NDIS Risk Management: Compliance and Best Practices

1. Effectively managing risk is a critical requirement of the National Disability Insurance Scheme (NDIS) – both at the NDIA systems/processes level and also the registered service providers level.  As an external source of risk having a material impact on the efficiency, effectiveness and accountability of NDIA’s operations and funding, registered providers of supports and registered plan management providers have heightened risk factors and compliance obligations. For example, the NDIA’s risk mandate that “In designing the NDIS to use self-directed funding, the Australian Government is essentially adopting a risk managed approach, where responsibility and accountability for ensuring that appropriate support is received rests with the individual clients …” [NDIA Corporate Plan 2013-2016 p.12] has heightened debt recovery risks for service providers’ Service Agreements mandatory requirement that “The Provider will seek payment for their provision of supports after the [Participant / Participant’s representative] confirms satisfactory delivery.”[NDIS model service agreement] Linda Hayes Business Strategist, GAICD With 20 years experience in marketing and business strategy, Linda has worked across a vast range of industry sectors to deliver business growth through better business planning and stronger organisational governance.

2. WORKSHOP OBJECTIVES • Review of key elements of AS/NZS ISO 31000:2009, Risk Management-Principles and Guidelines • Overview of the NDIS Risk Management Rules 2013 and NDIS Risk Management Framework • Identification of material strategic and operational risks for NDIS registered service providers and/or registered plan management providers • Tips and traps in effectively managing the heightened risk factors required to meet NDIS risk management compliance obligations

3. Review of key elements of AS/NZS ISO 31000:2009, Risk Management-Principles and Guidelines • “Organisations of any kind face internal and external factors and influences that make it uncertain whether, when and the extent to which they will achieve or exceed their objectives. The effect this uncertainty has on the organisation’s objectives is “risk”.” ISO AS/NZS 31000:2009/page iv • Benefits of risk management • protection of ALL stakeholders • identify and manage potential threats and opportunities • proactive management by the board and senior executive • improve decision making and planning • Improve operations - business processes and controls • legal and regulatory compliance

4. Review of key elements of AS/NZS ISO 31000:2009, Risk Management Principles, Framework and Process

5. Overview of the NDIS Risk Management Rules 2013 and NDIS Risk Management Framework • National Disability Insurance Scheme Act 2013 • National Disability Insurance Scheme Rules (pursuant to sec. 17 of Act) << NDIS Risk Management Rules 2013 • NDIA’s CEO “Operational Guidelines” (pursuant to a Rule under the Act) << Operational Guideline – Registered Providers of Supports and NDIS Terms of Business for Registered Support Providers and NDIS Risk Management Framework

6. Overview of the NDIS Risk Management Rules 2013 – Example: NDIS’s Board to manage internal and EXTERNAL sources of risk 5 Establishment, maintenance and content of risk management framework (1) The Board [NDIS Board] must, as soon as reasonably practicable after the commencement of these Rules, establish a risk management framework, and must have such a framework in place at all times. (2) The risk management framework must provide a reasonable assurance that the Agency’s risks are managed prudently and soundly. (3) The risk management framework is to deal with the systems, structures, processes and people within the Agency that identify, assess, mitigate and monitor all internal and external sources of risk that could have a material impact on the Agency’s operations, funding and financial sustainability. HANDOUT (extract)

7. Overview of the NDIS Risk Management Rules 2013 – Example: EXAMPLE: NDIS’s Risks and Safeguards for Participants 10. The participant should be encouraged to develop their own strategies and safeguards to reduce their potential exposure to harm or to manage the exposure. The following levels of safeguards can be used as a guide in the development of appropriate measures: … d. Service level safeguards: all good businesses and service organisations have internal systems that protect their clients and enable them to provide feedback and make complaints. Service level safeguards include quality frameworks, complaints mechanisms and workforce requirements such as qualifications, recruitment practices and performance standards. For many service providers service level safeguards these will be one of the requirements for registration with the NDIA. HANDOUT (extract)

8. NDIS QUALITY AND SAFEGUARDS FRAMEWORK (NDIA finalising development): Risk management safeguards implications Governments have agreed to the development of a national approach to quality and safeguards as part of the National Disability Insurance Scheme (NDIS). There is agreement that the national framework should maximise the opportunities for people with disability to make decisions about their supports while also enabling them to live free from abuse, neglect and exploitation. The framework should also promote innovation, continuous improvement and best practice in the provision of supports. A nationally consistent quality and safeguards framework should mean that people interacting with NDIS can expect consistent standards and safeguards wherever they live in Australia. The Commonwealth Government, in collaboration with the NDIA and state and territory governments, is leading the work to develop a system of quality assurance and safeguards, which will include complaints and critical incidents management. HANDOUT (complete)

9. Effectively managing risk is a component of Terms of Business – compliance with Qld. Human Services Quality Framework (HSQF) – Governance and Management element (Example) Expected outcome Sound governance and management systems that maximise outcomes for stakeholders. Context The organisation maintains accountability to stakeholders through the implementation and maintenance of sound governance and management systems. These systems should reflect the size and structure of the organisation and contribute to maximising outcomes for people using services. …. The organisation’s management systems are clearly defined, documented and monitored and (where appropriate) communicated including finance, assets and risk. HANDOUT (extract)

10. Board and management responsibilities for Risk Management • define and endorse the risk management policy; • ensure that the organization's culture and risk management policy are aligned; • determine risk management performance indicators that align with performance indicators of the organization; • align risk management objectives with the objectives and strategies of the organization; • ensure legal and regulatory compliance; • assign accountabilities and responsibilities at appropriate levels within the organization; • ensure that the necessary resources are allocated to risk management; • communicate the benefits of risk management to all stakeholders; • ensure that the framework for managing risk continues to remain appropriate.

11. Identification of material strategic and operational risks for NDIS registered service providers and/or registered plan management providers – EXAMPLE PROCESS FLOW

12. Identification of material strategic and operational risks for NDIS registered service providers and/or registered plan management providers – EXAMPLE RISK MATRIX Risk can be rated as the combination of the consequences of an event happening and the associated likelihoodof that event occurring. Every identified risk can then be action-prioritised according to its risk rating.

13. Identification of material strategic and operational risks for NDIS registered service providers and/or registered plan management providers – EXAMPLE RISK ACTION PRIORITISING

14. Identification of material strategic and operational risks for NDIS registered service providers and/or registered plan management providers – EXAMPLES: NDIS HEIGHTENED RISK FACTORS • Applying for NDIS registration on basis of incorrectly identifying/specifying your scope of services • Poorly positioning and actively marketing your NDIS and fee-for-service value-added services in highly competitive market (researching, value proposition, brand profile, key messages, communicating competitive edge) • Services breakdown due to failure implement critical required changes in organisational structure, workforce capacity and capability, technology systems • Ineffective Services Agreements or services policies, systems, practices • Insufficient organisational resources and reserves to operate in NDIS environment (financial sustainability reserves safety net, cash flow monitoring, reduced revenue to loss market share) OTHER RISKS ???

15. Identification of material strategic and operational risks for NDIS registered service providers and/or registered plan management providers – EXAMPLES: MITIGATING NDIS HEIGHTENED RISK FACTORS (Source: NSW NGO Maturity Model) • … consider and address the following issues: • The rationalisation or expansion of service offerings • The impact on revenue streams • Marketing considerations • The impact on workforce • The delivery of tailored services and support for each person, including costs and methods • The impact of new entrants to the market, including ‘for-profits’ • The systems and processes that will be required. • …. • ASSESS PRESENT RISKS • Strategy • Governance • Clients and Market Focus • Financial Sustainability • People and Capability • Information and Knowledge Management • Quality, Measurement and Improvement HANDOUT (extract)

16. Tips and traps in effectively managing the heightened risk factors required to meet NDIS risk management compliance obligations • Develop comprehensive knowledge and understanding of business in the changed NDIS environment – network with trial site organisations – share learnings • Conduct extensive organisational and services review !! • Make NDIS Risk Management planning a standing agenda item at Management and Board meetings • Periodically re-evaluate the appropriateness and integrity of your organisation’s planned responses to critical NDIS risks • Take the time to think and plan risk management strategies at all levels in your organisation • Don’t panic – managing NDIS risks can be a positive continuous improvement experience !!

17. Final questions? Additional resources: TDSA previously supplied a CD containing additional resources (including copies of the Workbook, Handouts and Presentation Slides). Instead of CDs, the TDSA website now enables a download of all these additional resources for all TDSA Think Tank modules you attend. You will need the password to access each module – and will be provided to you (or you can obtain it directly by emailing or phoning TDSA) We thank you for your participation in today’s Think Tank ! Could you please complete the Feedback/Evaluation Form and leave it face down on the desks. Thank you