• Section 1 - Purpose and Scope
• Purpose
• Scope
• Section 2 - Definitions
• Section 3 - Policy Statement
• Section 4 - Roles and Responsibilities
• Council
• Academic Board
• Material Risk Leads
• Project Managers/Leads
• All Staff
• Section 5 - Risk Reporting Requirements
• Section 6 -  Associated documents

Section 1 - Purpose and Scope

Purpose

(1) This Policy is an integral component of the Enterprise Risk Management Framework which:

1. establishes the principles and processes to identify, assess and manage risk;
2. allocates responsibilities for managing risks; and
3. aligns with the International Standard for Risk Management AS ISO 31000: 2018.

Scope

(2) This Policy applies to all areas of the University's operations, including its staff, appointees of the University, its controlled entities and to all activities authorised and conducted by or on behalf of the University.

Section 2 - Definitions

(3) For the purposes of this Policy, the following definitions apply:

1. Consequence - An outcome of an event which could affect objectives, positively or negatively.
   There may be multiple consequences from one event.
2. Control - Any action taken to positively alter the likelihood or consequences of a risk or opportunity event.
3. Material risk - Risks which have the ability to materially impact the achievement of the University’s strategic objectives or the University as a whole, distinct from risk which may be material for only one organisational unit.
4. Monitor - To track and evaluate risks and the effectiveness of the controls.
5. Opportunity - An uncertain event that could have favourable impact on objectives.
6. Residual risk - The remaining risk after controls have been implemented (action has been taken to alter the risk’s likelihood or impact).
7. Risk - is the potential for an event or set of events which may impact achievement of the University’s strategic objectives – either favourably or unfavourably.
8. Risk acceptance - An informed decision to accept the residual risk rating of a risk and proceed with the proposed course of action.
9. Risk appetite - The amount of risk, on a broad level, the University is willing to accept in pursuit of value. The Risk Appetite is expressed through statements set by Council.
10. Risk assessment - The overall process of risk identification, analysis and evaluation.
11. Risk evaluation - The process to determine risk management priorities by comparing the level of risk against risk appetite and risk target risk levels.
12. Risk identification - The process of determining what might impact on the achievement of objectives, why, and how.
13. Risk management - the University’s coordinated activities directed towards realising potential opportunities while managing adverse effects in order to improve the University’s ability to achieve its strategy and business objectives.
14. Risk management process -The systematic application of policies, procedures and practices to establish context, identify, analyse, evaluate, treat, monitor and communicate risk.
15. Risk profile - the allocation of risks to risk categories with assigned risk ratings.
16. Risk register - The summary of individual risks within a risk assessment or risk profile.

Section 3 - Policy Statement

(4) The University acknowledges that implementation and maintenance of a formal risk management system is fundamental to achieving its strategic and operational objectives.

(5) The University is committed to a rigorous and structured risk management system which is:

1. integrated into all parts of the University's activities with risk management embedded into key decisions and approval processes of all major business processes and functions;
2. structured to provide consistent and comparable results and support a shared understanding with all risks managed within the boundaries defined in the Risk Appetite Statement;
3. dynamic, recognising that risk emerges, changes or disappears due to changes in internal and external forces, and that the role of risk management includes anticipating, detecting, acknowledging and responding to those changes in a way which helps the University to achieve its objectives;
4. supported by best available information and considering future expectations, while taking into account limitations and uncertainties; and
5. continually improved through learning and experience.

Section 4 - Roles and Responsibilities

Council

(6) Council holds overarching accountability for risk management and determines the University's appetite for risk.

Audit and Risk Management Committee

(7) The Audit and Risk Management Committee is responsible for:

1. oversight of the University's risk management activities; and
2. liaising with management in monitoring key risks and, where appropriate, reporting to Council to provide assurance concerning the management of risks within the University.

Vice-Chancellor

(8) The Vice-Chancellor is responsible for:

1. the overall risk management across the University;
2. assigning Executive Risk Leads for each risk in the University's Material Risk Register;
3. promoting an appropriate risk management culture across the University;
4. overseeing the allocation of resources to enable effective risk management; and
5. reporting key and emerging risks and highlighting significant changes to the risk exposure risks and their management to the Audit and Risk Management Committee and University Council.

The Vice Chancellor's Group

(9) The Vice Chancellor's Group have collective and individual accountability for the management of risks as Executives of the University. They are accountable for the oversight, implementation, management and embedding of the Enterprise Risk Management Framework across their portfolios, including:

1. setting the right 'tone from the top';
2. ensuring compliance with the Risk Appetite Statement, Enterprise Risk Management Framework and this Policy;
3. reviewing and managing exceptions to the Risk Appetite Statement, establishing and monitoring actions to bring risks within appetite, escalating material matters to the Audit and Risk Management Committee; and
4. regular identification, review and assessment of risks in achieving the University's strategic objectives and actions to manage the risk. Allocation of the right skills and resources to effectively implement the Enterprise Risk Management Framework through the University.

Academic Board

(10) The Academic Board is responsible for the oversight and monitoring of academic risks.

Material Risk Leads

(11) Material Risk Leads are responsible for managing the material risks for which they are accountable, including:

1. facilitating risk management processes;
2. approving major decisions that may affect the University's risk profile or exposure; and
3. assessing material risks against the University's risk appetite;
4. monitoring the effectiveness of risk controls and providing regular reporting; and
5. escalating where necessary to ensure there is sufficient support and resources to carry out appropriate risk management.

Heads of Work Units

(12) Heads of Work Units are responsible for:

1. identifying risks within their operational unit;
2. maintaining an operational risk register;
3. assessing the risks against the University's risk appetite and the effectiveness of controls in the work unit's risk register on a quarterly basis;
4. assigning a risk lead to each risk in their operational risk register;
5. escalating the management of any operational risks that cannot be sufficiently mitigated at the work unit to the relevant Executive Member;
6. managing business as usual operational risks; and
7. promoting an appropriate risk management culture within their areas of responsibility.

Project Managers/Leads

(13) Project Managers or Project Leads are responsible for:

1. incorporating risk management throughout the project life cycle;
2. identifying and managing material project risks and monitoring them throughout the life of the project; and
3. incorporate risk reporting into the project reporting processes.

Manager, Insurance and Risk

(14) The Manager, Insurance and Risk is reponsible for:

1. providing advice on risk management to the University community;
2. providing training and resources to develop staff capability in risk assessment and management processes; 
3. reviewing the Enterprise Risk Management Framework, associated business processes and resources following a strategic refresh or significant event; and
4. facilitating maintenance of the Material Enterprise Risk Register, Academic Risk Register and Educational Partnership Risk Register. 

All Staff

(15) All staff are required to familiarise themselves with the Enterprise Risk Management Framework and apply to their roles, as relevant.

Section 5 - Risk Reporting Requirements

(16) Risks are to be monitored and reported in accordance with the Enterprise Risk Management Framework.

Section 6 -  Associated documents

(17) This Policy should be read in conjunction with:

1. Enterprise Risk Management Framework
2. Work Health Safety Policy
3. Emergency and Crisis Management Policy
4. Emergency Procedures
5. Business Continuity Management Policy
6. Compliance Management Policy
7. Fraud and Corruption Prevention Policy
8. Treasury and Investment Policy
9. Academic Quality, Standards and Integrity Policy