Councils provide a range of services and infrastructure for a geographical area. Services include waste collection, planning, child and family day care, and recreational services. Councils also build and maintain infrastructure, including roads, footpaths and drains, and enforce various laws. While core functions such as waste collection are similar across councils, the range of services each council provides can vary depending on the needs of each community.

County councils are formed for specific purposes, such as to supply water, manage flood plains or eradicate noxious weeds.

Joint organisations (JOs) are formed by councils in regional New South Wales. Core activities of JOs include regional strategic planning and priority setting, engaging in shared services with member councils, and regional advocacy and collaboration with the state and federal governments.

This report provides the results of the 2020–21 financial audits of 127 councils, 13 joint organisations and nine county councils.

In preparing this report, our observations and analyses were drawn from:

• audited financial statements
• performance audit reports
• data collected from councils
• audit findings reported to councils in audit management letters.

Each local council has unique characteristics such as its size, location and services provided to their communities. To enable comparison, we divided councils into three categories – metropolitan, regional and rural. County councils and joint organisations are separately identified in the report. Details of councils grouped into categories are provided in Appendix three.

Indicators of quality financial reporting include:

• unqualified audit opinions
• the number of errors in financial statements
• timeliness in preparing financial statements.

Audit opinions

Unqualified audit opinions were issued for all but one council

Except for Central Coast Council, unqualified audit opinions were issued for all completed councils and joint organisations' 30 June 2021 financial statements audits. Sufficient audit evidence was obtained to conclude the financial statements were free of material misstatement and were prepared in accordance with Australian Accounting Standards and the LG Act.

Qualified audit opinion issued for Central Coast Council on carrying values of roads, bridges, footpaths, bulk earthworks, stormwater drainage, water supply network and sewerage network assets

A qualified audit opinion was issued for the 30 June 2021 financial statements of Central Coast Council. As disclosed in the financial statements of Central Coast Council, the council recognised $5.5 billion of roads, bridges, footpaths, bulk earthworks, stormwater drainage, water supply network and sewerage network assets within ‘Infrastructure, property, plant and equipment’ in the Statement of Financial Position as at 30 June 2021.

In the 'Statement by the Administrator and Management', Central Coast Council certified that they were unable to provide sufficient evidence to support the carrying values of these assets in the Statement of Financial Position as at 30 June 2021. This is because the asset data used by council to value these assets could not be reconciled by council to its financial records prior to the valuation. The asset data was sourced from a non-financial system that did not include financial information or reference data that could be used to identify assets in council's fixed asset register.

Due to this limitation in scope of our audit, we were also unable to obtain sufficient appropriate audit evidence to support the carrying value of these assets and determine its impact on the Income Statement, Statement of Comprehensive Income and relevant notes to the financial statements for the year ended 30 June 2021.

Emphasis of matter paragraphs were included in Tenterfield Shire Council and Central Coast Council audit opinions relating to non-compliance with the LG Act

An emphasis of matter paragraph was included in the Independent Auditor's Reports to draw attention to non-compliance with the LG Act which both councils self-disclosed in their financial statements.

Both councils breached sections 409 and 410 of the LG Act during the year ended 30 June 2021 by accessing restricted funds without the required approvals.

Audit is still in progress for one council

The following audit remains outstanding and the outcome will be reported in next year's report to Parliament:

Errors identified through audits

Increase in the dollar value of errors identified

Our audits identified more errors and the total dollar value of these errors was higher compared to the prior year. It is important that councils perform robust reviews to minimise errors identified in financial statements. There were 18 councils (2019–20: 20 councils) where no errors were identified in their financial statements.

Corrected errors

A corrected error is an error identified by the auditor or council, which is subsequently corrected by council in the financial statements.

Of the 246 corrected errors identified in the 30 June 2021 financial statements, 13 were greater than $30 million:

The common areas where corrected errors were identified are outlined below.

Uncorrected errors

An uncorrected error is an error identified by the auditor or council in the financial statements, which has not been corrected by council. There are various reasons why errors are not corrected, the most common being it is not material to the financial statements taken as a whole.

Sixty-one per cent of the total value of uncorrected errors was due to unrecorded rural firefighting equipment

In 2017, we recommended that OLG should address the different practices across the local government sector in accounting for rural firefighting equipment.

In 2020–21, 68 (2019–20: 68) councils did not record rural firefighting equipment in their financial statements estimated to be $145 million (2019–20: $119 million). Forty-one councils recognise this equipment in their financial statements with a total value of $162.8 million, highlighting the inconsistent recognition practices across the local government sector.

The financial statements of the NSW Total State Sector and the NSW Rural Fire Service do not include these assets, as the State is of the view that rural firefighting equipment that has been vested to councils under section 119(2) of the Rural Fires Act 1997 is not controlled by the State. In reaching this conclusion, the State argued that on balance it would appear the councils control the rural firefighting equipment that has been vested to them. It is important to note that there are only two parties to the agreements that govern the use of vested rural firefighting equipment, leaving only two parties who would be considered to control this equipment – the NSW Rural Fire Service in the State sector, or councils in the local government sector.

The Department of Planning and Environment (inclusive of the Office of Local Government) (the Department) confirmed in the ‘Report on Local Government 2020’ (tabled in Parliament on 27 May 2021) their view that rural firefighting equipment is not controlled by the NSW Rural Fire Service.

The Local Government Code of Accounting Practice and Financial Reporting confirms the State’s view that it does not control these assets but provides that ‘Councils need to assess whether they control any rural firefighting equipment in accordance with Australian Accounting Standards’. It would seem however, given the State’s view that it does not control these assets, that these assets can only be controlled and therefore recognised by councils in the local government sector.

Despite this, many councils do not report these critical assets in their financial statements.

The continued non-recording of rural firefighting equipment in financial management systems of some councils increases the risk that these assets are not properly maintained and managed. Councils who have rural firefighting equipment vested from the NSW Rural Fire Service should recognise these assets in their financial management systems and consider their condition and useful life.

The Department should intervene where councils do not recognise rural firefighting equipment

The Department, through the Office of Local Government, requires each council to prepare financial statements in accordance with Australian Accounting Standards (accounting standards), as required by the LG Act. The State Government, through NSW Treasury (and in agreement with the Department), has concluded that under accounting standards rural firefighting equipment vested to councils is not controlled by the State, and further on balance that councils in the local government sector control this rural firefighting equipment.

The Department’s role includes assessing whether intervention is appropriate with respect to council's compliance with and performance against legislative responsibilities, standards or guidelines. Given the State's clear position, it would appear that any council not recognising this equipment is non-compliant with the relevant accounting standards.

Having considered the accounting position papers prepared by the respective stakeholders, the Audit Office has advised councils and the Department that any council not recognising this equipment is not complying with the requirements of the Australian Accounting Standards.

The Department should now intervene to address this matter as a priority.

We acknowledge that the Department has committed to working closely with NSW Treasury to educate, guide and assist councils to understand the State’s view regarding ownership and recognition of rural firefighting equipment in their financial statements.

Non-recognition of this equipment may impact the financial statements audit opinions of those councils

The NSW Rural Fire Service (NSW RFS), a state government entity, has spent in excess of $1.1 billion over the past ten years on rural firefighting activities and equipment. While confirming the State Government's position that it does not control this equipment, the NSW RFS advised it has a complete listing of the rural firefighting equipment vested to councils under section 119(2) of the Rural Fires Act 1997, and has provided this to the Department. The NSW RFS also confirmed that as it does not control the equipment, it is unable to confirm its value or condition.

This raises two general questions: whether these assets are being properly managed as in some instances they are purportedly not controlled by any government sector and are not recorded in either the State or the local government sector financial records, and whether in these instances there is non-compliance with accounting standards if this equipment is not recorded in the financial statements of councils. This may impact audit opinions on the financial statements of councils.

The Audit Office is conducting performance audits of the NSW Rural Fire Service (Planning and managing bushfire equipment) and the Office of Local Government (The effectiveness of local government regulation and support).

Prior period errors

A prior period financial statement error is an error identified in the current year that relates to the previous year’s audited financial statements.

	Prior period errors			By council type (2021 only)
Year ended 30 June		2020	2021	Metro	Regional	Rural	County	JO
Less than $250,000		2	4	1	--	3	--	--
$250,000 to $500,000		4	2	--	1	1	--	--
$500,000 to $1 million		1	4	2	--	2	--	--
$1 million to $5 million		18	11	5	1	4	1	--
$5 million to $15 million		21	19	9	8	2	--	--
$15 million to $30 million		9	6	6	--	--	--	--
$30 million to $50 million		1	4	3	1	--	--	--
$50 million and greater		5	4	2	2	--	--	--
Total number of errors		61	54	28	13	12	1	--
Total value of errors ($ million)		813	777	500	241	32	4	--

Of the 54 prior period errors, eight were greater than $30 million. All these errors were asset related.

There were no prior period errors identified at joint organisations.

Of the 54 prior period errors, 45 were asset related that were identified in 28 councils. The common areas where prior period errors were identified are outlined below.

Eighty-three per centre of the total prior period errors were asset related

Extreme risk findings

No extreme risk findings were identified in 2020–21. Last year, one extreme risk finding was reported at Central Coast Council. The council spent restricted funds for unrestricted purposes during 2019–20, without the appropriate approvals under the LG Act. It was reclassified as a high-risk finding in 2020–21.

High-risk findings

Six high-risk findings were reported at the following councils, including three new findings, two repeat findings and one repeat finding reclassified from extreme risk in 2019–20. One of the 2019–20 high-risk findings was resolved and one finding was reclassified to moderate risk in 2020–21 as management has taken action to mitigate the risks.

Common findings

The common governance findings reported in audit management letters related to deficiencies in corporate governance policies, fraud controls and legislative compliance.

Key corporate governance policies were not in place or regularly updated at 70 councils

The common areas where councils were missing governance policies are summarised below.

Corporate governance policies are essential for ensuring councils operate in accordance with external and internal requirements. It is important that the rules, standards and expectations are clearly outlined, and staff are provided adequate guidance to inform their actions.

Further issues were identified in contract management for 30 councils. While contract management policies were in place for these councils, we identified deficiencies in their contract management practices or contract register management. There is an increased risk of non-compliance with the Government Information (Public Access) Act or contractual terms.

Deficiencies in fraud control processes at 34 councils

Thirty-four councils reported deficiencies in fraud control processes, reduced from 41 councils reported in 2019–20.

The following fraud control deficiencies were reported in audit management letters.

Effective fraud controls and ethical frameworks help protect councils from events that risk serious reputational damage and financial loss.

Lack of legislative compliance policies or register at 25 councils

Twenty-five councils did not have a sufficient legislative compliance policy or register. This has improved from 38 councils reported in 2019–20.

Legislative compliance frameworks assist councils to monitor compliance with key laws and regulations. This is important as councils provide a broad range of services to the community and are subject to many legal requirements. A legislative breach can attract penalties, impact service delivery and cause significant reputational damage.

Twenty-seven councils do not have an internal audit function

Internal audit is an important element of an effective governance framework as it supports a risk and compliance culture. Internal audit provides assurance over council's governance practices and internal control environment, and identifies where performance can improve.

The LG Act also envisages the establishment of an internal audit function in each council to support the work of the audit, risk and improvement committee (ARIC). OLG released a discussion paper in September 2019 'A New Risk Management and Internal Audit Framework for Local Councils in NSW', detailing the proposed new framework.

In August 2021, OLG issued draft 'Guidelines for Risk Management and Internal Audit for Local Councils in NSW' to guide the operations of ARICs and to require councils to have a risk management framework and internal audit function to support and inform their operations. These guidelines are still in draft at the time of writing this report.

Under the proposed OLG guidelines, councils and joint organisations are not required to establish a risk management framework and internal audit function that complies with the guidelines until 30 June 2024.

In 2020–21, 101 councils have established an internal audit function, with majority of these functions outsourced from external providers. Twenty-seven councils do not have an internal audit function.

One hundred and eleven councils have established an audit, risk and improvement committee

The requirement for all councils and joint organisations to establish an audit, risk and improvement committee was further deferred to 4 June 2022 due to the COVID-19 pandemic. Councils and joint organisations are permitted under section 428B of the LG Act to enter into arrangements with other councils or joint organisations to share ARICs.

As at 30 June 2021, 111 councils have established an ARIC. Of the 111 councils, seven have a shared arrangement with other councils.

Councils and joint organisations that do not currently have an ARIC should take action to ensure they comply with legislative requirements

Audit, risk and improvement committees are an important contributor to good governance. They help councils to understand strategic risks and how they can mitigate them. An effective committee helps councils to build community confidence, meet legislative and other requirements, and meet standards of probity, accountability and transparency.

Opportunities could also exist for councils to gain efficiencies by increasing the number of shared ARICs where practical by scale or geographical location to do so.

ARICs can play an important role in providing feedback on financial statements before they are submitted to audit as part of management's quality review process.

Forty-four councils' (40%) ARICs reviewed financial statements before submission to the Audit Office, while 67 councils' (60%) ARICs did not review financial statements before submission to the Audit Office.

Only 16 (14%) ARICs obtained certification of effectiveness of internal controls from management to support the financial statements and information.

There is an opportunity for OLG to issue guidance to councils to develop an internal control certification process as better practice. In the NSW state sector, Chief Financial Officers provide an annual certification as to the effectiveness of its systems, processes and internal controls for ensuring that financial information is relevant and reliable.

High-risk findings

High-risk findings, including three repeat findings, one new finding and two repeat findings elevated from moderate risk in 2019–20, were reported at the following councils. Three of the 2019–20 high-risk findings were resolved, and another three were reclassified to moderate risk in 2020–21 as management has taken action to mitigate the risks.

Common findings

Common findings across councils include:

• Financial statements submitted for audit for 30 councils contained numerous errors and disclosure deficiencies.
• Sixteen councils continued to not appropriately apply or adequately assess the impact of the new accounting standards that were effective in 2019–20.
• Lack of preparation for the audit, such as having a financial reporting plan, impacted the timeliness of financial reporting at 21 councils.
• Eleven councils have deficiencies in related parties' policies and disclosure.

Further analysis and insights on financial reporting findings are detailed in Chapter 2 'Audit results'.

High-risk findings

Five high-risk findings, including one new finding, two repeat findings and two repeat findings elevated from moderate risk in 2019–20, were reported at the following councils. One of the 2019–20 high-risk findings was resolved, and another was reclassified to moderate risk in 2020–21 as management has taken action to mitigate the risks.

Common findings

The common financial accounting findings reported in audit management letters related to deficiencies in key account reconciliations and processing of manual journal adjustments.

Lack of segregation of duties with manual journal adjustments at 24 councils

There was a lack of segregation of duties over the posting of manual journal adjustments to financial information at 24 councils. An independent review of manual journal adjustments is important to reduce the risk of fraud or error in the financial statements.

Key account reconciliations were not prepared in a timely manner or independently reviewed at 23 councils

Regular reconciliation of financial information ensures timely identification of errors and facilitates a more efficient audit process. It was reported in audit management letters that:

• there was no evidence of independent review of key account reconciliations at 17 councils
• ten councils did not reconcile all key balances in the financial statements in a timely manner.

High-risk findings

High-risk findings increased from 21 to 69 in 2020–21, including 61 new findings, six repeat findings and two repeat moderate findings elevated to high-risk. They were reported at the following councils. The increase was mainly due to the 60 new high-risk findings in relation to the unrecorded rural firefighting equipment.

Seven of the 2019–20 high-risk findings were resolved, and eight findings were reclassified to moderate risk in 2020–21 as management has taken action to mitigate the risks.

Sixty councils had a high-risk finding reported in their audit management letter relating to unrecorded rural firefighting equipment

Chapter 2 'Audit results' reported 68 councils did not record rural firefighting equipment in their financial statements. This was reported as a high-risk finding for 60 councils, a moderate risk finding for seven councils, and was not reported for one council where the assets were clearly trivial. A moderate risk was reported when council performed additional procedures to demonstrate that the unrecorded amount was not material to the financial statements.

Chapter 2 'Audit results' includes more information on the recognition of rural firefighting equipment.

Other high-risk findings

Nine other high-risk findings that related mainly to data integrity of asset registers, fair value assessments and the asset valuation process, were reported in the following councils.

Common findings

The common asset management findings reported in audit management letters related to deficiencies in asset revaluation processes, maintenance of information in asset management systems and landfill rehabilitation accounting practices.

Weak processes over maintenance, completeness and security of fixed asset registers at 67 councils

Maintaining accurate and up-to-date asset data helps councils to make appropriate decisions around asset management. The common issues reported in audit management letters relating to fixed asset registers are summarised below.

We continue to see weak processes over maintenance and security of fixed asset registers. There continues to be issues with accuracy and completeness of the asset register, duplication or missing assets, and asset registers not being reconciled with the asset management system.

Prior period errors continue to predominately relate to the quality of asset records and asset revaluation errors such as found and duplicate assets. In particular, completeness of developer contributions/gifted assets in growth councils needs improvement.

Deficiencies in infrastructure asset revaluation processes at 58 councils

Councils manage a significant range and value of infrastructure, property, plant and equipment. These assets are significant to the financial statements of councils and are subject to management judgements and estimates when determining their fair values. These judgements and estimates often require the assistance of a qualified expert valuer.

Deficiencies were identified in infrastructure asset valuations at 58 councils, including:

• inadequate documentation to support key assumptions and judgements applied including:
  • useful lives and condition assessments
  • unit rates used to value infrastructure assets
• incorrect classification of assets
• incorrect exclusion of some assets from valuations
• management not documenting their quality review over the asset valuation.

Opportunities for councils to improve the valuation process

Performing asset valuations earlier gives time for management and auditors to complete all requirements before the financial statements are prepared and allows earlier sign offs to be achieved.

Councils should have a project plan in place to manage the asset valuation process. Suggested deliverables to be included in a timetable for council valuations may include the following:

Improvements to council landfill rehabilitation accounting practices required at 26 councils

Australian Accounting Standards require a provision for landfill remediation when the obligation to operate landfill sites would result in cash outflows for the council, and when it can be reliably measured. Such provisions should be annually reassessed for changes in assumptions, legal requirements and emergence of new landfill remediation techniques.

Common findings identified in council landfill rehabilitation accounting practices include:

• no formal assessment of obligations made to rehabilitate landfill sites
• insufficient documentation of provision calculations to support inputs, assumptions and key data for accounting of the provisions
• costs associated with post-closure, aftercare and monitoring of landfill sites in their provisions not included in the assessment.

High-risk findings

There were no high-risk findings related to purchases and payables processes in 2020–21. Two of the 2019–20 high-risk findings were resolved, and one finding was reclassified to moderate risk in 2020–21 as management has taken action to mitigate the risks.

Common findings

The common purchases and payables findings reported in audit management letters related to controls around purchase orders, review of creditor information and deficiencies in credit card management practices.

Controls around purchase orders were not enforced or absent at 37 councils

At 12 councils, it was identified that employees could approve their own purchase orders. At five councils, it was identified that purchase orders were approved without appropriate delegation. It is important there is segregation of duties and appropriate delegation in procurement to reduce the risk of fraud and misuse of public money.

Purchase orders were approved after the receipt of goods or services at 28 councils. Purchase orders should be issued before requesting goods or services to reduce the risk of unauthorised transactions.

Insufficient review of changes to creditor information at 29 councils

Twenty-nine councils did not perform sufficient review of changes to creditor information in the supplier master file, including bank account details. This increases the risk of transactions paid to incorrect accounts, resulting in financial losses for councils. Councils should review each change or perform regular collective review of changes.

High-risk findings

There were no high-risk findings related to payroll processes in 2020–21 (2019–20: Nil).

Common findings

The common payroll findings reported in audit management letters related to deficiencies in the review of employee payroll data and excessive annual leave balances.

Excessive annual leave balances were reported at 49 councils

Managing excess annual leave was a challenge for councils given the recent emergency events. Councils continued to deliver essential services in uncertain times and in a disrupted work environment. Many council employees, particularly in frontline roles, deferred leave plans and have taken little or no annual leave. To support council employees during the COVID-19 pandemic, legislative amendments were made to allow councils and their employees to agree to:

• council making a payment to an employee in lieu of annual leave, provided the employee will still have a balance of at least four weeks of leave remaining
• an employee taking annual leave at double or half pay.

Changes to employee payroll data are not reviewed at 26 councils

Twenty-six councils did not have adequate processes in place to review changes to employee payroll data. This includes instances where changes are reviewed, but not by an independent person. This increases the risk of unauthorised changes or errors remaining undetected, resulting in financial loss to councils.

High-risk findings

There were no high-risk findings related to cash and banking processes in 2020–21. One high-risk finding was raised in 2019–20 and it was resolved.

Common findings

The common cash and banking findings reported in audit management letters related to the lack of security of payment files and the lack of segregation of duties in the cash handling process.

Outdated bank signatories at 14 councils

Bank signatories are not being removed on a timely basis. Fourteen councils still had their former employees listed as an account signatory for bank accounts. This increases the risk of unauthorised transactions.

Deficiencies in the cash handling processes at 12 councils

Deficiencies in the cash handling process were identified at 12 councils, including lack of daily cashier reconciliation and lack of segregation of duty. This increases the risk of undetected balancing errors and misappropriation of cash or cheques.

Lack of security of payment files for pay runs at nine councils

Nine councils did not encrypt Electronic Funds Transfer (EFT) payment files from editing or sufficiently restrict access to payment files on the network before they were uploaded to online banking portals. This increases the risk of unauthorised or fraudulent transactions.

High-risk findings

There were no high-risk findings related to revenue and receivable processes in 2020–21 (2019–20: Nil).

Common findings

The common revenue and receivables findings reported in audit management letters related to deficiencies in the review of changes to fee tables and property data in council rates systems, and inappropriate revenue recognition practices.

Lack of review of changes to fee tables and property data in the rating system at 26 councils

Council systems contain fee tables and property information, which is used to determine rates and annual charges levied on different properties. Twenty-six councils do not adequately review changes for accuracy and appropriateness. This increases the risk of errors in recording rates and annual charges in the financial statements.

Inappropriate revenue recognition at 15 councils

Twelve councils had findings raised relating to their revenue recognition practices, including:

• no effective internal controls to ensure the completeness of revenue activities recorded
• deficiencies in grants recognition that resulted in misstatement in the financial statements
• use of cash accounting basis to recognise some revenue transactions, rather than accruals.

Deficiencies in revenue recognition practices resulted in 57 errors identified in councils' financial statements, totalling $93.4 million.

High-risk findings

High-risk findings, including repeat and ongoing findings, were reported at the following councils. One 2019–20 high-risk finding was not resolved, and seven findings were reclassified to moderate risk in 2020–21 as management has taken action to mitigate the risks.

High-risk findings detailed below relate to gaps in system implementation and user access controls.

Common findings

The common IT findings reported in audit management letters related to deficiencies in IT policies and procedures, lack of a cybersecurity framework, and controls and gaps in user access management processes. This is aligned with what we reported in the prior year's report.

IT policies and procedures were outdated or not in place at 59 councils

Fifty-nine councils did not formalise and/or regularly review their key IT policies and procedures. It is important for key IT policies to be formalised and regularly reviewed to ensure emerging risks are considered and policies are reflective of changes to the IT environment. Lack of formal IT policies and procedures may result in inconsistent and inappropriate practices and an increased likelihood of inappropriate access to key systems.

Lack of periodic user access review at 42 councils and insufficient control over privileged users at 73 councils

The following common access management findings were identified:

• Forty-two councils did not perform a periodic user access review to ensure users’ access to key IT systems were appropriate and commensurate with their roles and responsibilities.
• Seventy-three councils had gaps in privileged users management process. This includes gaps in restriction of privileged users or monitoring of the privileged accounts' activity logs.

Where robust access management processes are not in place, inappropriate access may exist. This increases the risk of unauthorised transaction or modification of sensitive data and transactions. The common findings above may be rated high-risk when there are no mitigating controls to prevent or detect any unauthorised transactions.

Cybersecurity frameworks and related internal controls were not in place at 65 councils

The NSW Cybersecurity Policy states that the term cybersecurity covers all measures used to protect systems and information processed, stored or communicated on these systems from compromise of confidentiality, integrity and availability. Strong cybersecurity is an important component of the NSW Beyond Digital Strategy, enabling the effective use of emerging technologies and ensuring confidence in the services provided by NSW Government.

While there is currently no requirement for councils to comply with the NSW Government’s Cybersecurity Policy, councils may find it useful to refer to the policy for further guidance.

Cybersecurity findings were reported in 65 councils as they did not have at least one of the following governance and internal controls to manage cybersecurity such as having a:

• cybersecurity framework, policy and procedure
• register of cyber incidents
• simulated cyber attack testing (penetration testing)
• cybersecurity training and awareness program.

The Report on Local Government 2019 recommended for the Office of Local Government (OLG) within the Department of Planning and Environment to develop a cybersecurity policy by 30 June 2021 to ensure cybersecurity risks over key data and IT assets are appropriately managed across councils, and key data is safeguarded. As at the date of this report, this policy has not been completed and published. Refer to Appendix two for more information.

OLG needs to develop a cybersecurity policy to be applied by councils as a matter of high priority in order to ensure cybersecurity risks over key data and IT assets are appropriately managed across councils, and key data is safeguarded.

Formal cybersecurity frameworks/policy in place for at 80 councils

A cybersecurity framework consists of threat identification, protection, detection, response and recovery of IT systems.

In the absence of guidance from OLG, our additional data collection identified that 80 councils (54%) have developed a formal cybersecurity policy and/or framework. These councils have adopted guidance from the following sources to aid them in developing their cybersecurity policies/frameworks:

• Cybersecurity NSW
• The Australian Cybersecurity Centre (ACSC)
• International Organization for Standardization (ISO standards)
• The National Institute of Standards and Technology (NIST)
• Payment Card Industry Data Security Standard (PCI DSS)
• councils' internal/external experts' recommendations.

Based on data collected across all 150 councils and JOs:

Poor management of cybersecurity can expose councils to a broad range of risks, including financial loss, reputational damage and data breaches. Furthermore, without a formal policy and framework, formal roles and responsibilities, and involvement of those charged with governance, councils are at risk of inappropriate planning and execution of their cybersecurity responses, which may also lead to inefficient use of their cybersecurity budget.

Fifty-one per cent of councils have yet to roll out cybersecurity training and awareness programs

With 51% of councils yet to roll out cybersecurity training and awareness programs for staff, councils have an increased risk of being exposed to a cyber incident. In addition, of the 51% of councils that have not yet rolled out training and awareness programs, 57% did not cover their third parties who have access to the council's systems, in these training programs (i.e., contractors, consultants, vendors, partners).

Cyber criminals aggressively target certain staff by sending fraudulent emails, stealing credentials and sending malicious attachments, which deploy because they entice people to interact with them. The most targeted staff are those in senior positions and finance roles. Completion of cyber awareness training by all staff, contractors and third-party providers help them recognise potentially malicious emails and avoid inadvertently activating attachments and software designed to infect devices and steal data to be used by cyber criminals.

Twenty-eight per cent of councils advised that they had cyber incidents during the financial year, represented by 41 councils.

The Australian Cybersecurity Centre (ACSC) was established in 2014 to lead the Australian Government's work to improve cybersecurity. ACSC is part of the Australian Signals Directorate within the Defence portfolio. The ACSC reports that:

Further, the ACSC, through their 2020–21 Annual Cyber Threat Report, has revealed that they received over 67,500 cybercrime reports, a 13% increase on the previous financial year. ACSC also stated the self-reported losses from cybercrime during the 2021 financial year was totalling more than $33 billion.

It is well known that cyber attacks are increasing, resulting in the need for councils to uplift their cybersecurity plans immediately.

The potential impacts from poor management of cybersecurity include:

• theft of corporate and financial information and intellectual property
• theft of money
• denial of service
• destruction of data
• costs of repairing affected systems, networks and devices
• legal fees and/or legal action from losses arising from denial-of-service attacks causing system downtime in critical systems
• third-party losses when personal information stored on government systems is used for criminal purposes.