Investor Presentaiton
The department is committed to building a risk culture that encourages proactive
risk management. In accordance with the established risk management policy and
framework, the department uses the Enterprise Risk Management System (ERMS)
to record risks and risk management activities.
In 2022-23, the department continued to focus on integrating and embedding
risk management into core business delivery. A new Risk Appetite Statement
was developed through a workshop with the Department Executive Committee
and published in September 2022. The Statement informed development of an
integrated assurance map that will be used to guide audit planning.
In addition, a new risk dashboard was implemented to improve reporting to the
Department Executive Committee and Risk and Audit Committee. This, combined
with a focus on internal controls for high risks, has led to significant review and
update of operational risks in the ERMS across the department. To support staff
understanding and implementation of risk management practices into core
business, a new eLearning package was rolled out in November 2022, explaining
how to manage risks using the department's risk management system and
providing a basic introduction to business continuity management.
Business continuity management
Business continuity is an important component of the department's risk
management framework, ensuring systems and processes are in place
for the continuity of critical business functions in the event of a
disruptive incident.
In 2022-23, the department progressed major business continuity
plan testing. This testing prompted the Business Continuity Plan
Refresh Program that has focused on simplifying and streamlining the
department's approach to the management of disruptive events.
In addition, a new business continuity management framework and policy
was released in April 2023. The new business continuity management
framework meets the requirements of Treasurer's Instruction 825 (Risk
Management and Security) and aligns with the principles of recognised
international standard ISO22301 Security and Resilience - Business
Continuity Management System supporting the department to improve
organisational resilience and capability through analysis of critical issues
and areas of vulnerability.
Key elements of the framework are:
•
•
a clear overview of the business continuity management process
defined incident classification, notification and plan activation
parameters
established communication protocols
defined roles and responsibilities.
Since the release of the new policy and framework, and in conjunction
with the Refresh Program of works, divisional business impact analyses
and business continuity plans are being updated.
Contents
•
About us
< 81 >
Significant issues ⚫Report on operations Agency performance Operational disclosures ⚫Key performance indicators • Financial disclosures and compliance
AppendixView entire presentation