Understanding how the risk and governance bar is lifting in aged care

Share this article

A guide to resetting risk and governance in aged care

The Royal Commission into Aged Care Quality & Safety (aged care royal commission) has signalled that aged care providers should be more accountable for the delivery of the standard and quality of care that elderly Australians are entitled to receive. In this series of five articles, we lead you through the actions to take now, to strengthen your governance and risk management to prepare for the changes to come. 

This is chapter 1 of our step-by-step guide to ‘get the basics right'; our following chapters will then expand on how to implement good governance and risk management in your operations. We draw on tried and tested approaches from healthcare and other industries.

Aged care providers should progress their governance and risk uplift now and not delay it, to be in the strongest position to respond to the significant industry changes to come. 

How to start your governance and risk reset 

Each chapter is designed to frame a conversation with your board and leadership team, to:

  • Review how the aged care royal commission’s final report is lifting the bar on governance and risk 

  • Deepen everyone’s understanding of what good governance and risk management look like 

  • Uncover the gaps, weaknesses and strengths in your governance and risk management today

  • Help you build the plan to lift your governance and risk to meet the higher expectations of consumers as consumers, regulators and the community.

Each chapter provides a ‘background briefing’ and then a set of questions for you, your board and leadership team to work through.

Why the bar is lifting

The aged care royal commission has highlighted a sector in need of fundamental transformation and generational change to meet the care of older Australians. 

The commission’s final report calls out uncomfortable truths for the sector and shines a light where it has fallen well short of what is expected in the care of our elder Australians. The root causes are many and include funding, capability gaps in leaders and resources and failing to treat the consumer at the centre of care delivery with a grounding in principles of deep respect and individualised care.

Addressing the governance gap  

One of the uncomfortable truths is the ‘governance gap’ uncovered by the final report. To date, the aged care sector has not met better practice in the way it governs and manages risk, and this has contributed to some serious service failures. In short, the royal commission’s final report calls out the need for a fundamental reset in aged care governance and risk management. 

Behind the recommendations to strengthen governance and risk we see four themes: 

  1. Providers should be supervised and held to account by stronger and more effective aged care regulator/s1 
  2. Providers should be governed and overseen by an independent body 
  3. Effective risk management must be established and verified
  4. The sector should be opened up to greater public transparency and scrutiny of performance. 

Specifically for directors

The royal commission reccommends significant change to board independence, board structure, composition and governance, as follows:

An independent board to oversee the provider: every aged care provider is to be overseen by a governing body with a majority of independent non-executive directors (R.90(a))

Board composition and skills: members must have a mix of skills, knowledge and experience, and knowledge of governance, to ensure the safety and high quality of care (R.90(a))

Best interests: board members must act in the ‘best interests’ of the provider and not otherwise (in accordance with their constitution) (R88(1b))

A mandatory board care committee: to monitor and ensure accountability for the quality of care delivered (clinical, personal, daily living), chaired by an independent member (R.90(b))

A fit and proper person test: directors and other key personnel must meet a ‘fit and proper person test’ and the Aged Care Quality and Safety Commissioner is to be notified of changes (R88(1c and d))

Annual attestation by the board that the provider has the structures, systems and processes in place to deliver safe and high quality care (R90(f))

Other important recommendations

Providers will also need to move to become more of an open, listening and transparent organisation, proactive in their management of risks for the benefit of its consumers and supported by capable leaders:

Effective risk management systems and practices:  in place for care, financial and other enterprise risks (R90(e))

Annual report published by the provider on its performance (R.88(1e))

Freedom of information: loss of certain Freedom of Information Act 1982 (Cth) exemptions to providers (R.88(2)), increasing scrutiny on performance

Complaints management: including understanding the patterns and reasons for complaints (R90(d))

Feedback loops from consumers, employees and others on the quality and safety of services delivered and how they can be improved (R90(c))

Developing leaders: performance reviews and training to uplift leadership and continuous learning (R89)

Why start the governance and risk reset now?

The government is yet to respond to the 148 recommendations in the final report, and flagged it needs more time to work through the choices offered by the commissioners on alternative solutions, as well as funding decisions.  

However, the commissioners were unequivocal and aligned on the recommendations made on governance and risk and we should expect these recommendations to be endorsed by the government in due course. 

If follows that aged care providers should be on the front foot to strengthen their governance and risk management. Starting a governance and risk reset now (rather than delaying it) makes good sense; it will lay the foundations for the higher standards of governance and risk to be enacted and will help build a stronger organisation that is focused and better able to manage the other changes to come. 

Continuing to meet immediate requirements set out in the standards

As we look ahead to responding to the royal commission and advancing clinical governance and quality standards, it is important that we don’t lose sight of what we need to demonstrate and maintain compliance today. As an executive and a board, it is important to be aware of the trends and areas of repeat and common failures against today’s requirements.

The commission's reports have highlighted common themes of non-compliance across the aged care quality standards, confirmed by the royal commission’s final report. Over the past 18 months, the new quality and safety regime has highlighted deficiencies particularly relating to Std 3 Personal and Clinical Care and Std 8 Organisational Governance. 

Standard 3 - What you need to know?

  • Standard 3 states that consumers and the community expect safe, effective and quality delivery of personal and clinical care. 
  • Standard 3 was consistently linked to serious risk decisions made by the royal commission. 
  • Standard 3.3(b) in particular appears to be one that services are grappling with and it specifically relates to the effective management of high impact or high prevalence risks associated with the care of each consumer.  

The royal commission identified the most common failures against this sub standard related to medication safety, managing pain, minimising restrictive practices and managing delirium. Other issues included staff responding inappropriately to deterioration, or failing to recognise and respond to changes in condition; clinical risk assessments and inconsistencies in risk management.

Standard 8 - What you need to know?

Standard 8 enables all the other aged care standards. It supports how the organisation strategically focuses on the requirements of each standard to ensure the organisation is well governed.

The failures in clinical and personal care documented in the Aged Care Quality and Safety Commission sector reports and the royal commission’s final report are often matched by a failure in governance with the provider not meeting the current standard 8 on organisational governance, such as:

  • Not having an effective clinical governance framework in place.
  • Not having effective risk management systems and practices to prevent harm to consumers, managing feedback or complaints or supporting open disclosure.
  • Staff lacking knowledge or understanding of key policies and procedures to manage significant risks e.g. on the use of chemical or physical restraints.
  • Inadequate escalation, reporting and monitoring to the governing body e.g. indicators, antimicrobial stewardship, reporting of abuse/neglect or improper use of restraint. 

So, whilst we must have an eye to the future and the changes to come, it is also essential to stay focussed on maintaining compliance and meeting today's expected standards.

How would your board and leadership team answer these questions?  

  1. Based on the royal commission’s recommendations, how big is our governance gap today, considering the changes to come? 
  2. Do we have any immediate gaps or deficiencies in our ‘system of control’ against the aged care standards and are we as a Board getting what we need to feel confident that the system is operating as intended? Are we prepared to attest to this or what else do we need from management or our internal audit function to do this?
  3. As a Board, are we confident that we have the same level of oversight and monitoring disciplines in place over our clinical risks and compliance obligations as we do our non clinical risks?

For more information on governance hot topics and board issues, visit PwC’s Governance Insights Centre.

Look out for the next chapter to help you with your reset journey, including questions, tips and ideas - Chapter 2: The basics of good governance.


1   There is some uncertainty over the regulatory regime, with alternative options offered by the commissioners

Contact us

Nicola Lynch

Nicola Lynch

Health & Education Industry Leader, PwC Australia

Tel: +61 425 147 707

Edwina Star

Edwina Star

Risk Consulting Lead, PwC Australia

Tel: +61 416 301 798

Tracy Robertson

Tracy Robertson

Senior Manager, Assurance, PwC Australia