Enterprise Risk Management Framework - Policy

Printer-friendly version

1.0   Purpose and Scope

1.1   Context

Risk is the ‘effect of uncertainty on objectives’[1] where effect is a deviation from the expected outcome. Risk may be caused by a single event or a set of circumstances that affect, adversely (threats) or beneficially (opportunities), the achievement of objectives.

In the context of risk management, uncertainty exists when there is an inadequate or incomplete knowledge or understanding of an event, its likelihood and/or its consequence.

Risk management refers to the set of principles, framework, culture, processes and coordinated activities to direct and control an organisation with regard to the many risks that can affect its ability to achieve its objectives. Effective risk management increases the likelihood of achieving objectives, identifying and pursuing opportunities and avoiding or minimising unexpected harms.

1.2   Risk Management Obligations

Risk management at the University of Queensland (UQ or the University) is guided by the International Standard ISO31000:2018 – ‘Risk Management Guidelines’ and seeks to comply with the following state and federal legislation relating to risk management:

  • Financial Accountability Act 2009 (Qld) – requires the establishment and maintenance of an appropriate system of risk management.

  • Financial and Performance Management Standard 2019 (Qld) – prescribes that UQ's risk management system must provide for mitigating the risk to the University and the State from unacceptable costs or losses associated with the operations of the University, and managing the risks that may affect the ability of the University to continue to provide services.

  • Higher Education Standards Framework (Threshold Standards) 2021 – requires that risks to higher education operations are identified and material risks managed and mitigated effectively.

  • Crime and Corruption Act 2001 (Qld) – refers to corruption risks and development of prevention strategies.

  • Work Health and Safety Act 2011 (Qld) – requires that risks are eliminated, and if not reasonably practicable to be eliminated, then minimised as far as reasonably practicable.

1.3   Risk Management Objectives

Risk management at UQ is:

  • an enabling management function overseen by the Senate and undertaken by managers and staff at all levels of the University and in all aspects of its operations; and

  • contextual (i.e. risks are assessed against specific objectives) and recognises that uncertainty could affect objectives adversely and/or beneficially.  

UQ’s risk management objectives are to facilitate the achievement of its strategic and operational objectives including:

  • Value creation and protection;

  • Effective and efficient performance and compliance; and

  • The development, enhancement and protection of its strategic and operational capabilities.

Enterprise Risk Management Framework

UQ’s Enterprise Risk Management Framework (ERMF) provides the overall framework, direction and oversight for the systematic, disciplined and consistent identification and assessment of risks (including opportunities) and for their effective and efficient management.

The ERMF comprises this policy, Senate and management commitment to effective risk management, people and relationships that enable a risk‑aware culture and the objectives and strategies that provide the context for risk assessment and management.

The following diagram highlights the core elements of UQ’s Enterprise Risk Management Framework and helps demonstrate that risk management at UQ is:

  • An enabling management function, supported by input from staff at all levels, dedicated to the achievement of UQ’s strategic and operational objectives and priorities while operating within the Senate-approved risk appetite and tolerance levels.

  • Contextual (i.e. risks are assessed against specific objectives) and recognises that uncertainty could affect objectives adversely and/or beneficially.

  • Built on and supported by the following five ‘pillars’:

  1. Senate’s expectations and risk appetite.

  2. Management/ leadership commitment and support for risk management function, organisational culture and relationships.

  3. External compliance obligations relating to risk management.

  4. Risk management objectives, strategies, mandate and accountabilities.

  5. Risk management resources, plans, processes and activities.


1.4   Scope and Application

The ERMF applies to all categories of risk across the whole of UQ, including risks associated with controlled entities, and their operations. It demonstrates the Senate and the Vice-Chancellor and President’s commitment to and support for effective and efficient risk management.

In addition to the ERMF, more detailed risk management governance documents with additional requirements exist, addressing specific risk domains, e.g. Health, Safety and Wellness and Information Technology Services. These more detailed risk governance documents are consistent with and give further effect to the ERMF.

2.0   Key Requirements

To demonstrate effective and efficient risk management, UQ will:

Risk appetite

Manage its risks in alignment with the risk appetite statement (RAS) approved by the Senate and towards the achievement of its strategic and operational objectives. Appendix A contains an overview of UQ’s RAS. It is important to note that:

  1. The RAS provides direction to management to guide their decision making. Management and staff are expected to be prudent and apply good judgement in interpreting the RAS to make sensible, risk-based decisions in the best interest of the University and its stakeholders.

  2. It is acknowledged that in some circumstances the risk appetite statements may result in conflicting risk management objectives. Where this is the case, a trade-off in risk will be required in order to achieve the most beneficial outcome for UQ and Enterprise Risk Services (ERS) should be advised.

  3. External obligations, budget constraints and the impact of external influences must be considered to determine the optimal treatment plan to manage particular risks.

  4. The RAS is operationalised via the Risk Matrix including the Risk Tolerance and Action Table (Appendix D).

Risk management culture

Create and continually enhance a constructive risk management culture in which staff and managers at all levels are encouraged and supported to raise and respectfully discuss risks, issues and opportunities towards beneficial outcomes.

Enterprise-wide approach

Adopt an enterprise approach to risk management and ensure its risk management framework, processes and practices:

  1. Explicitly address “uncertainty” in relation to the achievement of objectives and priorities with a view to reducing the variability of outcomes.

  2. Are context-driven (i.e. based on specific objectives).

  3. Recognise the impact of human, cultural and environmental factors on University objectives.

  4. Are systematic, structured, timely and consistent with UQ’s Governance & Management Framework.

  5. Are transparent and inclusive i.e. risk assessment and management activities and decisions include perspectives of all stakeholders, not just management’s.

  6. Enable risk management to be an integral part of management thinking, discussions and decision making and help management find the right balance amongst risk, cost and value.

  7. Are integrated into all organisational processes, activities and practices including strategic and operational planning, project management and day-to-day operations and that risks are sufficiently documented in relevant plans and reports.

  8. Help safeguard assets both tangible and intangible (e.g. IP).

  9. Protect the integrity of financial accounting and reporting.

  10. Are based on the best available information and recognise any limitations with the underlying data. 

  11. Are dynamic, iterative, responsive to change and continually improving.

  12. Are efficient and where feasible, harness technology to support risk management.

  13. Facilitate the continual improvement and enhancement of the University. 

Roles and responsibilities

Ensure clarity of roles, responsibilities and accountabilities for effective risk management including monitoring, reviews and provision of assurance on risks and controls.


Build a zero-harm safety culture and implement a risk-based safety management system. Refer to the Health, Safety and Wellness Policy and suite of supporting procedures for further guidance (Workplace Health and Safety - UQ Policy and Procedures Library).


Adopt a risk-based approach to demonstrating compliance including coordination of regulatory and compliance matters across the University.


Embed risk management in its investment processes and decisions to help identify, prioritise, assess and pursue viable opportunities in a systematic and disciplined manner.

Risk Matrix

Assess its risks using the Risk Matrix (Appendix D) and record the risks and controls in the relevant risk register template provided on the ERS website.

Risk Mitigation

Select, design, implement, communicate and document risk mitigation strategies to reduce the likelihood of the risk eventuating and/or to reduce the impact on UQ, should the risk eventuate.

Select only those risk mitigations for which the benefit will be greater than the cost of mitigating the risk.

Monitor risk itigation strategies to ensure continued relevance, appropriate application, effectiveness and efficiency.

General Management Controls

Manage its risks through the design, development and implementation of effective and efficient controls, including General Management Controls (GMCs) as defined in Appendix C. All risks will be managed at a level as low as reasonably practicable and on a legally justifiable and cost/benefit basis with a financial and business outcome focus.

Risk management options include (but are not limited to): risk elimination; risk avoidance; risk transfer (through insurance or contracts); and risk retention or acceptance with proper management.

Risk events, incidents, resilience and capability

Build resilience and requisite capabilities to anticipate, prepare, respond, rapidly recover and minimise adverse impacts from critical incidents, including possible but hard to predict risks. Refer to the UQ Incident Management Procedure for detailed incident management processes and protocols, including escalation requirements.

Escalate risk events and incidents via business as usual organisational hierarchy and functional (i.e. central divisions and functions) communication processes, and promptly inform Enterprise Risk Services to be informed when the impact on UQ is rated as ‘Major’ or ‘Extreme’ as per the Risk Consequence Rating Table (Appendix D).

Actively monitor and follow up negatively trending or adverse movements in key risk indicators and take appropriate steps to remedy unfavorable variances and trends including any systemic issues. Such monitoring follow-up and remediation will be undertaken by central functions and central divisions. Enterprise Risk Services will be promptly informed of unfavorable variances, trends, and systemic issues when the actual or probable impact on UQ is rated as ‘Major’ or ‘Critical’ as per the Risk Matrix Consequence Rating Table (Appendix D).


Ensure provision of meaningful and useful reports and assurance to senior management and the Senate on risks and controls. Such reports will include potential systemic, UQ-wide risk exposures and/or risk trends across the enterprise and any material changes to risk profiles and controls over time.

Internal Audit

To the extent feasible, integrate risk management and Internal Audit activities by ensuring that Internal Audit’s annual plans and programs of work appropriately consider the primary risks and controls of the University and provide assurance on their effectiveness.

Ongoing review

Continually review and optimise its risk management function, framework, processes and practices.

3.0   Roles, Responsibilities and Accountabilities

3.1   Senate

The Senate is the University's governing body and accountable for the effective and efficient governance of the University. The Senate approves this Framework including the University's risk appetite.

3.2   Senate Risk and Audit Committee

The role of the Senate Risk and Audit Committee (SR&AC) is to oversee the assessment and management of risks. The Committee’s responsibilities in relation to enterprise risk include:

  1. Review the tone and risk culture of UQ, and promote robust discussion around risk appetite and tolerance for risks.

  2. Receive reports from the Vice Chancellor’s Risk and Compliance Committee (VCRCC) on management’s identification and assessment of risks to UQ’s strategic and operational objectives and the effectiveness of processes to appropriately manage these risks.

  3. Advise Senate on significant issues and changes to the University’s risk profile.

  4. Receive annual advice upon the effectiveness of the ERMF, including annual advice whether risks are being managed in accordance with RAS.

3.3   Vice Chancellor's Risk and Compliance Committee (VCRCC)

The VCRCC provides assurance to the Vice-Chancellor and President and USET on the effectiveness of UQ’s risk management and compliance frameworks and practices and on significant risk or compliance issues. In addition to risk and compliance, the VCRCC also provides oversight of assurance, investigations, research integrity and work health and safety functions.

3.4 Vice-Chancellor and USET

The Vice-Chancellor, with support from USET, is responsible for:

  1. Creating and maintaining a risk-aware culture, including reinforcing commitment to and role modelling risk-informed decision making.

  2. Exercising management oversight responsibility, ensuring effective risk management practices as per this ERMF, and transparent risk reporting to Senate.

3.5   University Senior Leadership Group (USLG)

Under the ERMF, members of the USLG are responsible for:

  1. Assessing and managing the risks to their portfolio’s objectives and strategies;

  2. Maintaining risk registers in the approved format and ensuring the accuracy and currency of their risk registers;

  3. Monitoring and reviewing their risks and controls with sufficient frequency to ensure the currency of their risk profile and ongoing effectiveness of controls;

  4. Providing timely and positive assurance on the management of their risks and on the effectiveness of the General Management Controls within their portfolios;

  5. Facilitating annual reviews of their material risks and controls by ERS and any other ad hoc reviews of risks and controls that the ERS may undertake to meet SR&AC and/or VCRCC needs, and ensuring that any deficiencies identified through the review and assurance processes are promptly rectified; and

  6. Ensuring their direct reports undertake steps 1 to 5 above for their respective areas of responsibility.

3.6   Enterprise Risk Services (ERS)

The ERS is responsible for ensuring that the ERMF is implemented across the University and effective oversight is maintained through regular reporting on material risks. More specifically,  ERS is responsible for facilitating the assessment of and providing reports to the VCRCC and the SR&AC, at intervals decided by them, to raise awareness on:

  1. UQ’s Top Risks based on Managed Risk Levels (MRL) (i.e. the level of risk remaining after considering the effectiveness of the existing controls or risk treatments) and their management. UQ's Top Risks are developed by ERS, and approved by USET, with reference to lower level Top Risks registers (e.g. identification of common themes and trends), targeted management consultation, consideration of changes in both the University's internal and eternal environment, risk events and incident data.

  2. The effectiveness of the General Management Controls.

  3. Key emerging risks.

  4. UQ’s key risk indicators.

4.0   Monitoring and Review

Management is responsible for effective risk management with the ERS being an enabling function, and Internal Audit providing objective assurance.

Under the direction of senior executives and the Senate, the following three cohorts within the University will undertake monitoring and review activities to assess and ensure effective and efficient risk management and controls. While each group has its own monitoring and review objectives and scope consistent with their respective roles in the organisation, there will be ongoing communication and consultation amongst them to ensure effective and efficient monitoring and reviews at each level and avoidance of duplications. 


Managers will monitor and review their operational activities, risks and controls to ensure effective and efficient performance, governance, risk management and compliance. Monitoring and reviews performed at this level will be the most detailed and generally embedded in the routine processes, procedures, systems and activities of front line operating management. 

Heads of Enabling Functions

In addition to their ‘Management’ obligations noted above, Heads of Enabling Functions and Divisions (COO portfolio and DVCs' support services) will monitor and review their function-specific risks across the University and ensure the ongoing effectiveness of the related controls including policies and procedures.

Internal Audit

Internal Audit is responsible for providing objective assurance on the adequacy and effectiveness of risk management.

5.0   Recording and Reporting

Risk owners will record pertinent information and data relating to their risks and controls in the risk register format prescribed in Appendix E.

The following reports on risks and controls will be produced:

Report Title


Report Content

Report Producer

Report Recipient


Top Risks

The key risks of the University based on their Managed Risk Levels (current risk levels) at the time of reporting, including the specific controls managing these risks and any additional proposed controls to reduce the risks to Target Risk Levels (acceptable risk levels).  


ERS in consultation with VCRCC and USET



Yearly full review, half yearly progress updates, and quarterly any major changes to the risk profile

Key Emerging Risks


The key emerging risks of the University and what preparatory work or pre-emptive actions (if any) management has decided to take.

ERS in consultation with VCRCC and USET


As necessary, with yearly full review

Key Risk Indicators

The key risk indicators measuring UQ's compliance with the RAS.


ERS in consultation with VCRCC and USET



General Management Controls (GMCs)

The effectiveness of the GMCs per each USET member and overall, at University level.


ERS in consultation with VCRCC and USET


On a rolling basis and thereafter annually

6.0   Appendix

6.1   Appendix A - Risk Appetite Statement (RAS)

UQ's overall attitude towards risk is that of a prudent risk taker.

That is:

1.     UQ has a HIGH APPETITE for risks that meet all of the following conditions:

  1. The risk is associated with initiatives, operations and activities that support UQ’s strategic goals and priorities and have a credible prospect of providing moderate to high net returns or contributions to its objectives; and
  2. UQ has the capabilities to manage the risk effectively and efficiently to acceptable levels, or demonstrable risk capacity to sustain the loss should the risk materialise; and
  3. Any negative impact/s on risk categories for which UQ has a low or nil appetite can be managed to a tolerable level (see below).

2.     UQ has a LOW OR NIL APPETITE for risks that meet one or more of the following conditions:

  1. The risk has the potential to significantly erode or cause intolerable damage or harm to the health and safety of our people, UQ’s culture, reputation, operational resilience, financial viability, and/or social and legal licence to operate; or
  2. UQ does not have the capabilities to manage the risk effectively and efficiently, nor does UQ have the capacity to sustain the loss or negative consequence should the risk materialise.

Tolerance and treatment of risks with LOW or NIL appetite

In some cases, despite having a low or nil appetite for some risks, UQ may have to tolerate those risks at higher levels because:

  1. It is impossible, impracticable and/or cost prohibitive to eliminate those risks or reduce them to low levels; and
  2. Those risks cannot be avoided as they are inherent to initiatives, operations and activities that are essential to UQ given its objectives and strategy.

In such circumstances where UQ has no choice but to tolerate a higher risk level, the risk exposure will be reduced to as low as reasonably practicable (ALARP) via application of robust, cost-effective and affordable controls.

Examples (non-exhaustive list):

  • Health and safety risks
  • Compliance risks
  • Foreign interference risks
  • Cyber security risks
  • Risks to reputation
  • Fraud risks.


6.2   Appendix B - Risk Categories

The following table can be used to assist with the identification of risks to facilitate the development of a risk assessment and management plan (non-exhaustive).




Focus area categories


Research and Innovation

  • Research & innovation strategic targets, outputs, performance and outcomes (includes partnerships, commercialisation, investments, etc.)
  • Research resources and capabilities including staff, financial sustainability and funding diversification
  • Quality of research outcomes
  • Competitiveness including funding diversification, market share, demand and capabilities
  • Investment projects and programs
  • Adaptability and change management – operational agility
  • Innovation and opportunities, including with partners
  • Partner reputation, reliability, credit risks, etc.
  • Intellectual property, including encumbrances, licences, commercialisation activities, etc.
  • Research integrity and ethics
  • Security, availability, performance, quality/reliability of research facilities, infrastructure, experiments, systems, data and research samples
  • Safety of research activities including experiments, travel and use of materials facilities and equipment
  • Legal and regulatory compliance, including retention of licences, permits, foreign relations, national security risks, export controls, sanctions, information security, privacy, personal information, jurisdiction (domestic & international) obligations, etc.
  • Insurable activities


Teaching and Learning

  • Teaching & learning strategic targets, outputs, and outcomes
  • Teaching resources and capabilities including staff and funding
  • Quality of teaching outcomes
  • Teaching integrity and ethics
  • Assessment integrity and ethics
  • Student employability, including work integrated learning quality and availability
  • Teaching facilities, infrastructure, data and systems’ availability, security, performance, quality/reliability
  • Legal and regulatory compliance as well as program accreditation by professional bodies
  • Partnerships



  • Students’ related strategic targets, outputs and outcomes
  • Student experience and retention
  • Student outcomes including employability
  • Student behaviour/conduct, safety, security and well being
  • Student diversification


Stakeholders, Relationships and Reputation

  • Brand /image, credibility/trust, attractiveness
  • Constructive, respectful and mutually beneficial relationships
  • Actual and potential benefits – donations/endowments, support, etc.
  • External engagement
  • Other partnerships

Operational categories



  • Equity and diversity
  • Recruitment and selection
  • Capabilities, productivity and performance e.g. workforce and succession planning
  • Retention, development and progression
  • Industrial relations including employer and employee conduct
  • UQ Values, Code of Conduct
  • Resilience / continuity of HR operations (e.g. payroll)


Health, Safety and Wellness

  • Health and safety of students, staff, volunteers and visitors
  • Staff wellbeing



  • Statutory functions and powers as defined by the UQ Act
  • Operating Model
  • Performance, achieving Strategic Plan KPIs



  • Financial position / resilience
  • Financial performance
  • Budgeting and forecasting
  • Accounting, Reporting and Disclosure integrity
  • Resilience / continuity of operations


Governance, Legal and Compliance

  • Statutory approvals, licences, permits and certificates
  • Legal and contractual rights and powers
  • Oversight, monitoring, review and assurance activities and capabilities
  • Ethics and integrity, (corrupt conduct, fraud)
  • Resilience / continuity of operations


Facilities and Infrastructure

  • Security
  • Quality / Integrity / Reliability
  • Availability / operational capabilities, including utilities
  • Performance (optimum utilisation)
  • Resilience / continuity of operations


Systems and Information Management

  • Authenticity / integrity / reliability of systems and information
  • Security and Accessibility
  • Availability and useability
  • Productivity
  • Agility (future needs)
  • Resilience / continuity of operations

6.3   Appendix C - General Management Controls (GMCs)

The GMCs are inherent to the general management functions of leading, directing, planning, organising, staffing, coordinating and controlling any organisation. These controls form the foundations of the University’s internal control system and help provide a robust, systematic and perpetual defence against threats to achieving the University’s objectives. The GMCs should be implemented and assessed for their effectiveness at the UQ level and any of the lower levels including faculties, schools, institutes, controlled entities, functions, divisions, teams and projects.


Control Objective

Principal Question (All ‘Yes’ responses must be supported by verifiable evidence)


Clarity of objectives, strategies and KPIs

  • Have the objectives and strategies been clearly defined, aligned, prioritised and communicated to those who need to know?


Stakeholder management

  • Have the primary stakeholders been identified and strategies put in place to recognise and protect their rights and develop respectable, equitable and mutually beneficial relationships with them?


Enabling organisational structure

  • Does the organisational structure facilitate the effective and timely implementation of the strategy and the monitoring, measuring and reporting of performance?


Proper plans and budgets


  • Are there approved plans and budgets for all objectives, strategies, initiatives/projects and have these plans and budgets been communicated to those who need to know?


Clarity of roles, responsibilities and accountabilities

(Note 3)

  • Are the roles, responsibilities and accountabilities for the delivery of prioritised objectives and outcomes clearly articulated and assigned to individuals or teams?


Capable staff

  • Are the management and other pivotal/critical roles staffed by competent people?


Authority and delegations

  • Do managers and staff have appropriate authorities/delegations and mandate to achieve the objectives/outcomes expected of them?


Supportive culture

  • Do managers and staff behave in accordance with UQ Values and the Code of Conduct?



  • Are processes and protocols in place to protect people from harm?



  • Is there a robust process in place to demonstrate compliance with applicable laws and regulations and are regulatory breaches (if any) recorded, reported and promptly rectified?


Security of assets

  • Is there effective security over assets including systems, information and vital records?


Performance monitoring and reporting 

  • Are portfolio/area and staff performances against their respective KPIs and plans measured, monitored and reported on and timely actions taken to remedy any gaps in performance?


Responsible use of resources

  • Are there controls in place to ensure responsible, sustainable use and management of University resources including natural resources?


Appropriate records and reports

  • Are records and reports required for business and/or legal/regulatory reasons produced and are they relevant, reliable, timely and adequately retained?


Continuity of operations

  • Are there robust plans and processes in place to ensure continuity of business-critical operations?


Supervision, Monitoring and Reviews of Internal Controls

  • Is there effective supervision, monitoring and review of the effectiveness of implemented controls related to staff compliance with (local) operating procedures, systems and processes, including prompt remediation of any unfavourable variances?


Management Assurance

  • Does management provide reliable assurance and/or evidence to demonstrate effective and efficient performance, governance, risk management and compliance?

Note 3:   Accountability refers to the decision maker’s obligation to explain the use of delegated authority towards the achievement of agreed objectives and outcomes.
               Responsibility refers to the obligation to perform specific actions, under the instruction of and/or for the accountable party, towards the achievement of agreed objectives and outcomes.

6.4   Appendix D - Risk Matrix

Appendix D - Risk Matrix Table.pdf

6.5   Appendix E - Definitions, Terms and Acronyms

ERMF – Enterprise Risk Management Framework.

RAS – Risk Appetite Statement.

ERS – Enterprise Risk Services.

GMCs – General Management Controls.

IRL – Inherent Risk Level (It is the level of risk assuming there are no controls specifically designed and implemented to manage that particular risk).

MRL – Managed Risk Level (It is the level of risk taking into consideration the total effectiveness of all the existing controls or risk treatments that act upon that risk).

TRL – Target Risk Level (It is the desired (or acceptable) level of risk considering the University’s risk appetite and tolerance levels, to be achieved via implementation of proposed controls).

SR&AC – Senate Risk and Audit Committee.

VCRCC – Vice Chancellor’s Risk and Compliance Committee.

USET – University Senior Executive Team.

USLG – University Senior Leadership Group.

Systemic Issue -

An issue that meets ALL the following conditions:

  • It is a problem or an event that has negative consequences which has occurred or is inevitable; and
  • Is a materialised risk or an issue that will result in further risk exposure/s; and
  • It is a confirmed (verified) irregularity, deficiency, or vulnerability, not just speculation or hearsay; and
  • If left unmanaged, it will continue to exist (and probably deteriorate); and
  • It is demonstrably prevalent across UQ, organisational area or function, depending on the context.

[1] ISO 31000:2018

Director, Governance and Risk


UQ Incident Management - Procedures

Printer-friendly version

1.0                Purpose and Scope

1.1    Context

UQ’s operations are dependent on and influenced by many aspects of the university, such as:

  • A wide and very large scope of activities and services related to both teaching and research.

  • Multiple campuses.

  • Off campus activities and services both in Australia and abroad.

  • Large number of buildings, facilities, research equipment and other infrastructure.

  • Involvement of many people; staff, students, visitors and wider community.

Given this large scope of influences and dependencies impacting the university’s daily operations, business interruptions are likely to occur from time to time.  Disruptive incidents often result in a localised operational disruption only but sometimes can cause a critical incident when multiple areas are negatively impacted requiring a coordinated response, or in very rare circumstances result in a crisis where a strategic executive response is required.

1.2   Purpose & Scope

The purpose of this procedure is to ensure that the university builds adequate resilience and requisite capabilities to anticipate, prepare, respond, rapidly recover and minimise adverse impact from disruptive incidents, including hard to predict disruptions.  It takes into consideration potential impacts of a disruptive incident to people, assets, the local community, the environment and UQ’s reputation.

This procedure applies to actual or potentially imminent adverse incidents and events impacting on UQ, including its controlled entities.

1.3   Objectives

  • Anticipate threats to UQ’s strategic objectives.

  • Develop capabilities to prevent, prepare for, promptly respond to and rapidly recover from events that disrupt and threaten UQ.

  • Empower and develop the capabilities of individual leaders to manage disruption events and threats.

  • Integrate all levels of incident, risk and disruption management to create a consistent and enterprise wide approach. 

  • Build on and support existing organisational knowledge, skills and systems to ensure practical adoption of business resilience and critical incident management principles and capabilities.

2.0                Process and Key Controls

2.1   Incident management process

UQ has adopted the PPRR (Prevention, Preparedness, Response, and Recovery) comprehensive approach as the process for managing all phases before, during and after disruptive incidents.

The approach is continuous and all managers must understand and perform their roles and responsibilities related to all four phases of the process.



2.2   Enterprise incident response structure

UQ has a tiered enterprise incident response structure to ensure an integrated, scalable, enterprise wide and consistent response to disruptive incidents. The structure applies to all university operations and activities.

An incident response can initially be activated from all levels within the response structure (refer figure below). Once activated the response structure operates hierarchically.

Managers should understand:

  • Their individual roles and responsibilities within the structure.

  • Teams, plans and procedures to be activated at each level.

  • Their responsibility to report and/or escalate incidents to the next level above.

Enterprise incident response structure



2.3   Initial incident assessment and response

Incident assessment is a key component of incident management and ensures the appropriate level of response is activated.

Incident assessment must occur prior to activating a response at any level within the incident response structure.

Incident assessment at UQ is based on a combination of 10 key trigger incidents and critical consequences defined by the UQ Enterprise Risk Matrix.

The Initial Crisis Response Tool for Management guides managers through:

  • Assessment of trigger incidents.

  • Assessment of actual or potentially imminent consequences.

  • Required notifications and escalation of incident.

  • Required activation of teams, plans and processes.

3.0                Key Requirements

Disruptive incidents push activities from business as usual into the incident management process. This process is driven through three key requirements:

  • Formation of teams.

  • Implementation of plans.

  • Adherence to response priorities.

3.1   Teams

Level 1 - Local Response Teams (LRT)

  • Responsible for immediate response to incidents to protect people, assets, infrastructure, operations and/or services.

  • Local response managers are responsible for the direction of their staff and resources.

  • Utilise emergency response plans, incident response plans, business continuity plans and standard operating procedures to respond.

  • Report up to relevant senior manager and the UIMT (if activated).

Level 2 – University Incident Management Team (UIMT)

  • Responsible for senior management control and coordination over multiple UQ functions and ensures an adequate enterprise wide response to incidents.

  • Operates under the requirements of the University Incident Management Plan (UIMP).

  • Reports up to the Crisis Management Team (if activated) and coordinates down through the LRTs.

  • Team composition is scalable and flexible and determined by the incident response assessment.

  • See appendix 7.1 for UIMT basic composition.

Level 3 – Crisis Management Team (CMT)

  • Responsible for providing executive leadership in response to abnormal and unstable situations that threaten UQ’s strategic objectives, reputation or viability.

  • Sets the strategic objectives of the response and recovery.

  • Communicates with the Senate and is focussed on the medium to long term impacts.

  • Directs down through the UIMT.

  • Operates under the requirements of the Crisis Management Plan (CMP).

  • Team composition is scalable and flexible and determined by the incident response assessment.

  • See appendix 7.2 for CMT basic composition.

3.2   Plans

Plans detail and structure response and recovery actions and tasks. They exist at all levels of the incident response structure and are developed, practiced and tested during the preparedness phase.

Plan hierarchy



Plans within the Incident Management Process are:




Crisis Management Plan (CMP)

Informs and structures the VCC response to abnormal and unstable situations that threaten UQs strategic objectives, reputation and/or viability.

The CMP is developed, implemented and maintained by Enterprise Risk Services on behalf of the COO.

University Incident Management Plan (UIMP)

Coordinates and guides the senior management response to incidents that impact more than one university function, critical building and/or essential service.

The UIMP is developed, implemented and maintained by Enterprise Risk Services on behalf of the D/COO.

Communications Response Plan (CRP)

Informs and structures timely, consistent and accurate messaging that supports strategic and operational objectives.

The CRP is developed, implemented and maintained by OMC.

Local Response Plan (LRP)

Details and structures local and immediate response to protect people, assets, infrastructure, operations and/or services.

LRPs are developed, implemented and maintained by all functions.

Business Continuity Plan (BCP)

Details and structures tasks and actions to ensure critical business functions are maintained during and after critical incidents.

BCPs are developed, implemented and maintained by all functions, faculties and institutes.

Managers should have an understanding of the plans which they are responsible for and where they fit within the response structure.

3.3   Response priorities

During the response to an incident, individuals and teams can quickly become overwhelmed by a complex and dynamic situation. A key principle to overcome these circumstances is to prioritise and execute actions and tasks in order of importance. This ensures an appropriate, methodical and consistent response that creates time and space for managers. UQ has predefined the response priorities which will need to be followed by all managers and teams when responding to all incidents.





Ensure and account for the safety and security of people:

Students, staff, visitors and the public.



Contain, control and prevent further damage to or loss of:

Critical services, facilities and/or utilities and underlying infrastructure (e.g. electricity, water, transport, communications, security systems and/or information and information technology).



Contain, control and prevent further harm to:

  • local community and its amenities

  • environment.



Assess and determine actual or potential breaches of law, regulations, contract, governance and or critical licence and/or accreditation.

Check for available insurance response options and requirements.



Ensure accurate and timely information is provided to key stakeholders and media to ensure their trust and confidence in UQ.


4.0                Roles, Responsibilities and Accountabilities







Faculty Exec Mgr.

  • Manage risks in accordance with Enterprise Risk Management Framework
  • Inform Insurance Services of any new or changes to activities, assets and/or infrastructure
  • Perform Business Impact Analysis
  • Develop and implement Business Continuity Plans (BCP) and/or Local Response Plans (as required)
  • Annually review, test and/or exercise plans
  • Activate Local Response Plans
  • Escalate incidents as required
  • Represent portfolio in the UIMT
  • Inform and consult with Insurance Services to ensure maximum claim outcomes
  • Develop and implement recovery plans
  • Activate Business Continuity Plans
  • Manage incident investigation
  • Ascertain and implement lessons learned
  • Manage potential regulatory breach with relevant authority
  • Review and update plans, teams and risk registers
  • Facilitate insurance assessment and claims

Institute Dep Dir.

Relevant direct report to DVCs/COO

Executive Dean


  • Support implementation of BCPs and Local Response Plans (as required)
  • Support testing and/or exercise of BCP’s and Local Response Plans
  • Escalate incidents as required
  • Represent faculty/institute in the CMT
  • Ascertain and implement lessons learned

Institute Director


Executive Director OMC


  • Develop, implement and maintain Communications Response Plan (CRP)
  • Annually review, test and/or exercise CRP
  • Activate Communications Response Plan
  • Represent OMC in the UIMT and/or CMT
  • Ascertain and implement lessons learned
  • Review and update CRP and team
  • Facilitate insurance assessment and claims

Deputy COO

  • Support effective adoption of Enterprise Risk Management Framework
  • Support implementation of UIMP
  • Support testing and/or exercise of UIMT
  • Activate the UIMT
  • Escalate incidents as required
  • Chair the UIMT
  • Coordinate UIMT recovery actions and plans
  • Delegate responsibility for incident investigation
  • Ascertain and implement lessons learned
  • Facilitate insurance assessment and claims



  • Support effective adoption of Enterprise Risk Management Framework
  • Support testing and/or exercise of CMT
  • Activate the CMT
  • Chair the CMT
  • Ascertain and implement lessons learned


Governance and Risk

  • Develop, implement and maintain Enterprise Risk Management Framework
  • Ensure adequate insurance  program
  • Develop, implement & maintain UIMP/CMP
  • Annually test and/or exercise UIMT and CMT
  • Train use of Incident Management Procedure, CMP and UIMP
  • Support UIMT members
  • Support the D/COO in the UIMT
  • Support the COO in the CMT
  • Support UIMT/CMT recovery planning and actions
  • Coordinate lessons learned process
  • Coordinate insurance assessment and claims
  • Review insurance coverage

5.0                Monitoring, Review and Assurance

5.1   Enterprise Risk Services (ERS)

The ERS team will conduct an annual review of the effectiveness and implementation of this procedure and provide a report of findings and recommendations to the VCRCC.

6.0                Recording and Reporting

The following reports on the Incident Management Procedure will be produced:

Report Title

Report Content

Report Producer

Report Recipient


Procedure review

Progress and effectiveness of implementation of the Incident Management Procedure throughout UQ.

Enterprise Risk Services





Post Incident Review

Post Exercise Review

(includes lessons learned)

Analysis of what happened, why it happened, and, what worked well, what didn’t work well and recommendations on how it can be done better.

Enterprise Risk Services

Crisis Incident:


Crisis and University Incidents:




As required post incident

Training and Exercise Logs

Outline of training/ exercise conducted.

Enterprise Risk Services



As required following the conduct of training and / or exercise

7.0                Appendix

7.1   University Incident Management Team (UIMT)



7.2   Crisis Management Team (CMT)


Director, Governance and Risk


Systemic Issue - Guideline

Printer-friendly version

1.0 Context

The phrase ‘systemic issue’ is generally used to highlight the significance linked to the prevalence of risks, audit findings, control weaknesses or similar deficiencies and irregularities. This Guideline defines ‘systemic issue’ and is designed to facilitate better identification, consistent assessment and reporting on issues at The University of Queensland (UQ) that are genuinely systemic and therefore would require management’s prompt attention and action. 

2.0 Definition

An issue must meet ALL the following conditions to be defined as a systemic issue:

(1) It is an issue (i.e. a problem or an event that has negative consequences) which has occurred or is inevitable; and

(2) It is a materialised risk or an issue that will result in further risk exposure/s; and

(3) It is a confirmed (verified) irregularity, deficiency or vulnerability, not just speculation or hearsay; and

(4) If left unmanaged, it will continue to exist (and is expected to deteriorate); and  

(5) It is demonstrably prevalent across UQ, an organisational area or function, depending on the context (see Categorisation section below).

3.0 Categorisation

(1) Systemic issues will be categorised based on the risk categories as defined in Appendix B of the Enterprise Risk Management Framework (ERMF).

(2) A systemic issue may be further categorised as follows depending on the facts:

(a) UQ Systemic Issue - the issue is prevalent across UQ or is present across a significant number of areas of UQ.

(b) (Org Area) Systemic Issue - the issue is prevalent across the organisational area or is present across a significant number of areas/sections of the organisational area.

(c) (Function) Systemic Issue - the issue is prevalent across the function or is present across a significant number of areas/sections of the function.

(3) Systemic issues will be categorised by the party formally raising the issue in conjunction with the party accountable for managing or remedying the systemic issue.

(a) The accountable party is responsible for the timely resolution of the systemic issue and providing updates in the form of management reports regarding the completion of any required actions, or their progress.

(b) The party that raises the issue is responsible for monitoring and reporting on the adequate remedying of the systemic issue by the accountable party.

4.0 Supplementary Notes

(1) Some issues may be significant but not systemic.

(2) A systemic issue is distinct from the loss or consequence associated with that issue.

(3) A systemic issue may be a single type of irregularity, deficiency, vulnerability or a combination of these with similar causes and consequences.

(4) The significance of a systemic issue is to be measured based on the risk associated with that issue – as per the UQ Risk Matrix (Appendix D of the ERMF). The risk level is determined via the combination of:

(a) Likelihood score, representing the systemic issue’s prevalence; and

(b) Consequence score, representing the systemic issue’s severity including consideration of potential and realistic (reasonably expected) deterioration.

(5) The protocols for escalating and reporting of systemic issues, and the urgency with which systemic issues are to be addressed including the amount of resources committed to remediation, will depend on the associated risk level assessed as per the UQ Risk Matrix and the Risk Action Table (Appendix D of the ERMF).

Director, Governance and Risk


Printer-friendly version

Director, Governance and Risk
Director, Governance and Risk