Risk oversight and management

Risk management in the Listed Entity identifies and addresses the uncertainty in achieving our purpose. The objective of risk management is to identify potential areas of risk and develop appropriate risk mitigation strategies, thereby enhancing our ability to respond to the Courts and Native Title Tribunal requirements, Australian Government policy and legislative change, and to assist in providing the public with the efficient and effective delivery of justice.

Success depends upon developing our people, strengthening and adapting systems, and forging strong relationships with stakeholders. By carefully applying appropriate risk management principles we will maximise the efficiency and effectiveness of planning and decision-making, managing uncertainty and the effective use of resources to achieve the desired outcomes.

The Listed Entity’s Risk Management Framework and Plan, developed in accordance with the methodology set out in Commonwealth Risk Management Policy 2014 and the Australian/New Zealand Risk Management Standard (AS/NZS ISO 31000:2018), provides a structured and systematic approach to defining potential threats, measuring their impact and determining appropriate actions. The risk management framework supports the identification, analysis, assessment, treatment, monitoring, and review of all strategic, financial, reputational, personnel, political and operational risks.

The Listed Entity’s risk framework is designed to:

• ensure risk management supports the purposes prescribed in legislation.
• support a culture which encourages people to report incidents and take ownership of problems.
• ensure risk management awareness is embedded in all activities; positively contributing to better outcomes.
• ensure relevant stakeholders are consulted to enable the broadest consideration of risk.
• identify and manage entity-wide strategic risks and program or project-specific risks.
• promote sharing of risk information and experiences within the Listed Entity and across the Australian Government Community of Practices to develop more consistent approaches to managing risk.
• align with the PGPA Act and the Australian Government’s expectations as detailed in the Commonwealth Risk Management Policy.

Risk management priorities

The Listed Entity’s risk management priorities are established based on seven broad risk categories:

1. Human Resources – risks that affect staffs’ ethical behaviour, including integrity of decisions, processes and information, or those that affect the work, health and safety and wellbeing of our personnel, including psychosocial risks.
2. Compliance and Statutory – risks that affect integrity and accountability resulting in potential legislative non-compliance and/or reputational damage.
3. Financial – risks that result in potential impacts on financial sustainability.
4. Information Technology Systems – risks that affect information systems and potential impact on program delivery and court operations.
5. Cyber Security – risks of cyber intrusion or data breach resulting in potential harm, loss or disruption to Courts’ and Native Title Tribunal’s operations
6. Service Delivery – risks affecting ability to deliver services and programs in line with Corporate Plan and/or stakeholder expectations resulting in program delays and reputation impact.
7. Physical Security – risks affecting protective security which undermines the confidence of stakeholders, government and the public.
8. Delivery – risks affecting effective delivery of strategic capital projects impacting operations of the Court and Native Title Tribunals resulting in a loss of stakeholder confidence.

Oversight

The Audit and Risk Committee is established in accordance with section 45 of the PGPA Act and provides specific functions to assist with meeting the Accountable Authority obligations.

The functions of the committee are to:

• provide independent assurance on the effectiveness of the Listed Entity’s Risk Management Framework.
• review compliance with the Listed Entity’s Risk Management Policy and monitor and understand the potential impact of emerging risks on the Listed Entity’s ability to achieve its objectives.
• monitor the implementation of the Listed Entity’s Risk Management Plan.
• review compliance with finance law, including financial and performance reporting, risk reports periodically (quarterly and annual reports), and the internal control programs advising whether key controls are appropriate and are operating effectively.
• provide assurance that the Listed Entity has well-designed business continuity and IT disaster recovery arrangements in place and that these are tested periodically.

The Governance and Risk Planning Committee (GRPC) was established in 2024, superseding the Enterprise Risk Management Committee (ERMC). The GRPC has oversight of the implementation and operation of the Listed Entity Risk Management Plan and is accountable to and supports the Accountable Authority by making recommendations concerning:

• the Listed Entity Risk Management Framework including the policy and plan.
• the Accountable Authority’s Enterprise Risk Appetite Statement.
• the Enterprise Wide Risk Register.
• risk treatment strategies and action plans.

Additionally, the Integrity Uplift Committee (IUC) was established to promote and oversee the implementation of integrity awareness within the Listed Entity. The IUC is primarily tasked with ensuring that integrity, transparency and accountability remain fundamental to the Courts' and the Native Title Tribunal’s operations and culture, in alignment with the National Anti-Corruption Commission (NACC) guidelines and Listed Entity’s ethical standards.

Risk management oversight, together with broader responsibility for governance and compliance matters is overseen by the Governance, Risk and Compliance area within Corporate Services.

Figure 1. Federal Court Listed Entity risk management structure.

Table 1. Risk faced by the Listed Entity.