Internal controls and governance – trends in audit findings

Audit findings are increasing in high-risk, high-expenditure areas

Interim audits found deficiencies in internal controls and governance at 15 agencies. There is an increase in audit findings related to deficiencies in finance operational controls. These include findings in areas of high expenditure and risk such as procurement and grants. Forty-two per cent of audit findings are repeat, up from the 33% in 2024–25. This indicates that vulnerabilities, including IT control weaknesses, such as those which increase the risk of cyber-attack, are going unaddressed.

Deficiencies in procurement controls could limit agencies achieving value for money

Procurement processes and controls which did not meet mandatory requirements were identified, including deficiencies in tendering, supplier evaluation and compliance, putting at risk the achievement of value for money.

Grants administration

The internal controls and governance of 9 selected agencies with expenditure on grants of greater than $300 million were analysed as part of interim audits.

Centralised oversight of grants is limited

Most agencies do not have a centralised framework to oversight, and report on grant programs. In these agencies, grants administration and controls were primarily at the business unit or program level but there were no agency wide monitoring processes of these activities. This has resulted in fragmented oversight, including limited visibility of grant performance, risks and compliance.

Weaknesses observed included limited evidence of reconciliation of grants records to actual expenditure, monitoring acquittals, non-compliant expenditure and recoveries of overpayments or unspent funds at an agency level. This limits assurance over the completeness and accuracy of grant information and reduces visibility over the status and performance of grant programs.

Insufficient governance frameworks, policies and procedures increase the risk of waste or misuse of public funds

The Grants Administration Guide (the Guide), the NSW Government’s mandatory framework for grants administration, requires agencies to establish policies and procedures for grants administration. Limitations in agency policies and procedures across the grant lifecycle, including planning, due diligence, monitoring, acquittal and evaluation weaken accountability, increase the risk of waste or misuse of public funds, and limit agencies’ ability to demonstrate effective grant administration.

Agencies assess value for money inconsistently

Six agencies policies do not set out the level of analysis required at initial planning stages to demonstrate that a grant will achieve value for money. Four agencies do not specify or enforce requirements for cost–benefit analyses in business cases.

Analysis of a selection of grant programs identified 4 agencies that did not prepare a business case, including Transport for NSW allocating approximately $30 million over 3 successive funding rounds for a program (see Chapter 5).

Deficient due diligence checks and monitoring controls reduce the effectiveness of oversight of the use of grants

Analysis indicates that 5 agencies do not require criminal history checks on funding applicants, 4 do not require financial capacity checks and 3 do not consider recipients’ past performance when assessing applications. This increases the likelihood that high-risk applicants are not identified at the outset.

Weak monitoring limits oversight and delivery of grants. The depth and consistency of ongoing monitoring and reporting on performance differs across agencies, limiting assurance over outcomes and risk management. Two agencies did not outline the use of milestones or performance measures in monitoring selected programs as recommended by the Guide. Further, 4 agencies have not embedded a benefits realisation approach in their frameworks.

In one case, limited monitoring at the Department of Planning, Housing and Infrastructure led to inadequate oversight of a grant of $4.1 million made for a project. As of April 2026, the project is incomplete after approximately 5 years with $2.4 million in funding unspent. The funding agreement did not require regular reporting and the department had limited oversight of the recipient’s progress and expenditure from 2022 to 2025 (see Chapter 5).

Oversight of grants is ineffective when acquittals are not requested, monitored or evaluated

The policies of 2 agencies do not specify the extent of acquittal requirements for funding recipients, as required by the Guide. Delays in provision of acquittals by funding recipients and review of acquittals by agencies were observed in a sample of grant programs, including instances where unused public funds are yet to be recovered. These deficiencies reduce assurance that recipients have used public funds for their approved purpose or achieved intended outcomes.

Not all agencies require process, outcome and economic program evaluations at the completion of a program, as recommended by the Guide. In practice, evaluation assessments for a selection of grants reviewed were incomplete against the requirements of the Guide.

Consultants

Expenditure across all 26 agencies was analysed, and the internal controls and governance of 6 selected agencies with higher expenditure were examined in detail as part of interim audits.

Reporting on consultancy expenses is not complete

The NSW Procurement Board requires agencies to disclose consulting engagements greater than $50,000 in their annual reports. The Auditor-General’s previous performance audit NSW Government agencies’ use of consultants found that agencies inconsistently applied the definition of consulting engagements. Analysis identified at least $18.3 million in expenditure was for consultancy engagements but not reported as such by agencies in their 2024 and 2025 annual reports.

Some agencies did not comply with mandatory requirements when engaging consultants

Forty-eight contracts were selected for analysis, and 27% were found to have no conflict-of-interest disclosures completed by the consultants. Further, 13% of contracts did not include enforceable confidentiality provisions, increasing the risks around the use of sensitive government data. Agencies did not demonstrate that they considered alternatives, including using internal capability, for 17% of engagements sampled. For 40% of contracts, agencies did not monitor or evaluate the performance of the consultant.

Consultants are often engaged in direct source procurements. This included some instances where agencies applied exemptions from their policy requirements or where consultants were directly approached without a procurement process.

Taken together, these deficiencies heighten the risk of unnecessary costs and reduced value for money.

Purchasing cards

At the 26 agencies, there were 5.7 million transactions on purchasing cards (as credit cards are known in the NSW public sector) with a value of $2.3 billion for the period 1 July 2023 to 28 February 2026. Analysis indicates that purchasing cards are typically used for low-value purchases (such as office supplies, food and travel) and rely on cardholders exercising judgement to ensure expenditure is appropriate.

Expenditure across all 26 agencies was analysed, and the internal controls and governance of 6 selected agencies were examined in more detail as part of interim audits.

Purchasing card transactions include higher-risk expenditure that require scrutiny

Approximately $18 million in transactions were identified that may indicate purchasing card misuse or raise questions about their business purpose. These included purchases from vendors that retail in gift cards, entertainment, alcohol and tobacco products.

Personal purchases incurred and approved on agency purchasing cards

NSW Treasury policy mandates that cardholders are responsible for the proper use of their purchasing cards. Our data analytics identified potential personal (for a non-official purpose) and non-compliant expenditure being incurred on agency purchasing cards. In some cases, an official’s line manager approved these transactions as consistent with cardholders’ roles and for official purposes as part of acquittals, indicating deficiencies in controls designed to identify and prevent inappropriate expenditure.

Oversight is weak, with 1 in 5 transactions not acquitted within the required 30 days

Almost 21% of acquittals and approvals (to a value of approximately $350 million) took place a month or more after the expenditure was incurred, exceeding NSW Treasury’s recommended timeframe. Around 7.4% took place after more than 60 days. Delays in acquittals reduce the assurance that agencies have over the appropriate use of public funds.

Purchasing cards used for high-value purchases contrary to requirements

NSW Treasury policy indicates that purchasing cards should only be used for low-value, high- volume payments less than $10,000. There were approximately 9,350 transactions totalling $137 million that exceeded the $10,000 threshold. Purchases above this threshold increase the risk that expenditure bypasses or circumvents established procurement and payment controls. Analysis of some agencies’ policies indicate that card limits are not subject to regular review.

Technology – Cyber security

Agencies have not consistently implemented the mandatory requirements of the Cyber Security Policy

Analysis of 2024–25 annual agency reporting by the 71 agencies that report to Cyber Security NSW shows most did not comply with the policy. Over half of agencies have not implemented the ‘govern and identify’ and ‘protect’ mandatory requirements.

Some agencies have remediation strategies in place to meet requirements, though some are at least 4 years from achieving compliance. Reported cyber risks remain elevated across the sector, with 33 agencies reporting 128 significant, high and extreme residual cyber security risks.

Gaps in reporting on the implementation of policy requirements continue to reduce the reliability of the data

Aggregated attestation reporting arrangements, where 71 reports cover 189 agencies, limits visibility of entity-specific issues. Agencies are not required to report compliance with policy requirements where services are delivered by third parties, increasing the risk that deficiencies in third-party controls are not identified.

Management of legacy systems is inconsistent

Of the 10 agencies examined, 3 had not formally assessed the risks associated with each legacy system, and 2 had not implemented compensating controls to mitigate risks from legacy systems that can no longer be updated or patched.

Technology – Artificial intelligence

Internal controls and governance of 10 agencies with more significant use or potential from AI were analysed as part of interim audits.

Visibility of the use of AI and tracking of costs is limited

All 10 selected agencies have AI registers, though 4 only capture AI use that is assessed under the NSW AI Assurance Framework, increasing the risk of unmanaged and unidentified AI use.

Most agencies did not centrally track the costs of AI initiatives, limiting transparency and effective resource management. AI cost models tend to be more volatile than traditional software licencing costs.

Governance is not keeping pace with the speed at which agencies are adopting AI

AI is not consistently embedded as a strategic capability. Only half of the selected agencies have a formal AI strategy to guide adoption and maximise benefits. Agencies’ governance arrangements for AI are immature and inconsistent and half have not fully embedded AI-specific risks into their existing governance frameworks.

A focused approach to the strategic use of AI could maximise benefits so that AI use better aligns with agencies’ objectives.

Assurance of AI is inconsistent

We identified instances where agencies had not completed NSW Government AI Assurance Framework assessments or cyber security risk assessments, particularly for projects established before the framework’s introduction.

While retrospective application is not required, current guidance requires agencies to apply the framework across the solution lifecycle. Agencies need to assess existing AI solutions against the current guidance.

By 30 June 2027, agencies should strengthen their stewardship of public funds for their grant programs by:

1. putting in place policies, procedures and quality assurance processes to ensure that grants are administered consistently with the Grants Administration Guide, which includes:
   1. a process for demonstrating at the planning and design stage how grant opportunities will deliver value for money by identifying benefits and costs
   2. developing a monitoring and evaluation framework for grant opportunities, including defined performance measures and financial acquittal requirements
   3. a framework to identify and manage risks for all grants
   4. establishing centralised oversight and reporting arrangements to enable timely and effective monitoring of all grants across the entire grant life cycle.

By 30 June 2027, agencies should strengthen monitoring and oversight of the use of purchasing cards by:

2. applying data analytics to identify and investigate high-risk, potentially inappropriate, and non-compliant transactions.

By 30 June 2027, agencies should improve cyber security by:

3. formally assessing the risks associated with legacy systems and implementing appropriate compensating controls.

By 30 June 2027, agencies should strengthen the governance of Artificial Intelligence by:

4. assessing all required AI solutions against the NSW AI Assurance Framework and use that framework to assist in the lifecycle management of AI.

The NSW Government reported $18 billion in grants and subsidy expenses in 2024–25

The $18 billion in grants and subsidy expenses recorded in 2024–25 accounts for 13% of total NSW Government expenses.

This chapter analyses expenditure that meets the definition of a grant as set out in the Guide. For accounting purposes other types of transactions are also recognised as grants expenses in agency financial statements, including:

• payments to non-government organisations for service delivery
• gifts of government property
• third-party asset transfers
• ex gratia and compensation payments
• transfers between agencies
• scholarships
• transfers to local government, such as Financial Assistance Grants.

These types of transactions are not analysed in this chapter.

Grants administration must comply with requirements as set out in the Guide

The Guide provides the framework for administering grants, setting out principle-based guidance and mandatory requirements. All ministers, ministerial staff and government employees must comply with its mandatory provisions, which have been a requirement under the Government Sector Finance Act 2018 (GSF Act) since 1 July 2022. The Guide is issued by Premier’s Memorandum.

The term ‘grants administration’ covers all activities across the grant lifecycle, from initial planning through to final evaluation and reporting. Grants must deliver value for money in achieving stated objectives and adhere to the principles of transparency, accountability and probity.

The Guide sets out requirements across all stages of grants administration, including program planning and design, funding decisions, monitoring and acquittals, and the evaluation of outcomes.

The Guide also provides non-mandatory guidance on areas such as funding agreements, monitoring and acquittals, and evaluation. While this guidance is not mandatory, Premier’s Memoranda are binding on NSW Government agencies and compliance is expected.

Agency staff responsible for administering grants must also comply with relevant legislative requirements, including the Government Sector Employment Act 2013, which establishes core public sector values such as fiscal responsibility, efficient and prudent use of resources, and transparency.

Agency wide oversight and monitoring of grants is limited, weakening assurance over performance and compliance

Not all agencies are routinely reconciling grant program reports or listings and records to payments made, acquittal outcomes, or general ledger reported expenditure. Most of the 26 agencies could not readily provide grant program listings that reconcile to reported expenditure nor key information such as grant recipients, acquittal status, non-compliant expenditure or amounts to be returned. Information provided often required manual effort and coordination with individual business units.

Without regular reconciliation between grant registers, financial systems and program reporting, agencies may not readily identify discrepancies, incomplete acquittals, overpayments, unrecovered funds, or omissions in reporting. This limits assurance over the completeness and accuracy of grant information and reduces visibility over the status and performance of grant programs.

Most of the 9 selected agencies have established policies, procedures and guidance for grants administration, however, have not established organisation wide controls or reporting to monitor grants administration, delivery, performance and acquittals status. Grants administration in these agencies is largely decentralised and performed at the business unit level, covering specific grant programs. As a result, few agencies have a consistent, organisation-wide system or framework to monitor performance and from which to draw observations and assurance around performance, risk and compliance.

Organisation wide oversight and monitoring:

• improves decision-making
• makes it easier to identify and manage grant program risks and take corrective action
• improves the reliability and completeness of information reported to executive management
• means grant funds are more likely to accord with funding agreements and deliver intended outcomes.

Gaps in monitoring limits assurance over expenditure on grants

As required by TPG24-08 ‘Policy and Guidelines: CFO Certification on the Internal Control Framework over Financial Systems and Information’, chief financial officers (CFOs) design, implement and regularly monitor a risk-based internal control framework, supported by reliable data and monitoring processes.

In the context of grants administration, weak centralised oversight and monitoring limit the ability of agencies to demonstrate that these assurance requirements have been met. A consolidated view of organisational-wide grant program performance and compliance would allow CFOs to:

• assess control effectiveness
• identify and take action on issues in a timely manner
• provide assurance over the completeness and accuracy of financial and non-financial information.

The Guide requires that agencies establish procedures to ensure compliance, manage risks in line with the GSF Act, and use clear and specific written funding agreements.

Figure 2 below summarises the extent the 16 selected grant programs complied with the requirements and principles of the Guide.

The NSW Procurement Board defines a consultant as ‘a person or organisation engaged to provide recommendations or professional advice to assist decision-making by management’. The Board indicates that consultants are distinguished from other professional services and contractors by:

• the advisory nature of the work
• the output reflects the independent view or findings of the consultant
• the consultant's performance of the work is not, or mostly not, under the client’s direct supervision and direction
• the consultancy being the sole or majority element of the contract in terms of relative value or importance.

Non-consultancy professional services generally involve implementation or delivery of an existing proposal or strategy, output that is not the independent view of the supplier and there is more direct supervision and control by an agency.

Agencies must exercise judgement and care when determining if services provided by a supplier represents a ‘consultancy’, particularly as these suppliers provide a range of other professional services to agencies. The Auditor-General’s 2023 performance audit NSW Government agencies’ use of consultants found examples of consulting engagements which were not reported as consulting expenditure, indicating that the audited agencies did not apply the NSW Procurement Board's definition of consultant consistently. If a consultancy is not correctly identified at the outset of a procurement, the mandatory procurement and annual reporting requirements will not be applied.

Agencies must comply with legislation and NSW Procurement Board directions when engaging consultants

When engaging a consultant, agencies must comply with:

• Public Works and Procurement Act 1912 (PWP Act)
• Government Information (Public Access) Act 2009
• TPG25-10 Framework for Financial and Annual Reporting
• NSW Procurement Board policies and directions for procurement issued under the PWP Act.

PBD-2026-02 Engagement of professional services suppliers specifies that, when engaging consultants, agencies must:

• define the need to use a consultant, rather than other resource types
• make the duration of the consultancy as short as possible to undertake the required work
• justify any variations to the contract
• subject the engagement to appropriate confidentiality provisions
• declare and manage potential, perceived or actual conflicts of interest prior to and throughout the engagement
• assess the consultant’s work
• put appropriate documentation and record keeping practices in place
• identify the consultant when working within agencies, for example in email systems, security passes or staff directories
• not give the consultant decision-making authority in recruitment or selection processes for other consultants and contractors.

PBD-2026-02 does not apply to state-owned corporations, however, is better practice for these agencies.

PBD-2026-02 requires agencies to consider the Core NSW Public Service Work Policy, which sets expectations for identifying and delivering core work to strengthen internal capability and reduce reliance on consultants. It defines core work as activities central to government decision-making and public sector functions, including work that must be performed by government employees or progressively brought in-house.

TPG25-10 requires agencies to separately report consultancy engagements over $50,000 in annual reports, with engagements below this threshold reported in aggregate.

Agencies use suppliers to provide both consulting and other professional services

Agencies reported a decline in expenditure on consultants. Total consultancy expenditure reported in the NSW Government Total State Sector Accounts decreased from $193 million in 2022–23 to $78 million in 2024–25.

Suppliers of consulting services may also provide a range of other professional services beyond consulting, for example audit, business advisory, legal, IT and project management.

For example, from 1 July 2023 to 28 February 2026, the 26 agencies reported $46.6 million in expenditure on a sample of 85 suppliers engaged to provide consulting services. These suppliers provided $607.7 million in total services to the agencies over the period.

Figure 4 compares amounts classified as consulting expenditure with total payments to a sample of 85 suppliers who also provided consultancy services during the period 1 July 2023 to 28 February 2026.

Almost half of expenditure on consultants was paid to 10 consultants

Since 2022–23, the 26 agencies paid $85.8 million or 45% of consultancy expenditure to 10 consultants.

Figure 5 shows the expenses across these consultants between 2022–23 and 2024–25. The amounts below exclude $20.4 million in expenditure for contracts valued at less than $50,000. Agencies are not required to disclose these arrangements separately in annual reports.

Incomplete reporting of consultancy expenditure in annual reports

The Audit Office analysed a sample of payments from the 26 agencies made to suppliers who provided consultancy, as well as other services, between 1 July 2023 and 28 February 2026. The analysis identified at least $18.3 million in expenditure which were consultancy engagements but not reported as such by agencies in their 2024 and 2025 annual reports. These agencies include the Department of Education, Essential Energy, Ministry of Health and the NSW Land and Housing Corporation. We also identified $3.6 million in payments to suppliers in 2025–26 that were not classified as consultancy expenditure. Agencies have acknowledged this and will report the expenditure as consultancy expenditure in their 2026 annual reports.

Additionally, there were other contracts, which analysis undertaken by the Audit Office indicated may have met the definition of consultancy services but were not disclosed as such by the agency. While agencies disagreed with this assessment, several could not explain whether payments to these consultants were appropriately excluded from reporting. As a result, the extent of unreported consultancy expenditure may be greater than the amount identified.

Moreover, disclosures in 3 agencies’ annual reports between 2022–23 and 2024–25 were lower than amounts reported in the agency’s audited financial statements, indicating these agencies’ annual report disclosures are incomplete.

This section analyses the design and effectiveness of internal controls and governance related to consultants at 6 selected agencies. These agencies have the highest budgeted consultancy expenditure for 2025–26.

Plan, source and manage

Inconsistent engagement and management of consultants, limit agencies’ ability to demonstrate value for money, build internal capability, and maintain effective oversight.

Not all of the Auditor-General’s previous recommendations to improve the strategic management and engagement of consultants have been implemented

The Auditor-General’s 2023 performance audit found most agencies engaged consultants on an ad hoc basis, without a strategic approach. The report made recommendations for all agencies to improve internal controls and governance relating to engaging and managing consultants.

The table below shows the extent to which the selected agencies revised policies, procedures and internal controls in response to selected recommendations.

Source: Audit Office analysis.

Agency policies do not align with mandatory requirements

Not all of the selected agencies align their policies with mandatory requirements outlined in PBD 2026-02, including:

• only half mandate staff to document the need to engage a consultant rather than alternatives
• 67% provide no guidance to keep consultancy engagements to the minimum duration
• 83% do not require clear identification of consultants in email and security systems or organisational directories
• 67% do not restrict consultants from decision-making authority in recruitment or selection processes.

Core work

Core Work policy requirements have not been translated into operations

Three of the 6 selected agencies were required to comply with the Core Work Policy. The accountable authority is responsible for setting targets to reduce reliance on external resources for core work. While all 3 agencies developed plans and targets, they did not consistently:

• identify affected roles or classifications
• incorporate the principles of the Core Work Policy objectives into their procurement or consultancy engagement policies and procedures.

The absence of clear policies, procedures or guidance limits agencies’ ability to direct officials and ensure compliance with requirements.

Purchasing cards are now a significant part of the NSW Government’s procurement processes. There are approximately 42,500 purchasing cards issued by the 26 agencies as at 28 February 2026. The agencies advise expenditure on purchasing cards from 1 July 2023 to 28 February 2026 comprised 5.7 million transactions, totalling $2.3 billion.

Use of purchasing cards must comply with NSW Treasury’s mandatory requirements

NSW Treasury has minimum requirements relating to the use of purchasing cards. TPG24-01 Management of NSW Government Payments applies to all agencies under the Government Sector Finance Act 2018. It sets out requirements for making payments to vendors and suppliers and requires agencies to use purchasing cards for ad hoc, low value supplier payments up to $10,000.

TPP21-02 Use and Management of NSW Government Purchasing Cards (TPP21-02) establishes core requirements and provides operational guidance to help agencies establish and maintain an effective, efficient and appropriate use of purchasing cards. This includes:

• The accountable authority is ultimately responsible for the proper management and administration of purchasing cards within the agency.
• Cardholders understand and are accountable for the responsible use of purchasing cards.

TPP21-02 also emphasises that agencies should have effective preventative and detective controls.

Cardholders must ensure that purchasing cards are used responsibly. Key to this responsibility is that purchasing cards should not be used for non-official purposes or to circumvent established controls.

This section provides insights into the result of analysis of purchasing card expenditure from 1 July 2023 to 28 February 2026 for the 26 agencies. The analysis was undertaken applying data analytics to identify usage trends and at-risk transactions.

Purchasing cards are mainly used for low value transactions, including office supplies, travel and food, attracting a higher risk of misuse

Purchasing cards generally used for purchases below $10,000. Analysis of expenditure indicates that officials use cards for low value purchases such as food, supplies and travel. These categories are at a higher risk of misuse as judgement is required as to what constitutes an acceptable official expense. As a result, agencies need effective preventative and detective controls to confirm purchasing card transactions are for official purposes.

Figure 7 below shows purchasing card transactions by merchant category.

Purchasing card acquittals verify that transactions are for official purposes, correctly allocated and compliant with agency policies. Acquittals are generally subject to a review by an official’s line manager.

One in 5 purchasing card transactions are not acquitted and approved within 30 days

TPP21-02 recommends that purchasing card acquittals be completed within 30 days, with review and approval by a line manager. From 1 July 2023 to 28 February 2026 approximately $350 million or 21% of transactions took longer than 30 days to be acquitted. Just over 7% of transactions took more than 60 days.

The table below summarises the time taken for purchasing card acquittals to be submitted and approved.

Source: Audit Office analysis of agencies’ purchasing card transactions – 1 Jul 2023 to 28 Feb 2026.

Delays in acquitting purchasing card transactions reduce agencies’ ability to detect problematic transactions. There is a risk that:

• inappropriate expenditure, non-compliance, or errors will not be identified in a timely manner
• transactions cannot be disputed or recovered.

Effective policies, procedures and internal controls guide staff on how to comply with TPP21-02 and set expectations for the appropriate use of purchasing cards. Detective controls over purchasing card transactions help agencies identify misuse, non-compliance or unusual spending.

This section analyses the design and effectiveness of internal controls and governance related to purchasing cards at 6 agencies, selected to reflect a range of agency types and expenditure.

Policies, procedures and risk management

Agencies’ procedural guidance on prohibited transactions and transaction splitting should be clearer

All of the selected agencies have policies and procedures to guide purchasing card use. Most agencies have processes for periodic review.

TPP21-02 recommends that agencies ensure cardholders understand and are held accountable for the responsible use of purchasing cards. Analysis of the selected agencies’ policies and procedures indicates that guidance for officials could be improved by providing more clarity over:

• Prohibited transactions. All agencies specified some prohibited transactions or merchant categories. However, the way in which these were articulated differed in detail and clarity. Some agencies provide comprehensive lists of prohibited transactions, while others relied on broader descriptions such as personal or non-official purchases. Examples of prohibited expenditure identified include cash withdrawals, gift cards, entertainment and purchases that circumvent established procurement processes.
• Invoice splitting.

Integration of risks related to purchasing cards into enterprise risk management frameworks is limited

TPP21-02 requires agencies to identify and manage purchasing card risks consistent with their risk management framework. Formal identification of purchasing card risks boosts visibility at the enterprise level and supports effective monitoring and mitigation.

Only one of the 6 agencies captures purchasing card risks in its enterprise risk register, including those risks identified in TPP21-02, such as inappropriate use.

Some agencies had not conducted an internal audit of purchasing cards in the past 3 years in line with better practice

TPP21-02 recommends regular internal audits of purchasing card controls. Internal audits can provide assurance over the effectiveness of controls and governance arrangements, and help identify inefficiencies or non-official expenditure. Two selected agencies have not undertaken an internal audit on purchasing cards use since 2023.

Inadequate training may heighten the risk of inappropriate use, fraud and loss

TPP21-02 requires agencies to provide training to cardholders at induction or before issuing a purchasing card. Training builds cardholder understanding of their responsibilities, accountability and policy requirements, reducing the risk of misuse. Two agencies did not require staff to undertake training on purchasing cards prior to issuance.

Data analytics

TPP21-02 recommends using detective data analytics to identify potential fraud and non-official transactions, including but not limited to unusual spending patterns, suspicious merchants, duplicate transactions and transactions outside normal business activities.

Use of data analytics to oversight transactions is inconsistent

The extent and maturity of data analytics vary across the 6 selected agencies. Two agencies did not use data analytics. Other agencies limit analysis to expenditure coding checks or a narrow focus on specific risks, such as identifying dormant cardholders or duplicate transactions. Two agencies apply more targeted data-driven techniques, identifying and targeting risks specific to that agency.

The case study below illustrates one agency’s approach to data analytics.

Card limits

Most agencies did not undertake regular reviews of purchasing card limits

TPP21-02 requires agencies to establish, embed and regularly review their purchasing card frameworks. Regular reviews support alignment with genuine needs and delegated authority levels. Four of the 6 selected agencies did not have policy requirements to regularly assess whether limits are appropriate.

Cyber Security NSW aims to strengthen cyber resilience across all entities. Its Cyber Security Policy specifies mandatory requirements for agencies which are also recommended for state owned corporations.

There are 31 mandatory requirements, divided into 114 detailed requirements, grouped into 3 domains:

• govern and identify
• detect, respond and recover
• protect.

By 31 October each year, agencies must report to Cyber Security NSW on the extent of their compliance with the policy, cyber security risks (with a residual rating of high or extreme), and an attestation on cyber security.

In July 2026 Cyber Security NSW released a new revision to the policy. Key changes include more detailed requirements for agency heads to attest to approval of non-compliance, increased requirements for oversight and management of third-party suppliers, and guidance covering AI and quantum computing.

Leaders of the cyber security agencies in Australia, Canada, New Zealand, the UK and the US (collectively the ‘Five Eyes’ security alliance) warn that AI is fundamentally transforming cyber security and accelerating the speed, scale and sophistication of cyber threats. Their recommended areas of focus align with areas where many NSW agencies did not meet minimum cyber security policy requirements.

Cyber Security NSW also highlights the heightened risks from AI in its 2026–2028 Cyber Security Strategy and its advisories to agencies.

The February 2024 update of Department of Customer Service Circular DCS-2021-02 for the NSW Cyber Security Policy stated:

The data for 2025 shows that mandatory requirements are not fully implemented in most cases.

Cyber Security will be the subject of a future performance audit, as detailed in the Audit Office Audit Work Plan 2026–2029.

Insufficient levels of compliance with Cyber Security Policy requirements

As indicated in the figure below, less than half the agencies self-assessed that they comply with the ‘govern and identify’ and ‘protect’ domain mandatory requirements.

Remediation strategies indicate some agencies at least 4 years away from compliance

Agencies typically incorporate remediation plans into their cyber security and/or technology strategies and outline the activities required to achieve full compliance with policy requirements assessed as partially met or non-compliant. All 10 agencies have identified the stakeholders for the uplift program including their roles and responsibilities.

Remediation plans generally include implementation timeframes from a few months to 4 years. Information on prioritised remediation activities is based on risk and available funding and/or resourcing.

The remediation plan timeframes indicate full compliance with the Policy is at least 4 years away for some agencies.

Agencies need to address legacy systems and compensating controls for systems that can no longer be patched

Legacy systems often support critical operations while introducing operational and cyber security risk. It presents an asset lifecycle management, risk acceptance and compensating control challenge. Without clear inventories, formal risk assessments, compensating controls or plans for upgrades, replacement or decommissioning, agencies may be unable to manage these risks.

Analysis of the 10 selected agencies identified:

• all 10 agencies maintain an inventory of legacy systems in use, however not all of them recorded this information in a centralised listing
• 3 have not formally assessed the risks associated with each legacy system, although most have an approved strategy to upgrade, replace or decommission of these systems
• 2 agencies have not formally assessed and implemented compensating controls to mitigate risks from legacy systems that can no longer be updated or patched
• approaches from agencies that have implemented compensating controls vary depending on the systems, including measures such as network segmentation, system isolation and restricted access.

Digital NSW defines AI as ‘the ability of a computer system to perform tasks that would normally require human intelligence, such as learning, reasoning, and making decisions. AI encompasses various specialised domains that focus on different tasks.’ Examples include generative AI, machine learning, chatbots and virtual assistants.

Agencies expect AI use to continue to grow. At the 10 agencies current uses of AI include:

• productivity and workflow improvement, including workforce planning
• analysis of data, documents, images and videos to identify patterns, events and summaries
• AI assistants and chatbots
• learning and development support
• cyber security.

Agencies need robust governance frameworks to guide the development, deployment and oversight of AI to safeguard ethical standards, uphold integrity and meet public expectations.

The NSW AI Operational Policy was issued in July 2026, replacing the NSW Ethics Policy which was in effect during the period of this audit.
The NSW Government's AI Framework now consists of:

• AI Strategy which sets direction
• NSW AI Operational Policy which mandates requirements
• NSW AI Assessment Framework which is the process for assessing risks in AI projects
• AI Review Committee which advises on high risk AI uses.

DCS-2026-02 Use of Artificial Intelligence by NSW Government Agencies mandates compliance with the Operational policy, including the requirements to adhere to Australia’s AI Ethics Principles when using AI and to apply the AI assessment framework.

The Office of AI advised that the new NSW AI Operational Policy will improve some of the matters raised in this report.

NSW government agencies’ use of Artificial Intelligence is the subject of a performance audit, as detailed in the Audit Office Audit Work Plan 2026–2029.

Risks can be mitigated in AI program design

The case study below demonstrates the application of the NSW Government’s AI Framework and how AI risks can be mitigated by effective controls in program design.

Agencies report challenges and barriers that hinder effective AI adoption

The 10 selected agencies identified challenges and barriers to the adoption and use of AI:

• Governance, policy and ethical frameworks. Agencies face challenges in establishing and maintaining effective AI governance, including developing policies, frameworks and ethical guardrails that keep pace with rapidly evolving technology and regulatory requirements. The responsible adoption of AI is complicated by a lack of coordinated approaches, clear decision-making structures, and defined roles and responsibilities.
• Data sensitivity, security and quality. Managing sensitive information, such as personal or community-impacting data, is a major barrier. Agencies struggle with data classification, privacy, data loss, and maintaining high data quality and availability for AI systems.
• Education, skills and change management. Limited AI literacy, training and staff understanding hinder responsible and effective use. Agencies report challenges in engaging staff in professional learning, managing workforce impacts, and ensuring employees understand the risks and capabilities of AI tools, including public or unauthorised generative AI tools. Rapid advances in AI increase the challenge.
• Integration with legacy systems and operational complexity. Integrating AI into existing, often fragmented or legacy IT systems presents technical and operational challenges. Agencies must manage change across processes and workflows, balance productivity with transparency and safety, and consistently apply AI to business needs.

Some agencies lack oversight of the AI they have adopted

There are gaps in the completeness of the selected agencies’ AI registers. Six agencies capture all AI use, while 4 capture only AI use assessed under the framework. While not captured, these AI uses may warrant greater oversight without this assessment. Further risks exist with agencies needing to understand third party use of AI on their behalf, and the use of unapproved AI solutions.

A complete inventory of AI solutions will build transparency, oversight and accountability. It will give agencies a complete view of current or planned AI technologies, and increase their ability to confirm that governance arrangements are fit for purpose.

Most agencies did not centrally track the cost or set budgets for AI solutions. AI cost models are evolving rapidly, and are trending towards consumption-based pricing models driven by token usage (representing compute power used) rather than per-user licencing models. Token prices and usage can be volatile which may result in unexpected costs to agencies.

The Auditor-General’s Internal Controls and Governance 2025: Procurement and Technology report recommended agencies create a central AI inventory to document its purpose, uses and limitations for transparency, oversight and accountability.

Greater use of the NSW AI Assessment Framework would support responsible AI usage

The framework aims to ensure AI solutions are designed, built and operated with a strict adherence to the mandatory AI Ethics Policy.

Of the 15 selected projects (10 below $5 million and 5 above $5 million):

• 13 had the framework performed against them
• 2 did not use the framework assessment as it was not in place when AI solution was implemented
• 4 did not perform a cyber risk assessment.

The framework requires its application across the AI solution lifecycle. This means existing AI solutions need to be assessed as part of the ongoing governance of all AI solutions.

These gaps reduce confidence that agencies have adequately assessed the reliability, security and appropriateness of the AI tools implemented.

Half the agencies have a strategy to help maximise the benefits of AI

While the agencies have already implemented AI and plan to expand its use, only half the selected agencies have a formal AI strategy. A greater focus on the strategic use of AI could help maximise benefits from AI and ensure alignment with agencies’ objectives.

All selected agencies use AI but only half have an AI policy

Some agencies are developing or reviewing policies; others rely on the AI Ethics Policy. While the AI Ethics Policy sets out overarching principles, it is not sufficient; agency-level policy is required to deal with elements specific to that agency, including:

• policy ownership, scope and application
• roles and responsibilities, including internal review processes for new use cases
• compliance and internal reporting requirements, including how and to whom to report misuse or concerns.

The Auditor-General’s Internal Controls and Governance 2025: Procurement and Technology report recommended agencies establish and implement an AI policy and embed the consideration of AI use into governance frameworks.

AI adoption is outpacing the establishment of effective governance arrangements

Agencies need to more effectively integrate AI considerations into their governance frameworks to:

• evaluate AI’s broader impacts on accountability structures, policies and procedures (such as IT, procurement, risk management)
• adequately train staff to take advantage of AI and ensure its responsible use.

The table details the governance over the adoption and use of AI by agencies, focusing on whether agencies have considered the specific and unique risks posed by AI.