Risk Management at ACU involves Capture, Assess, Respond and Monitor risks at the institutional level. ACU recognizes that challenges are part of pursuing success, and our risk management process is designed to guide decision-making by identifying the best options, opportunities, and solutions.

This process engages faculty and staff across the university, as risk management is everyone's responsibility at ACU. Insights gathered are used by our leadership team to keep the university on course while remaining adaptive to changes in the global, domestic, and sector environment.

Risk management at ACU is led by the Assurance Unit within the Legal, Assurance, and Governance Directorate (LAG) and overseen by the Audit and Risk Committee, a sub-committee of the ACU Senate. Other committees also contribute to risk management and receive regular reports on related issues.

Our approach is supported by key frameworks and policies:

• Enterprise Risk Management Framework (ERMF): Provides a comprehensive approach to managing risks, ensuring they are prioritised, mitigated, and aligned with ACU's strategy.
• Risk Management Policy and Procedure: Ensures consistent and effective risk management, fostering a risk-aware culture and aligning risk management with ACU's mission and vision.
• Risk Appetite Statement (RAS): Defines how much risk ACU is willing to take (appetite) and how much it will accept (tolerance) in pursuing its objectives. The Audit and Risk Committee approves this under the authority of the ACU Senate.
• Risk Assessment Template: A tool for evaluating potential risks in university activities, ensuring they are identified and managed effectively and comply with risk management system requirements.

The Assurance Unit implements the University's risk management system, overseeing risk monitoring and reporting as part of our governance processes.

ACU uses the CARM Risk Management System to manage risks via risk registers. CARM, which stands for Capture, Assess, Respond, and Monitor, is an in-house information management system that calculates risk levels, drives actions, and automates risk management processes.