Establishment

The accountable authority (secretary) of the department must ensure that the entity has an audit and risk committee. This is in accordance with subsection 45(1) and 45(2) of the Public Governance, Performance and Accountability Act 2013 (PGPA Act).

Role and function of the committee

Subsections 17(1) and 17(2) of the Public Governance, Performance and Accountability Rule 2014 (the Rule) establish mandatory functions for audit committees:

  • The accountable authority of a Commonwealth entity must, by written charter, determine the functions of the audit committee for the entity.
  • The functions must include reviewing the appropriateness of the accountable authority's:
    • financial reporting
    • performance reporting
    • system of risk oversight and management
    • system of internal control.

The committee will also review:

  • internal audit resourcing and coverage in relation to the department's key risks and recommend approval of the internal annual audit plan by the secretary. The committee will oversee the independence, effectiveness and performance of the internal audit function. This includes confirming internal audit activities are carried out in accordance with the Global Internal Audit Standards issued by the Institute of Internal Auditors (IIA).
  • internal and Australian National Audit Office (ANAO) audit reports. The committee will give advice to the secretary about significant issues identified, and the implementation of agreed actions in accordance with the department's agreed approach.

The committee should indicate which matters it will consider during any given year in a forward plan (the work plan). It may consider other matters in response to changes in the department's operations and environment.

Financial reporting

The committee will review the appropriateness of the department’s financial reporting, to comply with subsection 17(2)(a) of the Rule.

This includes a review of the financial information systems and the appropriateness of the department’s financial reporting in compliance with the mandatory requirements of the:

  • PGPA Act
  • Rule
  • Australian Accounting Standards Board Accounting Standards (AASBs).

The committee will review the appropriateness of financial reporting by:

  • reviewing the department’s processes and systems for preparing financial reporting information and financial recordkeeping
  • reviewing the processes in place, allowing the department to stay informed throughout the year of any changes or extra requirements about financial reporting
  • reviewing the:
    • annual financial statements, including compliance with the PGPA Act, the Rule and the AASBs
    • extra department information (other than financial statements) required by the Department of Finance to prepare the Australian Government consolidated financial statements. This includes the supplementary reporting package.
  • providing written advice to the secretary about the appropriateness of the department’s financial reporting. This includes its annual financial statements and identify any areas of concern and suggestions for improvement.

Performance reporting

The committee will review the appropriateness of the secretary’s performance reporting for the department, in compliance with subsection 17(2)(b) of the Rule. This will include a review of the department’s performance information, systems and framework and the completeness and appropriateness of its performance reporting.

The committee will review the appropriateness of performance reporting by: 

  • reviewing the department’s systems and procedures for assessing monitoring and reporting on the department’s performance. Specifically, the committee will satisfy itself that the departments:
    • portfolio budget statements and corporate plan contain appropriate details of how to measure and assess the department’s performance. 
    • approach to measuring its performance over the financial year against the performance measures in the portfolio budget statements and corporate plan is appropriate. The approach must also comply with the Commonwealth Performance Framework.
    • systems and processes for preparation of its annual performance statement and inclusion of the statement in its annual report is appropriate.
  • providing written advice to the secretary of its view on the appropriateness of the department’s performance reporting. This includes its annual performance statement and identify any areas of concern and suggestions for improvement.

System of risk oversight and management

The committee will support the secretary, who must create and maintain an appropriate system of risk oversight and management for the department. This follows compliance with section 16(a) of the PGPA Act and subsection 17(2)(c) of the Rule, as well as the Commonwealth Risk Management Policy. This review will consider if identified risks and their treatments are consistent with the committee’s:

  • understanding of the department’s operating context
  • experience in risk management.

In undertaking this function, the committee will consider if:

  • management has a current and appropriate enterprise risk management framework and the necessary internal controls for the effective identification and management of the department’s risks. This is in keeping with the Commonwealth Risk Management Policy.
  • an appropriate approach has been followed in managing the department’s key risks. This includes those associated with individual projects and program implementation and activities.
  • the department’s processes to develop and adopt fraud control arrangements are consistent with the Commonwealth Fraud Control Framework and comply with section 10 of the Rule requirements. The committee must be sure that the department has good process design for detecting, capturing and effectively responding to fraud risks.
  • management has developed risk management capability in the department and if key roles, responsibilities and authorities about risk management are clearly articulated.

In fulfilling its review of the appropriateness of the department’s system of risk oversight and management, the committee will give written advice to the secretary. The advice will cover the committee's view of the appropriateness of the department’s system of risk oversight and management. It will also identify any areas of concern and suggestions for improvement. Advice will relate to the Commonwealth Risk Management Policy.

Where management proposes to accept a level of risk, it is their responsibility to escalate the matter to the secretary as necessary. Management must do this before the committee meets, particularly where the proposal may exceed the department’s risk appetite or tolerance. Consistent with its advisory role, the committee may also escalate any risks or issues it identifies to the secretary where necessary. This includes any matters that remain unresolved.

System of internal control

The committee will review the appropriateness of the system of internal control for the department, in compliance with subsection 17(2)(d) of the Rule.

In undertaking this function, the committee will consider:

  • Internal control framework:
    • management's approach to maintaining an effective internal control framework and if processes are in place to assess key policies and procedure compliance
    • reviewing the department’s procurement and contract management activities
    • if management has relevant policies and procedures in operation. For example, accountable authority instructions, delegations and authorisations, a business continuity management plan and bullying and harassment policies.
  • Legislative and policy compliance:
    • the effectiveness of systems for monitoring the department’s compliance with laws, regulations and associated government policies with which the department must comply
    • if management has adequately considered legal and compliance risks as part of the department’s enterprise risk management framework and fraud control framework.
  • Security compliance:
    • management’s approach to maintaining an effective internal security system and information, communication and technology security policy (including complying with the Protective Security Policy Framework).
  • Internal audit coverage:
    • ensure that coverage considers the department’s primary risks, and recommend approval of the internal audit work plan by the secretary
    • provide advice to the secretary on major concerns identified in internal audit reports, and recommend action on significant matters raised. This includes identification and dissemination of information on good practice.
    • periodically reviewing the effectiveness, independence, resourcing and performance of the internal audit function. This includes internal audit’s quality assurance and improvement program (QAIP) and the outcomes of any internal or external quality assessments.
  • Ethical and lawful conduct:
    • assess if management has taken steps to embed a culture that promotes the proper use and management of public resources and ethical and lawful conduct.
  • Business continuity:
    • decide if approach to set up business continuity planning arrangements is sound and effective. This includes if business continuity and disaster recovery plans have been periodically updated and tested.
  • Parliamentary committee reports and external audit and reviews:
    • decide if the department has appropriate mechanisms to review relevant parliamentary committee reports, external reports (Auditor-General, Joint Committee of Public Accounts and Audit (JCPAA) and royal commissions etc.) 
    • reviewing the adoption of agreed recommendations from ANAO audits or JCPAA and other parliamentary committee reports directed to the department.

The committee will give written advice to the secretary on the appropriateness of the department’s internal control system. It will also identify any areas of concern and suggestions for improvement.

Membership

Composition

Consistent with subsection 17(4) of the Rule, a majority of members must be persons who are not official of any Commonwealth entity.

The committee comprises a minimum of 3 members who:

  • have appropriate qualifications, knowledge, skills or experience to assist the committee to perform its functions
  • are not officials of the department, in accordance with subsection 17(3) of the Rule.

This requirement applies in the minimum 3 member composition and does not create an obligation to appoint more members beyond that minimum.

Selection and appointment

The identification and selection of members and departmental advisors is at the discretion of the secretary in consultation with the chair. They will consider the collective knowledge, skills and experience the committee needs to fulfil its responsibilities under this charter.

The secretary appoints the chair, members and decides their term length. The chair appoints the deputy chair.

Skills and knowledge

Consistent with subsection 17(3) of the Rule, members will collectively have a broad range of knowledge, skills and experience relevant to department operations. This includes its information technology environment.

All members should be experienced with financial management reporting, and:

  • at least one member must have accounting or related financial management experience or qualifications, and a broad understanding of accounting and auditing standards
  • at least one member must have ICT-related experience or qualifications, and a broad understanding of ICT risk management. 

Collectively, committee members will maintain sufficient knowledge of contemporary internal audit standards and assurance practices to allow effective oversight of the internal audit function.

Departmental advisors should collectively contribute knowledge of the breadth of the department’s business and its operating context. Departmental advisors will receive all papers and attend all meetings.

Remuneration

Independent committee members will receive remuneration at a level that reflects:

  • the expertise and skills the member brings to the committee
  • the time required for meeting preparation, attendance at meetings and interaction with management outside of committee meetings.

The members from other Commonwealth entities will not receive remuneration.

Observers

Consistent with subsection 17(5) of the Rule and the department’s governance structure, certain members of the department cannot be members of the committee. However, they may attend meetings as observers.

This includes the:

  • secretary
  • chief financial officer
  • chief information officer
  • chief internal auditor
  • chief operating officer
  • general counsel.

Representatives from the ANAO and external providers of internal audit services cannot be members of the committee. However, they may attend relevant committee meetings (in whole or in part) as observers, as determined by the chair or by the committee.

Observers may, as determined by the chair or by the committee, receive copies of committee papers as appropriate.

At the chair's discretion internal staff or external parties may attend meetings (in whole or in part) as invited guests.

Independence

The committee is directly accountable to the secretary for the performance of its functions.

The committee has no executive powers on the operations of the department. The committee may only review the appropriateness of aspects of those operations, consistent with its functions, and advise the secretary accordingly.

The secretary and officials of the department are responsible for the appropriateness of the department's: 

  • financial reporting
  • performance reporting
  • system of risk oversight and management
  • system of internal control.

The committee will annually assess the organisational independence of the internal audit function and the chief internal auditor. This includes if any actual, perceived or potential impairments to independence exist and the adequacy of safeguards in place to manage them.

Conflict of interest

Committee and sub-committee members must declare in writing any actual, perceived or potential conflict of interest they may have about their responsibilities. Members must submit a declaration on engagement of their role and each year thereafter. The secretary will review all member declarations.

Members should consider past employment, consultancy arrangements and related party issues in making their declaration. The committee must show the secretary that there are sufficient processes in place to manage any actual, perceived or potential conflict.

Members must declare any actual, perceived or potential conflict of interest that may apply to specific matters on the meeting agenda. Members must make their declaration at the beginning of each committee or sub-committee meeting. Where needed the chair will excuse the member from the meeting or from the committee’s consideration of the relevant agenda item(s). Meeting minutes will appropriately reflect any conflict details and actions taken.

The chair in consultation with the deputy chair will manage conflicts of interest.

If the chair has an actual, perceived or potential conflict, they must declare it to the secretary before the meeting starts. In the secretary’s absence, they must declare it to the deputy secretary with responsibility for governance matters.

Authority

The secretary authorises the committee, in performing its functions to:

  • seek any information it requires from:
    • any official of the department
    • external parties, including the ANAO, subject to any legal obligation to protect information.
  • request legal or other professional advice at the department’s expense:
    • as considered necessary to meet its responsibilities
    • subject to approval by the appropriate delegate.
  • request the attendance of any official of the department at meetings, as appropriate
  • meet privately with the chief internal auditor, without management present, as it considers appropriate
  • request the attendance of a committee member, as selected by the Audit and Risk Committee, at internal committee meetings in the department (as an observer), as appropriate.

The secretary directs officials of the department to cooperate with the committee.

Sub-committees

The committee, in consultation with the secretary, may create sub-committees to help meet its responsibilities. It will appoint a member of the committee as the chair of the sub-committee.

The committee will document and approve the responsibilities, membership and reporting arrangements for each sub-committee. Sub-committees must develop their own terms of reference, which the committee will review annually.

The sub-committee will report its actions to the committee. Any matter deemed of sufficient importance will be reported to the secretary through the chair of the committee.

Meetings

The committee will meet at least 4 times per year, or more often if needed. The committee may hold special meetings to review the department's annual financial statements, annual performance statements or to meet other specific responsibilities.

The chair:

  • will call a meeting if requested to do so by the secretary
  • may call a meeting if requested by another committee member.

A quorum for any committee meeting will be 3 members, one of whom must be the chair or the deputy chair. All committee members must attend each meeting in person or remotely. Attendance reporting follows legislative obligations.

Secretariat

In accordance with this charter, the department will provide secretariat services to the committee as determined by the secretary. The secretariat will make sure:

  • the chair approves the agenda for each meeting
  • the agenda and supporting papers circulate, where possible, at least one week before the meeting
  • to prepare and maintain the minutes of the meeting.

The chair and members must receive the minutes in a timely manner for review. Committee advisers and observers must also receive the minutes at the next meeting of the committee.

Reporting

The chair will report to the secretary after each meeting. The secretary must immediately receive reports on matters deemed of sufficient importance.

The committee will, as often as necessary, and at least once a year, report to the secretary on its operation and activities during the year. This includes its views on the effectiveness of internal audit, risk management and internal control arrangements.

Review of functions

The chair of the committee will initiate a review of the performance of the committee and any sub-committees at least once every 2 years. The secretary will receive the outcomes of these reviews.

The committee will review the appropriateness of this charter at least annually. The secretary will receive and approve the outcomes of these reviews.

Disclosure and use of information

Committee members must not use or disclose information obtained by the committee except in meeting the committee’s responsibilities, or unless expressly agreed by the secretary.

More information

Learn about the Audit and Risk Committee