Refine search Expand filter

Reports

Published

Actions for Local government 2025

Local government 2025

Local Government
Planning
Asset valuation
Compliance
Cyber security
Financial reporting
Financial sustainability
Fraud
Information technology
Infrastructure
Internal controls and governance
Procurement
Regulation
Risk
Service delivery
Shared services and collaboration

This report presents key findings and recommendations from financial audits of local councils, joint organisations and county councils for the year ended 30 June 2025.

It also comments on the sector’s financial sustainability, internal controls and governance, major capital projects, artificial intelligence (AI) and cyber security.

Key findings

Unmodified audit opinions were issued for the financial statements of 125 councils, 8 county councils and 11 joint organisations. Three council audits were in progress at the time of this report.

Financial reporting quality has improved

The number and value of errors in the financial statements declined from the previous year, and fewer versions of financial statements were submitted for audit, indicating improving financial reporting processes.

Financial sustainability continues to be a concern for some councils

Seventeen councils reported operating losses this year and 19 had insufficient cash (not subject to external restrictions) to cover 3 months of general expenses. Six of the 19 councils identified as being the least liquid also incurred operating losses.

Appendix 2 lists 11 councils with heightened financial sustainability risk due to various combinations of operating losses, insufficient cash, declining populations and low capacity to generate own source revenue.

Water supply infrastructure needs $1 billion to ensure access to safe and secure water

Two regional and 13 rural councils that supply water made operating losses. Even when operating costs can be covered, it is unlikely they will recover enough, based on council estimates, to enable infrastructure upgrades to agreed service levels.

Councils held $5.4 billion in local infrastructure contributions (LIC), but spending was low for some

There were 14 councils that held more than half of LIC funds. Of these, 10 spent less than 20% of their balance in the 2024–25 financial year. Delays between collecting and spending LIC funds may indicate that infrastructure planning and delivery processes are not operating effectively. The current LIC system is particularly complex for councils experiencing significant population growth.

Capital project guidance is outdated and inadequate

Of the 29 major capital projects reviewed, 14 were delayed by more than 6 months, and 6 were more than 10% over budget. Current guidelines are more than 15 years old and do not reflect the complexity and risks of modern infrastructure delivery.

Internal controls and governance processes had deficiencies

Deficiencies in internal controls and governance were identified at most councils, mainly associated with asset management, information technology (IT) and fraud control.

Most councils lack AI strategy and governance

Councils are in the early stages of adopting AI. Fewer than half have a strategy or governance framework, limiting oversight and opportunities to leverage benefits and mitigate AI risks.

Significant cyber security control deficiencies exist

Councils have critical weaknesses in managing supply chain risks. Policies and processes for assessing the cyber security exposure of technology assets are inadequate, and monitoring of cyber security investments and their associated benefits is limited.

Recommendations

The report makes 5 recommendations (see page 6 for full details).

This report provides an overview of the key findings and recommendations from financial audits of local councils, joint organisations and county councils for the year ended 30 June 2025. The report also comments on the sector’s management of:

  • financial sustainability
  • internal controls and governance
  • major capital projects, including progress against timelines and budgets for capital projects with budgets over $30 million
  • technology, including cyber security and emerging technologies like artificial intelligence (AI).

Chapter 3 includes key areas for improvement and practical lessons for councils. Refer to Appendix 5 for a list and results of completed financial audits of local councils, county councils and joint organisations.

This chapter outlines key areas of improvement and practical lessons that can be applied by all councils. The Local Government Act 1993 requires councils to apply sound financial management principles including responsible and sustainable expenditure, investment, and effective financial and asset management.

Financial sustainability

Governance and oversight

Councils require adequate governance and oversight, including identifying and responding to early warning signs. This can be achieved by councils ensuring:

  • council officers cultivate a culture of openness, transparency and accountability. This ensures concerns are raised promptly and financial information and analysis is comprehensively reviewed and questions appropriately dealt with
  • there is clarity and documented evidence on how decisions were reached
  • lead and lag performance indicators are established and reported against, to assist with oversight and monitoring
  • Audit, Risk and Improvement Committees are involved in reviewing and questioning quarterly business review statements and other key reports.

Long-term financial planning

Financial sustainability is achieved, over the medium and longer term, by ensuring:

  • revenue is sufficient to cover expenses by building budgets based on realistic assumptions and being agile to constrain expenditure when revenue falls below the target
  • cash flows and risks are well managed
  • sources of revenue are diverse
  • the quality of asset management data is improved to better inform long-term financial planning, budgets and financial decisions.

Budget monitoring and reporting

Councils should:

  • regularly monitor financial performance, financial position, cash flows and capital programs
  • ensure those responsible for budgets understand the key drivers that can have adverse effect on a sustainable budget position, are accountable and escalate promptly
  • undertake service reviews to better understand net cost of services to inform budgets and financial planning decisions.

Internal controls

Councils can improve financial sustainability by addressing deficiencies in controls and processes and:

  • building the competency of those responsible for finance and budgeting
  • ensuring that financial systems are being used to their full potential, for example, revenue and expenses being allocated by fund for each transaction
  • effectively managing cash by regularly reconciling by fund and where possible ensure cash inflows precede cash outflows
  • controlling costs and monitoring discretionary spending, cancelling non-essential expenditure and re-negotiating activities when economies of scale can be achieved by working with other councils or leveraging existing products.

Major capital projects

Robust project planning

Poorly planned projects with an unclear scope typically have cost overruns, variations for design changes, and delays. Better practices to mitigate this risk include:

  • underpinning of business cases by sound evidence and realistic assumptions
  • explicitly defining scope, dependencies and deliverables, including enabling works, project design and any contingent costs
  • robust option analysis and prioritisation of competing projects
  • ensuring that plans and projections include life cycle project costs to fund the delivery and maintenance of the required capacity
  • identifying risks and opportunities and appropriately responding to and managing risks throughout the project
  • leaving adequate time to build a robust business case and plan, and engaging experts to deal with complex projects or contract negotiations as required.

Monitoring and contract management

Monitoring and contract management function should be performed at the project level to ensure councils are getting what was promised, when it was promised, at the agreed price. There should be a focus on the technical specifications, scheduled milestones, payment processing and variations. Councils should ensure:

  • project managers have the right skills and resources to effectively manage contracts, monitor suppliers and assess performance
  • there is regular, transparent reporting to decision-makers on progress, costs and risks
  • escalations and decision-making pathways are clear.

Oversight and assurance

Effective governance and independent oversight are critical to project success. Strong governance and assurance arrangements ensure accountability, transparency and early detection of issues. Without effective oversight and accountability, there is a risk that projects can underestimate risk, proceed under incorrect assumptions or ignore emerging issues

For major capital projects, councils should ensure that:

  • governance bodies with appropriate expertise, independence and authority are set up to challenge assumptions and major decisions
  • regular assurance reviews, assessing not only compliance with policies, but also assumptions, enabling works risks and strategic alignment, are implemented.

Fraud prevention and detection

Fraud control and prevention strategies

Fraud has the potential to impede operations, diminish service quality, damage reputation and result in financial losses.

Council should detect and prevent fraud by implementing better practices such as:

  • ensuring that policies are regularly updated and their effectiveness is regularly tested
  • implementing an ethical framework, including a code of conduct, statement of business ethics, fraud control policy
  • developing processes to effectively manage conflicts of interest and secondary employment
  • performing a fraud risk assessment regularly and update controls based on findings
  • clearly defining roles and responsibilities for fraud, undertaking fraud awareness training and regularly having staff acknowledge their compliance with the code of conduct
  • embedding detection tools, including emerging technologies, to assist in the identification of, and response to, suspected fraud
  • undertaking environment scans and assurance activities, including reviewing industry information, such as that published by the Independent Commission Against Corruption, to identify risks and opportunities
  • undertaking assurance activities to obtain assurance over controls, monitor and address deficiencies promptly.

Fraud awareness culture

Committed executive and oversight committees that actively endorse fraud control measures and model ethical behaviour help reduce fraud risks and incentives.

Councils can promote ethical behaviour by:

  • clearly defining roles and responsibilities in fraud prevention
  • undertaking regular fraud awareness training
  • having staff regularly acknowledge their compliance with the code of conduct
  • establishing confidential reporting channels that allow staff or others to tip off fraud without identification.

Prevention of loss to third parties

Third-party scammers are becoming increasingly sophisticated. Councils can prevent loss to third parties by independently verifying all changes to vendor details directly with the vendor before payments are made.

 

Artificial intelligence

Governance and oversight

As AI becomes increasingly common in IT environments, it is necessary for councils to maintain suitable governance and oversight of both the AI pipeline and AI tools used in production.

While it is not mandatory for councils to apply it, the National framework for the assurance of artificial intelligence in government specifically identifies that:

'Governments should ensure their use of AI is disclosed to users or people who may be impacted by it. Governments should maintain a register of when it uses AI, its purpose, intended uses, and limitations’.

Strategic use of artificial intelligence

When senior leaders are kept informed of both the opportunities and challenges associated with AI, they are better positioned to champion strategic initiatives, address resource needs, and ensure that ethical and governance standards are upheld.

Cyber security

Managing supply chain cyber security risks

The foundation of an effective cyber security strategy is knowledge of the IT environment. Maintaining an IT asset inventory is crucial for strong cyber security as it provides visibility into what needs to be protected, enabling better risk management, threat detection and incident response.

Unmonitored external systems, such as those managed by third-party vendors and their extended supply chain, can introduce further risks if they do not adhere to industry security standards.

Furthermore, not including supply chain risk in the risk register means that these risks are not being tracked or managed effectively. This oversight can result in a lack of readiness for potential cyber incidents involving third-party vendors.

Cyber security spending

Effective management of cyber security investment helps councils ensure that their investments are having the desired results, in compliance with regulations, and ultimately safeguarding their operations while ensuring effective and efficient spending on cyber security.

 

Financial reporting is an important element of good governance. Confidence in, and transparency of, local government decision-making is enhanced when financial reporting is accurate and timely.

Indicators of quality financial reporting include:

  • relevant, unbiased and clear information
  • unmodified audit opinions
  • low number and value of errors, including disclosure deficiencies, in the financial statements
  • low number of different versions of financial statements submitted for audit.

This chapter outlines the financial audit results for 2024–25.

Chapter highlights

  • NSW councils have a greater financial reporting burden than other Australian states. Progress to declutter financial reporting requirements within the code has been slow. There are no major changes.
  • Unmodified audit opinions were issued for the 30 June 2025 financial statements of 125 councils, 8 county councils and 11 joint organisations. Two councils resolved issues that resulted in qualified audit opinions in previous years.
  • Eighty-eight per cent of councils lodged their 30 June 2025 financial statements by the statutory deadline of 31 October – the same percentage as in 2023–24. Fourteen councils and two joint organisations received extensions from the Office of Local Government (OLG).
  • More than half of the independent auditor’s reports were issued in the 5 days before the statutory deadline. Councils, the Audit Office, and Audit, Risk and Improvement Committees (ARICs) can take further steps to improve the timeliness of financial reporting and the audit process. Early financial reporting procedures can improve the quality and timeliness of financial reporting.
  • There are indicators that the quality of financial statements has improved, including fewer prior period and uncorrected errors, and fewer versions of the financial statements. Councils could further improve the quality of financial reporting by addressing longstanding deficiencies in record keeping and timely valuations of infrastructure, property, plant and equipment (IPPE).

Financial sustainability is the ability to meet current and future financial obligations without reducing essential services or borrowing money to fund successive operational deficits. This is achieved by ensuring that over the medium and longer term, revenue is sufficient to cover expenses; cash flow and risks are well managed; long-term financial planning is effective; and sources of revenue are diverse.

Councils are required to prepare long-term financial plans to help ensure they remain financially viable.

The graphs and tables presented in this chapter are prepared from councils’ financial statement data and in many cases represent averages of the metropolitan, regional and rural councils.

This chapter analyses the liquidity, financial performance and position of councils at 30 June 2025.

Chapter highlights

  • There has been an increase in the number of councils making operating losses – 17 councils. There is insufficient cash, not subject to external restrictions, to meet 3 months of general fund expenses at 19 councils (16 at 30 June 2024).
  • Two councils (Bathurst Regional and Upper Hunter Shire) spent restricted cash in breach of the Local Government Act 1993 (the LG Act).
  • Councils estimate that almost $1 billion is required to ensure that water supply infrastructure continues to meet agreed service levels.
  • Councils held $5.4 billion in local infrastructure contributions at 30 June 2025, but spending remains low for some councils. Over half of these contributions was held by 14 councils. Ten of these spent less than 20% of their contributions balance in 2024–25. The current system is particularly complex for councils with significant population growth to navigate.
  • Long -term financial plans for 21% of councils did not financially model for different scenarios.

A strong system of internal controls and governance enables agencies to operate effectively and efficiently, produce reliable financial statements, comply with laws and regulations, and support ethical and transparent decision-making. Good governance promotes public confidence in the integrity and effectiveness of a council’s systems and operations.

Well-governed, strong internal controls will enable councils to operate effectively and efficiently, produce reliable financial information, comply with laws and regulations, and support ethical government.

Financial audits include:

  • procedures to understand the design, implementation and operating effectiveness of internal controls and governance relevant to the preparation of a council’s financial statements
  • consideration of the extent to which an agency has complied with applicable laws, and the regulatory and policy requirements relevant to financial management and reporting.

This chapter highlights findings on internal controls and governance identified in 2024–25 audits.

Chapter highlights

  • The Audit Office’s audits reported on the design, implementation and/or operating effectiveness of internal controls and governance at nearly all councils, joint organisations and county councils. Almost 70% of reported findings related to weaknesses in governance, asset management and information technology (IT).
  • Deficiencies in controls and monitoring of user access, including privileged users, were reported at most councils, increasing the risk of loss, error or unauthorised transactions.
  • Councils should improve managing, recording and valuing assets. 63 councils had inaccurate and incomplete fixed asset registers, and 68 councils are deficient in asset valuation processes. These deficiencies could reduce the effectiveness of planning and decisions related to assets.
  • Councils need to improve their fraud control frameworks. While more councils have implemented policies for fraud and corruption prevention and conflicts of interest, some councils need to improve training, fraud risk assessments and use of technology to detect and prevent fraud.
  • All councils have established an Audit, Risk and Improvement Committee (ARIC), but 6 do not have the required number of independent members. Not all of these committees are covering the required aspects of council operations. Gaps in oversight could lead to unaddressed risks.

 

In accordance with the Local Government Act 1993 (the LG Act), councils are responsible for managing land and other assets so that current and future local community needs are met in an affordable way. Councils should invest in responsible and sustainable infrastructure for the benefit of the local community. They should also have effective asset management, including policies and processes to manage asset maintenance and enhancement.

Strong governance is fundamental to the successful delivery of infrastructure projects, which can be complex, have long delivery timelines and require significant investment. Without clear decision-making frameworks, strong oversight and robust processes for monitoring costs, schedules, scope and risks, projects can experience delays and cost overruns, or fail to deliver expected benefits.

A good governance framework ensures accountability, supports informed decision-making, mitigates systemic and project-level risks and provides a framework for learning from past projects to improve outcomes for the community. Best practice governance is structured, transparent and tailored to the scale, complexity and risk profile of the project.

This chapter analyses the status of major capital projects with a budget of greater than $30 million for 2024–25.

Chapter highlights

  • In 2024–25, councils spent $6.1 billion to renew and acquire infrastructure, property, plant and equipment (IPPE) for the benefit of the local community.
  • 14 capital projects over $30 million were delayed by more than 6 months and 6 of these were more than 10% over budget.
  • Guidance for managing capital projects is outdated and inadequate. Guidelines do not cover the full project life cycle, or all types of projects, and do not provide advice on assurance arrangements that would support project delivery.

Councils are increasingly integrating emerging technologies like artificial intelligence (AI) to streamline operations, foster innovation and enhance delivery of services.

This chapter examines:

  • the use of AI in the 90 councils that reported having adopted AI
  • whether appropriate governance, risk and assurance mechanisms are in place to support the ethical adoption of AI
  • future plans and strategies for AI use by councils.

While there is no single definition of AI, the NSW Government’s Artificial Intelligence Ethics Policy defines AI as intelligent technology, programs and advanced computing algorithms that can augment decision-making by identifying meaningful patterns in data.

Chapter highlights

  • The Office of Local Government (OLG) does not require councils to follow a mandatory framework for responsible AI adoption. A mandated framework would provide a consistent, responsible and effective method for managing AI risks and opportunities across councils.
  • Councils are in the early stages of AI adoption. Several challenges and barriers affecting the adoption and use of AI have been noted by councils, including funding constraints, the development of governance frameworks, management of data quality, security and privacy, and limited AI literacy.
  • Councils will need to integrate AI into their existing governance arrangements as use grows. Fewer than half of the councils have implemented formal AI policies and most have yet to fully integrate the specific and unique risks posed by AI into their existing governance frameworks. This includes evaluating the broader impacts of AI on accountability structures, policies and procedures (such as information technology (IT), procurement, risk management), and monitoring and reporting systems.
  • Enhanced visibility of opportunities, challenges and risks will allow councils to leverage the benefits of AI. While they are in the early stages of AI adoption, only 11% of councils currently have a strategy for adopting AI. This, and the limited level of oversight, could significantly hinder councils from fully leveraging the potential benefits that AI offers and lead to fragmented efforts that don’t fully align with councils’ objectives.

Cyber security is a major concern for local government. Cyber threats have the potential to disrupt operations, compromise sensitive data and, when combined with fraudulent activity, contribute to financial losses. Dependence on third-party vendors and overall supply chains introduces risk, as these external parties may not have strong cyber security measures in place. Identifying and managing cyber risk, including those from third parties, is critical in maintaining business operations and protecting information assets.

Councils have the option to follow the Office of Local Government’s (OLG) Cyber Security Guidelines - Local Government 2024 (the Guidelines). The Guidelines aim to help councils develop a basis for cyber security policy and measures.

This chapter analyses how councils:

  • manage their internal and supply chain cyber security risks
  • control and monitor their cyber security investments.

Chapter highlights

  • Councils have gradually but inconsistently improved in relation to four cyber security governance controls dealing with policies, risk registers, staff training and incident recording. Challenges remain for the consistent delivery of staff training and registration of cyber security incidents, and around a quarter of councils are missing at least one of the four selected cyber security controls.
  • There are significant weaknesses in councils’ management of supply chain risks. Seventy-three per cent of councils do not have formal policies addressing supply chain cyber security risks and 70% of councils did not have formal processes to assess their technology assets. These weaknesses include not formalising policies to manage supply chain cyber security risk, not monitoring third-party cyber security responsibilities throughout the service agreement, and not including third-party providers during cyber incident response plan testing.
  • There are opportunities for councils to improve the management of their cyber security spending. There is limited monitoring of investment/benefit realisation on cyber security investments. Seventy-two per cent of councils did not assess the effectiveness of their cyber security spending or ensure that it aligned with current threats. Only 21% of councils identify and manage underutilised, redundant or outdated cyber security tools and services.

Audit Work Program 2025–28

The Audit Office’s Audit Work Program sets out the Auditor-General’s planned financial and performance audits for the next three financial years and is refreshed annually to stay responsive to emerging risks and evolving stakeholder needs. It is designed to deliver independent assurance and practical insights that inform, influence, and improve public sector performance. The current program is organised around five themes that target systemic and priority issues, so that reports create public value and help agencies achieve more with finite public funds.

The next local government–focused report scheduled for tabling is ‘Long-term financial planning in local government’. For more information, or to subscribe to updates, please visit our website.

Published

Actions for Cyber security in Local Health Districts

Cyber security in Local Health Districts

Health
Cyber security
Information technology
Internal controls and governance
Management and administration
Risk

My Cyber security insights 2025 report noted that modern governments' dependence on IT and global network interconnectivity has significantly raised cyber security risks. Incidents such as data theft, privacy breaches, and denial of access to essential systems can disrupt public services and erode trust in government. 

The ‘Cyber security in Local Health Districts’ report was completed in July 2025. I determined that it was not in the public interest to make the report public at that time. As such, I presented the report to Parliament on a confidential basis on 9 July 2025 to be published on 19 December 2025, allowing NSW Health to take action in response to the report recommendations prior to publication. 

In the time since presentation of the confidential report, NSW Health has established a taskforce and progressed action in response to the report’s recommendations. 

Objective 

This audit assessed whether NSW Health is effectively safeguarding clinical systems, required to support healthcare delivery in Local Health Districts, from cyber threats.

Conclusion 

NSW Health is not effectively managing cyber security risks to clinical systems that support healthcare delivery in Local Health Districts. In addition, Local Health Districts have not met the minimum NSW Government cyber security requirements that have been outlined in NSW Cyber Security Policy since 2019. 

Local Health Districts are not adequately prepared to respond effectively to cyber security incidents. Systemic non-compliance with NSW Government cyber security requirements, including maintaining adequate cyber security response plans, business continuity planning and disaster recovery for cyber security incidents, means that Local Health Districts could not demonstrate that they are prepared for, or resilient to, cyber threats. This exposes the risk that a preventable cyber security incident could disrupt access to healthcare services and compromise the security of sensitive patient information.

eHealth NSW has not clearly defined or communicated its roles and the expected roles of Local Health Districts regarding cyber security. This has led to confusion amongst Local Health Districts on the cyber security risks they manage, including for crown jewel assets (the ICT assets regarded as valuable or operationally vital for service delivery), and identifying and mitigating critical vulnerabilities, threats and risks. Local Health District management of cyber security is hampered by a lack of support, coordination and oversight from eHealth NSW in cyber security matters. 

Recommendations 

The audit recommended that: 

  • The Ministry of Health collate and validate information on compliance with the NSW Cyber Security Policy
  • The Ministry of Health finalise and communicate cyber security roles and responsibilities within the NSW Health system
  • eHealth NSW develops clear guidance to Local Health Districts on balancing need to deliver clinical services while meeting cyber security requirements and supports Local Health Districts to improve cyber security capability
  • Local Health Districts design and implement a fit for purpose cyber security risk management framework.

 

Clinical systems are required to deliver health services to people presenting to hospitals, community health services and other health services. Disruptions to clinical services caused by cyber attacks can disrupt the delivery of health services. This audit focused on one area of clinical service delivery in four Local Health Districts to understand how effectively the districts manage cyber security risks to the clinical systems used for that area of clinical service delivery.

This chapter looks at how roles and responsibilities relating to cyber security are defined in NSW Health. It examines funding for cyber security activities, considers how Local Health Districts identify the information and communication technology (ICT) assets that require protection, and assesses how Local Health Districts understand the vulnerabilities of clinical systems to cyber threats. It also considers whether Local Health Districts have built and maintained a strong culture of cyber security. This is important because most cyber security attacks are the result of people-related factors rather than technical weaknesses.

This chapter reports on whether Local Health Districts respond to cyber attacks effectively. First, it considers the strength of cyber security controls in Local Health Districts and their capacity to implement them. Second, the chapter looks at how Local Health Districts monitor and detect cyber security incidents. Finally, it considers how well Local Health Districts plan for a cyber security incident. This is essential to ensure that if a cyber security incident does occur, the Local Health District is able to either continue delivering services or that any downtime that results from the incident is minimised.

Appendix 1 – Response from entity

Appendix 2 – About the audit

Appendix 3 – Performance auditing

 

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

 

Parliamentary reference - Report number #413 - presented to NSW Parliament 9 July 2025

Published

Actions for State finances 2025

State finances 2025

Whole of Government
Treasury
Financial reporting

This report summarises the 2024–25 consolidated financial statements of the New South Wales General Government Sector (GGS) and Total State Sector (TSS). Together these comprise the Total State Sector Accounts (TSSA). 

The report comments on key findings from the TSSA audit and highlights significant factors that have contributed to the State’s financial outcomes for the year ended 30 June 2025. The report also identifies areas of focus for future audits.

Key findings

The audit opinion on the TSSA was unqualified.

The GGS deficit was $1.4 billion higher than originally budgeted

The GGS reported a deficit of $5.1 billion for the 2024–25 financial year. This was higher than the original budgeted deficit of $3.6 billion, and $86 million higher than the revised budget deficit of $5 billion estimated during the 2024–25 half yearly review.

Since 2022–23, the GGS’s revenue growth has exceeded expense growth

This reversed a trend from previous years when expenses rose faster than revenue due to the Government’s response to COVID–19 and natural disasters.

The GGS’s interest expense increased by $3.1 million per day

In 2024–25, the GGS’s interest expense increased by $1.1 billion to $7.1 billion, mainly due to a $11.7 billion increase in the GGS’s borrowings. Interest is costing the GGS $19.6 million per day ($16.5 million last year). 

The GGS reported borrowings of $165.2 billion at 30 June 2025.

The State maintained its credit ratings, however, S&P Global has indicated a risk of downgrade still exists

Both Moody’s and Fitch maintained the State’s credit rating at triple-A with a stable outlook in September 2025. 

In November 2025, S&P Global reaffirmed its AA+ rating and maintained its negative long-term outlook. The negative outlook signifies a risk that the State's financial management or budgetary performance could weaken over the next two years.

Recommendations

All recommendations from our ‘State finances 2024’ report were addressed by NSW Treasury in 2024–25. No additional recommendations were made for 2024–25, apart from those to agencies that will appear in our ‘State agencies 2025’ report.

Appendix 1 – Status of 2024 report recommendations

Appendix 2 - Prescribed entities

Appendix 3 - Controlled entities

 

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Published

Actions for State agencies 2025

State agencies 2025

Communities
Education
Environment
Finance
Health
Industry
Justice
Planning
Premier and Cabinet
Transport
Treasury
Whole of Government
Asset valuation
Climate reporting
Compliance
Contingent labour
Cyber security
Financial reporting
Financial sustainability
Fraud
Information technology
Infrastructure
Internal controls and governance
Management and administration
Procurement
Regulation
Risk
Service delivery
Software assets

This report provides an overview of the key findings and recommendations from our audits of the 40 largest NSW state sector agencies for the financial year ended 30 June 2025. It also focuses on the government’s management of contingent workers, software assets, and climate reporting as these areas are critical for government efficiency, accountability, and transparency.

Key findings

Unqualified audit opinions were issued for all 30 June 2025 general purpose financial statement audits – with one exception.

A qualified audit opinion was again issued on the Wentworth Park Sporting Complex Land Manager’s financial statements because of insufficient evidence to support the recognition of a $6.5 million non-interest bearing loan.

There were 57 uncorrected misstatements totaling $397 million this year, compared with 88 uncorrected misstatements totaling $232 million in 2023–24.

Deficiencies were found in the completeness and accuracy of asset data

Asset registers were not consistently reconciled with asset management systems, leading to unexplained differences in source data records and unexplained reconciling items.

There are continuing deficiencies in the completeness and accuracy of Crown Land asset records.

Weaknesses in payroll controls led to staff overpayments

One agency continued paying 481 terminated employees, despite some terminations dating back to 2018. In one case, an employee was overpaid more than $295,000, over three years, after resigning in 2021. The agency is taking reasonable steps to recover these overpayments.

Ineffective oversight in the acquittal of grant programs

One agency had deficiencies in the financial acquittal of a grant program, increasing the risk of mismanagement as funds were allocated to third parties without effective oversight.

Contingent workers are being engaged for extended periods of time

Of the 15 agencies assessed, 227 contingent workers have held roles for more than five years, with one contract lasting over a decade.

There were 17 contingent workers paid more than $550,000 each, placing them in a salary range equivalent to, or above, Band 4 senior executive level. While justification for these salaries may be reasonable due to specialist skills, detailed assessment and market evaluation should be performed.

The Single Digital Patient Record (SDPR) project business case was inaccurate

The initial business case did not include all relevant project costs, and estimated operational costs lacked sufficient or reliable evidence.

The State has implemented first-year climate-related financial disclosure reporting

In 2024–25, 27 state agencies prepared climate-related financial disclosures. Unmodified assurance reports were issued for the three engagements completed as part of the climate disclosure assurance pilot.

Recommendations

Six recommendations were made to state agencies and NSW Treasury to implement (see section 2.4. Recommendations for full details).

This report provides an overview of the results and key findings from the year-end financial audits for 2024–25. The report also comments on the NSW Government’s management of:

  • contingent workers
  • software assets
  • climate reporting.

These topics were chosen as these areas are critical for government efficiency, accountability and transparency.

This is the second of four Auditor-General reports focused on financial audits undertaken in the NSW public sector for 2025. The other three reports in the series are as follows:

  • Internal controls and governance: Procurement and technology, published on 29 October 2025, which analyses the internal controls and governance of 26 of the largest state-sector agencies in NSW for the 2024–25 financial year. This report also includes findings on the focus areas of NSW Government procurement, cyber security and AI.
  • State finances which will focus on the NSW Government’s consolidated financial statements of the general government and total state sectors for 2024–25.
  • ‘Capital projects’, which will assess procurement and project management of major infrastructure and investment projects in NSW.

Financial audits provide independent opinions on the financial statements of state agencies. They are designed to give reasonable assurance that financial statements are true and fair, thus enhancing users’ confidence in financial statements.

This report analyses the year-end financial audit results of the state agencies. It is important that agencies prepare financial statements that are free from material error:

  • to ensure transparency, accountability and confidence in public sector financial management
  • because agencies deliver a wide range of services and are exposed to varying degrees of financial, operational and strategic risk, each presenting unique challenges to accurate financial reporting.

This report provides insights relating to the following important areas of public sector financial accounting and management, which carry elevated operational complexity, financial risk and long-term sustainability implications.

ChapterObjective
Financial audit results

Chapter 4 provides an overview of year-end audits of state agencies.

Chapter 5 examines the key financial and operational control deficiencies identified, which agencies should address.

Contingent workforce management

NSW agencies are reliant on contingent labour for critical roles and projects. While this brings flexibility and access to specialist skills, it also introduces risks around cost, oversight and planning. The Contingent Workforce Management Guidelines issued by the NSW Public Service Commission state that contingent workers should only be used when there is a clear shortage of required skills in the labour market, when an immediate solution is needed pending recruitment, or for time-limited projects

Chapter 6 examines how effectively agencies are managing their contingent workforce to ensure spending is optimised.

Software assets

Software assets form a significant part of the NSW Government’s asset portfolio, with a reported value of $5.0 billion as at 30 June 2025. Software assets comprise both internally developed and externally acquired IT systems and applications. Despite their non-physical nature, these assets are critical enablers of NSW Government public service delivery, digital transformation and operational efficiency across government agencies.

Chapter 7 examines how effective agencies are accounting for software assets and managing software/ IT projects to ensure project benefits and objectives are achieved.

Climate reporting

NSW Treasury has implemented climate-related financial disclosure (climate disclosures) reporting requirements for state agencies. A total of 27 state agencies were required to include climate disclosures in their annual reports, or a stand-alone climate report in 2024–25. It will be mandatory for these Phase 1 agencies to have their disclosures assured from 2025–26. To support this transition, the Audit Office of New South Wales and NSW Treasury ran a pilot program where agencies could nominate to have their 2024–25 disclosures voluntarily assured by the Audit Office.

Chapter 8 examines results and findings from these climate reporting pilot assurance engagements, including the Audit Office’s assessment of agencies’ readiness for climate reporting.

This chapter summarises the 2024–25 financial audit results for state agencies. Financial reporting is an important element of good governance. Confidence in, and transparency of, public sector decision-making is enhanced when financial reporting is accurate and timely.

Chapter highlights
  • Except for one agency, unqualified audit opinions were issued for all completed audits of state agencies’ 2024–25 financial statements.
  • A qualified audit opinion was again issued to the Wentworth Park Sporting Complex Land Manager’s 30 June 2025 financial statements.
  • A disclaimer of opinion was issued for the First Australian National Mortgage Acceptance Corporation (FANMAC) Master Trust’s 30 June 2023 financial statements.
  • For 2024–25 audits, $397 million (2023–24: $232 million) of uncorrected misstatements (on a gross basis) were found. The number of uncorrected misstatements for 2024–25 was 57 (2023–24: 88).
  • Three or more versions of financial statements were submitted by 76 agencies, which can indicate poor-quality financial reporting.
  • Hard close procedures helped to improve financial reporting timeliness.

Financial audits focus on the key internal controls and governance that support the preparation of financial statements. Breakdowns and weaknesses in internal controls increase the risk of fraud and error. Deficiencies in internal controls, matters of governance interest and unresolved issues identified in the final phase of financial audits were reported to management and those charged with governance of each agency so they can take appropriate action to mitigate the identified risk.

This chapter outlines observations and insights from the year-end financial statement audits of the 40 largest agencies in the state sector. These agencies are listed in Appendix 2.

Chapter highlights
  • Three high-risk findings were identified during 2024–25, with two being ongoing issues from prior years. These relate to control deficiencies in governance and asset management.
  • Deficiencies were found in:
    • the completeness and accuracy of asset data
    • payroll controls leading to staff overpayments
    • the acquittal of a grant program
    • governance controls, including management of conflict-of-interest (COI) declarations
    • the reporting and management of contracts and related controls.

This chapter presents key insights from analysis of 15 selected state agencies and their use of contingent workers. NSW agencies rely on contingent labour for critical roles and projects. While this brings flexibility and access to specialist skills, it also introduces risks around cost, oversight and planning.

Chapter highlights
  • Deficiencies were found in contingent workforce management.
  • Contingent workers are being engaged for extended periods of time.
  • Contingent workers are being paid in salary ranges equivalent to, or in excess of senior executives.
  • Some agencies lack oversight of contingent labour, however some maintained robust systems.

The Contingent Workforce Management Guidelines issued by the NSW Public Service Commission (PSC) include that contingent labour should be used when there is a clear shortage of required skills in the labour market, when an immediate solution is needed pending recruitment, or for time-limited projects requiring expertise not needed in the ongoing workforce. The use of contingent workers must respond to business objectives, be the most efficient and effective option, and be integrated with broader workforce planning – ensuring it is not used to bypass recruitment processes or for long-term roles that could be filled by direct employment.

This chapter presents key insights from analysis of seven selected state agencies’ accounting and management of software assets.

Chapter highlights
  • In 2024–25, state agencies expensed over $95 million in software costs due to incorrect capitalisation of expenses and project cancellations.
  • The monitoring and oversight of IT project delivery varies across the sector.
  • A major IT initiative is currently being undertaken in the health sector, the Single Digital Patient Record (SDPR). The business case did not capture all relevant project costs and the estimated operational costs were not supported by sufficient or reliable evidence.

Software assets form a substantial part of the NSW Government’s asset portfolio. As at 30 June 2025, software assets had a carrying amount of $5.0 billion, reflecting an increase of $1.0 billion since 30 June 2021.

Software assets comprise both internally developed and externally acquired IT systems and applications. Despite their non-physical nature, these assets support public service delivery, digital transformation and operational efficiency across government agencies. The following figure details state agencies with software capital expenditure greater than $50 million in 2024–25.

The NSW Government legislated its commitment to achieving net zero emissions by 2050 in the Climate Change (Net Zero Future) Act 2023. This Act establishes principles, targets and a commission to monitor the State’s climate progress.

NSW Treasury issued TPG24-33: Reporting Framework for Climate-Related Financial Disclosures (TPG24-33) to provide transparency over entities’ exposure to and management of climate-related risks and opportunities, and to support enhanced decision making. Climate related-financial disclosures also support the objectives of the Act.

TPG24-33 aligns with the Australian Accounting Standards Board’s (AASB) sustainability reporting standard, AASB S2 ‘Climate-related Disclosures’ and has been tailored by NSW Treasury to reflect the specific circumstances and capabilities of state agencies.

In Phase 1 of climate reporting, in 2024–25, a total of 27 state agencies were required to include climate disclosures in their annual reports, or in a stand-alone climate report. It will be mandatory for these agencies to have these disclosures assured from 2025–26.

A list of Phase 2 climate reporting state agencies was recently published by NSW Treasury, with mandatory disclosures for these entities required for 2025–26. Phase 1 and Phase 2 reporting agencies are listed in Appendix 3 of this report.

In July 2025, the Treasurer requested the Auditor-General to provide assurance over climate-related financial disclosures. The request included:

  • assurance on the climate-related financial disclosures of four Phase 1 pilot entities in 2024–25
  • assurance of 2025–26 disclosures of all Phase 1 entities, including a review of their disclosures prepared for 2024–25 by the end of this calendar year.
Chapter highlights
  • Unmodified limited assurance opinions were issued for three completed 2024–25 climate pilot assurance engagements.
  • The Audit Office of New South Wales 2024–25 climate assurance pilot identified areas of improvement where agencies can strengthen their climate disclosure practices and readiness for climate assurance. Key recommendations included ensuring agencies:
    • complete gap analysis against TPG24-33 requirements to ensure all disclosure requirements are being addressed
    • develop and implement a climate disclosure preparation plan
    • define reporting boundary and materiality to guide climate disclosure preparation
    • complete and document their climate risks and opportunities assessment
    • embed climate risks and opportunities into their enterprise-wide risk management process
    • develop an emissions inventory covering all material emissions sources within their operational boundary, including plans for closing any gaps over time
    • develop emissions reporting processes supported by informed emissions accounting policies
    • develop plans to address reported gaps in governance, climate risk identification and emissions reporting to ensure disclosure requirements are enhanced in future reporting periods.
  • Agencies are using different systems and processes to calculate emissions, which could affect the consistency and reliability of emissions reporting across the sector.
  • Agencies used different methods and formats when preparing 2024–25 climate disclosure.

Appendix 1 – Audits still in progress

Appendix 2 – Agencies included in report

Appendix 3 – Climate reporting agencies

Appendix 4 – In-scope TPG24-33 disclosure requirements

 

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Published

Actions for Members' additional entitlements 2025

Members' additional entitlements 2025

Premier and Cabinet
Whole of Government
Compliance

Members’ entitlements refer to the payments that Members of Parliament (members) are eligible to claim under the Parliamentary Remuneration Tribunal’s Annual Determination (the Determination) and the administrative guidelines of the Department of Parliamentary Services (the guidelines). These entitlements are designed to support members in performing their parliamentary duties and can include travel, communication and skills development.

This report reviews compliance in the 2024–25 financial year.

Key findings

There were 35,151 payments made to members for entitlements – totalling $26.4 million.

Of these, 33,450 claims for payment – totalling $13.8 million – were in the scope of this compliance review. The remaining payments of $12.6 million (annual basic salaries, and electoral and committee allowances) were not within scope of this review.

From a sample of 59 claims for the 2024–25 period, there were 29 departures from the requirements of the Determination and the administrative guidelines.

Loyalty and incentive scheme declarations (such as frequent flyer points) must be submitted at the end of financial year (ie 30 June) or within 30 days of ceasing to be a member. This review looked at 141 loyalty and incentive scheme declarations and found that three were submitted late.

Recommendations

The Department of Parliamentary Services should:

  • evaluate the effectiveness of its training for members and consider other measures to improve the timelines of claim submissions
  • consider conducting its annual internal audit process earlier in the year to identify audit findings sooner to better support members in meeting the requirements of the Determination and the guidelines.

The Parliamentary Remuneration Tribunal makes an Annual Determination outlining the annual salaries and additional entitlements allowed to Members of the Parliament of New South Wales under the Parliamentary Remuneration Act 1989.

The Determination requires members’ claims for additional entitlements comply with the Department of Parliamentary Services’ administrative guidelines. The Department administers payments of additional entitlements.

This report reviews the compliance of members’ claims for additional entitlements payable under the Determination.

During the 2024–25 financial year 35,151 payments were made to Members of Parliament for entitlements under the Determination totalling $26.4 million. Of these, 33,450 claims for payment of additional entitlements totalling $13.8 million were within the scope of the compliance review by the Audit Office of New South Wales. The remaining payments of $12.6 million made during the 2024–25 financial year were not reviewed as there are certain salaries and allowances within the Determination that are excluded from compliance review requirements. These payments include:

  • annual basic salaries, additional salaries and additional expense allowances
  • additional entitlements comprising electoral allowances and committee allowances.

Payments within the scope of this compliance review are set out below.

There were more departures from the requirements of the Annual Determination (the Determination) and the administrative guidelines of the Department of Parliamentary Services (the Department) in 2024–25 than in previous years. These departures were similar in nature to those consistently identified in the Audit Office’s previous compliance reviews, indicating a need for improved training and education for members.

From a sample of 59 claims and 141 annual loyalty and incentive scheme declarations submitted by members, the Audit Office identified 32 departures from Determination requirements and the administrative guidelines of the Department. These included:

  • 26 claims for payment that were not submitted within 60 days of receipt of invoice or incurring the expense (2023–24: 21 claims)
  • 3 claims under the communications allowance relating to publications that did not include the required authorisations and attributions (2023–24: one claim)
  • 3 members who submitted their annual loyalty/incentive scheme declarations after the date specified in the Department’s administrative requirements (2023–24: five members).

The following table summarises the instances of non-compliance with the Determination and Department guidelines identified through Audit Office compliance reviews over the past three years.

 

2024–25

2022–23

2021–22

Late submission of claims for payment

26

21

22

Late submission of Sydney allowance reconciliations

4

Ineligible claims for communications allowance

3

1

2

Communications allowance claims made during blackout period#

1

Annual loyalty and incentive scheme declarations not submitted

4

Late submission of annual loyalty and incentive scheme declarations

3

5

7

Total number of departures from the Determination

32

27

40


# Blackout periods are applicable only to election years.

 

This compliance review considers 33,450 claims totalling $13.8 million made by Members of Parliament in 2024–25. The following summary outlines the additional entitlements within the scope of this review.

The 2024 Report to Parliament on members’ additional entitlements made five recommendations.

The table below describes the status of these recommendations.

RecommendationCurrent status 
The Department should improve its quality review process when reporting the number and total dollar value of members’ additional entitlement claims to ensure it is accurately reporting the number and value of claims.The Department applied satisfactory quality review processes over members’ entitlements data prior to submission to the Audit Office.Fully addressed
The Department should ensure internal audits of members’ additional entitlements are adequately scoped, quality reviewed and endorsed prior to their commencement. The scoping should ensure requirements of the Determination are considered and achieved.

Last year the compliance review identified that the Department’s 2023–24 internal audit of members’ additional entitlements did not meet the requirements outlined in the Determination. This was because the scope was limited to communications allowance claims, and excluded the Sydney allowance and all other fixed allocation allowances.

This year:

  • a further internal audit for 2023–24 was performed for the Sydney allowance and all other fixed allocation allowances, and was finalised on 8 January 2025
  • the scope of the 2024–25 internal audit incorporates all additional entitlements required by the Determination, but the internal audit is yet to be concluded.
Fully addressed

Prior to the Audit Office’s compliance review commencing each year, the Department should ensure:

  • its annual internal audit on members’ additional entitlements is completed
  • the final report of the internal audit is ready to provide to the Audit Office.

This has not progressed.

Similar to last year, the internal audit of members’ additional entitlements for 2024–25 was in progress at the same time as the Audit Office’s compliance review and is yet to be concluded at the date of this report.

Section 4.2 recommends the Department should conduct its internal audit earlier to allow for earlier identification of member claim non-compliance.

Not addressed
Prior to payments being made, the Department should enhance its assessment as to whether members’ expenditure claims comply with the requirements of the Determination and the administrative guidelines of the Department and advise members promptly about whether their claims are ineligible.

The Department has determined that it will not review compliance of members’ claims at the time of payment as it:

  • considers the self-assessment regime sufficient as the key principle underpinning the administration of claims for additional entitlements
  • views its internal audit review process as providing sufficient assurance to help identify risk of non-compliance.
Risk accepted by the Department

The Tribunal should provide greater clarity on current processes and the implications of departures from the guidelines to members.

The Department should work with members to provide them with additional training or education and better help them to comply with the Determination and the administrative guidelines of the Department.

This has not progressed.

Additional recommendations relating to the Department are outlined in section 4.1. This includes assessing the effectiveness of its existing training and education to members and considering other measures to enhance timeliness of claim submissions.

Not addressed

 

Appendix 1 – Response from the Department of Parliamentary Services

 

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Published

Actions for Internal controls and governance 2025: Procurement and technology

Internal controls and governance 2025: Procurement and technology

Whole of Government
Compliance
Cyber security
Financial reporting
Fraud
Information technology
Internal controls and governance
Management and administration
Procurement
Project management
Regulation
Risk
Service delivery

Internal controls and governance help agencies achieve their outcomes by supporting effective operations, reliable financial reporting, and legal compliance. This report provides Parliament with insights from financial audits of 26 major NSW public sector agencies, focusing on the effectiveness of their internal controls and governance. It presents observations across key elements of these frameworks.

Key findings

Internal control findings have decreased

Audit findings on internal controls and governance were reported across all 26 agencies. While the total number of findings decreased in 2024–25 compared to the 2023–24 interim audits, repeat findings rose and now account for 33% of all reported issues.

IT controls need to improve

Five high-risk findings were reported, all related to ineffective IT controls, including those designed to prevent cyber security incidents. Approximately half of all findings involved IT controls over key financial systems.

Deficiencies in procurement practices

Agency procurement practices show deficiencies in policy alignment, capability, and oversight. Many do not fully incorporate mandatory requirements of the NSW Procurement Policy Framework, and procurement training is either lacking or not mandatory. Around half lack formal policies for best and final offer processes, and supplier relationship management is inconsistently applied, limiting value-for-money assurance.

While all agencies have conflict of interest policies, some are outdated and lack mechanisms for managing complaints, with over half failing to review centralised registers before awarding contracts.

Agencies can better integrate AI into their existing governance and strategy arrangements

Agencies are beginning to adopt AI but have yet to fully integrate it into governance and strategic planning. Fewer than half have formal AI policies or have embedded AI into existing frameworks to guide responsible use. Only a quarter have developed strategies to maximise AI’s benefits, and AI is not yet widely used as a strategic or operational tool across the sector.

Cyber security control deficiencies expose supply chains to vulnerabilities and undermine investment effectiveness

Control deficiencies make agencies vulnerable to supply chain cyber security threats and reduce investment effectiveness.

Three agencies lack formal policies addressing supply chain cyber risks, and eight do not have strategies to maintain complete IT asset registers, limiting visibility of systems. Weak third-party oversight was observed, including unclear contractual roles and limited post-termination planning. Additionally, not all agencies conduct cost–benefit analyses or align cyber security spending with threat landscapes, and only seven actively manage underutilised or outdated cyber security tools.

Recommendations

The report recommends that agencies strengthen controls and processes across three key areas: procurement frameworks, adoption of artificial intelligence, and cyber security controls.

Chapter 3 provides key areas of improvement and practical lessons for NSW government agencies in considering the effectiveness of their internal controls and governance.

This report analyses the internal controls and governance of 26 of the NSW public sector’s largest agencies. These agencies account for 95% of the NSW Government’s budgeted expenditure for 2024–25. The report provides Parliament with insights into the effectiveness of internal controls and governance in these agencies, including:

  • an overview of the results of interim financial audits for 2024–25
  • analysis of the effectiveness of these controls at selected agencies for certain important areas of public sector governance:
    • procurement
    • technology, including cyber security and emerging technologies like artificial intelligence
  • key areas of improvement and practical lessons for NSW government agencies in considering the effectiveness of their internal controls and governance.

Refer to Chapter 3 for key areas of improvement and practical lessons for agencies and Appendix 1 for details of the agencies selected for inclusion in each chapter of this report.

This is the first of four financial audit reports focused on financial audits undertaken in the NSW public sector for 2025. The other three reports in the series are:

  • State agencies, which will bring together the final results of, and insights from, audits of financial statements of all NSW public sector agencies for 2024–25
  • State finances, which will focus on the NSW Government’s consolidated financial statements of the general government and total state sectors for 2024–25
  • Capital projects, which will assess procurement and project management of major infrastructure and investment projects in NSW.

This chapter outlines key areas of improvements and practical lessons that can be applied by all agencies in designing and maturing internal controls and governance in respect of procurement and technology, including cyber security and emerging technologies like artificial intelligence.

Procurement

Procurement policies and frameworks

Procurement and contract management are foundational activities that support the delivery of public services in NSW. Ensuring the right oversight mechanisms are in place will promote value-for-money outcomes and mitigate risk. Agencies should:

  • use internal audit to obtain assurance on how procurement is being managed and delivered within an agency, in support of continuous improvement
  • establish structured reporting mechanisms, including use of key performance indicators, to executive management to enhance visibility of procurement activities and support executive-level accountability
  • develop centralised systems or formal processes to track procurement performance and supplier outcomes, enabling better oversight and data-driven decision-making.

People and capability

Building capability for procurement within agencies will promote procurement that achieves value-for-money outcomes. Agencies should strengthen learning and development frameworks by mandating procurement training for all relevant staff, including non-specialist roles, to ensure consistent capability across the agency.

Business cases

If business cases are not prepared, agencies risk delays, non-compliance and poor value-for-money outcomes. Agencies should take steps to embed business case procedures into procurement policies and guidance. Procedures should be tailored to the context of agencies and with appropriate staff capability to ensure that they address key risks.

Due diligence

Supplier performance risk can be mitigated from the outset of a contract by having in place robust due diligence processes. Agencies should:

  • strengthen due diligence frameworks by implementing clear, risk-based procedures that align with guidance from ICAC
  • undertake financial assessments at engagement and regular intervals throughout the construction contract lifecycle in accordance with the requirements of the Framework.

Conflicts of interest

Management of conflicts of interest is fundamental to ensuring procurement outcomes that promote public trust and ensure value-for-money. Agencies should take steps to promote effective management of conflicts by:

  • ensuring that centralised conflict of interest registers capture declarations across all staff categories and business units, where possible, to provide oversight and assurance that conflicts are being actively identified and associated risks are being managed
  • implementing structured, periodic reporting to governance bodies or accountable authorities on conflict of interest compliance, with particular focus on high-risk procurement processes
  • reviewing centralised conflict of interest registers prior to awarding procurement contracts to identify any undeclared conflicts and ensure that associated risks are appropriately managed.

Contract extensions

Poorly managed contract extensions can undermine procurement integrity by bypassing competitive processes, diminishing value-for-money outcomes and exposing agencies to financial and governance risks. Extending contracts should be undertaken where there are clear value-for-money outcomes. Agencies should:

  • mandate formal value-for-money assessments
  • document contractor performance
  • consider market alternatives before approving extensions.

Best and Final Offer

Without robust and transparent Best and Final Offer processes, agencies risk undermining competition, eroding supplier trust and compromising value-for-money outcomes. Agencies should have a clear policy and approach to best and final offers to promote competition, support transparency and maximise value-for-money outcomes. Agencies should take steps to:

  • clarify procedures within their procurement policies and processes
  • communicate requirements clearly in tender documentation.

Contract and supplier management

In the absence of robust contract and supplier management processes, agencies face increased risks of supplier underperformance, missed cost-saving opportunities and diminished accountability in achieving procurement outcomes. Agencies should strengthen procurement management by:

  • adopting a formal supplier relationship management framework
  • mandate the use of key performance indicators, regular performance reviews, root cause analysis, structured contract closure processes and evaluate outcomes.

 

Artificial intelligence (AI)

Governance and oversight

As AI becomes increasingly common in agency IT environments, it is necessary for agencies to maintain suitable governance and oversight of both the AI pipeline and AI tools used in production.

While it is not mandatory for NSW public sector agencies to apply the National framework for the assurance of artificial intelligence in government, it specifically identifies that: 

‘Governments should ensure their use of AI is disclosed to users or people who may be impacted by it. Governments should maintain a register of when it uses AI, its purpose, intended uses, and limitations’.

Strategic use of artificial intelligence

When senior leaders are kept informed of both the opportunities and the challenges associated with AI, they are better positioned to champion strategic initiatives, address resource needs, and ensure that ethical and governance standards are upheld throughout the organisation.

 

Cyber security

Managing supply chain cyber security risks

The foundation of an effective cyber security strategy is knowledge about the IT environment. Maintaining an IT asset inventory is crucial for strong cyber security as it provides visibility into what needs to be protected, enabling better risk management, threat detection and incident response.

Unmonitored external systems, such as those managed by third-party vendors and overall supply chain, can introduce further risks if they do not adhere to the agency’s security standards.

Furthermore, not including supply chain risk in the risk register means that these risks are not being tracked or managed effectively. This oversight can result in a lack of preparedness for potential cyber incidents involving third-party vendors.

Cyber security spending

Effective management of cyber security investment helps agencies to ensure that their investments are yielding the desired results, in compliance with regulations, and ultimately safeguarding their operations while ensuring an effective and efficient spending on cyber security.

 

This report provides Parliament with insights into the effectiveness of internal controls and governance at 26 of the largest NSW public sector agencies (excluding state owned corporations and public financial corporations). A list of the agencies included in each the analysis included chapter of this report is available at Appendix 1.

Internal controls and governance support the achievement of agencies’ outcomes by promoting effective operations, reliable financial reporting, and compliance with applicable laws and regulations.

Effective internal controls and governance are particularly important for the agencies included in this report because they collectively accounted for 95% of the NSW Government’s total budgeted expenditure in 2024–25. These agencies also deliver diverse services and are exposed to financial, operational and strategic risk.

Australian Auditing Standard ASA 315 ‘Identifying and Assessing the Risks of Material Misstatement’ requires an auditor to obtain an understanding of the design and implementation of the internal controls relevant to the preparation of financial statements. Observations and findings drawn from the application of this standard in financial audits of agencies form the basis of the report.

The table below details the elements of internal controls and governance that are detailed in this report.

ChapterOverview
Internal controls and governanceChapter 5 provides an overview of the findings and deficiencies in internal controls and governance identified in interim audits at all 26 agencies.
Procurement

Procured goods and services are one of the NSW Government’s largest areas of expenditure.

Chapter 6 examines the extent to which 17 agencies, with more material procurement activities, comply with selected NSW Government mandatory requirements and recommendations.

Technology - Artificial intelligence

Agencies are increasingly integrating emerging technologies like AI to streamline operations, foster innovation and enhance delivery of public services. To safeguard ethical standards and uphold the integrity of public institutions, as well as the rights of the public, it is essential that agencies establish robust internal controls and governance frameworks to guide the development, deployment and oversight of AI technologies.

Chapter 7 examines the current and future planned use of AI and governance, risk and assurance mechanisms to support ethical adoption of AI by 21 agencies who advised they had implemented AI.

Technology - Cyber security

Cyber risk is a critical concern. Cyber threats can disrupt operations and compromise sensitive data and assets. The dependence on third-party vendors and overall supply chains introduces risk, as these external partners may not have the same level of cyber security maturity as is expected of agencies.

Chapter 8 examines how 20 agencies are managing and mitigating cyber risks in supply chains and maximising the return on investment in tools that mitigate and manage cyber security.

Technology - Information technology controlsChapter 9 examines the key IT control findings and deficiencies internal controls identified in interim audits at all 26 agencies.

 

A strong system of internal controls and governance enables agencies to operate effectively and efficiently, produce reliable financial statements, comply with laws and regulations, and support ethical and transparent decision-making. Good governance promotes public confidence in the integrity and effectiveness of agencies’ systems and operations.

Financial audits include:

  • procedures to understand the design, implementation and operating effectiveness of internal controls and governance relevant to the preparation of an agency’s financial statements
  • consideration of the extent to which an agency has complied with applicable laws, and the regulatory and policy requirements relevant to financial management and reporting.

This chapter highlights findings relating to internal controls and governance from 2024–25 interim audits at 26 agencies. A list of agencies included in this chapter is included at Appendix 1.

Chapter highlights

  • Internal control findings decreased, but agencies should take action to address repeat findings. Repeat findings have increased and now represent 33% of all findings, compared with 19% in 2023–24. Findings on the design, implementation or operating effectiveness of internal controls and governance were identified at all agencies.
  • IT controls and governance need to improve. Approximately half of all findings reported related to IT controls. Five high-risk findings were reported, all of which related to ineffective IT controls, including those that prevent cyber security risks.
  • Common findings identified indicate that agencies need to improve the design or effectiveness of internal controls and governance processes relating to two of the largest areas of expenditure for the NSW Government, payroll and supply of goods and services expenses, to mitigate the risk of loss, error or fraud.

Effective internal controls and governance over procurement should enable an agency to deliver services to the public efficiently and effectively and ensure that value-for-money is achieved for each dollar of public funds invested.

This chapter examines the extent to which agencies:

  • procurement policies comply with the selected NSW Government mandatory and recommended procurement requirements
  • have established controls to ensure they deliver value-for-money in procurement outcomes.

This chapter focuses on the selected key mandatory requirements and best practice outlined in the NSW Procurement Policy Framework (the Framework). The accountable authority for each agency holds ultimate responsibility for managing agency procurement activities in accordance with the Framework.

As explained in Appendix 1, this chapter includes 17 of the agencies included in this report. These agencies were selected for analysis as they undertook more material procurement of goods and services. Seven of these agencies also undertake more significant construction activities. For other agencies, procurement was less material or mainly involved expenditure with other NSW government agencies, for which some of the mandatory requirements of the Framework do not apply.

Chapter highlights

  • Deficiencies in end-to-end procurement and contract management practices mean that value-for-money could be eroded. Agencies’ procurement policies and procedures do not consistently incorporate all mandatory and recommended requirements of the Framework examined in this chapter.
  • Not all agencies provide mandatory training on procurement to their staff. Lack of knowledge and capability around procurement processes can expose agencies to risk and limit achievement of value-for-money.
  • Agencies have developed guidance or require due diligence procedures to be undertaken when planning a procurement, however some agencies were not applying the guidance in the Framework to assess supplier viability for high-value construction contracts at periodic intervals.
  • There are inconsistent practices for the review, reporting and oversight of conflict of interest disclosures. More than half of the agencies do not formally review centralised conflict of interest registers to detect undeclared conflicts before awarding procurement contracts.
  • Not all agencies have developed formal policies and processes for the application of Best and Final Offer principles, reducing opportunities to achieve value-for-money outcomes.
  • Agencies have inconsistent approaches to assessing the value for money of contract extensions. Contract extension practices vary, with inconsistent documentation and limited post-project reviews.
  • Not all agencies adopt a supplier relationship management approach to managing suppliers. Not all agencies set key performance indicator to manage supplier performance. Inadequate supplier performance management and evaluation can limit the ability to demonstrate that procurement decisions represent value-for-money or achieve intended benefits.
  • The extent to which agencies have begun applying Anti-slavery frameworks and guidance in their procurement practices is variable.

Agencies are increasingly integrating emerging technologies like artificial intelligence (AI) to streamline operations, foster innovation and enhance delivery of public services.

This chapter examines:

  • the use of AI in the 21 agencies that reported having adopted AI
  • whether appropriate governance, risk and assurance mechanisms are in place to support ethical adoption in line with NSW Government policy and framework requirements
  • future plans and strategies for use of AI by agencies.

As explained in Appendix 1, this chapter includes 21 of the agencies included in this report. These agencies were selected as they had implemented AI.

Chapter highlights

  • Agencies are using AI for a variety of purposes, and its use will continue to grow. The adoption of a total of 357 different AI tools, either in pilot or fully implemented, was reported across 21 agencies. Several challenges and barriers affecting the adoption and use of AI have been noted by agencies, including the development of governance frameworks, management of data sensitivity, security and quality, limited AI literacy, and technical issues such as integration with existing IT systems.
  • Agencies should better integrate AI considerations into their existing governance arrangements. Fewer than half of the agencies have implemented formal AI policies and most have yet to fully integrate the specific and unique risks posed by AI into their existing governance frameworks. This includes evaluating its broader impacts on accountability structures, policies and procedures (such as information technology, procurement, risk management), and monitoring and reporting systems.
  • Agencies can improve the information they centrally capture about their AI tools by documenting information about purpose, intended use and limitations. A comprehensive inventory provides a clear, consolidated view of all AI in use, enabling agencies to monitor their deployment, assess their impact and manage risks, and ensure alignment with ethical and governance standards.
  • Around a quarter of agencies have a strategy to help maximise the benefits of AI. AI has not yet been integrated as a strategic or operational tool across the sector. Senior leaders need more oversight of AI use, risks and challenges to address barriers and align adoption to agency priorities and objectives.

Cyber security risk has become a critical concern for government. Cyber threats can disrupt operations, compromise sensitive data and damage reputations. The dependence on third-party vendors and overall supply chains introduces risk, as these external partners may not have the same level of cyber security measures in place as agencies. Understanding and managing cyber risk, including those from third parties, is essential for maintaining business continuity and protecting valuable assets.

Agencies have responded to such risks by implementing controls and investing in cyber security measures to protect their assets and data, in accordance with the requirements of the NSW Cyber Security Policy (CSP).

This chapter analyses how agencies:

  • manage their internal and supply chain cyber security risks
  • control and monitor their cyber security investments.

As explained in Appendix 1, this chapter includes 20 of the agencies included in this report. These agencies were selected as they were required to submit their own cyber security attestations to Cyber Security NSW. The other agencies rely on shared service arrangements and cyber security controls from other agencies.

Chapter highlights

  • Three agencies do not have a formal cyber security risk management policy that covers supply chain risks. Of 19 agencies that have established IT asset registers for internal and external systems, only 12 have a strategy to ensure the completeness of the register.
  • There are weaknesses in agencies’ management of supply chain cyber security risks. These included not clearly specifying cyber security roles and responsibilities in supplier contracts, excluding key third-party service providers in their cyber incident response plan testing, not enforcing third-party cyber security responsibilities and lacking formal processes to maintain cyber security and resilience after IT partnership or service agreement termination.
  • Agencies have weaknesses in their management of cyber security spending. Agencies are not consistently performing cost and benefit analysis, setting and monitoring investment/benefit realisation on cyber security investments, or ensuring security investments are aligned with agency cyber security needs and threats. Only seven agencies identify and manage underutilised, redundant or outdated cyber security tools and services.

Agencies rely on information technology (IT) systems to prepare their financial statements and deliver services to the public. Deficiencies related to Information Technology General Controls (ITGC) continue to be a key area of concern, accounting for half of all findings reported to the agencies included in this report. Of the five high-risk findings identified, all related to ITGCs for key financial systems.

Australian Auditing Standard ASA 315 Identifying and Assessing the Risks of Material Misstatement requires an auditor to:

  • understand the entity’s information system relevant to the preparation of the financial report
  • identify the specific risks arising from the use of IT (including cyber security risks) and evaluate the effectiveness of the entity’s controls that address those risks.

A list of agencies included in this chapter is included at Appendix 1. This chapter provides analysis of the reported ITGC and cyber security findings identified as part of financial audits for the 26 agencies included in this report.

Chapter highlights

  • Agencies have continued to face challenges in implementing appropriate controls to manage risks for key financial systems, including in relation to IT governance, user access, change management and cube security.
  • Three agencies did not have appropriate IT governance in place, including gaps in key policies, procedures and standards. Three agencies did not have appropriate assurance over controls at third-party vendors.
  • Not all agencies have taken steps to manage user access to key financial systems appropriately, increasing the risk of unauthorised access and loss. Key deficiencies include proper approval of user access provisioning, removal of user access on termination, regular revalidation of user access, monitoring of privileged user activities and implementation of password configurations.
  • Three agencies did not segregate developer access from access to migrate changes into the production systems. These ineffective change management controls may reduce system integrity at these agencies.
  • Three agencies lacked a formal disaster recovery plan (DRP) and testing for a key financial system, including two that did not undertake a disaster recovery test, increasing the risk that critical systems or operations may not be restored in a timely manner during a major disruption at these agencies.
  • One agency does not have adequate cyber security controls to detect or prevent cyber security incidents, including operating unsupported systems (including those that host crowns jewel applications) without a formal risk assessment or plan.

Appendix 1 – Agencies included in this report

 

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Published

Actions for Rail rolling stock procurement

Rail rolling stock procurement

Transport
Infrastructure
Procurement
Project management

Effective planning and procurement of rail rolling stock is critical to delivering safe, reliable, and cost-effective public transport for the people of New South Wales. These projects involve significant public investment and have long-term impacts on service quality, network integration, and value for money.

New South Wales has a comprehensive passenger rail network, including metropolitan lines in Sydney and regional lines across the state. Transport for New South Wales (TfNSW) is responsible for two major heavy rail fleet procurements: the New Intercity Fleet (NIF) and the Regional Rail Fleet (RRF). The procurement of these fleets is the focus of this audit.

This report was finalised in late September 2025. It references disputes with the private contractor, Momentum Trains and associated parties, regarding the Public Private Partnership (PPP) entered into for the RRF. Any resolution of the dispute will not affect the findings, conclusions, or recommendations of this report, which independently assesses how effective TfNSW was in identifying its business needs during the planning stage of procurement, and in ensuring probity and value for money.

I thank the contributing staff and executives from TfNSW for their significant input to this audit.

About this report

This audit assessed how effectively Transport for NSW (TfNSW) procured the New Intercity Fleet (NIF) and the Regional Rail Fleet (RRF).

The combined estimated capital-cost to completion of these procurements is currently $6.8 billion.

Findings

TfNSW did not effectively procure the New Intercity Fleet or the Regional Rail Fleet.

TfNSW did follow the processes required by the NSW Government and its own procurement policies, and managed probity and conflict of interest issues in alignment with those policies.

TfNSW did not effectively scope or estimate the full costs of the NIF or the RRF to inform assurance activities or investment decisions, and significantly underestimated the costs of enabling works for both projects.

TfNSW did not properly account for the number of NIF trains needed to avoid overcrowding, despite being aware overcrowding was likely on some peak services. This led to additional works and costs, including purchasing additional trains at higher prices.

TfNSW did not engage effectively with drivers and guards in planning and procurement. This limited its ability to manage the risks of industrial action, specifically those related to the decision for the NIF to be driver-only operated.

Documented ‘lessons learnt’ warned of the risks of using a Public Private Partnership (PPP) for the procurement of rolling stock, including the risks of variations. However, TfNSW did not effectively manage these elevated risks for the RRF, which were exacerbated by the decision to not include operation of the fleet in the PPP.

Recommendations

The audit makes six recommendations to TfNSW which relate to:

  • improving its use of demand forecasting to inform investment decisions and rail rolling stock procurement activities
  • introducing mandatory requirements for stakeholder consultation to inform rail rolling stock procurement projects
  • developing effective assurance processes at all project stages
  • improving public transparency by reporting clearly, consistently and comprehensively on the scope, timeline and costs of projects
  • ensuring written advice to Ministers and Cabinet is comprehensive, evidence-based and objective
  • maintaining and properly classifying records, including advice to Ministers and Government, at all project stages.

‘Intercity’ train services run from Sydney to the South Coast, the Blue Mountains, the Central Coast and Newcastle, as well as in the Hunter and Southern Highlands areas. Most of these routes are electrified (such as Sydney to Central Coast and Newcastle, Sydney to Lithgow, and Sydney to Kiama). Intercity routes that are not electrified (such as Kiama to Bomaderry and Campbelltown to Goulburn) use diesel-powered Endeavour train sets.

‘Regional rail’ services are long-haul diesel train services from Sydney to regional centres such as Grafton, Broken Hill, Armidale and Dubbo, as well as interstate train services to Canberra, Melbourne and Brisbane.

In 2023–24, NSW Trains reported that it used a network of 5,892 km of rail track. This included tracks owned by the Transport Asset Manager of NSW (approximately 2,600 km of operational rail tracks in regional NSW and 1,600 km in metropolitan Sydney). It also included tracks operated by the Australian Rail Track Corporation (ARTC), UGL Regional Linx, and interstate tracks owned by V/Line and Queensland Rail.

Appendix 1 – Response from entity

Appendix 2 – Overview of the trains referenced in this report

Appendix 3 – About the audit

Appendix 4 – Performance auditing

 

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

 

Parliamentary reference - Report number 417 - released 21 October 2025

Published

Actions for Revenue NSW’s administration of hardship assistance

Revenue NSW’s administration of hardship assistance

Finance
Service delivery

About this report

Revenue NSW is a division within the Department of Customer Service responsible for collecting fines and taxes, administering grants and recovering debt on behalf of state government agencies. As part of its role, Revenue NSW has a responsibility to ensure fines and debt processes do not have a disproportionate impact on vulnerable people.

Revenue NSW has a Hardship Policy to assist people experiencing hardship in accordance with its Customer Commitments which include acting with empathy, ease of access, situation resolution and clear explanations.

There are a range of payment options to provide hardship assistance under the policy including fine write-offs, payment plans and Work and Development Orders. Most decisions on hardship assistance are made by Revenue NSW. An individual can appeal a decision to the Hardship Review Board.

This audit assessed the effectiveness of Revenue NSW in delivering hardship assistance in compliance with relevant legislation, policies and guidelines.

Findings

Revenue NSW delivers assistance to people experiencing hardship using the range of payment options available under its Hardship Policy. It has established a governance framework to support effective implementation, including processes, procedures and delegations for assessing hardship applications.

Revenue NSW is not effectively monitoring, evaluating and reporting on the outcomes of the hardship assistance it provides under the Hardship Policy.

Revenue NSW can improve some of its processes that support it to make fair, consistent and transparent decisions on hardship assistance. It can also improve how it communicates decisions to people applying for hardship assistance.

Recommendations

The report makes five recommendations to:

  • evaluate and publicly report on the implementation of the Hardship Policy
  • improve quality assurance across fines and debt operations
  • improve correspondence to people seeking hardship assistance
  • improve the documentation of governance, risk management and ethics in artificial intelligence and automation used in fines and debt operations
  • communicate more clearly the role of the Hardship Review Board.

Published

Actions for Alternative school settings and home schooling

Alternative school settings and home schooling

Education
Service delivery

About this report

This audit assessed the performance of the NSW Education Standards Authority (NESA) and the NSW Department of Education in regulating home schooling and in providing alternative school settings, specifically: distance education schools, hospital schools, intensive learning support schools and youth justice centre schools. NESA regulated home schooling until 5 May 2025, when the function moved to the Department.

Findings

The Department and NESA have not effectively supported eligible students to receive a quality education in alternative school settings and home schooling. They have not:

  • defined the learning and wellbeing outcomes for students in these particular settings, or evaluated whether these settings are effective in achieving those outcomes
  • monitored or responded to demand for these settings, to make sure they are available and accessible in a timely way
  • supported student transitions into and out of these settings, so that continuity of education is maintained
  • proactively sought feedback from students and families to understand whether their needs are being met.

Recommendations

The audit makes three recommendations to the Department of Education, now responsible for regulating home schooling as well as for providing alternative school settings:

  • develop and implement a strategy for alternative school settings that recognises their specialised nature and
    • addresses demand
    • enables timely access
    • enhances departmental support for student transitions
    • establishes data and accountability mechanisms.
  • work with the home schooling community on reforms to regulation, including consideration of:
    • expedited registration processing
    • support for students’ transitioning into and out of home schooling
    • quality assurance mechanisms that recognise the unique features of home schooling.
  • identify the child safety monitoring risks in the alternative school settings and in home schooling regulation, and ensure fit-for-purpose mechanisms are in place to address these.

Previous reviews have identified areas for improvement in alternative school settings and home schooling but many of these are yet to be implemented

Alternative school settings and the regulation of home schooling have been in place for a number of decades (see section 2.3). Although each has been subject to at least one internal or external review, the Department of Education (the Department) and the NSW Education Standards Authority (NESA) (the agencies) have not actioned the resulting suggestions for improvement.

Relevant reviews of alternative school settings and home schooling include the following:

  • Distance education schools: The Department published its review of distance education schools in April 2025 (prior to this, distance education was reviewed 16 years ago, in 2009). The 2025 review found that the eligibility criteria for enrolment in distance education schools is restrictive and complex, resulting in barriers for students and inequitable access to education. It also highlighted inconsistencies between the different distance education schools in teaching, marking attendance and monitoring student outcomes, as well as outdated staffing and funding models that do not reflect the complexities of students who require distance education. At the time of writing the Department’s response was under development.
  • Hospital schools: The Department commissioned a review of hospital schools in 2020. The review found that the Department lacks sufficient data to assess if hospital schools meet the educational needs of all students in hospitals. Additionally, the review found that the location of hospital schools does not always align with the number of students in hospital.
  • Intensive learning support schools: The Department’s learning and wellbeing unit has previously reviewed the ‘4:1’ model for student attendance at intensive learning support schools (where students attend the support school for four days and their census (main) school for the remaining day). The Department could not locate this review report to provide it to the audit. However, staff and schools told the audit team that the review had found the 4:1 attendance model may be unsuitable for students in intensive learning support schools, as it makes it hard for students to connect to the mainstream school community, and may not address the challenges these students face in mainstream settings.
  • Youth justice centre schools: The Audit Office's 2016 audit on Reintegrating young offenders into the community after detention recommended that the (then) Juvenile Justice NSW work with the Department to roll out a statewide framework for transitioning school-aged young people from detention centres into the community. This was not done. A separate report from the NSW Advocate for Children and Young People on its consultations with young people in youth justice centres between 2015 and 2019 highlighted the importance of supporting children with education in youth justice centre schools, and identified that children leaving custody found it hard to re-engage in a school that catered to their needs.
  • Home schooling: A Parliamentary inquiry into home schooling practices in NSW reported in 2014. It concluded that the regulatory approach could be enhanced to maximise educational opportunities for home schooled children and better support the unique educational pathway of home schooling. The inquiry made 24 recommendations to address issues related to consultation with the home schooling community, the home schooling registration process, the regulatory body’s staff roles and training, unregistered home schoolers, child protection and wellbeing, quality assurance, resources and support for home schoolers, and data collection. The NSW Government supported 15 of these recommendations and NESA subsequently briefed the Education Minister on options to strengthen its powers to oversee home schooling practice after this inquiry, but these were not progressed. NESA also instigated four reviews into aspects of home schooling operations between 2020 and 2024, but they did not lead to any substantive changes to policy or process.

An Australian Senate inquiry into ‘school refusal’ – attendance difficulties associated with a level of emotional distress that means students may have trouble going to school or even leaving the house – reported in 2023. This recommended that state and territory education authorities investigate ways to increase the flexibility of education delivery, including by:

  • identifying ways to enhance flexibility in mainstream school settings for children experiencing school refusal
  • facilitating easier access to distance education and home schooling
  • providing more alternative and specialist school settings.

The NSW Government has not provided a formal response to this inquiry.

The Department considered the benefits and implications of transferring the regulation of home schooling from NESA

Following a request from the Minister for Education and Early Learning, the Department explored the implications, benefits and risks of transferring the home schooling regulatory function from NESA to the Department. This included considering the potential impact on home schooling stakeholders, relevant staff, the Department's resourcing, and opportunities to address child protection gaps and better support home schooling families with departmental educational resources. The Department briefed the Minister on these aspects.

The Department concluded that it has more resources than NESA to support and regulate the significant increase in the number of home schooled children over the last six years. It also observed that home schooling is regulated by the Department of Education in most other Australian jurisdictions.

The Department did not consult with the home schooling community before this change to regulatory responsibilities. On 20 March 2025, the Minister announced that the regulation of home schooling would move from NESA to the Department effective from 5 May 2025.

A number of stakeholders expressed concern to the audit about the decision. Many felt this would reduce flexibility, increase stress and hamper support for home schooling families. They were worried about potentially losing the flexibility to tailor education to their individual child’s needs and about home schooling becoming less accessible, because the Department was used to providing formal schooling. Stakeholders observed that families choose home schooling because the Department’s mainstream school system does not meet their needs.

The Department did not make any immediate changes to the way home schooling is regulated when it assumed responsibility from NESA. Possible areas of future reform it identified included enhancing connections between home schooling and tertiary or vocational education pathways.

The Department has created a new organisational structure to better utilise and support alternative school settings for students who cannot access mainstream schools

As detailed in the preceding chapters, the Department has administered alternative school settings as if they were mainstream schools, without recognising or supporting their tailored approaches for students unable to receive education in mainstream settings. The Department has also not identified the potential commonalities between the different types of alternative school settings and home schooling in terms of student needs, staff capabilities, or teaching and learning approaches.

Within each setting type, individual schools also largely operate in silos, with limited opportunities for school leaders or staff to connect and share similar experiences, challenges and good practices. In turn, these alternative school settings are disconnected from registered home schooling, with no understanding of the student movements between them.

In early 2025 the Department established two new directorates under a single executive director within its Public Schools Division to bring together most of the alternative school settings (distance education schools, hospital schools and youth justice centre schools) in one; and the regulation of home schooling in the other. Intensive learning support schools are not included under either directorate as they are considered schools for specific purposes (SSPs) along with SSPs that support students with disability. The Department is maintaining a strict separation of staff and functions between the two directorates, in recognition of the unique nature of home schooling and that regulating it is unlike the provision of public schools.

The aim of the new directorates is to better utilise and support alternative school settings to provide comprehensive public education to children who are unable to attend a mainstream school. This audit has identified gaps in the Department’s provision and management of alternative school settings, as well as in NESA’s regulation of home schooling. These include a lack of data and forecasting of demand, barriers to access, siloed operations, limited system-level support for student transitions and insufficient monitoring of student outcomes. These gaps will need to be addressed for the Department to achieve the new directorates’ reform objectives.

Appendix 1 - Response from entities

Appendix 2 - About performance audits

Appendix 3 - About the audit

Appendix 4 - Alternative school settings

Appendix 5 - Home schooling by area

Appendix 6 - Illustration of student transitions

 

Parliamentary reference - Report number 415 - released 25 September 2025

 

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Published

Actions for Coastal management

Coastal management

Planning
Environment
Local Government
Infrastructure
Management and administration
Risk

About this report

The coastal management framework under the Coastal Management Act 2016 (the Act), aims to deliver strategic and integrated management, use and development of the coast by state and local government for the social, cultural and economic wellbeing of the people of NSW.

The Department of Climate Change, Energy, the Environment and Water (DCCEEW) oversees and facilitates implementation of the framework by local councils in the coastal zone.

The Department of Planning, Housing and Infrastructure (DPHI) facilitates integration of the framework with the land use planning system.

Local councils are supported by DCCEEW and DPHI to develop coastal management programs (CMPs) that set out risk-based, long-term strategies for managing the coast.

This audit examined whether DCCEEW, DPHI and three local councils (City of Coffs Harbour, Shoalhaven City and Northern Beaches Councils) are effectively implementing the framework to manage the NSW coast.

Findings

The coastal management framework is not being effectively implemented to manage the NSW coastal environment. Seven years after the framework came into effect, most local councils are still in the process of developing CMPs.

DCCEEW is not effectively overseeing and facilitating implementation of the framework by state and local government. As a result, the Act’s objectives are not being achieved.

Gaps in DCCEEW’s strategic planning, risk management and performance monitoring mean it cannot demonstrate that the framework is being implemented to effectively manage risks to the use and resilience of the coastal environment now and into the future. 

The audited councils are developing CMPs to support coastal management and strategic land use planning, but the process is taking longer than anticipated. The audited councils with certified CMPs have faced challenges in integrating related coastal management actions as part of their integrated planning and reporting, due to uncertainty over long-term funding sources.

DCCEEW and DPHI are not effectively addressing challenges to the successful implementation of the framework. These include gaps in mapping coastal hazards to support framework objectives for managing risks from these hazards. DCCEEW is not effectively facilitating partnerships across state and local government, and there is uncertainty over funding for framework implementation.

Recommendations

The report makes recommendations including:

  • DCCEEW should improve its oversight, facilitation and monitoring of framework implementation.
  • DCCEEW and DPHI should address gaps in implementation of land use planning policy relating to managing coastal hazard risks.
  • Local councils, and divisions of DCCEEW and DPHI responsible for national parks and Crown land, should integrate the delivery of actions in CMPs into asset management, business and financial planning, and risk management processes.
  • Local councils should monitor and report on progress to the council and community.

Appendix 1 – Response from entities

Appendix 2 – About the audit

Appendix 3 – Performance auditing

 

Parliamentary reference - Report number # 414 - released 10 September 2025

 

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.