Responsible entity measures

Responsible entity measures in the CERCC Plan 2026 - 2028 support continuity of essential services and the transition to a circular economy by ensuring responsible entities:

understand key risks to their operations
have appropriate controls and planning in place to prevent or minimise such risks
are prepared to respond to disruptions.

What responsible entities must do

You must review each responsible entity measure in the CERCC Plan 2026 - 2028 and determine how it applies to the services you provide.

For each measure, you should:

Implement arrangements that are already in place to address the measure.

Actions addressing the measure should be listed as risk controls (existing) in the RERCC Plan, for each relevant risk.

Adopt the measure, when relevant, if existing arrangements are not in place.

If a measure is relevant and not currently addressed, you must adopt the measure into risk and business planning.

Actions to address the measure should be listed as risk treatments (actions to be undertaken) in the RERCC Plan, for each relevant risk.

Document where a measure is not relevant.

A measure may not be relevant to your operations or to the services you provide. Where this is the case, you are not required to comply with the measure.

A clear rationale explaining why a measure is not relevant must be recorded in the RERCC Plan.

The following guidance applies to responsible entity measures from the CERCC Plan 2026 - 2028 and is intended to support consistent, proportionate adoption and reporting in RERCC Plans.

Guidance applying to responsible entity measures

For each waste, recycling and resource recovery service provided by the responsible entity, outline the contingency measures and notification procedures in place, should the service be compromised, including potential limitations to the contingency processes.
Why this is required
Service disruptions can occur for a range of reasons. Having service specific contingency arrangements in place helps minimise impacts on the community, other service providers and the broader system.
Contingency arrangements should be appropriate to how each service operates and understood by the staff responsible for implementing them.
How to report in your RERCC Plan
For each waste, recycling or resource recovery service provided, the RERCC Plan should:
- identify the key risks of disruption affecting each service provided
- describe the contingency controls in place if the service is hindered, disrupted or fails for each risk of disruption or outline the treatments proposed to implement the contingency controls. This should consider notification procedures and any contingency arrangement limitations.
- demonstrate that contingency arrangements are documented, understood by relevant staff and subject to regular testing and review
Contingency controls may include contracts with other suppliers, alternative equipment, asset redundancy, cross-training of staff and other appropriate arrangements.
Outline the controls in place or actions to be undertaken, covering the next 3 years, for obtaining necessary regulatory approvals required for service delivery, including reasonable engagement and determination timeframes.
Outline suitable contingencies in place, or actions to be undertaken to maintain service continuity if approvals are delayed, or not successful.
Why this is required
Planning helps reduce the risk that delays or unsuccessful approvals could disrupt waste, recycling or resource recovery services.
Early planning and alternative strategies increase the likelihood that services can continue if approval pathways alter or are delayed.
How to report in your RERCC Plan
The RERCC Plan should:
- identify risks associated with not obtaining required regulatory approvals within timeframes necessary to support the delivery of each service provided
- describe the controls in place to obtain approvals, including engagement and determination timeframes or outline the proposed treatments to implement the controls
- demonstrate how planning, engagement and contingency processes support service continuity.
Controls may include long‑term planning (minimum 3 years), identification of suitable land, community and regulator engagement strategies, use of alternative providers, and other appropriate arrangements.
Outline the plans and processes in place to proactively build and maintain public trust and confidence in waste, recycling and resource recovery services delivered, where social acceptance risks exist.
Why this is required
Community understanding and acceptance of waste, recycling and resource recovery services supports ongoing service delivery and future expansion, where needed.
Maintaining public trust in services is an ongoing responsibility shared by industry and government and is an indicator of effective engagement.
How to report in your RERCC Plan
The RERCC Plan should:
- identify risks related to loss of public trust or confidence and the potential impacts on the delivery of each service
- describe the controls in place to build and maintain public trust and confidence or outline the proposed treatments to implement the controls
- demonstrate how social acceptance risks are monitored and managed over time.
Controls may include a stakeholder engagement plan, engagement officers, government engagement strategy, complaint management processes, and other appropriate arrangements.
Outline the controls in place, or actions to be undertaken, to prevent cybersecurity incidents which would result in a loss of sensitive data or impact service delivery.
Provide evidence of any cybersecurity threat exercises undertaken (tests of cybersecurity controls) including outcomes and improvements made. Example exercise - https://www.cyber.gov.au/business-government/exercise-in-a-box
Why this is required
Waste, recycling and resource recovery services increasingly rely on digital systems to operate.
Understanding this reliance and having effective cyber controls, contingencies and testing in place helps reduce the risk of disruption caused by internal or external security threats, including system failures, human error or malicious activity.
How to report in your RERCC Plan
The RERCC Plan should:
- identify risks relating to cybersecurity incidents, data loss or loss of access to critical information systems for each service provided
- describe the preventative controls and contingency arrangements in place to minimise the loss of sensitive data and disruptions to service delivery or outline the proposed treatments to implement the controls
- demonstrate that cybersecurity controls are tested, including evidence of at least one cybersecurity threat exercise and any improvements made as a result
Controls may include cyber security processes and software, data backup processes, cyber security training, IT system restoration procedures and contingencies, and other appropriate arrangements.
Outline the controls in place, or actions to be undertaken, for each waste, recycling and resource recovery service provided, to manage or reduce contamination causing disruption and/or to improve product quality.
Review the guidelines within the PFAS National Environmental Management Plan, updated in March 2025, and update risk assessments and control measures appropriately.
Why this is required
Contamination remains one of the most significant risks affecting essential waste, recycling and resource recovery services.
Poorly managed contamination can disrupt services, reduce the quality or usefulness of recovered materials and limit progress toward a circular economy. All responsible entities should understand where contamination risks exist in their services and have strategies in place to minimise them.
How to report in your RERCC Plan
For each waste, recycling or resource recovery service provided, the RERCC Plan should:
- Identify risks relating to contamination and the likelihood and impacts of contamination affecting each service
- describe the controls in place to prevent or reduce contamination or outline the proposed treatments to implement the controls
- demonstrate that the PFAS National Environmental Management Plan (March 2025) has been reviewed and identify where any details of risks to services are updated as a result
Controls may include monitoring and inspection procedures, infrastructure, education programs, contract clauses, and other appropriate arrangements.
Outline financial management controls in place, or actions to be undertaken, to minimise the impacts of external financial factors on service delivery.
Why this is required
Economic conditions can change quickly and may affect costs, resourcing and the ability to deliver services.
Responsible entities should understand where economic shocks (sudden) or stressors (sustained) could affect their operations and have financial and governance arrangements in place to help maintain service continuity and circular economy transition during periods of volatility.
How to report in your RERCC Plan
The RERCC Plan should:
- identify financial risks arising from economic shocks or financial stressors to each service delivered
- describe the controls in place to minimise impacts on service continuity or the transition to a circular economy or outline the proposed treatments to implement the controls
- demonstrate how financial risks are monitored and managed
Controls may include governance processes, insurance, economic monitoring, financial reserves and other appropriate arrangements.
Outline the controls in place, or actions to be undertaken, to access resilient and diverse end markets.
Why this is required
Viable end markets are essential to maintaining service continuity and supporting the transition to a circular economy.
Where markets are limited, unstable or highly concentrated, services can be disrupted and material recovery outcomes reduced. Responsible entities should consider how they develop, support or adapt to markets so they can respond to emerging, changing or growing opportunities over time.
How to report in your RERCC Plan
The RERCC Plan should:
- identify end market risks relating to the availability, diversity or reliability for each service provided
- describe the controls in place to access and maintain viable end markets or proposed treatments to implement the controls
- demonstrate how market risks are monitored and managed over time
Controls may include product quality testing, ongoing monitoring of markets, offtake agreements, product development and other appropriate arrangements.

Updated 30 June 2026

Responsible entity measures

On this page

What responsible entities must do

Guidance applying to responsible entity measures