from a Senior Executive Service (SES) may indicate a higher level of risk or Document positions or Continue to Questions 3 (or equivalent) or higher? delegation required. delegations required for the approval. Continue to question 3 3 External interaction Approval required by an external provider or A higher risk rating applies. indicates a lower level ‘No’ Does the business process, interaction an entity outside the Australian Government of risk. or approval involve or require approval may indicate a higher of risk and require Document the details of from an external provider or entity additional controls to be used. approvals involving Continue to Question 4 outside the Australian Government? interactions outside the Australian Government. Continue to Question 4 4 External scrutiny Approvals matching these criteria indicate A higher risk rating applies. indicates a lower level ‘No’ Does the business process, interaction a higher level of risk and require of risk. or approval involve, or is it likely to additional controls to be used. Document the details of involve a high level of public or media If the of external scrutiny is unknown, likely external scrutiny, Continue to Question 5 scrutiny, relate to issues that are or is considered high enough to warrant sensitivities, litigations or politically, commercially or personally additional controls, a response audits. ‘Yes’ sensitive, or likely to be the subject of should be recorded. litigation or an external audit? Continue to Question 5 5 Security Approvals or supporting business A higher risk rating applies. If you have answered to ‘No’ Does the business process, interaction processes involving significant security 1 questions, all or approval involve significant security issues, such as those relating to national Document all details of any continue to Q2 Phase 3: related matters? security, indicate a higher level of risk and significant security related Approval implementation. require additional controls to be used. risks. Alternatively you may also If the extent of the security-related issues choose to complete Phase 2 is unknown, or is considered high enough Continue to Phase 2: for additional assurance. to warrant additional controls, a Approval requirements ‘Yes’ If you have answered response should be recorded. ‘Yes’ to 1 one or more questions, continue to Phase 2 - Approval requirements.
from a Senior Executive Service (SES) (or equivalent) or higher? may indicate a higher level of risk or delegation required. Document positions or delegations required for the approval. Continue to question 3 Continue to Questions 3 3 External interaction Does the business process, interaction or approval involve or require approval from an external provider or entity outside the Australian Government? Approval required by an external provider or an entity outside the Australian Government may indicate a higher of risk and require additional controls to be used. A higher risk rating applies. Document the details of approvals involving interactions outside the Australian Government. Continue to Question 4 ‘No’ indicates a lower level of risk. Continue to Question 4 4 External scrutiny Does the business process, interaction or approval involve, or is it likely to involve a high level of public or media scrutiny, relate to issues that are politically, commercially or personally sensitive, or likely to be the subject of litigation or an external audit? Approvals matching these criteria indicate a higher level of risk and require additional controls to be used. If the of external scrutiny is unknown, or is considered high enough to warrant additional controls, a ‘Yes’ response should be recorded. A higher risk rating applies. Document the details of likely external scrutiny, sensitivities, litigations or audits. Continue to Question 5 ‘No’ indicates a lower level of risk. Continue to Question 5 5 Security Does the business process, interaction or approval involve significant security related matters? Approvals or supporting business processes involving significant security issues, such as those relating to national security, indicate a higher level of risk and require additional controls to be used. If the extent of the security-related issues is unknown, or is considered high enough to warrant additional controls, a ‘Yes’ response should be recorded. A higher risk rating applies. Document all details of any significant security related risks. Continue to Phase 2: Approval requirements If you have answered ‘No’ to all 1 questions, continue to Q2 Phase 3: Approval implementation. Alternatively you may also choose to complete Phase 2 for additional assurance. If you have answered ‘Yes’ to one or more 1 questions, continue to Phase 2 - Approval requirements.
DigitalAuthorisationsFramework-August2018.docx