1 Introduction

In July 2015 emergency risk management arrangements for critical infrastructure resilience (the arrangements) came into effect in Victoria to broaden the focus of critical infrastructure resilience activities from terrorism-protection to consider all potential hazards whether natural or human-induced.

The arrangements include: • Part 7A of the Emergency Management Act 2013 (the Act) • the Emergency Management (Critical Infrastructure Resilience) Regulations 2015 • the Ministerial Guidelines for Critical Infrastructure Resilience (the Guidelines) • the Critical Infrastructure Resilience Strategy (the Strategy). The Strategy explains that the health, safety and prosperity of the Victorian community are reliant on certain infrastructure and that the complex, interconnected and often interdependent nature of this critical infrastructure increases the risk of a disaster-causing systemic failure. The Strategy’s vision is arrangements for Victorian critical infrastructure resilience, founded on a strong partnership between government and industry sectors, that limit disruption to the supply of essential services to the Victorian community. Part 7A of the Act requires, and the Strategy encourages, resilience building activities by government and industry. The Strategy gives effect to Part 7A of the Act and outlines roles and responsibilities for building resilience.

The Inspector-General for Emergency Management (IGEM) has a function to monitor, review and assess critical infrastructure resilience at a system level under section 64(1)(ga) of the Act. The arrangements do not operate in isolation. IGEM considers the arrangements in the context of broader emergency management and regulatory frameworks which includes: other emergency management arrangements and economic regulation in Victoria which influence owners and operators of infrastructure and afford powers to government in an emergency national and international regulation which applies to the delivery of each of the services given that each relies on complex supply chains crossing state and national borders. As outlined in the publicly available 2016 Report4 and 2017 Report5, IGEM has monitored implementation of the arrangements, assessed incremental improvements and identified improvement opportunities. Overall, IGEM was satisfied that government organisations were working collaboratively with their respective critical infrastructure sectors in implementing the activities in line with the intent of the arrangements. This report explains why IGEM is transitioning from monitoring implementation of the arrangements to assessing the efficiency, and eventually the effectiveness, of the arrangements guided by IGEM's interpretation of the intent of the arrangements. IGEM will continue to consult with stakeholders about its assurance approach.

4 Critical Infrastructure Resilience – Implementation Progress Report 2016 5 Critical Infrastructure Resilience – Implementation Progress Report 2017

1.1 Assurance principles

Four assurance principles guide IGEM’s practice. These assurance principles aim to promote more coordinated, less burdensome and more valuable assurance activities. This will drive continuous improvement of the emergency management system and contribute towards better outcomes for Victorian communities before, during and after emergencies.

Continuous improvement means appreciating the complexity of emergency management in a rapidly changing context. It means valuing parts of the system which continue to work well and seeing where incremental or immediate improvement, or innovation, is necessary. In developing this report IGEM: • focused on the performance of processes and systems, rather than individuals • appreciated that critical infrastructure resilience is complex • appreciated that emergencies can be chaotic and that those managing the situation need to, at times, make swift decisions without perfect information and without the benefit of hindsight • understood that stakeholders need time, resources and opportunity to identify and implement improvements • shared information on what works well and what can be improved.

Collaboration and coordination means working together and organising activities to increase efficiency and effectiveness. In developing this report IGEM: • recognised the expertise of owners and operators of critical infrastructure, portfolio departments, Emergency Management Victoria (EMV) and Victoria

Police • involved and consulted with portfolio departments, EMV and Victoria Police • shared the results of its implementation monitoring from the 2016 Report and 2017 Report.

Reducing burden means respecting and minimising the amount of time and resources which stakeholders need to devote to an assurance activity. In developing this report IGEM: • appropriately scoped its assurance to critical infrastructure resilience at a system level • offered flexibility in methods of submitting information and feedback • provided advance notice and minimised intensive engagement with stakeholders during their busiest periods • thoroughly checked reports for quality before release.

Adding value encourages assurance practitioners to maximise the potential benefits of their assurance activity – namely providing assurance and informing decision making for continuous improvement. IGEM has: proactively identified risks that may hinder achievement of intended outcomes focused on the essential service sectors given their priority under the arrangements maintained the line of sight from the evidence to the analysis and through to findings reported findings without avoidable delay.