2022-09-12 General Committee Meeting Agenda

GENERAL COMMITTEE MEETING AGENDA   12 SEPTEMBER 2022




                                         Page 59 of 85

GENERAL COMMITTEE MEETING AGENDA                                                                     12 SEPTEMBER 2022

                COUNCIL POLICY - ENTERPRISE RISK & OPPORTUNITY MANAGEMENT

                 Risk Appetite Statement
                 Council aims to make a significant, sustainable and socially responsible contribution to the community and
                 is very protective of the natural environment. There is considerable acceptance for decisions that promote
                 ecologically sustainable development having regard to Council’s vision and desired environmental
                 outcomes. Council will apply the precautionary approach to environmental decision making where there is
                 uncertainty, to avoid or minimise harm.
                 Risk Tolerance Statement
                 Council will NOT tolerate:                        Council will tolerate:      Council encourages:
                 ¢ Activities and practices that knowingly         ¢ Minor environmental       ¢ Business activities and
                   compromise the environment, are                   impacts from                decisions that are
                   reasonably foreseeable and preventable.           uncontrollable or           undertaken in
                 ¢ Failure to meet environmental commitments         unforeseen events or        alignment with the
                   or legal requirements resulting in EPA fines      to deliver enduring         Noosa Environment
                   or penalties.                                     benefits to our             Strategy and Noosa
                 ¢ Decisions or activities that do not               community well into         Planning Scheme.
                   appropriately consider or are out of              the future.
                   alignment with the Noosa Environment            ¢ Single unforeseen
                   Strategy or Sustainability Principles without     events that can be
                   Council consideration and/or that result in       reversed.
                   long-term or irrevocable environmental          ¢ Activities or decisions
                   damage, climate impacts and threats to            that do not
                   biodiversity, including extinction of flora and   significantly impact
                   fauna.                                            Council’s corporate
                                                                     emissions or the
                                                                     Noosa community’s
                                                                     emissions.

                 Risk Appetite Statement
                 Council has a cautious approach to safeguarding from both internal and external threats, malicious attacks,
                 unauthorised access or a cyber-extortion event. Council’s aim is to protect its ICT systems and services
                 through appropriate internal controls, a cyber-aware workforce, effective governance, regular reviews, and
                 consistent management of our third party providers. If private or confidential data is exposed, Council will
                 meet its privacy and other statutory obligations.
                 Risk Tolerance Statement
                 Council will NOT tolerate:        Council will tolerate:          Council encourages:
                 ¢ Lack of preparation or           ¢ Cyber threats which have     ¢ Timely remediation of identified
                   planning in response to a         a minor impact and do not       cyber security control weaknesses.
                   cyber-attack.                     compromise the integrity,     « Employees to play their part and
                 ¢ Significant threats to assets     confidentiality or              apply technical and behavioural
                   arising from external             availability of Council         security controls to reduce Council’s
                   malicious attacks.                information or assets.          exposure to cyber security risks.
                 ¢ Misuse, inappropriate            ¢ Acyber threat which
                   distribution or loss of           results in disruption to
                   sensitive or confidential         infrastructure or systems
                   Council information due to        for no more than 1 day, or
                   the actions of employees.         loss of information
                                                     requiring less than 1 day
                                                     re-work.

                                                                                                                   Page 5

                                                                                                                Page 59 of 85