Preparing a risk management and monitoring program

Published by:: Environment Protection Authority
Date:: 17 June 2026

Purpose of this guideline

Certain permissions, including operating licences and permits, require the development of a Risk Management and Monitoring Program (RMMP) that enables the permission holder to document how they propose to minimise risks of harm to human health or the environment in accordance with the general environmental duty (GED).

This guideline assists duty holders in preparing an RMMP. It does not prescribe any risk controls or performance objectives. It describes a framework with some examples of the type of information you should include in your RMMP. Case studies and examples are for illustrative purposes only and duty holders can tailor their approach based on the size and complexity of their operations.

Risk management and monitoring programs: an overview provides an overview of preparing, implementing and reviewing your RMMP. Site Description to Training describe the type of information to include in your RMMP.

The guideline is designed for use by duty holders across all industry sectors. For this reason, a variety of examples are provided. However, the specific examples may not be suitable for all duty holders due to the range of risks that apply across different business activities.

This guideline may be updated periodically. EPA will endeavour to inform permission holders when it is revised. Refer to our website for the most recent version.

Intended audience

EPA has prepared this guideline to assist permissioned duty holders, consultants and EPA-appointed auditors to understand the expectations for developing and documenting an RMMP.

Other duty holders will also find this framework helpful when implementing a system for identifying, managing and monitoring their risks of harm to human health and the environment.

Regulatory framework

The Environment Protection Act 2017 (EP Act) includes key duties, including the GED. The GED requires that any person who is engaging in an activity that may give rise to risks of harm to human health or the environment from pollution or waste must minimise those risks, so far as reasonably practicable.

In addition, certain EPA permissions include a condition that requires you to document how you are minimising the risks from your activities in an RMMP.

Importantly, complying with an RMMP permission condition does not automatically mean that you are complying with the GED.

EPA permissions requiring an RMMP include:

Pilot Project Licence PPL_G05
Development Licence DL_C05
Operating Licence OL_G05
Permit PER_G05
Authorisation of Discharge and Disposal ADD_G05.

If you have a pilot project or development licence, your RMMP should prepare you for your proposed activity. It may include risks that were identified during the application and development phase, including risks that are identified from commissioning activities.

Your RMMP should focus on assessing, controlling and monitoring risks from your proposed operations and activities. This may require review when you begin operations or after your operating licence has been issued, or where a change has occurred.

A well-documented RMMP that is up to date, addresses all requirements, is fully implemented and being maintained will help you demonstrate that you are meeting the conditions of your permission. It will also help to demonstrate to EPA how you intend to comply with duties under the EP Act. Implementing your RMMP will help to reduce the risks of harm to your staff, neighbours, the local environment and your business.

Below is an explanation of what EPA expects to see in your RMMP to address each element of permission condition G05/C05.

1. You must develop a risk management and monitoring program for your activities which:
  1. identifies all the risks of harm to human health and the environment which may arise from the activities you are engaging in at your site.
    A description of your site activities (see Site description) and an assessment of the associated risks (see Risk management).
  2. clearly defines your environmental performance objectives
    Clear and meaningful environmental performance objectives, see Environmental performance objectives.
  3. clearly defines your risk control performance objectives
    A description of your risk controls and what they are intended to achieve, see Risk control performance objectives.
  4. describes how the environmental and risk control performance objectives are being achieved
    A description of the monitoring undertaken to assess whether you are meeting your environmental objectives and whether your critical controls are effective (see Monitoring).
  5. identifies and describes how you will continue to eliminate or minimise the risks in 1(a) above so far as reasonably practicable (SFARP); and
    A description of your controls, checks and monitoring program, including incident and emergency management and training (see Monitoring, Evaluating environmental performance, Incident and emergency management and Training)
  6. describes how the information collated in compliance with this clause, is or will be disseminated, used or otherwise considered by you or any other entity
    A description of your monitoring, including continuous improvement and performance reviews (see Monitoring, Evaluating environmental performance).
2. The risk management and monitoring program must be:
  1. documented in writing
  2. signed by a duly authorised officer of the licensed entity; and
  3. made available to the Authority on request.
See Preparing an RMMP.

How to prepare a Risk Management and Monitoring Programme (RMMP)

View transcript

Risk management and monitoring programs: an overview
This guideline provides an overview of preparing, implementing and reviewing your RMMP. It is designed for use by duty holders across all industry sectors.
Site description
Site Description describe the type of information to include in your RMMP. The level of detail you include in your site description is proportionate to the scale and complexity of your site and operation.
Risk management
It is considered best practice to apply risk management principles to your business activities. The state of knowledge around risk management is well established, with guidance, standards and information widely available.
Environmental performance
Environmental performance is the ongoing process of assessment and improvement to continuously reduce (eliminate or minimise) your organisation’s risks of harm to human health and the environment.
Monitoring
Once environmental performance objectives and indicators, and risk control performance objectives have been set, it is important to routinely check whether your controls are performing to your established standards and meeting your targets.
Evaluating environmental performance
Evaluating environmental performance allows you to measure and assess the effectiveness of your controls.
Incident and emergency management
It is important to include environmental emergency and incident management plans and procedures in your RMMP as they are key controls for minimising risks.
Training
As a business, you must ensure that appropriate information, instruction, supervision and training is provided to any person engaging in an activity for your business that may give rise to risks of harm to human health or the environment.
References and other useful resources
This page contains references and other useful resources.

Updated 17 June 2026