OAIC Audit and Risk Committee Charter

1. Legislative functions of audit committees

The Public Governance, Performance and Accountability Act 2013 (PGPA Act) requires that the Australian Information Commissioner, as the accountable authority of the Office of the Australian Information Commissioner (OAIC), ensures the entity has an audit committee (subsection 45(1)) and that committee is constituted and performs functions in accordance with any requirements prescribed by the associated rules (subsection 45(2)).

Under the Public Governance, Performance and Accountability Rule 2014 (PGPA Rule), the accountable authority of a Commonwealth entity must determine the functions of its audit committee by written charter (the Charter) (subsection 17(1)).

Consistent with subsection 17(2) of the PGPA Rule, the role of the OAIC Audit and Risk Committee (the committee) is to provide independent advice to the Australian Information Commissioner on the appropriateness of the OAIC’s:

1. financial reporting
2. performance reporting
3. system of risk oversight and management, and
4. the system of internal control.

The committee provides independent advice only. It has no management responsibilities and does not replace management or the Australian Information Commissioner accountability for risk, control or reporting.

2. Authority

The Australian Information Commissioner authorises the committee, within its responsibilities, to:

1. obtain any information it requires from any official or external party (subject to any legal obligation to protect information)
2. discuss any matters with the Australian National Audit Office (ANAO), or other external parties (subject to confidentiality considerations)
3. request the attendance of any official, including the Australian Information Commissioner, at Committee meetings, and
4. obtain legal or other professional advice at the OAIC's expense, as considered necessary to meet its responsibilities, subject to approval by the Australian Information Commissioner.

3. Audit and Risk Committee functions

3.1 Financial reporting

The committee will review the appropriateness of the OAIC’s financial reporting in accordance with subsection 17(2)(a) of the PGPA Rule. This includes the committee reviewing compliance with the mandatory requirements of the PGPA Act, the PGPA Rule, the Australian Accounting Standards as set by the Australian Accounting Standards Board, and advice given in supporting guidance.

Responsibilities

1. Review and provide advice on the appropriateness of:
   1. the OAIC’s financial statements
   2. information (other than the annual financial statements) requested by the Department of Finance in preparing the Australian Government’s consolidated financial statements, including the supplementary reporting package
   3. processes and systems for preparing financial reporting information
   4. financial record keeping
   5. whether appropriate management action has been taken in response to any issues raised by the ANAO, including financial statement adjustments or revised disclosures
   6. the OAIC’s financial reporting as a whole, with reference to any specific areas of concern or suggestions for improvement.
2. Act as a forum for communication between OAIC management and the ANAO.
3. Review processes to ensure that financial information included in the OAIC annual report is consistent with the signed financial statements.
4. The committee will provide a statement to the Australian Information Commissioner prior to the signing of the annual financial statements regarding:
   1. whether, in its view, the annual financial statements and additional entity information comply with the PGPA Act, the PGPA Rules, the Australian Accounting Standards and supporting guidance
   2. whether additional OAIC information (other than financial statements) required by the Department of Finance for the purpose of preparing the Australian Government consolidated financial statements (including the supplementary reporting package) complies with the PGPA Act, the PGPA Rules, the Australian Accounting Standards and supporting guidance, and
   3. in respect of the appropriateness of the OAIC’s financial reporting as a whole, with reference to any specific areas of concern or suggestions for improvement.

3.2 Performance reporting

The committee will review and provide advice on the appropriateness of the OAIC’s performance reporting in accordance with subsection 17(2)(b) of the PGPA Rule. This includes reviewing the mandatory requirements of the PGPA Act, the PGPA Rule and the Commonwealth performance framework and consider advice given in supporting guidance. The review will include information provided in the OAIC’s Corporate Plan, Portfolio Budget Statement and Annual Performance Statement.

Responsibilities

1. In reviewing and providing advice on systems and procedures for assessing, monitoring and reporting on achievement of the OAIC’s performance, the committee will satisfy itself that:
   1. the OAIC’s Portfolio Budget Statement and Corporate Plan include details of how the OAIC's performance will be measured and assessed
   2. the OAIC’s approach to measuring its performance throughout the financial year against the performance measures included in the Portfolio Budget Statement and Corporate Plan is appropriate and in accordance with the Commonwealth performance framework, and has considered guidance issued by the Department of Finance
   3. the OAIC has appropriate systems and processes in place for preparation of its Annual Performance Statement and the inclusion of the Statement in its annual report
   4. the proposed annual performance statement is not inconsistent with the OAIC’s financial information, including its financial statements, which it proposed to include in its annual report.
2. Review the Annual Performance Statement and provide advice on appropriateness to the OAIC.
3. The committee will provide a statement to the Australian Information Commissioner regarding whether, in its view, the OAIC’s Annual Performance Statements and performance reporting as a whole is appropriate, with reference to any specific suggestions for improvement or areas of concern.

3.3 Risk oversight and management

The committee will review the appropriateness of the OAIC’s system of risk oversight and management in accordance with subsection 17(2)(c) of the PGPA Rule. This includes the committee gaining an understanding of the OAIC’s risk appetite and operating environment, reviewing the mandatory requirements of the PGPA Act, the PGPA Rule and the Commonwealth Risk Management Policy,and considering advice in supporting guidance.

Responsibilities

1. Review and provide advice on the appropriateness of:
   the OAIC’s enterprise risk management framework and associated internal controls for the effective identification and management of the OAIC’s risks in keeping with the Commonwealth Risk Management Policy
   1. the OAIC’s approach to managing key risks, including those associated with legislative change, program implementation and other activities
   2. the process for developing and implementing the OAIC’s fraud control arrangements consistent with the Commonwealth Fraud and Corruption Control Framework, and satisfy itself that the OAIC has adequate processes for detecting, capturing and effectively responding to fraud and corruption risks
   3. articulation of key roles and responsibilities relating to risk management and adherence to them by officials of the OAIC.
2. The committee will provide a statement to the Australian Information Commissioner regarding whether, in its view, the OAIC’s system of risk oversight and management is appropriate (with reference to the Commonwealth Risk Management Policy) and any specific areas of concern or suggestions for improvement.

3.4 System of internal control

The committee will review the appropriateness of the OAIC’s system of internal control in accordance with subsection 17(2)(d) of the PGPA Rule. This includes the committee gaining an understanding the OAIC’s operating context and governance requirements, reviewing the mandatory requirements of the PGPA Act and PGPA Rule, and considering advice in supporting guidance.

Responsibilities

1. Review and provide advice on the appropriateness of the OAIC’s internal control framework:
   1. review the OAIC’s approach to maintaining an effective internal control framework and whether appropriate processes are in place for assessing whether key policies and procedures are complied with, such as compliance with OAIC specific legislative requirements, proper use and management of public resources and is committed to ethical and lawful conduct
   2. review whether the OAIC has in place relevant policies and procedures, such as Accountable Authority Instructions, delegations, a business continuity management plan and that these are periodically reviewed and updated.
2. Review and provide advice on the appropriateness of the OAIC’s legislative and policy compliance:
   1. review the effectiveness of systems for monitoring the OAIC’s compliance with laws, regulations and associated government policies with which the OAIC must comply
   2. whether the OAIC has adequately considered legal and compliance risks as part of the enterprise risk management framework, fraud control framework and planning.
3. Review and provide advice on the appropriateness of the OAIC’s security compliance:
   1. review the OAIC’s approach to an effective internal security system including complying with the Protective Security Policy Framework.
4. Review and provide advice on the appropriateness of the OAIC’s internal audit coverage:
   1. review the OAIC’s proposed internal audit coverage, ensuring the coverage considers the OAIC’s primary risks, and recommending approval of the internal audit work plan to the Australian Information Commissioner
   2. review all internal audit reports (and where relevant external audit reports), providing advice to the Australian Information Commissioner on major concerns identified in those reports, and recommending action on significant matters raised, including identification and dissemination of information on good practice
   3. monitor the OAIC’s implementation of internal audit recommendations.
5. The committee will provide a statement to the Australian Information Commissioner regarding whether, in its view, the OAIC’s system of internal control is appropriate, referring to any specific areas of concern or suggestions for improvement.

4. Reporting

The committee will regularly update the Australian Information Commissioner on its activities and make recommendations, as appropriate. The Chair of the committee will report to the Australian Information Commissioner following a meeting of the committee on any matters that the committee considers should be brought to the attention of the Australian Information Commissioner.

The committee will at least once annually confirm to the Australian Information Commissioner that all functions/responsibilities outlined in this Charter have been carried out and comply with any other reporting requirements specified by the Australian Information Commissioner from time to time. This will include whether, in its view:

• the annual financial statements and additional entity information comply with the PGPA Act, the PGPA Rules, the Australian Accounting Standards and supporting guidance
• the OAIC’s financial reporting is appropriate
• the OAIC’s annual performance statements and performance reporting as a whole is appropriate
• the OAIC’s system of risk oversight and management is appropriate (with reference to the Commonwealth Risk Management Policy)
• the OAIC’s system of internal control is appropriate.

In providing this view to the Australian Information Commissioner, the committee should also note any areas of concern, non-remediation of significant recommendations, and/or suggestions for system or process improvement.

5. Membership

5.1 Composition

The committee is independent from the executive management of the OAIC. In accordance with subsections 17(3) and 17(4) of the PGPA Rule, membership of the Audit and Risk Committee comprises three (3) members who are not officials of the OAIC, and the majority of the members are persons who are not officials of any Commonwealth entity.

The OAIC Audit and Risk Committee members comprises:

• an external Chair, and
• two (2) external members.

Membership of the committee will be reviewed periodically (at least every three (3) years) by the Australian Information Commissioner with the aim of ensuring an appropriate balance between continuity of membership, the contribution of fresh perspectives and a suitable mix of appropriate qualifications, knowledge, skills and experience to assist the committee to perform its functions.

Standing advisors to the committee are the General Manager, Enabling Services and Chief Financial Officer.

The Australian Information Commissioner may attend committee meetings. When they elect to do so, they will require copies of committee papers.

OAIC representatives may be invited to attend meetings as advisors, observers and specialist advisors as determined by the Chair. Representatives of the firms appointed as Internal Auditor and representatives of the ANAO, may attend meetings as observers.

Standing advisors, OAIC representatives including commissioners, and external representatives are not considered members of the committee.

5.2 Selection and Appointment

Chair

The Australian Information Commissioner will appoint the Chair of the committee. The Chair shall not be the Australian Information Commissioner.

The committee is authorised to appoint another member as Deputy Chair who will act as chair in the absence of the Chair.

The Chair will be appointed for an initial term of three years.

The Chair may be re-appointed for further periods, having regard to the length of their original appointment, after a formal review of their performance by the Australian Information Commissioner (maximum 3 terms in total).

Members

Member appointments will ordinarily be for an initial term of three (3) years, with appointments staggered to enable continuity of knowledge. Committee membership constitutes a personal and specific appointment and as such, proxies are not permitted.

Members may be re-appointed for further periods, having regard to the length of their original appointment, after a formal review of their performance by the Australian Information Commissioner. The Chair may be requested to provide advice to the Australian Information Commissioner on a member’s performance where an extension of the member’s appointment is being considered (maximum 3 terms in total).

5.3 Skills and Knowledge

Subsection 17(3) of the PGPA Rule provides members of the committee will have appropriate qualifications, knowledge, skills or experience to assist the committee perform its functions.

The committee is a skill-based governance committee. Members should collectively possess sufficient knowledge of governance, assurance, audit, finance, information technology, legislation, risk management, compliance and control plus any attributes relevant to the OAIC and its regulatory environment.

All members should be conversant with financial management reporting and at least one member of the committee must have accounting or related financial management experience and/or qualifications, and a comprehensive understanding of accounting and auditing standards.

The committee will adopt and maintain a program of induction, training and awareness-raising for its members, with the objective of enabling the committee to keep abreast of contemporary developments and leading practices in relation to its functions.

5.4 Remuneration

Remuneration for members of the committee will be determined by the Australian Information Commissioner. The level of remuneration will be set with reference to market conditions and will reflect:

• the committee’s composition
• market conditions
• individual member qualifications, knowledge, skills and experience
• the size and complexity of the OAIC and its impact on the effort from committee members to deliver their functions effectively
• any additional functions to be undertaken, beyond those mandated by the PGPA Act, which will affect the committee members’ scope of work.

6. Conduct of the Audit and Risk Committee

6.1 Membership expectations

The committee will engage with the OAIC in a constructive and professional manner in discharging its advisory responsibilities and formulating its advice to the Australian Information Commissioner.

Members of the committee are expected to understand and observe the legal requirements of the PGPA Act and PGPA Rule. Members are also expected to:

• act in an objective, impartial manner, in the best interests of the OAIC as whole
• apply good analytical skills, objectivity and good judgement
• express opinions constructively and openly, raise issues that relate to the committee’s responsibilities
• develop an understanding of the OAIC’s operating context, and
• contribute the time required to meet their responsibilities.

Committee members must not use or disclose information obtained from committee operations except in meeting the committee’s responsibilities, or unless expressly agreed by the Australian Information Commissioner.

7. Administrative arrangements

7.1 Meetings

The committee will meet quarterly at least four (4) times per year. One or more special meetings may be held to review annual financial statements and performance statements, or to meet other responsibilities of the committee.

All committee members are expected to attend each meeting, in person or via tele-or-video conference.

The Chair is required to call a meeting if asked to do so by the Australian Information Commissioner and decide if a meeting is required if requested by another member, the Partner of the firm appointed as internal auditor or the ANAO.

7.2 Decisions without meetings

With the approval of the Chair, the committee can agree to items out-of-session by email communication. The committee can make decisions without a meeting in the following circumstances:

• all committee members have been informed of the proposed decision (or reasonable efforts have been made to inform all members), and
• a majority of committee members entitled to vote on the proposed decisions indicate agreement.

Additional papers may be circulated to committee members for review out-of-session. Committee members are to indicate agreement to a decision without a meeting by providing written advice to the Chair and secretariat of their agreement to the proposed decision. This can be done by electronic signature or by email advice.

7.3 Agenda, papers and minutes

The secretariat and Director, Governance, Risk and Compliance will prepare an agenda for each meeting in consultation with the General Manager – Enabling Services. The Chair will approve the agenda for each meeting.

The secretariat will circulate the agenda and supporting papers, unless otherwise agreed by the Chair, no more than ten (10) and no fewer than five (5) working days prior to the date of the meeting. The agenda, papers and minutes will be conveyed to the committee using a format and platform that is determined by the OAIC, to ensure alignment with the agency’s privacy and security requirements.

Minutes must be reviewed by the Chair and circulated within two (2) weeks of the meeting to each member and committee observers, as appropriate.

7.4 Annual Work Plan

In the last meeting of each financial year, the committee will agree upon a forward meeting schedule for the subsequent year that includes the dates and location for the proposed meetings during that year.

The committee will develop an annual work plan aligned to each financial year, detailing activities to be undertaken to address the functions outlined in this Charter. The forward work plan will be used as the basis to drive and shape the agenda for upcoming meetings, noting that the committee may consider other or additional matters in response to changes in the OAIC’s operations and environment.

Additional or emerging items may be added to the forward work plan during the period of the plan if approved by the Chair.

7.5 Quorum

A quorum will consist of a majority of committee members, one of whom must be the Chair or the Deputy Chair. The quorum must be in attendance at all times during the meeting. In the circumstance where there are only two members present and one needs to be excused due to a material conflict of interest, the matter under discussion should be held over to the next meeting or considered out of session.

7.6 Secretariat

The OAIC Enabling Services Branch will provide secretariat services to the committee.

The secretariat will maintain records in accordance with the OAIC’s obligations under theArchives Act 1983 and section 37 of the PGPA Act.

7.7 Induction

New committee members will receive relevant information and briefings, as provided by the OAIC, on their appointment to assist them to carry out their committee responsibilities.

7.8 Conflicts of interest

On engagement and each year thereafter, members of the committee will provide written declarations, through the Chair, to the Australian Information Commissioner declaring any real or apparent conflicts of interest they may have in relation to their responsibilities.

Members should consider past employment, consultancy arrangements and related party issues in making these declarations and the Australian Information Commissioner, in consultation with the Chair, should be satisfied that there are sufficient processes in place to manage any real or apparent conflicts.

At the beginning of each committee meeting, members are required to declare any real or apparent conflict of interest that may apply to specific matters on the meeting agenda.

Where required by the Chair, the member will be excused from the meeting or from the committee's consideration of the relevant agenda item(s). The Chair is also responsible for deciding, in consultation with the Australian Information Commissioner where appropriate, if they should excuse themselves from the meeting or from the committee's consideration of the relevant agenda item(s). Details of actual, apparent or potential conflicts of interest declared by the Chair and other members, and actions taken, will be appropriately recorded in the minutes.

A register of interests will be maintained for the Chair and members to demonstrate transparency and as a safeguard against conflicts of interest.

7.9 Evaluation

The Chair of the committee will initiate a self-assessment of the performance of the committee at least once every two (2) years. The review will involve input from the Australian Information Commissioner, each committee member, and any other relevant stakeholders, as determined by the committee.

The outcomes of this assessment will be reported to the Australian Information Commissioner.

7.10 Review of Charter

The committee will review the appropriateness of this Charter at least once every two (2) years, to align it with current risks, challenges and opportunities the OAIC faces.  This review will include consultation with the Australian Information Commissioner.

Any substantive changes to the Charter will be recommended by the committee and formally approved by the Australian Information Commissioner.