FOI 20/21-0877 DOCUMENT 1

National Disability Insurance Scheme—Risk Management Rules 2013

Section 10

RISK MANAGEMENT DECLARATION 2013-14

The National Disability Insurance Scheme is a once in a generation economic and social reform which has been agreed to by all Australian Governments. It is administered by the National Disability Insurance Agency (the Agency).

The Scheme commenced on 1 July 2013, on the day the Board of the Agency was appointed. The Agency is therefore a new organisation. In the opinion of the Board the systems and processes necessary to support the provision of services to Scheme participants have not yet reached the level of sophistication which might be expected in a more mature organisation with a comparable scope of responsibilities.

In that context, the Board makes the following declaration as required by section 10 of the National Disability Insurance Scheme—Risk Management Rules 2013.

Declaration

In the opinion of the directors, to the best of our knowledge and belief and having made appropriate enquiries, except for the impact of the matters referred to in the qualification below, we declare that:

(a) The Agency has systems in place for the purpose of ensuring compliance with the National Disability Insurance Scheme Act 2013 and the Commonwealth Authorities and Companies Act 1997 (b) The Board and senior management of the Agency are satisfied with the efficacy of the processes and systems for the production of the Agency’s financial information (c) The Board has in place a risk management strategy that complies with the requirements of the National Disability Insurance Scheme—Risk Management Rules 2013 (d) The Agency (including the Board) has, throughout the relevant financial year, substantially complied with the risk management strategy (e) The risk management strategy is operating effectively; and (f) The risk management strategy in its present form has been submitted to and approved by the Ministerial Council.

Qualification

The Agency’s risk management strategy was formally endorsed by the Board in February 2014 and approved by the Ministerial Council on 24 March 2014. Therefore the Board cannot attest that the Agency complied with the strategy throughout the financial year.

A risk management framework has been established which includes procedures for complying with all the Board’s responsibilities under the National Disability Insurance

FOI 20/21-0877

Scheme—Risk Management Rules 2013, a risk management implementation plan has been developed with a defined timeline and actions and administrative systems and processes are progressively being refined. The task of embedding risk management throughout the Agency and developing a risk management culture, however, remains to be completed.

The Board does not consider these qualifications involve any contravention of the Board’s obligations under the National Disability Insurance Scheme Act 2013 or the National Disability Insurance Scheme—Risk Management Rules 2013 and is in the process of remedying the circumstances which give rise to the qualifications.

This declaration is made in accordance with a resolution of the Board and signed on behalf of the Board by:

Bruce Bonyhady Chair NDIS Board

[redacted — s47]

John Hill Chair Audit and Risk Committee

Page 2 of 9

FOI 20/21-0877

DOCUMENT 2

National Disability Insurance Scheme-Risk Management Rules 2013

Section 10

RISK MANAGEMENT DECLARATION

2014-15

We declare on behalf of the Board, as at the date of signing, that to the best of the Board’s knowledge and belief, and having made appropriate enquiries:

(a) The Agency has systems in place for the purpose of ensuring compliance with the National Disability Insurance Scheme Act 2013 and the Public Governance, Performance and Accountability Act 2013; and

(b) The Board and the senior management of the Agency are satisfied with the efficacy of the processes and systems for the production of the Agency’s financial information; and

(d) The Agency {including the Board) has, throughout the relevant financial year, substantially complied with the risk management strategy; and

(e) The risk management strategy is operating effectively; and

(f) The risk management strategy in its present form has been submitted to and approved by the Ministerial Council.

This declaration is made in accordance with a resolution of the Board and signed on behalf of the Board by:

[redacted — s47F]

Bruce Bonyhady Chair NDIA Board

John Hill Chair Audit and Risk Committee

Page 3 of 9

FOI 20/21-0877 DOCUMENT 3

Attachment A

National Disability Insurance Scheme—Risk Management Rules 2013

Section 10

RISK MANAGEMENT DECLARATION 2015-16

We declare, on behalf of the Board, that to the best of the Board’s knowledge and belief, and having made appropriate enquiries:

a) the Agency has systems in place for the purpose of ensuring compliance with the National Disability Insurance Scheme Act 2013 (‘Act’) and the Public Governance, Performance and Accountability Act 2013;

b) the Board and the senior management of the Agency are satisfied with the efficacy of the processes and systems for the production of the Agency’s financial information;

c) the Board has in place a risk management strategy that complies with the requirements of the National Disability Insurance Scheme — Risk Management Rules 2013 (‘Rules’);

d) the Agency (including the Board) has, throughout the relevant financial year, substantially complied with the risk management strategy;

e) the risk management strategy is operating effectively;

f) the risk management strategy in its present form has been submitted to and approved by the Ministerial Council.

This declaration is subject to the following qualification.

Qualification

During 2015-16 the Agency’s approach to risk management included a strong focus on risks critical to the successful roll-out of full scheme launch, taking account of the complex environment in which the Agency is operating.

Independent reviews have identified that there were aspects of the full scheme launch which could have been managed more effectively. These include planning and scheduling, change management, stakeholder engagement and the timely remediation of identified risks and issues.

In order to remedy the circumstances giving rise to this qualification, the Board will strengthen its risk management approach. While recognising that risk cannot be eliminated in a reform of this scale, a range of remedial measures commensurate with the size, complexity and timetable of the NDIS reforms are underway, including:

a) establishing an NDIS transition management group to address all outstanding technology, planning, change management and stakeholder communication issues;

b) allocating a Chief Operating role to oversee the NDIA’s operational matters during the transition to full scheme roll out;

c) changes to the Agency’s organisational model, structure and staffing to support the changes described in paragraphs a) and b) of this qualification;

d) enhancement of interagency risk management activities through clear documentation of accountabilities and stronger information sharing arrangements between the NDIA, Commonwealth, state and territory agencies.

Attachment A

The Board does not consider that the circumstances giving rise to this qualification involve a contravention of the Board’s obligations under the Act or Rules.

Bruce Bonyhady AM [redacted] Chairman

John Hill PSM Director and Chair, Audit, Risk and Finance Committee

Page 5 of 9

National Disability Insurance Scheme—Risk Management Rules 2013

Section 10 RISK MANAGEMENT DECLARATION 2016-17

We declare, on behalf of the Board, that to the best of the Board’s knowledge and belief, and having made appropriate enquiries:

b) the Board and the senior management of the Agency are satisfied with the efficacy of the processes and systems for the production of the Agency’s financial information; and

c) the Board has in place a risk management strategy that complies with the requirements of the National Disability Insurance Scheme — Risk Management Rules 2013 (‘Rules’); and

d) the Agency (including the Board) has, throughout the relevant financial year, substantially complied with the risk management strategy; and

e) the risk management strategy is operating effectively; and

f) the risk management strategy in its present form has been submitted to and approved by the Ministerial Council.

This declaration is subject to the following qualification.

Qualification

During 2016-17, the Agency has focussed on risk and controls to support the implementation of the NDIS.

Nonetheless, as the Agency moved from Trial to Transition, weaknesses became apparent in operationalising the Scheme, with implications for NDIA’s risk management strategy.

Work is ongoing to remedy the systems and processes that support the Scheme. This includes eight significant strategic priorities, including the processes and systems associated with the Participant and Provider Pathway Review.

In the Board’s opinion, this qualification does not prevent the signigg of this Declaration.

[redacted — s47]

Dr Helen Nugent, AO Chairman

[redacted — s47] Mr James Minto Director and Chair, Risk Committee

Page 6 of 9

National Disability Insurance Scheme—Risk Management Rules 2013

Section 10 RISK MANAGEMENT DECLARATION 2017-18

We declare, on behalf of the Board, that to the best of the Board’s knowledge and belief, and having made appropriate enquiries:

b) the Board and the senior management of the Agency are satisfied with the efficacy of the processes and systems for the production of the Agency’s financial information; and

c) the Board has in place a risk management strategy that complies with the requirements of the National Disability Insurance Scheme — Risk Management Rules 2013 (‘Rules’); and

d) the Agency (including the Board) has, throughout the relevant financial year, substantially complied with the risk management strategy; and

e) the risk management strategy is operating effectively; and

f) the risk management strategy in its present form has been submitted to and approved by the Ministerial Council.

This declaration is subject to the following qualification.

Qualification

During 2017-18 the Agency’s approach to operations continued to include a strong focus on isks and controls critical to the successful implementation of the NDIS.

Significant progress has been made in building the NDIA’s capacity to manage risk during the last year. However, the Board and Management recognised the need for improvement in the effectiveness of the operationalisation of the NDIA Risk Management Strategy and to ensure it is in place for the entire year. This reflects the complexity of full scheme rollout and ongoing challenges associated with transition.

To achieve this objective, the Agency is substantially enhancing its internal risk capability. This includes the revised Participant Pathway to provide for national consistency for participants and providers.

The Board does not consider that the circumstances giving [redacted] involve a contravention of the Board’s obligations under the Act and Rules.

Dr Helen Nugent AO Chairman

Mr James Minto Director and Chair, Risk Committee

Page 7 of 9

National Disability Insurance Scheme—Risk Management Rules 2013

RISK MANAGEMENT DECLARATION 2018-19

We declare, on behalf of the Board, that to the best of the Board’s knowledge and belief, and having made appropriate enquiries:

b) the Board and the senior management of the Agency are satisfied with the efficacy of the processes and systems for the production of the Agency’s financial information; and

c) the Board has in place a risk management strategy that complies with the requirements of the National Disability Insurance Scheme — Risk Management Rules 2013 (‘Rules’); and

d) the Agency (including the Board) has, throughout the relevant financial year, substantially complied with the risk management strategy; and

e) the risk management strategy is operating effectively; and

f) the risk management strategy in its present form has been submitted to and approved by the Ministerial Council.

This declaration is subject to the following qualification.

Qualification

During 2018-19 the Agency’s approach to risk management continued to include a strong focus on risks and controls critical to the successful implementation of the NDIS.

Significant progress has continued in 2018-19 to extend and support the Agency’s risk management capacity, particularly in relation to embedding risk leadership and culture. However, in relation to (¢), the Board and Management recognise the ongoing need to further embed risk management maturity. This reflects the complexity associated with the speed of full scheme rollout and ongoing challenges associated with transition, particularly with regard to technology and the recruitment, training and retention of appropriately skilled staff.

To achieve this objective, the Agency is extending its risk management capability and is developing business group risk maturity action plans to support deliverables.

The Board does not consider that the circumstances giving rjée to this qualification involve a contravention of the Board’s obligations under the Act and Rules.

Dr Helen Nugent AO Chairman Director/and Chair, Risk Committee

13 September 2019 13 September 2019

Page 8 of 9

National Disability Insurance Scheme—Risk Management Rules 2073

Section 10 RISK MANAGEMENT DECLARATION 2019-20

We declare, on behalf of the Board, that to the best of the Board’s knowledge and belief, and having made appropriate enquiries:

a) the Agency has systems in place for the purpose of ensuring compliance with the National Disability insurance Scheme Act 2073 (‘Act’) and the Public Governance, Performance and Accountability Act 2073, and

b) the Board and the senior management of the Agency are satisfied with the efficacy of the processes and systems for the production of the Agency’s financial information; and

c) the Board has in place a risk management strategy that complies with the requirements of the Nationa! Disability Insurance Scheme — Risk Management Rules 2013 (‘Rules’); and

d) the Agency (including the Board) has, throughout the relevant financial year, substantially complied with the risk management strategy; and

e) the risk management strategy is operating effectively, and

f) the risk management strategy in its present forn has been submitted to and approved by the Ministerial Council

This declaration is subject to the following qualification.

Qualification

The NDIS has grown significantly over the last seven years and is making a difference for participants and their families/carers. This is particularly notable given the 2019-20 financial year was one of significant growth for the NDIS. While satisfaction and outcomes are improving, and waiting times are reducing, the NDIA Board and Management is still committed to a simpler, easier and more reliabie Scheme.

A key focus during the year was to grow the Agency’s risk and assurance maturity to ensure the NDIA is actively monitoring and addressing potential strategic risks to Scheme, including, but not limited to, sustainability.

The Agency’s approach to risk management continues to include a strong focus on operational risks and controls critical to the success and viability of the NDIS, including maintaining Scheme supports during unprecedented levels of external business disruption.

The Board records compliance with all required elements of the declaration, with the exception of one element only: s.70(2)(e) the risk management strategy is operating effectively. While material progress was made in advancing the risk culture of the Agency this year, further work is required to have the Risk Management Strategy operating fully effectively at all times.

The Board will oversee the implementation of an agreed targeted action plan to remediate the qualification and ensure ongoing maturity of embedded risk frameworks in the coming year.

The Board does not consider that the circumstances giving rise to this qualification involve a contravention of the Board’s obligations under the Act and Rules.

Dr Helen Nugent AO [redacted] eas Director and Chair, RisKCommittee 15 September 2020 James Minto [redacted] 15 September 2020

Page 9 of 9