Skip to Content

Preview • Member course • Critical infrastructure • November 2026

CIRMP for Risk Leaders

Method, decisions and evidence for a critical infrastructure risk management program that will hold. Twelve lessons, a final test and a certificate of completion. For members.

Tony Ridley, MSc, CSyP, FSyI, SRMCP. 2 November 2026.

CIRMP for Risk Leaders: a member course. Method, decisions and evidence. Twelve lessons, one final test. Tony Ridley, risk-management.au.

The enhanced CIRMP Rules commenced on 10 June 2026, and the October 2026 guidance sets out how the Department expects them to be met. This course is for the person who has to make the program's decisions defensible: the risk management methodology, the material risk and reasonably practicable decisions, the records behind them, and the evidence the board relies on when it approves the annual report.

Who it is for. The senior person accountable for risk in an entity covered by Part 2A of the SOCI Act: chief risk officer, head of risk, risk director or risk manager, however titled. It builds on CIRMP Essentials for Managers and does not re-teach it.

What the course covers

Module A. Reading the regime as a risk leader

  1. A risk program, not a compliance document
  2. Tiers, dates and routes
  3. Competence, standing and what you ought to know

Module B. Method

  1. The methodology the Rules require but do not define
  2. Material risk: the test the Act sets
  3. Scales and words that hold

Module C. Decide and document

  1. Reasonably practicable: the standard you will be judged by
  2. Appetite is not the test
  3. The decision record

Module D. Assure and report

  1. Tolerances from consequence, controls to exact scope
  2. Keeping it current, and showing you did
  3. The board's annual report and the evidence behind it

By the end you will be able to

  • Determine which Part 2A obligations, tiers, dates and compliance routes apply to each of your entity's assets.
  • Specify a risk management methodology for the CIRMP that satisfies the s 7(2)(e) matter and uses terms and scales that hold.
  • Apply the material risk test and the reasonably practicable standard, and record each decision so it can be audited.
  • Identify where the October 2026 guidance's decision tools fail the statutory test, and apply a corrected method.
  • Set tolerances, controls and review triggers that keep the program current and show that it works.
  • Assemble the evidence the board needs to approve the annual report.

How it works

Each lesson has a knowledge check with an explanation for every answer. A fifteen-question final test follows the twelve lessons: 80 per cent to pass, unlimited attempts, and a certificate of completion when you pass. About 90 minutes in total. Members also get two job aids: a reasonably practicable decision record template and an evidence checklist by Rules section, each in PDF and editable Word.

The certificate records completion of a training course. It is not a qualification, accreditation or evidence of competence or CIRMP compliance.

Free lesson: A risk program, not a compliance document

Objective. Explain what Part 2A requires of the program, and what the risk leader is accountable for.

  • A CIRMP is a written program whose purpose, for each asset, is to identify each hazard where there is a material risk that its occurrence could have a relevant impact on the asset; so far as reasonably practicable, to minimise or eliminate that risk; and so far as reasonably practicable, to mitigate the relevant impact. It must also comply with the Rules (SOCI Act s 30AH(1)).
  • The duties continue after adoption. Adopt and maintain (s 30AC), comply (s 30AD), review regularly (s 30AE) and take all reasonable steps to keep it up to date (s 30AF) each carry 200 penalty units. So does failing to have regard to the matters in the Rules when adopting, reviewing or varying the program (s 30AKA(1), (3), (5)). The annual report carries 150 (s 30AG).
  • A relevant official may direct the entity to vary the program to fix a serious deficiency: one that poses a material risk to national security, the defence of Australia, or the social or economic stability of Australia or its people (s 30AI(1), (3)). Not complying carries 250 penalty units (s 30AI(5)).
  • The Rules are written as processes or systems the entity must "establish and maintain" (ss 7 to 11A). A document that describes risks, with no working process behind it, does not meet that wording.
  • When adopting, reviewing or varying the program, the entity must have regard to whether it identifies each position responsible for developing and implementing it, and for reviewing it and keeping it up to date, with contact details (Rules s 7(2)(c), (d); Act s 30AKA). In most entities those positions are, or depend on, the risk leader.

Watch for. The guidance mentions the s 30AI serious deficiency direction only in two glossary entries (pp 160 and 161), and does not address directors' or officers' duties at all. Its silence is not the limit of the obligation.

Do this week. Find the positions your program names under s 7(2)(c). For each, check it has the authority, resources and competence to do what the Rules assign to it. Record the gaps.

Knowledge check. Your entity has a well-written CIRMP, approved last year, but no one runs the review and update processes it describes. Which duties are most directly at risk?

  1. None; the program was adopted
  2. Only the annual report (s 30AG)
  3. Comply (s 30AD), review regularly (s 30AE) and keep it up to date (s 30AF)
  4. Only directions (s 30AI)

Answer: Comply (s 30AD), review regularly (s 30AE) and keep it up to date (s 30AF). Adopting the program is one duty (s 30AC). Complying with it, reviewing it regularly and taking all reasonable steps to keep it up to date are separate, continuing duties (ss 30AD to 30AF), each a civil penalty provision.

This is a member course. Lessons 2 to 12, the final test, the job aids and the certificate are for members. Become a member to take the course.

Already a member? Open the course.

Related: CIRMP Essentials for Managers: A Member Course.

General information about the Security of Critical Infrastructure Act 2018 (Cth) and the CIRMP Rules as at 2 November 2026. Not legal advice. The CISC guidance is non-binding; where the course departs from it, the reason is given.