content-left-bg.png
content-right-bg.png

Governance—risk management and accountability

WebPartZone1_1
PublishingPageContent

​​​​​​Governance refers to the structures and processes to set the strategic direction and manage operations to achieve strategic objectives, manage risk, discharge accountability obligations and deliver outcomes for Queenslanders and their communities.

Customer complaints management

We are committed to responding to customer complaints in an accountable, transparent, timely and fair way that is compatible with human rights. Complaints provide an opportunity for continuous improvement to enhance service delivery.

In January 2024, we released a new Complaints and grievances management policy and updated the Customer complaint management procedure and framework. The new policy sets a departmental policy position for complaint management and promotes easier navigation across the department's different complaints processes. The following resources were also developed to support people involved in the customer complaints process:

  • child-friendly resources to support children and young people to raise complaints and support staff to manage complaints in a child-friendly way
  • an easy-guide to provide simple and plain-English advice about how to make a customer complaint to the department.

Further information about how customer complaints are managed, including a report on customer complaints for 2023–24 and the framework, policy and procedure, are available.

Human rights

We are committed to sustaining a culture that protects and promotes human rights. In 2023–24, we furthered the objectives of the Human Rights Act 2019 (Qld) by:

  • re-establishing a centralised human rights function within the department to
    • support human rights leadership across the department
    • strengthen human rights understanding and practices in our divisions, regions and schools
    • coordinate and improve human rights complaints management and reporting
    • identify opportunities to strengthen human rights considerations in policies, procedures and practices
    • mature our human rights culture and build staff capability
  • implementing the Decision-making framework to support decision-makers to consider human rights as part of all decision-making
  • reviewing and delivering training to deepen staff human rights capability and understanding. This included delivery of complaints-focused sessions and sessions facilitated by the Queensland Human Rights Commission, as well as a review of mandatory staff training. Across 2023–24 96,943 employees, casual staff and contractors completed Mandatory All-Staff Training and Management Foundations training, with additional targeted training delivered to over 630 staff
  • strengthening human rights guidance in customer complaints resources to support the internal review process and management of unreasonable complainant conduct
  • developing improved human rights guidance for departmental policies and procedures to ensure information is clear and consistent to support staff to meet their responsibilities
  • reviewing existing resources to provide guidance to staff on human rights impacts within their decisions.

Human rights complaints

As a large service delivery agency, our decisions shape the future of young Queenslanders and provide opportunities to embed a strong culture that respects, protects and promotes human rights through review and continuous improvement. 

During the reporting period, we received 1,902 human rights complaints with 41 assessed as upheld/substantiated (either in full, or in part) and incompatible with human rights. Complaints assessed as incompatible with human rights remained low at 2% of total human rights complaints received by the department.

All human rights complaints were managed in accordance with our complaints policies and procedures. Actions taken for substantiated complaints in 2023–24 included giving an apology, changing a practice or process, or referring the issue for further investigation or system improvement.

Information systems and recordkeeping

In 2023–24, we strengthened information management systems through key initiatives, including:

  • launching the Physical Records Disposal Pilot project in response to the upcoming lift of the records disposal freeze. The pilot assessed the impact on schools, considering various factors such as costs and staff time, and reviewed the newly developed records disposal guidance material
  • commencing development of a Data Ethics Framework aimed at navigating the ethical aspects of data handling, including its societal impacts, vulnerability to misuse, and economic significance
  • designing a Data Governance Framework as part of our comprehensive information governance efforts. This framework integrates ethical considerations and risk management strategies to outline how data is systematically controlled within our organisation.

More work will continue on these initiatives in 2024–25.

Information security attestation

During the mandatory annual information security reporting process, the Director-General will attest to the appropriateness of the information security risk management within the department to the Queensland Government Chief Information Security Officer, noting that appropriate assurance activities have been undertaken to inform this opinion and the department security risk position.

During 2023–24, the department completed the following initiatives:

  • developed the Cybersecurity Plan 2024–28 to strengthen information system controls, including initiatives to support the effective management of evolving security threats
  • addressed information security gaps identified during the 2021–22 Information Security Annual Return audit
  • completed stage 1 of the Multi-Factor Authentication (MFA) project to enable MFA across all staff-based applications
  • completed the pilot Privileged Access Management project to bolster security surrounding privileged user accounts. The upcoming phase, scheduled for 2024–25, will introduce a just-in-time protocol, granting privileged users timely access to our most critical digital assets, further reducing the risk of malicious cyberattacks.

Further work on these important projects will continue in 2024–25.

Risk management

The department's Enterprise Risk Management Framework (ERMF) is a comprehensive approach to identifying, assessing, and treating risk based on the department's risk appetite within the context of our risk environment and supports staff to better understand risk and be more confident in applying it to their daily work and decision-making.

Our Enterprise risk management policy supports the department's approach to risk management as set out in the ERMF and is compliant with the Australian Standard on Risk management—guidelines (AS/NZS ISO 31000:2018). Our Enterprise risk management procedure sets out a consistent approach for managing risk across the department.

Risk management information is reported quarterly to our ELT, Audit and Risk Management Committee (ARMC) and Strategic Governance Committees to support the delivery of good governance and accountable decision-making as required under the Financial and Performance Management Standard 2019 (Qld).

In 2023–24, we strengthened our risk management position by developing an integrated risk assurance model, including integrated assurance maps for each of our enterprise risks. The work informs our ELT and ARMC about the current control environment for enterprise risks while achieving the department's priorities.

Further information including the ERMF, policy and procedure, are available on the Policy and Procedure Register website.

Audit and Risk Management Committee

The ARMC provides independent advice to the Director-General to help fulfil his responsibilities under the Financial Accountability Act 2009 (Qld).

The ARMC meets 6 times per year and has considered all audit recommendations by the Queensland Audit Office (QAO) in line with its Terms of Reference. A full list of QAO audits relevant to the department is included under the heading 'External oversight'.

Refer to the table ​for ARMC's role, functions, membership, remuneration and achievements.

Audit and Risk Management Committee
FunctionsThe ARMC provides independent audit and risk management advice to the Director-General, as a requirement under section 35 of the Financial and Performance Management Standard 2019 (Qld).
Achievements 2023–24​
  • Reviewed and endorsed the department's financial statements for 2022–23.
  • Noted the Chief Finance Officer Statement of Assurance for 2022–23.
  • Endorsed the Mid-Year Review of the 6+6 Month Audit Plan 2023–24 in November 2023 and endorsed the 6+6 Month Audit Plan 2024-25 in June 2024.
  • Reviewed and endors​ed the Internal Audit Charter, and monitored Internal Audit's key performance indicators and measures during the year.
  • Retained oversight of the implementation status of overdue audit actions from Internal Audit and Queensland Audit Office.
  • Reviewed and maintained oversight of key risks to the department.
  • Reviewed and endorsed the department's Information Security Annual Return and the supporting external assurance review, as well as monitored the department's progress towards implementing the Information Security Management System (ISMS) recommendations and actions.​
  • Attended various meetings with stakeholders during the year including meeting with new departmental executives.

Remuneration​

Position and nameMeetings/sessions attendanceApproved annual, sessional or daily feeActual fees received
Helen Moore, Chair6 of 6$18,000 pa$15,000 (noting increase in fees from 1 January 2024)
John Catford, Member5 of 6$12,000 pa$10,000 (noting increase in fees from 1 January 2024)
Marie Kavanagh, Member5 of 6$12,000 pa$10,000 (noting increase in fees from 1 January 2024)
Stacie Hansel, Member3 of 4 (noting no longer a member from 1 January 2024)N/AN/A
Shaun Conroy, Member2 of 2 (noting joined as member from 1 January 2024)$12,000 pa$6,000 (noting joined as member from 1 January 2024)

Notes:

  • Number of scheduled meetings/sessions: 6
  • Total out of pocket expenses: $0

Internal Audit

Internal Audit contributes to improving service delivery by identifying opportunities to enhance and strengthen our processes, with a particular focus on risk management and governance. Internal Audit's focus includes frontline service delivery areas, information systems, and programs and projects.

Internal Audit's activities are guided by its 6+6 Month Audit Plan, and align with the International Standards for the Professional Practice of Internal Auditing and the Financial Accountability Act 2009 (Qld).

During 2023–24, Internal Audit finalised:

  • 207 school audits including follow-up audits
  • 51 school health checks
  • 12 business, operational and performance audits
  • 10 payroll verifications
  • 3 information system audits.

School and Region Reviews

School and Region Reviews (SRR) review every Queensland state school at least once every 4 years, playing an important part in how we support schools to lift educational achievement, enhance student wellbeing and engagement, and strengthen culture and inclusion.

The review approach is tailored to meet the unique needs of every school and is informed by evidence and input from school staff, students and communities. Reviews are conducted by experienced educators trained in the use of the Australian Council for Educational Research School Improvement Tool, an internationally recognised framework for reviewing practices found in highly effective schools.

In 2023–24, the department continued to revitalise the review model to include differentiated review types, including the introduction of place-based and system reviews to complement existing school reviews. These include school-led reviews validated by SRR, Partnership Initiative school reviews and educational precinct reviews. A small number of schools engage in a differentiated review type in recognition of their unique context – these are conducted by SRR in collaboration with the school community.

During 2023–24, SRR completed:

  • 297 school reviews and 30 school-led review validations in Queensland state schools
  • 10 Partnership Initiative school reviews
  • 2 educational precinct precondition reviews
  • 2 school reviews and one curriculum-only review at offshore schools.

Further information about school reviews, including professional learning programs for school, regional and corporate staff, can be accessed via the School reviews website.

External oversight

The department is subject to several external reviewers established by legislation that provide independent advice, assurance and observations of our performance to our customers, stakeholders, and the community. The following reviewers produced reports relevant to the department.

Queensland Audit Office

The Auditor-General, supported by the QAO, provides independent professional financial and performance audit services to the public sector under the Auditor-General Act 2009 (Qld).

The following QAO reports released in 2023–24 include findings and recommendations applicable to the department:

  • Report 3: 2023–24: 2023 status of Auditor-General's recommendations
  • Report 11: 2023–24: State Entities 2023
  • Report 12: 2023–24: Responding to and recovering from cyber attacks
  • Report 13: 2023–24: Education 2023
The QAO reports include recommendations about information security management, infrastructure practices, and remuneration and payment processes.

Information security management is addressed in QAO reports 3, 11, 12 and 13. The reports include recommendations about:

  • improving cyber security and incident response activities
  • strengthening information system controls
  • managing risks associated with third parties
  • enhancing systems, processes and governance arrangements.

The department recognises the importance of strengthening information security management and is engaging in a range of activities to mitigate risks. Activities include:

  • developing the Cybersecurity Plan 2024–2028 to protect students and staff against cyber threats, grow the department's cybersecurity capabilities, secure information and enable cyber-resilient schools
  • maintaining technology and information asset registers and on-call capability to respond to cyber incidents
  • participating in whole-of-government cyber-readiness and simulation activities
  • working with the Australian Cyber Security Centre and Queensland Government Cyber Security Unit.

A recommendation to improve the capital accrual processes is detailed in QAO report 13. The department has established a project to implement system and process improvements to comply with audit recommendations.

Remuneration and payment processes are considered in QAO reports 11 and 13. The reports include recommendations about:

  • implementing robust policies and procedures that specify when a special payment is appropriate and how it should be made
  • assessing employment agreements and historical pay practices to identify potential wage underpayments.

The department is committed to upholding the highest standards of public expenditure and complying with the recommendations.

Further information on the status of Auditor-General's recommendations is available.

Statutory bodies and portfolio entities

The department supports a number of Queensland Government bodies and entities, including boards, committees, and statutory authorities.

Statutory bodies supported by the department, including universities and grammar schools, report directly to the Minister ​and prepare their own annual reports. These bodies/entities manage and oversee specific requirements for education, including tertiary. 

For other statutory bodies and portfolio entities that we support, their information is published in the department's Government Bodies report.

Open data

A number of reporting requirements for the department are published online on the Queensland Government's Open Data portal in lieu of inclusion in this report, including overseas travel and Queensland Language Services Policy.

Total expenditure on consultancies is reported in the Open Data portal including expenditure that has been capitalised. Expenditure on consultancies disclosed in the financial statements excludes expenditure that has been capitalised.

WebPartZone1_2
WebPartZone2_1
WebPartZone2_2
WebPartZone2_3
WebPartZone3_1
WebPartZone3_2
WebPartZone3_3
WebPartZone3_4
WebPartZone4_1
WebPartZone5_1
WebPartZone5_2
WebPartZone6_1
WebPartZone6_2
WebPartZone7_1
WebPartZone7_2
WebPartZone8_1
WebPartZone8_2
WebPartZone9_1
Last updated 03 October 2024