• Section 1 - Context
• Section 2 - Authority
• Section 3 - Scope
• Section 4 - Procedure
• Compliance Obligations Management
• Risk Assessment
• Control Identification and Assessment
• Monitoring
• Compliance Management Reporting
• Review
• Section 5 - Definitions

Section 1 - Context

(1) This procedure sets out the rules and requirements for maintaining compliance with relevant obligations at RMIT. It outlines RMIT’s approach to managing compliance, defines relevant terms, roles, responsibilities and embedding a positive compliance culture aligned with the best practice standard, ISO 37301:2021 for Compliance Management Systems. 

(2) This procedure is to be read in conjunction with the Compliance Policy and Compliance Breach Management Procedure.

Section 2 - Authority

(3) RMIT is subject to a wide range of compliance obligations, including compliance requirements under applicable laws, regulations, standards, codes of practice, and compliance commitments made by RMIT.

(4) Authority for this document is established by the Compliance Policy.

Section 3 - Scope

(5) Throughout this procedure, RMIT means the RMIT Group. The RMIT Group is defined as RMIT University and its controlled entities (e.g. RMIT Vietnam, RMIT Europe, RMIT Online and RMIT University Pathways – formerly known as RMIT Training).

(6) This procedure applies to all staff, researchers, affiliates, contractors and volunteers of the RMIT Group. All members of the RMIT community are responsible for understanding and fulfilling compliance obligations.

(7) Non-RMIT owned or controlled bodies, such as affiliated colleges and other similar entities, should utilise and apply this document and its principles.

Section 4 - Procedure

(8) The Compliance Procedure is a key feature of RMIT’s overall compliance management system. It affirms RMIT’s commitment to compliance and, along with the Compliance Breach Management Procedure, establishes methods to support staff in managing compliance obligations.

(9) The procedure expands on responsibilities outlined in the Compliance Policy, supports RMIT’s regulatory risk appetite, and describes the system for identifying, assessing, managing, monitoring and reporting on compliance management, including the role of the Central Compliance team in implementing a Group-wide legislative compliance management approach.

(10) RMIT’s compliance management approach is comprised of the following five components:

1. Compliance Obligations Management
2. Risk Assessment
3. Control Identification Assessment
4. Monitoring
5. Compliance Management Reporting.

(11) The components of the compliance management approach are reviewed and evaluated every two years to ensure they remain fit for purpose and facilitate continuous improvement.

Compliance Obligations Management

(12) Compliance with relevant legislation is crucial for RMIT to operate pragmatically and safely. It allows RMIT to uphold its reputation and ensure legal integrity, while safeguarding the rights and welfare of its stakeholders, and ensures responsible management of resources and finances. Relevant legislative topics include: 
•    Education and quality standards
•    International students
•    Copyright and intellectual property
•    Health, safety and wellbeing
•    Anti-discrimination and equal opportunity
•    Privacy and data protection
•    Research ethics and integrity, and 
•    Financial governance regulations. 

Legislative Obligations Register

(13) RMIT has established a centralised Legislative Obligations Register that comprises applicable legislation, along with its corresponding obligations and requirements. The legislation in this Register has been categorised based on its underlying nature and is as follows:

1. Education and Training
2. Operations and Corporate
3. People, Employment and OHS
4. Research
5. Technology, Data and Privacy.

(14) Ownership of compliance obligations must be defined, understood and aligned with the Delegations of Authority Policy to ensure effective oversight and management of compliance activities.

(15) Stakeholder teams essential to meeting legislative requirements are identified by the Central Compliance team during the initial review of the legislation. These stakeholder teams are designated as ‘Legislative Owners’ and ‘Legislative Specialists’ and are contact points for matters related to this legislation. It is important to note that compliance remains a shared responsibility across multiple teams. 

(16) The Central Compliance team engages with relevant teams as new legislation is implemented. If any work involving legislation with a high impact on RMIT is not listed in the Legislative Obligations Register, the responsible parties must notify the Central Compliance team at compliance@rmit.edu.au.

(17) Where a compliance management responsibility for an Act or specific obligations under that Act cannot be determined based on portfolio responsibilities, the Vice-Chancellor, in consultation with the Vice-Chancellor’s Executive Meeting, determines who will be the Legislative Owner for that Act or obligation.

Legislative Change Communication

(18) Compliance obligations may change as legislation changes. It is crucial for Legislative Owners and relevant RMIT stakeholders to be aware of these changes to maintain compliance and minimise risk to RMIT.

(19) The Legislative Change Communication Process is the system used to notify RMIT staff of changes to regulatory obligations. It provides a structured approach to inform relevant staff of changes to regulatory obligations through an Alerts system. This process ensures that relevant staff are aware of and address compliance risks arising from legislative changes.

(20) The Legislative Alerts List contains Bills and regulations that may change compliance obligations and is accessible through the RMIT staff Legislative Communication Change SharePoint site. Staff can check the summary fields in the list to determine if changes are relevant to their responsibilities before accessing the full Alerts list.

(21) Stakeholders responsible for or materially impacted by legislative obligations should subscribe to specific legislative newsletters and alerts from government departments or reputable legal advisory websites.

(22) Staff must consider how legislative changes impact their area of responsibility. This may include adjusting policies, procedures or practices to comply with new obligations. The Legislative Owner is responsible for communicating a compliance action plan to the Central Compliance team, outlining the impact of change, the proposed action plan and the timeframes for implementation.

(23) While the Legislative Change Communication process presents updates to regulatory obligations, it is the responsibility of RMIT staff to maintain awareness of these changes and determine subsequent actions to ensure compliance. Regulatory compliance changes identified locally should be brought to the attention of the Central Compliance team as soon as practicable.

Risk Assessment

Classification of Legislation by Tiers

(24) RMIT takes a risk-informed approach to managing compliance obligations by categorising applicable legislation into tiers based on the potential financial, regulatory, reputational and safety impacts associated with non-compliance. This tiered classification system, guided by the RMIT Risk Management Framework, helps prioritise and focus the assurance efforts provided by the Compliance Policy and its associated procedures. 

(25) Using RMIT’s Risk Management Framework, Legislative Owners, with assistance from Legislative Specialists and key staff, assess the level of risk that non-compliance with a particular compliance obligation poses to RMIT in achieving its strategic objectives. This assessment helps determine where to focus resources and the level of action required for non-compliance issues. 

(26) All non-compliance issues are risk-assessed within the context of the compliance obligation itself. This risk assessment is reviewed whenever there are changes to the compliance obligations, changes to internal policy, or every two years, whichever occurs first. 

Control Identification and Assessment

(27) Compliance control assessments are undertaken to determine if RMIT has processes in place to meet obligations under applicable legislation. These assessments are conducted using Self-Assessment Questionnaires (SAQs) to identify current controls and any gaps that need to be addressed. 

Self-Assessment Questionnaires (SAQs)

(28) Biannual reviews of compliance obligations are conducted to align with the biannual ARMC reporting cycle. These reviews utilise Self-Assessment Questionnaires (SAQs) to evaluate the current state of compliance and identify any areas of improvement.

(29) RMIT stakeholder teams, with assistance from the Central Compliance team, complete the SAQs as part of the compliance obligations review process. These teams will evaluate whether processes are in place to meet legislative obligations, record current controls, identify gaps and any actions needed.

(30) Specific requirements under each SAQ can be viewed at the Legislative Obligations Register.

(31) After the SAQs are completed, the Central Compliance team assess the responses to determine the overall compliance of the stakeholder teams with the requirements, and may provide feedback and suggestions for implementing compliance controls to address gaps or areas of non-compliance.

(32) The SAQs are essential for assessing RMIT’s strengths and areas requiring improvement. They provide valuable insights for specific business areas and the broader RMIT community.

Monitoring

(33) Following the initial compliance obligations review using the SAQs, the Central Compliance team conducts monitoring and check-ins every six months. These check-ins capture any changes in compliance status, controls and actions taken to address gaps. They also record any changes in the compliance environment that may have an impact on RMIT’s compliance obligations. These biannual check-ins provide an opportunity for the stakeholder teams to raise any compliance-related matters with the Central Compliance team.

(34) The monitoring program is designed to be flexible, allowing it to adapt to the changing environments and address specific areas of compliance risk in a timely manner.

(35) Legislative Owners are responsible for monitoring compliance within their business area to assess how effectively compliance risks are being managed. The Central Compliance team can provide advice on best practices for monitoring compliance risks. 

Compliance Management Reporting

(36) To ensure appropriate visibility, oversight and governance of compliance management, the Central Compliance team coordinates biannual reporting to VCEM and ARMC, with input from Legislative Owners and Legislative Specialists. When in-depth discussions on specific legislation are required, Legislative Owners will lead these discussions at relevant governance meetings.

(37) Compliance reports include key information and insights, which may cover:

1. Reported compliance breaches
2. Key legislative compliance gaps
3. Significant actions to address gaps
4. Compliance attestations by Legislative Owners
5. Status updates on the implementation of the Compliance Policy.

Compliance Breach Management

(38) All RMIT staff who identify or suspect a compliance breach must report it to their manager as soon as practicable, in accordance with the Compliance Breach Management Procedure.

(39) Managers must report the identified or suspected breach to the respective Legislative Owner, Legislative Specialist, and the Central Compliance team via the RMIT Compliance Breach Reporting Form.

(40) If compliance breaches related to a specific area of concern have a separate reporting process, that process takes precedence over using the RMIT Compliance Breach Reporting Form. Situations identified as near incidents are to be reported to the Central Compliance team.

(41) Legislative Owners are responsible for assessing the nature, scale and impact of breaches to determine the appropriate course of action.

(42) The Legislative Owner must report compliance obligation breaches to the relevant government department or external regulatory agency within the legislated timeframe, when mandatory. Before any disclosure is made, approval must be obtained from the Chief Financial Officer and Executive Director, Governance, Legal and Strategic Operations and advice sought on the reporting process.

(43) The Central Compliance team coordinates an annual attestation process that includes Legislative Owners reporting any known compliance breaches. 

Training and Awareness

(44) Awareness, communication and training programs are used to educate staff about their compliance responsibilities. These programs focus on compliance risk activities and are outlined in the Compliance Policy and associated procedures.

(45) Managers at all levels are responsible for ensuring that they and their staff are aware of their compliance obligations and have or are in the process of acquiring the necessary competence to meet these obligations. This includes ensuring that their staff complete all mandatory compliance training.

(46) The RMIT Compliance Education program is available on Workday. Mandatory courses are automatically assigned to staff members based on their roles and cover a range of areas, including workplace integrity, health, safety and wellbeing, information governance, privacy and cybersecurity.

(47) All staff and researchers have a responsibility to complete mandatory compliance training courses on employment, every two-years thereafter, or where a new training course is developed and assigned to them.

Continuous Improvement

(48) The ongoing review of the compliance management approach, objectives and assessment criteria is conducted as part of continuous improvement by the Central Compliance team. 

Review

(49) The Compliance Procedure is maintained by the Central Compliance team and is reviewed every five years in accordance with the Policy Governance Framework.

(50) Periodic reviews will align with ISO 37301:2021 Compliance Management Systems.

Section 5 - Definitions