National Disability Insurance Scheme—Risk Management Rules 2013

Risk management framework (section 5). This is the overarching system of systems, structures, processes and people within the Agency that identifies, assesses, mitigates and monitors all internal and external sources of risk that could materially affect the Agency. The framework must provide “reasonable assurance” that risks are managed prudently and soundly (subsection 5(2)). It must include a written risk management strategy, policies and procedures for all material risks (financial and non-financial), clearly defined managerial responsibilities and controls, and a review process to ensure its own effectiveness (subsection 5(4)). The framework itself is not necessarily a single written document, but it incorporates several written components.

Material risks (section 6). The framework must address operational risks (from failed internal processes, people, or systems), risks from the Board’s objectives and plans, risks to the financial sustainability of the NDIS, and “other kinds of risks” that alone or combined could have a material impact. This is a deliberately broad and non-exhaustive list. It gives the Board wide discretion but also wide accountability: any risk that becomes material later could be argued to have been within scope.

Risk management strategy (section 8). This is a written document, part of the framework, that must outline the risk governance relationship between the Board, its committees, and senior management. It must describe processes for identifying and assessing risks, establishing mitigation and control mechanisms, monitoring and reporting, and ensuring staff awareness and culture. It must identify persons or positions with risk roles and set out those responsibilities. Crucially, the strategy and any material amendments must be approved by the Ministerial Council (subsection 8(2)). That requirement introduces a political layer: the Board cannot unilaterally change its risk approach; it must seek approval from a body of state and territory ministers. The strategy must be reviewed at least annually (subsection 8(3)).

Risk management function (section 9). The Board must designate a part of the Agency or a person within it to assist the Board, committees, and senior management in developing and maintaining the risk framework. The designated function must be “operationally independent,” meaning it cannot be directly involved in the funding or provision of supports under the NDIS (paragraph 9(1)(c)). It must have authority, access to the Board, and appropriate resources and staff. It must notify the Board of any significant breach of or material deviation from the framework (paragraph 9(1)(g)). This creates an internal watchdog with statutory separation from the operational side of the Agency.

Risk management declaration (sections 10 and 11). After each financial year (starting after 30 June 2013), the Board must provide the Ministerial Council with a declaration signed by two Board members. The declaration must state that the Board believes, to the best of its knowledge, that the Agency has systems for compliance with the NDIS Act and the Commonwealth Authorities and Companies Act 1997 (now largely superseded by the Public Governance, Performance and Accountability Act 2013), that it is satisfied with financial information processes, that it has a compliant risk strategy, that it substantially complied with the strategy during the year, that the strategy is operating effectively, and that the strategy was approved by the Ministerial Council (subsection 10(2)). The declaration may be qualified; if so, the Board must describe the circumstances, whether they involve contravention of obligations, and the steps taken or proposed to remedy them (section 11). This declaration is a high-level attestation, not a detailed audit report. It does not require independent verification.

Operationally independent review (section 7). Reviews of the risk management framework must be conducted by persons who are operationally independent - that is, not involved significantly in developing or implementing the framework (subsection 7(2)). External consultants are explicitly allowed. Reviews must cover the risk management function, the strategy, and the Agency’s controls and procedures. The frequency and scope must be appropriate to the Agency’s size and complexity.

The Rules directly impose duties on the Board of the National Disability Insurance Agency. The Board is the primary duty-bearer. It must ensure all the elements listed in section 4 are in place, from culture to controls to scheme actuary involvement. The Board’s individual members are not made personally liable under these Rules, but the requirement that two members sign the annual declaration (subsection 10(1)) makes their reputations and potential exposure to governance scrutiny direct. The Board’s committees are also implicated, as the strategy must outline the risk governance relationship between the Board and its committees (paragraph 8(1)(a)).

Senior management of the Agency is affected indirectly. The Board must ensure that senior management takes steps to monitor and manage material risks consistent with the strategy (paragraph 4(1)(c)). Senior managers are likely to be tasked with implementing the framework, reporting to the Board, and interacting with the designated risk management function. They may also be subject to performance assessment based on risk compliance.

The scheme actuary is specifically mentioned: the Board must ensure the actuary is involved in risk decisions where appropriate (subsection 4(2)). This gives the actuary a formal seat at the risk management table, beyond merely performing actuarial valuations.

The risk management function within the Agency is a designated part or person (section 9). That person or unit gains statutory authority to access all aspects of the Agency with potential to generate material risk, including IT systems and development resources (paragraph 9(1)(f)). They also have a duty to notify the Board of significant breaches or deviations (paragraph 9(1)(g)). Those staff must have clearly defined roles and appropriate experience and qualifications (paragraph 9(1)(e)).

The Ministerial Council is a recipient of the risk management strategy for approval (subsection 8(2)) and of the annual risk management declaration (subsection 10(1)). This gives state and territory ministers oversight of the Agency’s risk posture. However, the Rules do not prescribe what the Ministerial Council must do with these documents. There is no requirement for the Ministerial Council to act on qualifications or to publish the declaration.

Participants and providers are not directly addressed by the Rules, but they are indirectly affected. If the risk management framework fails and the Agency becomes financially unsustainable, participant supports could be disrupted. Conversely, a risk-averse culture could lead to over-engineering of controls, slowing decision-making on plan approvals, or imposing burdens on providers. The Rules do not require the Board to consider participant or provider risk perspectives, only the Agency’s operational and financial risks.

Duty to establish and maintain a risk management framework (section 5). The Board must do this as soon as reasonably practicable after commencement and keep it in place at all times. The framework must provide reasonable assurance of prudent and sound risk management.

Duty to prepare a risk management strategy (subsection 4(1)(a) and section 8). The strategy is a core written component of the framework. It must be submitted to and approved by the Ministerial Council. The Board must review the strategy at least annually (subsection 8(3)). Material amendments also require Ministerial Council approval.

Duty to ensure sound risk management culture (paragraph 4(1)(b)). This is a soft obligation but imposes a positive duty on the Board to influence the Agency’s internal norms, not just to document processes.

Duty to ensure senior management monitors and manages material risks (paragraph 4(1)(c)). The Board cannot delegate this away; it must verify that management is acting consistently with the strategy.

Duty to allocate sufficient resources to risk management (paragraph 4(1)(f)). The Board must ensure budget and staff are adequate, which is a concrete cost driver.

Duty to designate a risk management function (section 9). The function must be operationally independent from funding and provision of supports. The Board must ensure it has authority, resources, and access.

Duty to arrange reviews of the risk management framework (section 7). Reviews must be effective, comprehensive, and conducted by operationally independent persons. Frequency and scope depend on the Agency’s size and complexity.

Duty to provide an annual risk management declaration (section 10). The Board must deliver a signed declaration to the Ministerial Council after each financial year. The declaration must attest to several matters, including substantial compliance with the risk management strategy.

Right to qualify the declaration (section 11). If the Board cannot make an unqualified declaration, it may include qualifications describing circumstances, whether they involve contraventions, and remedial steps. This right protects the Board from having to make a false statement, but it also requires disclosure of problems.

Right of the designated risk management function to access all aspects of the Agency (paragraph 9(1)(f)). This is a statutory right of entry, so to speak, within the Agency.

Right of the Board to submit the strategy to the Ministerial Council for approval (subsection 8(2)). Implicitly, the Board has the right to have its strategy considered, though not necessarily approved within a certain timeframe.

Duty of the Board to involve the scheme actuary in risk decisions where appropriate (subsection 4(2)). This is an ongoing procedural duty.

There are no express rights for participants, providers, or the public. The Rules do not create a private right of action for failure to manage risk. The Ministerial Council has no duty to enforce compliance; it receives declarations but is not required to act on them.

The Rules themselves do not prescribe any specific penalties, fines, or criminal offences for non-compliance. They are a legislative instrument made under the National Disability Insurance Scheme Act 2013, and enforcement would flow from that Act and from general Commonwealth governance law. The NDIS Act contains provisions about compliance by the Board and the Agency, including potential directions from the Minister or the Ministerial Council. However, the text of these Rules does not mention any enforcement mechanism.

Potential consequences for non-compliance include:

• A qualified risk management declaration (section 11) would be public (if disclosed) or at least known to the Ministerial Council. That could lead to ministerial intervention, changes to Board membership, or directions under the NDIS Act.
• If the Board fails to have a compliant risk management strategy or framework, it may be in breach of its statutory duties under the NDIS Act. The Ministerial Council could potentially withhold approval of the strategy, but the Rules do not specify what happens if the Ministerial Council does not approve a submitted strategy.
• The risk management declaration requires an attestation of substantial compliance with the strategy (paragraph 10(2)(d)). If the Board signs a false declaration, that could give rise to governance investigations or potential personal liability for misleading a Commonwealth body, though the Rules do not impose a separate penalty for misstatement. The Criminal Code Act 1995 regarding false statements to the Commonwealth could apply.
• The requirement that the Agency has systems for compliance with the Commonwealth Authorities and Companies Act 1997 (now the PGPA Act) could trigger enforcement under that Act, including potential sanctions against officials for breaches of the PGPA Act duties of care, diligence, and proper use of resources.

There is no independent auditor or regulator specifically assigned to enforce these Rules. The reviews under section 7 are internal or by external consultants, not by a body like the Australian National Audit Office though the ANAO could audit the Agency separately. The scheme actuary has a role but no enforcement power. The Board’s duties are ultimately enforceable through ministerial oversight and, in extreme cases, through the PGPA Act or by disallowance of the instrument (though these Rules were made in 2013 and are still in force).

The practical penalty is reputational and political: a qualified declaration or a failure to have an approved strategy would likely become known to stakeholders and could trigger Parliamentary scrutiny. The Rules thus rely on governance accountability rather than direct financial penalties.

The Rules expressly reference the National Disability Insurance Scheme Act 2013 (the Act) as the enabling statute. They are made under section 125B of that Act. The Act provides the broader context, including the Agency’s functions, the Board’s composition and powers, and the NDIS’s objectives. Compliance with the Rules is part of the Board’s duties under the Act.

The Rules also reference the Commonwealth Authorities and Companies Act 1997 (CAC Act) in the context of the risk management declaration. Subsection 10(2)(a) requires the declaration to state that the Agency has systems for compliance with the Act and the CAC Act. The CAC Act was replaced by the Public Governance, Performance and Accountability Act 2013 (PGPA Act) from 1 July 2014, shortly after these Rules commenced. The reference in the Rules is now effectively an anachronism. The Board’s declaration would need to address compliance with whatever governance framework is current. The PGPA Act imposes general duties on accountable authorities (the Board) and officials, including requirements for proper risk management and internal control. These Rules supplement those duties by prescribing specific NDIS-specific risk management requirements.

The Rules also refer to the National Disability Insurance Scheme,Rules for the Scheme Actuary 2013 (subsection 4(2)). That instrument sets out the scheme actuary’s duties, which include actuarial advice on the financial sustainability of the NDIS. The interaction is that the Board must involve the actuary in risk decisions where appropriate and consistent with those other Rules. This creates a cross-instrument obligation.

The Rules do not create any interaction with state or territory legislation directly, but the Ministerial Council comprises state and territory ministers, and the risk management strategy must be approved by that body. This gives state governments a role in approving the Agency’s risk posture, which is unusual for a Commonwealth statutory agency. It means the strategy must satisfy both Commonwealth and state political interests.

The Rules do not explicitly interact with the Freedom of Information Act 1982 or privacy laws, but the risk management framework and strategy may contain sensitive information about the Agency’s vulnerabilities. The annual declaration is likely a Commonwealth document subject to FOI unless exempt.

The Rules are silent on competition law, contract law, or provider obligations. They do not affect the National Disability Insurance Scheme (Supports for Participants) Rules 2013 or the pricing rules. However, if the risk management framework includes controls on provider payments or plan approvals, those operational controls would need to be consistent with those other rules.

The instrument text as supplied does not contain any amendment history or amending notes. The Rules were made on 25 June 2013 and commenced on 1 July 2013 (or the day after registration, whichever was later). The version provided appears to be the original instrument. There are no references to subsequent amendments in the text. It is possible that amendments have been made but not included in the source material. Based solely on the source, the amendment history is nil. Practitioners should check the Federal Register of Legislation for the current compilation.

The Rules have a sunsetting date under the Legislation Act 2003. As a legislative instrument made on 25 June 2013, it would have sunsets after 10 years (generally), meaning it likely sunset on 1 April 2024 unless rolled over or re-made. The user’s source does not mention sunsetting. This is a significant compliance risk if relying on the instrument as current.

The source material contains no references to any litigation, court decisions, or administrative review proceedings concerning these Rules. The Rules are procedural and prudential in nature, and they do not confer rights on participants or providers that could easily be litigated. A challenge could arise if the Board failed to comply and that failure caused financial harm to the NDIS, but that would likely be a political rather than a legal dispute. There is no private right of action. The only potential litigation avenue would be judicial review of a decision by the Board or the Ministerial Council under the Administrative Decisions (Judicial Review) Act 1977, but the Rules themselves do not create decisions that are reviewable. Based solely on the source, there is no litigation history. Analysts should search for any cases referencing the Rules or section 125B of the NDIS Act, but none are in the source.

“Substantially complied” is a vague threshold. The risk management declaration must state that the Agency has “substantially complied” with the risk management strategy throughout the financial year (paragraph 10(2)(d)). The Rules do not define “substantially.” This creates legal uncertainty. A Board could face disagreement over whether minor breaches amount to substantial non-compliance. A qualified declaration may be needed if there is any doubt, but qualification itself could trigger political scrutiny.

Ministerial Council approval is a bottleneck. The risk management strategy and any material amendments must be approved by the Ministerial Council (subsection 8(2)). The Ministerial Council is a political body comprising state and territory ministers. It meets infrequently. If the Board needs to amend the strategy quickly (for example, in response to a new risk), it cannot do so without waiting for Ministerial Council approval. This creates a rigidity that could leave the Agency exposed to emerging risks while the strategy is out of date.

Operationally independent reviews have a narrow definition. Persons conducting reviews under section 7 must be “operationally independent” - defined as not having played a significant role in developing or implementing the framework (subsection 7(2)). This can exclude internal people who are best placed to understand the risks. External consultants are allowed, but they may lack deep knowledge of the NDIS. The cost of external reviews can be substantial, and the rule does not specify a minimum frequency or maximum cost.

The risk management function must be independent of funding and provision of supports (paragraph 9(1)(c)). This sounds prudent, but it means the risk function cannot sit within the same division that approves participant plans or pays providers. This may create silos and reduce the flow of operational risk information into the risk function. The risk function may become detached from the day-to-day realities of plan management and provider engagement.

No requirement for public disclosure. The risk management strategy and declaration are provided to the Ministerial Council, but there is no obligation to publish them. Participants and providers have no way of knowing whether the Board is managing risks effectively. This reduces accountability to the public. A qualified declaration could remain secret unless the Ministerial Council chooses to release it or it is obtained under FOI.

Compliance with an outdated law. The declaration requires reference to the Commonwealth Authorities and Companies Act 1997 (subsection 10(2)(a)), which has been repealed and replaced. The Board now must refer to the PGPA Act 2013. This is a minor trap but could catch an unwary drafter if literal compliance with the older Act is still demanded by the Rules’ text.

Scheme actuary involvement is not defined. Subsection 4(2) requires the Board to involve the scheme actuary in risk decisions “to the extent that that involvement is appropriate and consistent with the scheme actuary’s duties.” This is vague and could lead to disputes about what is “appropriate.” The actuary may demand involvement in operational matters that the Board considers outside scope.

“Sufficient resources” is not quantified. Paragraph 4(1)(f) says the Board must dedicate “sufficient resources” to risk management. This is a judgement call that could be challenged in retrospect if a risk materialises. The Board could be accused of under-resourcing risk management despite having no benchmark.

Annual review can be too infrequent. The risk management strategy must be reviewed at least annually (subsection 8(3)). For a scheme with rapidly changing financial risks, annual review may be too slow. The instrument does not require more frequent review in response to material changes.

No override of other duties. The Rules do not state that risk management considerations trump the Agency’s duty to deliver supports to participants. A risk-averse Board could interpret the Rules as requiring restrictive controls that delay plan approvals or reduce flexibility.

Compliance with the Rules is essentially a five-step process: (1) establish the risk management framework and strategy; (2) designate the risk management function; (3) implement the framework and monitor compliance; (4) conduct reviews; (5) prepare and deliver the annual declaration.

Step 1: Establish the framework and strategy. The Board must create a written risk management strategy as soon as reasonably practicable (subsection 4(1)(a)). The strategy should address all elements listed in section 8: governance relationships, risk identification and assessment processes, mitigation and control mechanisms, monitoring and reporting, staff awareness and culture, roles and responsibilities, and the review process. The strategy must be submitted to the Ministerial Council for approval (subsection 8(2)). Until approved, the Board still has a duty to manage risks generally, but the strategy cannot be said to comply with the Rules until approval is obtained. The Board should also establish the broader framework (section 5), which includes the strategy plus policies, procedures, controls, and a review process. The framework must cover operational risks, risks from the Board’s objectives, risks to NDIS financial sustainability, and any other material risks (section 6).

Step 2: Designate the risk management function. The Board must formally designate a part of the Agency or a person as the risk management function (section 9). This function must be operationally independent from funding or providing supports. The Board should ensure the function has clear terms of reference, adequate authority, direct access to the Board and senior management, and sufficient staff with appropriate qualifications. The function must be notified of all significant breaches or deviations from the framework, and must have access to IT systems and development resources (paragraph 9(1)(f)). This designation should be documented and communicated to all staff.

Step 3: Implement and monitor. The Board must ensure the entire Agency has a sound risk management culture (paragraph 4(1)(b)). This requires training, communication, and embedding risk awareness into decision-making. Senior management must monitor all material risks consistent with the strategy (paragraph 4(1)(c)). The Agency must develop policies and processes for decisions affected by risk (paragraph 4(1)(e)). The scheme actuary must be involved in risk decisions where appropriate (subsection 4(2)). The Board should maintain a risk register, regular reporting to the Board, and escalation protocols.

Step 4: Conduct reviews. The Board must ensure effective and comprehensive reviews of the risk management framework (section 7). Reviews must be done by operationally independent persons - external consultants are often used. The review must cover the risk management function, the strategy, and controls and procedures. The frequency and scope should be appropriate to the Agency’s size and complexity. The Board should document review findings and implement recommendations.

Step 5: Prepare the annual declaration. After each financial year (starting with the year ending 30 June 2014), the Board must provide the Ministerial Council with a risk management declaration signed by two Board members (subsection 10(1)). The declaration must state that, to the best of the Board’s knowledge and belief, the Agency has compliance systems for the Act and the CAC Act (now PGPA Act), the Board is satisfied with financial information processes, there is a compliant risk strategy, the Agency has substantially complied with the strategy throughout the year, the strategy is operating effectively, and the strategy was approved by the Ministerial Council (subsection 10(2)). If the Board cannot make an unqualified statement, it must qualify the declaration, describing circumstances, whether contraventions are involved, and remedial steps (section 11). The Board should prepare a detailed internal attestation process to gather evidence before signing.

Ongoing compliance. The risk management strategy must be reviewed at least annually (subsection 8(3)). Any material amendments must be re-approved by the Ministerial Council. The Board should maintain a compliance calendar and ensure all documents are kept current. Given the sunsetting risk, the Board should verify that the instrument is still in force and consider whether the Rules have been re-made or replaced. The Board should also ensure the risk management framework is aligned with the PGPA Act risk management requirements to avoid duplication. Costs include staff time, consultant fees, and administrative overhead. These are not trivial; they represent a real resource allocation that could otherwise go to direct participant supports. The Board must balance the compliance burden against the benefit of prudential risk management.