!!"# $ % & ' ( ( )!! (! * + $,,

Transcription

1 !!"# $ % & ' ( ( )!!(!* + $,,

2 &, ),,,,! % ) + ( " ( " (! -. /

3 !(!#!(0#!(1#!(+#!(*#!(2#

4 Risk Policy & Procedure Sample Only Purpose and Scope: This procedure describes the process for risk management and provides a generic procedure for assessing risk w ithin ABC Education. It describes how risk management is linked to other compliance activities including the standards for managing risk in the Australian Quality Training Framew ork (AQTF), the international standard for quality management systems (ISO9001: 2000), and the requirements under the OH&S Act (2000), its associated Regulations (2001) and other Australian Standards. Policy: ABC Education is committed to complying w ith legislative requirements on risk management as part of a cycle of continuous improvement so as to ensure a safe workplace and quality training outcomes. As required by ANTA and outlined in the AQTF, ABC Education must: include documented procedures to identify and manage risks concerned with compliance with the Standards for Registered Training Organisations and to correct and prevent any failure to comply with the Standards and the RTO s quality system, policies or procedures. (Standard 1.8) Further, the NSW OH&S Act (2000) requires that a risk management strategy be implemented to ensure compliance. The Australian standard for risk management AS/NZ 4360 (1999) is the framew ork used by ABC Education. This approach ensures consistency in identification, analysis, reporting and updating of risk issues. Figure 1 - Source: Australian/New Zealand Risk Management Standard AS/NZS4360 (1999)

5 Responsibilities: 1. The Quality Management Group (QMG) has organisational responsibility for the effective implementation of risk management related to all organisational activity. 2. Faculty and Support Unit Managers are responsible for assessing risks against their business plan, putting the procedure into operation and monitoring and following up on control plans. Definitions: Risk Management The practice of systematically identifying and evaluating any threats to the organisation; establishing priorities for action and making decisions about w hich risk control measures need to be implemented. Generic Procedure: At the beginning of the planning cycle, Faculties and Support Units prepare and document business plans. These are to take into account the level of risk involved in plan associated activities, together w ith the mitigation strategies to be implemented where the level of risk is assessed as being too high. When and how risk is assessed for all major business activities is to be documented w ithin the business plan (refer to the organisation s Self Assessment Guide for Functional Units available from the Educational Developments Unit). An approach based on the AS/NZ 4360 is to be used. Faculties and Institute Support Units are therefore to assess risk by: 1. Establishing the unit/section objectives. 2. Identifying major activities needed to reach the objectives. 3. Identifying and analysing the risks associated w ith each activity. 4. Evaluating and ranking the risks. 5. Identifying the current risk control measures. 6. Rating the current risk control measures. 7. Determining the current risk. 8. Controlling unacceptable risk through mitigation strategies. Once major activities are their risks are identified, all effected stakeholders are to be included in the consultation process around the assessment of the risk. Where risk is assessed as EXTREME of HIGH, existing and potential control measures should be established and a reassessment undertaken. Treatment options are to be applied to the extent that a LOW or MEDIUM risk level can be gained and maintained

6 Applying controls Hard controls may include document trails, reconciliation, physical control over assets, authority for approvals etc. Soft controls may include ethics, competence, culture, communication, leadership, integrity etc. The effectiveness of a control should be rated in a subsequent risk assessment. Effectiveness may be rated as: Poor control is not addressing the risk (High risk level is not changing) Fair control is addressing the risk, but is not considered effective Good control effective in addressing risk (risk level is considered acceptable) Before employing regulatory instruments as a hard control refer to the document Principles for the use of regulatory instruments in organisations issued by ABC Education Legal Branch. This gives guidance on w hen a regulatory instrument is appropriate. Where extensive controls are in place for an activity assessed as low risk, consideration should be given to risk managing instead of continuing to control it. This frees up organisational resources. Where the final assessment is still EXTREME or HIGH, the Educational Developments, Corporate Services or Human Resources Manager should be contacted and an alternative treatment strategy considered such as outsourcing. A more detailed guide titled Implementing the Management of Risk is available to support the methodology behind this approach. It can be dow nloaded from ABC Education s Intranet at Generic Form: Appendix 1 provides a generic Risk Assessment Worksheet that provides evidence of assessment w ithin a structured format. Compliance to AQTF: NB - The follow ing provides a specific example of the implementation of risk management in the area of the AQTF. The generic procedure is as applicable here as it w ould be in terms of OH&S, financial systems and other compliance standards management. The Risk Management procedure outlined in the Risk Management Policy w ill be used to identify and manage the risks associated w ith compliance w ith the AQTF standards for Registered Training Organisations (RTO s). Annually the Educational Development Unit w ill analyse ABC Education s risk in adhering to the AQTF standards for RTO s. A number of sources w ill be utilised to do this. This includes but is not limited to: National Key Risk Areas identified by ANTA State priorities identified by VETAB from the National Key Risk Areas State sources for identifying risks Results from Internal Audits Analysis of Customer Suggestions & Complaints Analysis of surveys conducted including staff and student surveys

7 Analysis of staff suggestions Once this Risk Assessment has been conducted and appropriate controls implemented, a copy of the business unit risk plan is to be provided to the Educational Developments Manager for endorsement. On an ongoing basis, the Educational Developments, Corporate Services and the Human Resources Manager will monitor the risks associated w ith AQTF and legislative compliance from a variety of inputs including but not limited to: Internal Audits Staff Suggestions Customer complaints Ministerials OH&S Committees Appropriate legislation and licensing. Review This policy w as endorsed on January 1, 2003 and is due for review by December 19, Appendices Appendix 1 - Risk Assessment Template. Appendix 2 - AQTF National Risk Management Approach Appendix 3 - National Key Risk Areas (KRA s) Appendix 4 - State and Territory Sources for Identifying Risk

8 APPENDIX 1 - RISK ASSESSMENT WORKSHEET Business Objective: Ref. Risk Risk Description Assessment Before Controls (L) (C) Level of Risk Accept Risk Y/N Existing Control Description Assessment After Controls (L) (C) Controlled Risk Accept Risk Y/N Control Rating Treatment Major Process Steps:

9

10 Appendix 2 - AQTF National Risk Management Approach Preamble Unacceptable levels of risk may expose the national vocational education and training (VET) system to significant financial, legal, social and/or political consequences. To ensure individuals in receipt of training and assessment services in the VET sector are protected and assured of quality outcomes, national key risk areas have been identified by the States and Territories. These will be incorporated into the existing State and Territory risk management processes for targeting and scheduling audits of registered training organisations (RTO s). A national key risk area (KRA) may not assume the same priority in each jurisdiction due to demographics, policy priorities and social and economic variability. Therefore, States and Territories will select from these based on importance to their jurisdiction, for inclusion in their 12 month audit schedule. The national key risk areas will be reviewed and updated annually by the National Training Quality Council (NTQC). In doing so, they will consider which national key risk areas were selected by States and Territories, those not selected and the reasons for those decisions, along with the need for variations, inclusions and deletions to the listing of national key risk areas. States and Territories could advise the NTQC on priorities or emerging risks through the 12 month audit schedule. In States and Territories advice to the NTQC, there will also be an opportunity to share generic best practice information in both State and Territory audit practices and RTO business practices, as part of the continuous improvement process to ensure continued quality training outcomes in the VET sector. The AQTF National Risk Management Approach will ensure national consistency in the identification, analysis, reporting and updating of risk issues in accordance with the Risk Management Standard AS/NZS 4360 (1999). National consistency in risk management will be further enhanced by the application of the AQTF s Evidence Guide for Registered Training Organisations and Auditors as a risk mitigation and control tool. Audit activities are one part of a continuous improvement cycle to ensure quality training outcomes in the VET sector. Audit activities have the potential to inform RTO s about possible risks associated with their business, encourage self correction and treatment, provide quality guidance and generic information sharing on best practice and highlight the need for additional support and guidance in obtaining and maintaining compliance with the AQTF s standards for RTO s. Page 10 of 19 Page 10 of 19

11 Appendix 3 - National Key Risk Areas (KRA s) KRA1 High number and/or seriousness of verified complaints against RTOs RTO s facing a high number of and/or seriousness of verified complaints present a high risk to the integrity of the VET system and need careful monitoring. Particular risks are associated with: appropriate policies and procedures; timeliness in dealing with complaints and transparent and fair processe s. KRA2 Potentially dangerous environments and industries RTO s operating in potentially dangerous environments and industries have special requirements with: identifying the OH&S issues; informing and training staff and students about OH&S; understanding and managing the impact of OH&S requirements. KRA3 Delivery of Assessment & Workplace Training qualification (Certificate IV) RTO s delivering the qualification (integral to the Australian Quality Training Framework (AQTF) and every Training Package) face particular risks associated with: the qualifications of the trainers and asse ssors the quality of training delivery; and the robustness of the assessment. KRA4 Multi-site delivery (including off-shore) RTO s operating across more than one site and/or off-shore have particular risks associated with maintaining quality and consistency: when operating in more than one jurisdiction; where management and operations are diversified and decentralised. KRA5 Delivery and assessment of Training Packages and other AQF qualifications in new and emerging industries RTO s delivering training in new and emerging industries have little or no benchmarking data by which to verify: the currency of the qualifications and competencies of the trainers and asse ssors and determine professional development needs; the quality of training delivery; the robustness of the assessment; whether the training meets the needs of new Page 11 of 19 Page 11 of 19

12 and emerging industries; the status of the qualification in the industry with respect to whether or not additional training is required. KRA6 Delivery of training where training is not core business RTO s delivering training where training is not core business have particular risks associated with: the currency of the qualifications of the trainers and assessors; the quality of training delivery; the robustness of the assessment; the nature and quality of the supervision; the nature and quality of any partnership arrangements; the commitment of corporate management to the deployment of adequate resources (ie time, personnel, facilities, budget) to training delivery and assessment; the ethical management and transparency of multiple roles (eg schools and Group Training Companies). KRA7 Delivery by exclusive pathways There are particular risks where apprenticeships/traineeships are delivered fully on-the-job in a way that the structured learning component is not explicit, or alternatively, where the pathway to a particular occupational outcome is fully institutionally based with no real workplace component. For fully on-the-job pathways, RTO s have particular risks associated with: the qualifications of trainers and assessors; the quality of training delivery; the robustness of the assessment; the nature and quality of any partnership arrangements; and the nature and quality of the supervision. For fully institutional pathways the RTO has risks associated with relevance to current industry practice, adequacy of skill development opportunities, access to current equipment and facilities and currency of vocational competencies of trainers and assessors. KRA8 Introduction of (or significant expansion of) structured training into established industries RTO s delivering training in industries that have not previously had structured training have particular risks a ssociated with: the currency of the qualifications of the trainers and assessors; the quality of training delivery; the robustness of the asse ssment; the adequacy of the infrastructure to manage significant expansion of structured training; and understanding enterprise and industry training requirements. Page 12 of 19 Page 12 of 19

13 KRA9 Extreme variations in training effort by RTO s delivering the same or similar qualifications In a competency-based environment, the training effort may vary for the same or similar qualifications. RTO s with extreme variations in training effort for the same or similar qualifications, compared to that of other RTO s with similar client groups, may have particular risks a ssociated with the quality of training delivery and the consistency of outcomes. Interface Risk Areas: Where these issues interface with the AQTF s Standards for Registered Training Organisations, any risks must be identified, as a result of the interface. The following key risk areas are interface areas: KRA10 Introduction of new or changed external regulatory/licensing standards which may affect Training Package delivery RTO s operating where there are changes in external regulatory/licensing standards (eg Information Technology, Aged Care) which may affect Training Package delivery have particular risk a ssociated with: identifying new or changed regulations or licences; informing appropriate persons; understanding and managing the impacts of the new requirements on Training Package delivery. KRA11 Priority interface areas as defined by State/Territory (e.g. providers in receipt of government funds, poor AVETMISS returns, particular courses /qualifications) RTO s delivering training in priority areas as defined by the State/Territory are required to manage the risks associated with those defined areas. States and Territories may have particular priorities which contain inherent levels of associated risk. Appendix 4 - State and Territory Sources for Identifying Risk The following list provides a range of sources that States and Territories could use to identify risks associated with an RTO s performance. Complaints AVETMISS returns Contract management information Strategic industry audits (internal/external) Audit patterns derived from local audits Newspapers/advertising/training program promotional material Inter-government/inter-departmental Page 13 of 19 Page 13 of 19

14 legislation, forums, committees Industry training plans Research (NCVER etc) Size/change of scope Extreme variations in advertised program duration Regulated training data Field officer reports Group training data supplied by managers or media Company searches Annual internal audits Annual financial returns Student satisfaction surveys Employer surveys Stakeholder feedback Industry bodies/training plans Page 14 of 19 Page 14 of 19

15 Organisational Risk Audit - Template Area of risk Sub Areas Risk Lev el of impact Stakeholder/s Risk Priority Page 15 of 19 Page 15 of 19

16 Page 16 of 19 Page 16 of 19

17 Page 17 of 19 Page 17 of 19

18 Page 18 of 19 Page 18 of 19

19 Progress Report - Example Page 19 of 19