nc_an25_digital

Risk and Opportunity
                                                                                                                             16 October and 18 December 2025, with supporting                remains vigilant in monitoring emerging risks through
                                                                                                                             reports available on Council’s website. Council                 continuous improvement processes.



Management
Council manages risks and opportunities within                       management, mitigation and monitoring of risks and
                                                                                                                             Audit and Risk Committee
a context of competing resources, financial and                      opportunities in alignment with the Policy, Council’s
                                                                                                                             In accordance with subdivision 2 of the LG Regulation,          Four formal Audit and Risk Committee meetings were
community priorities. It recognises that innovation                  strategic objectives and the Australian Standard AS/
                                                                                                                             Council conducts Audit and Risk Committee meetings              held throughout the reporting period. The Audit and
involves risks, however also provides opportunities                  NZS ISO 3100.
                                                                                                                             to promote good corporate governance through the                Risk Committee comprises of two elected members
to create new ways to benefit the community and
                                                                                                                             provision of independent advice and counsel on audit            and two expert independent external members.
achieve its objectives.                                              Council is committed to the ongoing implementation
                                                                                                                             and risk management issues covering a wide range of
                                                                     of the policy through various education and awareness
                                                                                                                             Council operations and projects.                                The current members of Council’s Audit and Risk
Council regularly reviews, monitors, manages, and                    initiatives. On 19 February 2025, in conjunction with
                                                                                                                                                                                             Committee are:
reports its strategic, service delivery (operational)                the Local Government Mutual Scheme (LGMS),
                                                                                                                             Council’s Audit and Risk Committee Charter, adopted              — Tim Cronin (Chair)
and project risks to the Council, the Executive Team                 Council delivered training on the Enterprise Risk and
                                                                                                                             17 March 2022, highlights that a key function of the             — Ian Rushworth
and to the Audit and Risk Committee. Within this                     Opportunity Management Framework to staff, which
                                                                                                                             Committee is to provide reasonable assurance to                  — Cr Nicola Wilson
context, the Executive Team regularly review and                     explored topics such as:
                                                                                                                             Council that its core business goals and objectives are          — Cr Tom Wegener
reset Council’s Strategic Risk Register profile to reflect            — Risk management foundations
                                                                                                                             being achieved in an efficient and economical manner,
Council’s current strategic risk appetite, to support                 — External risk context and horizon scanning
                                                                                                                             within an appropriate framework of internal control




                                                                                                                                                                                                                                                        Noosa Council Annual Report 24/25
good governance, and to assist in decision making                     — R
                                                                         isk and Opportunity Management Framework
                                                                                                                             and risk management.
processes.                                                              in action at our Council
                                                                      — Our risk appetite statements


                                                                                                                             Internal Audit
On 19 September 2024, Council reviewed and                            — How to conduct a risk assessment
re-adopted the Enterprise Risk and Opportunity
Management Policy which ensures Council                              Council will continue to educate staff on risk and
has a systematic approach to the identification,                     opportunity management best practice.
                                                                                                                             Under section 105 of the LG Act, Council has                    with Council’s Internal Audit Terms of Reference and
                                                                                                                             established an internal audit function that provides            Internal Audit Policy.
Significant fraud event                                                                                                      independent, objective assurance and appropriate
                                                                                                                             services designed to add value and improve Council’s            For this reporting period, an internal audit was
In December 2024, Council was subject to an isolated                 of human error that contributed to control failures.    operations. The Internal Audit Policy, adopted 17 March         conducted on Council’s ICT Infrastructure Security.
fraud incident perpetrated by an international criminal              In response, Council has strengthened its risk          2022, provides the framework for the conduct of the             This audit was completed in August 2024 by an
organisation, resulting in an initial financial loss of $2.3         management frame-work and implemented                   internal audit function of Council as endorsed by the           external specialist provider with the final report
million. Through recovery efforts with our banking                   additional measures, including:                         Audit and Risk Committee.                                       delivered and presented to the Audit and Risk
partners and insurer, the net financial impact has been                — D  eployment of third-party payment protection                                                                     Committee on 12 September 2024. The audit
reduced to $1.7 million.                                                   software to validate banking details              After a successful procurement activity, Council                assessed the physical ICT security of 18 council-
                                                                       — Mandatory cyber security training for all staff     engaged a new internal auditor to assist Council                managed buildings. The findings from the audit were
The perpetrators used targeted social engineering                      — Introduction of an Organisational Policy and       with its various audit requirements. Council’s internal         grouped into the following areas: physical security
tactics. Upon detection, Council immediately                               Procedure for Creditor Masterfile Maintenance     audit activity continued to be managed by its Internal          parameters, physical entry, securing office and
convened a crisis response team and engaged an                         — E  nhanced system controls requiring approval      Audit Plan 2020 – 2025 while a new draft Internal               rooms and facilities, physical security monitoring,
independent ICT forensic specialist. The investigation                     for supplier contact changes                      Audit Plan covering FY26 – FY28 was developed by                protecting against physical and environmental
confirmed that there was no breach of Council                          — E  stablishment of an independent financial        Council’s new auditors which has regard to current              threats and cabling security. Overall, various
systems, no compromise of personal or ratepayer                            management assurance programme to ensure          strategic risks and input from the Executive Team.              recommendations for improvement were made
data, and no disruption to Council services.                               accuracy and integrity of financial information   The Audit Plan is regularly reviewed by the Audit and           with a focus on having appropriate policies and
The incident highlighted non-compliance with                                                                                 Risk Committee and adopted annually by Council.                 procedures in place, staff awareness and training,
certain standard processes and identified elements                   This matter was reported at Ordinary Meetings on        Council’s internal audits are conducted in accordance           physical entry, securing facilities and access, security


                                                               102                                                                                                                     103