ACNC Risk management

We adopt the ATO’s Enterprise Risk Management Framework and risk tolerance. We are:

willing to accept higher levels of risk where there is a clear opportunity to realise benefits and where risks can be controlled to acceptable levels
less willing to accept risk where it is not clear that benefits will be realised or where risks are unable to be controlled to acceptable levels.

Enterprise risks that affect our ability to achieve our vision and purpose are listed below, along with our strategies to contain these risks within acceptable levels.

Risks and management strategies
Enterprise risk	Risk description	Risk management strategy
Maintaining the accuracy of the Charity Register	There is a risk that the Charity Register contains charities that are not entitled to registration, which may undermine public trust and confidence in the ACNC.	We conduct risk assessments of all registration applications and review a sample of our decisions. We use a risk-based approach to inform our Register integrity work, to ensure charities remain entitled to registration. We revoke the status of charities that persistently fail to meet their reporting obligations via our double defaulter process. The risk-based approach includes data analytics, profiling and using public and government information to identify charities at highest risk of non-compliance.
Managing cyber risks	There is a risk that data held by the ACNC may be deleted, manipulated, stolen or misused, undermining trust in the ACNC and government.	We continue to enhance cybersecurity capabilities on our systems, which includes prioritising security patches and updates, to ensure we better meet whole-of-government requirements. We continue to actively manage the security settings of our website (including the Charity Register and Charity Portal) to ensure it is safe to use.
Strategic workforce planning	There is a risk that as a small agency with limited resources, our staff may not have the right tools or skills required for the future. This may compromise our ability to provide quality services to charities, the public and government.	We constantly monitor our external environment to identify tools that can assist our staff to complete their job more efficiently. We also use our relationships with our consultation forums, Advisory Board, the ATO and Treasury to ensure we are aware of our operating environment and how this may impact on future skills we may require. We use a range of different recruitment strategies to ensure we find the people with the right skills. We continue to implement initiatives such as our Culture Vision and Census Action Plan. We are committed to developing our staff through learning and development opportunities.