FIN1 FTU - Risk Identification table

Risk Identification Table This Risk Identification Table is to be completed as part of the formal Risk Management Policy andProcedures (Risk ManagementPolicy and Procedures) of the business. This will involve an ongoing review and updates as an integral part of the annual BusinessPlan process. All Treatment Plans that require specific action (as compared to ongoing maintenance) are to be included in the Implementation Section of the Business Plan. Untreated Risk Analysis The Untreated Risk Analysis (URA) codes are defined in the Table below based on a % of annual business turnover/revenue. Untreated Risk Analysis Turnover Extreme (E) Above 5% of Turnover High (H) Between 2% and 5 % of Turnover Medium (M) Between .5% and 2% of Turnover Low (L) Below .5 % of Turnover. Only risks of that fall within the Extreme and High URA categories must be included in the Risk Identification Table. Lower level risks can be included in the Table however no specific risk treatment is required. Lower level risks are to be managed via the usual day to day management of the business. Probability Factor The Probability Factor (PF) codes are defined in the Table below and are based on our assessment of the likelihood of the event occurring based on our own experience and our understanding of the business as well as information gleaned from industry commentary, industry surveys, industry experience and technical experts etc. Probability Factor Example Extreme (E) Highly likely to occur in the next 1 to 2 years. High (H) Likely to occur every 2 to 4 years on average. Medium (M) Likely to occur every 4 to 20 years on average. Low (L) Likely to occur less than once in every 20 years. a9091e87f14dcab524ef1b141a47b5d4.doc Page 1 of 19 15/05/25 5:24 AM Risk Identification Table Risk Assessment Criteria RiskAssessment Criteria shading as detailed in the Table below has been applied to each risk intheTabletoprovidevisualguidanceonthe assessment of a particular untreated risk. Probability Factor Extreme (E) High (H) Medium (M) Low (L) Risk Analysis Low (L) Medium (M) High (H) Extreme (E) Control Effectiveness TheControlEffectiveness(CE)codesreflecthowwelltheTreatment Plan manages the identified risk as per the Table below: Control Effectiveness Codes 1 2 3 4 Effectiveness / Explanation Very limited or badly designed, even where used correctly it provides little or no protection. Designed to reduce most aspects of the associated risk. Treatment Plan enables management to take timely action to mitigate against risk, but does not prevent the risk from occurring. .e.g. workflow monitoring. Designed to reduce most aspects of the associated risk by typically reducing both the impact and probability of the occurrence. This is the most common control type (e.g. experienced staff / training / clearly defined guidelines etc. Designed to comprehensively reduce or remove the risk entirely, e.g. 100% insurance. a9091e87f14dcab524ef1b141a47b5d4.doc Page 2 of 19 15/05/25 5:24 AM Risk Identification Table The Status – Treatment Plan details the techniques, systems, processes and controls we have used orimplementedtoreducetherisktoaModerate or Low risk outcome. Status - TreatmentPlan Impact Type URA PF CE Comment / Explanation Loss of AFS Financial, Licence due to Operational inadvertent breach. E L 3 The business is unable to conduct business if it does not have a Licence to do so. All existing and new staff complete an AFS Licence obligation overview as part of our Induction Program. Compliance Policy and Procedures Loss of Sole Human, Operational Responsible Manager (RM). H M 4 The business must have at Responsible least Managerone to be able to hold an AFSL. Only applies if the Business has only one Responsible Managers. The business has formal arrangements in place to source temporary replacement Responsible Managers where required. (MSM Compliance Services P/L has indicated that they are able to provide short term “Locum Service”). Such replacements are subject to our Relieving Responsible Manager Agreement. Board aware of ASIC advice responsibility. Key man insurance may be put into place to fund the cost of a Replacement Responsible Manager where considered necessary. Loss computer access. H E 2 H E 2 Business Risks Identified of Operational, Service Loss or Operational, damage of Service computer software and data or an to access inability such / data software. a9091e87f14dcab524ef1b141a47b5d4.doc Page 3 of 19 The business is unable to function without a computer system. Implementation of our Information Technology Policy and Procedures. All hardware/software readily available. Key Cyber Security issues specifically addressed. Coverage by insurance policies where considered necessary. The business is unable to function if data/software is or lost/destroyed inaccessible. Implementation of our Information Technology Policy and Procedures and our Disaster Recovery Policy and Procedures. Key Cyber Security issues specifically addressed. Coverage by insurance policies where considered necessary. 15/05/25 5:24 AM Risk Identification Table Impact Type Operational, Service, of Financial Business Risks Identified Loss supplier support. URA PF CE Comment / Explanation E L 3 Insolvency or withdrawal of support of sole major suppler might cause or business to cease and time involved in replacement. Status - Treatment Plan Ensure profitability of business to supplier. Develop and maintain relationships with wide range of suppliers. Balance business between suppliers to minimise risk. Enter long term contracts with suppliers where relevant/practical. Significant property damage. Operational, Financial H L 4 Claims made Financial third by parties. H H 3 Financial H M 4 Client ownership. a9091e87f14dcab524ef1b141a47b5d4.doc Page 4 of 19 Use of non APRA approved insurers require RM sign off and client signed acceptance. Security and fire procedures included in Staff Policy and Fire damage to premises and Procedures. Compliance with fire protection requirements. equipment leading to loss of Operational smoke operational All data and appliances regularly serviced. detectors in offices/entrance/kitchen. Insurance coverage in capacity. place including Fire and Business Interruption (B.I.), Burglary and Electronic Breakdown. B.I. includes provision for Increased Cost of Working Expenses and rewriting of records. Professional Indemnity and Public Liability policies in force. Financial cost of settlement Policy and Procedures in place for all major business process and payments. activities. Loss of business due to Letter of Engagement for staff includes a clause limiting this staff/authorised All contractors required to sign a Contractor exposure. representatives Confidentiality Agreement. All agreements with Authorised or spotters/referrers Representatives and Spotters/Referrers include reference to taking clients on departure. client ownership. 15/05/25 5:24 AM Risk Identification Table Business Risks Identified Impact Type Financial Major client. Status - Treatment Plan URA PF CE Comment / Explanation H E 2 Loss of major client having Broking Letter of Engagement used to document on relationship with major customers. significant impact business revenues. Option to agree Service Standards for clients. Management and staff awareness of importance of major clients due to business segmentation. Actions of Financial, representative Reputation s Outsourcing Operational, arrangements Service, H H 3 H M 3 H H 4 Financial Adequate staffing resources Operational, Service Financing/ Financial cash flow shortfalls / solvency issues a9091e87f14dcab524ef1b141a47b5d4.doc Page 5 of 19 H M 4 Representatives act outside of External Compliance Policy and Procedures, authority or fail to follow Policy Representatives Policy & Procedures, Induction Checklist, and Procedures. Appraisal and Development forms, Client File Review Sheet Template, Training Policy and Procedures. The failure of services outsourced leading to service Development of and the adherence to our formal or other delivery problems. Outsourcing Policy and Procedures to control such occurrences. Lack of staff to provide services expected by clients. Annual Business Plan specifically addresses staff resourcing. Rotation and multiskilling of staff so that more than one staff member can do every task in the business. Failure to maintain solvency Implementation of Financial Policy and Procedures. and accurate and adequate and financial records budgets. 15/05/25 5:24 AM Risk Identification Table Business Risks Identified Impact Type Financial Inappropriate use of business funds. URA PF CE Comment / Explanation H L 3 Inappropriate commitment finances. Status - Treatment Plan allocation or Dual signatory process where practical for all payments to of company suppliers. Individual financial limits and authorities for all staff maintained in Position Descriptions (where used) and applied. Banking and Bank Reconciliation procedures documented and included in Compliance checklist. Annual external audit. Lack Internal Controls of Operational, Service H M 3 Lack of understanding of who Organisation Chart used and kept up to date. is responsible what and Position Descriptions (where used) and responsibilities in how things are for done. place and kept up to date for all staff. Documentation of key procedures within the business. Usage of exception reports for critical business functions. Risks Various identified by External Audit H H 3 Ethical standards and conflicts of interest including involvement in Bribery. Various H L 4 Inadequate disclosure/con tent in printed materials License, Service H H 4 a9091e87f14dcab524ef1b141a47b5d4.doc Page 6 of 19 As required. Any issues raised by the External Auditor Staff actions and decision by making influenced external commercial factors. Conflict of Interest Policy and Procedures, Letter of Engagement, Compliance Checklist, Induction Checklist, Conflict Of Interest Overview and Staff Policy and Procedures address this issue. Failure to include all required All promotional or repetitively produced business notices/content and other documentation and any changes to be signed off by a printed Responsible Manager(s). information in material. 15/05/25 5:24 AM