Attachment 1 – Risk Consequence Criteria City of Stonnington - RISK CONSEQUENCE CRITERIA CONSEQUENCE CONSEQUENCE RATING Description Safety Financial Environmental Outrage & Media Regulatory Business Continuity INSIGNIFICANT • Effect is minimal No Treatment Applied • Up to $10k financial loss (.007% of Budget) • No detrimental environmental effect • Issue raised by residents and/or local press • Activity does not follow established industry standards • Business disruption, but no loss of service delivery MINOR • Event requiring moderate levels of resources and input • First-Aid Treatment Only • >$10 k - $50k financial loss (.037% of Budget) • Environmental discharge controlled, and of a minor nature • Resident and/or media concern/local media coverage • Activity does not follow "Best Practice" • service loss MODERATE • Significant with long reaching effect Medical treatment, Ambulance, or admission to hospital of less than 2 days • >$50 k - $500k financial loss (.37% of Budget) • Localised environmental impact, causing community annoyance, and requiring remedial action • Embarrassment for Council, including adverse coverage • Activity does not meet all of the requirements of the relevant Australian Standards • Productivity loss for up to 5 days MAJOR • Critical event Hospitalisation of more than 2 days, or long term injury or disability • >$500 k - $5 m financial loss (3.75% of Budget) • Long-term detrimental environmental or social impact • Reputation of Council severely affected in the long-term. • Activity does not meet all of the requirements of relevant legislation • Critical service loss for up to 1 month CATASTROPHIC • Disaster with potential to lead to collapse or to have a profound effect • Single or multiple fatalities • >$5 m financial loss (>3.75% of Budget) • Long-term environmental or social impact on community • Government intervention required • Activity does not meet any of the requirements of relevant legislation and Regulations • Loss of service for a critical period of time Consider the consequence for each category i.e.; Safety, Financial, Environmental, outrage and Media, Regulatory and Business Continuity. Determine the CONSEQUENCE RATING on overriding definition i.e.; “worst” (or highest) category.
Attachment 2 – Risk Controls Criteria City of Stonnington - RISK CRITERIA Measuring Risk: CONTROLS CONTROL RATING DESCRIPTION SYSTEM CONTROL/DESIGN CONTINGENCY PLAN INFORMATION SYSTEM Effectiveness of existing control measures Affects frequency of occurrence Reduces severity of consequence of an event Supports the action and capability for monitoring TOTALLY EFFECTIVE Significant control over the risk. Total confidence. Excellent system with total implementation. No variance in control quality. Total confidence in an effective plan. Fully tested and documented. Well proven data base, robust system, very user friendly. VERY EFFECTIVE Substantial reduction in risk. Improvements are possible. Very confident. Full system with effective implementation. Little or no variance in control quality. Very confident. Fully tested and documented. Mainly as above but improvements are possible. EFFECTIVE Satisfactory risk reduction. Improvements are possible. Quite confident. Satisfactorily implemented. Some variance in control quality. Just effective - open to some weaknesses. Not fully tested, quite good documentation. Mostly good but not yet robust. Some in supporting effective risk action. PARTIALLY EFFECTIVE Marginal risk reduction. Improvements should be considered. Moderately confident. Fair implementation only. Quite a degree of variance in performance. Not really effective plan. Not tested – open to substantial problems. Fair to poor database / performance in risk reduction. Not very user friendly. INEFFECTIVE Minimal risk reduction, if any. Improvements required. Not confident. Only partly introduced or no attempt. Substantial variance. No plan at all or very inadequate preparation. Very poor / inadequate / nonexistent. Process Consider the effectiveness of current controls when determining the three levels of risk. The rating given should be based on the lowest of control ratings applied.
Attachment 4 – Risk Matrix Consequence for Organisation Likelihood Insignificant Minor Moderate Major Catastrophic Almost Certain Moderate 11.00 High 16.00 High 20.00 Extreme 23.00 Extreme 25.00 Likely Moderate 7.00 Moderate 13.00 High 17.00 High 22.00 Extreme 24.00 Possible Low 4.00 Moderate 8.00 Moderate 15.00 High 19.00 High 21.00 Unlikely Low 2.00 Low 5.00 Moderate 9.00 Moderate 14.00 High 18.00 Rare Low 1.00 Low 3.00 Low 6.00 Moderate 10.00 Moderate 12.00 Attachment 5 – Risk Rating Definitions RISK CATEGORY Descriptor
Attachment 6 – Definition of Risk Status Definition of Risk Status Operational Risk which occurs in, hampers, or impacts upon an individual Division, Department, Service Unit or area of an organisation. Strategic Risk which will impact upon or hamper across the organisation its ability to operate or deliver its policy, strategy or services. Commercial Risk such as a failed contract or business relationship. Technical Risk such as failed equipment and managing assets. Financial & Systems Risk posed to Council’s financial systems and controls such as fraud. Compliance Risks to meeting regulatory obligations. Source: Managing Risk Across the Public Sector - Good Practice Guide – Auditor General Vic 2004 Document Control Version: 3.0 Date: 17 November 2015 Author: Manager, Risk Management & Contracts Compliance Risk, Coordinator QA: Business Support Officer Owner: Risk Management and Contracts Compliance Department Review Period: Annual Revision Details Date Update Details Reviewed QA Approved 18 2013 Adoption of Policy Risk Coordinator Manager, Risk Management & Contracts Compliance Council
23 September 2014 Annual administrative review of document and insertion of Internal Audit recommendations regarding Risk Tolerance and the roles of the Audit Committee and EMT. Risk Coordinator Manager, Risk Management & Contracts Compliance Executive Officer 17 November 2015 Annual administrative review. Risk Coordinator Manager, Risk Management & Contracts Compliance Chief Executive Officer