View Current

Risk Management Policy

This is the current version of this document. To view historic versions, click the link in the document's navigation bar.

Section 1 - Purpose and Context

(1) Western Sydney University is committed to promoting a risk-aware culture that enables transparency, accountability and informed decision-making.

(2) Effective risk management supports the delivery of the University's objectives, including excellence in learning, teaching and research, a positive student experience, financial sustainability and strong operational performance. It also strengthens organisational resilience and the University's capacity to anticipate, to respond to and adapt to change.

(3) The purpose of this Policy is to:

define the University's Risk Management Framework
confirm the University's commitment to promoting a risk-aware culture
define roles, responsibilities and accountabilities for risk management
establish minimum requirements for embedding risk management practices within operations.

(4) This Policy is aligned with ISO 31000:2018 Risk Management - Guidelines.

Policy Application

(5) This policy applies to:

the University and its Controlled Entities, and to its staff and affiliates
all activities conducted by, or on behalf of, the University and its Controlled Entities, both in Australia and internationally.

(6) All risk-related frameworks, procedures and registers must align with this Policy and the University's Risk Management Framework.

Top of Page

Section 2 - Policy Statement

Risk Management Framework

(7) The Risk Management Framework sets out the University's approach to managing risk across its activities and operations. It defines the processes for identifying, analysing, evaluating and treating risks, and for monitoring, communicating and reporting risk in a structured and consistent manner.

(8) The Framework establishes clear accountabilities for risk ownership and supports informed decision-making, a safe learning and working environment, and compliance with legislative and regulatory requirements.

(9) The University's Risk Management Framework comprises:

the Risk Management Policy, which sets expectations and minimum requirements for managing risk across the University
the Risk Appetite Statement, approved by the Board of Trustees, which defines the level and type of risk the University is prepared to accept in pursuing its strategic and operational objectives
the Enterprise Risk Register, which documents the University's most significant strategic, major operational and emerging risks, and provides the basis for executive and governance oversight
the Risk Assessment Matrix, which sets out the University's criteria and processes for assessing risk, including the rating scales used to determine overall risk levels
the Risk Management Handbook, which provides practical guidance on undertaking risk assessment and applying consistent risk management practices at the University
Operational Risk Registers maintained by Faculties, Schools, Divisions and Controlled Entities to support the identification and management of operational risks
risk tools and systems, including approved templates and the Governance, Risk and Control System, to enable consistent, accurate and timely risk assessment, monitoring and reporting.

(10) Controlled Entities must consult with the Risk Team, as required, to develop and maintain entity-specific artefacts that are aligned with the University's Risk Management Policy and broader Risk Management Framework.

Risk Management Principles

(11) Western Sydney University applies the following principles to embed risk management into all University activities and decision-making:

Integrated: Risk management is incorporated into governance, strategy, planning, learning, teaching, research, operations and major decisions across the University.
Structured and comprehensive: A clear and consistent approach supports the identification, assessment, management and monitoring of risks across the University and its Controlled Entities.
Customised: Risk management is tailored to the University's size, complexity, operating environment and strategic context.
Inclusive: Risk management processes involve appropriate consultation and engagement with relevant stakeholders and subject matter experts, including students where relevant.
Dynamic: Risks and controls are reviewed regularly to reflect changes in the internal and external environment, including emerging risks.
Uses the best available information: Risk management is informed by reliable, timely and relevant information. This includes internal monitoring and review activities, professional judgement, external benchmarking and applicable legislative and regulatory obligations. Decisions are made on an evidence-based and defensible basis.
Considers human and cultural factors: The University promotes a risk-aware culture that supports transparency, accountability and timely escalation of issues.
Continual improvement: Risk management practices and controls are reviewed to ensure ongoing effectiveness. Lessons learned, assurance activities and sector better practice inform continuous improvement.

Western Sydney University Leadership Commitment to Risk Management

(12) The University's leadership is committed to an integrated and mature approach to risk management that supports strong governance and effective oversight.

(13) The Board of Trustees, Boards of Controlled Entities and their senior leadership demonstrate this commitment by:

modelling and reinforcing the behavioural standards set out in the University's Code of Conduct or the relevant Controlled Entity Code of Conduct
setting clear expectations for a risk-aware culture that promotes transparency, accountability and ethical conduct
integrating risk management into strategic planning, resource allocation and major organisational decisions
ensuring appropriate governance structures and supporting systems are in place that enable effective risk management and accountable risk ownership
promoting coordinated oversight through effective engagement between management, the Risk Team and Internal Audit
upholding the independence and objectivity of the Risk and Internal Audit functions
regularly reviewing the effectiveness of the Risk Management Framework and supporting ongoing improvement.

(14) The University engages with regulators, sector bodies and external experts to ensure its governance and risk management approach remains aligned with legislative obligations and sector standards.

Top of Page

Section 3 - Procedures

Roles and Responsibilities

(15) Risk management at the University and its Controlled Entities operates using a Three Lines of Accountability approach, which promotes accountability for risk ownership, oversight and independent assurance within the risk appetite approved by the Board of Trustees.

(16) Risk owners are accountable for ensuring that risks within their area of responsibility are clearly defined, assessed, controlled and monitored, and that treatment actions are implemented, reviewed and reported in line with the Risk Management Framework.

(17) Detailed roles and responsibilities are set out in Section 4 – Risk Management Lines of Accountability and Roles and Responsibilities.

Reporting and Escalation

(18) The Enterprise Risk Register, including strategic, major operational and emerging risks, is reported quarterly by the Risk Team to the Audit and Risk Committee and, through the Audit and Risk Committee, to the Board of Trustees to support effective oversight of the University's key risks.

(19) Staff must promptly escalate the following to the Vice-Chancellor and President and the Chief Audit and Risk Officer:

critical risk or risk trending towards critical
risk operating outside the University's Risk Appetite Statement
risk accepted within delegations, or any incident or issue, that may materially affect the University's objectives, reputation or compliance obligations
material control deficiencies or failure identified through monitoring, assurance or operational activities
significant near miss or event that could reasonably have resulted in a material impact had circumstances been slightly different.

(20) Risks relating to Controlled Entities are reported to the relevant Controlled Entity Board or Board Committee and to the University's Audit and Risk Committee where material to the University.

(21) Material changes arising from emerging or developing risks are reported to regulators in accordance with legislative and regulatory requirements and within statutory timeframes.

Review

(22) The effectiveness of the University's risk management arrangements is supported through:

an annual review of the Risk Appetite Statement by the Board of Trustees
an independent external review of the Risk Management Framework at least every five years.

Top of Page

Section 4 - Risk Management Lines of Accountability and Roles and Responsibilities

Role	Risk Management Responsibility
Governance and Oversight: The Board of Trustees and its Committees oversee risk management and assurance arrangements in accordance with their respective Charters.
Board of Trustees	Provides overall oversight of risk management in accordance with the Western Sydney University Act 1997 (NSW) and the Board of Trustees Charter.
Audit and Risk Committee	Supports the Board in overseeing audit, risk management and compliance in accordance with the Audit and Risk Committee Charter, including review of major risks relating to Controlled Entities.
Controlled Entity Boards	Oversee risk management within their respective Controlled Entities in accordance with their governing documents and Board Charters, including review and monitoring of material risks.
Academic Senate	Oversees academic risk and standards, including assurance of teaching, learning, research and research training, in accordance with the Academic Senate Charter.
Finance and Investment Committee	Monitors treasury, investment and infrastructure-related financial risks within its delegated authority in accordance with the Finance and Investment Committee Charter.
First Line – Management and Staff: Management and staff are accountable for identifying, assessing and managing risks within their areas of responsibility, and for escalating material risks in accordance with the Risk Management Framework.
Vice-Chancellor and President	Provides executive leadership of risk management, promotes a strong risk culture, ensures appropriate capability and resourcing, and escalates High and Critical risks to the Board as required.
University and Controlled Entity Executive Leadership	Implements the Risk Management Framework within their areas of responsibility and ensures risk management is integrated into strategy, planning and decision-making across the University and its Controlled Entities. Key responsibilities include: modelling and reinforcing a strong and accountable risk culture operating within the approved Risk Appetite Statement owning risks within their portfolios and ensuring effective controls are designed, implemented and maintained integrating risk considerations into planning, budgeting, investment decisions and major strategic initiatives ensuring risk assessments accompany major proposals reviewing strategic, operational and emerging risks regularly monitoring mitigation actions and implementing agreed assurance outcomes escalating material risks in accordance with this Policy ensuring appropriate staff capability and training in risk management.
All Staff and Affiliates	Manage risks within the scope of their roles and delegations and support a risk-aware culture by applying the University’s risk management requirements in their daily work. All staff and affiliates must: comply with this Policy, the Risk Management Framework, the Code of Conduct and applicable ethical, safety, regulatory and data governance requirements identify, assess and manage risks associated with their roles, activities and projects complete risk assessments for significant decisions and initiatives, where required monitor, report and escalate material risks, incidents or concerns in accordance with escalation requirements use approved risk tools, templates and systems and maintain accurate risk information relevant to their area of responsibility seek advice from relevant specialist areas (e.g. Risk, Work Health and Safety, Compliance, Privacy, Legal, Finance, Quality and Integrity) where additional expertise is required complete mandatory training relevant to their responsibilities implement agreed improvements arising from assurance activities within the scope of their role and delegation.
Second Line – Risk Oversight: Second-line functions provide independent oversight, advice and challenge to management to support effective and consistent risk management across the University.
Chief Audit and Risk Officer (Second and Third Line)	Leads the University's risk management and internal audit functions and advises the Vice-Chancellor and President, the Audit and Risk Committee and the Board of Trustees on matters relating to risk and internal control. Responsible for: promoting a strong and consistent risk and assurance culture across the University leading the Risk Team and the Internal Audit Team providing independent advice on the effectiveness of the University's risk management and internal control environment to the Vice-Chancellor and President, the Audit and Risk Committee and the Board of Trustees overseeing the enterprise-level effectiveness of the Risk Management Framework and its continuous improvement escalating significant or systemic risk issues and control weaknesses to senior management and relevant governance committees safeguarding the structural independence and integrity of the second- and third-line functions.
Risk Team	Provides independent second-line oversight, guidance and challenge to strengthen risk management practices across the University and its Controlled Entities. The Risk Team does not own or manage risks. Responsible for: maintaining and enhancing the Risk Management Framework and associated methodologies coordinating enterprise-wide identification, assessment and reporting of strategic, operational and emerging risks monitoring risk exposures, including those operating outside the approved Risk Appetite Statement reviewing the quality and consistency of risk assessments and mitigation strategies preparing consolidated risk reporting for the Audit and Risk Committee, the Senior Executive Team and other governance committees escalating significant emerging risks, systemic issues and material risk exposures in accordance with this Policy.
Other Line Two functions including Compliance, Work Health and Safety, Privacy, Legal and Quality and Integrity	Provide independent oversight and subject matter expertise within their respective domains. They establish frameworks and standards, monitor control effectiveness and escalate material risk exposures in accordance with this Policy.
Third Line – Independent Assurance: Internal Audit provides independent and objective assurance to the Board of Trustees and the Audit and Risk Committee on the effectiveness of the University's governance, risk management and internal control environment.
Internal Audit	Provides independent and objective assurance over the effectiveness of the University's risk management, governance and internal control environment, including the manner in which the first and second lines achieve risk management and control objectives. The Internal Audit function operates in accordance with the Internal Audit Charter.