Department of Finance

Chief Risk Officer’s Guide

Risk and Control Operating Model

Implementing the commonwealth risk management policy

The Commonwealth Risk Management Policy

Section 16 of the Public Governance and Accountability Act 2013 (PGPA Act) provides that
accountable authorities of all Commonwealth entities must establish and maintain appropriate
systems of risk oversight, management and internal control for the entity.
 Non-corporate Commonwealth entities must comply with the Commonwealth Risk Management
Policy.
 Corporate Commonwealth entities are not required to comply but should align with this policy
as a matter of good practice.

Establishing a risk management policy

Entity requirements to Role of the risk function Role of the business / Independent and
meet policy Chief Risk Officer / Head of Risk function objective oversight
Independent review of PGPA Act 2013 Executive Team (Head of Audit Committee /Internal
Rec 13 “Accountable authorities, Division / Business Unit / Audit/ANAO/Regulators
particularly of large Commonwealth Function) S45 PGPA Act. Each
entities, or entities with complex risks, The first line of responsibility entity must have an Audit
should consider appointing a Chief Risk for owning and managing risk Committee. Functions
Officer to support the accountable is the day-to-day decisions of must include the
authority to implement a strong risk officials in all roles and at all appropriateness of the
culture and behaviour across all levels levels. entity’s system of risk
of the organisation” oversight, management
and internal controls
(PGPA Rule S17(1)).
MUST establish and The CRO is responsible for maintaining Business areas are Review and advise the
maintain an entity specific the risk management policy that links responsible for: accountable authority on
risk management policy the entity’s risk management  proposing an entity’s risk the entity’s compliance
that: framework to its strategic appetite, aligned to with the Commonwealth
 defines its approach to objective(s). The risk management Corporate and Business Risk Management Policy.
the risk management and policy and supporting risk management Plans, for approval and
how it supports strategic framework should: ensuring that this is aligned
plans and objectives  inform, empower and guide the entity to the entity’s risk appetite as
 defines the entity’s risk and its officials on how to identify cascaded to it
appetite and risk and manage risks in their daily  the Executive Team review
tolerance activities and decision making and approve Business
 outlines key  protect the soundness of the entity Plans and associated risk
accountabilities and and its resilience to risk events appetite proposed by
responsibilities for Businesses and Functions.
 clearly identify the accountabilities
managing and and processes for assessing,
implementing the risk monitoring, reporting and managing
management framework the strategic, emerging and material
 is endorsed by the risks facing the entity
entity’s accountable  support forward looking and
authority. insightful risk management across
the entity Top Down and Bottom Up.

1
 Department of Finance
Chief Risk Officer’s Guide

Establishing a risk management framework

Entity requirements to Role of the risk function Role of the business / Independent and
meet policy Chief Risk Officer / Head of Risk function objective oversight
Independent review of PGPA Act 2013 Executive Team (Head of Audit Committee
Rec 13 “Accountable authorities, Division / Business Unit / /Internal
particularly of large Commonwealth Function) Audit/ANAO/Regulators
entities, or entities with complex risks, The first line of responsibility S45 PGPA Act. Each
should consider appointing a Chief for owning and managing risk entity must have an Audit
Risk Officer to support the accountable is the day-to-day decisions of Committee. Functions
authority to implement a strong risk officials in all roles and at all must include the
culture and behaviour across all levels levels. appropriateness of the
of the organisation” entity’s system of risk
oversight, management
and internal controls
(PGPA Rule S17(1)).
MUST establish a risk Working collaboratively with the Where mandated the Review and advise the
management framework business to design a risk business is responsible for accountable authority on
which includes: management framework ensures that implementing and the appropriateness of
the risk management activities of the embedding the entity’s risk the entity’s:
 the risk management entity are:
policy andthe entity’s framework in its area,  risk management
 proportionate to the level of risks including:
approach to managing policy
risk faced by the entity  the efficiency and  risk appetite
 aligned to the other activities effectiveness of risk
 risk reporting (internal  internal controls for
andexternal) undertaken by the entity controls, processes and risk identification and
 structured, comprehensive and procedures
 the desired risk risk management
embedded across the entity  the identification,
management culture  articulation of roles
and how it is being  dynamic and responsive to management and and responsibilities
encouraged emerging and changing risks or reporting of strategic, for risk management
entity strategy and activities. material and emerging
 the approach to  internal controls
embedding risk (ISO 3100-2018) risks to its business
framework and
management into Risk Management Framework should  working collaboratively processes for
business processes address the following risk management with the Risk Function. assessing
 how it contributes to activities:  compliance with compliance with
managing any shared 1. Strategic Thinking policies, processes, policies, processes,
or cross jurisdictional 2. Risk Identification legal and regulatory legal and regulatory
risks 3. Risk Management requirements. requirements.
 measuring risk 4. Risk Appetite
management 5. Controls, Data, Systems
performance and the 6. Monitoring & Reporting
oversight 7. Governance
 the review and 8. Role Profiles
development of risk 9. Customer Outcomes
management
framework and risk
profile.
The risk management
framework must be
endorsed by the entity’s
accountable authority.

2
 Department of Finance
Chief Risk Officer’s Guide

Defining responsibility for managing risk

Entity requirements to Role of the risk function Role of the business / Independent and
meet policy Chief Risk Officer / Head of Risk function objective oversight
Independent review of PGPA Act 2013 Executive Team (Head of Audit Committee
Rec 13 “Accountable authorities, Division / Business Unit / /Internal
particularly of large Commonwealth Function) Audit/ANAO/Regulators
entities, or entities with complex risks, The first line of responsibility S45 PGPA Act. Each
should consider appointing a Chief for owning and managing risk entity must have an Audit
Risk Officer to support the accountable is the day-to-day decisions of Committee. Functions
authority to implement a strong risk officials in all roles and at all must include the
culture and behaviour across all levels levels. appropriateness of the
of the organisation” entity’s system of risk
oversight, management
and internal controls
(PGPA Rule S17(1)).
An entity’s accountable The CRO provides oversight of the The Head of the Review and advise the
officer MUST (within the effectiveness of the Three Lines of Business/Function must accountable authority on
risk management policy) Defence Model in the entity that ensure that roles and the appropriateness of
define the responsibility ensures that roles and responsibilities for risk: the entity’s articulation
for managing risk by: responsibilities for risk  are meaningfully of roles and
 defining who is management, risk activities and risk understood and responsibilities for risk
responsible for Governance are clearly understood cascaded to all staff and management.
determining risk across the entity and that they align included in their role
appetite and tolerance with, and are complimentary to, profiles and performance
for risk delegations and authorisations. objectives
 allocating Risk Accountabilities (Individual &  are assessed as part of
responsibility for Collective) individuals’ performance
implementing the risk 1. Regulatory / Legal review processes.
management 2. Internal (3LOD)
framework 3. Governance
 defining roles and 4. Role Profiles
responsibilities in 5. Performance and Remuneration.
managing individual
risks.

3
 Department of Finance
Chief Risk Officer’s Guide

Embedding systematic risk management into business processes

Entity requirements Role of the risk function Role of the business / Independent and objective
to meet policy Chief Risk Officer / Head of Risk function oversight
Independent review of PGPA Act Executive Team (Head of Audit Committee /Internal
2013 Rec 13 “Accountable Division / Business Unit / Audit/ANAO/Regulators
authorities, particularly of large Function) S45 PGPA Act. Each entity
Commonwealth entities, or The first line of responsibility must have an Audit
entities with complex risks, for owning and managing risk Committee. Functions must
should consider appointing a is the day-to-day decisions of include the appropriateness of
Chief Risk Officer to support the officials in all roles and at all the entity’s system of risk
accountable authority to levels. oversight, management and
implement a strong risk culture internal controls (PGPA Rule
and behaviour across all levels of S17(1)).
the organisation”
MUST ensure that the Provides objective oversight Within their area of  Provide independent
systematic and challenge of the: accountability: assurance over the
management of risk is adequacy, effectiveness and
 entity’s systems and  effective implementation of
embedded in key compliance with risk
controls in respect of risk risk controls and processes
business processes. policies, internal controls
management, noting risks  own and manage risks within and processes within the
are owned by the business risk appetite, and evidence business, and the
 effectiveness of risk consideration of risk in adherence to them by
management across the decision making officials of the entity.
entity by the business  remediate weaknesses in  Conducting thematic and
including compliance with risk risk controls or processes post incident reviews at
appetite, risk policies, controls,  escalate breaches of risk the Entity / Business
processes and procedures appetite or risk concerns /Functional level as required.
 risks inherent in any  collaborate with, and
proposed business strategy seeks guidance from, risk
and plans are consistent SMEs to inform
with the entity’s risk appetite consideration of risk in
and tolerance. decision making.
Where appropriate, provide
guidance to the business on
consideration of risk in
business decisions.

4
 Department of Finance
Chief Risk Officer’s Guide

Developing a positive risk culture

Entity requirements Role of the risk function Role of the business / Independent and objective
to meet policy Chief Risk Officer / Head of Risk function oversight
Independent review of PGPA Act Executive Team (Head of Audit Committee /Internal
2013 Rec 13 “Accountable Division / Business Unit / Audit/ANAO/Regulators
authorities, particularly of large Function) S45 PGPA Act. Each entity
Commonwealth entities, or The first line of responsibility must have an Audit
entities with complex risks, for owning and managing risk Committee. Functions must
should consider appointing a is the day-to-day decisions of include the appropriateness of
Chief Risk Officer to support the officials in all roles and at all the entity’s system of risk
accountable authority to levels. oversight, management and
implement a strong risk culture internal controls (PGPA Rule
and behaviour across all levels of S17(1)).
the organisation”
An entity’s risk The CRO is responsible for  Role model and set a strong Review and advise the
management supporting the accountable Tone From the Top. accountable authority on the
framework MUST officer in the development of a  Support the development appropriateness of the
support the positive risk culture across the of a positive risk culture entity’s risk culture.
development of a entity. This should include the consistent with the entity’s
positive risk culture. assessment of and actions target risk culture,
taken to embed positive risk evidenced by reinforcing
behaviours: desired risk behaviours
 Listening, Sharing and and appropriate actions
collaboration taken for detrimental
culture risk behaviours.
 Adherence to policies,
processes and procedures  Promote a proactive
approach to risk
 Risk is evidenced in decision
management that
making considers both threat and
 Continuous improvement opportunity.
 Individual accountability and
Learning from mistakes
 Open and constructive giving
and receiving of challenge.
The risk culture should promotes
a proactive approach that
considers both threat and
opportunity.

5
 Department of Finance
Chief Risk Officer’s Guide

Communicating and consulting about risk

Entity requirements Role of the risk function Role of the business / Independent and objective
to meet policy Chief Risk Officer / Head of Risk function oversight
Independent review of PGPA Act Executive Team (Head of Audit Committee /Internal
2013 Rec 13 “Accountable Division / Business Unit / Audit/ANAO/Regulators
authorities, particularly of large Function) S45 PGPA Act. Each entity
Commonwealth entities, or The first line of responsibility must have an Audit
entities with complex risks, for owning and managing risk Committee. Functions must
should consider appointing a is the day-to-day decisions of include the appropriateness of
Chief Risk Officer to support the officials in all roles and at all the entity’s system of risk
accountable authority to levels. oversight, management and
implement a strong risk culture internal controls (PGPA Rule
and behaviour across all levels of S17(1)).
the organisation”
MUST implement  Oversight and report the  Oversight of and report the Outcomes of oversight
arrangements to entity’s aggregate risk business risk profile activities should:
communicate and profile relative to current relative to current and
 inform the accountable
consult about risk in a and future business strategy future business strategy
authority whether the entity’s
timely and effective and activities and agreed and activities and agreed
system of internal controls is
manner to both internal risk appetite: risk appetite.
appropriate to the entity
and external  reporting should consider all  Report emerging risks and
 provide advice to the
stakeholders. material risks plans to mitigate them.
accountable authority on
 report on emerging risks to  Alert the Risk Function major concerns identified
the entity and plans to and the accountable and recommended
mitigate them officer with regard to actions, including
 alert the accountable current or planned identification and
authority to and provide activities that may cause dissemination on good
challenge on, any business the business to exceed it practice.
strategy, plans or actions that risk appetite and
may cause the entity exceed it tolerance.
risk appetite and tolerance
 oversight and validation of the
entity’s external risk
reporting obligations.

Understanding and managing shared risk

Entity requirements Role of the risk function Role of the business / Independent and objective
to meet policy Chief Risk Officer / Head of Risk function oversight
Independent review of PGPA Act Executive Team (Head of Audit Committee /Internal
2013 Rec 13 “Accountable Division / Business Unit / Audit/ANAO/Regulators
authorities, particularly of large Function) S45 PGPA Act. Each entity
Commonwealth entities, or The first line of responsibility must have an Audit
entities with complex risks, for owning and managing risk Committee. Functions must
should consider appointing a is the day-to-day decisions of include the appropriateness of
Chief Risk Officer to support the officials in all roles and at all the entity’s system of risk
accountable authority to levels. oversight, management and
implement a strong risk culture internal controls (PGPA Rule
and behaviour across all levels of S17(1)).
the organisation”
MUST implement  The CRO provides guidance to  Openly collaborates and Where appropriate share
arrangements to the business on how to shares information on outcomes of oversight with
understand and collaborate with other current and emerging risk other Commonwealth entities
contribute to the Commonwealth Entities to issues with others. to identify areas of shared
management of shared identify areas of shared risks risks and to contribute to the
risks. and to contribute to the aggregate assessment of
aggregate assessment of those those risks.
risks and, importantly, their
effective management, not only
for the entity, but on occasion the
Commonwealth.

6
 Department of Finance
Chief Risk Officer’s Guide

Maintaining risk management capability

Entity requirements Role of the risk function Role of the business / Independent and objective
to meet policy Chief Risk Officer / Head of Risk function oversight
Independent review of PGPA Act Executive Team (Head of Audit Committee /Internal
2013 Rec 13 “Accountable Division / Business Unit / Audit/ANAO/Regulators
authorities, particularly of large Function) S45 PGPA Act. Each entity
Commonwealth entities, or The first line of responsibility must have an Audit
entities with complex risks, for owning and managing risk Committee. Functions must
should consider appointing a is the day-to-day decisions of include the appropriateness of
Chief Risk Officer to support the officials in all roles and at all the entity’s system of risk
accountable authority to levels. oversight, management and
implement a strong risk culture internal controls (PGPA Rule
and behaviour across all levels of S17(1)).
the organisation”
MUST maintain an  Identify and support the  The business is primarily Identify and support the
appropriate level of development of the capabilities responsible for ensuring development of the
capability to both needed to ensure that risks are staff have the capabilities capabilities needed to
implement the entity’s managed effectively across the to manage risk in their daily conduct its oversight
risk management entity, including that the data activities aligned to their activities.
framework and used to assess its risks is fit- roles and responsibilities
manage its risks. for-purpose in terms of quality,  Where appropriate the
quantity and breadth. business collaborates with
 Identify and support learning the Risk Function for
and training needs needed to support in building their
effectively manage risk and risk capabilities.
develop a positive risk culture
across the entity.

Reviewing and continuously improving the management of risk

Entity requirements Role of the risk function Role of the business / Independent and objective
to meet policy Chief Risk Officer / Head of Risk function oversight
Independent review of PGPA Act Executive Team (Head of Audit Committee /Internal
2013 Rec 13 “Accountable Division / Business Unit / Audit/ANAO/Regulators
authorities, particularly of large Function) S45 PGPA Act. Each entity
Commonwealth entities, or The first line of responsibility must have an Audit
entities with complex risks, for owning and managing risk Committee. Functions must
should consider appointing a is the day-to-day decisions of include the appropriateness of
Chief Risk Officer to support the officials in all roles and at all the entity’s system of risk
accountable authority to levels. oversight, management and
implement a strong risk culture internal controls (PGPA Rule
and behaviour across all levels of S17(1)).
the organisation”
MUST review its risks, Ensure the continuing Undertakes regular activities to Ensure the continuing
its risk management efficiency and effectiveness of assess the effectiveness of efficiency and effectiveness
framework and the the risk management Function risk management within the of its oversight processes,
application of its risk and Risk Management business and is responsible including the coverage of the
management practices Framework and that it remains for remediating identified oversight activities of the
on a regular basis, and fit-for-purpose in supporting and weaknesses. entity’s key risks and activities.
implement enabling the entity to conduct
improvements arising its activities in a safe manner.
out of such reviews.