Risk Management Policy

Purpose

The purpose of this policy is to outline the approach of Alphacrucis University College (AC) to risk management in all academic, administrative and business activities of AC.

Scope

Whole of AC

Policy

AC is committed to appropriate, consistent, structured and effective risk management processes. The International Standard on Risk Management AS/NZS ISO 31000:2009 defines risk as “the effect of uncertainty on objectives” and risk management as “coordinated activities to direct and control an organization with regard to risk”. AC manages risk continuously and methodically, involving assessment, monitoring, mitigation and review of risks. The AC Risk Management Plan covers all academic and financial activities of AC and fosters an environment where staff assume responsibility for continuous improvement.

PRINCIPLES

Corporate Governance and Risk Management

• Finance and Audit Committee is responsible for oversight, maintenance and regular review of the financial risks of AC as defined in the AC Risk Management Plan. Academic Risk and Moderation Committee is responsible for oversight, maintenance and regular review of the academic risks of AC as defined in the AC Risk Management Plan.
• Current and emerging risks will be incorporated into the AC Risk Management Plan as they are identified and reported.
• The Chair of Finance and Audit Committee will report on financial risk issues to Council, and the Chair of Academic Risk and Moderation Committee will report on academic risk issues to Council.
• Senior staff members are accountable for: risk management in their respective areas of responsibility and ensuring compliance with risk assessment procedures.
• Risk management includes communication and reporting on risks that have been identified, as well as risk analysis, evaluation and mitigation options.

Monitoring and Review of Risks

• The AC Risk Management Plan provides formal mechanisms for monitoring and reviewing risk to benchmark the effectiveness of risk management throughout AC and at all governance and management levels.
• While risks may never be eradicated, they can be mitigated and controlled. AC employs the following tables to identify Risk Mitigation Strategies and Control Effectiveness:

Risk Mitigation Strategies
The following table is used when identifying and determining Risk Mitigation strategies:

Strategy	Detail
Avoidance	Not proceeding with task, project or activity that is likely to generate the risk
Acceptance	Accept risk and establish appropriate management plan
Reducing Likelihood	Develop processes to reduce likelihood of risk, e.g. preventative maintenance, audits, inspection and testing
Reducing Consequence	Develop processes to reduce consequence of risk. e.g. Contractual arrangements, redesign, security measures, contingency planning
Transfer	Transfer all or part of risk to second party through insurance, contractual arrangements, organisational structures
Retention	Accept all residual risk

 

Control Effectiveness
The following table is used when determining Control Effectiveness:

Score	Rating	Description
5	Highly Ineffective	Controls are non-existent or have major deficiencies and don’t operate as intended
4	Ineffective	Limited controls in place, high level of risk remains
3	Significant Improvement Required	Key controls in place, with significant opportunities for improvement identified
2	Limited Improvement Required	Controls properly designed and operating, with opportunities for improvement identified
1	Effective	Controls properly designed and operating as intended

 

The Risk Mitigation Strategy and Control Effectiveness rating relevant to each identified risk are recorded in the Risk Management Plan.

---

Procedures

Risk Management Procedures

---