C.1 Risk Management and Internal Audit

Risk Management

In accordance with the requirements of the ACT Government Enterprise-Wide Risk Management Framework, and as part of its overall governance framework, the Directorate has in place:

• an overarching Risk Management Policy setting the context for integrating risk management into all aspects of the Directorate's activities and processes;
• a Risk Management Framework that outlines risk management practices and responsibilities for risk management implementation, business continuity processes and fraud and corruption prevention across the Directorate; and
• a Risk Analysis and Treatment Strategies document that identifies the key Directorate risks, their sources, impacts and current mitigation strategies.

These documents were reviewed following the November 2012 Administrative Arrangements to assess the effect of changes to the Directorate's structure, responsibilities and operating environment arising from the inclusion of staff and functions from the former Treasury Directorate, including the Injury Management and Safety Unit from Shared Services.

The Director-General has endorsed the new suite of Risk Management documents, and these are available to staff through the Directorate's intranet.

The Executive Management Group undertakes monitoring of the Directorate's risk assessment and treatment strategies.  The Audit and Risk Committee also regularly reviews the Directorate's approach to setting an appropriate control and risk management environment.

The Director, Corporate Management, is the Senior Executive Responsible for Business Integrity Risk (SERBIR) and responsible for the reporting of risk under the Risk Management Framework.

Further information can be obtained from:

Sue Hall
Director
Corporate Management
+61 2 6207 0569

Internal Audit

Internal Audit is an independent assurance and consulting activity that reviews and evaluates the effectiveness of the Directorate's risk management, internal control, and governance practices.  From 1 July to 9 November 2012, the results of the (then) Chief Minister and Cabinet Directorate Internal Audit function were reported through the joint CMCD/Treasury Directorate Audit and Risk Committee to the Directors-General.

Following the Administrative Arrangements of 9 November 2012 (the AAs), the results of CMTD's Internal Audit function are reported through the CMTD Audit and Risk Committee (the Committee) to the Director-General.  The Committee's functions are governed by the CMTD Audit and Risk Committee Charter.

Following the AAs, the Committee comprised an Independent Chair and four members:  three executives from CMTD and one executive from another ACT Government directorate.  Alternate members have also been appointed to attend meetings in the absence of members, as required.  The Chief Finance Officer and representatives from the Auditor-General's Office are also invited to attend meetings as observers, with the SERBIR and the Director, Accounting Branch, being invited as required.  The Director-General has a standing invitation to attend Committee meetings.

The objective of the Committee is to provide independent assurance and assistance to the Director-General on the Directorate's risk, control and compliance framework, and its external accountability responsibilities.

The Committee, in fulfilling its objectives, assists the Director-General in the discharge of his/her responsibilities for:  exercising due care, diligence and skill in relation to the Directorate's reporting of financial information, application of accounting policies, adequacy of internal controls, financial and risk management (including occupational health and safety risks), and compliance with applicable laws.

Internal audits are outsourced to members of the ACT Government Internal Audit Services Panel.  Internal audits to be conducted for CMTD are selected from a work program that is revised annually and approved by the Director-General.  The Committee monitors action taken by CMTD to implement all audit report recommendations.

Internal audits completed during the year include reviews of:

• the Insurance Claims Database;
• Centenary of Canberra – High Level Review of Project Management;
• Travel/Cabcharge;
• Classification and Storage of Records – Official Paper Records and Electronic Records;
• Credit Cards;
• Compulsory Third-Party Insurance Scheme; and
• Taxation Compliance.

Internal audits commenced during the year, but not complete as at 30 June 2013, include reviews of the following:

• Acceptance of Gifts or Hospitality;
• Leave Management;
• Recruitment and Contractors;
• Employee Benefits, including Superannuation; and
• Website Accessibility and Compliance.

The Audit and Risk Committee held 14 meetings during the year.  The number of meetings attended by Committee members and observers is as follows:

Further information can be obtained from:

David Morgan
Internal Audit Manager
+61 2 6207 6367