Risk Management Plan

1. Purpose

The purpose of this Risk Management Plan is to establish the operating approach through which Canberra Institute of Technology (CIT) identifies, assesses, treats, monitors, escalates and reports risks that may affect the achievement of its strategic, academic, operational, financial, compliance and project objectives.

The Plan translates CIT's risk management principles into a connected operating model. It explains how risks are identified from environmental intelligence and operational experience; how they are assigned to the appropriate register; how risks move through management and governance pathways; and how assurance and continuous improvement feed back into the risk cycle.

Escalating a risk does not automatically transfer ownership of the risk. Risks should be managed at the lowest level that has the authority, capability and resources to address them effectively. Higher levels of management and governance receive information about escalated risks so they can provide oversight, coordination, support and decision-making where required.

2. Scope

This Plan applies to the following people and governance bodies across CIT:

• CIT Board and members of relevant Board committees, including Audit and Risk Committee (ARC).
• Chief Executive Officer (CEO), executives and members of executive governance forums.
• Branch, Division, College, corporate-function, program, project and cross-functional initiative managers, sponsors and risk owners.
• All CIT employees, including academic, professional and corporate staff.
• Contractors, consultants, volunteers and other people performing work for or on behalf of CIT, where risk responsibilities are relevant to their engagement.
• CIT governance forums involved in risk, academic quality, assurance, compliance, Work Health and Safety (WHS), fraud and corruption, projects or continuous improvement.

3. Alignment with ACT Government Requirements

This Plan follows the ACT Government Risk Management Policy and Framework applicable to CIT, including the ACT Government Risk Management Policy maintained by the ACT Insurance Authority (ACTIA) and associated whole-of-government guidance. It operates consistently with the ACT Government risk management requirements and ISO 31000:2018.

As of September 2026, published ACT Government material identifies the applicable policy as the ACT Government Risk Management Policy 2021; CIT will review this Plan when the ACT Government issues or materially updates the applicable 2026 Policy or Framework.

Where a whole-of-government policy, framework, legislation, standard or other mandatory requirement applies, that requirement takes precedence.

4. Risk Management Principles

Risk management at CIT is guided by the following principles:

• Integrated: Risk management is embedded in governance, strategy, planning, operations, assurance, change management and decision-making processes.
• Structured and comprehensive: CIT applies a consistent risk management process, common risk language, standard register architecture and defined escalation pathways across the organisation.
• Customised: Risk management arrangements are tailored to CIT's operating environment, including its public sector, educational, regulatory, academic and operational context.
• Inclusive: Risk management is supported through appropriate engagement with managers, staff, students, specialists, stakeholders and governance bodies.
• Dynamic: Risks are regularly monitored and reviewed to reflect changes in objectives, operating environments, controls, incidents and emerging issues.
• Based on best available information: Risk decisions are informed by data, evidence, assurance activities, performance information, incidents, lessons learned and relevant external intelligence.
• Human and cultural factors: Risk management considers the impact of people, behaviours, communication, capability, leadership and organisational culture on risk outcomes.
• Continuous improvement: CIT uses assurance outcomes, control performance, lessons learned and environmental changes to strengthen and improve its risk management framework over time.

5. Risk Governance and Accountability

5.1 Register Selection and Non-Duplication

The risk should be recorded in the register that best reflects the objective affected, the person accountable for managing it, and the level of authority needed for oversight and decision-making. Where work involves multiple areas, a new register is not required in every case. Existing risk registers may be used, provided the risk, owner, controls, actions, review arrangements and escalation decisions are clearly documented.

If the same risk affects multiple areas of CIT, a single primary risk record should be maintained. Related issues, controls, incidents and actions can then be linked to that record. This helps avoid duplicate entries and ensures a consistent view of the risk while allowing visibility through the relevant management and governance forums.

6. Risk Management Architecture

CIT uses a four-tier model to determine the appropriate level for managing each risk:

• Tier 4: risks managed within day-to-day operations, teams, Colleges or business areas.
• Tier 3: risks affecting programs, projects, service streams or cross-functional initiatives.
• Tier 2: risks affecting a Branch or Division, or requiring broader coordination and management authority.
• Tier 1: strategic or enterprise risks requiring organisation-wide oversight or decisions.

Risks are managed at the tier closest to the affected activity that has the authority, capability and resources to manage the exposure. A risk may move to a higher tier where broader coordination, additional resources, executive decisions or increased oversight are required. Escalation does not automatically transfer ownership of the risk.

WHS and fraud and corruption risks remain in their specialist systems. Their governance pathway does not create an additional escalation tier.

6.1 Academic Risk Governance

Academic risks affecting day-to-day academic operations are generally managed at Tier 4 by the relevant College, program or academic area. Risks affecting an entire program, including risks associated with program development and implementation, are generally managed at Tier 3. Academic risks affecting multiple areas or CIT-wide academic objectives may be managed at Tier 2 or Tier 1, depending on their significance and the authority required to manage them.

Material, recurring or broader academic risks are reviewed by TLQC, which considers the risk, monitors relevant actions and recommends further action or escalation where required. These risks are recorded in the Academic Risk Register where appropriate. Academic Council provides academic oversight and may refer matters to EMC where executive decisions, additional resources or CIT-wide coordination are required.

EDD coordinates the management response to College-based and cross-College academic risks, including monitoring agreed actions, addressing cross-College dependencies, identifying systemic issues and escalating matters requiring additional authority, resources or governance oversight. Colleges and program areas remain responsible for risks, controls and treatment actions within their areas.

Where an academic risk involves Student Services or another branch or function, EDD works with the relevant executive or responsible area to coordinate the response. One accountable risk owner must be nominated based on the objective most directly affected and the authority required to manage the risk. Control and treatment action responsibilities must be clearly assigned across the relevant Colleges, branches and functions. Escalation to TLQC, Academic Council or EMC does not transfer risk ownership unless a change in ownership is formally approved and recorded.

6.2 Functional and Enterprise Risk Governance

Day-to-day operational risks are generally managed at Tier 4 by the responsible business area. Risks involving programs, projects, service streams or multiple business areas are generally managed at Tier 3. Risks affecting a Branch or Division are generally managed at Tier 2, while strategic and CIT-wide risks are managed at Tier 1. A risk is managed at the tier with the authority, capability and resources to address it effectively. It may be escalated when broader coordination, additional resources, senior decisions or greater oversight are needed. Escalation does not automatically change the risk owner.

6.3 Cross-Functional Initiatives

Cross-functional initiatives involve more than one business area and may include major contracts, partnerships, tenders or new programs. Risks associated with these initiatives are generally managed at Tier 3 because they extend across normal business-area boundaries.

A formal program structure or separate Program Risk Register is not required, and an existing approved register may be used. The responsible executive must appoint an initiative owner or sponsor, determine where the risks will be recorded, and ensure responsibility for each control and treatment is clearly assigned. The initiative owner or sponsor coordinates the overall response. The risk owner remains accountable for the risk, while control and treatment owners are responsible for their assigned actions.

The risk should only move to Tier 2 or Tier 1 where broader authority, resources, coordination or oversight are required, not simply because there is no Program Manager or separate Program Risk Register.

6.4 Integrated Governance and Assurance

Academic Council, EMC, ARC and the Board may consider the same material risk, but each has a different role. Academic Council oversees academic standards and assurance, EMC coordinates organisational actions and resources, ARC provides independent challenge and advice, and the Board provides strategic oversight and decision-making. CIT maintains one primary risk record, with links to any related specialist, academic or local records. This avoids duplication while ensuring each governance body has the information needed to fulfil its responsibilities.

7. Risk Management Process

CIT will apply the current ACT Government risk management process and tools promoted by the ACT Insurance Authority, adapted to CIT’s legislative functions, governance arrangements, risk appetite and four-tier risk architecture.

The risk management process includes establishing the context, identifying risks, analysing risks, evaluating risks, selecting and implementing treatments, monitoring and reviewing risks, and communicating and consulting throughout the process. Recording and reporting must occur at each relevant stage.

The Risk Identification Procedure governs environmental scanning, event and issue screening, risk validation, risk description, selection of the primary record and initial tier assignment. The Risk Management Procedures govern detailed analysis, control assessment, evaluation, treatment, monitoring, review, escalation, acceptance and closure.

Where the ACTIA process or tools are updated, CIT will assess the change and update its supporting procedures and templates where necessary. CIT-specific governance, academic oversight, specialist-register and four-tier requirements continue to apply.

8. Risk Management Operating Cycle

8.1 Event, Issue and Risk Interfaces

Events, issues and risks are related but are not interchangeable. An event or issue is managed first through the applicable operational, incident, regulatory, complaints, conflict of Interest or specialist process. Information from that process then enters risk identification to determine whether the event changes an existing risk or reveals a distinct future uncertainty. Regulatory reportability and risk classification are separate decisions and may occur in parallel.

9. Risk Identification

Risk identification is the structured process of recognising and describing uncertainty that may affect a CIT objective, obligation or outcome, and determining whether that information should be managed as an issue, control concern, existing-risk change, new risk, opportunity, compliance response, improvement action or other management matter. It is the first substantive step in the risk management cycle and provides the evidence base for subsequent assessment, treatment and governance.

The aim is to identify significant risk information as early as possible without treating every operational issue, incident or notification as a risk. Effective risk identification considers the underlying cause or uncertainty, rather than just the immediate problem. It also checks whether the exposure is already captured in an existing risk, avoids creating duplicate risks, and ensures the matter is managed through the area, governance body or

Risk identification is an ongoing activity that occurs through day-to-day management, planning, assurance and governance processes. Risk information generally comes from two sources:

Forward-looking information that highlights potential future risks, such as environmental scanning, emerging trends, legislative changes, strategic developments and external notifications.

Experience-based information that highlights existing or realised exposures, such as issues, incidents, complaints, control failures, audit and assurance findings, academic quality information and performance results.

Regardless of the source, the same process is applied to determine whether the matter represents a risk, an issue, an improvement opportunity, or a combination of these, and to ensure it is recorded and managed through the appropriate register and governance arrangements.

The CIT Risk Identification Procedure provides detailed guidance on how risks are identified, assessed, recorded and managed, including environmental scanning, notification screening, risk validation, allocation to the appropriate register, and recordkeeping. This enables the Plan to remain high-level while ensuring the identification process is documented, consistent and practical to apply.

10. Risk Assessment and Evaluation

Following validation and allocation to the appropriate register, the risk is assessed using the ACT Government Risk Management Framework. The assessment considers the likelihood and consequences of the risk, the effectiveness of existing controls, the level of residual risk, alignment with risk appetite and tolerance, and any requirements for escalation.

Assessment should be proportionate to the significance and uncertainty of the risk. Controls should be considered separately from the risk event and consequences. Risk owners should be able to explain the basis for the assessment and the evidence available. Strategic significance may justify escalation even where the numerical rating is not high. Material changes in context, controls, incidents, assurance findings or external conditions should trigger reassessment.

11. Risk Escalation

CIT uses a four-tier model to move risk information to the level with the authority, capability and resources needed to manage the exposure. The model applies to operational work, programs, projects, service streams, commercial contracts, strategic partnerships, new program development, implementation and other cross-functional initiatives. Academic governance and specialist governance operate across the tiers.

Escalation is not automatically a transfer of ownership. The existing owner remains accountable unless a receiving authority formally reassigns ownership and records the decision. A risk may move directly to a higher tier where immediate regulatory, safety, integrity, financial or reputational action is required.

11.1 Escalation Criteria

• The risk exceeds approved appetite or tolerance, or is rated High or Extreme under approved criteria.
• The accountable owner cannot manage the risk effectively using available authority, capability, resources or agreed cross-functional arrangements.
• The risk requires executive or Board decision, funding, prioritisation, risk acceptance or resolution of conflicting responsibilities.
• The risk affects multiple business areas and coordinated treatment cannot be agreed or sustained.
• The risk has significant legal, regulatory, contractual, financial, safety, academic, student, integrity or reputational implications.
• The matter is systemic, recurring, indicates a common control weakness or materially changes an existing risk profile.
• The risk is emerging and may materially affect strategic objectives or enterprise resilience.

A risk involving several areas is not escalated solely because no single team controls every treatment. The accountable owner should first identify control and treatment owners and establish coordinated action within existing delegations. Formal escalation is required where that coordination does not provide sufficient authority, resources, priority, risk acceptance or control effectiveness.

11.2 Four-Tier Escalation Model

11.3 Tier 3 Cross-Functional Initiative Pathway

Tier 3 is not limited to formally established programs or projects. It also includes commercial contracts, strategic partnerships, major tenders, new program development and implementation, and other cross-functional initiatives. Where there is no Program Manager or Program Risk Register, the relevant Executive must nominate an initiative owner or sponsor and approve the primary risk record. The record may be a proportionate initiative risk log or an existing Branch or central register.

11.4 Academic Risk Pathway Across the Four Tiers

Academic governance overlays the four tiers. Tier 4 covers local academic delivery risks. Tier 3 covers program-level and new-program-development risks. Material or systemic academic risks are reviewed by TLQC and recorded in the Academic Risk Register where appropriate. Academic Council provides academic governance oversight. EMC addresses matters requiring executive authority, resources or enterprise coordination, and material enterprise risks are reported to ARC and the Board through Tier 1 arrangements.

11.5 Cross-Cutting Risk Ownership and Register Rules

Where a risk has academic, commercial, contractual and functional dimensions, CIT will nominate one accountable owner and one primary risk record. The owner is selected according to the objective most directly affected and the authority needed to manage the overall exposure. Supporting areas remain accountable for assigned controls and treatments. Academic Council, EMC and ARC may review the same risk for different purposes without creating duplicate risks or transferring operational ownership.

11.6 Escalation Timeframes and Urgent Matters

11.7 Four-Tier Escalation Flowchart

The pathway is proportionate. Risks may move directly to a higher tier when urgent or material. Academic and specialist governance operate alongside the applicable tier.

↓

↓

↓

↓

↓

11.8 Examples

The examples below illustrate how risks may be recorded, managed and escalated within the CIT risk management model. They are provided for guidance only. Actual ownership, register selection and escalation pathways will depend on the nature of the risk, the affected objectives, the accountable owner and the level of authority required to manage the exposure.

11.9 De-escalation and Closure

• Controls and treatments have been implemented and their effectiveness has been evidenced.
• Residual risk is within the appetite or tolerance applicable to the receiving level.
• The authority that accepted or received the escalation approves de-escalation or closure.
• The risk record identifies the continuing owner, monitoring arrangements and any outstanding actions.

12. Risk Treatment and Control Management

Treatments should address causes, exposure or consequences and be proportionate to the level of risk. Each treatment should have an accountable owner, target date, expected outcome and monitoring approach.

• Existing controls should be identified and their design and operating effectiveness considered as part of risk assessment.
• Treatment actions should be integrated with academic planning, program review, continuous improvement, compliance actions and operational plans where relevant.
• Material findings, systemic themes and emerging risks identified through assurance should be reported to the relevant governance forum and considered for inclusion in the appropriate risk register.
• Residual risk should be reassessed following significant treatment, corrective action or material change.

12.1 Academic Risk Control and Assurance

Academic risks are managed through preventive and detective controls, program-level prioritisation, academic quality assurance and governance oversight. The Academic Risk Register is the central mechanism for recording systemic academic risks, associated controls, treatments, risk indicators and assurance activities.

The Academic Priority Risk Table (APRT) operates as a program-level risk identification and prioritisation mechanism. Existing APRT criteria are used to identify programs with characteristics or circumstances that may increase exposure to academic risk. APRT results prioritise academic quality assurance and provide evidence for monitoring relevant risks in the Academic Risk Register. The APRT is not itself an assurance activity.

Additional academic assurance may include validation, moderation, Education Quality reviews, program reviews, targeted reviews of high-priority programs identified through the APRT, student feedback/outcome analysis, training-product transition reviews, industry/workplace reviews, follow-up of previous findings and internal/external audit where appropriate.

12.2 Governance Decisions and Recording

When a risk is escalated, the receiving forum should record the purpose and outcome of escalation, including whether the risk remains within appetite, what action or resources are approved, whether ownership remains unchanged or is reassigned, which register is authoritative, what assurance is required, and when the matter will next be reviewed. Decisions by Academic Council, EMC, ARC and the Board should be reflected in the primary risk record and linked to the relevant minutes or decision record.

13. Monitoring, Assurance and Reporting

Urgent or material risks must not wait for the next scheduled meeting. Escalation decisions and responses must be communicated back to the originating owner and reflected in the primary risk record.

13.1 Governance Decisions and Records

The receiving forum must record the purpose and outcome of escalation, the risk owner, primary register, approved actions and resources, risk acceptance decision, assurance required, reporting frequency and next review date. Ownership remains unchanged unless reassignment is expressly approved and recorded.

13.2 Academic Risk Reporting Pathway

Academic risks are initially identified and managed by the relevant College, academic area or program owner at the lowest appropriate tier. Local academic issues, APRT results, corrective actions and improvement activities are managed through normal processes and do not automatically require entry in the Academic Risk Register. Risks affecting an entire program, new program development or a cross-functional initiative are managed through the relevant Tier 3 arrangements and reported to TLQC or the appropriate academic committee.

Where evidence indicates a material, recurring or systemic academic exposure, the risk is recorded in the Academic Risk Register and reported to Academic Council. Matters requiring executive authority, additional resources or coordination across multiple areas are referred to EMC. Risks with material enterprise-wide implications are reported to ARC and the CIT Board through the Tier 1 reporting pathway.

Where an academic risk is cross-functional, one accountable risk owner must be nominated based on the objective most directly affected and the authority required to manage the risk. Control and treatment action owners must be assigned across the relevant Colleges, branches and functional areas, with responsibilities and timeframes clearly recorded. The accountable risk owner coordinates the overall response, while control and treatment action owners remain responsible for their assigned controls and actions. Escalation does not transfer ownership unless formally approved and recorded.

13.3 Regulatory Events and Notification Reporting

Potential regulatory events must be reported promptly through the appropriate management and compliance processes. Staff are responsible for identifying and escalating matters that may create legal, regulatory, contractual or reporting obligations.

Any notification or reporting requirements should be considered and actioned as soon as possible and should not wait for a risk assessment to be completed. If the event creates an ongoing or future risk, it should also be assessed and recorded in the appropriate risk register. Significant compliance issues and material events should be escalated to the appropriate management or governance body based on their impact, urgency and seriousness.

14. Academic and Functional Risk Intersection

Academic risks should not be isolated from CIT's broader risk architecture. An academic risk may originate from, or depend upon, a functional or specialist risk. Where a functional risk has an academic consequence, the risks should be linked rather than duplicated.

The primary register should reflect the underlying objective and management pathway. A functional or specialist risk remains managed through its relevant register, while a material academic consequence is reflected in the Academic Risk Register. Controls and treatments should be coordinated rather than duplicated.

14.1 WHS Risks Affecting Academic Standards

The WHS Risk Register remains the specialist mechanism for managing WHS exposure, hazards and controls. A WHS risk should also be considered for academic risk where it affects the environment, resources, equipment or conditions necessary for safe and appropriate training and assessment. For example, equipment that cannot safely be used may create an academic consequence if it prevents CIT from delivering or assessing required competencies. The detailed WHS treatment remains in the WHS system, with the academic consequence cross-referenced where material.

14.2 Conflict of Interest as a Risk Input

Conflict of interest information is an important input into CIT’s risk management process. Actual, potential or perceived conflicts may reveal weaknesses affecting decision-making, procurement, recruitment, contracting, governance, academic integrity, impartiality or public trust. Individual conflicts must first be declared, assessed, recorded and managed under the CIT Conflict of Interest Policy. The responsible area should then consider whether the matter is isolated or indicates a broader, recurring or systemic exposure, such as repeated late declarations, ineffective management plans, unclear decision-making responsibilities or inadequate segregation of duties. Where a broader exposure is identified, the information should be considered through the Issue-to-Risk Gateway to determine whether an existing risk should be updated, a new risk should be identified, a control should be strengthened or a continuous improvement or assurance action is required.

The Risk Management Plan does not replace the conflict of interest procedure or its recordkeeping and confidentiality requirements. The conflict of interest record remains the authoritative record for the declaration, assessment and management of the individual matter. Risk registers and continuous improvement records should contain only the de-identified information needed to describe the broader organisational exposure, control weakness or required action. An appropriate cross-reference should be included where permitted, without reproducing personal, confidential or matter-specific information.

Not every conflict of interest will require a risk register entry. A risk should be recorded only where the matter identifies a broader organisational exposure, recurring issue, control weakness or risk to the achievement of CIT objectives. Individual conflict of interest records remain the authoritative record for the declaration, assessment and management of the matter.

15. Assurance Integration

Risk management is integrated with CIT's broader assurance activities and should operate alongside assurance processes to support effective governance, decision-making and continuous improvement.

• Management self-assurance and control reviews.
• Compliance reviews and regulatory assurance.
• Internal and external audit.
• Independent reviews and evaluations.
• Academic quality assurance and validation.
• Governance and committee oversight.
• Control testing and performance reporting.

Assurance findings are assessed to determine whether they represent an operational issue, a control failure, a change to an existing risk, a new risk or a systemic exposure. The relevant risk, issue or action register is then updated, avoiding duplicate records where the matter is already captured. The responsible owner implements or escalates the required response, and the effectiveness of completed actions is monitored. Lessons from assurance activities are incorporated into future risk scanning, planning and continuous improvement.

15.1 Three Lines and Governance Integration

CIT adopts a Three Lines approach to governance, risk management and assurance. Under this model, business areas are responsible for managing risks and controls, specialist functions provide oversight and support, and independent assurance is provided through Internal Audit.

First-line business areas identify events, take immediate action, maintain operational controls and provide evidence. Second-line functions, including Compliance, Risk, Education Quality, Privacy, WHS, ICT Security and other specialist areas, provide advice, challenge, oversight, coordination of notifications and monitoring of corrective actions. Internal Audit provides independent assurance on the design and effectiveness of the risk management framework and related controls. EMC, ARC, Academic Council and the Board provide oversight within their respective mandates. These roles support, but do not replace, the accountability of the risk owner.

Education Quality provides second-line monitoring and assurance over academic risks and corrective actions, including validating whether actions have been effectively completed. Operational responsibility for implementing controls and corrective actions remains with the relevant College, program area, branch or functional area.

16. Records and Evidence

CIT will retain sufficient evidence to demonstrate how risks were identified, assessed, treated, monitored and escalated. Relevant evidence includes:

• Risk registers and risk assessments.
• Risk treatment schedules and action plans.
• Issue-to-Risk Gateway records and supporting evidence.
• Completed ACTIA risk management artefacts, tools and templates, where applicable;
• Environmental scanning records and source information.
• Control assessments and testing evidence.
• Risk escalation and acceptance decisions.
• Committee and governance records supporting material risk decisions.
• Assurance reports and management responses.
• Risk reporting and KRI information.
• Lessons learned and review records.

Where CIT uses an ACTIA artefact, tool or template as part of the risk management process, the completed document and supporting evidence will form part of the relevant risk record.

Records must be managed in accordance with CIT's records management requirements and applicable Territory records authorities. The risk record should be sufficient to reconstruct the basis for material risk decisions.

17. Risk Register Development and Implementation

Risk register development will be undertaken as a coordinated process rather than as separate exercises by individual business areas. The purpose is to establish a connected risk profile reflecting CIT's objectives, operating environment, academic responsibilities, strategic priorities and material exposures.

17.1 Development sequence

1. Confirm objectives and context.
2. Review environmental scanning and notifications.
3. Review existing risks and source records.
4. Review issues, incidents and assurance findings.
5. Identify new and emerging risks.
6. Remove duplicates and consolidate common risks.
7. Determine the appropriate register and governance level.
8. Assess risks and controls.
9. Identify treatments and KRIs.
10. Assign risk owners.
11. Validate with management and governance.
12. Establish monitoring and reporting.

17.2 Development and implementation schedule

The development process may use ACTIA-facilitated workshops and in-house consultation with relevant stakeholders. The detailed schedule should be maintained as an implementation artefact and updated as delivery progresses.

18. Continuous Improvement Register

CIT maintains continuous improvement registers to record and monitor opportunities to improve its services, systems, practices and outcomes. These may arise from complaints, incidents, feedback, reviews, audits, assurance activities, academic quality processes or lessons learned.

Not all risk treatment actions will require entry into the Continuous Improvement Register. Actions should be recorded in the Continuous Improvement Register where they involve a substantive or systemic improvement to a process, control, system, capability, policy or practice. Routine controls, monitoring activities and isolated corrective actions may be managed through the Risk Register or the relevant business process.

Where a risk treatment action is recorded in the Continuous Improvement Register, the associated Risk Register should reference the improvement action to maintain traceability and allow the risk owner to monitor progress and treatment effectiveness.

The same matter may be recorded in both the Risk Register and Continuous Improvement Register where each record serves a different purpose. To minimise duplication, the Continuous Improvement Register should be the primary record for the detailed improvement action, while the Risk Register records the treatment and relevant status or reference.

18.1 Improvements Cycle

The improvements cycle starts when an issue, finding, complaint, feedback item, audit result or lesson learned identifies an opportunity for improvement. The opportunity is reviewed to confirm that action is needed and to determine the desired outcome. An owner is assigned, the action is prioritised and recorded, and implementation begins. Progress is monitored and the outcome is reviewed to confirm that the improvement has been effective. Where an improvement results in a new or enhanced control, the control should be incorporated into the relevant risk management, operational or governance processes and recorded in the applicable risk record. Once completed, the action is closed, and any lessons learned are used to strengthen risk management, assurance activities, planning, controls and operations.

19. Review and Maturity

The Plan will be reviewed at least annually and whenever there is significant change to CIT's strategy, operating environment, regulatory obligations, governance arrangements or risk profile. Effectiveness should be evaluated using evidence rather than completion of activities alone.

• Are risks being identified early enough to support decision-making?
• Are issues being appropriately distinguished from risks?
• Are common risks being consolidated rather than duplicated?
• Are academic risks being managed through the appropriate academic governance pathway?
• Are strategic risks informed by divisional intelligence and environmental scanning?
• Are controls and treatments demonstrably reducing exposure?
• Are escalation and reporting timely and proportionate?
• Is assurance providing reliable information about risk and control effectiveness?
• Are lessons learned being embedded across CIT?

20. Risk Management Capability and Training

CIT will maintain effective risk management capability through role-based training and development. Training will be proportionate to each person’s responsibilities, timed to support the relevant risk management activities, and delivered through in-house training, ACTIA-facilitated sessions and relevant ACT Government risk management modules.

Appendix A –Risk Recording and Escalation Guide

How to apply these rows: The specialist register answers where the detailed risk is recorded. The tier answers who must manage, coordinate or oversee the risk. Escalation changes the level of attention or decision-making but does not automatically move the full specialist record into another register or transfer ownership. Where broader consequences are recorded elsewhere, use a concise cross-reference and retain sensitive or investigation-related information only in the authorised specialist system.

Appendix B – Minimum Risk Record

Appendix C – Improvements Register and Academic Risk Reporting Map

Appendix D – Minimum Improvement Record

21. Policy Contact Officer

For more information about this policy contact CIT Risk Officer.

Alternatively, contact CIT Student Services on (02) 6207 3188 or email infoline@cit.edu.au for general information.

22. Procedures

This policy is implemented through the associated procedures. Authority to make changes to the procedures rests with the policy owner.