16Duty to establish and maintain systems relating to risk and control

#### 16 Duty to establish and maintain systems relating to risk and control The accountable authority of a Commonwealth entity must establish and maintain: (a) an appropriate system of risk oversight and management for the entity; and (b) an appropriate system of internal control for the entity; including by implementing measures directed at ensuring officials of the entity comply with the finance law. > Note 1: An example of a measure directed at ensuring officials of the entity comply with the finance law is a measure: (a) requiring, as a condition of employment of an official of the entity, that the official complies with the finance law; and (b) specifying sanctions (such as termination) that apply to the official for contravening that condition. > Note: Such a measure would not be needed for officials to whom the Public Service Act 1999 or Parliamentary Service Act 1999 applies because, under that Act, sanctions may be imposed on those officials for contravening the finance law: see section 32 of this Act. > Note 2: This duty includes managing consultants and independent contractors who work for the entity, even if they are not officials of the entity.