{"id":"F2013L01183","name":"National Disability Insurance Scheme—Risk Management Rules 2013","slug":"national-disability-insurance-scheme-risk-management-rules-2013","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":437839,"registerId":"F2013L01183-fast-fetch-1775954523683","compilationNumber":null,"startDate":"2026-04-12","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"1","sectionType":"section","heading":"National Disability Insurance Scheme—Risk Management Rules 2013","content":"---\nmeta-content-style-type: text/css\nmeta-content-type: application/xhtml+xml; charset=utf-8\nmeta-generator: Aspose.Words for .NET 20.2\n---\n\n![](image.001.png)\n\n \n\nNational Disability Insurance Scheme—Risk Management Rules 2013\n\nI, WILLIAM RICHARD SHORTEN, Minister for Financial Services and Superannuation, determine these rules under section 125B of the National Disability Insurance Scheme Act 2013.\n\n \n\nDated                                 25 June 2013.\n\n \n\n \n\n \n\nWILLIAM RICHARD SHORTEN\n\nMinister for Financial Services and Superannuation\n\n \n\n \n\n\nContents\n\n \n\nPart 1 Preliminary\n\n1 Name of instrument\n\n2 Commencement\n\n3 Interpretation\n\nPart 2 General responsibilities of the Board\n\n4 General responsibilities of the Board\n\nPart 3 Risk management framework and risk management strategy\n\n5 Establishment, maintenance and content of risk management framework\n\n6 Kinds of material risks\n\n7 Reviews of risk management framework\n\n8 Risk management strategy\n\nPart 4 Risk management function\n\n9 Risk management function\n\nPart 5 Risk management declaration\n\n10 Preparation and content of risk management declaration\n\n11 Qualifications to risk management declaration\n\nPart 1             Preliminary\n\n1                         Name of instrument\n\nThese Rules are the National Disability Insurance Scheme—Risk Management Rules 2013.\n\n2                         Commencement\n\nThese Rules commence on the later of:\n\n(a)          the day after they are registered; and\n\n(b)          1 July 2013.\n\n3                         Interpretation\n\nIn these Rules:\n\nAct means the National Disability Insurance Scheme Act 2013.\n\nAgency—see section 9 of the Act.\n\nBoard—see section 9 of the Act.\n\nBoard member—see section 9 of the Act.\n\nMinisterial Council—see section 9 of the Act.\n\nNDIS means the National Disability Insurance Scheme (as defined in section 9 of the Act).\n\nPart 2             General responsibilities of the Board\n\n4                         General responsibilities of the Board\n\n(1)          The Board must ensure that:\n\n(a)          it prepares a written risk management strategy as soon as reasonably practicable after the commencement of these Rules; and\n\n(b)          the Agency has a sound risk management culture; and\n\n(c)          the members of the Agency’s senior management take the steps necessary to monitor and manage all material risks that are likely to be faced by the Agency, consistent with the risk management strategy; and\n\n(d)          the Agency’s operational structure is such that it facilitates effective risk management; and\n\n(e)          the Agency develops policies and processes for making decisions affected by risk that are consistent with the risk management strategy; and\n\n(f)           the Agency dedicates sufficient resources to risk management; and\n\n(g)          the Agency recognises the uncertainties involved in the measurement of risk and understands the limitations and uncertainties relating to the output of models used to measure components of risk; and\n\n(h)          the Agency establishes, and has in place at all times, appropriate controls in relation to risk that are consistent with the Agency’s risk profile and are understood by, and regularly communicated to, relevant staff of the Agency.\n\n(2)          The Board must also ensure that the scheme actuary is involved in decisions made by the Agency and the Board in relation to risk, to the extent that that involvement is appropriate and consistent with the scheme actuary’s duties and the National Disability Insurance Scheme—Rules for the Scheme Actuary 2013.\n\nPart 3             Risk management framework and risk management strategy\n\n5                         Establishment, maintenance and content of risk management framework\n\n(1)          The Board must, as soon as reasonably practicable after the commencement of these Rules, establish a risk management framework, and must have such a framework in place at all times.\n\n(2)          The risk management framework must provide a reasonable assurance that the Agency’s risks are managed prudently and soundly.\n\n(3)          The risk management framework is to deal with the systems, structures, processes and people within the Agency that identify, assess, mitigate and monitor all internal and external sources of risk that could have a material impact on the Agency’s operations, funding and financial sustainability.\n\n(4)          The risk management framework must include:\n\n(a)          a written risk management strategy prepared in accordance with section 8; and\n\n(b)          policies and procedures to identify, assess, monitor, report on and mitigate all material risks, whether financial or not, that are likely to be faced by the Agency; and\n\n(c)          clearly defined managerial responsibilities and controls in relation to risk; and\n\n(d)          a review process to ensure that the risk management framework is effective in identifying, measuring, evaluating, monitoring, reporting, and controlling or mitigating, material risks.\n\nNote: The risk management framework is not necessarily a written document, although it will include various written documents such as the risk management strategy.\n\n6                         Kinds of material risks\n\nThe risk management framework is to deal with the following kinds of risks:\n\n(a)          operational risks, including risks of unexpected costs resulting from inadequate or failed internal processes, people and systems;\n\n(b)          risks arising from the Board’s objectives and plans in respect of the Agency’s functions;\n\n(c)          risks to the financial sustainability of the NDIS;\n\n(d)          other kinds of risks that, alone or in combination with others, may have a material impact on the Agency.\n\n7                         Reviews of risk management framework\n\n(1)          The Board must ensure that:\n\n(a)          there are effective and comprehensive reviews of the risk management framework, conducted by persons (including, if appropriate, external consultants) who are operationally independent and appropriately trained and competent; and\n\n(b)          the frequency and scope of such reviews are appropriate having regard to the size and complexity of the Agency’s operations.\n\n(2)          For paragraph (1)(a), a person is not operationally independent if the person plays, or has played, a significant role in the development or implementation of the risk management framework.\n\n(3)          A review must include:\n\n(a)          a review of the risk management function; and\n\n(b)          a review of the risk management strategy; and\n\n(c)          a review of the Agency’s controls and procedures in relation to risk.\n\n8                         Risk management strategy\n\n(1)          The risk management strategy must:\n\n(a)          outline the risk governance relationship between the Board, committees of the Board and the senior management of the Agency; and\n\n(b)          describe the processes for the Agency to identify and assess risks; and\n\n(c)          describe the process for the Agency to establish mitigation and control mechanisms for individual risks; and\n\n(d)          describe the process for monitoring and reporting issues in relation to risk (including the communication and escalation of such issues); and\n\n(e)          describe how the Agency is to:\n\n(i)            ensure that relevant staff are aware of issues relating to risk; and\n\n(ii)         instil an appropriate culture in relation to risk; and\n\n(iii)       ensure that the risk management strategy is accessible to the Agency’s staff; and\n\n(f)           identify persons and positions in the Agency with roles and responsibilites in relation to risk, or groups of such persons and positions, and set out those roles and responsibilities; and\n\n(g)          describe the review process mentioned in paragraph 5(4)(d).\n\n(2)          The risk management strategy, and any material amendments to the risk management strategy, must be approved by the Ministerial Council.  The Board must submit the strategy or amendments to the Ministerial Council as soon as reasonably practicable after the strategy or amendments have been approved by the Board.\n\n(3)          The risk management strategy must be reviewed (including any reviews conducted in accordance with section 7) at least annually.\n\nPart 4             Risk management function\n\n9                         Risk management function\n\n(1)          The Board must designate a part of the Agency or a person in the Agency that, at a minimum:\n\n(a)          is responsible for assisting the Board, committees of the Board and the senior management of the Agency to develop and maintain the risk management framework; and\n\n(b)          is appropriate to the size, operations and complexity of the NDIS; and\n\n(c)          is operationally independent, meaning that they are not directly involved in the Agency’s functions in relation to the funding or provision of supports under the NDIS; and\n\n(d)          is conferred with the authority and the access to the Board, committees of the Board and senior management of the Agency, necessary to conduct its activities effectively and independently; and\n\n(e)          is resourced with staff who have clearly defined roles and responsibilities and the experience and qualifications appropriate to those roles and responsibilities; and\n\n(f)           has access to all aspects of the Agency that have the potential to generate material risk, including information technology systems and system development resources; and\n\n(g)          is required to notify the Board of any significant breach of, or material deviation from, the risk management framework.\n\n(2)          The first designation of a person or body under subsection (1) must take place as soon as reasonably practicable after the commencement of these Rules.\n\nPart 5             Risk management declaration\n\n10                    Preparation and content of risk management declaration\n\n(1)          The Board must, after the end of each financial year of the Agency’s operations that commences after 30 June 2013, provide the Ministerial Council with a risk management declaration signed by 2 Board members on behalf of the Board.\n\n(2)          The risk management declaration is to state that, to the best of the Board’s knowledge and belief, and having made appropriate enquiries:\n\n(a)          the Agency has systems in place for the purpose of ensuring compliance with the Act and the Commonwealth Authorities and Companies Act 1997; and\n\n(b)          the Board and the senior management of the Agency are satisfied with the efficacy of the processes and systems for the production of the Agency’s financial information; and\n\n(c)          the Board has in place a risk management strategy that complies with the requirements of these Rules; and\n\n(d)          the Agency (including the Board) has, throughout the relevant financial year, substantially complied with the risk management strategy; and\n\n(e)          the risk management strategy is operating effectively; and\n\n(f)           the risk management strategy in its present form has been submitted to and approved by the Ministerial Council.\n\n11                    Qualifications to risk management declaration\n\nThe Board may qualify a risk management declaration (for example, if the Board cannot make an unqualified declaration of a matter mentioned in subsection 10(2)).  A qualification must describe:\n\n(a)          the circumstances giving rise to the qualification; and\n\n(b)          whether those circumstances involve any contravention of the Board’s obligations under the Act or these Rules; and\n\n(c)          the steps taken, or proposed to be taken, to remedy the circumstances giving rise to the qualification.\n","sortOrder":0}],"analysis":{"flash_summary":{"complexity_score":4,"scope_assessment":{"changed":false,"description":"These Rules implement governance and risk-management requirements for the NDIS Agency that are consistent with the Act’s objective of ensuring prudent management of the Scheme. They do not materially expand the Agency’s statutory functions; rather they specify how the Board and Agency must manage and report risk (framework, strategy, designated risk function, reviews, and an annual declaration). The Rules add procedural and reporting detail to the Act but do not extend the Agency’s substantive powers or change the core scope of the NDIS as set out in the Act."},"complexity_factors":["Short instrument (11 numbered rules plus interpretation) concentrated on governance obligations","6 defined terms in the interpretation section (Act, Agency, Board, Board member, Ministerial Council, NDIS)","Several clear, standalone duties rather than heavily nested conditions (notably Rules 4–11)","Cross-references to external instruments and laws (National Disability Insurance Scheme Act 2013, Commonwealth Authorities and Companies Act 1997, Rules for the Scheme Actuary) introduce external dependencies","Recurrent procedural requirements (annual reviews, independent reviews, annual declaration) increase ongoing operational complexity","One layer of external approval (Ministerial Council approval of the strategy) and reporting (annual declaration) adds coordination points","Operational independence requirement for reviewers and risk function with a specific disqualification rule (Rule 7(2) and Rule 9(1)(c)) creates some conditional logic","Limited number of exceptions and qualifications permitted (qualification of declaration in Rule 11) — simple but consequential"],"plain_english_summary":"**What these Rules do (mechanics)\n\n- These Rules require the National Disability Insurance Agency (the Agency) Board to set up, keep and run a formal risk-management system for the National Disability Insurance Scheme (NDIS). (see Rules 4–5)\n- The Board must prepare a written risk management strategy and keep a risk management framework in place at all times. The framework must identify, assess, monitor, mitigate and report material risks (financial and non‑financial) that could affect the Agency’s operations, funding or financial sustainability. (see Rules 5–6, 8)\n- The Board must ensure senior managers monitor and manage material risks, that appropriate controls and resources are provided, and that staff understand risk-related processes. The scheme actuary must be involved in Agency and Board risk decisions where appropriate. (see Rule 4)\n- The Board must designate an operationally independent risk management function (a team or person) with authority, access and resources to support the framework, including notifying the Board of significant breaches. (see Rule 9)\n- The risk management strategy (and material amendments) must be approved by the Ministerial Council; the strategy must be reviewed at least annually and the framework must be subject to periodic independent reviews. (see Rules 7–8)\n- After each financial year, the Board must submit a risk management declaration signed by two Board members to the Ministerial Council, stating that (to the Board’s best knowledge) systems are in place for compliance with the Act and the Commonwealth Authorities and Companies Act 1997, financial information processes are satisfactory, the risk strategy complies with these Rules and has been substantially followed. The Board may qualify (i.e. disclose exceptions to) that declaration and must state remedial steps. (see Rules 10–11)\n\nWho this affects (actors and responsibilities)\n\n- The Agency Board: primary duty-bearer. Must establish strategy and framework, ensure culture, resources and controls, obtain Ministerial Council approval for the strategy, and sign the annual declaration. (Rules 4, 5, 8, 10)\n- Senior management of the Agency: must monitor/manage risks consistent with the strategy and operate the controls and processes. (Rule 4)\n- The designated risk management function (team or person): must be operationally independent, have access and authority, be properly resourced and report breaches. (Rule 9)\n- Scheme actuary: must be involved in risk decisions as appropriate. (Rule 4(2))\n- Ministerial Council: must approve the risk management strategy and receives the annual declaration. (Rule 8(2), Rule 10)\n\nWhy this matters (purpose claims and practical effects)\n\n- The stated purpose is to ensure the Agency manages risks prudently and soundly and protects the financial sustainability of the NDIS (see Rules 5(2)–(3), 6(c)). That is achieved by requiring an explicit governance architecture (Board oversight, an independent risk function), documented processes (strategy, policies, reviews) and formal accountability (Ministerial approval, annual declaration).\n\nAnalytical remarks: costs, incentives, trade‑offs and implementation issues\n\n- Who pays: the Agency bears the direct resource and administrative costs of creating and maintaining the framework, staffing the risk function and running independent reviews (Rules 5(4)(b), 9(1)(e), 7). Those costs are ultimately met from Commonwealth appropriations for the Agency and can affect budget allocations within the NDIS system.\n- Who decides: the Board sets the risk framework and strategy, subject to Ministerial Council approval of the strategy; the Board must also involve the scheme actuary where appropriate (Rules 4, 8(2), 4(2)). This concentrates rule‑making and implementation decisions within the Agency, with an external check via the Ministerial Council.\n- Compliance and administrative burden: the Rules create recurring obligations — annual reviews of the strategy, periodic independent reviews of the framework, and an annual signed declaration with possible qualifications (Rules 7–8, 10–11). These produce ongoing compliance costs and record‑keeping requirements.\n- Implementation risk: effectiveness depends on the Board’s judgment about what is “material,” the quality and independence of reviews (Rule 7(1)), the adequacy of resourcing for the designated risk function (Rule 9(1)(e)), and timely involvement of the scheme actuary (Rule 4(2)). The Rules set outcomes and minimum features but leave significant discretion to the Board about specifics.\n- Incentives and trade‑offs: formalising risk processes should improve detection and management of large or systemic risks to the NDIS, but it reallocates resources from other Agency activities to governance and may slow some operational decisions if escalation paths and approvals are required. Ministerial Council approval of the strategy (Rule 8(2)) introduces an additional external clearance step that can provide oversight but could delay reforms or impose politically framed expectations.\n- Effects on private sector providers and participants: the Rules govern Agency governance rather than private providers directly. Any indirect effects on providers (for example, through funding policy or tighter financial controls) are possible but are not specified in these Rules themselves.\n\nReference points in the instrument: key obligations are in Rules 4–11 (see especially Rules 4, 5, 8, 9, 10)."},"flash_summary_failed":{"failed":true,"reason":"Unauthenticated. Configure AI_GATEWAY_API_KEY or use a provider module. Learn more: https://ai-sdk.dev/unauthenticated-ai-gateway","source":"analysis-cron"},"kimi_summary":{"content_quality":"ok","complexity_score":4,"scope_assessment":{"changed":false,"description":"The legislation remains focused on its original purpose of establishing risk management governance for the NDIS Agency. The scope covers Board responsibilities, framework requirements, risk function designation, and annual declarations – all directly related to prudent financial and operational risk management for a large statutory agency. No significant scope creep is evident; the rules address the specific mandate under section 125B of the NDIS Act."},"complexity_factors":["Moderate length (11 sections) with straightforward structure following logical progression from framework establishment to annual reporting","7 defined terms in interpretation section, all referencing external definitions in the parent Act rather than creating new complex definitions","Minimal cross-referencing – primarily internal references to other sections of these Rules and occasional references to the parent Act and related Scheme Actuary Rules","Clear conditional logic without nested exceptions – requirements use 'must' and 'as soon as reasonably practicable' rather than complex triggering conditions","Some operational complexity in section 9 requiring operational independence of risk function from funding/provision decisions, but this is clearly defined","Annual review and approval requirements create procedural obligations but are mechanically straightforward"],"plain_english_summary":"These rules require the NDIS Agency Board to establish and maintain a comprehensive risk management system—including a formal strategy, an independent risk function, and annual Board confirmation—to protect the Agency’s operations and the scheme’s financial sustainability. \n\nThey bind the Board and senior management, involve Ministerial Council oversight, and indirectly protect NDIS participants by reducing fraud, operational failures and threats to long‑term funding, increasing accountability over public spending on supports."}},"importantCases":[],"_links":{"self":"/api/acts/national-disability-insurance-scheme-risk-management-rules-2013","history":"/api/acts/national-disability-insurance-scheme-risk-management-rules-2013/history","analysis":"/api/acts/national-disability-insurance-scheme-risk-management-rules-2013/analysis","conflicts":"/api/acts/national-disability-insurance-scheme-risk-management-rules-2013/conflicts","importantCases":"/api/acts/national-disability-insurance-scheme-risk-management-rules-2013/important-cases","documents":"/api/acts/national-disability-insurance-scheme-risk-management-rules-2013/documents"}}