National Disability Insurance Scheme—Risk Management Rules 2013

National Disability Insurance Scheme-Risk Management Rules 2013

I, WILLIAM RICHARD SHORTEN, Minister for Financial Services and Superannuation, determine these rules under section 125B of the National Disability Insurance Scheme Act 2013.

Dated 25 June 2013.

WILLIAM RICHARD SHORTEN

Minister for Financial Services and Superannuation

Contents

Part 1 Preliminary 3

1 Name of instrument 3

2 Commencement 3

3 Interpretation 3

Part 2 General responsibilities of the Board 3

4 General responsibilities of the Board 3

Part 3 Risk management framework and risk management strategy 4

5 Establishment, maintenance and content of risk management framework 4

6 Kinds of material risks 5

7 Reviews of risk management framework 5

8 Risk management strategy 6

Part 4 Risk management function 6

9 Risk management function 6

Part 5 Risk management declaration 7

10 Preparation and content of risk management declaration 7

11 Qualifications to risk management declaration 8

Preliminary

Name of instrument

These Rules are the National Disability Insurance Scheme-Risk Management Rules 2013.

Commencement

These Rules commence on the later of:

the day after they are registered; and

1 July 2013.

Interpretation

In these Rules:

Act means the National Disability Insurance Scheme Act 2013.

Agency-see section 9 of the Act.

Board-see section 9 of the Act.

Board member-see section 9 of the Act.

Ministerial Council-see section 9 of the Act.

NDIS means the National Disability Insurance Scheme (as defined in section 9 of the Act).

General responsibilities of the Board

General responsibilities of the Board

The Board must ensure that:

it prepares a written risk management strategy as soon as reasonably practicable after the commencement of these Rules; and

the Agency has a sound risk management culture; and

the members of the Agency's senior management take the steps necessary to monitor and manage all material risks that are likely to be faced by the Agency, consistent with the risk management strategy; and

the Agency's operational structure is such that it facilitates effective risk management; and

the Agency develops policies and processes for making decisions affected by risk that are consistent with the risk management strategy; and

the Agency dedicates sufficient resources to risk management; and

the Agency recognises the uncertainties involved in the measurement of risk and understands the limitations and uncertainties relating to the output of models used to measure components of risk; and

the Agency establishes, and has in place at all times, appropriate controls in relation to risk that are consistent with the Agency's risk profile and are understood by, and regularly communicated to, relevant staff of the Agency.

The Board must also ensure that the scheme actuary is involved in decisions made by the Agency and the Board in relation to risk, to the extent that that involvement is appropriate and consistent with the scheme actuary's duties and the National Disability Insurance Scheme-Rules for the Scheme Actuary 2013.

Risk management framework and risk management strategy

Establishment, maintenance and content of risk management framework

The Board must, as soon as reasonably practicable after the commencement of these Rules, establish a risk management framework, and must have such a framework in place at all times.

The risk management framework must provide a reasonable assurance that the Agency's risks are managed prudently and soundly.

The risk management framework is to deal with the systems, structures, processes and people within the Agency that identify, assess, mitigate and monitor all internal and external sources of risk that could have a material impact on the Agency's operations, funding and financial sustainability.

The risk management framework must include:

a written risk management strategy prepared in accordance with section 8; and

policies and procedures to identify, assess, monitor, report on and mitigate all material risks, whether financial or not, that are likely to be faced by the Agency; and

clearly defined managerial responsibilities and controls in relation to risk; and

a review process to ensure that the risk management framework is effective in identifying, measuring, evaluating, monitoring, reporting, and controlling or mitigating, material risks.

Kinds of material risks

The risk management framework is to deal with the following kinds of risks:

operational risks, including risks of unexpected costs resulting from inadequate or failed internal processes, people and systems;

risks arising from the Board's objectives and plans in respect of the Agency's functions;

risks to the financial sustainability of the NDIS;

other kinds of risks that, alone or in combination with others, may have a material impact on the Agency.

Reviews of risk management framework

The Board must ensure that:

there are effective and comprehensive reviews of the risk management framework, conducted by persons (including, if appropriate, external consultants) who are operationally independent and appropriately trained and competent; and

the frequency and scope of such reviews are appropriate having regard to the size and complexity of the Agency's operations.

For paragraph (1)(a), a person is not operationally independent if the person plays, or has played, a significant role in the development or implementation of the risk management framework.

A review must include:

a review of the risk management function; and

a review of the risk management strategy; and

a review of the Agency's controls and procedures in relation to risk.

Risk management strategy

The risk management strategy must:

outline the risk governance relationship between the Board, committees of the Board and the senior management of the Agency; and

describe the processes for the Agency to identify and assess risks; and

describe the process for the Agency to establish mitigation and control mechanisms for individual risks; and

describe the process for monitoring and reporting issues in relation to risk (including the communication and escalation of such issues); and

describe how the Agency is to:

ensure that relevant staff are aware of issues relating to risk; and

instil an appropriate culture in relation to risk; and

ensure that the risk management strategy is accessible to the Agency's staff; and

identify persons and positions in the Agency with roles and responsibilites in relation to risk, or groups of such persons and positions, and set out those roles and responsibilities; and

describe the review process mentioned in paragraph 5(4)(d).

The risk management strategy, and any material amendments to the risk management strategy, must be approved by the Ministerial Council. The Board must submit the strategy or amendments to the Ministerial Council as soon as reasonably practicable after the strategy or amendments have been approved by the Board.

The risk management strategy must be reviewed (including any reviews conducted in accordance with section 7) at least annually.

Risk management function

Risk management function

The Board must designate a part of the Agency or a person in the Agency that, at a minimum:

is responsible for assisting the Board, committees of the Board and the senior management of the Agency to develop and maintain the risk management framework; and

is appropriate to the size, operations and complexity of the NDIS; and

is operationally independent, meaning that they are not directly involved in the Agency's functions in relation to the funding or provision of supports under the NDIS; and

is conferred with the authority and the access to the Board, committees of the Board and senior management of the Agency, necessary to conduct its activities effectively and independently; and

is resourced with staff who have clearly defined roles and responsibilities and the experience and qualifications appropriate to those roles and responsibilities; and

has access to all aspects of the Agency that have the potential to generate material risk, including information technology systems and system development resources; and

is required to notify the Board of any significant breach of, or material deviation from, the risk management framework.

The first designation of a person or body under subsection (1) must take place as soon as reasonably practicable after the commencement of these Rules.

Risk management declaration

Preparation and content of risk management declaration

The Board must, after the end of each financial year of the Agency's operations that commences after 30 June 2013, provide the Ministerial Council with a risk management declaration signed by 2 Board members on behalf of the Board.

The risk management declaration is to state that, to the best of the Board's knowledge and belief, and having made appropriate enquiries:

the Agency has systems in place for the purpose of ensuring compliance with the Act and the Commonwealth Authorities and Companies Act 1997; and

the Board and the senior management of the Agency are satisfied with the efficacy of the processes and systems for the production of the Agency's financial information; and

the Board has in place a risk management strategy that complies with the requirements of these Rules; and

the Agency (including the Board) has, throughout the relevant financial year, substantially complied with the risk management strategy; and

the risk management strategy is operating effectively; and

the risk management strategy in its present form has been submitted to and approved by the Ministerial Council.

Qualifications to risk management declaration

The Board may qualify a risk management declaration (for example, if the Board cannot make an unqualified declaration of a matter mentioned in subsection 10(2)). A qualification must describe:

the circumstances giving rise to the qualification; and

whether those circumstances involve any contravention of the Board's obligations under the Act or these Rules; and

the steps taken, or proposed to be taken, to remedy the circumstances giving rise to the qualification.