NSW Public Sector Risk Register Deployment Template

Standard Operating Procedure: New South Wales (NSW) Public Sector Risk Register Deployment

Document ID: SOP-NSW-RR-4092
Effective Date: October 24, 2023
Version: 3.1.0
Review Cadence: Annual / Post-Gateway Review
Author: Julian Vance, Chief Architect, Template Registry

---

1. Executive Summary & Purpose

This Standard Operating Procedure (SOP) defines the institutional-grade engineering lifecycle for creating, maintaining, and auditing Risk Registers compliant with the New South Wales (NSW) Treasury Policy and Guidelines (TPP18-07: Internal Audit and Risk Management Policy) and the NSW Risk Management Toolkit (ISO 31000:2018 aligned).

The primary objective is to establish a deterministic framework for identifying, analyzing, evaluating, treating, and monitoring operational, strategic, and financial risks across NSW Government agency projects, ensuring absolute auditability, statutory compliance, and mitigation of systemic vulnerabilities.

---

2. Scope & Prerequisites

2.1 Scope

This procedure applies to all capital works, digital transformations, policy implementations, and operational business units operating under the governance of NSW Government departments, agencies, and State-Owned Corporations (SOCs).

2.2 Prerequisites & Tooling

• Software Stack: Enterprise Risk Management (ERM) software or locked Microsoft Excel/SharePoint Online templates conforming to NSW Treasury schema.
• Access Control: Restricted write permissions to designated Risk Owners and Risk Managers; read-only access for general project stakeholders.
• Reference Frameworks:
  • ISO 31000:2018 (Risk Management — Guidelines)
  • NSW Treasury TPP18-07
  • NSW Government Gateway Review System (Gateways 0–6)

---

3. Roles & Responsibilities (RACI Matrix)

---

4. Step-by-Step Procedure

Phase 1: Context Establishment & Register Initialization

• Initialize the canonical NSW Risk Register template (.xlsx or approved ERM platform instance) ensuring inclusion of mandatory metadata fields: Agency Name, Project ID, Date Logged, and SRO Name.
• Define the external and internal context in accordance with NSW Treasury parameters (e.g., political sensitivity, public safety impact, fiscal constraints).
• Establish the agency-specific Risk Likelihood and Consequence Matrix (5x5 grid ranging from Insignificant/Rare to Catastrophic/Almost Certain).

Phase 2: Risk Identification & Categorization

• Conduct structured risk-identification workshops utilizing standard NSW taxonomy (Strategic, Operational, Financial, Compliance, Reputational, Technological, Safety).
• Populate the Risk Description field using the mandatory causal syntax: Cause $\rightarrow$ Event $\rightarrow$ Impact.
• Assign a unique alpha-numeric identifier to each risk event (e.g., TR-NSW-FIN-001).

Phase 3: Inherent Risk Assessment

• Evaluate the Inherent Likelihood (Probability of occurrence without controls) on a scale of 1 to 5.
• Evaluate the Inherent Consequence (Severity of impact if realized) on a scale of 1 to 5, mapping against NSW Treasury impact tables (Financial, Reputational, Safety, Service Delivery).
• Calculate the Inherent Risk Score using the deterministic product or matrix lookup: $\text{Inherent Score} = \text{Likelihood} \times \text{Consequence}$.
• Classify the Inherent Risk level (Low, Medium, High, Extreme).

Phase 4: Control Evaluation & Residual Risk Scoring

• Document all existing, verifiable mitigating controls currently operational within the agency.
• Assess the design and operating effectiveness of each control (Effective, Partially Effective, Ineffective).
• Calculate the Residual Likelihood and Residual Consequence accounting for current operational controls.
• Compute the Residual Risk Score to determine if the risk sits within the agency's established Risk Appetite Statement (RAS).

Phase 5: Treatment Plan Formulation & Implementation

• Determine the risk treatment strategy: Treat, Tolerate, Transfer, or Terminate.
• For risks exceeding the organizational Risk Appetite, assign a definitive Treatment Action (Mitigation strategy).
• Designate a single, named Action Owner (Role/Title—avoid generic team names).
• Establish a hard Target Completion Date for the treatment action.

Phase 6: Monitoring, Review, and Escalation

• Update the Risk Register status bi-weekly during project delivery cycles and monthly during operational steady-state.
• Flag any risk where Residual Score $\ge 15$ (Extreme/High) for mandatory escalation to the Project Steering Committee and inclusion in agency-level executive reporting.
• Archive closed risks with documented lessons learned in the central repository.

---

5. Quality Assurance & Pro-Tips

5.1 Best Practices

• Avoid "Zombie Risks": Risks that remain static with no movement in score or treatment status for >90 days must be formally re-evaluated or closed.
• Control Independence: Ensure documented controls are distinct from monitoring activities; a report is not a control unless it actively triggers a preventative or corrective intervention.
• Granular Ownership: Never assign "Project Team" as a Risk or Action Owner. Accountability must rest with a single individual.

5.2 Common Pitfalls

• Conflating Causes and Impacts: Writing descriptions like "Risk of budget overrun" instead of the structural cause ("Inaccurate subcontractor estimations leading to budget overrun of $2M").
• Under-reporting Inherent Risk: Failing to assess risks without controls, which distorts the true value proposition of implemented mitigation strategies.

5.3 Metric Thresholds

• Target Treatment Closure Rate: $\ge 85%$ of treatments closed on or before their Target Completion Date.
• Maximum Review Cycle: 30 calendar days for High/Extreme risks; 90 calendar days for Medium/Low risks.

---

6. Frequently Asked Questions (FAQ)

Q1: How do we handle risks that cross agency boundaries under NSW Government machinery-of-government (MoG) changes?

Answer: The risk must be recorded with a dual-agency tag. The Lead Agency SRO retains accountability, but the interface risk must be formally communicated to the secondary agency’s risk manager within 5 business days of the MoG transition, updating the "Consulted" stakeholder field accordingly.

Q2: What is the mandatory threshold for escalating a risk to the NSW Treasury or Gateway Review team?

Answer: Any risk that registers as Extreme (Residual Score $\ge 20$) post-treatment, or any risk with a potential financial impact exceeding $5M AUD that cannot be absorbed within the existing project contingency, must be flagged for immediate escalation to the NSW Treasury portfolio analyst and recorded in the formal Gateway Review briefing pack.