Australia Public Governance, Performance and Accountability Act 2013 (PGPA Act) 16: Duty to establish and maintain an appropriate system of risk oversight and management and an appropriate system of internal control, including measures directed at ensuring officials comply with the finance law

What does 16 require?

Two systems are required of every accountable authority and must be kept working: one for overseeing and managing risk, one for internal control, each appropriate to the entity. Part of the internal control system is a set of measures aimed at getting the entity's officials to comply with the finance law; the Act's own example is an employment condition requiring compliance, backed by sanctions up to termination (unnecessary for staff whose Public Service Act or Parliamentary Service Act already penalises breaches of Australian law). The obligation also reaches the management of consultants and independent contractors working for the entity even when they are not officials. The Commonwealth Risk Management Policy and the PGPA Rule's fraud and corruption control standard supply the detail.