Risk Potential Assessment Tool (RPAT)

Download Instructions

The RPAT is a Word 2003 template and REQUIRES MACROS TO BE ENABLED in order to work.

Q

Strategic Context -€“ Section 1

Intent of Question

A1

Government Priority

How important is this for the Government?

A2

Financial Impact

What is the extent of exposure of public monies?

A3

Citizens

How will citizens be impacted?

A4

Market

How will markets and the private sector be impacted?

A5

Stakeholder Impact

How complex are the stakeholders?

A6

Other

Is there a significant risk not captured adequately elsewhere which needs to be highlighted to ministers?
(eg Security, Environment, International)

 

Q

Implementation Complexity -€“ Section 2

Intent of Question

B1

Other Jurisdictions /
Agencies / Business Areas

How many government entities are involved?

B2

Benefits

What is the extent of benefits?

B3

Organisational/cultural
change

What is the extent of change for the agency?

B4

Innovation

Is there a significant innovative implementation component envisaged?

B5

Information and
Communication
Technology

What is the extent of the ICT enablement?

B6

Procurement

How complex is the procurement envisaged?

B7

Construction

Is there a construction element?

B8

Contractual/Service
Delivery Arrangements

How complex are the delivery arrangements, including Service Delivery partners?

B9

Governance

What entities are involved (or will be involved) in the implementation.

B10

Management/team
experience

Does the agency have access to experienced resources to implement this type of proposal?

B11

Timing Constraints

Are there scheduling or program/project management challenges?

B12

Dependencies

What project/program dependencies exist? Does the proposal require new or amended legislation?

B13

Clarity of Policy

Are the policy scope and detail developed?

B14

Agency Capability

Is the agency capable of delivering the requirement?

Section A - Strategic Context analysis

Q A1) Government Priority

A1. Government priority

Very Low

Low Government profile.

Low

Med

Moderate Government interest.

High

Very High

High Government interest/priority. 

This question is directed at identifying Strategic priority placed on this proposal by Government.  If you are unsure about the answer to this question, consult your Central Agency contact.

Justification comments could include the importance or priority to the Government of the policy; what are the consequences arising for Government through non-delivery, cost blow-outs, delay, or not meeting announced or election commitments?

  • What is the importance to the government of this proposal being implemented well?

Mitigation and Residual Risk for QA1

Government Priority is set by government. Any Mitigation measure which had the effect of reducing the residual risk, would have resulted in the government changing its priority. It would be expected therefore, that the Level of Risk for QA1 would remain the same pre-and post- Mitigation.

Mitigation could demonstrate appropriate agency planning and prioritisation of the initiative; and broad implementation consideration.

Mitigation does not mean supporting the merits of agreeing to the proposal. For example, do not offer mitigations such as "the HIGH risk rating of this government election commitment will be mitigated to LOW when the proposal is agreed to and implemented". Assume the proposal will be agreed to, and focus mitigation measures (if any) on the subsequent implementation.

  • Risk treatment is unlikely to reduce the Level of Risk.

Back to top

Q A2) Financial 

A2. Financial

Very Low

Exposure of public funds, less than $50m.

Low

Med

Exposure of public funds $250-$500m.

High

Very High

Exposure of public funds, greater than $1 billion.

This question is directed at indicating what the level of potential cost and financial exposure is associated with the proposal.  In determining direct costs give consideration to:

  • Use the gross cost estimate. Do not adjust down for any offsets.
  • Include both administered and departmental costs over the forward estimates
  • Has the proposal been costed to consider all costs?
  • Any contingent liabilities that maybe taken on by Government as a result of implementation?
  • Is there potential for the proposal requiring additional funding?
  • Justification comments would include a brief financial snapshot of the proposal, and how the estimates were arrived at.

Mitigation and Residual Risk for QA2

The exposure of public funds for the RPAT ratings ranges from less than $50m - VERY LOW to greater than $1b VERY HIGH. As these are estimates being put forward as part of the NPP, it is not possible to change them through mitigation measures. Therefore, the residual risk will normally be the same as the pre-mitigation Level of Risk.

Mitigation could demonstrate appropriate agency planning and financial controls in place, or projected to be applied. Estimates could be firmed up over time through, for example, public tendering or competitive capped grants. The Two Pass processes may also be applied to develop the most cost effective solution.

  • Risk treatment is unlikely to reduce the Risk Rating.

Back to top

Q A3) Citizens 

A3. Citizens

Very Low

Low impact on small number of citizens.

Low

Med

Medium impact on moderate number of citizens.

High

Very High

Large impact on large number of citizens.

This question is directed towards assessing the level of impact on citizens, both in terms of quantum of citizens affected, or level of impact on groups of citizens. Citizens also refers to the public at large. Drafters should consider the effect the proposal will have on the public if fully delivered, partially delivered or if delivery fails. The answer should incorporate which segments of the public will be affected and the degree to which each segment will be affected.

Mitigation and Residual Risk for QA3

Mitigation could demonstrate appropriate agency planning for communication and activities which would make for successful implementation.  Consultation envisaged could be outlined.

  • Risk treatment may reduce the Risk Rating, leading to a lower residual risk.

Back to top

Q A4) Market

A4. Market

Very Low

Minimal impact on private sector.

Low

Med

Moderate negative or positive impact on private sector.

High

Very High

Significant negative or positive impact on private sector.

This question is aimed at determining the effect on the private sector, or markets.  The answer to this question should incorporate which sectors will be affected positively or negatively and the size of the effect on each sector.

The Justification should also describe the capacity of the private sector to take on any responsibilities associated with the proposal, the level of interest and opposition in the private sector as well as the size of the market in relation to government intervention.

  • Is there an impact on the Small to Medium Enterprise (SME) market?

Mitigation and Residual Risk for QA4

Mitigation could demonstrate appropriate agency planning for communication and activities which would make for successful implementation.  Consultation envisaged could be outlined.
Risk treatment may reduce the Risk Rating.

Back to top

Q A5) Stakeholders

A5. Stakeholders

Very Low

Straightforward stakeholder arrangement or no opposition of stakeholders expected.

Low

Med

Multiple stakeholders or some stakeholder opposition expected.

High

Very High

Complex stakeholder arrangements or significant stakeholder opposition expected.

This question is aimed at identifying the extent of issues in dealing with stakeholders for this proposal.  The Justification should reflect on who the stakeholders are, identify what positions or expectations they have in relation to the proposal and explain what actions will be undertaken to consult with stakeholders. Include stakeholders represented through interest groups and/or the media.

When determining a strategic Context rating, drafters should consider:

  • Whether there are a large number of different stakeholder groups;
  • What are the consequences of them having a diverse range of views;
  • What is the consequence of stakeholder opposition?

Mitigation and Residual Risk for QA5

Mitigation could demonstrate appropriate agency planning, for example development of a Stakeholder Management Strategy, including communication and activities which would make for successful implementation.  Outline consultation envisaged with stakeholders.

  • Risk treatment may reduce the Risk Rating.

Back to top

Q A6) Other

A6. All Other

Very Low

Low

Med

High

Very High

Proposal specific risk to be highlighted for Cabinet

This question is aimed at identifying other risks in the strategic context not covered in the above categories specific to a policy of this type. This section should be used to draw Cabinet's attention to any issues that are likely to be missed without a specific focus.

Examples of  "Other Risks" are significant Security, Environmental, International and Location constraints and/or issues. These categories of risk which can have consequences to government are the most common risks which do not have a specific question in the RPAT.

If you wish the entry in "All Other" to appear in the Top Five Risks within the NPP and therefore to be highlighted in the NPP, provide a rating high enough for this question (VERY HIGH or HIGH) in order for it to outrank the other questions.

Mitigation and Residual Risk for QA6

Mitigation could demonstrate appropriate agency planning to address the risk.

  • Risk treatment may reduce the Risk Rating

Back to top

Section B - Implementation Complexity

Q B1) Other Jurisdictions/Agencies/Business Areas

B1. Other jurisdictions/Agencies/ business areas

Very Low

No other jurisdictions, agencies or other business units involved.

Low

Med

Some involvement across other jurisdictions, agencies or business areas.

High

Very High

Complex involvement across jurisdictions, agencies or business units.

This question is aimed at assessing the degree to which the proposal cuts across other jurisdictions, agencies, and business areas.  The answer to this question should incorporate what involvement jurisdictions/agencies/business areas have to the proposal and how this involvement may add complexity or difficulty to the proposal.

Cross agency proposals would be likely to attract a MEDIUM or higher answer.

In addition, any involvement with States or Territories should be thoroughly addressed. If there is COAG involvement, Inter-Governmental Agreements or National Partnership Agreements envisaged, the answer to this question would likely be HIGH or VERY HIGH.

Mitigation and Residual Risk for QB1

Mitigation could demonstrate appropriate agency planning, consultation and formalisation of agreement to address the additional complexity of the involvement of multiple entities.

  • Risk treatment may reduce the Risk Rating.

Q B2) Financial Benefits

Back to top

B2. Benefits

Very Low

Less than $50m.

Low

Med

$250m - $500m.

High

Very High

Greater than $1b.

This question is seeking information on the size of the expected financial benefit which would flow from the proposal.  The answer should incorporate all anticipated financial benefits which would flow from the life of the proposal and an explanation of how these benefits would arrive.

Benefits may include additional revenue from the proposal, greater efficiencies, long term reductions in costs or other benefits that are clearly identified and captured by the proposal.

Mitigation and Residual Risk for QB2

Mitigation could demonstrate appropriate agency planning, such as development of a Benefits Realisation Strategy or Value Management approach.  The focus would be on how achieving the benefits will be managed.

  • Risk treatment may reduce the Risk Rating.

Back to top

Q B3) Organisational/Cultural Change

B3. Organisational/cultural change

Very Low

Limited impact on operations or staff.

Low

Med

Some organisational restructuring, retraining or transfer of staff/ outsourcing.

High

Very High

Very significant impact on operations or staff.  Rectifying high profile operational failure.

This question is aimed at determining what transformation or alterations to agency structure and practices/culture will occur in order to implement the proposal.  The answer should also include information on what restructuring or practice/culture changes will be occurring and why/how these changes relate to the proposal.

Proposals which require the establishment, merger or closure of an agency would likely attract a HIGH or VERY HIGH rating.

Mitigation and Residual Risk for QB3

Mitigation could demonstrate appropriate agency planning, such as development of a Change Management Strategy and staff consultation.

  • Risk treatment may reduce the Risk Rating.

Back to top

Q B4) Innovation

B4. Innovation

Very Low

Involves no new technology, development, methods, production or tools.

Low

Med

Involves new techniques but with a stable application or known techniques but with new application.

High

Very High

Use of new or untried technology, development, methods, production or tools with high degree of complexity or uncertainty.

This question is designed to determine how much innovation will be incorporated into the proposal. This aims to capture the inherent risks in developing and delivering proposals that involve significant new or untried methods of practice/technology.

  • What innovative tools or applications are to be used in the proposal and has this innovation been previously been used and the success of this previous use?

Mitigation and Residual Risk for QB4

Mitigation could demonstrate appropriate agency planning, such as development of a Risk Management Strategy, contingency planning and a Blueprint for the expected end state.

  • Risk treatment may reduce the Risk Rating.

Back to top

Q B5) Information Technology

B5. Information Technology

Very Low

No IT component.

Low

Med

Infrastructure required/ Packaged software /data migration/some links to other internal/external systems.

High

Very High

Significant infrastructure requirements/complex data migration/extensive and/or complex links to internal/external systems.

This question is directed at determining the level and complexity of ICT for the proposal.  The answer to the question should provide information on the complexity and structure of proposed ICT and how this ICT is incorporated into the whole proposal.

The information provided in the answer boxes is advisory as there are many other potential complexity areas around ICT which should all be discussed within the answer.

Drafters should also consider;

  • the levels of skills required to implement the proposed ICT
  • and the availability of those skills

Mitigation and Residual Risk for QB5

Mitigation could demonstrate appropriate agency ICT planning, such as adherence to whole-of-government policies on commercial-off-the-shelf software and data centres. Proposals subject to the ICT Two Pass process would likely attract a HIGH or VERY HIGH rating.

  • Risk treatment may reduce the Risk Rating.

Back to top

Q B6) Procurement

B6. Procurement

Very Low

No procurement.

Low

Med

Delivery of complex products/services.

High

Very High

Significant customised element. Multi stage procurement process.

This question is designed to determine the extent of formal procurement or tendering out envisaged for the proposal.  The answer to this question should incorporate all connected procurement and the complexity associated with each of the procurement processes proposed.

Particular attention should be given to:

  • known instances where similar procurements have failed
  • exceeded budget
  • or where market capability has been unable to meet the specified procurement.

Mitigation and Residual Risk for QB6

Mitigation could demonstrate appropriate agency planning, such as adherence to the Commonwealth Procurement Guidelines and the tendering approach.
Risk treatment may reduce the Risk Rating.

Back to top

Q B7) Construction

B7. Construction

Very Low

No construction requirements.

Low

Med

New construction using non-standard construction.

High

Very High

Unique Commonwealth construction or other construction with extensive customised elements.

This question is designed to determine the level and nature of construction in the proposal.  The answer to this question should incorporate all  construction and the complexity associated for each construction proposed.

There are many areas of construction which may add complexity, such as:

  • heritage/architectural value,
  • proximity to areas associated with indigenous culture/identity,
  • to be used for highly sensitive activity and a wide variety of other issues which should be all addressed within the Justification.

Proposals subject to the Two Pass and/or Public Works Committee process would likely attract a HIGH or VERY HIGH rating for this question.

Mitigation and Residual Risk for QB7

Mitigation could demonstrate appropriate agency planning, such as adherence to the Commonwealth's Property Management Framework.

  • Risk treatment may reduce the Risk Rating. 

Back to top

Q B8) Contractual/Service Delivery Arrangements

B8. Contractual/Service Delivery arrangements

Very Low

No contract/ delivery arrangements required.

Low

Med

Multiple suppliers but with single prime contractor.
Separate Service Delivery entity.

High

Very High

Complex commercial arrangements.  Multiple suppliers without prime contractor or multiple Service Delivery partners.

This question is designed to determine the nature and level of commercial or Service Delivery arrangements associated with this proposal.  The answer to this question should address how contracts or agreements for delivery are set-up and the private sector or other delivery partner's capacity to meet supply needs.  It should also indicate the effect that contract and supply arrangements may have on the industry or service delivery segment.

Where another Commonwealth agency is providing Service Delivery for the proposal, this is likely to attract a MEDIUM, HIGH or VERY HIGH rating. It would be expected that early consultation had occurred with service delivery agency.

Mitigation and Residual Risk for QB8

Mitigation could demonstrate appropriate agency engagement with the Service Delivery partner, or Procurement Strategy planning.

  • Risk treatment may reduce the Risk Rating.

Back to top

Q B9) Governance

B9. Governance

Very Low

Straight forward and stable governance structure.

Low

Med

Some governance issues identified and actions developed to correct them.

High

Very High

Complex governance structures likely to change during life of implementation.

How complex are the governance arrangements for the proposal? How mature is the decision making structure envisaged? Are there complex structures such as cross agency or interdepartmental committees, inter jurisdictional governance arrangements or external representation in the governance arrangements?

The answer to this question should address any issues which would add to the likelihood of governance complexity leading to implementation challenges.

Mitigation and Residual Risk for QB9

Mitigation could demonstrate appropriate agency planning, such as establishment of Project or Program Boards, Steering Committee or an Inter Departmental Committee.

  • Risk treatment may reduce the Risk Rating.

Back to top

Q B10) Management/team experience

B10. Management/ team experience

Very Low

Fully resourced and skilled team and management.  No recruitment requirement or specialist training.

Low

Med

Key skills/experience in place but recruitment or training required for staff.

High

Very High

Key skills/experience lacking or not available. Significant new resources or training required. 

This question is aimed at determining the resources allocated to, or available to implement the proposal. What is the level of team and management experience for the proposal?  The Justification to this question should indicate what level of skills and experience are expected and how/if the current management and team fill this.

What difficulties may arise for recruiting staff/management currently missing skills/experience? The ease of importing the skills externally or internally should be considered.

Mitigation and Residual Risk for QB10

Mitigation could demonstrate appropriate agency resource planning, including how project/program and technical resources would be recruited or assigned.

  • Risk treatment may reduce the Risk Rating.

Back to top

Q B11) Timing Constraints

B11. Timing Constraints

Very Low

No challenge in meeting timetables.

Low

Med

Compressed or extended timeframe for delivery.

High

Very High

Schedules very difficult, no contingency allowed.  Uncontrolled changes to deadlines likely.

The question is aimed at determining if there are timing constraints which add complexity to the proposal.  The answer to this question should incorporate any timing constraints (for example fixed dates for commencement of proposal) and how these constraints will add complexity to ensuring delivery of the proposal on time, on budget and to expectations.

Mitigation and Residual Risk for QB11

Mitigation could demonstrate appropriate agency planning, such as development of project/program timelines; risk management and contingency planning.

  • Risk treatment may reduce the Risk Rating.

Back to top

Q B12) Dependencies

B12. Dependencies

Very Low

No dependence on success of other projects/programs and no legislation required.

Low

Med

Some dependence on successful delivery of other projects/programs OR existing legislation required.

High

Very High

Fully dependant on successful delivery of other projects/programs OR new or amended legislation required.

This question is directed towards understanding the level of dependence of this proposal on successful implementation of other projects/programs or on the passage of legislation.

Consideration needs to be given to dependant projects/programs, including:

  • what other projects/programs this proposal is dependent on,
  • and the current status of these projects/programs and the level of dependence.

If new or amended legislation is required, drafters should choose Very High as the answer. This will normally have the effect of promoting Q12 Dependencies into the Top Five Risks, and would consequently be included in the NPP.

Further, arising from the recent High Court judgement in Williams v Commonwealth [2012] HCA 23, agencies must consider whether the NPP:

  • has or will require legislative authority to spend; and
  • is within the scope of Commonwealth legislative power.

Mitigation and Residual Risk for QB12

Mitigation could demonstrate appropriate agency engagement with legislative drafters and planning for timely progress through Parliament. Cross program planning, possibly through agency Portfolio Management, could also demonstrate proposed management of dependencies.

  • Risk treatment may reduce the Risk Rating.

Back to top

Q B13) Clarity of Policy

B13. Clarity of Policy

Very Low

There is clarity of policy and high level of policy development assurance.

Low

Med

Developing clarity of policy and some level of policy development assurance.

High

Very High

Lack of clarity of policy and low level of policy development assurance.

This question is aimed at uncovering how well developed and well understood the proposal is. The level of policy development assurance planned should be taken into account when determining this.
The Justification to this question should consider:

  • the detail of direction given by Government for the proposal (detailed or very high level),
  • if all parties signed up understand the proposal in the same way (e.g. States and Territories, or if industry input is envisaged for final program design)
  • and what mechanisms are in place to manage this.

Mitigation and Residual Risk for QB13

Mitigation could demonstrate appropriate agency planning, such as timing of government response to reports, Green/White paper progress, COAG or other inter jurisdictional agreement progress and contingency planning if policy expectations change.

  • Risk treatment may reduce the Level of Risk, leading to a lower residual risk.

Back to top

Q B14) Agency Capability

B14. Agency Capability

Very Low

Agency has extensive experience with previous comparable outputs.

Low

Med

Agency experience with comparable projects but with new complexities for delivery.

High

Very High

No previous experience with this kind of proposal.

This question is directed to answering how proficient/experienced an agency is in delivering this type of proposal.  The answer to this question should incorporate capability demonstrated in the delivery of similar outputs by the agency, if the agency has retained relevant capabilities since the last similar delivery and what lessons have been learned about prior initiatives.

Agencies may include;

  • outcomes from recent agency capability reviews, or P3M3 assessments
  • capability improvement strategies.
  • consideration should be given to Workforce Planning, and the impact on the agency of implementing the proposal

Whether the implementation of a new policy initiative is managed by an agency as "business as usual" or via project management disciplines, there will be a wide variance in capability, skills and expertise required to ensure success. In determining workforce impact and associated risks, give consideration to the following:

  • What implications does this initiative have for the agency's workforce (capacity, capability, location, functional alignment to business delivery)?
  • What new skills or capabilities will become important to achieve business outcomes and how will they be acquired (developed internally or attracted from external sources)?
  • What is the current availability of these new skills and capabilities in the external labour market and what is the level of impact if they are not available at critical time points in the implementation?
  • What skills and capabilities will no longer be required and how will this surplus be managed?

Mitigation and Residual Risk for QB14

Mitigation could demonstrate appropriate agency workforce and organisational planning.

  • Risk treatment may reduce the Risk Rating.

Back to top

Contact for information on this page: Assurance Reviews