Procurement Plan

From: Acting Branch Manager, Insurance and Performance Reporting Date: 11 September 2013 Subject: Procurement of Internal Audit Services

The purpose of this minute is to seek your approval for the procurement of services in accordance with this plan to enable the selection of an internal audit provider. It is proposed to conduct the procurement as a Request for Quotation (RFQ) with KPMG, Deloitte, PwC and Ernst & Young invited to submit a response. These are considered the four providers who are able to supply the services required.

These service providers form part of the Department of Resources, Energy and Tourism Panel — Internal Audit, Risk Management, Program Evaluation, Fraud Control, Protective Security and Fraud Investigation Services — SoN 145385 which the Agency utilises.

Services and requirements

Broadly the requirement of the services is to:

assist the Board meet its statutory and legislative obligations by the provision of internal audit and assurance services
develop an internal audit plan focused on adequacy of internal controls, compliance activities and management of key business risks
undertake internal audit reviews in accordance with the internal audit plan and provide reports to Management and the Board on the adequacy of policies and processes
review and report on the integrity of financial and operational information used for annual reporting
identify and provide “best practice” advice on opportunities for improvement in areas reviewed
provide ad hoc assistance as required

Page 1 of 55

Value for Money (VFM) Assessment

Value for money will be achieved through a competitive RFQ process. The responses will be assessed against defined evaluation criteria and in accordance with a pre approved evaluation plan.

The CFO will be the approving delegate and the Branch Manager Insurance and Performance Reporting will be the contract manager.

Term of the arrangement and contract value

Services will be required between 1 November 2013 and 30 October 2014. It is anticipated that the contract value will be between $150K and $250K.

Proposed agreement type

An official order for services will be placed in accordance with panel arrangements.

Risk assessment

Existing panel being utilised to minimise service quality risks. Competitive quotation process being undertaken to minimise pricing risks.

Alternative approach

Request for Tender is alternate approach. Selection from existing panel is considered the most expedient.

Reporting

The successful provider will have clear deliverables and timelines. The contract delivery will be managed by the Branch Manager Insurance and Performance Reporting.

Consultation

Advice has been provided by the Agency’s internal Procurement team.

Conflict of Interest

Staff involved in the RFQ process will complete conflict of interest declarations as appropriate and follow standing protocols.

Recommendation

R1 - That you approve the procurement in accordance with this plan and the evaluation plan attached.

R2 — That you as the delegate approve in principle the projected expenditure of up to $250K for the full contract term.

Signed

[redacted — s22(1)(a)(ii)]

Page 2 of 55

Delegate Approval

As delegate I certify that this procurement represents best value for money and that the proposed purchase will make effective, economical and efficient use of public moneys. I have read and understand the DisabilityCare Australia Procurement Instruction and the Commonwealth Authorities and Companies Act 1997.

Under DisabilityCare Australia’ Delegations Policy, I approve this procurement plan to spend public money and there is available budget for the committed amount.

Name of the Delegate

Position Title [redacted — s22(1)(a)(ii)]

Signature: [redacted]

Date: M. . Ay. nS .

Page 3 of 55

Attachment: RFQ Evaluation Plan — Internal Audit Services

Evaluation Committee

The following team will undertake the evaluation

Position	Name	Branch
Chair	[redacted — s22(1)(a)(ii)]	Insurance and Performance Reporting
Member	[redacted — s22(1)(a)(il)]	Fraud and Compliance Advisor
Member	[redacted]

Timetable for Evaluation

The timetable for evaluation will be as follows:

Event	Timetable
Quotation requested	13 September 2013
Quotation due	11 October 2013
Board Chair advised of proposed appointment	21 October 2013
Successful provider notified	25 October 2013
Contract initiation	1 November 2013

Evaluation method

All RFQ’s will be evaluated for compliance.

A qualitative assessment method will be used to assess each RFQ against the evaluation criteria and overall value money.

Quotations will be evaluated against the following criteria:

Value for money;
Demonstrated understanding of project requirements;
Demonstrated skills and experience in subject matter;
Demonstrated capacity to meet specified timelines:
Demonstrated experience with similar agencies and /or insurance schemes.

A report with recommendations will be forwarded to the delegate for approval.

Unsuccessful providers will be offered the chance of a debrief after all negotiations with the successful provider have been completed.

All meetings will be minuted and reports will be maintained for audit purposes.

Each evaluation criteria will be evaluated on a 10 point scale below.

Tender Assessment Rating/Scoring Scale

Rating Scale	Score
Exceptional	10
Specification requirements significantly exceeded in all areas. Claims are fully substantiated. Unequivocal support from referees. Extremely Low Risk.
Outstanding	9
Specification requirements are exceeded in most key areas & addressed to a very high standard in others. Most Claims are fully substantiated with others very well substantiated. Unequivocai support from referees. Very low risk.
Very Good	8
Specification requirements met to a very high standard in all areas. All Claims are well substantiated. Very strong support from Referees. Some manageable risks with strategies. Very Low risk.
Good	7
Specification requirements met to a high standard in all areas. Claims are well substantiated in key areas. Strong support from referee with minimal or no reservations. Low risk — all Key risks covered well.
Fair	6
Specification requirements are addressed well in all areas. Claims are well substantiated in most areas. Credible strategies that fully address all minimum requirements and exceed requirements in some areas. Some minor shortcomings. Sound referee support. Most key risks are covered well. Medium risk
Acceptable	5
Specification requirements addressed to a consistent acceptable standard with no major shortcomings. All claims are adequately substantiated. Some proposals questionable. Support from referees is adequate. Medium risk.
Marginal	4
Specification requirements not fully met and additional information/ deficiencies not adequately overcome by Tender’s clarification. Some claims unsubstantiated; others only adequate. Some proposals unworkable. Referees report adequate with minor reservations. Medium/High Risk
Poor	3
Specification requirements poorly addressed in some areas or not at all. Claims largely unsubstantiated. A number of proposals unworkable. Strong referee reservations. High risk.
Very Poor	2
Specification requirements inadequately dealt with in most or all areas. Claims almost totally unsubstantiated. A number of proposals unworkable with a high probability of service failure. Referees cannot recommend. Very High risk.
Unacceptable	1
Specification requirements not met. Claims unsubstantiated and unworkable. Significant adverse referee comments. Extreme Risk.
Non-Compliant	0
Tenderer completely failed or refused to provide a response.

Note: Where the narrative on the tender response is accurate but there is a discrepancy with the referee statements provided in the table, scoring can be adjusted up or down by % a point.

Schedule 1— Order

Order Number — CN0127

The Contractor has offered under clause 4.1 of the Deed specified at item 1 below to provide the Services. The Commonwealth accepts this offer on the terms and conditions set out in the Deed and in this Order and issues this Order in accordance with clause 4 of the Deed. Subject to clause 4.7 of the Deed, if there is an inconsistency between this Order and any other provisions of the Deed, the terms and conditions in this Order will prevail to the extent of any inconsistency.

Item	Description	Clause	Details
1.	Deed No. and description	N/A	Internal Audit, Risk Management, Program Evaluation. Fraud Control, Protective Security and Fraud Investigation Services dated 1 August 2012.
2.	Names of Parties to the Deed	N/A	National Disability Insurance Scheme Launch Transition Agency (trading as National Disability Insurance Agency) The Agency and Ernst & Young
3.	Services Start Date	1.1 and 9.1	23 December 2013
4.	Contract Period	1.1 and 9.1	The contract will commence on 23 December 2013 and expire at midnight on 22 December 2014. The contract will provide an option to extend for 2 years which may be exercised at the total discretion of the Agency.
5.	Category of Services	4.1	Internal Audit
6.	Services	11	The Contractor will be required to undertake the following:

assist the Board meet its statutory and legislative obligations by the provision of internal audit and assurance services
develop an internal audit plan focused on adequacy of internal controls, compliance activities and management of key business risks
undertake internal audit reviews in accordance with the internal audit plan and provide reports to Management and the Board on the adequacy of policies and processes
review and report on the integrity of financial and operational information used for annual reporting
identify and provide “best practice” advice on opportunities

Page 6 of 55

F0I 22-0863

for improvement in areas reviewed

provide ad hoc assistance as required.

The output of the work will be the provision of a robust internal audit capability to complement overall risk management activities and form part of a comprehensive assurance framework. Ongoing liaison with Management and regular reports to the Board and/or Committees will be required.

Included in the work programme will be the review and provision of advice to the Board on the adequacy of the Agency’s risk management framework in accordance with the Scheme Risk Management Rules 2013.

Any ad hoc assistance required will be conducted in accordance with the fees outlined as per Attachment A Statement of Work and Attachment B Ernst & Young Proposal to this Official Order, and will not be undertaken without written consent by the Agency’s contact officer prior to work being undertaken.

7. Subcontractors

11.6

Not Applicable

8. Progress meetings and reports

13.1 and 13.2

The timetable for the contract is set out in the table below:

Contract initiation 23 December 2013

Development of a draft internal audit plan for Management review

24 January 2014

Updated draft internal audit plan for Board and/or Committee review

3 February 2014

Finalisation of an internal audit plan with Board and/or Committees

11 February 2014

Implementation of plan and periodic reports to Board and/or Committees

Quarterly or as agreed Ad hoc advice and assistance
As required.

9. Project Officers

13.1

Agency a[redacted — s22(1)(a)(ii)] , Acting National Manager, Business Assurance I Contractor S47F =, Partner

10. Performance Criteria

1.1 and 14

Special Skills/Knowledge Needed

Demonstrated skills and experience in development and delivery

Page 7 of 55

FOI 21/22-0868

of internal audit plans and assurance services in similar funding agencies and/or insurance schemes will be maintained.

Applicable Service Levels and Standards

Services are to be provided to the satisfaction of the contract manager, Executive team and Board.

Services to be provided in accordance with internal audit industry standards and professional obligations.

Resources/materials to be provided by the Agency

Background material on Commonwealth standards, legislative rules and relevant guidelines will be provided. Existing plans and procedures and access to key staff will also be provided.

Reporting Requirements

Reports will be required as detailed in the timetable set out in the section above.

Regular progress meetings with the contract manager will be required throughout the period of the appointment. Attendance at Board and /or Committee meetings would be expected.


11. Specified Personnel	1.iand15	As per Attachment B Ernst & Young Proposal
12. Agency Material	1.1 and 16	Not Applicable
13. Pre-existing aterial	1.land17	Agency
			Not applicable
			Contractor
14. Intellectual Property Rights	1.1and17	No Change

Page 8 of 55

Payment — Service Charges

19.1

Expenses

19.6

(a) Not separately charged. ¢ Not Applicable

Other

Other- Confidential Information

¢ Not Applicable

Page 9 of 55

FOI 21/22-0868

Signed for and on behalf of the National Disability Insurance Scheme Launch Transition Agency (trading as National Disability Insurance Agency) as represented by the Department of Resources, Energy and Tourism by its duly authorised delegate in the presence of

[redacted]

Signature of witness Signature of delegate

Name of witness (print) [redacted — s22(1)(a)(ii)]

General Manager Corporate and Chief Financial Officer

Signed by Ernst & Young in the presence of

[redacted]

Signature of Contractor

Name of witness (print)

Page 10 of 55

DOCUMENT 3

National disabilityinsurance Agency

Deed of Variation

Between

Name: National Disability Insurance Scheme Launch Transition Agency ABN 25 617 475 104

Address: GPO Box 700, Canberra ACT 2601

Short name: The Agency

and

Name: Ernst and Young ABN 75 288 172 749

Address: 8 Exhibition Street, Melbourne VIC 3000

Short name: Contractor

Background

A The Agency and the Contractor are parties to a contract dated 23 December 2013 for the supply of internal audit services, being Order number CN0127 (the Contract).

B The parties have agreed to amend and restate the terms of the Contract in accordance with the terms and conditions of this Deed.

Agreed Terms

The Agency and the Contractor agree that:

(i) with effect from the date of this Deed, the Contract is varied in accordance with Schedule 1 to this Deed; and

(ii) except to the extent expressly set out in Schedule 1, the terms and conditions of the Contract are not limited or otherwise affected by this Deed.

EXECUTED as a deed

FOI 21/22-0868

National disabilityinsurance Agency

Signed for and on behalf of the National Disability Insurance Scheme Launch Transition Agency by its duly authorised delegate in the presence of

[redacted — s47F - personal privacy] Signature of witness

[redacted — s47F - personal privacy] Name or witness (print)

Date: 03/11/2014

[redacted — s22(1)(a)(ii) - irrelevant material] Signature of delegate

[redacted — s22(1)(a)(ii) - irrelevant material] Name of delegate (print)

Deputy CEO Position of delegate (print)

Executed by Ernst & Young (ABN: 75 288 172 749) in accordance with section 127 of the Corporations Act 2001 (Cth) by:

[redacted — s47F - personal privacy] Signature of witness

[redacted] Signature or Partner

[redacted — s47F - personal privacy] Name of Partner(print)

Name of witness (print) Date: 06/11/2014

The National Disability Insurance Agency Deed of Variation Page 12 of 55

Schedule 1— Variation Details

Amendments to the Agreed Terms of the Contract

Schedule 1 — Order, dated 23 December 2013, made between Ernst and Young and the National Disability Insurance Scheme Launch Transition Agency defined at item 4 on page 1 of Schedule 1 — Order:

Item	Description	Clause	Details
4	Contract Period	1.1 and 9.1	The contract will commence on 23 December 2013 and expire at midnight on 22 December 2014.

The contract will provide an option to extend for 2 years which may be exercised at the total discretion of the Agency.

The Agreed Terms of the Contract are amended as outlined below:

Item	Description	Clause	Details
4	Contract Period	1.1 and 9.1	The contract will commence on 23 December 2013 and expire at midnight on 22 December 2015.

The contract will provide an option to extend for 1 year which may be exercised at the total discretion of the Agency.

The National Disability Insurance Agency Deed of Variation

Page 13 of 55

DOCUMENT 4

National disabilityinsurance Agency

Deed of Variation

Between

Name: National Disability Insurance Scheme Launch Transition Agency ABN 25 617 475 104 Address: GPO Box 700, Canberra ACT 2601 Short name: The Agency

Name: Ernst and Young ABN 75 288 172 749 Address: 8 Exhibition Street Melbourne VIC 3000 Short name: Contractor

Background

A. The Commonwealth of Australia, as represented by the Department of Resources, Energy and Tourism, and the Contractor are parties to a Deed of Standing Offer for the Provision of Services, being Deed number RET11-1200012.

B. Pursuant to the Deed RET11-1200012, the National Disability Insurance Agency and the Contractor are parties to a contract dated 23 December 2013 for the supply of internal audit services, being contract number CN0127 (the Contract).

C. The parties have agreed to amend and restate the terms of the Contract in accordance with the terms and conditions of this Deed.

Agreed Terms

The National Disability Insurance Agency and the Contractor agree that:

(i) with effect from the date of this Deed, the Contract is varied in accordance with Schedule 1 to this Deed; and

(ii) except to the extent expressly set out in Schedule 1, the terms and conditions of the Contract are not limited or otherwise affected by this Deed.

EXECUTED as a deed

The National Disability Insurance Agency Deed of Variation Page 14 of 55

FOI 21/22-0863

National disabilityinsurance Agency

Signed for and on behalf of the National Disability Insurance Scheme Launch Transition Agency by its duly authorised delegate in the presence of

s22(1)(a)(ii) - irrelevant material Name of witness (print) Name of delegate (print)

alo SES Band 2 Date: 04.01.2016 Position of delegate (print)

Executed by Ernst & Young (ABN 75 288 172 749) in accordance with section 127 of the Corporations Act 2001(Cth) by:

signature of witness [redacted — s47F - personal privacy] Name of witness (print) Name of Partner (print)

Date: 22 December 2015

The National Disability insurance Agency Deed of Variation Page 15 of 55

Schedule 1— Variation

Amendments to the Agreed Terms of the Contract

The agreed terms of the Contract are amended as outlined below:

a) Item 4 of Schedule 1 - Order,

a. Delete the following:

Item	Description	Clause	Details
4.	Contract Period	1.1 and 9.1	The contract will commence on 23 December 2013 and expire at midnight on 22 December 2015.

The contract will provide an option to extend for 1 year which may be exercised at the total discretion of the Agency.

b. And replace with the following:

Item	Description	Clause	Details
4.	Contract Period	1.1 and 9.1	The contract will commence on 23 December 2013 and expire at midnight on 30 June 2017.

The contract will provide an option to extend for 1 year which may be exercised at the total discretion of the Agency.

b) Item 15 of Schedule 1 - Order,

a. delete the following:

b. And replace with the following:

National disabilityinsurance Agency

b. And replace with the following:

Item	Description	Clause	Details
17.	Conflict of interest	22.2 and 27	The Contractor acknowledges that if it is engaged by NDIA to provide services in relation to Local Area Coordination under RFT NDIA 020 (Provision of Local Area Coordination Services in selected areas of Victoria) as described in that RFT or any subsequent approach to market by NDIA for any associated, related or similar services in any location within Australia, this (the LAC Services) may constitute a conflict of interest for the purposes of clause 22.2 and clause 27.

The National Disability Insurance Agency Deed of Variation

Page 17 of 55

FOI 21/22-0868 DOCUMENT 5

MINUTES

National Disability Insurance Agency Audit and Risk Committee Meeting 1 2 December 2013 280 Elizabeth Street, Sydney

Attendance

Present

John Hill PSM, Chair
Martin Laverty, Member
Helen Williams, Independent Member
Marian Micalizzi, Independent Member

Officials in Attendance

David Bowen, Chief Executive Officer
Helen McKenna, acting Chief Financial Officer and General Manager, Corporate
Bill Gemmell, Acting National Manager, Business Assurance Branch (in the role of Chief Internal Auditor)
Judi Pearce, Audit and Risk Committee Secretariat
Alexandra Madsen, Board Secretariat
Ian Goodwin, Australian National Audit Office (ANAO)
Carla Jago, ANAO

Apologies

John Walsh AM, Member

Meeting Commencement and Conclusion Times

The Committee meeting was held from 2:20 pm — 5:45 pm on Monday 2 December 2013.

Mr Bowen joined the meeting at 2.45pm.

SESSION 1: OPENING

Item 1.1 — Welcome and Conflict of Interest Declarations

Welcome

The Chair welcomed Committee members to the meeting and thanked members for their attendance.
The Committee acknowledged the traditional owners of the land and paid respect to Elders, both past and present.
The Committee also acknowledged that the purpose of the National Disability Insurance Scheme (NDIS) is to achieve the full social and economic participation of people with disability and certainty for people with disability, and their carers, of reasonable and necessary care over the participant’s lifetime as set out in the objects of the National Disability Insurance Scheme Act 2013 (the NDIS Act).

Page 18 of 55

FOI 21-0863

The Committee further acknowledged the objectives of the Convention on the Rights of Persons with Disabilities.

The Committee further acknowledged the shared national governance of the NDIS, and the interests and stakes that all shareholder governments have in the NDIS.

Conflicts of Interest

The Committee noted that Ms Micalizzi was formerly a partner at PricewaterhouseCoopers (PWC). PWC presented to the Committee to be appointed as the NDIA’s Risk Management Service Provider (see Item 4.4 below).

The Committee also noted Mr Walsh’s email to Committee members and Mr Gemmell of 17 November 2013, in which he stated:

“As a recently retired partner of PwC I need to declare an interest in the discussions surrounding the appointments of external consultants to these roles. I have not had any involvement or contact with PwC regarding these roles, nor do I have any idea who at PwC is in the proposed engagement teams. However I do have an ongoing association with PwC in an area unrelated to these tenders.

I am happy to follow the guidance of the committee on what role, if any, I should take in these deliberations - whether it is total disengagement, discussion without voting, advice on particular areas where I may have special understanding, or just declaration of a conflict.”

Item 2 — Australian National Audit Office — Introduction

The Committee was introduced to Mr Goodwin and Ms Jago from the ANAO:

Mr Goodwin informed the Committee that he will be responsible for signing off on NDIA audits on behalf of the Auditor-General.
Ms Jago informed the Committee that she would have day-to-day responsibility for working with the NDIA on its audits.

The Committee was informed that the function of the ANAO was to provide external audit functions for public sector entities.

Mr. Goodwin informed the Committee that the ANAO would undertake performance audits, financial statement audits, and assurance reviews of the NDIA.

The Committee noted that reports prepared by the ANAO are required under the Auditor-General Act 1997 to be tabled in the Parliament.

The Committee noted that the ANAO will work with Committee members and executive officers in the NDIA to develop on Audit Plan for the February 2014 meeting of the Committee.

Mr. Goodwin offered to circulate an Audit Activity Report for Committee members to consider.

Action Items/Matters Arising

The ANAO to prepare an Audit Plan for consideration at the Committee meeting in February 2014.
The ANAO to circulate Audit Activity Report to Committee members.

Item 3 — Committee Charter and Forward Work Program

Committee Charter

The Committee agreed to the Committee Charter, subject to the following changes:

The preamble should be amended to include a proper warning that the Committee should not become involved in the management of the NDIA.
The preamble should also include a statement about the Board and Committee’s commitment to the NDIS, and its functions and responsibilities under the NDIS Act.
The ‘Risk Management’ responsibilities on page two should reflect the sign-off obligations of the Board under the National Disability Insurance Scheme—Risk Management Rules 2013 (Risk Rules), and be amended to better reflect the risk management strategy.
The ‘financial statement’ responsibilities on page three should be amended to add a requirement for the Committee to review any significant accounting policies, and future changes to such policies.
The ‘financial statement’ responsibilities on page three (dot point two) should also be amended to ensure that the Committee is providing advice to both the Chief Executive and the Board on the results of their review of the Agency’s financial statements.
The Charter should include an acknowledgement of the United Nations Convention on the Rights of Persons with Disabilities, and
The Secretariat will prepare a note for the ARC and Board clarifying the stakeholder groups mentioned in dot point 2 of the Legislative and policy compliance section of the Charter.

Forward Workplan

The Committee agreed that the forward workplan should be populated, in consultation with the internal auditor, and brought back to the Committee for consideration in February 2014.
The Committee agreed that once the workplan was agreed to, it should be provided to the Board.

Action Items/Matters Arising

The Committee Charter to be updated.
The Secretariat will prepare a note for the ARC and Board further clarifying the stakeholder groups mentioned in dot point 2 of the Legislative and policy compliance section of the Charter.
The Committee workplan should be populated in consultation with the internal auditor and considered at the February 2014 Committee meeting.

Item 4 — Presentations: Internal Audit and Risk Management Service Providers

Internal Audit

The Committee received presentations from Ernst & Young and Deloitte as part of their response to the request for quotation for an internal auditor.

The Committee recommended that Ernst & Young be appointed as the internal auditor for the NDIA, and in particular noted that they demonstrated a strong knowledge of the NDIS and the NDIA and had presented a well-developed internal audit methodology.

The Committee suggested that the CEO consider and direct the initial audit projects.

The Committee recommended that the internal auditor be appointed for a period of twelve months, with options to extend.

The Committee agreed that performance of the internal auditor should be considered in late 2014.

The Committee also recommended that Ernst & Young be contracted to review periodically the Risk Management Framework, as required by the NDIS Risk Management Rules.

Risk Management Services

The Committee received presentations from KPMG and PWC as part of their response to the request for quotation for risk management advisory services.

The Committee recommended that KPMG be appointed to provide risk management advisory services, in accordance with the Agency’s evaluation of the request for quotation process.

Action Items/Matters Arising

The Committee recommended the NDIA make arrangements to appoint Ernst & Young as the internal auditor, with their performance to be reviewed in October 2014.
The Committee recommended that the NDIA make arrangements to appoint KPMG to provide risk management advisory services.
CEO to consider initial audit projects.

Item 5 — Risk Management

The Committee noted the work to date on the risk management framework.

The Committee agreed that the Risk Management service provider should hold workshops with Committee members, the Board and management, to further develop the risk management framework.

Action Items/Matters Arising

KPMG to provide workshops with Committee members, the Board and NDIA management to further develop the risk management framework

Page 21 of 55

Item 6 — Internal Audit

The Committee agreed that the internal auditor should work with management and Committee members to develop an internal audit plan.
The Committee agreed that a well-developed plan should be considered at its February meeting, and provided to the Board once finalised.

Action Items/Matters Arising

Ernst & Young to develop an internal audit plan for consideration at the February Committee meeting.

Item 7 — Committee Operating Arrangements

The Committee agreed that:
- ‘out of session’ should only be used for agreement to Committee minutes and time critical matters
- the Board should be asked to consider the appointment of a Deputy Chair
- minutes of Committee meetings will be provided to the Board, following clearance by the Chair
- ‘other business’ should be raised by Committee members at the beginning of each meeting
- meeting procedures should provide for the Committee to request that officials not participate in aspects of meetings, and that if this did occur, a Committee member would be responsible for taking minutes
- audit reports should be distributed to Committee members as they come in, and not in bulk
- the CEO should be issued with a standing invitation to attend Audit and Risk Committee meetings, and that other executives should attend on a case by case basis as agreed with the Chair (preferably by dialing in)
- response times should be dealt with on a case by case basis.

Item 8 — Relationship with the Sustainability Committee

The Committee noted that greater clarification was required around the differing roles of the Committee and the Sustainability Committee.
The CEO noted that the main focus of the Committee was the NDIA’s operations, while the Sustainability Committee would focus on higher level ‘Scheme’ sustainability issues.
The Committee noted that Mr Walsh, as Chair of the Sustainability Committee, should be able to provide greater clarity at the February 2014 meeting.

Action Items/Matters Arising

Mr Walsh, as Chair of the Sustainability Committee, to provide clarity regarding the differing roles of that Committee and the Audit and Risk Committee at the February 2014 meeting.

Item 9 — Close

The Chair closed the meeting at 5.45 pm.

Draft Audit & Risk Committee Charter

The Board has established the Audit and Risk Committee in compliance with section 32 of the Commonwealth Authorities and Companies Act 1997 (CAC Act) and Regulation 6A of the CAC Regulations.

The Audit & Risk Committee, as a Committee of the Board, is committed to the National Disability Insurance Scheme (NDIS) and supports the Board in fulfilling its responsibilities under the NDIS Act.

The Audit & Risk Committee acknowledges the United Nations Convention on the Rights of Persons with Disabilities, which seeks to promote, protect and ensure the full and equal enjoyment of all human rights by persons with disabilities.

Responsibility for the day-to-day management of the National Disability Insurance Agency resides with the Chief Executive Officer (CEO), appointed under the NDIS Act, who reports to the Board. Audit & Risk Committee members are appointed by the Board and are not part of the Agency management structure.

This charter sets out the committee’s objectives, authority, responsibilities, composition and tenure, reporting and administrative arrangements.

Objective

The objective of the committee is to provide independent assurance and advice to the Board on the National Disability Insurance Agency’s risk, control and compliance framework, and its financial statement responsibilities.

Authority

The Board authorises the committee, within its responsibilities, to:

obtain any information it requires from any employee or external party (subject to any legal obligation to protect information);
discuss any matters with the external auditor, or other external parties (subject to confidentiality considerations);
request the attendance of a Director or any employee, including the Chief Executive, at committee meetings; and
obtain legal or other professional advice, as considered necessary to meet its responsibilities, at the National Disability Insurance Agency’s expense, within the Internal Audit budget limit.

Composition and tenure

The Audit and Risk Committee comprises five members, appointed by the Board.

The Board will appoint a non-executive member as the Chair of the committee; normally a member of the Board.

The committee is authorised to appoint a Deputy Chair who will act as chair in the absence of the Chair.

The Chair of the Board may attend the committee meetings, but will not be a member of the committee.

The Chief Executive, Chief Financial Officer, Chief Risk Officer, Chief Information Officer and Internal Auditor may attend meetings as observers, as determined by the Chair, but will not be members of the committee.

A representative of the Australian National Audit Office will be invited to attend all meetings of the committee, as an observer.

The members, taken collectively, will have a broad range of skills and experience relevant to the operations of the National Disability Insurance Agency. At least one member of the committee will have accounting or related financial management experience with an understanding of accounting and auditing standards in a public sector environment.

Members will be appointed for an initial period not exceeding three years. Members may be re-appointed after a formal review of their performance, for a further period not exceeding two years, unless otherwise agreed, following discussions with the Chair.

Responsibilities

Risk Management

review and recommend the approval of the Risk Management Framework and Risk Management Strategy (RMS) to the Agency Board;
review and recommend the approval of the risk profile and Board Risk Appetite statement, outlined in the RMS, to the Board;
review the results of all reviews of the RMS;
review and approve the annual Risk Management Program;
review whether management has in place a current and comprehensive enterprise risk management framework and associated procedures for effective identification and management of the National Disability Insurance Agency’s business and financial risks, including fraud;
determine whether a sound and effective approach has been followed in managing the National Disability Insurance Agency’s major risks including those associated with individual projects, program implementation, and activities;
assess the impact of the National Disability Insurance Agency’s enterprise risk management framework on its control environment and insurance arrangements;
determine whether a sound and effective approach has been followed in establishing the National Disability Insurance Agency’s business continuity planning arrangements, including whether business continuity and disaster recovery plans have been periodically updated and tested;
review the process of developing and implementing the National Disability Insurance Agency’s fraud control arrangements and satisfy itself the National Disability Insurance Agency has appropriate processes and systems in place to detect, capture and effectively respond to fraud-related information, including whistle-blower and other tip-off arrangements;
review reports on fraud from the National Disability Insurance Agency’s Fraud Manager that outline any identified allegations of fraud, the status of any ongoing investigations and any changes to identified fraud risk in the National Disability Insurance Agency; and

Page 24 of 55

• ensure compliance with the Risk Management Rules 2013 and provide advice to the Board regarding the sign-off of the Risk Management Declaration for annual provision to the Ministerial Council .

Internal Control

• review whether management’s approach to maintaining an effective internal control framework, including over external parties such as contractors and advisers, is sound and effective; • review whether management has in place relevant policies and procedures, including Chief Executive’s Instructions or their equivalent, and that these are periodically reviewed and updated; • determine whether the appropriate processes are in place to assess, at least once a year, whether key policies and procedures are complied with; • review whether appropriate policies and supporting procedures are in place for the management and exercise of delegations; • consider how management identifies any required changes to the design or implementation of key internal controls; and • assess whether management has taken steps to embed a culture which is committed to ethical and lawful behaviour.

Financial Statements

• satisfy itself that the financial statements are supported by appropriate management sign-off on the statements and on the adequacy of key internal controls; • review the financial statements and provide advice to the Chief Executive and the Board; (including whether appropriate action has been taken in response to audit recommendations and adjustments to the draft financial statements) and recommend their signing by the Board; • review the processes in place designed to ensure that financial information included in the National Disability Insurance Agency’s annual report is consistent with the signed financial statements; • review significant accounting and reporting issues, including complex or unusual transactions, highly judgemental areas and recent professional and regulatory pronouncements and understand their impact on the financial statements; • review the annual financial statements and consider whether they are complete and consistent with information known to Committee members; and • review annually at the time of the audit adjusted and unadjusted times noted by the external auditor and management and as to why any items remain unadjusted.

Legislative and policy compliance

• review the effectiveness of the system for monitoring the National Disability Insurance Agency’s compliance with those laws, regulations and associated government policies that the National Disability Insurance Agency must comply with, including but not limited to: privacy; data management; quality assurance arrangements; and Freedom of Information requirements; • review the operations of the organisation for efficiency and effectiveness, including agency operations in relation to participants, providers, expert panels and other stakeholders;

                      Page 25 of 55

Internal Audit and External Audit

review, where relevant, the National Disability Insurance Agency’s compliance with International Conventions, particularly the OECD Convention on Combating Bribery of Foreign Public Officials in International Business Transactions;
determine whether management has appropriately considered legal and compliance risks as part of the National Disability Insurance Agency’s enterprise risk management plan;
provide advice to the Board regarding the issue of the National Disability Insurance Agency annual Compliance Report; and
review and recommend the NDIA compliance framework documented in ‘Regulatory Compliance Management Program’.

Internal Audit

act as a forum for communication between the Board, senior management and internal and external audit;
review the proposed internal audit coverage, ensure the coverage is aligned with the National Disability Insurance Agency’s key risks, and recommend approval of the Annual Work Plan by the Chief Executive;
advise the Chief Executive on the adequacy of internal audit resources to carry out its responsibilities, including completion of the approved internal audit work plan;
coordinate, as far as practicable, audit programs conducted by internal audit and other review functions;
review all audit reports and provide advice to the Board on significant issues identified in audit reports and action to be taken on issues raised, including identification and dissemination of good practice;
monitor management’s implementation of internal audit recommendations;
review the internal audit charter to ensure appropriate organisational structures, authority, access and reporting arrangements are in place; periodically review the performance of internal audit.

External Audit

act as a conduit for communication between the Board, senior management and external audit;
provide input and feedback on financial statement and performance audit coverage proposed by external audit, and provide feedback on the audit services provided;
review all external audit plans and reports in respect of planned or completed audits and monitor management’s response and implementation of audit recommendations; and
provide advice to the Board on action to be taken on significant issues raised in relevant external audit reports or better practice guides; and
review the performance of the external auditor.

Governance Arrangements

periodically review the National Disability Insurance Agency’s governance arrangements or elements of the arrangements as determined by the Board and suggest improvements, where appropriate, to the Board.

Other responsibilities

Parliamentary committee reports and external reviews - satisfy itself that the National Disability Insurance Agency has appropriate mechanisms in place to review and implement, where appropriate, relevant parliamentary committee reports and external reviews of the National Disability Insurance Agency, and recommendations arising from these reports and reviews.
Performance reporting framework - satisfy itself that the National Disability Insurance Agency has an appropriate performance reporting framework that meets the full range of government requirements and is linked to the National Disability Insurance Agency’s objectives and outcomes.

Sub-committees

The committee may establish one or more sub-committee/s to assist the full committee in meeting its responsibilities.

The responsibilities, membership and reporting arrangements for each sub- committee shall be documented and approved by the full committee. The committee stipulates that:

a member of the full committee is appointed as Chair of the sub—committee; the membership of sub—committees may extend beyond members of the full committee if additional expertise on particular matters is required;
minutes of all meetings of sub-committees are to be taken, distributed promptly to all members of the full committee, and tabled for discussion at the next full committee meeting; and
important issues that may require consideration by the full committee are brought to the attention of the Chair immediately following a sub-committee meeting, so that the Chair is in a position to decide what action to take.

Responsibilities of committee members

Members of the committee are expected to understand and observe the legal requirements of the CAC Act and regulations. Members are also expected to:

act in the interests of the National Disability Insurance Agency;
apply good analytical skills, objectivity and good judgment; and
express opinions constructively and openly, raise issues that relate to the committee’s responsibilities and pursue independent lines of enquiry.

Reporting

The committee will as often as necessary, and at least once a year, report to the Board on its operation and activities during the year. The report should include:

a summary of the work the committee performed to discharge its responsibilities during the preceding year;
a summary of the National Disability Insurance Agency’s progress in addressing the findings and recommendations made in internal and external audit and parliamentary committee reports;
an overall assessment of the National Disability Insurance Agency’s risk, control and compliance framework, including details of any significant emerging risks or legislative changes impacting the National Disability Insurance Agency; and
details of meetings, including the number of meetings held during the relevant period, and the number of meetings each member attended.

The committee may, at any time, report to the Board any other matter it deems of sufficient importance. In addition, at any time an individual committee member may request a meeting with the Chair of the Board.

Administrative arrangements

Meetings

The committee will meet at least four times per year. A special meeting may be held to review the agency’s annual financial statements.

The Chair is required to call a meeting if asked to do so by the Chair of the Board, and decide if a meeting is required if requested by another member.

Planning

The committee will develop a forward meeting schedule that includes the dates, location, and proposed agenda items for each meeting for the forthcoming year, that cover all the responsibilities outlined in this charter.

Attendance at meetings and quorums

The quorum for meetings of the committee is three persons..

Secretariat

The Board, in consultation with the committee, will appoint a person to provide secretariat support to the committee. The secretariat will ensure: the agenda for each meeting is approved by the chair; the agenda and supporting papers are circulated, at least one week before the meeting; and the minutes of the meetings are prepared and maintained. Minutes must be reviewed by the Chair and circulated within two weeks of the meeting to each member and committee observers, as appropriate.

                      Page 28 of 55

Declarations of interest

Once each year, members of the Audit and Risk Committee will provide written declarations to the Chair for provision to the Board declaring any ‘material persona! interest’ in matters that relate to the affairs of the Agency. External members should consider past employment, consultancy arrangements and related party issues in making these declarations, and the Chair should be satisfied that there are sufficient processes in place to manage any real or perceived conflict.

At the beginning of each Audit and Risk Committee meeting, members are required to declare any potential or actual conflicts of interest that may apply to specific matters on the meeting agenda. Where required by the Chair, the member will be excused from the meeting or from the committee’s consideration of the relevant agenda item(s). Details of potential or actual conflicts of interest declared by members and action taken will be appropriately minuted.

Induction

New members will receive relevant information and briefings on their appointment to assist them to meet their committee responsibilities.

Assessment arrangements

The Chair of the Audit and Risk Committee, in consultation with the Chair of the Board, will initiate a review of the performance of the committee at least once every two years. The review will be conducted on a self-assessment basis (unless otherwise determined by the Board) with appropriate input sought from Board members, committee members, senior management, the internal and external auditors, Chief Financial Officer, and any other relevant stakeholders, as determined by the Chair of the Board.

The Chair will provide advice to the Board on a member’s performance where an extension of the member’s tenure is being considered.

Review of charter

At least once a year the committee will review this charter. This review will include consultation with the Board.

Any substantive changes to the charter will be recommended by the committee and formally approved by the Board.

Approved

[Signature]

Chair of the Board Date:

Page 29 of 55

National Disability Insurance Agency

Audit & Risk Committee

2pm 12 February, 2014

The Maple Room, Swissotel 68 Market Street, Sydney.

2.00 — 2.05 Welcome, apologies, declarations of conflicts of interest
2.05 — 2.15 Minutes of the Previous Meeting and Status of Action Items
2.15 — 2.30 Amended Audit & Risk Committee Charter
2.30 — 2.40 Amended Audit & Risk Committee Annual Forward Work Program
2.40 — 3.00 Chief Risk Officer’s Report
3.00 — 3.20 Risk Management Strategy and Framework
3.20 — 3.35 Risk Management Declaration
3.35 — 3.50 Internal Audit Report — draft Audit Work Program
3.50 — 4.10 ANAO Report — financial statements audit engagement letter
4.10 — 4.20 CAC Act Compliance Survey Report
4.20 -4.35 Fraud Control Framework, Strategy, Policy & Plan
4.35 -4.50 Public Governance, Performance and Accountability Act 2013 (PGPA Act) replacing the Commonwealth Authorities and Companies Act 1997
4.50 — 5.00 Next Meeting - 22 April, 2014.

5.00. Close.

Audit and Risk Committee Meeting 1/2014

NDIA Board - Audit and Risk Committee Minutes

12 February 2014, Swissotel Sydney

Attendance

Present:
- John Hill PSM, Chair
- John Walsh AM, Member
- Martin Laverty, Member
- Helen Williams AO, Member
- Marian Micalizzi, Member
Officials in Attendance:
- David Bowen, Chief Executive Officer
- Jo-Ann Rose, Chief Finance Officer
- Helen McKenna, Chief Risk Officer
- Louise Glanville, incoming Corporate Secretary
- Alexandra Madsen, Board Secretariat
Others in attendance:
- Ian Goodwin, Australian National Audit Office (ANAO)
- Carla Jago, ANAO

Meeting Commencement and Conclusion Times

The Committee meeting was held from 2:00 pm – 5.30 pm on Wednesday 12 February 2014.

Item 1 Welcome; apologies

The Chair welcomed Committee members to the meeting and thanked members for their attendance.
The Committee acknowledged the traditional owners of the land and paid respect to Elders, both past and present.
The Committee also acknowledged that the purpose of the National Disability Insurance Scheme (NDIS) is to achieve the full social and economic participation of people with disability and certainty for people with disability, and their carers, of reasonable and necessary care over the participant’s lifetime as set out in the objects of the National Disability Insurance Scheme Act 2013 (the NDIS Act).
The Committee further acknowledged the objectives of the Convention on the Rights of Persons with Disabilities.

Page 31 of 55

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES

The Committee further acknowledged the shared national governance of the NDIS, and the interests and stakes that all shareholder governments have in the NDIS.

Item 2 Minutes of the previous meeting and status of action items

The Committee endorsed the minutes of the NDIA Audit & Risk Committee meeting of 2 December 2013, which will be transmitted to Board at its March meeting.
The Committee noted the status of action items from that meeting, and agreed that the action item of clarifying stakeholder groups come forward at the April meeting.
The Committee agreed it should pursue the appointment of a deputy with the Board.
The Committee noted the information provided by Mr Walsh regarding the differing roles of the Sustainability Committee and the Audit & Risk Committee.

Action Items/Matters Arising

A note from the secretariat clarifying stakeholder groups to be brought forward at April meeting.
Seek approval from the Chairman to appoint a deputy of the Audit and Risk Committee.

Item 3 Audit and Risk Committee Draft Charter

The Committee agreed that the Chair will finalise the Draft Audit & Risk Committee Charter, and provide it to the Chairman of the Board for endorsement.
Chair of Committee to finalise Charter and provide to Chairman of the Board.

Item 4 Audit and Risk Committee Forward Work Plan

The Committee agreed the draft ARC Forward Work Plan, subject to minor edits.

Item 5 Chief Risk Officer’s Report

The Committee noted the oral report provided by the Chief Risk Officer, including information on:
- development of a Risk Management Implementation Plan, including a Risk Management Manual and templates (using material from the Victorian Managed Insurance Authority as best practice), and training material for staff as the start of developing a risk management culture in the Agency

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES

Page 32 of 55

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES

othe need to ensure alignment of strategic risks with the strategic plan, and then to ensure alignment of risks down through the Corporate Plan and Divisional and Branch Business Plans, and
o how the CRO function will support the completion of risk management material for the Chair of the Board to send to the Standing Council on Disability Reform within the timeframe required by the Council’s Secretariat (Friday 21 February 2014).

Item 6 Risk Management Strategy and Framework

e The Committee noted that comments were to be provided to the Chair on the draft strategy and framework by close of business on 13 February 2014.
e The Committee noted that the strategy and framework would need to be provided with a covering letter from the Chairman of the Board by 21 February 2014.
e Prepare covering letter to CRCD on risk management strategy and framework for Chairman of the Board by 20 February 2014.

Item 7 Risk Management Declaration

e The Committee discussed the actions planned to support periodic risk management reviews and annual compliance declarations.
e The Committee agreed to the process, roles and responsibilities outlines in the agenda paper to support the Committee and Board fulfill their responsibilities around annual declarations.
e Confirm how Scheme Actuary will be involved in risk management process.

Item 8 Internal Audit Report draft work plan

e The Committee noted that the draft Internal Audit Plan was endorsed at a joint sitting of the Board and Committee on 12 February 2014, subject to:
- o including data integrity
- o including procurement and delegations
- o delaying an audit of planning and assessment process until later in 2014 when the new processes have settled, and
- o removing the audit of shared service arrangements as a priority for 2014.
e The Committee agreed that the internal auditor should be tasked with developing a three year audit program, including provision for audits of how the Agency has responded to the recommendations of completed audits.

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES

Page 33 of 55

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES

An extended internal audit program, along with the first formal report from the internal auditors, to be brought to the April meeting of the Committee.
An annual compliance report to be developed for review by the Committee, and added as a standing under the line agenda item.

Item 9 ANAO Report — Audit Engagement Letter

The Committee noted information provided by the ANAO on their recent audit reports, and a number of relevant best practice guides.

The Committee noted the information provided by the ANAO on the development of a draft Audit Strategy Document, which will be provided for endorsement at the April Committee meeting.

The Committee:

noted the draft engagement letter from the ANAO, and
agreed that a recommendation should be made to the Chairman of the Board to sign the terms of engagement.
Recommend to Chairman of the Board that ANAO engagement letter be signed. CFO to provide the Committee at the April meeting:
financial statements as at 31 March in same format as at end of year, including an outline of the analysis to be provided to support consideration
a draft version of the management representation letter to directors
a draft version of the letter of representation by directors
a summary of the Finance Minister’s orders, and
a timetable of the financial statements preparation process.

The ANAO to lead a discussion of fraud at the April Committee meeting. ANAO to provide draft Audit Strategy Document for endorsement at April Committee meeting.

Item 10 CAC Act Compliance Survey Report

The Committee endorsed the processes to be undertaken to enable Board members to gain assurance for the annual compliance reporting, including that Management will provide a letter of assurance to Board members.

The Committee noted the results of the Certificate of Compliance process and reporting for the period 1 July to 31 December 2013.

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES

Page 34 of 55

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES

The Committee agreed that the NDIA develop an annual compliance plan, with regular reports to be provided to the Committee.
Management to provide Board with a draft letter of assurance at 31 December and 30 June of each financial year.

Item 11: NDIA Fraud Control Framework

The Committee endorsed the NDIA Fraud Control Plan, subject to some further elaboration in paragraph 2.2 of the likely impact of fraud by an ‘individual’.
The Committee endorsed the NDIA Fraud Policy Statement, subject to references being included regarding the role of the Board.
Provide Committee with information on:
- Arrangements being negotiated with DSS and Comcare for the investigation of fraud, and
- The various ways that fraud can be reported in the NDIA and within the Commonwealth, including external arrangements for whistleblowing.

Item 12: Public Governance, Performance and Accountability Act 2013

The Committee noted that the Public Governance, Performance and Accountability Act 2013 will replace the Commonwealth Authorities and Companies Act 1997 (PGPA Act) from 1 July 2014, imposing new obligations on the Board of the NDIA and officials of the NDIA and establishing requirements for the composition of the Audit and Risk Committee.
The Committee disagreed with the proposed requirement for a majority of independent members on Audit and Risk Committees.
The Committee noted that the Legal Services Branch will provide a further briefing on the impact of the Public Governance, Performance and Accountability Act 2013 once the Rules under that Act are finalised.
The NDIA to provide briefing on the PGPA Act once its rules are finalised.
NDIA to prepare a letter for the Chair of the Board to sign disagreeing with the PGPA Act draft rules requiring a majority of independent members on Audit and Risk Committees.

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES

Page 35 of 55

Meeting Close

The Committee meeting closed at 5:30 pm on Wednesday 12 February 2014.

Signed:

Mr John Hill PSM Audit and Risk Committee Chair

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES

Page 36 of 55

NATIONAL DISABILITY INSURANCE AGENCY BOARD

AUDIT AND RISK COMMITTEE - MEETING 2/2014 of 22 APRIL 2014

Date: Tuesday 22 April 2014 Location: Sydney — Boardroom, Level 9, 300 Elizabeth St.

SESSION 1: INTRODUCTION (9:00AM — 9:15AM)

ITEM 1.1 Chair’s Welcome
ITEM 1.2 Declarations of Interests
ITEM 1.3 Minutes of Previous Meeting and Matters Arising

SESSION 2: RISK MANAGEMENT (9:15AM — 11:00AM)

Incl. morning tea: 10:30am

ITEM 2.1 The Agency and risk management (oral update)
ITEM 2.2 The role of the Scheme Actuary (oral update)

SESSION 3: AUDIT AND FRAUD (11:00AM — 12:15PM)

ITEM 3.1 Internal Audit Report — EY
ITEM 3.2 Technical Accounting Advice
ITEM 3.3 ANAO Update
ITEM 3.4 Agency Fraud Prevention Update

SESSION 4: CFO REPORT (12:15PM — 12:50PM)

ITEM 4.1 CFO Report
ITEM 4.2 Operational Financial Policies

SESSION 5: MEETING CLOSE (1:00PM)

ITEM 5.1 Feedback from Committee Members

MEETING CLOSE

Sensitive — not for further distribution without the agreement of the National Disability Insurance Agency Corporate Secretary.

Page 37 of 55

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE PAPER

UNDER THE LINE ITEMS 2/2014

ITEM 1 Updated Forward Work Plan
ITEM 2 Committee Charter (as noted by Board)
ITEM 3 Sustainability Committee Minutes and Matters Arising
ITEM 4 Note on Stakeholders from ARC Charter

Sensitive — not for further distribution without the agreement of the National Disability Insurance Agency Corporate Secretary.

Page 38 of 55

MINUTES

NDIA Board Audit and Risk Committee Meeting 2/2014 22 April 2014 NDIA Office, 300 Elizabeth St, Sydney

Attendance

John Hill PSM, Chair
John Walsh AM, Member
Martin Laverty, Member
Helen Williams AO, Member
Marian Micalizzi, Member

Officials in Attendance

David Bowen, Chief Executive Officer
Stephen Payne, Chief Financial Officer
Sarah Johnson, Scheme Actuary
Louise Glanville, Corporate Secretary
Matthew Short, Board Secretariat
Peter Newling, Board Secretariat

Others in attendance

Ian Goodwin, Australian National Audit Office (ANAO)
Carla Jago, ANAO
Stuart Painter, EY - In attendance from Item 3.1 to meeting close
Emma Wiggins, EY - In attendance from Item 3.1 to meeting close

Meeting Commencement and Conclusion Times

The Committee meeting was held from 9:00am — 1:20 pm on Tuesday 22 April 2014.

SESSION 1: INTRODUCTION

Item 1.1 Chair’s Welcome

The Chair welcomed Committee members to the meeting and thanked members for their attendance.
The Committee acknowledged the traditional owners of the land and paid respect to Elders, both past and present.
The Committee also acknowledged that the purpose of the National Disability Insurance Scheme (NDIS) is to achieve the full social and economic participation of people with disability and certainty for people with disability, and their carers, of reasonable and

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES

Page 39 of 55

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES

necessary care over the participant’s lifetime as set out in the objects of the National Disability Insurance Scheme Act 2013 (the NDIS Act).

The Committee further acknowledged the objectives of the Convention on the Rights of Persons with Disabilities.
The Committee further acknowledged the shared national governance of the NDIS, and the interests and stakes that all shareholder governments have in the NDIS.

Item 1.2 Declarations of Interests

The Committee noted that the Corporate Secretary circulated a declaration form on 10 April 2014, prior to Committee papers being circulated, for Committee members to provide their declaration of interests.
The Committee noted the register of interests is a standing item and that there were no new interests declared by the Committee members at the meeting that had not been previously circulated.

1.3 Minutes of the previous meeting and status of action items

The Committee endorsed the 12 February meeting minutes of the Audit and Risk Committee that will be transmitted to Board at its May meeting, with the following amendments:
- Item 7: remove typos of ‘fulfil’ and ‘outlined’, and
- Item 10: the action item should reference the development of the annual compliance report to include updates on the CAC Act compliance surveys, and the letter of assurance from Management should not be in draft form.
The Committee noted the status of action items from that meeting, and noted that:
- the CFO will provide a shell of the financial reporting accounts at the next meeting and prior to the tabling of draft annual accounts
- the Chief Risk Officer and the Secretariat will table the compliance report at the next meeting, and
- the letter that went to CDRC only attached the Risk Management Strategy and not the Risk Management Framework as had been previously advised.
The Minutes are to be amended as described and transmitted to the Board at the May 2014 Board meeting.
The Chief Risk Officer and the Secretariat will produce the compliance report for the next ARC meeting

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES Page 40 of 55

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES

e The CFO will produce shell accounts for the July ARC meeting.

SESSION 2: RISK MANAGEMENT

Item 2.1 Agency Risk Management update

The Committee discussed the Agency’s risk management structure and the need for a more defined and developed approach to risk management, closely linked to the NDIA Strategic Plan.

The Committee recommended that the Agency’s ‘Risk, Fraud and Compliance Committee’ should be made up of people in decision-making positions, preferably GMs, and the CRO should work to that Committee.

The Committee agreed, in-principle, to the principles and the strategic risks identified in the Chair’s paper and agreed that these be recommended to the Board with suggested additions to be included at the discretion of the Chair, such as mainstream supports, family and community participation reduction, and Agency capability.

The Committee recommended that the Board endorse the paper ‘Risk Management in the NDIA’ as the basis on which risk Management should be implemented in the NDIA.

The Committee recommended that the Board instruct Management to:

convene the ‘Risk, Fraud and Compliance Committee’
appoint a CRO, and
resource the risk management function as soon as possible.

The Committee recommended that the Board instruct Management to prepare, as soon as possible, a program for the implementation of risk management in the NDIA, including proposals for addressing the fundamental weaknesses identified in the internal audit report on financial management processes; and if external assistance is to be engaged, management should consult with the Chair of the ARC prior to engagement.

The Committee recommended that the Board instruct Management to consult with the Scheme Actuary, and bring to the May 2014 Board meeting, a proposal setting out in detail the manner in which the Scheme Actuary is to be involved in the development and implementation of risk management in the NDIA.

In light of the ANAO expressed intention to focus on fraud control in his first audit of the NDIA, the Committee recommended that Management implement the Fraud Control Program previously agreed by the Committee (refer item 11 February 2014 ARC meeting) that includes regular reporting to the ARC of incidents of fraud and Management responses to those incidents.

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES

Page 41 of 55

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES

The Committee also recommended the Rules and Operational Guidelines regarding self-management and ‘choice and control’ that are provided to Planners, be provided to the Board and external ARC members prior to the May Board meeting, in order to assist in settling risk appetite for that area.
The Committee also discussed the potential to undertake an operational risk assessment regarding the NDIA in the context of the APRA CPS220 standard.
The Board at its May 2014 meeting to receive a briefing on the Rules and Operational Guidelines around self-management and choice and control, including an assessment of risk relating to these areas.
- External ARC members are also to get a copy of this paper.
The principles and the strategic risks identified in the Chair’s paper, as agreed in principle, to be recommended to the Board, with any additions to be finalised by the Chair.

Item 2.2 The role of Scheme Actuary

This item was not discussed during the meeting and was recommended for an out of session note.

The Scheme Actuary to provide a note out of session on how the role of the Scheme Actuary relates to the functions of the ARC.

SESSION 3: AUDIT AND FRAUD

Item 3.1 Internal Audit Report — EY

The Committee noted the update provided from the internal auditors from EY (Mr Stuart Painter and Ms Emma Wiggins) regarding the Risk Management Declaration Audit Report including:
- the risk management declaration that the Board is required to sign has six components, with EY rating 2 as red flag, 3 as amber, and 1 green
- it should be possible to achieve ‘established’ standards by 30 June 2014 for all measurables, except tools and technology
- the system does not currently meet ISO 31000 standards, and
- the role of the Scheme Actuary in risk management needs to be clearly defined and established.

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES Page 42 of 55

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES

The Committee noted the Management action plan developed to address the findings of the internal audit review on Risk Management Declaration.
The Committee noted the proposed Internal Audit Program for 2014-16 and requested that:
- ‘Board and Management Reporting’ audit be delayed until the Board has finalised its own review after its first year of operations
- ‘Data Integrity’ audit listed as a potential audit be moved into the Audit Program as soon as possible (possibly to replace the ‘actuarial assumptions’ audit)
- ‘Fraud Management’ audit listed for 2016 be advanced, and
- ‘Sector Development Grants’ Audit as listed for Q2 will also be a priority for the ANAO and should be considered for advancement.
The Committee noted the progress with the audit on ‘Financial Management Processes’ and requested it be provided to the Committee out of session once finalised with Management, including the management action plan and timeframes.
Audit plan to be amended as indicated.
The Secretariat will clarify, through the Chairman of the Board, the Board review to ensure that it and the internal audit work do not conflict, and that a report be provided to the July 2014 ARC meeting.
Financial Management Process audit will be provided to the ARC out of session, inclusive of management responses and timeframes for resolution.

Item 3.2 Technical Accounting Advice

The Committee noted the technical accounting advice provided by EY in response to key items of concern raised by the ANAO.
The Committee agreed that cash contributions should be treated as revenue only after they have been received by the NDIA.
The Committee noted that the treatment of in-kind contributions is an on-going accounting issue for the NDIA, and agreed that the Agency should do further work to determine whether the full (estimated) in-kind entitlement should be considered as revenue and an asset, and that this advice should be prepared for the July 2014 ARC meeting.
The Committee also noted the ANAO’s advice that measurement/system difficulties are not an adequate reason to treat in-kind supports in a manner different from that required by the relevant accounting standard.

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES Page 43 of 55

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES

The Committee noted the technical advice regarding the treatment of the obligation to the participant, and agreed that the Agency must do further work to establish the best method for the accounting treatment; noting that there was no desire by the Committee to require full revalidation of entitlement by participants annually.

The Committee agreed that:

Management is to seek Board input to establish its preferred position on whether the obligation to the participant is for the duration of the plan (i.e. 1 year) or for the participant’s lifetime.
Management is to discuss the matter with DSS, including whether the Minister is required to be consulted,
Further advice on this issue would come to the July 2014 ARC.

The CFO/Management to do further work to establish the preferred treatment of in-kind for accounting purposes for the July 2014 ARC meeting.

The CFO/Management should seek Board input on whether the obligation to the participant is for the duration of the plan (i.e. 1 year) or for the participant’s lifetime.

CFO/Management should approach DSS for advice on the treatment of the obligation, including whether the Minister is required to be consulted.

CFO/Management to report back to the July 2014 ARC meeting regarding the advice on the treatment of the obligation to the participant.

Item 3.3 ANAO Update

The Committee noted the ANAO Audit Activity Report.

The Committee discussed views on fraud risks and how they are managed in the entity.

The Committee noted the ANAO draft Audit Strategy for the 2013-14 financial statements audit.

The Committee agreed that fraud, and the implementation of the Fraud Control Framework should be prioritised higher in the Internal Audit process (Item 3.1 refers).

The Internal Audit program to be amended to prioritise the Fraud Control Framework

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES Page 44 of 55

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES

Item 3.4 Agency Fraud Prevention Update

This item was not formally discussed, but was accepted by exception.

The Committee noted the Agency Fraud Control Framework has been finalised and published on the Agency intranet for all staff.

The Committee noted the progress of negotiations on the arrangements for investigation of fraud matters by DSS and Comcare.

The Committee noted the ways that fraud can be reported in the NDIA and within the Commonwealth.

The Committee noted arrangements for reporting of fraud by external parties, including establishment and staffing of the dedicated telephone number and email reporting facility.

SESSION 4: CFO REPORT

Item 4.1 Chief Finance Officer’s Report

The Committee noted the summary of the Financial Performance Report, inclusive of year to date results to 31 March 2014, and full year forecast 2013-14 with commentary.

The Committee noted ANAO matters inclusive of key dates and requirements of both parties to the annual accounts statutory audit process.

The Committee noted additional information relating to:

technical accounting treatment of in-kind and cash contributions from EY and Scheme accruals,
an overview of the External Budget Process.

The Committee agreed that a balance sheet will be a standing item under the CFO report, and will be provided to the July 2014 ARC meeting.

The Committee also agreed that there should be some disaggregation of financial figures regarding property/operating expenses.

The CFO to provide a Balance Sheet within the CFO report, and this to be provided to the July 2014 ARC meeting.
The CFO to provide disaggregated figures to the July 2014 ARC meeting regarding property/operating expenses.

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES

Page 45 of 55

Item 4.2 NDIA Operational Financial Policies

The Committee endorsed the Credit Card Policy, subject to clarification of the contradiction between the credit card policy and the travel policy regarding use of credit cards for travel meals.
The Committee approved for the Board’s signature the resolution regarding use of Agency Credit Cards, subject to any amendments required once the aforementioned discrepancy has been settled.
The Committee endorsed the Travel Policy.
The Committee endorsed the Vehicle Policy, subject to the CFO clarifying whether vehicles included in the policy can be used to pick children up from school, and whether there needs to be acknowledgement that cars should be appropriate for people with disability.
The Committee endorsed the Procurement Policy [3 Tiers].
The Committee endorsed the Operational Financial Delegations, and recommended they be submitted to the Board for adoption, highlighting the ‘unlimited’ delegations listed in the schedule.
The Committee endorsed the Operational HR Delegations.

Action Items/Matters Arising

The CFO to clarify the discrepancy between the credit card and the travel policies.
The CFO to clarify whether vehicles included in the policy can be used to pick children up from school, and whether there needs to be acknowledgement that cars should be appropriate for people with disability.
Subject to the above, the credit card policy to be submitted to the Board for approval and signature at the May 2014 Board meeting.
The other policies should be provided to the Board for endorsement at the May 2014 Board meeting, especially noting the various ‘unlimited’ delegations in the financial delegations policy.

SESSION 5: Meeting Close

The Committee meeting closed at 1:20 pm on Tuesday 22 April 2014.

Signed:

Mr John Hill PSM Audit and Risk Committee Chair

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES

Page 47 of 55

MINUTES

NDIA Board Audit and Risk Committee Meeting 2/2014 22 April 2014 NDIA Offices, 300 Elizabeth St, Sydney

Under the Lines Items

Item 1 Updated Forward Work Plan

The Committee noted the revised Audit and Risk Committee Forward Work Plan.
The Committee noted that this will be a standing ‘Under the Line’ item on the Committee agenda.

Item 2 Updated Forward Work Plan

The Committee noted the final ARC Charter that has been provided to, and approved by, the Chairman and the Board.

Item 3 Sustainability Committee Minutes and Matters Arising

The Committee noted the Minutes from the first Sustainability Committee meeting that was held in Sydney on 11 February 2014.
The Committee noted the Sustainability Committee’s List of Matters Arising.

Item 4 Note on stakeholders

The Committee noted the list of stakeholders provided to clarify the reference to stakeholders in the ARC Charter.

Signed:

Mr John Hill PSM Audit and Risk Committee Chair

SENSITIVE: OFFICIAL AUDIT AND RISK COMMITTEE MINUTES

Page 48 of 55

FOI 21/22-0868 DOCUMENT 8

Audit, Risk & Finance Committee Charter

The Board has established an Audit, Risk and Finance Committee in compliance with section 45 of the Public Governance, Performance and Accountability Act 2013 (PGPA Act) and rule 17 of the Public Governance, Performance and Accountability Rule 2014 (PGPA Rule). Under rule 17 of the PGPA Rule, the Board must, by written charter, determine the functions of the committee.

1. Purpose

The Committee is a sub-committee of the Board of the National Disability Insurance Agency (Agency), and is established to assist the Board discharge its responsibilities under the National Disability Insurance Scheme Act 2013 and the PGPA Act including by reviewing the appropriateness of the Board’s financial reporting, performance reporting, risk oversight and management and internal controls, for the Agency.

2. Authority

The Board authorises the Committee, within its responsibilities, to:

a) Obtain any information it requires from any official or external contractor to the Agency (subject to any legal obligation to protect information);

b) Discuss any matters with the external auditor (ANAO), or other external parties (subject to confidentiality considerations);

c) Request the attendance of any official, including members of the Board, at Committee meetings; and d) Obtain legal or other professional advice at Agency expense, as considered necessary to meet its responsibilities.

3. Membership

a) The Audit, Risk & Finance Committee comprises 5 Members, appointed on resolution of the Board.

b) The Board will appoint a Non-Executive Director as the Chair of the Committee and a Non-Executive Director as the Deputy Chair. The Chair and Deputy Chair must be Directors of the Board.

c) Where the Chair of the Committee is unable to attend a meeting, the Deputy Chair will preside over that meeting.

d) The Chair of the Board is entitled to attend Committee meetings, but will not be a Member of the Committee.

e) Board Directors, Chief Financial Officer, Chief Risk Officer, Scheme Actuary, Chief Information Officer, Internal Auditor and other management representatives or external advisors may attend meetings as advisers or observers, on the invitation of the Chair, but will not be Members of the Committee.

f) A representative of the ANAO will be invited to attend meetings as an observer.

g) The Members, taken collectively, will have a broad range of skills and experience relevant to the operations of the Agency and the disability sector with at least one Member of the Committee having significant accounting or related financial management experience with an understanding of accounting and auditing standards in a public sector context.

                       Page 49 of 55

h) Members will be appointed for an initial period not exceeding 3 years. Members may be re-appointed after a formal review of their performance, for a further period not exceeding 3 years (i.e. 2 term limit).

Functions

The Committee is not responsible for executive management functions of the Agency and as such has no executive powers or delegations. The Committee will engage with management in a constructive and professional manner in discharging its responsibilities and formulating its advice to the Board.

Financial Reporting a) Assess the interim and annual financial statements and provide advice to the Board; (including recommending their signing). In particular, the committee will:  Assess the Agency’s compliance with accounting standards, including an assessment of the appropriateness of accounting policies and disclosures;  Assess areas of significant judgement and financial statement balances that require estimation;  Assess any significant changes to accounting policies and practices, (by May of each year); and  Assess whether appropriate management action has been taken in response to any issues raised by the ANAO, including findings, financial statement adjustments, revised disclosures or other recommendations; b) Provide guidance to the Agency on the types and frequency of financial information to be provided to the Board; c) Provide guidance to the Agency on the reporting of metrics that reflect measures of operational and network efficiency; d) Monitor the standard and relevance of financial information provided to the Board; e) Assess the processes in place designed to ensure that financial information included in the Agency Annual Report is consistent with the signed financial statements; f) Satisfy itself that the financial statements and notes thereto are supported by appropriate management sign-off and that the systems of internal controls and risk management are adequate; g) Provide advice to the Board regarding the issue of the Agency annual Certificate of Compliance, or equivalent report; and h) Discuss with the ANAO the Auditor’s judgments about the quality of Agency accounting policies and processes for the preparation of the Financial Statements.

Performance Reporting a) Satisfy itself that the Agency has a framework for managing performance and reporting it to the Board and externally that is appropriately linked to organisation objectives and outcomes; b) Review the performance reporting framework for the selection of key performance indicators and other performance measures and metrics; c) Advise the Board of actions that could be taken on significant matters of concern or significant opportunities for improvement that are mentioned in internal or external audit reviews and report; d) Investigate any issues relating to Agency performance that the Committee considers warrant review or investigation, or that are referred to the Committee by the Board or other Committees of the Board;

e) Assess the proposed reporting of Agency performance to ensure that the information is consistent with reported financial information.

Risk Oversight and Management a) Assess whether the Agency has in place systems, policies and procedures to promote compliance with the Risk Management Rules and relevant sections of the Rules for the Scheme Actuary 2013 and provide advice to the Board regarding the sign-off of the Risk Management Declaration for annual provision to the Ministerial Council. b) Assess whether the Agency has in place a current and sound enterprise Risk Management Framework and associated procedures for effective identification and management of Agency strategic, business, operational, project and financial risks, including fraud and corruption; and review and recommend approval of the Risk Management Framework to the Board; c) Monitor the Agency’s approach to managing the risk of fraud and corruption and review reports on fraud from the Agency that outline any significant or systemic allegations of fraud, the status of any on-going investigations and any changes to identified fraud and corruption risk across the Agency; d) Determine whether the Agency has appropriately considered legal and compliance risks as part of its Enterprise Risk Management Plan; e) In close consultation with the ICT Committee, consider the adequacy of the Agency’s ICT risk profile and in particular, key risks associated with the ICT Programme; f) Determine whether a sound and effective approach has been followed in establishing the Agency business continuity planning arrangements, including whether business continuity and disaster recovery plans are periodically updated and tested; and g) Assess whether management has taken steps to embed a culture which is committed to ethical conduct and lawful behaviour.

Internal Control Environment Internal Control Framework a) Assess whether the Agency approach to maintaining an effective internal control environment is sound and effective; b) Assess whether the Agency has in place comprehensive and relevant policies and procedures designed to maintain an effective internal control framework, such as policies, procedures and delegations, including over external parties such as contractors and advisers; c) Determine whether the Agency has appropriate operating and monitoring processes in place to assess, whether key policies, procedures, laws and regulations are complied with and that policies and procedures are kept up to date; d) In close consultation with the ICT Committee, consider the adequacy of the Agency’s information technology security arrangements; and e) Assess the adequacy of Agency compliance with relevant legislative and legal obligations, with particular reference to compulsory compliance declarations. Internal Audit a) Assess, update and approve the Internal Audit charter; b) Assess the proposed internal audit coverage, ensure the coverage is aligned to Agency key risks, and assess the adequacy of internal audit resources to carry out its responsibilities; c) Assess all audit reports and provide advice to the Board on significant issues identified in these reports and recommend action on issues raised, including

Engagement with the ANAO

The committee will engage directly with the ANAO, as the entity’s external auditor, in relation to accounting policies and practices, the preparation and content of the financial statements and the notes thereto and performance auditing. In particular, the Committee will:

Provide input and feedback on planned ANAO financial statement and performance audit coverage and provide feedback to ANAO on the extent and standard of services provided;
Monitor Agency responses to all ANAO financial statement management letters, findings and performance audit reports, including the timely and effective implementation of audit recommendations; and
Discuss privately with the ANAO at least once per year the findings of the ANAO and its performance in carrying out its functions

Reporting

The Committee will update the Board after each meeting on its activities and make recommendations to the Board, as appropriate.

The Chair of the Committee will report to the Board at the next Board meeting following a meeting of the Committee on any matters that the Chair considers should be brought to the attention of the Board.

The Committee will at least annually confirm to the Board that all functions/responsibilities outlined in this charter have been carried out, and comply with any other reporting requirements specified by the Board from time to time.

The Committee will provide guidance to the Board on the adequacy of Agency compliance with relevant legislative and legal obligations, with particular reference to compulsory compliance declarations (e.g., the Financial Statements and the Risk Management Declarations).

5. Administrative Arrangements

Meetings

The Committee will meet at least 4 times per year. One or more special meetings may be held to review Agency annual Financial Statements or to meet other responsibilities of the Committee.

All Members are expected to attend each meeting, in person or via tele-or-video conference on agreement with the Chair.

The Chair is required to call a meeting if asked to do so by the Board, and decide if a meeting is required if requested by any Committee Member, or by the internal auditor or the ANAO.

Planning

The Committee will develop a forward meeting schedule that includes the dates, location, and proposed agenda items for each meeting for the forthcoming year, and that covers all the responsibilities outlined in this charter, aligned to Board requirements.

Quorum

A quorum will consist of a majority of Committee Members. The quorum must be in attendance at all times during the meeting.

Secretariat

Secretariat arrangements will be the same as for the Board. The Secretariat will ensure the agenda for each meeting is approved by the Chair in advance, that the agenda and supporting papers are circulated in advance of meetings where practicable to do so and at least 5 working days before a meeting; and ensure the Minutes of each meeting are prepared and maintained. Minutes must be reviewed by the Chair and circulated within 10 working days of each meeting to each Member and Observer, as appropriate.

Conflicts of interest

Members will provide written conflict of interest declarations annually to the Board declaring any material personal interests they may have in relation to their responsibilities. External members should consider past employment, consultancy arrangements and related party issues in making these declarations and the Board, in consultation with the Chair, should be satisfied that there are sufficient processes in place to manage any real or perceived conflict.

At the beginning of each meeting, Members are required to declare any material personal interests that may apply to specific matters on the meeting agenda. Where required by the Chair, the member will be excused from the meeting or from Committee consideration of the relevant agenda item(s).

The Chair is also responsible for deciding if they should excuse themselves from the meeting or from Committee consideration of the relevant agenda item(s).

Details of material personal interests declared by the Chair and other Members, and actions taken, will be appropriately recorded in the minutes.

Induction

New Members will receive relevant information and briefings on their appointment to assist them to meet their Committee responsibilities.

Performance Assessment Arrangements

The Chair will initiate a self-assessment of the performance of the Committee at least annually. The review will involve input from the Board, each Member, senior management, internal audit, the ANAO, and any other relevant stakeholders as determined by the Committee.

Review of Committee Charter

At least once a year the Committee will review this Charter for consultation with the Board. Any changes to the Charter must be approved by the Board.

Approved [Signature]

[Chair of the accountable authority] or Board Date

FOI 21/22-0868 - DOCUMENT 9

                                                   Bruce Bonyhady AM
                                                           Chairman

30 September 2014

Senator the Hon Mitch Fifield Chair COAG Disability Reform Council Parliament House CANBERRA ACT 2600

Dear Minister

I am writing to you in your capacity as Chair of the Council of Australian Governments Disability Reform Council (the Council), regarding the requirement for the National Disability Insurance Agency (NDIA) Board to provide the Council with a signed risk management declaration.

Attached is the Risk Management Declaration 2013-14, signed by the Chair of the NDIA Board and the Chair of the Audit and Risk Committee of the NDIA Board in accordance with section 10 of the National Disability Insurance Scheme Risk Management Rules 2013 (‘the Risk Management Rules’).

I would like to note in particular the qualification outlined in the declaration. The Board does not consider that these qualifications involve any contravention of the Board’s obligations under the National Disability Insurance Scheme Act 2013 or the Risk Management Rules. The Board has therefore agreed to the attached Risk Management Declaration.

Yours sincerely

National Disability Insurance Agency T: (03) 5273 1486 GPO Box 700 E: bruce.bonyhady@ndis.gov.au Canberra ACT 2601

                       Page 55 of 55