View Document

Compliance Policy

This is the current version of this document. You can provide feedback on this policy document by navigating to the Feedback tab.

Section 1 - Purpose

(1) The purpose of this policy is to define the RMIT framework and objectives for the management of compliance obligations and promote a positive compliance culture as an integral part of ensuring good governance and operational excellence at RMIT.

Top of Page

Section 2 - Overview

(2) RMIT University is a public institution under Victorian law and stands on Aboriginal Country of the Kulin Nation. RMIT recognises and acknowledges the Bundjil Statement that helps all RMIT staff to respectfully work, live and study on Aboriginal Country.

(3) RMIT is subject to a wide range of compliance obligations including compliance requirements under applicable laws, regulations, standards, codes of practice, and compliance commitments made by RMIT.

(4) This policy frames the RMIT Group approach to compliance to ensure a compliance culture that enables RMIT to achieve its strategic, operational and commercial objectives.

Top of Page

Section 3 - Scope

(5) The policy applies to all staff, researchers, contractors and volunteers of the RMIT Group.

Top of Page

Section 4 - Policy

(6) RMIT is committed to ensuring compliance with all laws and regulations, and alignment to standards and codes of practice that apply to the RMIT Group.

(7) RMIT will embed a positive compliance culture across all operating areas with control systems that create effective and sustainable compliance outcomes.

(8) Compliance management will be underpinned by continuous improvement and awareness of compliance obligations across all operating areas and locations.

Compliance Framework

(9) RMIT’s compliance framework encompasses the following elements:

  1. All staff are required to act ethically and with integrity. Behaviours that create and support compliance are encouraged and behaviours that compromise compliance are unacceptable.
  2. Ownership of compliance obligations is clearly articulated, understood and aligned to Delegations of Authority Policy and the Code of Conduct to enable effective oversight and management.
  3. University operations are underpinned by a compliance management program that is integrated with the risk management framework to enable RMIT to identify, assess, manage, monitor and report on compliance obligations.
  4. Breaches in compliance are proactively identified and prompt corrective action is taken. Members of the RMIT Group who breach compliance obligations may be subject to disciplinary action.
  5. Regular assurance reporting on significant breaches, trends and systemic issues, and the level of compliance, is conducted across the RMIT Group.

(10) This policy and the Compliance Management Program form key components of RMIT’s compliance framework.

(11) RMIT’s compliance framework is informed by governance structures and instruments including, but not limited to:

  1. University statutes and regulations
  2. Code of Conduct
  3. Audit and general governance functions
  4. Corporate Social Responsibility Framework
  5. Delegations of Authority Policy
  6. Risk Management Policy
  7. Anti-Corruption and Fraud Prevention Policy

Responsibilities

(12) The Audit and Risk Management Committee assists RMIT University Council (Council) in discharging its responsibilities to the RMIT Group by monitoring compliance with laws, regulations and the Code of Conduct.

(13) Members of the Vice-Chancellor's Executive:

  1. are accountable for and implement the RMIT Group Compliance Management Program within their areas of responsibility
  2. assign appropriate resources for management of compliance obligations including nominated compliance management contacts with subject matter expertise who have significant operational control and delegated authority
  3. provide information, advice and assurance about compliance management for their areas of accountability.

(14) Risk, Audit and Compliance:

  1. develops and maintains the Compliance Management Program. This includes the development of the Compliance Policy and associated procedures and resources
  2. advises and supports responsible owners and compliance obligation contacts to effectively implement controls for the management of compliance obligations
  3. monitors and facilitates regular reporting to governance bodies and management committees, and external agencies where required.

(15) Compliance management contacts:

  1. promote a culture of compliance within their business area or function and manages implementation activities in accordance with the Compliance Management Program
  2. actively monitor compliance risks and responds to compliance breaches in line with the Compliance Breach Management Procedure
  3. collaborate with the Risk, Audit and Compliance team to maintain an effective and current compliance management program and cooperates with requests for information.

(16) All staff and researchers remain individually accountable for their actions as members of the RMIT Group community, bound by the Code of Conduct and relevant enterprise agreements. They have a responsibility to:

  1. ensure that they are aware of the compliance obligations applicable to their role and that their actions are consistent with RMIT policies
  2. undertake mandatory compliance training
  3. report and escalate compliance concerns and suspected breaches to their manager or supervisor.

(17) Contractors and volunteers have a responsibility to:

  1. ensure that they are aware of the compliance obligations applicable to their role at RMIT and that their actions are consistent with RMIT policies
  2. undertake compliance training as requested and conduct themselves in accordance with the specific terms of engagement.
  3. The Executive Director, Governance, Legal and Strategic Operations is responsible for the Compliance Management Program and the Compliance Breach Management Procedure.

Review

(18) This policy is maintained by the Governance team.

(19) Periodic review will have regard to ISO 19600 Intentional Standard for Compliance Management.

Top of Page

Section 5 - Procedures and Resources

(20) Refer to the:

  1. Compliance Management Program
  2. Compliance Breach Management Procedure
Top of Page

Section 6 - Definitions

Breach A contravention of a compliance obligation caused by an act or omission. Significant or material breaches may be reportable to an external agency or regulator. See also: Material breach
Compliance obligation Compliance obligations at RMIT are grouped into three tiers. Tier 1: obligations that are fundamental to RMIT’s core business, being the provision of education and research, which are identified as high priority and core to licenses to operate as a Table A University, RTO, CRICOS provider and non-senior secondary school provider. It includes high risk obligations relating to the good governance of RMIT. Tier 2: obligations that relate to RMIT’s operational efficiency and commercial success. They are relevant to specific operating locations, business units or functional areas. Tier 3: other obligations established under the RMIT Policy Governance Framework including delegations of authority, standards of conduct and obligations to give effect to RMIT’s self-accrediting authority.
Compliance Management Program The coordinated institutional approach to identification, monitoring, review and reporting of compliance obligations, risks, and performance across the RMIT Group.
Compliance management contact Senior leaders, with subject matter expertise, usually reporting directly to a member of the Vice-Chancellor's Executive. They are responsible for implementing the compliance management program for their specific areas of operational responsibility.
Compliance obligation register There are two types of registers that support the Compliance Management Program. Key Compliance Obligation Register: a record used to identify tier 1 compliance obligations and to assess the risk, impact and likelihood of non-compliance with these obligations. Compliance activities and controls for these obligations are documented within the register. Functional/business level Compliance Obligation Register: a record used to identify tier 2 compliance obligations and to assess the risk, impact and likelihood of non-compliance with these obligations.
Compliance obligation breach register A record of breaches of the University’s compliance obligations managed by Risk, Audit and Compliance.
Governance attestation process A verification process undertaken by members of the Vice-Chancellor's Executive and key senior staff whereby they attest to the effectiveness of internal controls and compliance/non-compliance with the obligations that are relevant to their areas of operation throughout the University.
Governance bodies Council, committees of Council, and the Academic Board.
Material breach A severe and significant breach, in terms of scale and/or regulatory requirements, or with implications for safety and security, and/or legal requirements. See also: Breach
Responsible owner A member of the Vice-Chancellor's Executive or a specified regulatory delegate under the Delegations of Authority Policy.