The graph above shows that 79 per cent of deficiencies (80 per cent in 2016–17) were operational, with the rest split between compliance deficiencies (17 per cent compared to 13 per cent in 2016–17) and reporting deficiencies (four per cent compared to seven per cent in 2016–17).
 
The table below describes the most common deficiencies across agencies, including their risk rating, the number of repeat deficiencies and the recommendations our management letters have communicated to agencies.

Operational
	High	2 new, 3 repeat
	Moderate	113 new, 36 repeat
	Low	81 new, 11 repeat

Compliance
	High	1 new, 0 repeat
	Moderate	31 new, 4 repeat
	Low	14 new, 4 repeat

Reporting
	Moderate	5 new, 3 repeat
	Low	0 new, 4 repeat

Additional matters related to IT vendor management, fraud and corruption control and management of purchasing cards and taxis are detailed in later chapters of this report.

The number of financial control deficiencies we identified rose for the first time in four years

Over the last 12 months financial control deficiencies increased by 27 per cent, after having declined by 33 per cent over the previous three years. However, the 157 deficiencies we found in 2017–18 is still lower than the 185 we found in 2014–15. We found financial control deficiencies at 75 per cent of agencies, a decrease from 79 per cent in 2016–17.

Deficiencies in internal controls increase the risk of intentional and accidental errors in processing information, producing management reports and generating financial statements. This can impair decision-making, affect service delivery and expose agencies to fraud, financial loss and reputational damage. Poor controls may also mean agency staff are less likely to follow internal policies, inadvertently causing the agency not to comply with legislation, regulation and central agency policies.
 
The graph below shows the risk rating of reported financial control deficiencies for the past four years.

We identified 63 per cent more IT control deficiencies than last year

The number of reported IT control deficiencies increased by 45 per cent over the last four years, from 107 in 2014–15 to 155 in 2017–18. This year, we found IT control deficiencies at 75 per cent of agencies, an increase from 63 per cent last year. We also found:

• new IT control deficiencies increased 56 per cent, from 81 in 2016–17 to 126 in 2017–18
• moderate risk deficiencies increased by 84 per cent, from 57 in 2016–17 to 105 in 2017–18
• high risk deficiencies decreased from two in 2017–18 to one in 2017–18.

The increase in IT control deficiencies is driven by:

• the government's increasing digital footprint as it prioritises on-line interfaces with citizens, and the number of transactions conducted through digital channels increases
• re-direction of IT staff from business as usual activities to implement complex IT projects and systems 
• absence of formal risk assessments over privileged user access, including high level access granted to third parties
• continued transition of services to outsourced service providers and shared service arrangements, which can ‘blur’ lines of responsibility.

Good IT controls are an essential ingredient underpinning effective processes, policies and procedures for managing information systems, securing sensitive information, and ensuring the integrity of agency data.

Poor IT controls increase risks to agencies, including unauthorised access, cyber security attacks, fraud, data manipulation, privacy breaches, non-compliance with laws and regulations and information theft.
 
The graph below shows the risk rating of reported IT control deficiencies for the past four years.

The increase in the number of control deficiencies we found this year, suggest agencies need to prioritise rectifying IT weaknesses in the year ahead.

Nearly a quarter of all control deficiencies have been unaddressed for more than 12 months

The number of repeat internal control deficiencies we identified has increased. As a percentage of all internal control deficiencies, it continues to represent nearly a quarter of all the internal control deficiencies we identified.

Of concern is the increase in repeat IT control deficiencies, up four percentage points from last year to 19 per cent of total IT control deficiencies.

Repeat IT control deficiencies signify an emerging risk to agencies

Rectifying certain IT deficiencies can take longer than rectifying other control deficiencies. IT fixes may require program changes, system testing and interruptions to services. However, until they are addressed vulnerabilities that can be exploited by internal and external parties pose a threat to agencies. The graph below shows a spike in repeat IT control deficiencies in the current year.

Good IT controls underpin the effectiveness of processes and controls and protect the sensitive data agencies hold.

Agencies need to address the above challenges by ensuring:

• there is clear ownership of recommendations arising from IT control deficiencies, with timeframes and actions plans for their implementation
• audit and risk committees and agency management monitor the implementation status regularly.

Proper controls should be maintained through any change process and considered as part of the design and implementation of a new system and the transition from a legacy system.

Fifty-seven per cent of the IT vendor contracts had clauses that required the vendor to provide assistance on transition and/or develop a transition/phase out plan. However, only 28 per cent of agencies have actually developed a transition/phase out plan with the IT vendor. While agencies may plan to implement a plan, it is better practice to do this early in the contract life, as the transition may need to occur before the expected contract end date.

Ineffective contract transition/phase out processes could result in service disruption, breakdowns in controls, unnecessary costs and an increased risk of 'vendor lock-in'. This risk is compounded where the contract is silent on the IT vendors’ obligation to help with the transition/phase out.

Agencies could make better use of their contract registers to manage IT contracts

Contract registers are an important tool from a financial management, legislative and contract management perspective. A contract register helps to manage an agency’s compliance obligations under the Government Information (Public Access) Act 2009 (the GIPA Act). The contract register also:

• allows an agency’s central procurement team to monitor contract end dates, contract extensions and commence new procurement in a timely manner
• helps agencies manage their contractual commitments, budgeting and cash flow requirements.

Our report on Government agencies compliance with the GIPA Act from 2016 found exceptions around the completeness and accuracy of agency contract registers. In our 2017–18 audits, we identified exceptions at 11 agencies because they did not have a contract register, or had registers that were not accurate and/or complete. This increases the risk of non-compliance with the GIPA Act, and sub-optimal procurement and contract management outcomes.

The GIPA Act allows for government information to be available to the public and includes establishing and maintaining a register of contracts with the Private Sector with a value of $150,000 or more. The register is required to be published on the Government's Tenders website or on the agency website.

Poor management of user access:
•    exposes agencies to the risk of fraud
•    compromises data integrity and confidentiality
•    increases the risk of unauthorised and invalid transactions
•    increases the risk of those user profiles being used for cyber attacks.

The NSW Government Digital Information Security Policy mandates that agencies (except State Owned Corporations and universities) complete a self-attestation of compliance with the core requirements of the policy. This policy requires that agency information security management systems take account of the controls in ISO 27001 ‘Information technology - Security techniques - Information security management systems - Requirements’. This standard requires the regular review of users’ access rights, and the removal or adjustment of access rights upon termination of employment or transferral.

Agencies need to strengthen user access administration to prevent inappropriate access to sensitive systems.

Privileged access

Some agencies are not monitoring activities of privileged account users

Agency staff often have access to sensitive data. If that access is not properly controlled and monitored it can increase the risk of a data leak or fraud. This is particularly true for those privileged users that are ‘trusted insiders’ who can be employees, business partners, or third-party contractors.

Forty per cent of agencies do not periodically review the activities of privileged users to identify suspicious or unauthorised activities.

Examples of deficiencies included:

• system audit logs not enabled to track user account activities
• no process to periodically review privileged user activities where system audit logs are enabled and maintained
• limited segregation of duties of IT privileged users from business operational responsibilities.

The absence of periodic reviews of privileged user accounts increases the risk that these accounts can be misused to:

• commit fraud
• access and extract confidential information
• access files, install and run programs, and change configuration settings
• maliciously or accidentally delete or distribute information.

Poor management of privileged access may also lead to breaches of section 11 of the Public, Finance and Audit Act and the NSW Government Digital Information Security Policy. This policy requires that agency information and security management systems take account of ISO 27001. This standard requires that privileged access rights are controlled and restricted.

Agencies should review the number of privileged users and access granted to privileged users, and assess and document the risks associated with their activities. Based on this review agencies should:

• grant and restrict privileged user access to only staff that require that level of access to perform their role
• identify controls to address the risks associated with privileged user activity, including regular monitoring of activity logs. 

Password controls

Agencies can improve their password controls

Twenty-three per cent of agencies did not comply with their own policy on password parameters. The deficiencies identified were related to:

• passwords not meeting minimum password lengths
• passwords not meeting complexity requirements
• no limit on the number of failed login attempts enforced
• password history not enforced (i.e. the number of passwords remembered and restricting the recycling of recently used passwords)
• minimum and maximum password age is not applied (i.e. prompting the change of password frequently).

Our audits also identified the use of default and generic passwords being used by agencies. Weak passwords increase the risk of unauthorised use of, and changes to, financial information. These weaknesses were identified across agency IT applications, databases and database servers.

Agencies should review IT password settings to ensure that they are complying with the requirements of their password policies.

Program changes

Some agencies are not approving changes to IT programs prior to implementation

All agencies have established IT change management policies to ensure the changes to IT programs and related infrastructure components are appropriately authorised, performed and tested prior to implementation. We found deficiencies in agency IT program change controls at 15 per cent of agencies. These deficiencies related to:

• inappropriate segregation of duties over developing and releasing IT program changes to the production environment
• inability to provide evidence for approval of IT program changes
• other issues, such as failure of a service provider to obtain approval before releasing changes to production and deficiency in IT change management policy.

At one agency, we noted that inappropriate changes were made to the finance system during the year. This caused a $3.0 million understatement in annual leave expense every month, and manual calculations and journals were required each month to correct the expense. This issue highlights the importance of performing adequate user acceptance testing before IT program changes are moved to a production environment.

Weak program change control exposes agencies to the risk of:

• unauthorised and/or inaccurate changes to systems or programs
• issues with data accuracy and integrity
• inappropriately accepting contractual terms and releases that come with upgrades.

Agencies should consistently perform user acceptance testing before system upgrades and program changes are deployed. Changes should not be made without appropriate approval and documentation to support the approval.

Computer operations

Management of computer operations is essential to agencies' IT environments as it ensures appropriate policies and procedures to manage potential disasters and critical system failures have been implemented. This includes developing business continuity plans and disaster recovery plans.

Some agencies have not developed business continuity plans and disaster recovery plans

We found deficiencies in agency disaster recovery and/or business continuity processes at 13 per cent of agencies. These deficiencies related to:

• absence of business continuity or disaster recovery plans, including supporting business impact analysis
• not testing the business continuity or disaster recovery plans during the year.

Without detailed analysis and planning, agencies cannot predict the impact of disruption, identify maximum tolerable outages, or plan informed recovery strategies. They also risk:

• data loss and delays in restoring data
• a plan not working in an actual emergency
• periods of vulnerability while transitioning between systems.

While most agencies have business continuity and disaster recovery plans, the consequences for those that don’t can be very high were an event to occur. The NSW Government Digital Information Security Policy requires agencies to develop, review and test their disaster recovery plans.

We also found that some other common principles of performance reporting were not in place, as illustrated in the graph below. Significantly, the areas where agencies’ reporting was the least informative were:

• explaining variances between reported performance and target and/or reported performance consistently over time
• explaining why a target has changed between years
• comparing performance against benchmarks from industry or other jurisdictions.

More generally, our analysis of annual reports showed agencies tend to report and focus on positive achievements, with limited acknowledgement where improvement is required.

There is no independent assurance about the accuracy of reported performance metrics

Agencies are solely responsible for the accuracy of the performance metrics reported in their own annual reports. No independent assurance is required or sought that an agency’s performance information is accurate. This limits the credence Parliament and the public might place on reported information as a relevant and accurate reflection of an agency's performance.

Prior performance audits have noted issues related to the collection of performance information. For example, our 2016 Report on Red Tape Reduction highlighted inaccuracies in how the dollar-value of red tape reduction had been reported. Estimates of the savings were in some cases based on unverified or unsubstantiated assumptions, cost-transfers, or pre-implementation projections that had not yet been achieved. Our 2018 report on Progress and measurement of the Premier’s Priorities assessed the effectiveness of the approach undertaken by the Premier’s Implementation Unit to measure and report on progress towards the Premier’s Priorities performance targets. The report highlighted that the data used to measure progress of the Premier’s Priorities came from a variety of government and external datasets, some which have inherent limitations that were not made clear when reported to the public.
 
For the purposes of this report, we did not look in detail at the systems and processes agencies have implemented to produce their performance metrics. The quality, reliability accuracy and consistency of reported information is enhanced by:

• developing policies and guidance aimed at improving the consistency and accuracy of data, related to collection, manipulation and presentation
• assigning responsibilities for management oversight of processes
• having effective internal review processes
• establishing independent review processes to provide effective challenge to the methodology used to collect the performance data, assumptions adopted, benchmarks applied and key judgements made.

As there are known delays in several projects being delivered by agencies within the scope of this report, it appears unlikely that such reporting was not relevant for the agencies concerned.

The annual reports regulation does not define 'major works in progress'. However, the Budget Papers refer to 'major works'. Each year each approved major work is described with its allocated funding. For context, the table below shows the value of the major works, as detailed in the 2016–17 Budget Papers, of the 14 agencies that did not report on their major works programs in their annual reports.

Some agencies expressed the view that since the annual reports regulation does not define what constitutes a 'major work', they had excluded their smaller major works programs. They did not believe their omission was material to their annual reporting.

Notwithstanding the above, the NSW Budget Papers do include details of major works in progress, the cost of those works to date and the estimated dates of completion, but the NSW Budget Papers do not include any of the other information required by the annual reports regulation, such as details of significant cost overruns and delays.

NSW Treasury produce an annual report checklist to assist agencies with their annual report compliance obligations. Agencies can use this checklist to improve the completeness and consistency of their annual reporting.

Agencies are not required to publicly report on completed major projects

There is no legislative requirement for agencies to report on completed major works. While 16 of the 30 agencies did report on completed major works, there was no reporting of actual costs and completion dates against original and revised budgets, or the original expected date of completion.

Without this information, it is difficult to draw meaningful conclusions about the performance of a project or program. In addition, Parliament and the public have limited comfort that public resources have been used efficiently and effectively.

Overall, reporting on major projects and programs could be improved if:

• agencies report on both works in progress and projects completed during the year
• actual costs, completion dates and forecast completion dates (for works in progress) are reported against original and revised budget and original expected completion date
• the above is supported by qualitative information explaining the reasons for significant cost overruns, delays or other information, such as key performance metrics relevant to the project.

The 76 per cent rate of growth in purchasing card expenditure over the last four years means agencies should focus on developing effective frameworks for controlling and monitoring the use of purchasing cards.

Policy framework

The establishment and implementation of a purchasing card policy is a core requirement under TPP 17–09.

We reviewed whether agencies had developed and implemented policies to control purchasing card use.

All agencies have purchasing card policies in place

All agencies that held purchasing cards had policies in place. But 26 per cent of agencies have either not reviewed their purchasing card policies by the scheduled date, or have not specified a scheduled revision date for their policy.

TPP17–09 became effective from 1 April 2018. For those agencies that do not have a process for reviewing policies as pronouncements are made, or on a regular cyclical basis, there is a risk that their policies are not aligned to TPP17–09. Regular review of policies also ensures significant changes within the agency's structure, internal control environment, other regulatory requirements and better practice are reflected in agency policies on a timely basis.

Preventative controls

Robust preventative controls at agencies is the foundation for a strong control environment to manage the use of purchasing cards.

We reviewed the adequacy of agency preventative controls.

All agencies have established centralised registers of authorised cardholders

We found all agencies maintained a centralised register of authorised cardholders. TPP 17–09 requires agencies to maintain a purchasing card register and specifies several mandatory fields. However, we found purchasing card registers contained some, but not all required fields.

A complete and accurate register helps manage the issue, use and cancellation of purchasing cards. It also helps ensure agencies manage card use within the overall limit approved under the Public Authorities (Financial Arrangements) Act 1987.

Agencies reported they did not comply with the TPP’s core requirements because the information was being managed within multiple registers, or was contained within their expense management system. Agencies also advised that because cardholders could not obtain a purchasing card without signing a statement of responsibility, they did not believe that including the information in a register added any value.

The roles and responsibilities of the program administrator were not adequately defined

Eighty-nine per cent of agencies have appointed a program administrator or have an officer appointed to administer their frameworks for managing purchasing cards. But only 57 per cent of those agencies' purchasing card policies have clearly defined the roles and responsibilities of the program administrator.

Defining the roles and responsibilities of the program administrator ensures the expectations and obligations of the role are clearly communicated and known by all staff. It also establishes a central point of reference for staff when they need to clarify policy requirements, or when other issues arise such as a lost or stolen card.

Agencies should consider formally appointing a program administrator and updating their purchasing card policy to define the roles and responsibilities of the function.

Only basic restrictions are applied to the use of purchasing cards

All agencies applied some restrictions on cardholders, mainly through applying credit limits and expiry dates, transaction limits and placing blocks on cash withdrawals. However, other restrictions, such as merchant blocks, geographic restrictions and prohibiting account deposits were less commonly used. The graph below shows the restrictions applied by agencies.

Agencies were more likely to use detective controls to highlight transactions with higher risk merchants, or from interstate or overseas locations. Wider use of cardholder restrictions is a more proactive control, which can also reduce the administrative costs of identifying and investigating suspicious transactions.

Not all agencies provide training to staff on their cardholder responsibilities

Along with requiring staff to sign a statement of responsibility when issued with a purchasing card, 76 per cent of agencies also provide training to staff on their responsibilities and obligations.

Training can more effectively communicate key responsibilities and help cardholders understand their accountability for purchasing card use. It also demonstrates the agency's commitment to maintaining an effective purchasing card framework and minimising misuse.

Detective controls

Detective controls are used by agencies to identify potential irregularities and misuse of purchasing cards. Detective controls further reduce the risk associated with the use of purchasing cards.

All agencies reconcile their monthly purchasing card transactions

We found all agencies had controls in place to acquit monthly transactions, have the cardholder’s direct manager review and approve purchasing card acquittals and to follow up on overdue unacquitted transactions.

A monthly purchasing card reconciliation process ensures that purchasing card transactions are valid, accurately coded and consistent with the agencies’ purchasing card policy. It is the first line of defence in identifying fraudulent or erroneous transactions.

Most agencies have some detective controls over purchasing card activity, but there are opportunities for improvement

Ninety-two per cent of agencies have designed and implemented at least one control to monitor and review purchasing card activity.

The extent of monitoring and review at each agency will depend on the significance of purchasing card activity, and the assessed risk of fraud and error associated with that activity. The graph below details the monitoring and review activity at agencies, while Exhibit 2 below, highlights some better practice examples from the agencies we reviewed.

Opportunities exist to improve monitoring and review activities by applying reviews, such as data analytics and independent spot-checks. The examples below show how some agencies use analysis to identify high risk patterns and anomalies in high volume transaction populations.

Most agencies report to senior management on purchasing card activity

Sixty-six per cent of agencies provide some level of reporting to senior management and/or those charged with governance on purchasing card activity. Management oversight helps to support the ongoing operation of a control environment, reinforces the importance of the control framework, and provides assurance the purchasing card framework is operating as intended.

At a minimum, agencies should be reporting to senior management on:

• cards in circulation, cancelled cards and inactive cards
• unacquitted transactions
• actions taken to address long overdue unacquitted transactions
• the results of monitoring activities
• outcomes from any investigations.

Policy framework

We reviewed the adequacy of agency policies developed and implemented to support the NSW Government Travel and Transport Policy.

Some agencies have not developed policies for taxi use, or are applying outdated policies

Thirteen per cent of agencies have not developed and implemented a policy, either in a dedicated policy or broader travel policy, to manage taxi use. A further 41 per cent of agencies have not reviewed the policy by the scheduled revision date or do not have a scheduled revision date in the policy. The oldest policy dated back to 2009.

Failure to update policies by the scheduled review date increases the risk that outdated policies and procedures may be followed and that policies and procedures do not reflect current best practice. Specifically, for taxis, there is a risk that the policy does not reflect an agency’s current preferred method for managing taxis and has not provided for the use of other more cost-effective travel options (see below).

Most agency policies do not promote the use of cost saving travel options

The NSW Government Travel and Transport Policy encourages agencies to adopt alternative travel options such as ride-share and general Opal cards for use within Sydney metropolitan areas. The results of our analysis are presented below.

Most policies deal only with common situations where taxis are used

Eighty-two per cent of the agencies have provided specific guidance in their policies related to typical and common situations when taxis can be used, however guidance could be more comprehensive to help reduce the risk of potential misuse. We found that some agencies’ policies did not provide guidance around the following:

Seventy-seven per cent of agencies’ policies specify the agency’s preferred method to pay for taxis. By nominating a single preferred payment method, agencies are better able to monitor taxi use as there is one source of truth.

Preventative controls

Agencies have few preventative controls in place

Because taxi use is not considered a major expense stream, agencies are less focussed on implementing extensive preventative controls to reduce misuse. That said, 50 per cent of agencies using e-tickets require the staff member’s direct supervisor to approve the request before the e-ticket is provided. Also, 72 per cent of agencies require Cabcharge card application forms to be completed before an employee is granted a card. This helps to ensure that only staff members with a business need are given the cards.

Detective controls

We reviewed the adequacy of agency controls to monitor taxi use.

Most agencies have implemented processes to approve taxi use expenditure

All agencies have implemented controls to approve taxi expenditure by expense reimbursement and purchasing card. However, we found 28 per cent of agencies did not require the supervising manager to review monthly Cabcharge card invoices to verify that the travel costs incurred on the card are valid before processing the invoice for payment.

Registers help to manage the use of Cabcharge cards and e-tickets

The use of a centralised register ensures agencies are able to effectively monitor the use of Cabcharge cards and e-tickets, and prevent misuse by cancelling e-tickets and Cabcharge cards that are not required. We found:

• eighty-seven per cent of agencies have established registers for issued e-tickets (either centralised or at a business unit level) within the agency. However, 33 per cent do not regularly review the register to ensure it remains up to date, and cancel unused e-tickets after a specified period (note: e-tickets expire automatically after 12 months)
• seventy-seven per cent of agencies maintain a register of issued Cabcharge cards.

Regular review of the registers helps to ensure:

• Cabcharge cards and e-tickets are only issued to active employees
• long outstanding e-tickets and unused Cabcharge cards are followed up and cancelled if necessary.

Controls to monitor and review taxi use can be enhanced

Fifty-three per cent of agencies have not implemented controls, such as data analytics, spot checks and internal audit reviews to monitor and review taxi use. The graph below details the monitoring and review activity happening at the 47 per cent of agencies that have implemented controls to monitor and review taxi use.

The amount agencies spend on taxis is generally small in comparison to agency operating budgets. Agencies need to select and implement controls that balance the costs and benefits of their approach, but provide them with an appropriate level of assurance that taxi use complies with their policies. Some agencies may even find it more efficient to monitor taxi use as part of a broader purchasing card or fraud monitoring program.

We did not look at all aspects of employment screening, instead focussing on the policies agencies have implemented to reduce the risk of employment application fraud. The Independent Commission Against Corruption (ICAC) published a report in February 2018 on Strengthening Employment Screening Practices in the NSW Public Sector. Agencies can improve their processes by benchmarking to this report.

Agencies have IT security policies, but gaps in IT security controls undermine their policies

A key element of a prevention system is a specific IT security strategy aligned with the organisation’s business strategy. This reflects the significant reliance on technology and the potentially serious consequences of a breach of IT security.

Poor IT security along with other gaps in agency prevention systems, such as employment screening practices heightens the risk of fraud and inappropriate use of data. Our audits continue to identify concerns over IT security controls. Section 3.2 of this report details our findings in greater detail.
 

The graph below details the different ways agencies publicise options for reporting fraud.

There are opportunities for some agencies to improve the culture that supports staff reporting actual or suspected fraud and corruption by increasing the number of reporting lines that are available to staff, and publicising these options more widely.

Agencies should report fraud and corruption matters to their audit and risk committees

We found that 21 per cent of agencies’ audit and risk committees did not have a standing item on the agenda for reporting of actual or suspected frauds.

Oversight by an audit and risk committee provides assurance that:

• fraud and corruption matters are being dealt with appropriately in line with agency policies and relevant legislation
• systemic issues are being identified and preventative and/or detective controls implemented to address the issue
• appropriate gravity is given to criminal behaviour, particularly if it is perpetrated by senior management.

Audit and risk committees play an important role in ensuring:

• fraud and corruption risks are being assessed and managed within agency enterprise risk frameworks
• appropriate systems and processes are in place to capture and effectively investigate fraud
• management act on staff reports of actual or suspected fraud.