Risk Potential Assessment Tool General Guidance (RMG 107)

To support government consideration of your New Policy Proposal, the Risk Potential Assessment Tool (RPAT) template provides a standardised assessment and presentation of risks in your proposal.

The Risk Potential Assessment Tool Guidance Resource Management Guide No. 107 is available to assist you with completing your RPAT.

You must complete a RPAT for each New Policy Proposal with an estimated financial implication of $30 million or more. Where the level of risk before mitigation is ‘medium’ or higher, you must provide a copy of your RPAT to the relevant Finance Agency Advisory Unit in Budget Group. The level of risk will be used to determine whether additional assurance such as an Implementation Readiness Assessment or Gateway Review may be required.

You may opt to complete an RPAT for proposals with a financial implication of less than $30 million if you choose to do so.

Audience

This guide applies to officials of Commonwealth entities who are responsible for preparing Risk Potential Assessment Tools as part of a New Policy Proposal (NPP) within the Budget process.

Key points

Budget Policy requires that entities complete a Risk Potential Assessment Tool (RPAT) for each NPP with an estimated financial implication of $30 million or above. The RPAT may still be used as an opt-in better practice measure for NPPs with financial implications of less than $30 million.

The purpose of the RPAT is to assist entities to determine and communicate the potential risk of a proposal to ministers before seeking cabinet’s agreement. The risk rating of a proposal can also inform whether additional assurance processes may apply.

Resources

This guide is available on the Finance website.

Other relevant publications include:

Introduction

  1. This guide will assist you with completing your RPAT. The RPAT is the first step in the assessment of risk when developing a NPP, and provides a standard set of high-level criteria for assessing the degree of strategic importance and implementation complexity.  The RPAT assists to identify the risks that need to be managed. Identifying a source of risk is an important step and helps to establish the extent to which that source plays a contributory role, either in terms of the likelihood of the risk occurring and/or its impact.
  2. The RPAT is not an exhaustive risk analysis model, although it can inform and complement a fuller program/project risk analysis. The RPAT is a template provided to Commonwealth entities (entities) to standardise the assessment and presentation of risks in NPPs and to better support government consideration. The RPAT uses an entity’s responses to develop a risk rating for each NPP which is also used as a basis to determine whether or not a proposal may be subject to an assurance review (i.e. the Gateway review process or an Implementation Readiness Assessment).

Part 1 – Risk Potential Assessments

  1. The RPAT must be completed for each NPP with an estimated financial implication of $30 million or above (refer relevant Estimates Memoranda). Where the Level of Risk (before mitigation) is MEDIUM or higher, a copy of the RPAT must be provided by the entity to the relevant Finance Agency Advice Unit (AAU) in Budget Group.
  2. Where multiple NPPs contributing to a single policy objective are presented to cabinet as a package within a single submission, an additional whole of submission RPAT must be provided to Finance.
  3. Also, where an NPP is seeking in principle agreement from government to develop a more detailed case for options (e.g., First Pass consideration), the RPAT must reflect the total proposal being put forward, as best as it is known (i.e. it must not be limited to the activities to be undertaken between First Pass/First Stage and Second Pass/Second Stage consideration).
  4. The RPAT must be submitted to Finance as soon as practicable, and well in advance of the planned consideration by cabinet.
  5. After government approval of an NPP, if there is a significant change to one or more risk factors affecting the NPP’s implementation, the implementing entity is required to complete a revised RPAT. The updated RPAT must be provided to Finance if the estimated financial implication is $30 million or above and the Level of Risk (before mitigation) is medium or above.
  6. The RPAT template contains twenty-one mandatory questions – seven relating to Strategic Context and fourteen relating to Implementation Complexity. Responses to these questions are to reflect pre mitigation levels of risk and be developed in line with this guidance document.

How to complete the RPAT

The RPAT is a Microsoft Word 2003 template which can be downloaded from this website:

Risk Potential Assessment Tool

Macros must be enabled for the calculations contained in the form to function correctly. When providing Finance with a copy of the RPAT, it must remain a Word 2003 document. Do not send completed RPATs as PDF documents or in other file formats.

The 21 Questions in the RPAT

  1. The questions are designed to enable consistent consideration of risk sources at the pre‑government decision stage, within a standard evidence based document. Each question in Section A and B is answered by entering two pieces of information; the Risk Rating and Justification.

1. Risk Rating

  1. Each question requires one choice from VERY LOW, LOW, MEDIUM, HIGH and VERY HIGH.
  2. A brief text prompt specific to each question is provided to guide the selection.

2. Justification

  1. The Justification field allows the entity to state the assumptions underpinning the selection of a Risk Rating for that question. Text can be entered, or copied/pasted from supporting documentation.
  2. Text in the Justification field will be extracted by the template to the Top Five Risks table (if that question is ranked in the Top Five Risks). Ensure text is succinct – approximately 250 characters is recommended – with a maximum of 1 page allowed for each question.

3. Creating the Top Five Risks table

  1. CLICK on the Add Top Risks button. This will automatically extract the Top Five Risks from the 21 questions (i.e. those with the highest risk rating).
  2. The Top Five Risks are ranked in order of individual question Risk Rating, e.g., all the VERY HIGHs are extracted first, then the HIGHs and so on. Then, the order in which the extracted Top Five Risks are presented is based on the question ordering, e.g., Q1 will be presented before Q2 if both are VERY HIGH.
  3. An example Top Five Risks table is at Appendix A.

4. Adding mitigation and Residual Risk

  1. Risk mitigation is the process of developing options and actions to enhance opportunities and reduce threats to project objectives. 
  2. Once the Top Five Risks table is created, drafters must enter mitigation information into the table. Drafters also have the opportunity to alter the Residual Risk rating, which may affect the Overall Risk (including mitigation) in the Risk Summary. For the RPAT, mitigation, or the risk treatment, is directly related to the implementation risks which may arise assuming the proposal proceeds.  Drafters are expected to consider the strengths and weakness of mitigation information entered.
  3. Although only the Top Five Risks require mitigation to be entered in the RPAT, drafters are expected to consider mitigation for all risks outlined in the RPAT. 
  4. It is strongly advised to keep a copy of the mitigation text entered in a separate document during the drafting process, as the mitigation text may be lost. This occurs if drafters need to clear the risks, and re-generate to adjust the Top Five Risks listing. Mitigation text will need to be re-entered into the table.

Residual Risk

  1. Residual Risk is the risk remaining after mitigation (risk treatment). The Overall Risk (including mitigation) rating may be reduced after the mitigation is applied.
  2. Please note that while some questions in the RPAT can have mitigation strategies that lead to a lower risk rating, there are some categories where the risk rating will not reduce (e.g., if the proposal is for a signature reform, which attracts a VERY HIGH risk rating for Government Priority, the residual risk can only be lowered if the Government Priority is lowered).
  3. The detailed guidance below provides advice on which of the risks are unlikely to have a lower Residual Risk.
  4. Residual Risk must only be changed (lowered) where there is evidence to suggest the options for the treatment of the risk would lower the likelihood of it occurring.

Risk Summary

  1. The Strategic Context rating is determined by the answers to the questions in Section A.
  2. The Implementation Complexity rating is determined by the answers to the questions in Section B.
  3. The Legal Risk rating, if HIGH, will affect the Level of Risk (before mitigation) and the Overall Risk (including mitigation) so that the minimum rating for these two indicators will be HIGH. 
  4. The Level of Risk (before mitigation) is calculated by the intersection of Strategic Context and Implementation Complexity.  This rating is highlighted and bolded in the table as it is the risk that is used to determine if Finance requires the completed RPAT.
  5. Overall Risk (including mitigation) is calculated from the potentially lowered residual risk ratings applied to the Top Five Risks. The Overall Risk (including mitigation) will often not be different to the Level of Risk (before mitigation), as the RPAT form only has provision for five of the 21 questions to have their residual risks lowered.   
  6. An example Risk Summary table is at Appendix A.

Part 2 – Questions’ intent

Section A – Strategic Context analysis

Q A1) Government Priority

A1. Government Priority

Very Low

 

Very low government profile.

Low

 

Med

 

Moderate government interest.

High

Very High

 

Very high government interest/priority. 

Identify the strategic priority placed on this proposal by government.  If you are unsure about the answer to this question, consult your central entity contact.

Mitigation and Residual Risk for QA1

Mitigation strategies are unlikely to affect the government’s priority; this can only occur were government to change their strategic priorities for Budget. Therefore, the residual risk would normally remain the same as the pre-mitigation Level of Risk.

  • Risk treatment is unlikely to reduce the Level of Risk.

Q A2) Financial Impact

A2.
Financial Impact

Very Low

 

Exposure of public funds, less than $50m.

Low

 

Med

 

Exposure of public funds $250-$500m.

High

 

Very High

 

Exposure of public funds greater than $1 billion.

Indicate the level of cost and financial exposure associated with the proposal.  In determining direct costs give consideration to:

  • using the gross cost estimate (do not adjust down for any offsets)
  • including both administered and departmental costs over the forward estimates
  • whether all costs have been considered
  • any contingent liabilities that may accrue to government as a result of implementation; and
  • whether the proposal is likely to require additional funding.

Mitigation and Residual Risk for QA2

The exposure of public funds for the RPAT ratings range from less than $50 million – VERY LOW to greater than $1billion – VERY HIGH. As these are estimates being put forward as part of the NPP, it is not possible to change them through mitigation measures. Therefore, the residual risk will normally be the same as the pre-mitigation Level of Risk.

  • Risk treatment is unlikely to reduce the Risk Rating.

Q A3) Citizens

A3. Citizens

Very Low

 

Low impact on small number of citizens.

Low

Med

 

Medium impact on moderate number of citizens.

High

Very High

 

Large impact on large number of citizens.

Assess the level of impact on citizens, both in terms of number of citizens affected, or impact on groups of citizens. Citizens are defined as an Australian Citizen or Australian Resident. Drafters are expected to consider the effect the proposal will have on the citizens if fully delivered, partially delivered or if delivery fails. It is expected that the answer will include which segments of the public will be affected and the degree to which each segment will be affected.

Mitigation and Residual Risk for QA3

  • Risk treatment may reduce the Risk Rating.

Q A4) Market

A4. Market

Very Low

 

Minimal impact on private sector.

Low

 

Med

 

Moderate negative or positive impact on private sector.

High

Very High

 

Significant negative or positive impact on private sector.

Determine the effect on the private sector, or markets.  It is expected the answer to this question will incorporate which sectors will be affected positively or negatively and the size of the effect on each sector. Drafters are expected to consider the capacity of the private sector to take on any responsibilities associated with the proposal, the level of interest and opposition in the private sector as well as the size of the market in relation to government intervention.

Drafters are also expected to highlight and detail if there is an impact on the small to medium enterprise (SME) market.

Mitigation and Residual Risk for QA4

  • Risk treatment may reduce the Risk Rating.

Q A5) Stakeholders

A5. Stakeholders

Very Low

 

Straight forward stakeholder arrangement or no opposition of stakeholders expected.

Low

 

Med

 

Multiple stakeholders or some stakeholder opposition expected.

High

Very High

 

Complex stakeholder arrangements or significant stakeholder opposition expected. 

Identify what issues exist in dealing with stakeholders for this proposal.  Drafters are expected to consider who the stakeholders are, identify what positions or expectations they may have in relation to the proposal and the complexity associated with stakeholder management. Include stakeholders represented through interest groups and/or the media.

When determining a Strategic Context rating, drafters are expected to consider:

  • complexity and number of different stakeholder groups;
  • diverse range of views and their impact on the proposal; and
  • the potential consequences of stakeholder opposition.

Mitigation and Residual Risk for QA5

  • Risk treatment may reduce the Risk Rating.

Q A6) Legal Risks

A6. Legal Risks

Very Low

 

AGS legal risk ratings (where relevant) are Low, and contracting risk is Very Low.

Low

 

Med

 

AGS legal risk ratings (where relevant) are Medium, or contracting may involve indemnities, warranties or guarantees.

High

Very High

 

AGS legal risk ratings (where relevant) are High, stakeholders are litigious, or contracting creates significant risks to the Commonwealth.

Identify the legal issues which may impact on the policy design, or implementation of the proposal. Drafters are expected to explain the legal risks which arise from: AGS advice; contingent liabilities such as warranties, guarantees and indemnities; personal injury or property damage arising from implementation; or a highly litigious stakeholder group.

Mitigation and Residual Risk for QA6

  • Risk treatment may reduce the Risk Rating.  Mitigation for the risks that arise in AGS advice can only reduce the residual risk rating in consultation with AGS.

Q A7) All Other

A7. All Other

Very Low

 

Very Low other risk.

Low

 

Med

 

Medium other risk.

High

Very High

 

Proposal specific risk to be highlighted for cabinet.

Identify any other risk in the Strategic Context not covered in the above categories specific to a policy of this type. The intent of this section is to alert cabinet to significant issues not already captured in previous questions. Examples of “Other Risks” are significant Security, Environmental, International and Location constraints and/or issues. These categories of risk which can have consequences for government are the most common risks which do not have a specific question in the RPAT.

Mitigation and Residual Risk for QA7

  • Risk treatment may reduce the Risk Rating.

Section B – Implementation Complexity

Q B1) Other Jurisdictions/Entities/Business Areas

B1. Other Jurisdictions/

Entities/ Business areas

Very Low

 

No other jurisdictions, entities or other business units involved.

Low

 

Med

 

Some involvement across other jurisdictions, entities or business areas.

High

 

Very High

 

Complex involvement across jurisdictions, entities or business units.

Assess the degree to which the proposal cuts across other jurisdictions, entities, and business areas.  Drafters are expected to incorporate what involvement jurisdictions/entities/business areas have to the proposal and how this involvement may add complexity or difficulty to the implementation of the proposal.

Multiple entity involvement in the delivery of a proposal would be likely to attract a MEDIUM or higher rating. In addition, where any involvement with States or Territories is included or the potential for Inter-Governmental Agreements, National Partnership Agreements and COAG involvement, the proposal would likely attract a HIGH or VERY HIGH rating.

Mitigation and Residual Risk for QB1

  • Risk treatment may reduce the Risk Rating.

Q B2) Financial Benefits

B2. Financial Benefits

Very Low

Less than $50m.

 

Low

 

Med

$250m - $500m.

$250m - $500m.

High

 

Very High

Greater than $1b.

Greater than $1b.

Indicate the size of the expected financial benefit to be derived from the proposal.  Drafters are expected to consider any additional revenue from the proposal, greater efficiencies, long term reductions in costs or other benefits that are clearly identified and quantified in the proposal.

Mitigation and Residual Risk for QB2

  • Risk treatment is unlikely to reduce the Level of Risk.

Q B3) Organisational/Cultural Change

B3. Organisational/

Cultural change

Very Low

 

Limited impact on operations or staff.

Low

 

Med

 

Some organisational restructuring, retraining or transfer of staff/ outsourcing.

High

Very High

 

Very significant impact on operations or staff.  Rectifying high profile operational failure. 

Determine what transformation or alterations to entity structure and practices/culture will occur in order to implement the proposal. 

Proposals which require the establishment, merger or closure of an entity would likely attract a HIGH or VERY HIGH rating.

Mitigation and Residual Risk for QB3

  • Risk treatment may reduce the Risk Rating.

Q B4) Innovation

B4. Innovation

Very Low

 

Involves no new technology, development, methods, production or tools.

 

Low

 

Med

 

Involves new techniques but with a stable application or known techniques but with new application.

High

Very High

 

Use of new or untried technology, development, methods, production or tools with high degree of complexity or uncertainty.

Determine how much innovation will be incorporated into the proposal. Drafters need to assess the inherent risks in developing and delivering proposals that involve significant new or untried methods of practice/technology.

Drafters are encouraged to consider what innovative tools or applications are to be used in the proposal, if this innovative approach has been previously used and, if so, was the previous use a success.

Mitigation and Residual Risk for QB4

  • Risk treatment may reduce the Risk Rating.

Q B5) Information and Communications Technology

B5. Information and Communications

Technology

Very Low

 

No IT component.

Low

 

Med

 

Infrastructure required/packaged software/data migration/some links to other internal/external systems.

High

 

Very High

 

Significant infrastructure requirements/

complex data migration/

extensive and/or complex links to internal/external systems.

Determine the level of complexity and structure of the proposed ICT and how this is incorporated into the proposal.

The examples provided in the risk rating boxes are not an exhaustive list.  Drafters are expected to consider all other potential complexities associated with the ICT component within the proposal, which may include the technical skills and availability required to implement the proposed ICT.

Proposals subject to the ICT Investment Approval Process would likely attract a HIGH or VERY HIGH rating for this question.

Mitigation and Residual Risk for QB5

  • Risk treatment may reduce the Risk Rating.

Q B6) Procurement

B6. Procurement

Very Low

 

No procurement.

Low

 

Med

 

Delivery of complex products/services.

High

Very High

 

Significant customised element. Multi stage procurement process.

Determine the extent of formal procurement or tendering envisaged for the proposal.  It is anticipated that drafters will incorporate all related procurement and the complexity associated with each of the procurement processes proposed.

Particular attention is expected to be given to:

  • known instances where similar procurements have failed;
  • budget overruns; or
  • instances where market capability has been unable to meet the procurement needs as specified.

Mitigation and Residual Risk for QB6

  • Risk treatment may reduce the Risk Rating.

Q B7) Construction

B7. Construction

Very Low

 

No construction requirements.

Low

 

Med

 

New construction using non-standard construction.

High

 

Very High

 

Unique Commonwealth construction or other construction with extensive customised elements.

Determine the level and nature of construction in the proposal.  Drafters are expected to reflect all construction and the complexity associated for each construction proposed.

There are many aspects of construction which may add complexity, such as:

  • heritage/architectural value;
  • proximity to environmentally fragile areas, endangered species and the like;
  • proximity to areas associated with indigenous culture/identity; and
  • proposed usage for a highly sensitive activity.

Proposals subject to the Two Stage Capital Works Approval Process would likely attract a HIGH or VERY HIGH rating for this question.

Mitigation and Residual Risk for QB7

  • Risk treatment may reduce the Risk Rating.

Q B8) Contractual/Service delivery arrangements

B8. Contractual/

Service delivery arrangements

Very Low

 

No contract/ delivery arrangements required.

Low

 

Med

 

Multiple suppliers but with single prime contractor.

Separate service delivery entity.

High

Very High

 

Complex commercial arrangements.  Multiple suppliers without prime contractor or multiple service delivery partners.

Determine the nature and level of commercial or service delivery arrangements associated with this proposal.  Drafters are expected to address how contracts or agreements for delivery are set-up and the private sector or other delivery partner’s capacity to meet supply needs.  The answer is also expected to indicate the effect that contract and supply arrangements may have on the industry or service delivery segment.

Where multiple suppliers or another Commonwealth entity is providing service delivery arrangements for the proposal, this is likely to attract a MEDIUM, HIGH or VERY HIGH rating. It would be expected that early consultation had occurred with the service delivery entity and they have informed this assessment.

Mitigation and Residual Risk for QB8

  • Risk treatment may reduce the Risk Rating.

Q B9) Governance

B9. Governance

Very Low

 

Straight forward and stable governance structure.

Low

 

Med

 

Some governance issues identified and actions developed to correct them.

High

Very High

 

Complex governance structures likely to change during life of the project/ program.

Determine the complexity of the governance arrangements for the proposal. Drafters are expected to consider whether the structures involve cross entity or interdepartmental committees, inter-jurisdictional governance arrangements or external representation in the governance arrangements.

Mitigation and Residual Risk for QB9

  • Risk treatment may reduce the Risk Rating.

Q B10) Management/team experience

B10. Management/ Team experience

Very Low

 

Fully resourced and skilled team and management.  No recruitment requirement or specialist training. 

Low

Med

 

Key skills/experience in place but recruitment or training required for staff.

High

Very High

 

Key skills/experience lacking or not available.  Significant new resources or training required. 

Determine the resources allocated to, or available to implement the proposal. Drafters are expected to consider the level of team and management experience for the proposal and whether this needs to be imported, difficulties that may arise in relation to recruitment or training and any complexity associated with sourcing the skills externally or internally.

Mitigation and Residual Risk for QB10

  • Risk treatment may reduce the Risk Rating.

Q B11) Timing Constraints

B11. Timing Constraints

Very Low

 

No challenge in meeting timetables.

Low

 

Med

 

Compressed or extended timeframe for delivery.

High

Very High

 

Schedules very difficult, no contingency allowed.  Uncontrolled changes to deadlines likely.

Determine whether there are timing constraints which add complexity to the proposal, e.g., fixed dates for commencement of proposal and how these constraints will impact delivery of the proposal on time, on budget and to expectations.

Mitigation and Residual Risk for QB11

  • Risk treatment may reduce the Risk Rating.

Q B12) Dependencies

B12. Dependencies

Very Low

 

No dependence on success of other projects/
programs.

Low

 

Med

 

Some dependence on successful delivery of other projects/
programs.

High

Very High

 

Fully dependant on successful delivery of other projects/
programs.

Assess the level of dependence or interdependence of this proposal to other projects/programs for successful implementation. Drafters are expected to consider the nature of the other projects/programs that this proposal is dependent on, the current status of these projects/programs and the level of dependence.

Mitigation and Residual Risk for QB12

  • Risk treatment may reduce the Risk Rating.

Q B13) Clarity of Policy

B13. Clarity of Policy

 

Very Low

 

There is clarity of policy and high level of policy development assurance.

Low

Med

 

Developing clarity of policy and some level of policy development assurance.

High

Very High

 

Lack of clarity of policy and low level of policy development assurance.

Determine how well developed and understood the policy intent for the proposal is. Drafters are expected to consider the level of policy development that is planned, the level of detail or direction given by government for the proposal, and whether all parties are committed and have a common understanding of the proposal’s intent (e.g., states and territories, or if industry input is envisaged for final program design).

Mitigation and Residual Risk for QB13

  • Risk treatment may reduce the Level of Risk.

Q B14) Entity Capability

B14. Entity Capability

Very Low

 

Entity has extensive experience with previous comparable outputs.

Low

Med

 

Entity experience with comparable projects but with new complexities for delivery.

High

Very High

 

No previous experience with this kind of proposal.

Determine how proficient/experienced the entity is in delivering this type of proposal.  Drafters are expected to consider the capability demonstrated in the delivery of similar outputs by the entity, if the entity has retained relevant capabilities and what lessons have been learned about prior initiatives.

Consideration be given to:

  • outcomes from recent entity capability reviews, or P3M3 assessments;
  • capability improvement strategies;
  • workforce planning and the impact on the entity implementing the proposal;
  • whether the implementation of the policy initiative is managed by an entity as “business as usual” or via project management disciplines;
  • the implications this initiative will have for the entity’s workforce (capacity, capability, location, functional alignment to business delivery);
  • the new skills or capabilities that will become important to achieve business outcomes and how will they be acquired (developed internally or attracted from external sources);
  • the current availability of these new skills and capabilities in the external labour market and, the level of impact if they are not available at critical time points in the implementation; and
  • the skills and capabilities that will no longer be required and how will this surplus be managed.

Mitigation and Residual Risk for QB14

  • Risk treatment may reduce the Risk Rating.

Appendix A

Example of a Top Five Risks table

Risk

Justification

Mitigation

Residual Risk

#1

Government Priority

Very High

This text is carried forward from the Justification field in the RPAT question.

Mitigation text is entered directly here by the drafting entity.

Very High

#2

Citizens

Very High

This text is carried forward from the Justification field in the RPAT question.

Mitigation text is entered directly here by the drafting entity.

High

#3

Stakeholders

High

This text is carried forward from the Justification field in the RPAT question.

Mitigation text is entered directly here by the drafting entity.

Medium

#4

Information Technology

High

This text is carried forward from the Justification field in the RPAT question.

Mitigation text is entered directly here by the drafting entity.

Medium

#5

Financial

Medium

This text is carried forward from the Justification field in the RPAT question.

Mitigation text is entered directly here by the drafting entity.

Medium

Example of a Risk Summary table

The Risk Summary is calculated by the RPAT form.

Strategic Context

Medium

Implementation Complexity

High

Legal Risk

Medium

Level of Risk  (before mitigation)

High

Overall Risk (including mitigation)

Medium


Did you find this content useful?