SENIOR LEADERSHIP & BOARD
RISK PROFILE
Updated 28/07/2023
Summary of action – current state
ID
Risk
Summary of current action
Rating
Trend
Last modified
1
Loss of trust in the electoral system
Focus and key trigger point is on GE, and processes being robust and well managed. Cross public sector official partnerships are active in
28/07/23
sharing information on activities, and working collectively on preparations including tabletop exercises and scenarios.
Staff have increased and advice and personnel available to support preventing, responding and recovering from challenges is now in
place. Our communications strategy to address dessimination of incorrect information is in place.
2
Failing to build and maintain trusting
In addition to significant volume of activities in operations, progressing both Kaupapa Māori voting places, and relationships and strategic
28/07/23
relationships with Māori
partnerships on the ground, we continue to build and relationships with Māori at national/senior levels. We also continue to develop Ngā
Maihi and support capability uplift in the Commission.
3
Being unable to respond sufficiently to a During this period the board approved changes to the incident management approach of the Commisison – these changes are being
28/07/23
major disruptive event, including a
engaged on with the business. We are finalising design of our escalation reporting during GE, the GE taskforce, which will ensure clear
pandemic
understanding across the commission on communication channels. A review of Business Continuity Plans is underway. Tabletop
simulations with our security and emergency officials has looked at our ability during the election to respond to certain significant events.
4
Inability to deliver successfully or meet A number of pressures, particularly inflationary and staff costs remain on our radar as they may impact on our baseline. Budget for 23/24
28/07/23
expectations due to insufficient funding approved since last risk profile. The budget for 23/24 is for a net deficit of $11.3m which leaves reserves of $2.2m. New process through
ELT for any changes requiring increases in fund against allocated budget.
5
Commission’s reputation for neutrality is We continue to provide support to MOJ with advice on the operational implications of policy proposals and seek input from the Board on
28/07/23
jeopardised by ‘politicisation’ and
what if any substantive formal comments the Commission makes on proposals. IRP delivered interim report in June 2023. There has also,
pressure from key stakeholders
in line with expectations, been increased activity in this space in the news as GE draws closer. Consistent messaging and communications
embedded in enquiries and voting place training for the GE period.
6
Critical supplier leaves the market or is Steps increasing procurement capability has been progressing. This includes supplier management plans for critical suppliers being
28/07/23
operationally compromised
developed or under development. This risk is stable on prior period, but still significant as due to the tumultuous economic climate,
labour market pressures and ongoing supply chain issues.
7
Failing to deliver on strategic objectives A number of pressures at a key delivery point: balancing preparing for elections, building capability, increased cost pressures and being
28/07/23
asked to trade off future to deliver the immediate. The last quarter saw the recruitment of key roles which will help the Commission to
keep an eye on longer term objectives whilst under delivery pressure. Approval for the plan for developing the 10 year strategy roadmap
was received and work is slowly starting with environmental scanning pieces. Recruitment for a principal advisor strategy underway.
8
Failing to prevent or respond adequately We are working closely with NCSC in the run up to the election. Work in the quarter includes: developing a cyber security dashboard and
28/07/23
to a cyber security incident
finalising cyber security team. Deep dive on risk planned
9
Critical system failure at a critical time
We are developing an item of work to create a roadmap of future systems work that may be required to avert this risk in the long
28/07/23
term. We are mitigating this through comprehensive Certification and accreditation checks on our key systems. Election readiness testing
across critical systems has progressed in line with programme planning.
2
10
Failing to deliver on a critical legislative Watching brief: alert for regulatory changes which may impact our ability to deliver. Have been providing support to IRP.
28/07/23
and/or regulatory change
11
Failing to meet obligations to implement New HSW lead now in place. Presently operationally focused on supporting GE HSW processes.
28/07/23
robust health, safety and wellbeing
practices
Summary of action – current state
ID
Risk
Summary of current action
Rating
Trend
Last modified
12
Over-reliance on core staff results in
Heavy recruitment during this period, both against our TOM and to fill GE roles.
27/07/23
critical points of failure
13
Failing to understand and/or connect
Extensive operational relationships in run up to GE supporting our delivery and system connections.
27/07/23
with the wider environment results in
unforeseen consequences and/or limits
our resilience
3
IN CONFIDENCE
Risks
“Taking into account the mitigations and contingency we
Current rating
have in place, what is our level of risk right now?”
ID
Risk
1
Loss of trust in the electoral system
2
Failing to build and maintain trusting relationships with Māori
Very Likely
3
Being unable to respond sufficiently to a major disruptive event, including a pandemic
6 7
4
Inability to deliver successfully or meet expectations due to insufficient funding
3
Likely
5
Commission’s reputation for neutrality is jeopardised by ‘politicisation’ and pressure from key stakeholders
12 4
D
O
6
Critical supplier fails to deliver
8
O
2
9
H Feasible
7
Failing to deliver on strategic objectives
11
13
ELI
1
8
Failing to prevent or respond adequately to a cyber security incident
K
5
LI
9
Critical system failure at a critical time
10
Slight
10
Failing to successfully implement critical legislative and/or regulatory change
11
Failing to meet obligations to implement robust health, safety and wellbeing practices
Very
12
Over-reliance on core staff results in critical points of failure
unlikely
13
Failing to understand and/or connect with the wider environment results in unforeseen consequences and/or
limits our resilience
CONSEQUENCE
4
IN CONFIDENCE
Risks
“Where are we aiming to get to in order to manage this
Target rating
risk effectively?“
ID
Risk
1
Loss of trust in the electoral system
2
Failing to build and maintain trusting relationships with Māori
Very Likely
3
Being unable to respond sufficiently to a major disruptive event, including a pandemic
12
6
4
Inability to deliver successfully or meet expectations due to insufficient funding
Likely
3
3
5
Commission’s reputation for neutrality is jeopardised by ‘politicisation’ and pressure from key
4
D
stakeholders
O
4
8
O
8
1
6
Critical supplier fails to deliver
H
5
Feasible
11
5
7
10
7
Failing to deliver on strategic objectives
ELI
K
2 9 13
LI
8
Failing to prevent or respond adequately to a cyber security incident
6
1
11
9
Critical system failure at a critical time
Slight
2
9
10
Failing to successfully implement critical legislative and/or regulatory change
12
13
7
11
Failing to meet obligations to implement robust health, safety and wellbeing practices
10
Very
unlikely
12
Over-reliance on core staff results in critical points of failure
13
Failing to understand and/or connect with the wider environment results in unforeseen consequences
and/or limits our resilience
CONSEQUENCE
5
IN CONFIDENCE
1. Loss of trust in the electoral system
Consequences
Loss of confidence, low voter turnout, voter disengagement, people do not trust the voting process, aggravation of voters and issues motivated
groups, unbalanced promotion of issues and opinions and ideologies, scrutiny, reputational damage, strain on capability, capacity and
resources. Threats to electoral officials.
Drivers/Threats
•
Increasingly complex global and domestic threat environment
•
Lack of controlled message or reach
•
Issues motivated groups/individuals/ foreign players
•
Failure to engage with all demographics
•
Lack of social media awareness/forums/media etc
•
Wider belief in conspiracy theories
•
Lack of engagement with media
•
How COVID-19 is managed and perceived to be managed within the
Very likely
•
Lack of connectedness to wider public sector
electoral process
•
Continued downward participation in local body elections
•
Current court cases and debate creates a perception of reduced
Likely
G
•
Generalised anti-government sentiment may become focused on
transparency undermining public confidence
election events
•
Expectations of the Commission about what our role is in helping to
OOD
Feasible
C
increase compliance/transparency of party activity and ‘resolving’
H
•
Political party agenda
LIE
•
Corruption of politician(s)
mis/disinformation about political debate
K
Slight
T
LI
•
Targeted campaign to cause mistrust in system
Very
Current Mitigations
•
A framework to guide implementation of measures across the
•
Consistent and regular communication with parties and candidates
unlikely
organisation
•
Proactive communication and liaison with social media platforms
•
‘Always on' communications, with clear and accurate messaging • Engagement and involvement in cross-sector programmes aimed at
and information for voters
common threats (e.g. misinformation)
•
Assumption that we will be standing up an external risk and
•
Proactive work to engage with communities
IMPACT
security (whole of government) support network again for GE23
•
Transparency around processes and systems
•
Communications and information targeted at building trust in the • Supporting and encouraging community ownership (e.g. appoint
system
people from within the community)
Status Tracking
•
Dedicated staff oversee EC social media / manage media
•
Work with international EMBs
•
Commission arrive at a clear view of its role and communicate that • Learnings from by-election (s)
to parties and the public
•
Early engagement and planning with NZ Police
First identified
•
Regional security resources and police liaison in place supporting • Communications strategy to address dissemination of incorrect
01 Feb 2021
wider security and integrity outcomes for GE23.
information
Last updated
Further mitigations
•
Programme of work to identify key risks in more detail and implement changes prior to GE2023- progressing
•
Further education programmes/further engagement- progressing
24/7/23
•
Market research and subsequent implementation of change (including doing more re trust and confidence in non-election years)
•
Additional resourcing to support implementation of the trust framework- progressing
Trend stable
Responsible Manager
•
Mark Lawson
Contingency
•
Communication and disruption protocols
•
Relationships and connections with National Security System
Previous state
Current state
•
A second security advisor resource secured. Internal and external security groups established. Key
•
Regional security resources secured and July start of policy liaison within EC6
decisions about allocation of resources to support integrity and security of the voting place made.
•
Good progress on risk driven analysis and planning progressing with system
Good progression toward future mitigations
partners.
IN CONFIDENCE
2. Failing to build and maintain trusting relationships with Māori
Consequences
Relationships with Māori: access to services issues, public criticism, criticism from Māori, Treaty cases brought against the Commission re
access issues.
Drivers/Threats
•
Te Tiriti o Waitangi obligations are not met
•
Myths within some parts of Māoridom are enduring
•
Commission fails to establish relationships with iwi/hapu
•
Belief that regulatory compliance administered inequitably/unfairly
•
Damage to existing relationships and loss of trust, impact on
•
Decline in levels of turnout of Māori
future ability to build relationships
•
Inability to attract culturally competent staff
Very likely
G
•
Needs of Māori not understood or reflected in Commission’s
•
Changes to regional structure fail to focus sufficiently on outcomes
approach or services
for, or partnerships with Māori
Likely
•
Debate surrounding Māori Wards during LBEs contributes to
•
Media reporting on Māori Electoral Option
mistrust or suspicion regarding elections
•
If Councils fail to inform people in the way they’d like (re Māori
OOD
Feasible
C
•
Profile likely to increase as issues arise in Select Committee
wards) then there may be a stronger voice for EC to do this work
H
LIE
Current Mitigations
•
Identified as a strategic priority and the need to build more
•
Participation strategy
K
Slight
T
LI
capability is reflected in the operating model refresh
•
Co-build and design of voting and engagement services
Very
•
‘Strategic Comms plan
•
Continuing the external governance arrangements involving key
unlikely
•
Strategy based on long-term, consistent relationships
representatives (and specialists) from support agencies
•
Community engagement activity
•
Providing information about services to parties and candidates
•
Work to develop strategic relationships
•
Providing information and engaging on MEO
•
Senior Manager Māori being closely involved in the development • Relationships with Māori media
IMPACT
of day-to-day operational policy and planning.
•
Review and respond to internal support for Māori staff including
•
Work to consider the impact of Māori data sovereignty on the
addressing capacity and pay gaps
Commission
•
Directing people to information about Māori wards and addressing
Status Tracking
concerns (note but is also underlining the main issues re MEO)
Further mitigations
•
Securing funding to implement strategic comms plan
•
Further work to build relationships with Māori at national/senior
First identified
•
Increase capability to embed best practice community
levels- progressing
01 Feb 2021
engagement and co-design of services
•
Build on relationships with Māori media
•
Electoral Panel Review – has a focus on services to Māori and is • Representation in governance/advisory
an opportunity to strengthen relationships
•
Engagement with Iwi during design of any future changes to MEO
Last updated
27/03/23
Responsible Manager
•
Hone Matthews
Contingency
Trend stable
Previous state
Current state
Regional dialects being used where possible in MEO and GE campaigns
In addition to significant volume of activities in operations, progressing both
Relationship developed with Iwi Chair’s forum
Kaupapa Māori voting places, and relationships and strategic partnerships on the
Positive reporting on MEO campaign- high interest from Māori media
ground, we continue to build and relationships with Māori at national/senior
Election approach to working with Maori is well advanced
levels. In the last 3 months we have also continue to develop Ngā Maihi, and 7
support capability uplift in the Commission.
IN CONFIDENCE
3. Being unable to respond sufficiently to major disruptive events:
including pandemics, earthquakes, cyber attacks, floods, terrorist attacks, infrastructure failures etc
Consequences
Unable to meet statutory objectives and stakeholder expectations (NZ Public, Government, political parties, international and employees). For example, the
electoral rol becomes aged, unable to pay staff, staff welfare is compromised, public enquiries are unanswered, electoral events are cancelled or postponed.
Very likely
Drivers/Threats
•
Not having the necessary legislative and regulatory power to enable a •
Long lead times to prepare for an event
response
•
Presently the IRT team is only stood up as required, infrequent rehearsals and no
T
Likely
C
G
•
Lack of focus/resourcing on business continuity
ongoing owner
•
Over reliance on WFH (no permanently nominated BCP site)
•
BCP plans are event focused
•
We don’t have COVID contingency funding
•
Under resourced permanent presence in the non-IT Security area.
OOD
Feasible
H
•
MoJ indicated they are not wil ing to co-ordinate a contingency
•
Implications of COVID on our ability to resource (staff) the election
LIE
workforce to help mitigate risk for GE23
•
COVID – creating barriers because our approach is not aligned with public
K
Slight
LI
•
Uncertainty about COVID – difficult to plan and prepare when the
perception
environment is changing rapidly (and appears to be improving)
•
More difficult to obtain secondees to support GE23
Very
unlikely
Current Mitigations
•
The Incident Response Team, which is working effectively.
•
Existing relationships with wider government sector
•
A staff vaccination policy has been developed and staff have been
•
Simulations/exercises in business continuity for the GE
IMPACT
consulted
•
Remote working established as a norm and being enhanced
•
Work has commenced on identifying preparations and funding for an •
2 strategic priorities support this end (Capability/Preparing for a GE)
election where COVID remains an issue
•
Testing for the updated BCP scheduled for Sept 22
•
A specific business continuity plan is being developed covering the
•
Make a case for additional COVID funding
Status Tracking
next 6 months as part of the Omicron mitigation response
•
Contact with Whanau Ora re their response, making use of their network
•
SIMS training for Incident Response Team
•
Testing our planning assumptions
First identified
Further Mitigations
•
Legislative changes to support recovery
•
Contingency resources/succession planning, including seeking the support of
•
Regular testing and simulation of BCP scenarios
other agencies to help us (e.g. MoJ)
01 Feb 2021
•
Build BCP considerations into projects
•
Expand the frequency and types of scenarios
•
Secure further resource to support BCP and generate more focus
•
Physical BCP sites nominated and set up
Last updated
•
Enhanced pre-prepared comms
27/03/23
Responsible Manager
•
Lucy Hickman
Trend stable
Contingency
•
Seek assistance from wider government agencies
•
Enhanced pre-prepared comms
•
Work with vendors and partners – facilities and systems
Current state
Previous state
Board approved changes to the incident management approach - changes are being engaged on
Resource secured for BCP focus. New manager for IRT identified. With key roles coming on Board,
with the business. We are finalising design of GE escalation and governance - GE taskforce,
we need to team up more closely to manage a cross cutting risk. Time to broaden gaze beyond
which will ensure clear understanding communication channels. Review of Business Continuity
Covid 19
Plans is underway. Tabletop simulations with our security and emergency officials h 8
as looked at
our ability during the election to respond to certain significant events.
IN CONFIDENCE
4. Inability to deliver successfully or meet expectations due to
insufficient funding
Consequences
Inability to deliver a trusted election to an expected high standard leading to reduced confidence in the system. Can’t meet expectations.
Impact on resourcing required to support funding bids. Our planning assumptions need to be over-ridden by action. Complaints during
critical periods increase which ties up resources. If turnout is lower in 2023 then there will be questions asked about the Commission’s
performance (which may be linked to the issue of funding and how money was spent)
Very likely
G
Drivers/Threats
•
Commission’s business is poorly understood or perceptions we • State of the economy
Likely
C
are ‘cost plus’
•
Competing ministerial priorities and cost pressures
•
Poor quality financial planning and management information
•
Late policy reforms which are not (fully) funded
OOD
Feasible
T
•
Focus on Stats NZ Budget increases places spotlight on
•
Unresolved cost pressures (e.g. systems, policy changes…)
H
LI
Commission’s funding
E
K
Slight
LI
Current Mitigations
•
Working closely with MoJ and Treasury around advice to
•
Early and ongoing engagement with the Minister of Justice
Very
Ministers and responding to any queries
•
Submission of robust funding bid in Budget 2022.
unlikely
•
Managing through a period of uncertainty including close
•
Ensuring that when we re-set internal budgets to align with
scrutiny of existing budgets and expenditure and regular (re)-
available funding that we evaluate risk and our ability to meet
evaluation of assumptions
expectations.
•
Funding project with Ministry of Justice co-investment and
•
Developing better processes to help manage the risk of failing to
IMPACT
active involvement on the project team- Remove?
utilise our funding on critical priorities in a timely way.
•
Re-evaluate how we deliver services to some targeted
•
Communication with key stakeholders where we believe there is risk
stakeholders groups given a leaner budget than the preferred or
that we may not (fully) meet their expectations- progressing
Status Tracking
scaled options.
Further Mitigations
•
Seek an improvement to the Commission’s longer-term funding • Contingency around COVID funding- NA- remove
model off the back of the Budget 2022 bid
•
Funding for security- decision made within operating- remove
First identified
•
Having longer-term funding pressures mapped out (e.g.
01 Feb 2021
systems)
Last updated
Responsible Manager
•
Karl Le Quesne
27/03/23
Contingency
Trend stable
Previous state
Current state
Ministers advised of service levels and funding pressures. Continuing to manage
A number of pressures, particularly inflationary and staff costs remain on our
tradeoffs within baseline.
radar as they may impact on our baseline. Budget for 23/24 approved since last
Reserves are low and well below Board reserves policy.
risk profile. The budget for 23/24 is for a net deficit of $11.3m which leaves
reserves of $2.2m. New process through ELT for any changes requiring increases 9
in fund against allocated budget.
IN CONFIDENCE
5. Commission’s reputation for neutrality is jeopardised by
‘politicisation’ and pressure from key stakeholders
Consequences
Loss of confidence of parties. Harder for Commission to undertake its role as a referee including additional challenges, re-work etc.
Potentially, public confidence could be dented if our impartiality is under threat.
Very likely
Drivers/Threats
•
Policy issues become politicised and focus on the Commission
- Our advice can be used in political debate
Likely
itself rather than the substantive issue on hand
- Less respect of the ‘referee’
•
Inconsistency with compliance and decision-making.
- Our role when we are involved in litigation and retaining a
G
OOD
Feasible
•
Not seen as being even-handed
perception of neutrality
H
T
C
LI
•
Political debate about costs of elections
- Debate about the role of the Commission as part of the Law
E
K
Slight
•
Balancing a need to be neutral with the wishes of the actors
Review could flow into expectations of us before we have different
LI
•
Lack of consensus on the reforms
roles/powers (e.g. misinformation)
Very
•
Proposed legislative changes which polarise opinion
unlikely
Current Mitigations
•
We communicate a consistent message to all parties at all times
•
Code of conduct sets out neutrality requirements
•
Demonstrate fairness in all activities with parties/candidates (“play • Co-lateral (e.g. guidelines) for candidates
a straight bat”)
•
Decisions that may contain risk are escalated
IMPACT
•
Our staff understand what being neutral means and follow
•
Media engagement protocols/process (incl social media)
professional practices in dealings with parties
•
‘Election Protocols for engagement between MOJ, EC and
•
Developing our submissions to the Independent Review Panel
Ministers developed, led by MoJ (moved from future mitigations)
Status Tracking
Further Mitigations
•
Escalate
•
Protocols for engaging with parties/politicians/candidates
•
Promoting the right stories about what the Commission does – in
First identified
progress
14 Jun 2021
Responsible
•
Kristina
Last updated
Manager
27/03/2023
Contingency
Trend stable
Previous state
Current state
As we move into pre election period, scrutiny and rhetoric will increase that could
IRP delivered interim report in June 2023. There has also, in line with
impact this area. Mitigations have continued to develop included an emphasis on
expectations, been increased activity in this space in the news as GE draws closer.
political neutrality for our own staff, the beginning of communications that outline the
Consistent messaging and communications embedded in enquiries and voting 10
different aspects of the election and protocols in place with MoJ
place training for the GE period.
IN CONFIDENCE
6. Critical supplier leaves the market or is operationally compromised
Consequences
Unable to receive critical goods or services from provider(s) at key times impacts provision or quality of Commission’s services (e.g. logistics and
delivery, materials during a by-election, system failure) Responding to this adds to our cost pressures
Drivers/Threats
•
Limited options in the domestic market, particularly in ‘sunset’
•
Ongoing market conditions caused by COVID-19 and unknown
industries (e.g. printing, post)
impact on providers
Very likely
•
Supply chain issues, in particular as a result of COVID-19 with an
•
Lack of understanding of risks at critical times and/or lack of
overseas dependency – availability and timeframes
response/mitigation
C
Likely
•
Ongoing business viability of suppliers
•
Competition from suppliers from other agencies e.g. Census or
•
Ability for our existing suppliers to survive and for us to adapt to a
Local Authorities
OOD
Feasible
G
different supplier market
•
Specific issues in global supply chains relating to EC business in
H
LI
•
Insufficient investment in our procurement capability
particular (but not limited to) IT products and paper.
E
K
Slight
T
•
Impact of Ukraine war on supply chains
LI
Very
Current Mitigations
•
Mapping out critical requirements and dependencies for the GE
•
Early issue of RFP if no contract right of renewal where contracts are
unlikely
•
Where critical risks exist in relation to specific suppliers, identify
due to expire during current cycle
what plans and mitigations these suppliers have in place. Managing • Robust planning of logistics and supplies requirements
risk through good quality procurement processes and ongoing
•
Early procurement and delivery schedules
contract management and relationships with providers
•
Consider back up options or plans (alternative supply chains) where
IMPACT
•
Early engagement with providers to exercise contract right of
there is limited local capability – contingency planning
renewal including a review of suppliers ongoing capability
•
Improve contract and supplier meetings and feed risks back for
•
Leveraging other govt support (e.g. IRD for Catalyst contract)
updating
Status Tracking
Further Mitigations
First identified
14 Jun 2021
Responsible Manager • Lucy Hickman
Last updated
27/03/23
Contingency
•
Develop alternative strategies for obtaining goods and services
where required
Trend stable
Previous state
Current state
•
No one has left the market, however Cyclone Gabriel highlighted the fragility of the
•
Steps increasing procurement capability has been progressing. This
postal system. We have formed a permanent procurement team we are recruiting
includes supplier management plans for critical suppliers being developed
into. Still need to look at the supply chain to see if they are operationally
or under development. This risk is stable on prior period, but still
compromised. We have stated our contract management plans
significant as due to the tumultuous economic climate, labour market
11
pressures and ongoing supply chain issues.
IN CONFIDENCE
7. Failing to deliver on strategic objectives
Consequences
Fail to deliver the election. Fail to deliver to a standard that meets expectations. Staff morale reduces/potential burnout. Loss of good will. Lost
productivity. Uncertainty around accountabilities and role. Could lose staff. Not breaking out of 3-year cycle focus.
Drivers/Threats
•
GE 23 takes focus from any strategic activity
•
Scope creep
Very likely
•
Poorly executed organisational change
•
Staff get derailed on lower priorities/pet issues
C
•
Work programme unrealistic or unachievable
•
Lack of cohesion across the organisation and focus on priorities
Likely
G
•
Strategic direction not well understood or scoped
•
Can’t attract calibre of staff we need
•
Other priorities take over that are unplanned (e.g. by-elections,
•
Over-reliance on a small group of SMEs
OOD
Feasible
H
new legislation)
•
Staff turnover
LIEK
•
Funding/resourcing limitations
•
Lack of capacity and funding to think and plan for the longer-term
Slight
LI
•
Increased expectations that we will absorb costs in baseline
(i.e. not being fully funded for this work)
Very
T
Current Mitigations
•
Strategic plan agreed, including the strategic priorities
•
Planning for 10 year strategy development – cross Commission
unlikely
•
Ensuring the business plan, work programmes and other strategies
approach
(eg ISSP) are aligned with the strategic priorities
•
Monitoring implementation of the strategic plan through work
•
Reprioritisation and re-planning work
programmes
•
Additional staff identified to help with the mahi
•
Seeking stronger programme management disciplines from earlier
IMPACT
•
Planning for earlier election readiness and minimisation of late
changes
Status Tracking
Further Mitigations
•
Communication of strategic plan/priorities to staff – ‘keep the
Apply consolidation strategy/priorities when making decisions (eg
strategy in front of people’
trade-offs)
First identified
14 Jun 2021
Responsible
•
Karl Le Quesne
Manager
Last updated
27/03/23
Contingency
Trend stable
Previous state
Current state
•
Several positions in market to support this area. Early plannining work under
The last quarter saw the recruitment of key roles which will help the
way
Commission to keep an eye on longer term objectives whilst under delivery
pressure. Approval for the plan for developing the 10 year strategy roadmap
was received and work is slowly starting with environmental scanning piece 12
s.
Recruitment for a principal advisor strategy underway.
IN CONFIDENCE
8. Failing to prevent or respond adequately to a cyber security
incident
Consequences
Inability to deliver election events, disruption to operations, disruption to corporate services, direct harm to NZ voters (e.g., data breach), reputational damage
and/or financial damage.
Drivers/Threats
• Motives include nation stage agenda, financial gain, notoriety, revenge,
• Threat actors range in sophistication some examples are: nation stage actors,
ideology, curiosity or causing col ateral damage when the target is another
cyber-criminals, malicious insiders, cyber terrorists, hacktivists, inadvertent
Very likely
G
organisation.
insiders and attention seekers.
• Attacks can be targeted to specific organisations or more generally across
• The barriers to becoming a successful threat actor are lowering with
Likely
mil ions of targets.
Ransomware software being freely available.
• Recent well-publicised successful attacks have resulted in payouts to attackers • Lack of assistance in legislation to support a response
(e.g. Colonial Pipeline Texas netted $11m USD) which may increase motivation
OOD
Feasible
T
C
H
and number of attacks.
LIEK
Slight
LI
Current Mitigations
•
Structured improvement of controls (technology, human, supply chain
•
Funding in FY21/22 budget for control improvements including resources,
Very
management) to enable us to continually improve our ability to identify,
software and process improvements.
unlikely
prevent and respond to cyber security incidents.
•
Certifying and accrediting GE critical systems.
•
Resourcing focused on cyber security issues.
•
Links to NCSC and acting upon security bulletins.
•
Draft enterprise-wide information systems strategic plan (ISSP) Phishing,
•
Patching applications, infrastructure regularly and quickly.
training, SMT focus and leadership to inform staff.
•
Pentesting applications and infrastructure annually.
•
Cloudflare DDoS protection.
•
Third party supply chain audits.
IMPACT
•
Developing playbooks for incident types
Further Mitigations
•
In the process of improving authentication/authorisation at the Commission •
Improving our ability to respond to cyber security incidents by investigating
Status Tracking
to reduce ability for attackers to harvest credentials.
the use of 3rd parties for large-scale incidents
•
Implementing extra monitoring software to improve our ability to detect and •
Improving C&A process efficiency so more apps can be included.
prevent incidents
•
Leveraging deeper NCSC capability / solutions.
First identified
•
Larger Cyber Security awareness campaigns
•
Enhanced pre-prepared comms
14 Jun 2021
•
Develop a dashboard and improve how we report against it to determine
mitigations and current state
Last updated
•
DR for manual failover during critical result entry
27/03/23
Responsible Manager
•
James (Chief Information Security Officer)
Trend stable
Contingency
•
Restoring systems and data from backups.
•
NCSC forensic expertise and assistance.
•
Manual workarounds at GE time (e.g. if DDoS protections fail).
•
Preparing to work with business on BAU contingency plans – no system
•
Notify relevant Government bodies
availability scenario.
Previous state
Current state
We have just recruited a cyber security specialist and in tandem are exploring
We are working closely with NCSC in the run up to the election. Developing a
relationships with a third- party cyber security support.
cyber security dashboard and finalising cyber security team
13
Have started conversations with NCSC around support and approach to GE 2023.
Deep dive on risk planned
IN CONFIDENCE
9. Critical system failure at a critical time
Consequences
Lose currency of critical systems leading to operational issues or failures. Systems run out of support. Inefficiencies, manual work-arounds. Loss of
staff due to frustration with aged or inadequate tools. Slow delivery and lack of collaboration through technology.
Drivers/Threats
•
Insufficient funding
•
Commission has competing priorities with a finite pool of resource to
Very likely
•
Lack of adequate resources
deliver
G
•
Lack of strategy/innovation
•
Vendor performance does not meet expectations
Likely
•
Reliance on end of life technology
•
Reliance on a single small local vendor for key systems
•
Failure of legacy systems
•
Impact of a tight labour market on ability of vendors to support the
OOD
Feasible
C
H
•
(Lack of) readiness of our GE2023 BCP and resourcing to support it
Commission in a timely way
LIEK
Slight
T
LI
Very
unlikely
Current Mitigations
•
Enterprise-wide Information Systems Strategic Plan includes feedback • Working towards the concept of co-design between IT and the
and input from business units across the Commission
business units
•
Future services strategy work planned this year should help flesh out • Election Ready Technology initiatives being actively worked on
future requirements and risks in technology space
•
Roadmap of future requirements of critical systems
IMPACT
•
Continued investment in staff and training
•
Good forward planning with vendors to mitigate the risk that services
•
Continued process improvement e.g. DGG, Security, Programme
are delayed
Management etc
•
C&A on key systems
Status Tracking
•
MSA agreement with Catalyst has now been agreed and part of the
•
testing currently on track for election readiness systems
agreement requires regular disaster procedures and regular testing
First identified
Further Mitigations
•
Go to market when appropriate for alternative vendors – less reliance • Funding to match ISSP aspirations
on one vendor
•
Reprioritise to find additional resourcing for GE2023 BCP work
14 Jun 2021
•
System lifecycle plan for all major EC technology requirements
Last updated
Responsible Manager
•
Lucy Hickman
27/03/23
Contingency
•
Fall back to full or partial manual processes
•
Hire in additional expert consultants and technical specialists
•
Purchase point solutions
Trend stable
Current state
Previous state
Election readiness testing across critical systems has progressed in line with
We are mitigating this through comprehensive Certification and accreditation
programme planning.
14
checks on our key systems. Catalyst MSA in place.
Key contract in place.
IN CONFIDENCE
10. Failing to successfully implement critical legislative and/or
regulatory change
Consequences
What we implement fails to deliver on requirements. Reputation. Stakeholder dissatisfaction/perceptions. Compliance issues. Lower confidence in
results. Failures within the system itself. Loss of political trust. Intent wouldn’t be delivered upon. Enquiry.
Very likely
Drivers/Threats
•
Limited notice of pending changes from MoJ
•
Lack of funding
•
Late confirmation of legislation
•
Short implementation timeframes
Likely
•
Particularly challenging if it relies on changes to electronic systems
•
Insufficient detailed analysis of operational implications during
planning
OOD
Feasible
G
H
•
(Sometimes rapidly) changing nature of the proposed amendments
LIE
•
Use of existing resources means it's hard to focus on this as a priority
K
Slight
C
LI
Very
Current Mitigations
•
Work closely with MoJ to get early notice of possible changes to
T
unlikely
enable appropriate response and advice of implications
IMPACT
Further Mitigations
•
Start detailed analysis when advice of possible change is known
•
Work with suppliers to provide early indications of possible changes
including detailed design work (if possible)
and requirement
Status Tracking
•
Be prepared to de-scope or halt other work
•
Undertake a risk assessment and advise Minister of these, if possible,
•
Re-prioritise so that additional resource can be provided for this work
including scope/costs and timeframes where applicable
First identified
14 Jun 2021
Responsible Manager
•
Anusha Guler
Last updated
Contingency
27/03/23
Previous state
Current state
Trend decreasing
MEO launch successful. While some future changes are signalled, there is no
Watching brief: alert for regulatory changes which may impact our ability to deliver.
immediate risk. Note: this can change quickly in our environment and risk rating
Have been providing support to IRP.
will shift in response
15
IN CONFIDENCE
11. Failing to meet obligations to implement robust health, safety
and wellbeing practices
Consequences
Significant negative impact on one or more staff, visitor and/or member of the public, compliance and litigation, adverse media coverage
Drivers/Threats
•
Poor understanding of health and safety obligations and failure to implement •
Low levels of funding available to support this work
fit for purpose policies, tools and standards
•
Tight labour market impacts our ability to assist our staff
Very likely
•
Systems and processes are in place but are disparate and not completely fit for •
Enquiries response staff may be impacted by more difficult complainants
purpose
(including any public-facing staff)
Likely
G
•
Poor culture around safety
•
Obligations under H&S legislation
•
Failure to respond to identified issues and threats
OOD
Feasible
C
H
Current Mitigations
•
Awareness of H and S obligations and implementation of actions to respond to •
Health and Safety is an element of our values (under Manaakitanga) and is
LIE
these obligations during COVID, e.g. mental health and well being
recognised as an important part of the ‘building our capability’ strategic
K
Slight
T
LI
•
Training for senior managers to help them understand obligationsFocus on
priority
Very
messages that resonate with staff and reflect the environment they’re working •
Made H&S a standing item in the ELT agenda
unlikely
in (incl mental wellbeing)
•
Threat Assessment work prior to electoral eventsRegular staff Engagement
•
Work around unpublished rol and employees of the Commission
survey
•
Updated and implemented a broader flexible working policy
•
Using the IRT on an ongoing basis
•
Refocus on values as a refreshed wellbeing approach
IMPACT
Further Mitigations
•
Lead and lag indicators established and managers held more accountable for •
Better reporting
results
•
Additional focus on health, safety and wellbeing in induction processes and in
•
Board opportunities to see real-life health and safety risks on the ground
training
Status Tracking
•
Dedicated Health and Safety budget
•
Better risk identification and well-managed mitigations
•
Deepening our staff engagement efforts through comms, culture, information
First identified
•
Ensuring work is organised in a way that controls risk
13 July 21
Responsible Manager
•
Lucy Hickman
Last updated
Contingency
27/03/23
Trend stable
Previous state
Current state
•
Policy approved. Further work will occur during election prep
•
New HSW lead now in place. Presently operationally focused on
supporting GE HSW processes.
16
IN CONFIDENCE
12. Over-reliance on core staff results in critical points of failure
Consequences
The organization fails to deliver critical activities or delivers them poorly. Public and/or political criticism as a result of reputational damage. A
substantive issue about the integrity of the election (or other, e.g. enrolment) process.
Drivers/Threats
•
Working in silos both within and across teams
•
Turnover and the pay restraints
•
Failing to document critical processes
Very likely
•
Failing to build knowledge and expertise of staff
•
Failing to plan for person failure as part of business planning and
interventions
Likely
C
G
Current Mitigations
•
The BCP work has required that back-up plans are identified and
•
Building a financial business case and new operational model which
OOD
Feasible
documented including cover for critical tasks.
explicitly helps to support resilience
H
LI
•
The Operating Model Refresh work has identified critical staff risk and • Implementing a separate programme management framework for the
E
K
Slight
T
has incorporated this into the organisational changes being
GE which makes processes and requirements more transparent and
LI
implemented
requires greater capture of information that can be shared
Very
•
Strategic objective to document all critical GE delivery processes
•
Recruitment, H&S, BCP, reprioritisation.
unlikely
•
Identifying back-ups for all key staff during the GE
•
Review of GE 2023 critical path to identify critical points of failure and
•
Remuneration and performance approach for 2021/22 has been
where we may need to have more documentation around process.
implemented
IMPACT
Further Mitigations
•
Need to identify substitutes
•
Ways to support critical staff when a crisis arises that they need to
•
Substitutes are well informed to be able to step in
deal with
•
Capture knowledge to make it readily accessible for others
•
succession planning-including understanding and planning for career
Status Tracking
•
ELT workshop held to identify key issues. A plan will be developed in
pathways
the new year including; identifying and documenting key people,
•
Clear prioritisation and agility around resource use
processes and roles
•
Investigate targeted retention and reward options
First identified
•
Building more resilience in key functions; work planning, back-ups, on
21 Sept 21
call rosters, supporting staff to manage wellbeing.
Responsible
•
All ELT managers
Last updated
Manager
27/3/23
Contingency
Trend decreasing
Previous state
Current state
•
Key management roles are in place and teams are organising themselves to
•
Heavy recruitment during this period, both against our TOM and to fill GE
deliver. Some hard to recruit roles have been filled. Election planning well advanced
roles.
17
IN CONFIDENCE
13. Failing to understand and/or connect with the wider
environment results in unforeseen consequences and/or limits
our resilience
Consequences Legislative change has unintended consequences on us and/or catches us unprepared to respond. We are unable to access support of wider sector when a major
issue arises. There is an opportunity cost in failing to transition to digital. We are unable to deliver critical services effectively because we haven’t kept pace with
Very likely
environmental change. Current specific issues rapidly become problematic (e.g. NZ Post, Local Body Elections, demand for online voting).
Likely
G
OOD
Feasible
C
H
Drivers/Threats
•
Failing to understand the changing environment and the implications of this •
Lack of policy and planning capacity
LI
on what we do
•
Lack of understanding of our enquiries/OIAs and what people are saying
E
K
Slight
T
•
Legislative change (our own legislation or other legislation which has a flow-
about the Commission (and any issues)
LI
on effect) impacts on us and we were not consulted on impacts and/or
Very
listened to
unlikely
Current Mitigations
•
External work on risk and security for GE2023
•
Building and fostering external relationships to help the Commission
•
Working closely with MoJ, MoH, DPMC and others during the COVID
understand its risks and be in a position to respond to these as and when
response
required.
•
The need to build resilience as an organisation is a key plank of the
•
Working with Stats NZ to mitigate risk that there are critical requirements of
IMPACT
Commission strategy and is reflected as a main driver in the Capacity Review
common print supplier by both agencies (that cannot be met) in 2023.
and Operating Model Refresh
•
CEO engagement with external stakeholders
•
Environmental scanning work
•
Centralising enquiries for GE2023 and rol ing up info within Zendesk to
Status Tracking
•
Increasing capability with new SGD group
provide a better picture of the environment
•
Comms media monitoring
•
Stakeholder engagement plan
First identified
Further Mitigations
•
Seek to build ‘our constituency’ further and deeper
•
Recruitment of a role focused on stakeholder management to ensure we are
21 Sept 21
•
Developing a ‘resilience framework’
attending to relationships and co-ordinated
Last updated
Responsible Manager • Mark Lawson
27/07/23
Contingency
Trend stable
Previous state
Current state
Strengthening relationships at a National level with key external agencies e.g. Iwi
Extensive operational relationships in run up to GE supporting our delivery and
Chairs network. Greater intelligence from the ground is flowing through.
system connections.
The nature of public debate has become more pejorative and intense which runs
the risk of cutting across our work with Māori. Keeping a watching brief on
18
broader environment with our partners
VERSION CONTROL
Date
By
Reason
Comment
modified whom
14 June 21
Mark Lawson
Initial draft created – capturing risks identified to date at SMT risk
workshop
13 July 21
Mark Lawson
Adapted following SMT risk workshop 2 – some changes to the
One risk removed from workshop 1:
“Staff response to organisational change” and
naming of risks. Focus of the workshop was on analysing gross and
consolidated into another risk as a driver of “Capacity to deliver on strategic objectives”.
target risks.
New risk (11) added
“Failing to meet obligations to prevent or respond to a major health and
safety incident”
20 July 21
Mark Lawson
Adapted following SMT risk workshop 3. Focus of the workshop was
Risk owners agreed. Agreed to circulate to SMT to complete current status and finalise
on current risk.
draft risk profile.
23 July 21
SMT
Update of current status and content for individual risk treatment
plans
13 Sept 21
SMT
Update of actions taken to help mitigate individual risks (captured in
the treatment plans)
21 Sept 21
Board
Risk workshop undertaken by the Board results in the addition of
Risks 12
“Over-reliance on core staff results in critical points of failure” and 13
“Failing to
further risks to the register and some further additions to existing risk
understand and/or connect with the wider environment results in unforeseen consequences
treatment plans
and/or limits our resilience” added
29 Sept 21
SMT
Circulated to SMT for input and any changes following Board meeting
Minor changes made
on 21 Sept
17 Nov 21
SMT
SMT risk review
01 Feb 22
SMT
SMT risk review
Updates to status. Additional risk added
(“14. Lack of planning and preparedness for key
structural changes within the organisation”). Risk 11 (Health and Safety) redefined to better
reflect current situation.
VERSION CONTROL
Date
By
Reason
Comment
modified
whom
21 Mar 22
SMT
SMT risk review
Three risks were modified to better reflect the current environment and issues (Risks 1 “
Loss
of trust in the electoral system”, 9 “
Critical system failure at a critical time”,
and 14
“Insufficient planning and preparedness results in poorly embedded organisational
change”
A minor technical change was made the Operational Framework, changing the title of
orange risk ratings from “High” to “Medium“ to further encourage early reporting of those
risks.
03 May 22
SMT
SMT risk review
Risk 4 “Insufficient funding and/or lack of certainty about funding” was modified to reflect
the fact that there will be funding certainty through the budget by mid May
15 Jun 22
SMT
SMT risk review
Risk 14 “Insufficient planning results in poorly embedded organisational change” was
modified to reflect the fact that the Commission has now moved from planning into
implementation of changes which are now being embedded.
3 Aug 2022
SMT
SMT risk review
Regular evaluation of risk profile and consideration of SMT’s recent environmental scan
work on the profile as a whole. A number of risk ratings (4) were changed as a result of this
review.
07 Sep 22
EMT/SLG
Regular risk review
Risk 11 was modified to include wellbeing – “Failing to meet obligations to implement
robust health, safety
and wellbeing practices”
22 November
Leigh Deuchars
Updated overall risk and risk 17 for circulation
Proposed upward trend in 7,10, 12 and 14 due to current context. 14 changed to red
2 December
ELT
Regular review
Proposed upward trend in 7,10, 12 and 14 due to current context. 14 changed to red
2 December
ELT
Deep dive outcome
Changes to risk 12 to reflect ELT workshop
27 March
ELT
reviewRegular
Changes to risk 10- decreased trend due to implementation of MEO, risk 12- reduced., risk
14 reccommend closing (TBC at Board), note cyber security risk deep dive is needed
24 July
Kristin Leslie
Regular review – Q4 22-23
Minor changes across all risks to reflect quarter, particularly GE 2023 prep activities, risk 14
removed per May board decision.
IN CONFIDENCE
Terms
•
Threat
An unwanted event or act. E.g. Major adverse natural event. These are what we need to
monitor.
•
Vulnerability
The weaknesses in the organisation that might make the consequences more severe.
•
Consequence
The effect of a threat on the organisation. E.g. denial of access to voting places etc. These are what we need to understand and be able to
mitigate.
•
Impact
The magnitude/severity of the consequence. E.g. Extreme
•
Likelihood
The probability of the threat occurring. E.g. Feasible
•
Risk
The uncertainty, created by a threat, for an organisation to be able achieve its objectives. Risk is a combination of impact and likelihood. This is what will help us
prioritise which
threats and
consequences to focus our effort on.
•
Mitigation
What we are doing to reduce the likelihood. E.g. monitoring.
•
Contingency
What we are doing to reduce the impact. E.g. BCP.
21
IN CONFIDENCE
Definitions
Risk response criteria
Very Likely
L
M
C
C
C
Rating
Description
Immediate:
Critical
requires management oversight - escalation, improved actions,
resources and strategies required to reduce, transfer or control the risk.
As soon as possible: requires management visibility - reporting via
Likely
L
L
M
C
C
Medium
responsible governance channel, improved actions, resources and strategies
required to reduce, transfer or control the risk.
D
Maintain: current actions, resources and strategies to prevent escalation of
OO
H
Low
risk. Can be managed through delegation or in a decentralised way with
I
Feasible
L
L
M
M
C
central oversight.
EL
Risk likelihood criteria
LIK
Descriptor
Description
Slight
L
L
L
L
M
Very likely
The event occurs frequently and will likely occur
Likely
The event has occurred before and will likely occur
Feasible
The event could occur at some time
Very
L
L
L
L
L
Slight
The event rarely occurs but could
unlikely
Very unlikely
The event may occur only in exceptional circumstances and hasn’t before
G
Gross – unmitigated risk
C Current – with current mitigations
T
Target – mitigated risk
CONSEQUENCE
22
IN CONFIDENCE
Definitions
Risk consequences criteria
consequence ratings
Factor
Insignificant
Minor
Significant
Major
Extreme
Financial
- Cost overrun <1%
- Cost overrun 1%-3%
- Cost overrun of 3%-5%
- Cost overrun of 5%-10%
- Cost overrun of >10%
- Procurement issues
- Probity issues
- Fraud
- Systemic control failure
Trust & Confidence
-Minor disagreements
- Relationship issues between key
- Significant one off or ongoing
- Severe breakdown of key
- Breakdown of key relationships
with/between key
stakeholders
relationship issues
relationships
impacting on the success of the
stakeholders
- Minor/ one-off reputational
- Significant one off or ongoing
- A one-off event or series of events
Elections and sustained loss of public
damage
reputational issues
resulting in loss of confidence from one
trust and confidence
- Minor localised disengagement
- Contained breach of personal
or more key stakeholders and the
- Significant breach of personal
among voters
information
public
information
- Localised disengagement among
- Breach of personal information
voters
- Disengagement among voters
Safety & security
-First aid treatment, injury or
- Injury or il ness impacting the
- Multiple injuries or widespread il ness
- Attack from organised Group
- Death or permanent disability
il ness requiring treatment
business
- Significant near miss
- Insider misuse of system/information
injury
-Near miss incident
- Minor disruption to a limited
- Large scale human disruption
- Public safety issues
- Systemic safety and or security
number of locations
(protest)
failure
- Widespread and sustained
disruption to an Election event
-Loss of ‘live’ voting papers
Media/ social media
-Minor community issues
- Localised community concerns
- Sustained negative media coverage
- Sustained adverse national media/
- Sustained adverse international
-One-off negative localised
and disruption
- Significant localised community
social media coverage
media/ social media coverage
media coverage
- One-off negative national media
concerns
- National concern
- International concern
coverage
Business continuity
-Minor delays and impacts on
- Delays and impacts on some
- Delays and impacts on some aspects
- Significant external disruption
- Delays and impacts on an Election
localised operations
aspects of national operations
of events
- Recovery taking longer than 6 hours
event as a whole
-Recovery within 30 minutes
- Recovery within 60 minutes
- Recovery within 6 hours during an
during an event
- Recovery taking longer than 24
during an event
during an event
event
hours during an event
- Some external disruption
- Significant external disruption
Critical infrastructure
-Minor, localised interruption
- Multiple localised interruptions
- Significant one-off event resulting in
- Significant national disruption to one
- Systematic failure
failure
sustained interruption
or more aspects of operation
- Widespread and sustained
disruption
Capability
-Minor internal gaps in
- Minor gaps in capability
- Major capability gaps
- Significant capability gaps
- Significant capability gaps
capability
impacting e.g. the public in one
- Some tasks impacted
- Inability to deliver some key tasks
impacting on the delivery of an
-Some tasks not completed on
location
Election
time or to expectation
- Inability to deliver a significant
number of key tasks
Technology
-Minor/ localized technology
- Minor/ localised ongoing
- Minor national technology
- Major technology interruption
- Significant technology interruption
interruption
technology interruption
interruption
impacting on event delivery
impacting on General Election
- Minor/ weak attack
- Data security concern
- Sustained attack
delivery with long-term impact
- Data loss
Political/ Legislative
-Isolated non-compliance with
- Breach of contract
- Multiple non-compliance incidents
- Significant breach of legislation/
- Litigation
legislation/regulation/
- Political party scrutiny
regulations/ contract
- Parliamentary scrutiny 23
contract
Document Outline
