Item #:
23.07-05
Item:
Enterprise risk updates
To:
Electoral Commission
For:
Board meeting 12 July 2023
Prepared by:
Kristin Leslie, Manager Strategy Risk and Assurance
Recommendations
It is recommended that the Board:
1.
note the attached updates on recruitment; privacy and information management; and disruptive events
at voting places
2.
discuss overall Commission preparations in each of the areas
3.
discuss whether the updates provide what the Board would seek to enable their response should events,
criticism or challenges related to the relevant risk areas materialise.
Purpose
1. This paper updates the Board on cross-Commission activities to anticipate, prepare for, manage and mitigate
the impacts of the relevant risks being examined.
Discussion
2. On 17 May 2023 the Board commissioned a number of enterprise risk deep dives on potential issues where the
Board would like to seek further assurance. The purpose of these pieces of work is for each identified area:
a. to provide the Board with a holistic, summarised view of the risk and how it may impact outcomes the
Commission seeks to enable; which Commission activities or programmes of work may be impacted; and
how the Commission has prepared to reduce, mitigate, avoid or respond. (This view should improve
board visibility or confidence that the risk is broadly understood and being actioned in a coordinated
manner at the appropriate levels within the Commission.)
b. to enable the Board to have a conversation about whether activities being undertaken result in an
overall risk profile which aligns to the risk appetite and risk tolerance of the Commission.
3. The potential issues were acknowledged not solely to be areas where risks may materialise, but also where they
may be perceived to have materialised. Therefore the Commission needs to be well prepared to make
statements to redress incorrect or incomplete public understanding of the risk.
Next steps
4. August board updates will be cyclone-affected areas and Māori engagement. September updates will be
cybersecurity and counter disinformation activity. The updates will include a high-level update of the previously
discussed topics.
1
Appendices
A – A3 Updates on recruitment; privacy and information management; and disruptive events.
