Strategic Risk Committee Meeting Minutes

14 April 2014 – 9.30am

Julie Hammer (Chair), Adam King, Chris Disspain, Erhan Karabardak, George Pongas, Jo Lim, Josh Rowe, Jacki O’Sullivan (Minutes)

Kartic Srinivasan

1. Previous Minutes
The Committee noted the previously approved and published 17 February 2014 minutes.

2. Review of Outstanding Action Items:
• Dropbox/Own Cloud:
   - Adam King completed a comparison of Dropbox and OwnCloud options as an auDA document repository.  The Committee agreed on the recommendation to proceed and implement Own Cloud.
   - It was agreed staff would be moved from Dropbox to OwnCloud in the first instance with a trial run set up for the Risk Committee before a framework and guidelines would be formulated for Board requirements.
• Handover Brief, Disaster Recovery and Threat Matrix documents:
   - Adam King noted the previously suggested changes had been incorporated in the Handover Brief and Disaster Recovery documents.  He advised the Committee that the Disaster Recovery document will be kept as a high level document with more detail, especially detail subject to change, devolved into subsidiary documents.  It is estimated that the high level document will be completed by end May 2014 but the detailed subsidiary documents may take somewhat longer to complete.

3. Risk Action Status Report:
• Jo Lim gave an update on the changes to the Risk Action Status Report.
• The Committee discussed and agreed the review process and reporting documentation should be amended.
• It was agreed 3 set meetings would be held by the Risk Committee in April, August and December with the main Risk Log document, new and emerging threats and ratings to be reviewed at each meeting.  Only those Risk Actions which are assessed as amber (delayed or having issues) or red (requiring attention) should warrant discussion by the risk committee.
• In the interim, all Committee members should raise topical issues via email and ad hoc meetings would be called if required.
• It was agreed JH/JL/CD would discuss the best way forward for reporting and would send a proposal to the Committee via email.

5. Next meeting
The next meeting will be held on Monday 25 August 2014 at 11.00am at Crown Promenade.