3.2 Risk-based approach to investor assurance

Risk-based assurance means that different levels of assurance and reporting are applied proportionate to a potential risk profile. The qualitative risk profile criteria are outlined in Table 3.

Table 3 Qualitative risk profile criteria

Criteria	Definition
Level of Government Priority	■ The level and timing of project or program priority, where: - The level of priority for a project is specifically mandated (or where a Ministerial authority has been given to mandate that a project is a priority) in documents such as the NSW Budget, Premier's Priorities, State Infrastructure Strategy, Election Commitment, or is a response to a Legislative Change. Alternatively, the project is an enabler of a mandated priority project. - The timing of the priority project can be either within or outside the Forward Estimates and relates to planning/development commencement, construction commencement or construction completion. These two conditions should exist.
Interface Complexity	■ The extent to which the project or program's success will depend on the management of complex dependencies with other: - Institutions - certain bodies are contributing to the funding of the project or will be given operational responsibility; and/or - Projects or services - there are fundamental interdependencies with other projects or services that will directly influence the scope and cost of the project.
Procurement Complexity	■ The extent to which a project or program requires, sophisticated, customised or complex procurement methods (non-traditional), thereby increasing the need for a careful assessment and management of risk. ■ Procurement complexity may also be influenced by the extent of agency experience and capability. For example, some procurement methods (e.g. ECI) may be used more commonly by some agencies and represent a lower procurement risk.
Agency Capability	■ The extent to which the sponsor agency has demonstrated capability (skills and experience), or can access through recruitment or procurement the required capability in the development and / or delivery of the type of project or program proposed and/or its delivery strategy.
Essential Service	■ The extent to which a project is essential to meet a deficiency that would otherwise have serious adverse impacts on the functioning of an existing community or the growth of a new community.

A weighted score for the above criteria is determined based on the weightings and scores outlined in Attachment E. This weighted score is compared against ETC to determine a preliminary Project Tier based on the matrix shown in Table 4.

Table 4 Project-tier weighted risk score matrix

Weighted Risk Score	ETC Range
Weighted Risk Score	$10M - 50M	$50-$100M	$100M - $500M	$500M - $1B	>$1B
0.0 - 2.0	Tier 4	Tier 3	Tier 3	Tier 3	Tier 2
2.1 - 2.2	Tier 4	Tier 3	Tier 3	Tier 2	Tier 2
2.3 - 2.4	Tier 4	Tier 3	Tier 2	Tier 2	Tier 2
2.5 - 2.9	Tier 3	Tier 2	Tier 2	Tier 2	Tier 1 - HPHR
3.0 - 3.9	Tier 2	Tier 2	Tier 2	Tier 2	Tier 1 - HPHR
4.0 - 5.0	Tier 1 - HPHR	Tier 1 - HPHR	Tier 1 - HPHR	Tier 1 - HPHR	Tier 1 - HPHR

The initial risk profiling self-assessment process is undertaken by delivery agencies. The process involves giving each project a risk-based score against these criteria, and undertaking further qualitative analysis, enabling projects to be grouped into risk-based tiers to which different levels of project assurance can be applied. The risk-based tiers are as follows:

• Tier 1 - High Profile/High Risk;

• Tier 2;

• Tier 3; and

• Tier 4.

This tiered approach is designed to ensure that the right balance is struck between a robust approach correctly focused on highest risks, and achieving value for money. More intensity / scrutiny is placed on projects that need it most e.g. Tier 1 - High Profile/High Risk projects. This is represented in Figure 4.

Figure 4 Tiered approach

Throughout their lifecycle, projects may move between tiers depending on changing risk profiles.

The project tiering is endorsed as outlined in Section 2.5. For a project to be endorsed by IIAC as a Tier 1 - High Profile/High Risk project, it must be nominated as such by the:

• Cabinet;

• Premier;

• Treasurer;

• Minister for Infrastructure;

• Responsible Minister;

• Relevant delivery agency Secretary or Chief Executive Officer; or

• Chief Executive Officer of Infrastructure NSW.

For a project to be removed off the Tier 1 - High Profile/High Risk list, before it is operational, the relevant delivery agency Secretary or Chief Executive Officer must request the removal in writing to the Chief Executive Officer of Infrastructure NSW. The Infrastructure NSW Assurance Team will consider the request and make a recommendation in relation to the request to be endorsed by IIAC. The request may also be referred to the Risk Review Advisory Group26 for advice. Any recommended change in a Tier 1 - High Profile/High Risk project rating is reviewed by Cabinet.

_______________________________________________________________________________________________________

26 Refer to 2.9 Responsibilities