Victorian Government Risk Management Framework (VGRMF)

Summary

The VGRMF sets the minimum risk management requirements for departments and public bodies covered by the Financial Management Act 1994. It adopts AS ISO 31000:2018 as the risk management standard and establishes 16 mandatory requirements across risk governance, risk processes, maturity, attestation, and insurance.

Mandated via Standing Direction 3.7.1. The current version (September 2025) contains minor amendments removing references to state significant risks, following the Minister for Finance's April 2025 approval dissolving the State Significant Risk IDC in response to VAGO's June 2024 performance audit.

VMIA (Victorian Managed Insurance Authority) supports implementation through risk maturity benchmarking, advisory services, and government insurance programs.

16 Mandatory Requirements

The mandatory requirements (section 3.1) are organised into two groups, plus an attestation obligation. Each applies to all entities subject to the Standing Directions.

Risk Management Requirements (1–9)

Nine requirements the responsible body must be satisfied are met: (1) framework consistent with ISO 31000:2018; (2) framework reviewed annually; (3) positive risk culture demonstrated; (4) risk appetite defined; (5) clear risk ownership for each risk; (6) shared risks managed through inter-agency collaboration; (7) planning and decision-making embed risk management; (8) adequate resources assigned to risk management; (9) risk profile and risk appetite reviewed at least annually.

Insurance Requirements (10–15)

Six requirements for agencies required to insure with VMIA: (10) determine appropriate insurance products and coverage levels in consultation with VMIA; (11) arrange all insurance with VMIA unless exempted; (12) maintain appropriate deductibles reflecting risk appetite; (13) adequate claims management capability for retained financial risks; (14) claims management practices in place with data available to VMIA on request; (15) work towards minimising exposure to insurable risk.

Attestation (16)

Under SD 5.1.4, departments and agencies must provide an annual attestation of compliance with the FMA, Standing Directions (incorporating the VGRMF), and Instructions, disclosing all material compliance deficiencies. The responsible body is responsible for accuracy and should utilise audit committees to support the attestation.

Roles and Responsibilities

The VGRMF assigns specific roles to four entity types: all agencies (comply with SD 3.7.1, senior management own and lead the framework); agency audit committees (oversight of risk profile, insurance, framework effectiveness, compliance monitoring, risk culture); DTF (maintain and update the VGRMF, monitor compliance through attestation); and VMIA (support implementation through risk maturity benchmarking, advisory services, insurance programs, training).

Other entities with risk management roles include the Victorian Secretaries Board (strategic oversight of shared risks), DPC (coordination through Cabinet process), VPSC (governance guidance for public entity boards), and PSAC (senior leaders forum for shared and agency-specific risks).

Guidance (Non-Mandatory)

Section 3.3–3.4 provides guidance on shared risks, insurance as a risk management tool, risk culture (tone from the top, accountability, communication, escalation), risk appetite, risk evaluation, key risk indicators, risk maturity (agencies should develop strategies to improve maturity), and control effectiveness testing. These are not mandatory requirements but support agencies in meeting the mandatory requirements.

Compliance and Attestation

Entities must: 1. Self-assess against all 16 minimum requirements 2. Gather evidence of compliance for audit committee review 3. Audit committee verifies compliance and recommends attestation (partial or full) 4. Responsible body attests in the annual report 5. Where deficiencies are identified, remediation plans must be established

Standing Direction 5.1.4 requires the responsible body (or a member) to attest annually. For departments, the accountable officer is the responsible body; for other entities, it is the board or person with ultimate decision-making authority.

Relevance to Procurement

• Risk assessment is a fundamental requirement for all procurement activities (Instruction 4.2.1 s1.1(f))
• PV Contract Management Guide references VGRMF as the baseline risk framework
• Risk registers, risk allocation, and risk management plans are core procurement and contract management documents
• Risk appetite and tolerance settings directly influence procurement risk thresholds
• VMIA provides insurance risk advice relevant to procurement and contract insurance requirements