FOI 23/24-1011
OFFICIAL
1. Purpose and context
The National Disability Insurance Agency (NDIA or the Agency) invests in risk management
to support its statutory function of delivery of the Scheme in accordance with the National
Disability Insurance Scheme Act 2013, Corporate Plan objectives, and delivery of a
sustainable Scheme. The Risk Management Strategy (RMS) outlines how the Agency wil
manage the material risks that arise as part of our operations and initiatives.
As a Corporate Commonwealth Entity, the NDIA has a range of legislative obligations that
inform our risk management approach. The RMS
obligations under Commonwealth law, including the:
Public Governance, Performance and Accountability Act 2013
National Disability Insurance Scheme Act 2013
National Disability Insurance Scheme Risk Management Rules 2013 (the Rules).
The legislative and risk governance landscape is summarised below.
The RMS aims to embed the fol owing risk management principles in the Agency
operations:
early and proactive identification, mitigation, and escalation of risk for awareness/
management, taking account of emerging and shared risks
systematic consideration of risk in business planning and decision making
strong risk leadership and designation of operational managers as Risk Owners,
supported by independent Risk Specialists
a control environment that is actively monitored and enhanced
active consideration of partner performance and third-party risks
robust processes and systems that support compliance, assurance, and integrity
ndis.gov.au
NDIA Risk Managemen
Page 2 of 9 t Strategy
2
FOI 23/24-1011
OFFICIAL
a positive risk culture sustained through ongoing maturity and capability uplift.
2. Our risk assessment process
The overal approach is for uncertainty, opportunity, and threats to be identified, assessed,
managed, and monitored within the planning and execution levels of the Agency, including
at Group, Divisional, Branch (where risks could impact the ability to plan and meet business
objectives), and at an individual level.
2.1 Risk management process
artefacts include information and tools to provide guidance
on the identification, assessment, management, monitoring, and reporting of risks. Key risk
assessment tools are accessible on the Agency intranet, including risk management
process guidance and risk assessment criteria.
risk management process is a continuous cycle and comprises the fol owing
inter-related components:
identify key risks
assess current internal controls, likelihood, and consequence of each risk
manage any additional actions required to mitigate the risk
monitor and report on the risk profile and performance
learn and share from experience.
2.2 Risk management declaration
In accordance with the Rules, the Board wil provide the Ministerial Council with an annual
Risk Management Declaration. The Chief Risk Officer and Chief Executive Officer wil
support the Board declaration by completing an annual risk maturity self-assessment in
accordance with the Board approved Risk Maturity Assessment Methodology.
2.3 Risk classification
The Agency classifies its material risks into the fol owing categories:
Strategic risks risks that might significantly impact the delivery of the Scheme
Enterprise risks risks that have the potential to span across the Agency, requiring
active management by multiple groups and/ or a whole-of-Agency response
Payment risks risks associated with Scheme payments, fraud and
non-compliance
Regulatory risks risks associated with legislation / regulatory obligation
compliance
ndis.gov.au
NDIA Risk Managemen
Page 3 of 9 t Strategy
3
FOI 23/24-1011
OFFICIAL
Operational risks risks associated with the delivery of services and the day-to-day
business activities of the Agency, including security risks and emergency and
business continuity planning and response
Project risks delivery and delivered risks inherent in, and stemming from, key
strategic or business initiatives.
2.4 Risk appetite and tolerances
The
isk appetite wil be reviewed and set by the Board on an annual basis. The
Agency Risk Appetite Statement articulates how a risk appetite is applied across the key
operational elements of:
People
Financial sustainability
Fraud
Stakeholder confidence and trust
Legislative obligations
Information communication technology.
The Agency sets annual quantitative thresholds (tolerance ranges) through the performance
metrics assigned to the above risk classifications (e.g., strategic risk performance metrics,
incident and regulatory escalation thresholds, and group key performance indicators).
Performance metrics are monitored on a monthly basis and reported to Senior Executives
and/or governing committees on a quarterly basis via the Chief Risk Officer Report. Material
non-conformances are escalated to relevant Executives when identified and reported to the
Strategic Leadership Team.
3. Our strategic risk management approach
3.1 Governance and accountability arrangements
Our Objective: The Agency will maintain comprehensive risk governance, with regular
communication and escalation through to the Strategic Leadership Team and Board.
NDIA Board The Board is ultimately responsible for overseeing the establishment of an
effective Agency risk management approach. The Board fulfils its responsibilities with advice
and support from the Risk and Audit Committees.
Strategic Leadership Team The Agency maintains strong strategic oversight of
uncertainty, opportunity and risk through its Strategic Leadership Team led by the
Chief Executive Officer.
Chief Risk Officer The Strategic
Chief Risk Officer in the monitoring of strategic, enterprise, operational, regulatory and
project risks, and the provision of independent assurance and audit.
ndis.gov.au
NDIA Risk Managemen
Page 4 of 9 t Strategy
4
FOI 23/24-1011
OFFICIAL
Risk and Control Owners Senior Executive Staff are the risk and control owners and
responsible for the identification, management, monitoring, and escalation of risk exposures.
Al staff in the Agency have a responsibility to be risk aware, report any identified risks, and
take risk mitigation actions as appropriate. Specific roles and responsibilities are detailed in
Appendix A.
3.2 Risk Management Framework
Our Objective: The Agency will support prudent and sound risk management
outcomes through a robust risk management framework.
An annual implementation plan wil facilitate the operationalisation of the RMS and ongoing
risk maturity, and wil include a continuous improvement approach to:
1. strengthening Agency controls
2. enhancing Agency fraud and compliance response
3. further embedding risk management in the operating environment
4. risk management capability and capacity uplift.
further articulated in enterprise-level risk,
assurance, fraud and corruption prevention, and security management plans.
The Agency wil utilise a centralised risk management system (Insight) to capture, manage,
analyse, and report material risk, control, and treatment data.
3.3 Controls and treatments
Our Objective: The Agency will continue to strengthen internal control design and
assurance.
The Agency wil maintain an effective internal control environment by designing and
implementing controls and treatment actions that directly impact identified risks. Risk
Owners wil be responsible for developing and implementing treatment plans. Completed
treatments wil be assessed for impact on the control and residual risk environment.
Risk and control owners wil undertake reviews of their risk and control profiles and report
outcomes on a quarterly basis (or more regularly should the prevailing risk environment
warrant).
Assurance activities wil facilitate control assessment and review, and the identification of
weaknesses and recommendations to increase control effectiveness. Responsibility for
implementation of assurance recommendations wil reside with the Risk Owner.
ndis.gov.au
NDIA Risk Managemen
Page 5 of 9 t Strategy
5
FOI 23/24-1011
OFFICIAL
3.4 Monitoring and reporting
Our Objective: The Agency will continue to support risk-based decision making
through proactive risk performance reporting.
Risk reporting wil reflect performance against key risk indicators and threshold tolerances,
control effectiveness, and treatment plan activity. Quarterly strategic, operational, fraud and
compliance, and regulatory risk performance reports wil be presented to the Strategic
Leadership Team and Board.
Event-based risk reporting and escalation of issues wil occur as appropriate.
3.5 Culture and capability
Our Objective: The Agency will continue to mature the risk culture and build
capability.
The Agency wil endeavor to build an environment in which risk is openly and honestly
discussed. To further enhance risk culture, additional assurance and key insights wil come
from risk maturity assessments. The Agency wil provide regular risk communications and
recognise sound risk management practices.
Training and coaching opportunities wil be articulated in a risk capability strategy.
Accountabilities and performance expectations for risk management wil be reflected in
position descriptions and
Performance Framework.
The RMS is
3.6 Review
Our Objective: The Agency will evolve its risk management strategy consistent with
the prevailing risk appetite and strategic settings.
The RMS wil be reviewed annual y by the Board. Material amendments wil be submitted to
the Ministerial Council for approval. As appropriate, the Agency wil also commission
independent comprehensive reviews of the effectiveness of the risk management
framework, including the RMS.
ndis.gov.au
NDIA Risk Managemen
Page 6 of 9 t Strategy
6
