Key findings

This audit focused on the results of financial audits of all NSW universities and their controlled entities for 2025.

• Financial performance improved for most universities, but overall expense growth continues to outpace revenue growth.
• Domestic student revenue does not cover operating costs.
• Over a third of total consultant expenses in the sector went to 2 firms.
• Controls to manage conflicts of interest are inadequate.
• There is limited central oversight for contingent labour hire.
• Control deficiencies were most common in IT, cyber security, governance and payroll.
• Universities continue to grapple with the complexities of AI.

Key insights for committees

• Conflict-of-interest management is a core governance control: Strengthening policies and guidance to require annual declarations, nil returns, and having an up-to-date central register improves transparency, particularly for procurement.
• Accountability in the use of consultants drives value for money: Over-reliance on directly sourcing reduces transparency and weakens competitive pressure.
• Extend cyber security oversight to third-party service providers and IT legacy systems: Consistently enforcing third-party cyber security responsibilities and assessing legacy system risks will reduce exposure to cyber security risks and system failures.
• Embedding governance at the enterprise level is needed in a fast-changing environment: Risks introduced by AI highlight the need for stronger governance, risk and procurement controls to keep pace with the rate of adoption and development.

Key findings

This audit focused on whether the Racing for the Regions program is being administered and delivered effectively to meet government objectives. This included assessing oversight and management of the program by the Department of Creative Industries, Tourism, Hospitality and Sport (the department) and Racing NSW’s compliance with the requirements of the funding deed.

• The terms of the funding deed do not enable effective oversight by the department.
• The department is not actively overseeing project delivery.
• Grant payments were made in compliance with most of the required financial controls.

Key insights for committees

• Robust funding agreements are critical for effective grant administration: Funding deeds should clearly define scope, timelines, milestones, reporting requirements and expected outcomes.
• Accountability should continue until acquittal: Agencies should understand and exercise their accountability for administering grants throughout the grant life cycle. This includes monitoring delivery, managing risks, keeping records and ensuring funds are acquitted. Grantees are responsible for delivering funded activities and meeting the terms of the grant agreement.
• Outcome measures and an evaluation plan should be established early: Clear performance measures and evaluation requirements to demonstrate value for money and whether intended outcomes are achieved should be established and implemented as part of the funding deed. 

Key findings

This audit examined whether Corrective Services NSW, Fire and Rescue NSW and NSW Ambulance effectively and efficiently manage unplanned leave and overtime. 

• All 3 agencies have policies and procedures for managing unplanned leave and overtime, but implementation is not always supported by effective monitoring and timely action.
• Reliance on overtime remains high, driven by workforce shortages, outdated staffing models, workers compensation absences, and rostering constraints.
• Rostering arrangements and overtime practices create fatigue risks that are not being effectively mitigated.
• Reporting and dashboards have improved visibility, but gaps remain in data analysis, compliance monitoring, and use of information to address root causes.
• Targeted initiatives are underway, but they have not yet reduced the main drivers of unplanned leave and overtime costs.

Key insights for committees

• Workforce risks require active governance: Material workforce pressures should be visible to audit and risk committees, including their impact on cost, continuity, safety, and service delivery.
• Overtime can indicate deeper control weaknesses: Sustained reliance on overtime may point to gaps in workforce planning, demand management, rostering, or business continuity. 
• Data should drive accountability: Workforce reporting should do more than show trends. It should support analysis of underlying causes and timely action.
• Initiatives need clear measures of impact: Programs intended to reduce leave, overtime, or workforce pressure should have clear performance measures and evaluation requirement defining the expected outcomes, monitoring and reporting arrangements, and evidence required to demonstrate whether they are working.

Key findings

This audit assessed whether Transport for NSW (TfNSW) had effectively administered the Regional Roads Fund (RRF). 

• Projects led by TfNSW are being managed within the existing governance framework.
• TfNSW did not provide detailed evidence to support the allocation of additional project funding.
• TfNSW projects are not following typical assurance life cycles, increasing risk.
• TfNSW did not comply with some aspects of the Grants Administration Guide.
• TfNSW has not defined outcomes to guide the administration of the RRF.

Key insights for committees

• Cost and benefits should be considered: Clear analysis of options, expected benefits, costs, contingencies, and risks helps decision makers prioritise funding, understand trade-offs and support accountability. 
• Frameworks and processes should enable compliance with grants administration guidance: Organisational policies and processes should support staff to recognise when funding is to be managed as a grants program, to identify and respond to risks, and to evaluate program merits. 
• Focus on outcomes and value for money: Establish clear objectives, performance measures and evaluation frameworks to demonstrate whether programs achieve their intended outcomes and deliver value for money.

Key findings

This audit assessed the efficiency and effectiveness of NSW Health’s oversight and assurance of arrangements to engage and accurately remunerate visiting medical officers (VMOs). The audit found:

• NSW Health does not provide coordinated statewide governance of VMO engagement and remuneration.
• NSW Health does not assess the long-term financial or workforce impacts of VMO use.
•  Local Health Districts do not have effective internal controls over VMO payments.
• Weaknesses in IT systems and data controls undermine compliance with policy.
• NSW Health does not monitor or report on VMO arrangements.
• Assurance methods are reactive and fail to quickly identify and address system-wide risks.
• NSW Health is strengthening its system-wide oversight of the use of VMOs.

Key insights for committees

• Where management is devolved, stewardship from the centre is essential: Clearly defined roles, processes, minimum mandatory control standards, assurance and accountability support the management of risk without weakening local service decisions.
• A centralised workforce planning capability can provide strategic support for devolved operations: Guidance on different workforce models and value-for-money from the centre helps align local decisions with broader system sustainability.
• Higher-risk or non-standard arrangements warrant clear governance and oversight: Non-compliance with mandatory requirements should be known and justified. 

Key findings

This audit focused on whether the NSW Police Force effectively and efficiently planned and sourced key components to upgrade core policing technology systems.

• NSW Police did not effectively plan and has not yet delivered the program, despite substantial investment. The contract was awarded to a supplier that posed a high delivery risk.
• Supplier non-performance caused delays and costs with no ongoing benefit.
• There was no effective oversight of timelines, budget controls or risks.
• NSW Police reset the program in mid-2024, reducing program delivery risks.
• NSW Police estimates it needs additional funding to deliver the program by 2031, 4 years later than originally planned.

Key insights for committees

• Legacy system risks need active management: Delays in replacing critical systems can increase operational, cyber security and service continuity risks.
• Internal capability is critical to program success: Agencies need sufficient business, project management and technical capability to lead complex transformations and reduce reliance on key individuals. 
• Technology investments should remain focused on business outcomes: Program success should be measured by improvements in operations and service delivery, not just system implementation. 

Key findings

This audit focused on whether NSW Health efficiently and effectively provides access to planned surgery (also known as elective surgery) to public patients.

• NSW Health has mostly cleared the backlog of patients caused by pauses to planned surgery during COVID-19.
• NSW Health is not completing planned surgery for all patients within clinically recommended timeframes.
• NSW Health has not fully rolled out more efficient models for planned surgery.
• NSW Health’s planned surgery access policy supports effective waitlist management.
• Despite local control weaknesses, NSW Health waitlist data can be relied upon.

Key insights for committees

• Efficiency indicators are vital in a resource constrained environment: It is important that agencies can demonstrate efficiency in a resource constrained environment before seeking additional public money.
• Performance indicators are strong drivers of behaviour and need sufficient assurance regimes to guard against unintended distortions: Because indicators can influence behaviour, agencies need sufficient assurance mechanisms to be confident that data relied on for performance management is sound.

Key findings

This audit focused on whether the NSW Reconstruction Authority is effectively administering the Resilient Homes Program (RHP) and Resilient Lands Program (RLP) to meet the programs’ objectives.

• The RHP and RLP were not effectively planned. 
• The Reconstruction Authority is prioritising RHP funding based on risk.
• The Reconstruction Authority has reallocated funding from buybacks to increase the number of resilient measures.
• There have been persistent delays in the RHP.
• The Reconstruction Authority has not effectively administered the RLP.

Key insights for committees

• Identifying the costs, benefits and risks from the outset is fundamental to effective delivery: The absence of key planning such as risk assessments and business cases at the outset can contribute to delays and increased risks.

Key findings

This audit focused on the effectiveness of the Department of Climate Change, Energy, the Environment and Water, the Natural Resources Access Regulator and WaterNSW in implementing compliance and enforcement measures for the sustainable and integrated management of non-urban water use in NSW.

• There have been significant reforms to address deficiencies in water regulation. The complexity of the reform agenda has posed challenges for effective regulation.
• The department has not assessed outcomes of water regulation reforms.
• Significant deficiencies in IT systems limit the oversight of outcomes and risks.
• The Resources Regulator has developed a policy architecture with supporting technologies.
• The Resources Regulator needs to improve how it measures and reports on its regulatory outcomes.

Key insights for committees

• Critical decisions are only as reliable as the underlying data: Effective regulation depends on accurate and timely data to inform decisions. 
• Risk-based regulation requires continual review: Frameworks should be regularly tested in order to have assurance that effort is focused on the areas of greatest priority and risk. 
• Oversight of shared responsibilities is critical: Establishing governance arrangements which embed accountability and responsibility promote good governance of risks that cross organisational boundaries.
• Compliance activity should be targeted and evidence-based: Compliance programs should be informed by data, risk intelligence and analysis, and enforcement responses proportionate, consistent and focused on achieving regulatory outcomes.

Key findings

This audit focused on whether Port Stephens Council and Armidale Regional Council are developing and monitoring their long-term financial plans (LTFP) to ensure their strategic goals can be achieved sustainably.

Port Stephens Council

• The LTFP complies with all requirements except scenario modelling.
• The LTFP is incorporated with other integrated planning and reporting (IP&R) documents.
• The council uses reliable data and modelling to develop its LTFP.

Armidale Regional Council

• The LTFP complies with requirements but financial modelling is limited.
• The LTFP is not incorporated with other IP&R documents.
• There are deficiencies in the asset data used to inform the LTFP.

Key insights for committees

Effective long-term financial plans are supported by:

• integration of the LTFP and other key IP&R documents
• ensuring that the data used to inform the LTFP, including asset data, is reliable
• designing and testing a variety of scenarios that may have a material impact on financial performance
• using the LTFP and the delivery program as part of annual budget planning
• determining the level of financial risk that a council is willing to accept and ensuring that mitigations are designed so that the residual risk is within the target
• documenting key decisions relevant to development of the LTFP.

Key findings

This audit focused on whether the Department of Primary Industries and Regional Development’s Make the Move 2024-25 advertising campaign was carried out effectively, economically and efficiently, and in compliance with the Government Advertising Act 2011 (the Act), regulations and guidelines.

• The campaign largely complied with the mandatory requirements.
• The department did not complete a cost-benefit analysis before commencement of the multi-year campaign in 2023-24.
• The campaign exceeded its relocation target and largely achieved positive outcomes.
• Post-campaign evaluation and effectiveness assessment was delayed.

Key insights for committees

• Having a clear view on costs and benefits from the outset ensures value for money: Carrying out a cost-benefit analysis before commencing a campaign provides assurance that the campaign is an efficient and cost-effective means of achieving a public purpose.
• Value for money can only be assessed at the outset if life cycle costs are included: The total cost of a campaign should be considered in analysis not just annual budget allocations.

Key findings

This audit focused on how effectively the NSW Department of Education and NSW public schools protect the security and privacy of student information. 

• The department has established a range of controls to manage the security and privacy of student information. 
• Technical responsibilities have been allocated to school principals without sufficient departmental oversight.
• There are gaps in how schools apply the department’s staff access controls to systems.
• Some schools use third-party digital products without departmental oversight.
• The department does not independently assure third-party digital products in its marketplaces.
• The department only recently identified key third-party systems as ‘crown jewels’.

Key insights for committees

• Devolved responsibilities need active support and assurance: Where responsibility is delegated or shared, the centre must be sure frontline staff have the capability, guidance and support needed to manage risks effectively. 
• Restricting access to information to only those staff who need it protects privacy: User access to sensitive data should be restricted, role-based, regularly reviewed and promptly removed when no longer needed.
• Third-party providers require the same scrutiny as internal systems: Contractual requirements alone may not provide sufficient assurance. Independent verification, ongoing monitoring and clear accountability for third-party risks are important where external vendors hold or process sensitive information.
• Good governance keeps pace with technology risk: As organisations increasingly rely on digital platforms and AI-enabled tools, ensure governance, privacy and cyber security controls evolve alongside technology adoption.