b) describe the processes for the Agency to identify and assess risks	pages 30—34
(c) describe the process for the Agency to establish mitigation and control mechanisms for individual risks	pages 35—37
(d) describe the process for monitoring and reporting issues in relation to risk (including the communication and escalation of such issues)	pages 38—40
(e) describe how the Agency is to: (i) ensure that relevant staff are aware of issues relating to risk; and (ii) instil an appropriate culture in relation to risk; and (iii) ensure that the risk management strategy is accessible to the Agency’s staff	page 40
(f) identify persons and positions in the Agency with roles and responsibilities in relation to risk, or groups of such persons and positions, and set out those roles and responsibilities	pages 41—44
(g) describe the review process [ie, a review process to ensure that the risk management framework is effective in identifying, measuring, evaluating, monitoring, reporting, and controlling or mitigating, material risks (see section 5(4)(d))]	page 44

Sensitive — not for further distribution without the agreement of the National Disability Insurance Agency Corporate Secretary.

Page 56 of 292 Page 2 of 3

Agenda Item 2.5

The Framework (and Strategy) will be reviewed by the Board on an annual basis and Ministerial Council approval of the Strategy will be required if material changes are made to the Strategy.

Prepared by: [redacted] Team: Director, Risk and Assurance Phone: [redacted]

Approved by: [redacted] A/g General Manager Phone: [redacted]

Attachments:

Attachment A NDIA Risk Management Framework

Sensitive – not for further distribution without the agreement of the National Disability Insurance Agency Corporate Secretary. Page 57 of 292

Page 3 of 3