This report covers the findings and recommendations from our 2019–20 financial audits that relate to internal controls and governance at 40 of the largest agencies in the NSW public sector. The agencies included in this report deliver a diverse variety of services and are exposed to numerous financial, operational and strategic risks. Effective internal controls and governance frameworks help to mitigate the likelihood of risks arising and their severity if they do.

A list of the 40 agencies included in this report is in Appendix three.

The 40 agencies selected for this volume constitute an estimated 85 per cent of total expenditure for all NSW public sector agencies. The snapshot below provides an indication of the collective size of assets, liabilities, revenue and expenses of these 40 agencies for the year ended 30 June 2020.

The report focuses on aspects of government preparedness for recent emergencies

The bushfire and flood emergencies and the COVID-19 pandemic continue to have a significant impact on the people and public sector of New South Wales. The scale of the government response to these events has been significant. It has involved emergency response coordination and service delivery in crisis conditions. It has required the development of, or changes to governance, policies, systems and processes so agencies can respond quickly and provide for the immediate needs of citizens.

The Audit Office is focussed on the changing risk environment presented by these events and how effectively emergency responses have been delivered, in particular the financial and governance risks arising from the scale and complexity of government responses to these events.

As a result, this report focuses on:

Agencies can use this report to build resilience and agility by enhancing their internal control and governance frameworks

The report provides insights into the effectiveness of controls and governance processes in the NSW public sector by:

• highlighting the potential risks posed by weaknesses in controls and governance processes
• helping agencies benchmark the adequacy of their processes against their peers
• focusing on new and emerging risks, and the internal controls and governance processes that might address those risks.

The findings in this report should not be used to draw conclusions on the effectiveness of individual agency control environments and governance arrangements. Specific financial reporting, internal controls and audit observations are included in the individual 2020 cluster financial audit reports, which will be tabled in parliament during December 2020.

High risk findings arise from failures of key internal controls and/or governance practices of such significance they can affect an agency’s ability to achieve its objectives or impact the reliability of its financial statements. This in turn, increases the risk that the audit opinion will be modified.

We rate the risk posed by each financial and IT control deficiency as ‘High', ‘Moderate’ or ‘Low’. The rating is based on the likelihood of the risk occurring and the consequences if it does. The higher the rating, the more likely it is that agencies will suffer losses, or its service delivery will be compromised. Our risk assessment matrix aligns with the risk management framework in NSW Treasury’s Risk Management Toolkit for the NSW Public Sector.

The number of high risk findings has increased from last year

We identified ten high risk findings, compared to four high risk findings in 2018–19, with two repeat deficiencies from the previous year. Nine of the ten high risk deficiencies related to financial controls and one related to IT controls.

Agencies should continue to address high risk internal control deficiencies as a matter of priority.

While it is important to monitor the number and nature of deficiencies across the NSW public sector, it is also useful to assess whether deficiencies are common to multiple agencies. Where deficiencies relate to multiple agencies, central agencies or the lead agency in a cluster can help ensure consistent, timely, efficient and effective responses to identified deficiencies.

We classified the 396 internal control deficiencies we identified in 2019–20 into common categories as follows:

• financial operational deficiencies
• IT operational deficiencies
• compliance deficiencies
• reporting deficiencies.

We assess trends in agency controls by measuring the number of internal control findings that emerged from our financial audits. We use three measures:

• number of findings
• number of new and repeat findings
• risk level of findings.

Our 2019–20 audits identified 396 internal control deficiencies, comprising:

• 226 financial control deficiencies
• 170 IT control deficiencies. We reported these deficiencies to agency management and those responsible for governance at agencies, such as audit and risk committees and cluster secretaries. Our management letters outline each audit finding, assess its implications, rate the level of risk and make recommendations.

The number of internal control deficiencies has increased by 13 per cent from last year

The 13 per cent increase in internal control deficiencies is predominately due to a seven per cent increase in new internal control deficiencies and 24 per cent increase in repeat internal control deficiencies. This follows an increase in internal control deficiencies of 12 per cent in 2018–19.

IT governance

IT governance provides a structure to enable agencies to effectively manage and monitor their IT risks to ensure that associated activities are aligned to achieve their objectives to deliver services to the public.

Most agencies have implemented policies to manage their key IT systems

Ninety-seven per cent of agencies have established IT policies to ensure key IT processes and functions are appropriately managed. However, five per cent of these policies were not regularly reviewed. Regular review of IT policies ensure that the strategies and procedures agencies implement effectively manage the evolving IT risks affecting their IT environments. The implementation of IT policies ensures there are adequate processes in place for the on-going management of existing and new IT risks affecting agencies.

Information security

Information technology is often at the core of how agencies deliver services in every sector. While IT can improve service delivery, the growing dependency on technology and rapid transformation to a digital society means agencies face an increasing number of risks if they do not adequately protect their IT systems from unauthorised access and misuse.

In the Report on Central Agencies 2019 we found the NSW Public Sector's cyber security resilience needed urgent attention. This was based on agencies' self-assessments against the Australian Cyber Security Centre’s Essential 8 cyber risk mitigation strategies. While our audits do not look at all aspects of how agencies have implemented the ‘Essential 8’, the findings below do highlight areas of information security that agencies need to strengthen to better align to the ‘Essential 8’ and the NSW Cyber Security Policy.

User access administration

User access administration over IT systems needs to be improved

All agencies have implemented formal processes for user access creation and modification to IT systems, yet the practical application for managing user access management requires further improvement. We found:

• 6 issues related to granting user access across 13 per cent of agencies
• 8 issues related to removing user access across 15 per cent of agencies
• 39 issues related to periodic reviews of user access across 43 per cent of agencies
• 32 issues related to users with inappropriate access across 35 per cent of agencies.

Examples of deficiencies included:

• periodic user access reviews were not performed to ensure access levels align with the user’s role
• regular reviews of dormant user accounts and default/generic accounts were not performed
• there was no process to periodically review third party user access, nor were the profiles promptly removed once they were no longer required
• weaknesses in processes to ensure timely changes to access levels to reflect changes to staff responsibilities and terminations
• access to new users and changes to user access levels had been granted without approval, or without evidence of approval
• processes had not been implemented to disable default/generic accounts.

Agencies deliver a diverse range of essential services to the public. Ongoing delivery of these services is critical to the social and economic outcomes of the State. Agencies also often perform other key functions, that while not critical, are important.

Business continuity management helps agencies respond to and manage business disruptions, maintain or restore critical services and return to business as usual with minimal impact to service delivery. ICT disaster recovery planning forms part of an agency's business continuity management, focussing on the recovery and restoration of information and communications technology (ICT) systems that are critical to an agency maintaining business continuity. Business continuity and disaster recovery planning arrangements contribute to the resilience of an agency.

The recent emergency situations have highlighted the need for agencies to have business continuity and disaster recovery arrangements in place so that they can effectively respond to these situations with minimal disruption.

There is no specific NSW Government direction that requires agencies to maintain business continuity and disaster recovery planning arrangements

NSW Treasury Policy TPP 15-03 'Internal Audit and Risk Management Policy for the NSW Public Sector' requires agencies to maintain a risk management framework. The 'NSW Cyber Security Policy' requires agencies to maintain an approved cyber security plan, integrated with business continuity arrangements. However, there are no specific requirements or minimum standards agencies must adhere to with regards to their business continuity and disaster recovery planning arrangements.

As a result, our review considers how well agencies' business continuity and disaster recovery planning arrangements align to aspects of:

• ISO22301: 2019 Security and Resilience – Business Continuity Management Systems – Requirements; and
• ISO27031:2011 Information technology — Security techniques — Guidelines for information and communication technology readiness for business continuity.

In particular, we have focused on whether agencies have:

• implemented and maintained up-to-date business continuity and disaster recovery plans
• performed comprehensive risk assessments and business impact analysis
• regularly tested their business continuity and disaster recovery plans
• implemented processes to monitor and evaluate the performance of their business continuity and disaster recovery plans.

The review focussed on the state of agency business continuity and disaster recovery planning arrangements prior to the outbreak of COVID-19 in Australia. During 2020–21 we plan to conduct a performance audit on 'Business continuity and disaster recovery planning'. This audit will consider the effectiveness of agency business continuity planning arrangements to maintain business continuity through the recent emergencies and/or COVID-19 pandemic and return to a business-as-usual environment. We also plan to conduct a performance audit on whole-of-government 'Coordination of emergency responses'.

Business continuity policies have been developed

For the period 1 January 2019 to 31 December 2019, 88 per cent of agencies had developed a business continuity policy, but 18 per cent were past their scheduled review date. Business continuity policies generally include key requirements of the business continuity framework, such as the development of business continuity plans for critical business functions, performance of business impact analysis and establishment of roles and responsibilities. In addition, we found 21 per cent of agencies do not define a critical business function for the purpose of requiring a business impact assessment to be performed.

There is an opportunity for agencies to review and ensure their key resilience frameworks are aligned, so that business impacts, roles and responsibilities and recovery times are clear to stakeholders and consistent.

A key step of the business continuity management framework is to perform and document a business impact analysis (BIA). The BIA helps agencies identify critical business functions that support an agency's business objectives, including target recovery times and resource dependencies for each critical business function. The BIA should be supported by a comprehensive risk assessment to identify critical business functions.

Not all agencies have prepared a business impact analysis

Twenty-three per cent of agencies had not conducted a BIA to identify critical business functions and determine their business continuity priorities at 31 December 2019. In addition, of the agencies that had conducted a business impact analysis, 20 per cent are only performing this on an ad-hoc basis or when there is a significant change in operations, rather than at planned intervals. In particular, one agency last conducted a business impact analysis in October 2014.

We also found agencies can improve the content of their BIA. Some agencies did not include key elements that we would expect to see in a BIA, as detailed in the table below.

Without an up-to-date and comprehensive BIA there is a risk that agencies will not be able to restore critical business functions within an acceptable timeframe. Agencies may also not know what to do in the event of a disruption if key systems and dependencies and interdependencies have not been identified, further elevating the risk that critical business functions will not be restored within an acceptable timeframe.

We are currently conducting a review on agency compliance with the 'NSW Cyber Security Policy'. This will examine, amongst other things, whether agency cyber security plans are linked to their business continuity arrangements. This review may identify further threats, risks and vulnerabilities associated with agency BIAs.

Disaster recovery plans not always prepared for IT systems that support critical business functions

We found only 81 per cent of agencies had a disaster recovery plan in place for all IT systems and infrastructure identified in the business impact analysis at 31 December 2019, meaning there is no plan in place to recover some key IT systems and infrastructure that support critical agency functions.

As noted above, 23 per cent of agencies have not conducted a BIA; for these agencies, we could not determine whether they had disaster recovery plans in place for all key IT systems.

Risks to business continuity should be re-assessed and updated

Agencies are required to maintain risk assessment processes and a risk management framework in accordance with NSW Treasury Policy TPP 15-03 'Internal Audit and Risk Management Policy for the NSW Public Sector'.

While the purpose of our review of agency business continuity and disaster recovery arrangements was not to review agency risk identification and assessment processes, we believe the recent emergency situations provide an opportunity for agencies to re-visit and update the nature, likelihood and consequence of risks impacting on business continuity and related risk treatments. For example, the COVID-19 pandemic has highlighted several new risks that agencies may not have previously captured in their risk registers or BIA, such as:

• concentration risks associated with being dependent on certain suppliers
• additional technology risks (e.g. ability to support a workforce working from home)
• additional cyber risks
• additional risks related to the delivery of key services, particularly where the agency has a citizen facing role e.g. unable to open branches or provide face to face support etc.

The table below outlines some common business continuity risks reviewed during the period 1 January 2019 to 31 December 2019 and the proportion of agencies that had identified the risk and had a plan to mitigate it.

Business continuity and disaster recovery plans should be prepared for critical business functions and key IT systems and infrastructure identified as part of the BIA process. Business continuity plans provide guidance and information to help teams to respond to a disruption and to assist an agency with response and recovery. A disaster recovery plan helps agencies maintain IT services in the event of an interruption, or restore IT systems and infrastructure in the event of a disaster or similar scenario.

Most agencies have developed business continuity and disaster recovery plans, but deficiencies in the BIA may impact their effectiveness

Eighty-eight per cent of agencies had developed business continuity plans and 81 per cent of agencies had developed disaster recovery plans for some or all of their critical IT systems and infrastructure during the period 1 January 2019 to 31 December 2019. However, there is a risk that agencies either do not have plans in place for all key business functions or IT systems and infrastructure, or do not have effective plans in place because the BIA has not captured key elements, as noted above.

We also considered how comprehensive business continuity and disaster recovery plans are. Comprehensive plans are important because they are the key document that will guide staff in the event of an interruption, disaster or crisis. They also specify key governance arrangements and reporting requirements in the event it is invoked.

The results are detailed in the tables below.

Most agencies provide additional supporting material to help staff in the event of the business continuity plan being invoked

At 31 December 2019, 99 per cent of agencies had developed some supporting materials to help key staff involved in managing business continuity apply the business continuity plan in the event it is invoked. This helps staff understand their role and responsibilities and implement the key requirements of the business continuity plan, particularly when faced with the pressure of an emergency situation or other interruption.

Agencies should consider whether the current level of support and guidance provided to staff involved in managing business continuity is sufficient. Scenario testing and post incident reviews provide a useful source in understanding whether this is the case, which we explore further below.

Actual incidents or events provide an important feedback loop on the effectiveness of current business continuity and disaster recovery arrangements. It is therefore important that agencies record incidents that led to the activation (or not) of the business continuity or disaster recovery plan. Agencies should perform post incident reviews to identify what went well and what can be improved and report the outcomes of these reviews to those charged with governance.

Agencies are not always capturing, assessing and reporting disruptive incidents

We found that an incident log of events that led to activation of the business continuity and disaster recovery plans were maintained by only 40 per cent and 63 per cent of agencies respectively for the period 1 January 2019 to 31 December 2019.

The absence of a log or register to record incidents where agency personnel or business units considered activating the business continuity or disaster recovery plans makes it difficult for those charged with governance to determine whether the actions taken in relation to the incident were appropriate. A log or register of incidents also enables agencies to assess trends and determine the consistency of responses, as well as enable them to maintain a complete trail of incidents (and associated records) in the event that key staff leave the agency and that knowledge is lost.

Our findings from a review of a sample of recorded incidents between the period 1 January 2019 to 31 December 2019 are detailed in the table below.

Without performing a post incident review, agencies may not adequately capture lessons learnt from the incident, and importantly, will not continuously improve the suitability, adequacy and effectiveness of business continuity and disaster recovery arrangements. Reporting to those charged with governance is also an essential accountability mechanism that helps to ensure agency responses to incidents are consistent and appropriate.

The exhibit below provides examples of the nature of business continuity and disaster recovery incidents recorded in agency incident registers.
 

Exhibit 1: Examples of business continuity and disaster recovery incidents

The recent emergencies provide an opportunity for agencies to update and refine their business continuity, disaster recovery or other business resilience frameworks

Agencies should ensure that they assess their response to the recent emergencies and update their business continuity, disaster recovery or other business resilience frameworks to reflect the lessons learnt from these events. This should capture, but is not limited to:

• misalignment of business resilience frameworks and key indicators
• identification of previously unidentified risks and opportunities, and strategies to mitigate the risk or exploit the opportunity
• identification of procedural gaps in recovery, 'stand down' or other processes
• completeness of critical business functions, key IT systems, dependencies or inter-dependencies
• appropriateness of resources and roles and responsibilities and identifying any lack of clarity that may exist.

Some agencies do not test their business continuity plans, or test them infrequently

We found 40 per cent of agencies had not conducted business continuity scenario testing exercises in the period from 1 January 2019 to 31 December 2019. This means they may not be well prepared to respond to business disruptions or incidents that arise.

We also found that agencies are not periodically testing their business continuity plans. For example, 68 per cent of agencies reported having tested their business continuity plans less than once per year, on average for the period between 1 January 2017 to 31 December 2019.

The table below shows how often agencies have tested their business continuity plans in the last three years from 1 January 2017 to 31 December 2019.

Gaps in approaches to testing business continuity plans limit the effectiveness of scenario testing

Many agencies are reliant on other parties and service providers to support critical business functions or deliver critical services to the public. This includes other government agencies, private sector service providers and non-government organisations.

We previously noted that a key element of agency BIAs is the identification of dependencies and inter-dependencies that support critical business functions. However, our review of 22 business continuity testing scenarios performed before 31 December 2019 found that 61 per cent of agencies did not ask third parties (such as NGOs), other government agencies (such as the cluster lead agency) or service providers to participate in the scenario.

Where a key third party does not participate in the testing exercise, the effectiveness of scenario testing is limited because:

• no matter how well prepared the agency is, the third party may not be well prepared for a disruptive event should it arise, which may hinder the agency meeting its recovery time objectives
• roles and responsibilities, communication protocols and response and recovery procedures will not have been comprehensively tested to confirm the accuracy of the business continuity plan.

While we acknowledge some government-wide emergency and crisis management exercises have been performed, business continuity scenario testing at an agency level would benefit from greater involvement of key dependent and interdependent third parties that support or perform critical business functions for agencies.

We also found the effectiveness of business continuity testing exercises was limited because some agencies:

• did not test a high impact scenario they had identified in their business continuity plan (seven per cent)
• did not prepare formal post-exercise reports to document the outcome of the scenario testing (seven per cent) and of agencies that did, 12 per cent did not report the outcomes of testing to a relevant governance committee.

The exhibit below provides examples of nature of the business continuity scenario testing exercise conducted by agencies between 1 January 2019 to 31 December 2019.

Exhibit 2: Examples of business continuity scenario testing exercises

Some agencies have not tested the effectiveness of their disaster recovery plans

IT systems and infrastructure are an important enabling resource associated with maintaining continuity of critical business functions. However, we found 43 per cent of agencies have not developed and tested their disaster recovery plans within the period from 1 January 2019 to 31 December 2019. Recovering IT systems is particularly problematic as they are often hosted by third parties, will inevitably involve some loss of data depending on the date and time data was last backed up, and if hosted in regional locations may function more slowly when service is restored.

Most agencies do not maintain a forward-looking business continuity testing plan, but many maintain forward looking disaster recovery testing plans

Seventy-one per cent of agencies do not maintain a forward-looking business continuity testing plan for high impact scenarios identified in their BIA.

A forward-looking plan to test all high impact scenarios provides assurance to those charged with governance that a plan is in place to test the plan within an appropriate timeframe. Testing increases the chance that should the high impact event occur, the agency will be able to effectively resume the critical business function within an acceptable timeframe.

The model audit and risk committee charter in TPP 15-03 'Internal Audit and Risk Management Policy for the NSW Public Sector' requires agency audit and risk committees to 'review whether a sound and effective approach has been followed in establishing the agency’s business continuity planning arrangements, including whether disaster recovery plans have been tested periodically'.

Most agencies report business continuity and disaster recovery planning arrangements to their audit and risk committees, but testing outcomes are not as widely reported

Most agencies require senior management to review the key inputs of the business continuity management and disaster recovery systems at planned intervals. However, reporting to those charged with governance could be more comprehensive, as detailed in the table below.

Our review of a sample of agency business continuity and disaster recovery testing exercises conducted during the period 1 January 2019 to 31 December 2019 had found agencies are not always reporting on the outcomes of these exercises to their audit and risk committees. We found that while:

• 82 per cent reported on the outcomes of the business continuity scenario testing exercise conducted to an agency head, executive management committee or similar. However, only 18 per cent of agencies are reporting outcomes to audit and risk committee.
• 86 per cent reported the outcomes of disaster recovery plan testing to an agency head, executive management committee or similar. However, only five per cent of agencies reported the outcomes of the test to their audit and risk committee.

Audit and risk committees should be briefed on the results of scenario testing exercises to discharge their responsibilities to review whether sound and effective business continuity and disaster recovery arrangements have been established and adequately address identified risks.

A review of the agency's disaster recovery and business continuity management systems should be included on the internal audit function's forward plan

A review of the effectiveness of agency business continuity management systems and disaster recovery plan was included in the internal audit plan of only 56 and 58 per cent of agencies, respectively. Internal audit reviews of these plans would provide agencies and their governing bodies assurance that there is clarity in processes, alignment of arrangements to address risks, and an optimum level of preparedness.

The NSW Procurement Board issues policies and directions for procurement under the Public Works and Procurement Act 1912 (PWP Act). The PWP Act provides the legislative framework for procurement for NSW Government agencies. The PWP Act and the NSW Procurement Board’s policies and directions apply to all government agencies except for state-owned corporations.

Procurement of goods and services is a critical activity to enable NSW Public Sector agencies to effectively deliver services to the public. The Total State Sector Accounts for the year ended 30 June 2020 provides an overview of spend on goods and services by NSW Public Sector agencies, including:

• $2.2 billion on contractors
• $155 million on consultants
• $16.9 billion on supplies, services and other services.

NSW Procurement has established an accreditation program for goods and services procurement

The Accreditation Program for Goods & Services Procurement (the Program) establishes minimum standards for agency procurement as a basis for improving procurement outcomes delivered across NSW Government. It is governed by the NSW Procurement Board and NSW Procurement administers the Program on its behalf. Agencies can attain one of two accreditation levels and each level has specific minimum requirements for accreditation and a different authority to procure.

Accredited agencies have the authority to enter into any procurement arrangement consistent with its terms of accreditation, but exemptions for agencies may exist under some Procurement Board Directions, as identified in the NSW Government Procurement Policy Framework.

The table below sets out the accreditation status of agencies in the scope of this report.

We consider aspects of agency compliance with their accreditation status and the Enforceable Procurement Provisions later in this chapter.

The NSW Procurement Policy Framework (the Framework) issued by NSW Procurement outlines the Procurement Board’s requirements as they apply to each step of the procurement process. The Framework is a policy under PWP Act and agencies must comply with the mandatory requirements outlined in the Framework.

All agencies have procurement policies, but some are past their scheduled revision date

All agencies have established policies and guidance to support procurement activity and manage procurement risks. However, 17 per cent of agencies have not reviewed their procurement policies by the scheduled date. On-going review and revision of procurement policies are important to ensure they reflect best practice and incorporate current NSW Procurement Board Directions on a timely basis.

Deficiencies in agency policies may be contributing to non-compliance with the Framework

Most agencies within the scope of this report are required to comply with the PWP Act and various NSW Procurement Board Directions (the Directions). These Directions can relate to broader aspects of procurement, such as appropriate supplier conduct or narrower procurement activity, such as construction, professional services or telecommunications procurement.

The Directions are extensive and agencies must have procurement policies that adequately capture the requirements of the Directions to support its compliance requirements and achieve the best outcomes from its procurement activity.

The table below details how well agencies’ procurement policies capture certain aspects of the Directions. Later in this chapter we highlight areas where agencies are not fully compliant with the Directions. It is likely gaps in agency procurement policies are contributing to these deficiencies.

We have previously highlighted challenges for agencies complying with the directions in a compliance review conducted in September 2018.

Exhibit 3: Previous Audit Office Report on Procurement and Reporting of Consultancy Services (published September 2018)

Agency policies are not always consistent with their accreditation status, and do not address risks associated with high risk procurement, such as direct negotiations

We found agency procurement policies do not contain the level of detail that would ensure it complies with its accreditation program status. For example:

• 55 per cent of the unaccredited agencies’ procurement policies do not specify that certain procurement activities for goods and services valued at $650,000 or higher requires approval by a level 2 accredited agency in the cluster or NSW Procurement
• 21 per cent of agencies that have level 1 accreditation program status did not specify in their procurement policies that a level 2 accredited agency or the NSW Procurement Board must concur before a procurement activity is commenced if the following risk and value thresholds are exceeded

Concurrence from level 2 accredited agencies or NSW Procurement helps to ensure procurement risks are being appropriately managed and deliver a value for money outcome.

Agency procurement policies did not always provide clear guidance to staff about managing the risks associated with direct negotiations and conflicts of interest. Direct negotiations are exclusive dealings between an agency and a supplier without going through a competitive process. The risk of corrupt conduct in the procurement process is increased and it may also be more difficult for an agency to demonstrate it has achieved value for money. The NSW Independent Commission Against Corruption has developed guidelines for agencies engaging in direct negotiations, which can be accessed here.

The table below outlines the gaps in procurement policies related to direct negotiation and managing conflicts of interest.

Most agencies maintain a central contract register, but many are incomplete risking non-compliance with GIPA legislation

All agencies are required to record all details of contracts above $150,000 in a central contract register. Eighty-eight per cent of agencies did so, but of these agencies, 13 per cent did not capture all contracts and eight per cent did not include all relevant contract details. Sixteen per cent of agencies also did not periodically review their contract register.

The Government Information (Public Access) Act 2009 (the GIPA Act) aims to improve the transparency and integrity of the NSW public sector by requiring agencies to proactively publish information in relation to their contracts with the private sector. If an agency does not maintain a central contract register, it increases the risk of non-compliance with GIPA Act. A centralised contract register can also enhance procurement and contract management outcomes because it:

• allows an agency’s central procurement team to monitor contract end dates, contract extensions and commence new procurement in a timely manner
• helps agencies manage their contractual commitments, budgeting and cash flow requirements.

We have previously identified concerns with the completeness and accuracy of contract registers maintained by agencies, and this remains an ongoing area of concern. The exhibit below details findings from a previous compliance review conducted in October 2016.

Exhibit 4: Previous Audit Office report on Agency compliance with the GIPA Act (published October 2016)

Some agency contracts that were renewed or extended during the year did not go through a competitive process, nor was a value for money assessment performed

While there can be valid and appropriate reasons to renew or extend a contract already executed with a supplier it is important for the agency to demonstrate that their procurement continues to represent value for money. Poor monitoring of contract end dates can lead to contracts being renewed or extended simply to avoid service interruption. The lead times required to plan for a new procurement preclude proper process being followed. Maintenance of a complete and accurate contract register and monitoring of contract end dates is an important aspect of managing this risk.

We reviewed 32 contracts that were renewed or extended during 2019–20. Seventy-eight per cent of agencies performed a value for money assessment prior to renewing or extending the contract with their existing supplier. However, documentation of this assessment was not always robust. For example:

• 7 per cent of agencies did not assess or document supplier performance (including meeting customer expectations and performance against key performance indicators)
• 21 per cent of agencies did not consider procurement arrangements or activities currently in place or planned for the future
• 19 per cent of agencies did not perform an analysis of the current market to determine if opportunities for cost or process efficiencies were available.

Of the agency contracts examined, all were approved by an appropriate delegated authority. However, we noted one contract where the approval was obtained only for the value of the contract extension and not the total contract value.

A proper consideration of the commerciality of renewing or extending an existing contract helps address the risk that the procurement will not meet business needs or that agencies do not identify potential alternate suppliers who can deliver the good or service at lower cost and/or higher quality.

Most agencies provide some training and support to staff on procurement activities

Ninety-three per cent of agencies provide training to staff involved in procurement activity, and a further 77 per cent of agencies provide this training on an on-going basis. Thirteen per cent of these agencies did not ensure their training emphasised personal accountability, probity and transparency in relation procurement activity.

Of the seven per cent of agencies that had not provided training to staff we noted gaps in aspects of their procurement activity, including:

• not conducting value for money assessments prior to renewing or extending the contract with their existing supplier
• not obtaining approval from a delegated authority to commence the procurement process
• procurement documentation not specifying certain key details such as the conditions for participation including any financial guarantees and dates for the delivery of goods or supply of services.

On-going training and awareness programs allow agencies to communicate to all staff their responsibilities and obligations in relation to procurement activities which results in:

• effective performance management of vendors
• reduction in uncontrolled spend
• compliance with procurement guidelines and directions
• improvement in risk management processes undertaken.

Most agencies have implemented procurement controls, but some unaccredited agencies did not have their procurements endorsed

We reviewed the implementation of certain procurement controls across 26 contracts valued above $650,000 that were executed in 2019–20. We noted:

• 10 per cent of agencies procured the goods or services under a whole-of-government contract or prequalification scheme and had obtained the minimum number of written quotes required
• 90 per cent of agencies procured the goods or services outside of a whole-of-government contract or prequalification scheme and had undertaken the open approach to market (OAM) with the minimum number of proposals obtained.

Forty-three per cent of unaccredited agencies did not have their procurement endorsed by an accredited agency within the cluster or by NSW Procurement, as required by the Framework. This is likely due to deficiencies in their current policies, as previously noted. We also noted other deficiencies in some processes across the 26 contracts reviewed, as detailed in the table below.

Of the 26 contracts reviewed, a request for tender was issued for 21 of these contracts. The table below outlines some deficiencies in tender procurement documentation.

Clear and complete tender documentation ensures that tender participants understand the agency’s requirements. Poor procurement documentation may result in:

• the product or service not being delivered as required
• offers from unsuitable suppliers or no offers because of a lack of clarity as to the agency's requirements
• additional time and resources required to issue addenda clarifying the specification to potential tenderers during the tender process
• multiple contract variations.

Evaluation committees were established for all the tenders noted above. Our review of documentation maintained by the evaluation committee found that:

• 93 per cent of agencies obtained conflicts of interest declarations from the evaluation committee members
• all agencies developed an evaluation plan
• all agencies prepared evaluation reports that outlined the results and recommendations for awarding tender
• 96 per cent of agencies had the final recommendations approved and signed off by the appropriate delegated authority to award the contract and had obtained approval from an appropriate delegated authority separate to the tender evaluation process or the actual tender process to award the contract.

Agencies have undertaken emergency procurement activities

NSW Procurement released the ‘COVID-19 Emergency procurement procedure’ (the procedure) to allow agencies to expedite the procurement of critical goods and services during the COVID-19 pandemic. The procedure aimed to help agencies comply with clause 4 of the Public Works and Procurement Regulation 2019 (PWP Regulation), which allows the Head of the Agency or their nominee, in an emergency situation, to authorise procurements to a value sufficient to meet that particular emergency.

As at 30 June 2020, agencies in the scope of this report had reported conducting 32,239 emergency procurements with a total contract value of $316,908,485. The procurement activity mainly related to:

• cleaning and hygiene supplies
• Information technology, phones and laptops to facilitate remote working and remote education
• engagement of consultants for crisis management planning
• site cleaning costs
• non-contact equipment such as soap and hand sanitiser dispensers, and thermometers
• medical supplies
• remote working office equipment.

Implementation of processes to effectively manage the procurement of critical goods and services ensure agencies are able to balance the need to act without delay and deliver the goods or services while also ensuring adequate levels of accountability are maintained.

Some agencies did not establish policies or guidance to clearly communicate emergency procurement processes

Fifty-one per cent of agencies have established policies, procedures or other guidelines for emergency procurement activities. Effective communication of emergency procurement processes is critical as it ensures staff remain accountable and agencies are able to:

• manage procurement spend as prices may be inflated during this period
• manage fraud, corruption and conflicts of interest risks
• prioritise procurement activities for immediate business needs
• avoid entering into contracts on unfavourable terms and conditions.

The table below shows the gaps in the agency policies, procedures and guidelines. There is an opportunity to build this into procurement policies going forward, so agencies are better prepared for emergency situations that may arise in the future.

Most agencies complied with the COVID-19 'Emergency procurement procedure'

Twenty-two agencies within the scope of this report had undertaken emergency procurement activities during 2019–20. Where there is an authorised emergency procurement under clause 4 of the PWP Regulation, the agency is exempt from complying with certain procurement requirements, including the requirement to achieve value for money and the principles of probity and fairness.

Although the agency does not have to undertake a value for money evaluation when undertaking emergency procurements, it still must use government resources efficiently, effectively, economically and in accordance with the law.

Ninety-six per cent of agencies had maintained a register to record decisions and authorisations associated with these activities. Sample testing of emergency procurement activity showed that most agencies also complied with key elements of the procedure and PWP Regulation, as noted below.

In addition, we noted 67 per cent of agencies had used standard documentation to document the criteria used for selecting suppliers and the outcome of any comparative assessment or price assessment.

Complying with the procedure helps to ensure government resources are being efficiently, effectively, economically and in accordance with the law.

Delegations are fundamental to the operation of the NSW public sector and a cornerstone of good governance. Legislation appropriates money to Ministers and confers on them power to make decisions. Ministers may then delegate that power to another Minister, or to the officer of an authority in writing. Those delegation instruments may contain limitations within which the officer upon whom the delegation is conferred must operate. The Minister may also reserve certain decisions only to themselves. An officer cannot lawfully exercise power unless delegated to do so by the Minister responsible.

Legislative and machinery of government changes have meant delegation instruments required review and in many cases, updating. We found some delegation instruments had not been updated in years. Others could not be located. Some referred to repealed legislation or regulation, contained errors, had gaps, did not align with current funding arrangements, referred to positions that do not exist, or did not contemplate the need to sub-delegate power to a more appropriate party within cluster arrangements. Some agencies were unsure of their obligations, and incorrectly relied on their enabling legislation for authority.

The importance of delegations, as a decision-making mechanism became apparent in the recent emergency situations, which required agencies to make clear and timely decisions. Clear, lawful delegations will also be necessary as agencies administer grant and stimulus programs and make investment decisions to aid in the recovery process.

In the NSW public sector, financial and human resources functions are predominately governed by the:

• Government Sector Finance Act 2018 - This act confers various functions on persons or entities. This act allows a Minister to delegate any of their delegable functions conferred to them under the act. Expenditure by accountable authorities and government officers must be authorised in accordance with a delegation, sub-delegation or under the authority of a law.
• Government Sector Employment Act 2013 - This act, along with the Government Sector Employment Regulation 2014 and the Government Sector Employment Rules 2014 form the legislative framework for the employment and administration of the NSW Government sector workforce. The framework encompasses various human resource functions, such as the recruitment, commencement, on-going employment and termination of staff.

Delegations help to ensure decisions are made by appropriately skilled and experienced staff and allow agencies to operate efficiently. But to be effective, delegations must be kept up-to-date, provide clear authority to decision makers and be widely communicated.

This chapter focusses on whether agencies have established valid and up to date delegations and whether, by sample testing, have complied with their financial and human resources delegations.

In On 1 July 2019, machinery of government changes became effective. These changes created and abolished entities, as well as transferred staff and functions between entities. Agencies impacted by machinery of government changes should have reviewed and updated their delegations to take into account the changes in functions, roles and responsibilities.

Provisions in the Government Sector Finance Act 2018 (GSF Act) relating to budget, appropriations and Special Deposit Accounts commenced on 1 July 2019, which meant agencies needed to consider whether:

• delegations allow it to spend money from each source of money it receives e.g. deemed appropriations, annual appropriations, cluster grants etc.
• there is an approval to enter into financial arrangements and any corresponding required delegations
• it is covered by transitional provisions
• the function can be delegated and subdelegated under the GSF Act
• the delegate / subdelegate is a permissible delegate under the GSF Act
• the agency can operate without certain delegations, for example an agency, by virtue of its enabling legislation with a working account within the Special Deposits Account may not require an expenditure delegation.

Agencies' instruments of delegation and delegation manuals had not been updated following legislative or administrative changes, or do not have set dates for regular review

All agencies have established financial delegations to ensure employees have clear guidance and instruction to exercise their authority appropriately and effectively. However, we found:

• 12 per cent of agencies have not reviewed their financial delegations by the scheduled date or have not set a scheduled review date
• of the 19 agencies impacted by machinery of government changes, 16 per cent of these agencies had not updated their financial delegations to reflect the changes.

For these agencies, there is a risk that staff are inappropriately approving transactions, spending money unlawfully, or financially over-committing the agency. There is also a heightened risk that staff cannot respond in a timely manner to urgent situations, without the need to clarify their powers.

Some financial delegation manuals did not clearly capture certain financial transactions

We found that some agencies could improve the clarity of their financial delegation manuals, as set out in the tables below. Ensuring that financial delegations manuals capture all relevant functions and clearly reference the legislation that permits the delegation helps to ensure that staff have a clear understanding of their delegated power.

Agencies have established human resources delegations, but some did not revisit their delegation manuals following the machinery of government changes, or have not set dates to regularly review human resources delegations

Ninety-eight per cent agencies have a delegation manual to effectively manage the administration of the human resources function, but seven per cent of these are not supported by an instrument of delegation, meaning staff may be making decisions without delegated power. We also found:

• 12 per cent of agencies have not reviewed their human resources delegations by the scheduled date or have not set a scheduled review date
• of the 19 agencies impacted by machinery of government changes, 16 per cent of agencies did not update their human resources delegations to reflect the changes.

For these agencies, there is a risk that staff are inappropriately making decisions associated with the administration of staff, such as hiring decisions, determining rates of pay, and termination decisions.

Some human resources delegation manuals did not clearly capture certain functions

We found that some agencies could improve the clarity of their human resources delegation manuals, as set out in the tables below.

Instances of non-compliance with the Government Sector Finance Act 2018

Agencies did not understand or correctly apply the requirements of the GSF Act, resulting in non-compliance with the Act. We found that 18 per cent of agencies spent deemed appropriations without obtaining an authorised delegation from the relevant Minister(s), as required by sections 4.6(1) and 5.5(3) of the GSF Act.

As previously noted in section 6.2, provisions in the Government Sector Finance Act 2018 relating to appropriations commenced on 1 July 2019. Agencies need to ensure that when new legislation commences or is amended that they adequately assess the impact on their operations and instruments of delegation.

Further detail on this issue will be included in our Auditor-General's Reports to Parliament on Central Agencies, Education, Health and Stronger Communities, which will be tabled throughout December 2020.

Instances of non-compliance with human resources delegations identified

We reviewed compliance against agency human resources delegations for a sample of new employees. We found not all agencies are complying with their human resources delegations' manual, as detailed in the table below.

These exceptions increase the risk of inappropriate decisions being made associated with the advertising of roles, appointment of staff and their commencing pay. This indicates staff do not have a clear understanding of their delegated powers, or there is a lack of awareness or culture around the importance of complying with delegations in the agencies. Agencies should monitor compliance with their human resources delegations and communicate exceptions back to staff to raise awareness.