Standard Operating Procedure: Risk Register Implementation (Queensland)

Standard Operating Procedure: Risk Register Implementation (Queensland Jurisdiction)

Document ID: TR-SOP-RM-QLD-001
Effective Date: 2024-05-22
Version: 1.0.0
Review Cadence: Annual or upon significant legislative amendment

1. Executive Summary & Purpose

This SOP dictates the methodology for creating and maintaining a Risk Register compliant with the Queensland Government Information Security Classification Framework (QGISCF) and AS/NZS ISO 31000:2018. The purpose is to ensure uniform identification, assessment, and mitigation of operational risks across Queensland-based projects.

2. Scope & Prerequisites

• Scope: All project-based operations under the jurisdiction of Queensland regulatory frameworks.
• Software Requirements: Template Registry Enterprise Suite, Microsoft Excel (v2019+), or Jira Align.
• Hardware/PPE: N/A (Standard workstation environment).
• Prerequisites: Completed Project Charter and approved Stakeholder Map.

3. Roles & Responsibilities (RACI)

4. Step-by-Step Procedure

Phase 1: Risk Identification

• Conduct a stakeholder workshop to define the "Risk Context" (Internal/External).
• Catalog risks using the PESTLE framework (Political, Economic, Social, Technological, Legal, Environmental).
• Categorize risks by Type: Strategic, Operational, Financial, or Reputational.

Phase 2: Assessment & Quantification

• Assign Likelihood (1-5) based on Queensland historical data trends.
• Assign Consequence (1-5) per the QGIF (Queensland Government Insurance Fund) impact matrix.
• Calculate Inherent Risk Score (Likelihood × Consequence).

Phase 3: Mitigation Strategy

• Define Treatment Plans: Avoid, Mitigate, Transfer, or Accept.
• Assign "Risk Owner" for every entry (no unassigned risks permitted).
• Establish Residual Risk Score post-mitigation.

Phase 4: Review & Monitoring

• Establish a monthly review cycle for "High" and "Extreme" risks.
• Update the registry version control system following each change.

5. Quality Assurance & Pro-Tips

• Best Practice: Ensure the "Risk Owner" is an individual, not a department. Accountability must be traceable to a single point of authority.
• Common Pitfall: Conflating "Issues" (occurred events) with "Risks" (potential events). If it has happened, move it to the Issue Log.
• Metric Threshold: Any risk with an Inherent Score > 15 must trigger a mandatory escalation report to the project Steering Committee within 48 hours.
• Q-Compliance Note: Ensure all descriptions align with the terminology used in the Queensland Treasury Risk Management Framework.

6. Frequently Asked Questions (FAQ)

Q: How do I handle risks that cross jurisdictional boundaries?
A: Default to the most stringent regulatory requirement (typically the QGISCF) and add a secondary notation for the interstate regulatory body.

Q: What is the recommended frequency for reviewing low-level risks?
A: Quarterly. However, any "Low" risk that remains static for 12 months should be flagged for reassessment or closure to prevent "register bloat."

Q: Can I use qualitative descriptors instead of numerical scores?
A: No. Institutional-grade documentation requires quantitative data for trend analysis and automated dashboard reporting. Use 1–5 scales exclusively.

End of Document
Authorized by: Julian Vance, Chief Architect, Template Registry