EXPLANATORY STATEMENT
Issued by the authority of the Minister for Financial Services and Superannuation
National Disability Insurance Scheme Act 2013
National Disability Insurance Scheme—Risk Management Rules 2013
Section 125B of the National Disability Insurance Scheme Act 2013 (‘the NDIS Act’) provides that the Minister administering the Insurance Act 1973 may determine rules that:
• relate to the management of risks, whether financial or not, that are likely to be faced by the DisabilityCare Australia Agency (‘the Agency’); and
• must be complied with by DisabilityCare Australia’s Board of Directors (‘the Board’).
The Minister for Financial Services and Superannuation is the Minister administering the Insurance Act 1973 and therefore has the authority to determine these rules.
The purpose of these rules is to support members of the Board to satisfy their obligations under the Commonwealth Authorities and Companies Act 1997 and the NDIS Act and support the long-term financial sustainability of DisabilityCare Australia. In particular, the rules require the Board to ensure there is a risk management framework which is documented in a risk management strategy and operationalised through the risk management function. The risk management declaration ensures that the Board remains accountable for its risk management responsibilities.
These rules embed insurance-based principles in the management of the scheme to ensure the Agency and Board regularly assess and monitor the scheme’s liabilities and performance and have the capacity to respond to emerging risks. The rules establish a strong financial and risk management framework in the Agency to ensure that its risks are prudently and soundly managed.
Commencement
The rules commence on 1 July 2013, unless they are registered on or after this date, in which case they commence on the day after they are registered.
Consultation
The States and Territories were consulted before the Minister determined the rules, but formal agreement was not sought as it is not required under the NDIS Act. The following were also consulted:
• the Australian Prudential Regulation Authority;
• the Chief Executive Officer, Chair and Board member of DisabilityCare Australia
• the Department of Finance and Deregulation; and
• the Australian Government Actuary.
Explanation of provisions
The rules have five Parts:
• Part 1 is the preliminaries.
• Part 2 outlines the general responsibilities of the Board.
• Part 3 deals with the risk management framework and strategy.
• Part 4 deals with the risk management function.
• Part 5 explains the risk management declaration.
Part 1 Preliminary
Section 1 provides the name of these rules.
Section 2 provides that the rules are to commence on 1 July 2013, unless they are registered on or after this date, in which case they commence on the day after they are registered.
Section 3 provides definitions for terms in these rules.
Part 2 General responsibilities of the Board
This Part provides a description of the role of the Board in relation to the management of risks.
Subsection 4(1) provides the obligations of the Board regarding the management of risks. This includes responsibility for preparing a risk management strategy and ensuring that the Agency has an appropriate risk management culture. The Board must ensure that the Agency takes the necessary steps to monitor, control and effectively manage risks including establishing an appropriate operational structure and developing policies and processes consistent with the risk management strategy.
Subsection 4(2) provides that the Board must ensure the scheme actuary, within his or her scope of duties as specified in the NDIS Act and the National Disability Insurance Scheme—Rules for the Scheme Actuary 2013, is involved in decisions made by the Agency and Board which relate to risk.
Part 3 Risk management framework and risk management strategy
This Part provides that the Board must establish, maintain and review the risk management framework. Key elements of the risk management framework include:
• a written risk management strategy;
• policies and procedures to identify, assess, monitor, report on and mitigate all material risks, whether financial or not, that are likely to be faced by the Agency;
• clearly defined managerial responsibilities and controls in relation to risk; and
• a review process to ensure that the risk management framework is effective in identifying, measuring, evaluating, monitoring, reporting, and controlling or mitigating, material risks.
This Part also outlines the types of material risks that the risk management framework must address and the requirements of the risk management strategy.
The Board may have regard to the International Organization for Standardization’s ISO 31000:2009 Risk management – Principles and guidelines document when performing its duties in Part 3.
Subsections 5(1) and 5(2) provide that the Board is responsible for the risk management framework of the Agency including ensuring that the Agency always has a risk management framework that provides reasonable assurance that its risks are prudently and soundly managed.
Subsection 5(3) provides that the risk management framework is the totality of systems, structures, policies, processes and people within the Agency that identify, assess, mitigate and monitor all internal and external sources of risk that could have an impact on the Agency’s operations, funding and financial sustainability.
Subsection 5(4) provides the requirements of the risk management framework including: a written risk management strategy; policies and procedures to identify, assess, monitor, report on and mitigate all material risks likely to be faced by the Agency; clearly defining managerial responsibilities and controls; and a process to review the effectiveness of the framework.
Section 6 explains the types of material risks relevant to the Agency that the risk management framework must address, including operational and financial sustainability risks. This could also include non-financial risks, such as consistent application of access criteria.
Subsection 7(1) outlines that the Board must ensure that its risk management framework is subject to effective and comprehensive review by operationally independent, appropriately trained and competent persons. The frequency and scope of such reviews must have regard to the size and complexity of the Agency’s operations.
Subsection 7(2) defines ‘operationally independent’ which is an eligibility requirement listed under subsection 7(1) for reviewers of the risk management framework.
Subsection 7(3) provides that a review of the risk management framework must include the risk management function, risk management strategy, and the Agency’s controls and procedures in relation to risk.
Section 8 sets out the requirements of the risk management strategy. The risk management strategy is a high level, strategic document intended to describe the key elements of the risk management framework.
Subsection 8(1) provides the requirements of the risk management strategy such as: a description of the risk governance relationship between the Board, committees of the Board and the Agency’s senior management; an outline of the processes of the Agency to manage risk issues; ensuring that Agency staff develop an appropriate risk culture and have access to the risk management strategy; identifying persons and positions in the Agency responsible for risk management; and a description of a process to review the framework.
Subsection 8(2) provides the process for amending the risk management strategy including seeking approval by the Ministerial Council as defined in section 9 of the NDIS Act. The relevant Ministerial Council is the Standing Council on Disability Reform.
Subsection 8(3) provides that the risk management strategy must be reviewed at least annually.
Part 4 Risk management function
This Part outlines the requirements for the Agency in setting up its risk management function and the role that the risk management function performs.
Section 9 provides that the Board must designate a part of the Agency or a person in the Agency to perform the risk management function. It outlines the responsibilities of those carrying out the risk management function such as assisting with the development and maintenance of the risk management framework and notifying the Board of any significant breach of, or material deviation from, the risk management framework.
To effectively carry out its activities in an effective and independent manner, the designated person or persons must be conferred with the authority and access to the Board, committees of the Board and senior management of the Agency.
The person or persons must also be appropriately supported or resourced with staff who have suitable qualifications, experience and expertise to effectively carry out the risk management function.
To avoid significant conflicts of interest, the person or persons must not directly be involved in the Agency’s functions of funding or provision of supports. For example, the Board could request the Agency to establish a risk management team to be led by a qualified and experienced person who has authority to raise concerns with the Board at any time considered necessary by that person. Staff who are Local Area Coordinators or approving care and support packages cannot be members of the team responsible for the risk management function.
Part 5 Risk management declaration
This Part outlines the process for the preparation and content of the risk management declaration.
Subsection 10(1) sets out that the Board must provide the Ministerial Council, as defined in section 9 of the NDIS Act, with a risk management declaration signed by two directors at the end of each financial year. The relevant Ministerial Council is the Standing Council on Disability Reform.
Subsection 10(2) explains that the declaration should state that, to the best of the Board’s knowledge, having made appropriate enquiries:
• the Agency has systems in place for ensuring compliance with the NDIS Act and the Commonwealth Authorities and Companies Act 1997;
• the Board and senior management are satisfied with the efficacy of the processes and systems surrounding the production of financial information at the Agency;
• the Board has in place a risk management strategy that complies with the requirements of these rules;
• the Agency (including the Board) has, throughout the relevant financial year, substantially complied with the risk management strategy;
• the risk management strategy is operating effectively; and
• the risk management strategy in its present form has been submitted to and approved by the Ministerial Council. The relevant Ministerial Council is the Standing Council on Disability Reform.
Section 11 provides that the Board may qualify a risk management declaration and that the qualification must describe the circumstances giving rise to the qualification, any contravention of the Board’s obligations under the NDIS Act or these rules and the steps taken, or proposed to be taken, to remedy the circumstances giving rise to the qualification.
Regulation Impact Statement
The Office of Best Practice Regulation has advised that a Regulation Impact Statement is not required as the rules have a minor impact on business and the not-for-profit sector.
Statement of Compatibility with Human Rights
Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011
This Legislative Instrument does not engage any of the applicable rights or freedoms. This Legislative Instrument is compatible with human rights as it does not raise any human rights issues.