Requirement A

Anita is an EL1 employee tasked with preparing a New Policy Proposal (NPP) to support pathways to employment for a vulnerable population in the community. As the NPP involves financial implications of more than $30M, Anita must complete a Risk Potential Assessment Tool (RPAT) as part of the process to brief her Minister.

Using the RPAT to guide her, Anita considers a number of potential impacts and risks in implementing the proposal. These include:

• the likely positive economic and social impacts over the life of the measure and beyond, that are evidenced by available research data and modelling;
• possible negative impacts to the target population if the measure is poorly or partially implemented, as well as the impact on trust in government;
• the implications of not identifying and consulting with the right stakeholders—including the target population, employment service providers, representatives of other vulnerable populations not included in the measure, other jurisdictions, broader peak bodies, and civil society groups; and
• potential impacts of not proceeding with other courses of action which might be available but are not proposed to be funded.

In making her assessment, Anita pays attention to factors including:

• the needs of the target population, based on available evidence, including specialisation of services;
• the potential transferability and scalability to other populations in the longer term;
• the availability and capability of appropriate service providers in key geographic regions, and the potential for this to change over time or fluctuate with economic circumstances;
• the possible interactions with other existing Commonwealth or State/Territory community policies or programs;
• the need for legal advice and administrative and IT systems capability to support implementation; and
• the capacity of her own team and the agency to oversee the project over its life.

What happens next?

On the basis of the RPAT, Anita concludes that with mitigation the overall risk is ‘medium’, and that risk mitigation strategies will need to be developed and included as part of the proposal.

Through the RPAT process, Anita demonstrates Stewardship by giving thorough and realistic consideration to the potential short- and long-term impact of the measure, as well as the potential for the measure to inform and build on the longer-term work and priorities of Government.

Robert is an APS 6 System Administrator for a corporate IT system used to manage recruitment processes. The business process for recruitment requires change following updates to the broader HR system, which interconnects recruitment, onboarding, and payroll. To accommodate the change, Robert is tasked with amending the online forms used to collect applicants’ personal information.

Robert identifies that additional personal information will need to be collected in the recruitment system to enable data to flow to other corporate systems to manage the onboarding of successful candidates. Robert understands that this may change the privacy risk assessment for personal data held in the recruitment system but believes that the current mitigation strategies will not need to change.

Robert is aware that his team has sought advice in the past from the information law team when assessing privacy risks in collecting and using personal information for new purposes, but he thinks that on this occasion it is unnecessary, and will add too much time to the completion of his task.

As a result, he does not review the risk assessment or seek advice on the change, instead continuing in the belief that all risks associated with the collection and storage of personal and confidential information are sufficiently mitigated. Additionally, as the change only affects the way the data is collected in the recruitment system, not the amount of data required by other corporate HR systems, Robert decides not to consult with anyone else in the department. He does not advise his supervisor, Emeka, of his decision.

Following the implementation of Robert’s changes, a bulk recruitment round is conducted in the department, and personal information relating to the internal employees who had applied in the round becomes visible to all department staff who have an approval function in the broader HR system.

What happens next?

Robert realises that this privacy breach could have been avoided if he had reviewed the privacy risk assessment and considered additional mitigation strategies, in consultation with Emeka, the information law team, and other stakeholders such as the pay and conditions team and the IT team.

Robert’s failure to have sufficient regard to the reasonably foreseeable effects of his decisions has had consequences for internal candidates, and undermined their trust in the overall integrity of the department’s HR function.

Emeka counsels Robert as part of his performance management, and works with him to find ways to ensure a situation like this will not happen again, including by working together to develop principles and processes for risk management strategies and consultation plans for future projects.

Emeka also takes this opportunity to discuss with the whole team the importance of collaboration in managing risk and calling on the expertise of departmental colleagues to help them achieve their business outcomes.

Amali is an EL2 employee who has been in her position for six weeks. She is now responsible for grants management of a high-profile industry program, but was not involved in the grant opportunity process. In preparing funding agreements for execution, Amali reviews some documents that indicate that a successful applicant, Entity A, may have been ineligible for funding, and its application probably should not have been approved.

In deciding what to do about her concern, Amali considers:

• the potential legal and financial risks of Entity A’s approval proceeding to contract;
• the reputational risks for the department, the Minister, and the Government that could arise if the issue comes to light through external scrutiny, such as a performance audit, Parliamentary Question, or media enquiry; and
• the longer-term consequences of the team’s underdeveloped grant management capability to effectively undertake their responsibilities.

Amali also knows that a decision to withdraw funding from Entity A will delay delivery of a Government priority program, may add costs through rectifying any errors, and may cause embarrassment for the department about the selection process.

After weighing these considerations, Amali decides to talk to her branch manager, Jim, who agrees that the grant approval of Entity A should be reconsidered. He also considers whether defects in the assessment process enabled other ineligible entities to be approved. In a written brief to Sofia, the Deputy Secretary, Jim notes that although reversing a decision about one entity may cause some financial, legal, and reputational damage to the department, the impacts of not addressing possible systemic issues with the whole grant round would be much worse for the integrity of the program, undermine trust in the agency and the APS, and be detrimental to the Government’s policy goals.

Sofia agrees and decides a targeted intervention by the internal audit team should be undertaken to assure the integrity of the grant round, by re-assessing the eligibility of all applications. This confirms that Entity A’s application had been incorrectly assessed as eligible by the assessment team, but no other ineligible entities received grant approvals in this round.

After strategising with the department’s legal team, Jim and Amali advise Entity A that its funding agreement will not proceed as initially offered, following a final assurance check of all applicants, which had flagged the ineligibility issue. The exchange is difficult and uncomfortable. However, Entity A is encouraged to reapply in the next grant opportunity because its application was strong, and there are ways for it to become eligible that may not incur significant additional expense.

What happens next?

Jim and Amali ensure future accountability measures are implemented for the next funding round, including revised assessment procedures, quality assurance methodologies, improved governance arrangements, and further probity and technical training for the team. Assurance measures are also reflected in the branch plan, and staff performance agreements at all levels.

Amali, Jim, and Sofia all exhibited strong ethical judgement and demonstrated Stewardship by having proper regard to future implications of their actions, and placing due weight on managing risks relating to probity and legal compliance, system integrity, team capability and the public interest.

Jim and Sofia also demonstrated Stewardship by leading a culture where staff feel able to raise difficult issues, even though doing so may cause discomfort or more work, by validating and addressing them appropriately.