• Section 1 - Introduction
• Section 2 - Purpose
• Section 3 - Audience and Scope
• Section 4 - Definitions
• Section 5 - Lines of Responsibility
• Section 6 - Compliance Principles in Practice
• Section 7 - Legislative Compliance Program
• Part A - Compliance Register
• Part B - Compliance Breach Management
• Part C - Legal Compliance Handbook
• Part D - Compliance Support and Compliance Monitoring
• Part E - Mandatory Compliance Training for Staff
• Part F - Compliance Assurance
• General
• Compliance Declarations
• Compliance Testing
• Compliance Assurance Map
• Part G - Compliance Management Reporting
• Section 8 - Related Documents

Section 1 - Introduction

(1) This Compliance Management Framework (Framework) is a key feature of the University of Newcastle's (University) overall compliance management system. It affirms the University's commitment to compliance and establishes methods to support staff to manage compliance obligations, particularly those obligations imposed by law.

(2) Effective compliance management is an integral part of the University's governance arrangements and links with financial, risk, policy, environmental and health and safety systems, and is embedded within the University's culture. Compliance structures and practices support better decision making as well as the safeguarding of assets to achieve strategic objectives.

(3) Compliance is a shared responsibility, supporting behaviours, actions, and activities that are consistent with relevant laws, regulations, and University expectations.

(4) This Framework expands on the responsibilities described in the Compliance Management Policy by establishing the practices and methods to be used to identify, disseminate, monitor and report on compliance management at the University, including the responsibilities for implementing a University-wide legislative compliance program.

(5) All University business unit and division leaders are responsible for implementing this Framework in their respective areas and all University staff are individually accountable for their compliance with relevant obligations. 

Section 2 - Purpose

(6) This Framework:

1. provides key principles to guide compliance management;
2. establishes methodologies for integrating compliance into operations, as appropriate;
3. facilitates University-wide compliance assurance, where possible;
4. supports University values and promotes ethical decision-making;
5. supports the University's regulatory risk appetite; and
6. aims for legislative compliance requirements to be met through efficient processes.

Section 3 - Audience and Scope

(7) This Framework applies across the University, but does not apply to the University's controlled entities.

(8) In accordance with the University's Compliance Management Policy and the Governance Framework for Controlled Entities, controlled entities must ensure that effective controls are in place to support the management of their compliance obligations.

(9) While the specific activities outlined in this Framework are not expected to be implemented by controlled entities, they can be duplicated or adapted by the controlled entities to manage compliance. Compliance support can be provided to controlled entities by Legal and Governance Services in accordance with existing agreements.

Section 4 - Definitions

(10) In the context of this document:

Section 5 - Lines of Responsibility

(11) The Council is the governing authority of the University, having control and management of the affairs and concerns of the University as per the University of Newcastle Act (1989).

(12) The Vice-Chancellor, as principal executive officer, oversees compliance management to ensure it is effective.

(13) The Risk Committee and Council actively monitor and evaluate the effectiveness of the University's compliance management system.

(14) Responsible Executives, as the highest-level leaders in operational management, facilitate compliance assurance and support effective compliance management. As compliance owners, the Responsible Executives ensure that effective controls are in place to support the management of compliance obligations within the Council's risk appetite, as detailed in the University's Risk Management Framework.

(15) Responsible Executives must ensure that:

1. staff are undertaking regular training;
2. identified internal controls are operating;
3. there is regular, timely review of regulatory risks;
4. areas of non-compliance have been effectively reported and corrected;
5. appropriate operational policies, processes and procedures are in place and are maintained in accordance with the Policy Framework.

(16) Legal and Governance Services, as subject matter experts, provide guidance for compliance management and ensure it is carried out in accordance with this Framework. 

(17) The internal audit function, as independent experts, conduct audits to determine the effectiveness of controls for compliance risk.

(18) All staff are responsible for compliance. In all operational areas, leaders must take action to ensure their staff are able to comply with their obligations and report instances of non-compliance.

Section 6 - Compliance Principles in Practice

(19) The following principles are designed to be used to inform compliance related decision-making. These principles are relevant to obligations arising from legislation, policies, licences, standards, agreements or any other compliance commitment made by the University.

(20) Principle 1:  Compliance efforts should be prioritised by taking a risk-based approach.

(21) Principle 2: Ethical considerations must be factored into compliance decisions.

(22) Principle 3: Staff should identify and consider all compliance obligations whenever planning, implementing or reviewing a University system, program, activity, policy document, or process and when making decisions or exercising delegated authority.

(23) Principle 4: Compliance must be considered in the context of both current and proposed (future) University activities.

(24) Principle 5: Systematic monitoring of compliance obligations is central to meeting compliance objectives.

(25) Principle 6: When compliance decisions are made, relevant external and internal factors must be considered, including:

1. political, legislative, social, and cultural contexts;
2. the economic, market, and financial situation;
3. University Rules, policies, procedures, and resources, particularly the University's Ethical Framework; and
4. community expectations.

Section 7 - Legislative Compliance Program

(26) The University's legislative compliance program has been designed to be active, positive, and business-aligned ensuring a preventative approach. The University's compliance program incorporates a facilitative compliance function that is business-aligned and considers the risk appetite, strategic goals, operational environment, values and governance structures within the University.

(27) The University's legislative compliance program is comprised of the following seven components:

1. Compliance Register;
2. Compliance Breach Management and Breach Register;
3. Legal Compliance Handbook;
4. Compliance Support and Monitoring;
5. Mandatory Compliance Training;
6. Compliance Assurance;
7. Compliance Management Reporting;

(28) The above components integrate with other University processes and structures that support compliance management, including:

1. Governance Rule;
2. Delegation of Authority Framework, Guidelines and Delegations Register;
3. Assigned responsibilities for individuals, committees, working groups, and teams;
4. Policy Framework and Policy Library;
5. Ethical Framework;
6. Staff Code of Conduct;
7. Risk Management Policy and Risk Management Framework; and
8. Operational and Strategic Risk Profiles.

(29) Legal and Governance Services will review and evaluate the components of the legislative compliance program to ensure they remain fit for purpose and to ensure continuous improvement is achieved.

Part A - Compliance Register

(30) The Compliance Register is maintained by the Senior Compliance Manager or their nominee, in consultation with Responsible Executives and compliance coordinators.

(31) Any State or Commonwealth legislative instrument that imposes legal obligations on the University is listed in the Compliance Register.

(32) For each legislative instrument listed in the Compliance Register, further information is provided that:

1. details high-level compliance obligations for the University in relation to that legislative instrument;
2. identifies associated regulations, instruments or standards, if relevant;
3. lists the areas of the University impacted by the obligations; and
4. identifies the Responsible Executive and Compliance Coordinator/s.

Part B - Compliance Breach Management

(33) A Breach Register is maintained by Legal and Governance Services. It describes alleged legislative breaches, and other significant suspected or substantiated non-compliance events and incidents. The Breach Register includes a consequence scale rating for each breach record, outlines follow-up actions taken and other key details relevant to the assessment and management of the matter.

(34) Notification of any legislative non-compliance (or suspected breach of legislation) must be made to Legal and Governance Services immediately through the online breach reporting tool. Non-compliance may occur as a one-off incident, or present as problems that are systemic, longer term, or broader issues.

(35) Any person, including a member of the public, can report suspected or actual non-compliance using the online breach reporting tool.

(36) Reports of non-compliance may also be received via:

1. the University's complaint mechanisms (see Complaint Management Policy and Procedure);
2. by lodging a public interest disclosure in accordance with the Public Interest Disclosure Policy;
3. by reporting a Research Breach in accordance with the Research Breach Investigation Procedure;
4.  by reporting a privacy breach to the Privacy and Rights to Information Manager; or
5. reporting a work health and safety incident through the work health safety incident management system.

(37) In managing a breach report, Legal and Governance Services will allocate and escalate the matter to the relevant Responsible Executive or Compliance Coordinator (or other University leader, team, or group).

(38) Management and remediation of non-compliance incidents may include, but is not limited to:

1. conducting investigations into reports of non-compliance incidents;
2. ensuring the breach is addressed responsibly and promptly through corrective and/or preventative action;
3. reporting to external regulators or other entities if relevant; and
4. reviewing compliance controls to ensure they are adequate to maintain compliance.

(39) Legal and Governance Services may review remediation actions, investigations and compliance reporting activities undertaken across other areas of the University.

(40) Significant areas of non-compliance will be reported by Legal and Governance Services immediately to the Vice-Chancellor and relevant Responsible Executive. The Vice-Chancellor and General Counsel and Chief Governance Officer will report this information to the Risk Committee. Non-compliance is considered significant where the outcome includes:

1. breach of legislative obligations which may result in loss of life or serious injury;
2. a material fine or penalty;
3. an impact on the ongoing operations of the University for a period greater than two months;
4. prosecution;
5. required reporting to a regulator leading to an external investigation; or
6. reputational damage causing loss of confidence or adverse impact over a prolonged period.

Part C - Legal Compliance Handbook

(41) A Legal Compliance Handbook is maintained by Legal and Governance Services to provide guidance for the Compliance Team, Responsible Executives and Compliance Coordinators regarding relevant procedures and activities that are undertaken to meet legislative compliance objectives.

(42) Please see also Compliance SharePoint site.

Part D - Compliance Support and Compliance Monitoring

(43) Legal and Governance Services will promote a culture of compliance and assist in facilitating compliance by providing support across the University.

(44) Legal and Governance Services will:

1. provide compliance related coaching and support to relevant stakeholders;
2. subscribe to legal and regulatory updates where known;
3. monitor for new legislation and changes to key legislation and communicate these to relevant stakeholders in the University;
4. undertake a preliminary impact analysis of identified legislative changes and where significant impact on the University is identified:
   1. ensure the Responsible Executive of the relevant business area is provided an opportunity to plan the University's approach to the legislative change; and
   2. report changes to the Executive Leadership Team and the Risk Committee.
5. establish and maintain a Regulator Contact List to document staff with responsibilities for regular communications with regulators, including details of relevant regulators;
6. establish and maintain a Register of Committees who undertake, oversee or monitor compliance audits, reviews and other compliance activities;
7. broadly deploy a program of awareness across the University to promote compliance, which may include establishing communication and information sharing protocols between key personnel;
8. where requested and appropriate, provide input into policy documents, training programs and other activities that support legislative compliance and/or mitigate risk of non-compliance; and
9. where requested and appropriate, assist in the development of internal compliance controls.

(45) Responsible Executives and Compliance Coordinators will:

1. integrate compliance principles into business operations;
2. monitor and review existing policy and procedural documents to promote and enable compliance, in accordance with the Policy Framework;
3. ensure staff and other relevant people complete required training and induction;
4. subscribe to relevant legal and regulatory updates;
5. conduct regular reviews of their assigned legislation;
6. communicate any known changes to relevant legislation to Legal and Governance Services;
7. participate in communication and information sharing protocols established by Legal and Governance Services;
8. ensure any operational changes that are required because of pending regulatory change are implemented by the date required;
9. complete regular and continual self-assessments as to the risk of non-compliance with their assigned legislation, including how risks will be mitigated and the internal controls in place; and
10. facilitate and respond to instances of non-compliance and regulatory risk, including breach reporting.

Part E - Mandatory Compliance Training for Staff

(46) A mandatory compliance training program has been developed by the University to ensure University staff understand some of key responsibilities in high-risk areas. Please refer to Mandatory Training and Onboarding Procedure.

(47) Mandatory compliance training is generally delivered via online training modules when a person commences employment with the University. For some courses there are annual refreshers or other recertification requirements.

Part F - Compliance Assurance

General

(48) Council has delegated the monitoring of the University's compliance management program to the Risk Committee. However, in performing their prescribed functions, other standing Committees of Council may undertake governance functions that relate to compliance, as relevant. The responsibilities of the Committees are contained in the Committee Charters.

(49) A review of the effectiveness of the implementation of this Framework may be undertaken by Internal Audit as required.

(50) Legal and Governance Services may request information from University staff relevant to significant compliance concerns or high-risk areas at any time.

Compliance Declarations

(51) Each year, Responsible Executives and Compliance Coordinators listed in the University's Compliance Register will be asked to provide information to be reported to Council. The process may involve self-assessment or an attestation to provide reasonable assurance that legislative obligations are understood, controls are in place to manage compliance risk and all known breaches have been reported and managed.

Compliance Testing

(52) Legal and Governance Services may periodically test the effectiveness of this Compliance Management Framework through a range of proportionate assurance activities. Such activities may include, but are not limited to:

1. seeking evidence to support compliance declarations or other compliance assurance mechanisms;
2. reviewing breach reports to identify systemic issues and corrective actions;
3. participating in policy reviews where the policy is designed to meet a compliance obligation, in accordance with the Policy Framework; and
4. tracking the number of breach reports or other incidents.

Compliance Assurance Map

(53) Legal and Governance Services maintains a Compliance Assurance Map that documents and evaluates the coverage of assurance activities across key compliance obligations and risks. The Compliance Assurance Map identifies assurance activities across management, oversight, and independent assurance functions, and is used to identify gaps, overlaps, and opportunities for improvement.

(54) The Compliance Assurance Map will be reviewed at least annually.

Part G - Compliance Management Reporting

(55) To ensure active involvement in oversight of compliance management, Legal and Governance Services will regularly report to the Vice-Chancellor, Council, and Risk Committee on compliance matters including:

1. areas of elevated regulatory risk (as they become known);
2. significant incidents of non-compliance (as they arise);
3. results of compliance declarations and testing (annually);
4. alleged and actual non-compliances recorded in the breach register (annually); 
5. general updates on compliance management performance across the University (when requested); and
6. the current Compliance Assurance Map.

Section 8 - Related Documents

(56) Compliance Management Policy

(57) Compliance Assurance Map

(58) Ethical Framework

(59) Risk Management Framework

(60) Complaint Management Policy

(61) Mandatory Training and Onboarding Procedure

(62) Risk Committee Charter

(63) Governance Framework for Controlled Entities

(64) Australian Standard: AS ISO 37301:2023 Compliance Management Systems — Requirements with guidance for use.