Compliance and Risk Management Framework Version 1, October 2020
Total Page：16
File Type：pdf, Size：1020Kb
Compliance and Risk Management Framework Version 1, October 2020 Compliance and Risk Management Framework This Framework relates Risk Management Policy Document No: 6154088 to: Framework applies: All sites Target audience: All Staff Description: The Compliance and Risk Management Framework is designed to assist Councillors, employees and contractors of Logan City Council (Council) to achieve our strategic and operational goals and objectives with respect to Compliance and Risk Management. This framework articulates the requirement for Council to establish risk management practices in accordance with ISO 31000:2018 and AS/NZS 19600:2015. Subject: Compliance and Risk Management Keywords: Current Risk, Frequency, Hazard, Initial Risk Rating, Loss, Probability, Risk, Risk Analysis, Risk assessment, Risk identification, Risk evaluation, Compliance, Breach, Noncompliance Related Legislation (including OHS legislation), Australian Standards, QLD Policy or Circular, other Documents, Professional Guidelines, Codes of Practice or Ethics: ISO 31000:2018, Risk Management Guidelines AS/ISO 19600:2015 Compliance Management Guidelines Doc ID No: 5979417 Code of Conduct for Staff Doc ID No: 5992416 - Workplace and Safety Doc ID No: 13324550 – Audit and Risk Committee Policy Work Health and Safety Act 2011 Work Health and Safety Regulations 2011 Local Government Act 2009 Local Government Regulation 2012 Child Protection Act 1999 Privacy Act 1988 (Cth) Privacy Amendment (Notifiable Data Breaches) Act 2016 (Cth) Environmental Protection Act 1994 Business Continuity Institute Good Practice Guidelines 2018 Other state and federal legislation as applicable Director responsible for Director, Organisational Services Framework: Manager for Framework Administration and Corporate Governance Managers implementation: Framework Contact Person: Corporate Governance Manager Framework Review Due Date: 2 years from date of adoption or date of last review. Document Control File: 1186813‐1 Document Id: 14119488 Version Number Description of Change Author / Branch Date 1.0 Creation Corporate Governance October 2020 DM 14119488 Compliance and Risk Management Framework Page 2 Table of Contents 1 INTRODUCTION ......................................................................................................... 5 1.1 Structure of this Framework .......................................................................................... 5 2 OBJECTIVES ............................................................................................................. 5 3 ROLES AND RESPONSIBILITIES ............................................................................. 6 3.1 Council.......................................................................................................................... 6 3.2 Audit and Risk Committee ............................................................................................ 7 3.3 Chief Executive Officer ................................................................................................. 7 3.4 Executive Leadership Team.......................................................................................... 8 3.5 Administration and Corporate Governance Managers .................................................. 8 3.6 Managers...................................................................................................................... 8 3.7 Employees and Contractors .......................................................................................... 9 4 COMMUNICATION..................................................................................................... 9 4.1 Internal stakeholders ..................................................................................................... 9 4.2 External stakeholders ................................................................................................... 10 4.3 Reporting ...................................................................................................................... 10 4.4 Management Review .................................................................................................... 10 5 RISK MANAGEMENT ................................................................................................ 12 5.1 Architecture of the risk management framework ........................................................... 12 5.2 Overall process ............................................................................................................. 12 5.3 Risk Rating.................................................................................................................... 13 5.4 Risk escalation .............................................................................................................. 14 5.5 Risk treatment ............................................................................................................... 14 5.6 Accountability................................................................................................................ 14 5.7 Integration into organisational processes ...................................................................... 15 5.8 Resources ..................................................................................................................... 15 5.9 Reporting ...................................................................................................................... 15 5.10 Monitoring and review of the framework ....................................................................... 15 6 COMPLIANCE MANAGEMENT ................................................................................. 16 6.1 Compliance Register ..................................................................................................... 16 6.2 Legislative Changes ...................................................................................................... 16 6.3 Compliance Breach Management ................................................................................. 16 6.4 Reporting to the Audit and Risk Committee and ELT .................................................... 18 6.5 Key Performance Indicators .......................................................................................... 18 6.6 Compliance audits ........................................................................................................ 18 6.7 Change Management ................................................................................................... 18 APPENDIX 1: RISK TREATMENT PLAN TEMPLATE...................................................... 19 APPENDIX 2: NOTIFIABLE BREACH REQUIREMENTS ................................................. 20 DM 14119488 Compliance and Risk Management Framework Page 3 APPENDIX 3: RISK TOOLS .............................................................................................. 22 DM 14119488 Compliance and Risk Management Framework Page 4 1 Introduction The function of this Compliance and Risk Management Framework (CRMF) is to provide Logan City Council (LCC) Councillors, employees and contractors with guidance in how to apply consistent and comprehensive risk management and how to manage its compliance obligations. This document supports Council’s Risk Management and Compliance Policies. It identifies key activities needed for an effective risk management approach and provides information on how to identify, analyse, assess and treat risks. The risk management process contained in this framework aligns with the ISO31000:2018 Risk Management. The Compliance elements of this framework outline Council’s approach to managing its compliance obligations in accordance with the requirements of AS/ISO 19600:2015 Compliance Management Systems. 1.1 Structure of this Framework This CRMF recognises the common features and requirements of risk management and compliance in supporting good governance. Accordingly, this document has been structured to reflect this by using a common approach to risk and compliance in most areas apart from Sections 5 and 6 Risk Management and Compliance Management, which relate to Compliance and Risk separately. 2 Objectives Compliance and Risk Management are the responsibility of all Councillors, employees and contractors, with specific risk responsibilities being allocated to different groups and levels within the organisation. Compliance and Risk Management will support Council in being able to meet our values and deliver upon our objectives, via a consistent and comprehensive process. It will: Increase the likelihood of us achieving our strategic and business objectives; Encourage a high standard of integrity and accountability at all levels of the organisation; Support more effective decision making through better understanding of risk exposures; Create an environment that enables us to deliver timely services and meet performance objectives in an efficient and cost effective manner; Safeguard our assets – human, property and reputation; and Meet compliance and governance requirements. In adopting a CRMF, Council has the following objectives: Provide a consistent, systematic approach to the early identification and management of risks within an acceptable level; Make available accurate and concise risk information that informs decision making, including business direction; DM 14119488 Compliance and Risk Management Framework Page 5 Adopt risk treatment strategies that are cost effective and efficient in reducing risk to an acceptable