Each Programme Key Risk Area has a number of variables which relate to it.
These are the different columns on the Programme Risk Register spreadsheet.
Links to KEQ
An indication of which of NZQA’s Key Evaluation Question the Programme Key Risk Area relates to
Related ELT Risk Register Risk Category
Indicates which category on the ELT Risk Register the Programme Key Risk Area relates to
ELT Risk Register Risk Area
Indicates which ELT Risk Area the Programme Key Risk Area best aligns with
Programme Key Risk Area
The Fourteen key risk area which need to be managed at programme level (see below)
Academic Programme Risk Category
All Programme Key Risk Areas are aligned with one of four Risk Categories: Outcomes, People, Process, Compliance. The Risk Category is used to determine which rubric to use on the Programme Consequence table (on the Prog Consequence and Control tab) and hence the Consequence level:
Risk Owner
The position which is accountable for the management of the risk. Typically the Academic Programme Manager
Inherent Risk Likelihood
The likelihood of the risk eventuating before any controls are put in place to reduce the likelihood of the risk eventuating.
Likelihood is determined through consideration of historic outcomes (i.e., has it happened before, how frequently, etc.) and what is known of events which may impact the likelihood of it happening in the future. Likelihood is rated as one of:
- Almost certain (L5),
- Likely (L4),
- Possible (L3),
- Unlikely (L2),
- Rare (L1)
Inherent Risk Consequence
The consequence or impact of the risk were it to occur before any controls/mitigations are put in place. Inherent Risk Consequence is determined through the use of the Consequence Rubric on the Prog Consequence and Control tab on the Register. Consequence is rated as one of:
- Insignificant (C1),
- Minor (C2),
- Moderate (C3),
- Major (C4),
- Catastrophic (C5)
Inherent Risk Rating
The Inherent Risk Rating is determined through the use of the Risk Rating Matrix and Consequence Table (on the Prog Consequence and Control tab on the Register) by multiplying the values for the Likelihood rating and the Consequence rating.
For example, if a risk is Likely (L4) to occur and the Consequence would be Major (C4) then the Risk rating is High (16).
On the risk register spreadsheet this is calculated automatically
Controls and mitigations (institutional/system related) e.g. policies and procedures
These are the institutional measures in place to manage the Programme Key Risk Area. It includes our QMS, Policies, governance and management controls, etc.
Status and effectiveness of Controls / Treatment Plans
This is a statement of how well or to what extent the Controls and mitigations are effective within the programme. For example, how well are relevant policies known and followed.
There are four Control statuses (see the Prog Consequence and Control tab on the Register).
| Strong | Significant controls exist supported by an active on-going monitoring system. |
| Moderate | Controls in place provide a reasonable certainty of mitigating the risk although do not fully address the management of the risk. |
| Weak | Controls in place are insufficient to prevent or mitigate the risk. |
| Uncontrolled | Outside the control of the organisation in respect of likelihood, although there may be the ability to manage the consequences. |
Residual Risk Likelihood
The likelihood of the risk eventuating after any local programme level actions are implemented.
Residual Risk Consequences
The consequence if the risk were to eventuate after any programme level actions are implemented.
Residual Risk Rating
The Residual Risk Rating is determined through the use of the Risk Rating Matrix and Consequence Table (on the Prog Consequence and Control tab on the Register). On the risk register spreadsheet this is calculated automatically (ignore the “FORMULA STILL BEING REFINED” comment in the column heading)
Treatment Plan (any additional control measures to be put in place at programme level)
This is what has been identified by the programme team as additional actions to take to mitigate the likelihood or consequences of a risk.
Embedded monitoring – measurement (how we know we are managing the risk)
These are the actions which are being taken to keep a close eye on the risk to ensure that it is being effectively managed.
Early warning indicators (how we know if we are going off track)
These are the things to watch out for through the monitoring process.
Staff Responsible for Treatment Plans
This is who the APM has designated as implementing the actions identified to reduce the likelihood or consequence of a risk at programme level.
APM Comments
This is a space for APMs to make whatever notes they wish. It could be things to raise with PAQCs or where barriers to improving things have been identified. This is not reported through to the PowerBI dashboard.
Target Residual Risk Rating
Not currently displayed/required.
There is always an element of risk with any of the risk areas. This is the ideal risk level to which the programme team is working.
Target Completion date
Not currently displayed/required.
The date by which the Target Residual Risk Rating is to be achieved.
Progress to Target Date
Not currently required.
A judgement on how well the programme team is progressing toward achieving the Target Risk Rating by the Target Risk Rating date.
Download as Risk Area Variables.pdf