Refine search Expand filter

Reports

Published

Actions for State Finances 2021

State Finances 2021

Whole of Government
Finance
Asset valuation
Compliance
Financial reporting
Internal controls and governance
Management and administration

What the report is about

The results of the consolidated General Government Sector (GGS) and Total State Sector (TSS) financial statements audits for the year ended 30 June 2021.

What we found

The Independent Auditor’s Report on the 2020–21 GGS and TSS financial statements was unqualified but contained an emphasis of matter. The resolution of significant issues delayed signing until 24 December 2021.

The emphasis of matter draws attention to significant uncertainties associated with key assumptions related to the recognition by the GGS of a $2.4 billion investment in the Transport Asset Holding Entity (TAHE).

The Audit Office advised NSW Treasury that it intended to issue a qualified audit opinion, but actions by the NSW Government avoided this outcome. All evidence provided prior to 14 December indicated that the GGS’s return on the $2.4 billion cash contributed to TAHE was insufficient to support accounting for it as an investment. Projected returns were below the long term inflation rate and were insufficient to recover:

  • TAHE's revaluation loss of $20.3 billion in 2020–21
  • an average rate of return of at least 2.5 per cent of equity invested in TAHE.

In these circumstances, the $2.4 billion contributed to TAHE should have been expensed. This could have impacted the GGS’s budget result.

The NSW Government’s actions to avoid a qualified audit opinion included:

  • a government decision made on 14 December approving TAHE’s shareholding ministers communicating that their expectation of a return had increased to 2.5 per cent
  • reflecting the revised shareholding ministers’ expectations in the 2021–22 ‘NSW Half-Yearly Review’ on 16 December. The NSW Government provided an additional $1.1 billion to fund increased access and license fees to TAHE from the public sector operators (Sydney Trains and NSW Trains)
  • signing a Heads of Agreement (HoA) on 18 December between Transport for NSW (TfNSW),TAHE and the public sector operators. The HoA reflected the parties’ intent to renegotiate contracts to increase TAHE’s licence and access fees by $5.2 billion.

The uncertainty raised in our emphasis of matter relates to:

  • TAHE’s future estimated access and licence fees, which remain subject to re-negotiation and must meet or exceed the indicative future access and licence fees set out in the HoA
  • continued funding for TAHE's key customers (Sydney Trains and NSW Trains) to meet the price increases outlined in the HoA
  • the 2021–22 'NSW Budget Half Yearly Review', which provides for $1.1 billion of the additional funding over the forward estimates period to 2024–25. A further $4.1 billion is required over the following six years (2026–31), which are outside the forward estimates period
  • further significant cash flows required to support the funding model are outside the 10-year contract period. That is, beyond 30 June 2031.

There remains a risk that:

  • TAHE will not be able to re-contract with the rail operators for access and licence fees at a level that is consistent with current projections
  • future government's funding to TAHE’s key customers, the rail operators, may not be consistent with the current shareholding ministers’ expectations
  • TAHE will be unable to grow its non-government revenues.

The audit found a risk of undue reliance on consultants, a need to improve quality controls on materials submitted to audit and an extreme risk finding raised with respect to providing key information on a timely basis.

The GGS Budget Result for the 2020–21 financial year was a deficit of $7.1 billion compared to an original forecast budget deficit of $16 billion.

The State did not achieve its fiscal target of maintaining annual expenditure growth below the long-term revenue growth target of 5.6 per cent. In 2020–21, the GGS expenditure grew by 6.9 per cent mainly due to grants and subsidies paid from the COVID-19 stimulus packages received from the Commonwealth.

What we recommended

Significant matters concerning TAHE

We recommend NSW Treasury:

  • implement effective quality review processes over key accounting information
  • establish a policy to determine the minimum expected rate of return on its equity injections into public sector entities
  • report on the performance of investments in TAHE and all other public sector entities
  • ensure the revised commercial agreements between TAHE and NSW rail operators reflect access and licence fees set out in the Heads of Agreement
  • with TAHE, prepare robust projections and business plans to support returns beyond FY2031
  • liaise with the Australian Bureau of Statistics (ABS) and reconfirm the sector classifications of TAHE, NSW Trains and Sydney Trains
  • with TAHE, monitor the risk that control of TAHE assets could change in future reporting periods
  • significantly improve its processes to ensure all key information is identified and shared on a timely basis
  • consider whether there is sufficient competent oversight of its use of consultants and assess the risk of an overdependence on consultants at the cost of internal capability.

A number of other non-TAHE related recommendations have been raised in Section 6 ‘Key Audit Findings’.

Fast facts 

The Total State Sector comprises the General Government Sector, the Public Non-Financial Corporation (PNFC) Sector and the Public Financial Corporation (PFC) Sector.

The 2020–21 consolidated financial statements of the General Government and Total State Sectors provide the financial performance and position of the NSW Government.

  • $391b government property, plant and equipment in the Total State Sector as at 30 June 2021
  • $3.3b government net contributions to other public sectors in 2020–21. $2.4 billion was contributed to TAHE
  • $19.3b net holding losses from the GGS's investment in other public sector entities recognised outside of the 2020–21 budget result
  • $7.1b budget deficit of the General Government Sector in 2021
  • 7 - six high risk and one extreme risk management letter findings related to the General Government Sector's investment into TAHE
  • 24 monetary misstatements exceeding $20 million were identified in agencies financial statements in 2020–21
Image
Margaret Crawford, Auditor-General for New South Wales

Pursuant to the Government Sector Audit Act 1983 I present my report on State Finances 2021. My independent auditor’s opinion on the State’s consolidated financial statements, albeit delayed, is unqualified. My independent auditor’s report however, does include an emphasis of matter drawing attention to significant uncertainties remaining in relation to the State’s equity investment in the Transport Asset Holding Entity (TAHE).

The 2020–21 year was challenging from many perspectives, not least being the continuing impact of and response to the COVID-19 pandemic. Once again, NSW Treasury provided government agencies extensions of time to submit financial statements for audit. Finance staff and management right across government must be congratulated for their responsiveness in meeting their financial reporting obligations in such challenging circumstances.

The General Government’s 2020–21 budget result, reflected within the Total State Sector Accounts, was a deficit of $7.1 billion. This compares with the original budgeted deficit of $16 billion. The factors that contributed to this outcome are presented in this Report to Parliament along with other significant matters related to the audit of the Total State Sector Accounts.

One section of my report is dedicated to issues related to the accounting for TAHE. This year’s audit was significantly delayed by protracted disagreement over the treatment of the government’s cash contribution to TAHE. This matter was further frustrated by the fact that information was withheld and not shared with my Office on a timely basis. This has warranted an extreme risk finding for NSW Treasury to significantly improve governance processes to ensure complete and timely sharing of information. This is key to preserving trust, which is one of the foundations that underpins my Office’s engagement with agencies in the conduct of their audits.

The challenges encountered in completing this year’s audit were extraordinary and tested the constructive partnership between the Audit Office and NSW Treasury. I want to acknowledge the enormous efforts of staff of both agencies to correct material errors and ultimately achieve my unmodified audit opinion. I saw first-hand the professionalism, resilience and dedication of my staff. A commitment to accurate and transparent financial reporting is a key basis upon which confidence in the financial management of New South Wales’ resources can be assured.

Margaret Crawford

Auditor-General for New South Wales

9 February 2022

The Independent Auditor's Report, which includes an emphasis of matter was issued on 24 December 2021

While the audit opinion on the State's 2020–21 financial statements was ultimately unmodified, NSW Treasury delayed signing the NSW Total State Sector Accounts (TSSA) in order to resolve significant accounting issues that were material to the TSSA, in particular the treatment of the General Government Sector's (GGS) investment in the Transport Asset Holding Entity (TAHE) during 2020–21.

The Treasurer and NSW Treasury signed the consolidated financial statements on 24 December 2021, eleven weeks later than the 2018–19 pre-pandemic timetable.

The Audit Office advised NSW Treasury that the 2020–21 TSSA would be qualified with respect to TAHE

Our review of all evidence received prior to 14 December indicated the GGS's expected returns were below the long-term inflation rate and that there was no expectation it should recover a significant asset revaluation loss. The levels of projected returns did not support the accounting treatment of the GGS's cash contribution of $2.4 billion to TAHE as an equity injection.

The TSSA are prepared in accordance with Australian Accounting Standards and particularly AASB 1049 ‘Whole-of-Government and General Government Sector Financial Reporting’. This standard requires contributions from owners to comply with the Australian Bureau of Statistics (ABS) Government Finance Statistics Manual 20151 (GFSM) where it would not conflict with Australian Accounting Standards.

The ABS GFSM states that an equity contribution is recognised unless there is no reasonable expectation that a sufficient rate of return can be generated by that investment, in which case the transfer is expensed. A realistic rate of return is defined in the ABS GFSM as the intention to earn a rate of return that is sufficient to generate dividends (including income tax equivalents) and holding gains or losses at a later date. Holding losses include the final asset revaluation decrement of $20.3 billion, which TAHE incurred on its property plant and equipment assets when it became a for-profit entity and was required to value its assets on the basis of the cash flows they are expected to generate. The lower the commercial returns (cashflows), the greater the potential valuation losses of a for-profit entity's assets. This $20.3 billion valuation loss is disclosed within notes 1 'Significant Accounting policies - TAHE Reform in 2020–21', Note 11 'Equity Investments in Other Public Sector Entities' and Note 14 'Property, Plant & Equipment of the Total State Sector and GGS' financial statements.

Multiple versions of models estimating the GGS's expected rate of return were submitted to the Audit Office by NSW Treasury attempting to demonstrate the commerciality of the GGS's investment in TAHE. Until 14 December 2021, our review of all calculations indicated the existing access and licence fees set up under commercial arrangements effective 1 July 2021 did not support a reasonable expectation that a sufficient rate of return would be earned on the equity injections to TAHE. The existing revenue arrangements reflected a shareholders' expected rate of return of only 1.5 per cent per annum of contributed equity and did not include recovery of the revaluation loss of $20.3 billion incurred in 2020–21.

Having reviewed all evidence provided, the Audit Office communicated to NSW Treasury that unless corrected, the State's accounts would be qualified as the $2.4 billion transfer made by the GGS to TAHE should have been reported as a grant expense instead of an investment. The GGS's estimated rate of return was not sufficient to cover:

  • TAHE's final revaluation loss of $20.3 billion in 2020–21
  • a dollar value equal to, or exceeding a 2.5 per cent rate of return on the equity invested in TAHE (ie: at least equal to the long term inflation rate).

Action was required by the NSW Government to avoid a qualified audit opinion

NSW Government actions avoided a qualified audit opinion related to the GGS’s cash contribution of $2.4 billion to TAHE. To support the TAHE structure as a commercial arrangement earning a sufficient rate of return, the NSW Government agreed to provide additional future funding to TAHE's key government customers (Sydney Trains and NSW Trains) to support increases in access and licence fees to be paid to TAHE.

Shareholding ministers increased their expectations as to TAHE's target average return to the expected long-term inflation rate of 2.5 per cent

On 14 December 2021, a government decision was made resulting in the TAHE shareholding ministers requesting that TAHE re-negotiate the access fees and license fees payable under the Operating Agreements between TAHE and the public operators (Sydney Trains and NSW Trains). The renegotiation was to target an average return to the GGS of 2.5 per cent on the equity contributed. TAHE's existing ten year agreements with the operators provide a mechanism by which the parties meet annually and consult in order to determine the amount of the access fees and licence fees that will be payable in the following financial year.

The revised shareholder expectations for TAHE were published in the 2021–22 'NSW Budget Half Yearly Review' on 16 December 2021. The revised expectations changed the basis of the expected returns on equity from the 10-year Commonwealth bond rate of only 1.5 per cent, to the expected long-term inflation rate of 2.5 per cent. This is consistent with the Reserve Bank's target band and the Commonwealth's Department of Finance's expected return on government investments in other sectors.

The revised shareholder expectations were confirmed in a signed Heads of Agreement

On 18 December 2021, Transport for NSW (TfNSW), TAHE and the operators, Sydney Trains and NSW Trains entered into a Heads of Agreement (HoA). This HoA forms the basis of negotiations to revise the pricing within the existing 10-year contracts and deliver upon the shareholders' expectation of a return of 2.5 per cent per annum of contributed equity. This revised return includes:

  • income earned over the estimated weighted average remaining useful lives of TAHE’s assets
  • recovery of the revaluation losses in 2020–21 on TAHE’s property, plant and equipment assets incurred when TAHE commenced operations as a for-profit entity, albeit the recovery of the revaluation loss is projected to take up to 2052.

The HoA reflects an intention between all parties to revise the contractual agreements to increase future access and license fees by $5.2 billion. This included $1.1 billion for the period FY2023–25, which is reflected in the 2021–22 'NSW Budget Half Yearly Review'. Further detail on the HoA is reported in Section 3 of this report ‘Investment in the Transport Asset Holding Entity’.

NSW Treasury revised its calculations to reflect the increased future returns

Following these changes, NSW Treasury revised its calculations of estimated returns to reflect a cumulative return equivalent to the expected long-term inflation rate, and recovery of the 2021 valuation loss by 2052. The rate of return period is consistent with the weighted average remaining useful life of TAHE's assets. The changes supported the financial reporting treatment of the $2.4 billion transfer from the GGS to TAHE as an investment rather than an expense, even though TAHE is currently heavily reliant on revenues from the public rail operators, Sydney Trains and NSW Trains. If the cash contribution had to be treated as a capital grant expense, it would have reduced the GGS's budget result by $2.4 billion.

The Independent Auditor’s Report includes an emphasis of matter drawing attention to uncertainty relating to the General Government Sector's investment in the Transport Asset Holding Entity (TAHE)

Despite the investment in TAHE being better supported, and the independent auditor's opinion being unqualified, the Independent Auditor’s Report includes an emphasis of matter, which draws attention to the significant uncertainties remaining in relation to the GGS’s equity investment in TAHE. The significant uncertainty is associated with key assumptions that support the recognition by the GGS of its $2.4 billion investment in TAHE during 2020–21.

As at the time of signing the Independent Auditor's Report, there was significant uncertainty with regards to judgements around the commerciality of TAHE's operations because:

  • TAHE’s future estimated access and licence fees, which are critical to its ability to earn a realistic rate of return, remain subject to re-negotiation and re-signing of the current access agreements. The proposed indicative future access and licence fees, which are set out in the HoA are intended to form the basis of the re-negotiation.
  • $1.1 billion in additional funding for TAHE's key customers, Sydney Trains and NSW Trains, was provided in the 2021–22 'NSW Budget Half Yearly Review' consistent with the terms in the HoA. However, this funding only extends to the end of the forward estimates period in 2024–25. There is an additional $4.1 billion required over the following six years, which falls outside of the forward estimates period (up to the end of the 10-year contract period). While this has been communicated to the government's Expenditure Review Committee, it is yet to be provided for in government's budget figures. As TAHE's projections are currently highly dependent on its government customers, it is critical that the government continue to provide sufficient funding to the GGS to support increases in the prices government customers will pay for access to TAHE's assets.
  • A further significant portion of the required returns is earned outside of the 10-year contract period (terminating 30 June 2031). NSW Treasury has estimated $37.9 billion in returns from its investment in TAHE over the period from 1 July 2022 to 30 June 2052, but has not identified the source or means of these returns beyond 2031. Currently, TAHE derives the majority of its revenue from access and licence fee agreements with Sydney Trains and NSW trains, who in turn are both funded by grants to Transport for NSW from the GGS. The projected returns calculated by NSW Treasury beyond 2031 are calculated by assuming a 2.5 per cent growth rate. About 87 per cent of these estimated returns are being earned beyond the ten years, with $32.9 billion estimated over the period 2032–52. There remains risk that:
    • TAHE will not be able to re-contract for access and licence fees at a level that is consistent with current projections
    • future governments' funding to TAHE's key customers will not be sufficient to fund payment of access and licence fees at a level that is consistent with current projections
    • TAHE will be unable to grow its non-government revenues.

Significant accounting issues relating to TAHE are detailed in Section 3 to this report titled ‘Investment in the Transport Asset Holding Entity’. Other significant matters related to the TSSA audit are covered in section 6 to this report titled ‘Key Audit findings’.

Other financial reporting matters

The State extended the date for submission of agency financial statements for audit to provide relief to agencies impacted by the New South Wales' COVID-19 lockdowns

All agencies were given a one-week extension (two weeks in 2019–20) to prepare their financial statements and submit them for audit by 2 August 2021. Further extensions were subsequently approved for the following ten agencies and funds (11 in 2019–20) to submit completed financial statements for audit:

  • Department of Communities and Justice (9 August 2021 for disclosures related to cloud computing costs)
  • Investment NSW (13 August 2021)
  • Jobs for NSW (13 August 2021)
  • TCorp IM Funds (19 August 2021)
  • Lord Howe Island Board (22 October 2021)
  • Department of Customer Service (31 August 2021 for disclosures related to AASB 1059 'Service Concession Arrangements: Grantors')
  • Department of Transport (20 August 2021)
  • Sydney Olympic Park Authority (12 August 2021)
  • Planning Ministerial Corporation (12 August 2021)
  • Transport Asset Holding Entity (16 August 2021).

Additional extensions provided agencies with more time to resolve accounting issues relating to:

  • asset valuations
  • first time implementation of AASB 1059
  • asset transfers and treatment of software as service costs.

The extensions outlined above resulted in a two-week delay submitting the State’s draft consolidated financial statements for audit.

In 2020–21, agency financial statements presented for audit contained 24 errors exceeding $20 million (19 in 2019–20). The total value of these errors was $6.6 billion, a significant increase from the previous year ($1.4 billion in 2019–20)

The graph below shows the number of reported errors exceeding $20 million over the past five years in agencies’ financial statements presented for audit.

The errors resulted from:

  • incorrect application of Australian Accounting Standards and NSW Treasury Policies
  • incorrect judgements and assumptions when valuing non-current physical assets and liabilities
  • human error or lack of oversight.

The completion of the 2020–21 Total State Sector Accounts was significantly delayed as material accounting issues were resolved. These issues related to how the General Government Sector’s (GGS)2 investment in the Transport Asset Holding Entity was accounted for. The key areas of audit concern, which required considerable effort to satisfactorily resolve, included our assessment of:

  • the accounting treatment of funds transferred to TAHE from the GGS, specifically:
    • whether funds transferred to TAHE from the GGS should be considered an equity investment or capital grant expense, with the latter having implication to the presentation of the NSW Government Budget positions. Funds are expensed unless, as an investment, there is a reasonable expectation to generate a sufficient rate of return
    • forming a view as to what a ‘reasonable expectation of a sufficient rate of return on investment3’ should be with respect to the Australian Bureau of Statistics' Government Finance Statistics Manual 2015 (GFSM)
    • the valuation of TAHE’s property, plant and equipment at 30 June 2021
  • whether TAHE was correctly classified as a Public Non-Financial Corporation (PNFC) entity
  • whether, under the agreements in place for the use and price of TAHE's assets, TAHE controlled its property, plant and equipment.

Our assessments were hindered by errors and omissions in information and models provided by NSW Treasury to demonstrate expected returns from TAHE, as well as a lack of timeliness and completeness in their responses to requests for documentation to support NSW Treasury's proposed accounting of government's contributions to TAHE.

Up until 13 December 2021, evidence provided by NSW Treasury to support the treatment of a $2.4 billion equity transfer from the GGS to TAHE did not demonstrate a sufficient rate of return on the State's investment. Instead, the evidence suggested the transfer was of the nature of a capital grant expense, which would impact the GGS budget result. Unless corrected, by either reversing the equity investment to a capital grant expense (impacting the GGS budget result) or providing additional resources to the rail operators to support additional TAHE access and licence fees (adding additional expenses to future GGS budget results), this matter would have caused the State's accounts to have been qualified.

After the Audit Office communicated the likely audit outcome to NSW Treasury, significant changes were made by government from 14 December 2021. Government decisions that avoided qualification of the TSSA included:

  • On 14 December, a government decision approved communicating revised shareholders' expectations of rate of return of 2.5 per cent being the long-term inflation rate, and increased grants to Transport for NSW for the rail operators to pay increased access and licence fees to TAHE to support of the new rate of return (previously 1.5 per cent).
  • On 16 December, the 2021–22 'NSW Budget Half Yearly Review' included an increase in expected returns to be derived through higher access and license fees charged by TAHE. To facilitate these returns, an increased allocation of funds of $1.1 billion was made to Transport for NSW (TfNSW) from 1 July 2022 as part of the forward estimates for the period 2022–25. This was to pay for the proposed increased access and licence fees the operators would be required to pay TAHE.
  • On 18 December, TfNSW, TAHE and the operators Sydney Trains and NSW Trains signed a Heads of Agreement (HoA) forming the basis of negotiations to revise annual operating agreements to facilitate the shareholders’ expected returns of 2.5 per cent of contributed equity. The HoA included indicative access and licence charges to be used as a basis of renegotiation, increasing access fees and licence fees to be paid by Sydney Trains and NSW Trains over the 10-year period from 2022–2031 by a further $5.2 billion. Most of this increase occurs outside the forward estimates. The majority of the additional funding may need to be funded by future governments.

NSW Treasury has projected returns to be earned to 2052 (a period covering the weighted average remaining useful lives of TAHE's assets) as sufficient to recover the revaluation loss of $20.3 billion which arose when TAHE revalued its assets under the income approach. These assets were valued on a discounted cash flow basis as at 30 June 2021.

These key decisions and the circumstances leading up to these changes are detailed later in this section.

Background

On 1 July 2020, the former Rail Corporation of New South Wales (RailCorp), a not-for-profit entity, was renamed the Transport Asset Holding Entity of New South Wales (TAHE) transitioning to a for-profit statutory State-Owned Corporation under the Transport Administration Act 1988. There was no change in the structure of TAHE as a new entity was not created. Ownership remains fully with the government. TAHE, and the former RailCorp, were both classified as Public Non-Financial Corporation (PNFC) entities within the Total State Sector Accounts. TAHE was not a newly created entity, nor was it the result of a change in administrative re-arrangements (such as Machinery of Government change).

Prior to 1 July 2015, the government paid appropriations to TfNSW, a GGS agency, to construct transport assets. When completed, these assets were granted to RailCorp, a not for-profit entity within the PNFC sector. The grants to RailCorp were recorded as an expense in the State’s GGS budget result and in the NSW Total State Sector Accounts (TSSA).

From 1 July 2015, the government announced the creation of TAHE (a dedicated asset manager). Funding for new capital projects was to be provided through equity injections, even though the business model was yet to be determined. NSW Treasury initially set a timetable for finalising the business model, operating model and contracts for the use of TAHE's assets of 1 July 2019.

Contributions paid to TAHE by the GGS were treated as equity investments from July 2015 forward. This treatment continued, despite delays in settling the business model. In 2020, the Audit Office raised a high risk finding due to the significance of the financial reporting impacts and business risks for NSW Treasury and TAHE.

The business model eventually adopted was one whereby:

  • The GGS invests in TAHE with an expectation of a sufficient rate of return.
  • TAHE charges the operators (predominantly Sydney Trains and NSW Trains) to use network and rolling stock to deliver services. The operators remain responsible for both the delivery of the services and the maintenance and safe operation of the assets. The operators are primarily funded by TfNSW through grants.
  • The GGS grants funds to operators, which allows them to pay access fees to TAHE. The amount of these grants impacts the budget result.
  • TAHE pays a return back to GGS by way of dividends and tax equivalents. The return may also include holding gains and losses on the fair value of the net assets of TAHE.

TAHE earns relatively small amounts of income from transactions with the private sector. While the TAHE Board envisages that, over time, they will enhance the commerciality of TAHE’s operations, it is currently highly dependent on revenues from government contracts (over 80 per cent). The circularity in flow of funds between transport agencies in the GGS and PNFC sectors is shown in the diagram below:

The government continues to respond to the impacts of the COVID-19 pandemic on New South Wales through its economic stimulus measures

The COVID-19 pandemic continues to significantly impact the State’s finances, reducing revenue and increasing expenses especially in sectors directly responsible for responding to the COVID-19 pandemic, such as Health. Over 2020–21, the government allocated an additional $5.6 billion to agencies as part of its economic stimulus and pandemic response. Measures included:

  • $1.8 billion in health measures including essential medical equipment purchases, vaccine distribution, quarantine, contract tracing and maintaining clinical health capacity (such as intensive care units)
  • $508 million in additional cleaning services primarily to the Department of Education and Transport for NSW
  • $500 million as part of the ‘Dine & Discovery NSW’ voucher program to the Department of Customer Service
  • $350 million in combined land tax relief and small business recovery grants to Department of Customer Service and NSW Treasury respectively.

Around $4.5 billion of this package was spent in 2020–21, leaving $1.1 billion unspent and carried forward into 2021–22. The graph below shows the total allocation and spend by cluster for 2021 compared to their target spend.

Deficit of $7.1 billion compared with a budgeted deficit of $16 billion

The outcomes of the government’s overall activity and policies are reflected its net operating balance (Budget Result). This is the difference between the cost of general government service delivery and the revenue earned to fund these sectors.

The General Government Sector, which comprises 204 entities, generally provides goods and services funded centrally by the State.

In addition to the 204 entities within the General Government Sector, a further 98 government controlled businesses are included within the consolidated Total State Sector financial statements. These businesses generally provide goods and services, such as water, electricity and financial services for which consumers pay for directly.

The Budget Result for the 2020–21 financial year was a deficit of $7.1 billion compared to an original forecast of a budget deficit of $16 billion.

Revenues increased $5.6 billion to $91.8 billion

In 2020–21, the State’s total revenues increased by $5.6 billion to $91.8 billion, 6.5 per cent higher than previous year. A decrease of 0.3 per cent was recorded in 2019–20. The main contributors to the increase in the State's revenues were an increase in taxation revenue of $4.6 billion and an increase in grants and subsidies of $1.4 billion when compared to the prior financial year.

Taxation revenue increased by 15.3 per cent

Taxation revenue increased by $4.6 billion, mainly due to:

  • $2.9 billion higher stamp duties collected from property sales driven by:
    • $2.7 billion increase in contracts and conveyance duties (transfer duties) from both higher transaction volumes and strong property price growth during 2020–21
    • $200 million increase in motor vehicle registration duty driven by increases in new vehicle sales
  • $520 million higher Gambling and Betting Taxes was earned as 2019–20. The previous year's revenues were impacted by club and hotel closures due to COVID-19. The operation of these venues in 2020–21 returned to normal for most of the year resulting in higher club gaming tax revenue of $216 million and hotel gaming taxes of $265 million
  • $439 million higher collections of payroll taxes. The previous year's revenues were impacted by tax relief measures implemented by the government in response to COVID-19. Lower payroll tax was collected in 2019–20 as employment levels dropped during the State’s first lock down
  • $416 million higher land tax revenues, driven by an average 3.2 per cent increase in valuer general land values, which are the basis for determining land tax values.

Stamp duties of $11.7 billion remains the largest source of taxation revenue, $2.9 billion higher than payroll tax of $8.8 billion, the second-largest source of taxation revenue.

Expenses increased $4.1 billion to $101 billion

The State’s expenses increased 4.3 per cent compared with 2019–20. Most of the increase was due to higher employee expenses, depreciation and amortisation, other operating costs and grants and subsidies expense.

Employee expenses, including superannuation, increased 3.6 per cent to $44.1 billion

Salaries and wages increased to $36.3 billion ($34.8 billion in 2019–20). This was mainly due to increases in staff numbers and an average increase of approximately three per cent in the cost of NSW's employees across the sector. Salaries and wages for the Education and Health sectors increased by $511 million and $619 million respectively.

The Health sector employed an additional 4,893 full time staff in 2020–21 (2,763 in 2019–20) and incurred an extra $28 million in overtime mainly in response to COVID-19. Education increased staff numbers by 2,418 full time equivalents in 2020–21 (4,866 in 2019–20). This year, the health and education sectors received a 0.3 per cent award increase in pay rates.

The Public Service Commission (PSC) noted in the ‘State of the NSW Public Sector Report, 2021’ that the government sector senior executive headcount increased by 347 to 3,680 (3,333 in 2019–20). The Transport cluster represented the majority of the increase in the government sector's senior executive headcount, with an increase of 182. The PSC report noted the increase was due to the growing portfolio of major transport infrastructure projects.

Historically, the government wages policy aims to limit growth in employee remuneration and other employee related costs to no more than 2.5 per cent per annum.

Depreciation and amortisation expense increased 7.6 per cent to $10.3 billion

Depreciation and amortisation increased to $10.3 billion in 2020–21 ($9.6 billion in 2019–20). This increase was mainly driven by the depreciation of completed infrastructure projects including the State’s WestConnex M8 and M5 East Motorways, and other road projects such as Woolgoolga to Ballina project. This year also includes twelve months of depreciation relating to the CBD and South-East Light Rail versus six months in the previous financial year.

Furthermore, the first time adoption of AASB 1059 ‘Service Concession Arrangements’ resulted in the State recognising $45.4 billion of service concession assets in its capacity as grantor under arrangements with operators. More than 87 per cent of this balance was recognised by the Transport cluster. These assets are valued at current replacement cost and are depreciated on an annual basis. A service concession arrangement is an arrangement whereby the government as grantor, contracts with an operator to develop (or upgrade), operate and maintain the grantor's public service assets such as roads, bridges or hospitals. The grantor controls or regulates what services the operator must provide using the assets, to whom, and at what price. The grantor also retains any significant residual interest in the assets at the end of the arrangement. Further details about AASB 1059 are included in the ‘Implementation of new accounting standards’ section of this report.

Grants and subsidies increased $1.5 billion to $15.6 billion

The increase in grants and subsidies is due to payments made by the State in supporting businesses and local communities in response to COVID-19. These mainly included $240 million in Dine & Discover voucher payments, $156 million in land tax relief assistance, $160 million increase in grants to non-government schools (including $31 million to support Covid intensive learning support programs), and $109 million relating to small business grant payments.

The State also transferred $592 million in newly constructed assets to local councils. These mainly related to $378 million in assets transferred following completion of WestConnex stage 2 and $180 million from Northern Roads.

Other operating expenses increased two per cent to $27.5 billion

Operating expenses increased to $27.5 billion in 2020–21 ($26.9 billion in 2019–20) due to higher operating activities as agencies responded to the pandemic.

Supplies and Other Services increased by $1.7 billion. This was mainly due to funding of $533 million in hotel quarantine and associated services, and $495 million in medical equipment for the health sector.

Inventories consumed increased by $266 million. This included $217 million in COVID-19 medical equipment that was written off because it had expired or did not meet the TGA regulatory standards. Contractor expenses increased by $306 million because of increased capital works activity, primarily in the Transport sector.

The increase was offset by $1.6 billion in lower insurance claims expense. In 2019–20 financial year, higher claims were made in respect to natural disaster events, including bush fires.

Health costs remain the State’s highest expense

Total expenses of the State were $101 billion ($96.4 billion in 2019–20). In 2020–21, Health remains the highest contributor of expenses for the State with $25.7 billion ($24.2 billion in 2019–20). Education remains the second highest contributor of expenses reporting $18.4 billion in 2020–21 ($17.5 billion in 2019–20).

The following sectors have the highest expenses as a percentage of total State expenses:

  • Health – 25.6 per cent (25.1 per cent in 2019–20)
  • Education – 18.3 per cent (18.2 per cent in 2019–20)
  • Transport – 14.5 per cent (13.3 per cent in 2019–20).

Assets grew by $12.3 billion to $526 billion

The State’s assets include physical assets such as land, buildings and infrastructure, and financial assets such as cash, and other financial instruments and equity investments. The value of total assets increased by $12.3 billion to $526 billion. This was a 2.4 per cent increase compared with 2019–20, mostly due to changes in asset carrying values.

Valuing the State’s physical assets

State’s physical assets valued at $391 billion

The value of the State’s physical assets increased by $1.7 billion to $391 billion in 2020–21 ($37.9 billion increase in 2019–20). The State’s physical assets include land and buildings ($172 billion), infrastructure systems ($202 billion) and plant and equipment ($16.7 billion).

The movement in physical asset values between years includes additions, disposals, depreciation and valuation adjustments. Other movements include assets reclassified to held for sale and other opening balance adjustments.

Liabilities increased $16.4 billion to $291 billion

The State borrowed additional funds in response to COVID-19

The State’s borrowings rose by $15.8 billion to $134 billion at 30 June 2021. This accounted for most of the increase in the State’s total liabilities.

The value of TCorp bonds on issue increased by $16.8 billion to $114 billion, which largely funded the State's capital expenditure and response to the COVID-19 pandemic.

TCorp bonds are traded in financial markets and are guaranteed by the NSW Government.

Over 2020–21, TCorp continued to take advantage of lower interest rates, buying back short-term bonds and replacing them with longer dated debt. This lengthens the portfolio matching liabilities with the funding requirements for infrastructure assets.

The State’s fiscal objective published in the 2021–22 Budget Papers is to repair the operating position by returning the budget to surplus by 2024–25 and rebuilding balance sheet capacity by bringing net debt down towards seven per cent of Gross State Product (GSP) over the medium-term. The State measures net debt as the sum of deposits held, government securities, loans payable and other borrowings, less the sum of cash and deposits, advances paid and investments, loans receivable and placements.

The chart below shows the actual net debt to GSP for NSW compared to the Commonwealth net debt to Gross Domestic Product (GDP) over the past six years. The trend shows an increase in net debt, particularly in the past two years, which is mainly driven by additional borrowings needed to fund stimulus measures when responding to COVID-19 and natural disaster relief.

GSF Act and GSF Regulation

Financial reporting provisions in the Government Sector Finance Act 2018 (GSF Act) have now commenced

From 1 July 2021, the Public Finance and Audit Act 1983 (PF&A Act) financial reporting provisions were repealed. Agencies prepared their 2020–21 financial statements under Part 7 of the GSF Act. They were audited under the Government Sector Audit Act (GSA Act). The GSF Act requires the timeframe for annual financial statement submission be specified in the Treasurer’s Directions.

Under the GSF Act, all reporting GSF agencies are required to prepare annual financial statements, unless exempt from the definition of a reporting agency under the Government Sector Finance Regulation 2018 (GSF Regulation). Those agencies exempt from preparing financial statements include certain small agencies, Crown Land Managers, special purpose staff agencies and retained State interests. These agencies must meet prescribed requirements or thresholds and self-assess each year to determine whether they remain exempt against the criteria in the GSF Regulation.

Most of the financial reporting provisions of the GSF Act have now commenced except for requirements concerning special deposit accounts (SDA) and special purpose financial reports, which are scheduled to commence on 1 July 2023, subject to approval from the Governor.

The GSF Act now includes most of the provisions applicable to GSF agencies, as requirements for appropriations, expenditure, financial services, and other matters were enacted on 1 December 2018 and 1 July 2019.

Once fully commenced, the GSF Act will consolidate and replace reporting provisions of four Acts:

  • PF&A Act
  • Public Authorities (Financial Arrangements) Act 1987
  • Annual Reports (Departments) Act 1985
  • Annual Reports (Statutory Bodies) Act 1984.

GSA Act and GSA Regulation

The PF&A Act was renamed the GSA Act on 1 July 2021 and now only contains provisions relating to the Auditor-General and the Audit Office, the audit of government sector finances and governance of the Public Accounts Committee.

Of note in the renamed GSA Act is that:

  • a new principal object was added that specifically provides the Auditor-General is an independent and accountable statutory officer
  • the previous financial reporting provisions in the PF&A Act were repealed as the financial reporting provisions are contained in Part 7 of the GSF Act. As a result, there are no longer financial reporting provisions in the GSA Act
  • a new section 34 was added, which contains the requirements for the audit of State sector agencies’ financial statements. These were previously contained in two separate sections.

The GSA Regulation commenced on 1 July 2021, replacing the Public Finance and Audit Regulation 2015 (PF & A Regulation). The GSA Regulation contains the list of entities, funds and accounts prescribed for the purpose of audits under the GSA Act.

Inconsistencies exist in the GSF Act and GSA Act related to key statutory timeframes

There are inconsistencies between key statutory timeframes imposed on the Treasurer and Auditor-General in the GSF Act and GSA Act which has been brought to the attention of NSW Treasury. The inconsistencies identified include:

  • Section 34(3)(a) of the GSA Act defines the audit period for the Statements be as soon as practicable after the Auditor-General is given the Statements. This appears to be inconsistent with section 49(3) of the GSA Act, which requires that the Auditor-General, on or before 22 October transmit the Statements and audit report to the Treasurer. Neither provision is a paramount provision.
  • Section 49(3) of the GSA Act also appears to be inconsistent with section 52(1) of the GSA Act which provides that the Statements are to be given to the Auditor-General in accordance with section 7.17 of the GSF Act. Section 7.17 of the GSF Act requires that the Statements are to be prepared and given to the Auditor-General by an agreed date to enable the audit of the Statements. Part 7 of the GSF Act is a paramount provision under section 1.8 of the GSF Act, which means the requirements in section 7.17 of the GSF Act prevail.

There are also inconsistencies in key statutory reporting timeframes imposed on the Treasurer under the GSF Act.

The audited Statements are a key accountability mechanism that provides information on the State’s financial performance and position. Ambiguity in the statutory reporting timeframes could impact on the future timely provision of this information to Parliament. As noted at the beginning of this report, the delay in issuing the audit report for the 30 June 2021 Statements was due to NSW Treasury’s resolution of accounting issues that were material to the Statements, in particular the treatment of the General Government Sectors investment in TAHE during 2020–21. NSW Treasury's management letter will include a high risk finding with regards to the inconsistencies between the GSF Act and GSA Act.

Recommendation

NSW Treasury should seek legislative amendments in Parliament to resolve the inconsistencies in the GSF Act and GSA Act relating to key statutory reporting time frames.

Appropriations framework

NSW Treasury lacks a framework to monitor and provide assurance to ministers that they are in compliance with their appropriation authority

The GSF Act requires that money not be paid out of the Consolidated Fund except under the authority of an Act, such as the annual Appropriation Act or GSF Act. This means a minister is only authorised to spend out of the Consolidated Fund the amount they have been appropriated by the relevant Act(s).

Generally, money is authorised to be paid out of the Consolidated Fund either through:

  • The Annual Appropriation Act - this is an act to appropriate out of the Consolidated Fund sums for the services of the government for the relevant financial year. These appropriations are made to the responsible ministers of principal departments, Special Offices and certain SDAs.
  • The GSF Act - this act allows the responsible minister of a GSF agency to be given an appropriation out of the Consolidated Fund, at the time the agency receives or recovers any deemed appropriation money. Deemed appropriation money is defined in section 4.7(3) of the GSF Act.

Ministers can delegate and sub-delegate appropriation expenditure functions to accountable authorities and officers of GSF agencies. Any spending by accountable authorities and officers of GSF agencies in excess of the amount appropriated to their relevant minister would be made contrary to section 4.6(1) of the GSF Act.

The Budget Papers are an additional mechanism by which the government controls the level of expenditure by agencies both at the individual and departmental administrative cluster level. The Budget Papers set an administrative limit imposed by the government. Separately, the Treasurer can issue a Budget control authority under section 5.1 of the GSF Act. A Budget control authority can regulate expenditure of money by GSF agencies in a variety of ways, as set out in section 5.1(2) of the GSF Act.

In July 2021, NSW Treasury advised the Audit Office that it had received advice from the Crown Solicitor's Office, in January 2021, that payments between agencies in different administrative clusters would not meet the definition of a 'deemed appropriation' under the GSF Act by the receiving agency. This applies to money paid and received by two agencies across different administrative clusters that continue to hold the money in the Consolidated Fund. These intra-government receipts increase the amount an agency has available to spend, without there being a corresponding increase in the responsible minister’s appropriated expenditure limits, thus increasing the risk an agency’s expenditure could cause a minister to exceed their appropriated expenditure authority.

After being made aware of the issue, the Audit Office worked with NSW Treasury officers to clarify potential implications. The Audit Office also obtained further advice from the Crown Solicitor’s Office to clarify certain aspects of the appropriations framework more broadly. In the advice to the Audit Office, the Crown Solicitor advised that an agency is not subject to its own legally appropriated expenditure limit (assuming it is not subject to any annual spending limit imposed through an instrument of delegation or a budget control authority issued by the Treasurer under section 5.1 of the GSF Act). In effect, because responsible ministers are given appropriations, these legal expenditure limits, rest in aggregate, with the principal department and agencies the minister is responsible for. The advice also confirmed:

  • a deemed appropriation for the services of an agency would ordinarily be available for the services of other agencies, if the officers of the other agencies had a delegation from the minister(s) to expend the deemed appropriation and funds remained available under those deemed appropriations
  • that the ‘exhaustion’ of a minister’s appropriation may be precipitated by one agency’s level of expenditure in the financial year, but the effect is that the relevant appropriation is exhausted for all agencies (and their officers) that may otherwise rely on it
  • whether expenditure by an agency occurred beyond the scope of its authority would require a progressive examination of the total amounts expended from the minister’s appropriation
  • amounts expended from the Consolidated Fund without the authority of an appropriation are spent contrary to section 4.6(1) of the GSF Act
  • a minister is responsible to Parliament for (i) the manner in which appropriations are expended, and (ii) any ‘overspends’ (that is, expenditure without authority) by agencies for which they are responsible.

Determining whether expenditure has occurred without the authority of an appropriation is complex and it is not possible for an individual agency to monitor or determine at what ‘point in time’ expenditure has been incurred in excess of the minister’s appropriation authority. As noted earlier, there are mechanisms in place to manage agencies' administrative expenditure limits set by the Budget Papers, but there is no mechanism in place to ensure expenditure by agencies does not exceed a minister’s appropriation authority received under the annual Appropriations Act and GSF Act.

Recommendation

NSW Treasury should ensure a framework exists to monitor and provide assurance to ministers that expenditure incurred across a financial year by agencies under the relevant minister’s coordination does not exceed the appropriation authority conferred by the annual Appropriation Act and the GSF Act.

In addition, principal departments and agencies that hold money in the Consolidated Fund are required by Australian Accounting Standard AASB 1058 'Income of Not-for-Profit Entities' and NSW Treasury Circular TC20/08 'Mandates of options and major policy decisions under Australian Accounting Standards' to prepare a Summary of Compliance in their financial statements. The Summary of Compliance applies to agencies that obtain part or all of their spending authority from a Parliamentary appropriation. It is intended to provide information on the amounts appropriated or authorised for an agency’s use and whether those expenditures were authorised. There remains uncertainty around how the Crown Solicitor’s Office advice received by the Audit Office impacts these disclosures, as the total spending authority given by Parliamentary appropriations and expenditure against these appropriations cannot generally be attributed to an individual agency. Such a scenario is not contemplated by the relevant Australian Accounting Standard. NSW Treasury's management letter will include high risk findings about improving mechanisms in place to manage agencies administrative expenditure limits, uncertainties related to appropriation spending authority on agencies summary of compliance disclosures.

Recommendation

NSW Treasury should assess how the requirement to prepare a Summary of Compliance under Australian Accounting Standards impacts relevant principal departments and agencies' financial statement disclosures.

Delegations to incur expenditure

Further to last year's reporting, some agencies have again spent monies without an authorised delegation

The delegation to incur expenditure is an important accountability mechanism of responsible government.

Last year’s Report on State Finances reported instances where government agencies did not understand or correctly apply the requirements of the GSF Act for deemed appropriations, resulting in some agencies spending deemed appropriations money without an authorised delegation from the relevant minister(s) as required by sections 4.6(1) and 5.5(3) of the GSF Act.

This year’s financial audits identified that further agencies: TAFE Commission, Multicultural NSW and the Office of the Ageing and Disability Commissioner spent money received from an annual Appropriation and/or deemed appropriation money without an authorised delegation from the relevant minister(s), as required by sections 4.6(1) and 5.5(3) of the GSF Act. NSW Treasury's management letter will include high risk issues about improving mechanisms in place to ensure agencies have appropriate delegations in place to spend Appropriation and/or deemed appropriation money.

In addition, the audit of the Jobs for NSW Fund (the Fund) special purpose statements identified that five payments from the Fund were authorised by an officer without the necessary delegation from the minister as required by section 14 of the Jobs for NSW Act 2015 and sections 5.5(2) and 5.5(3) of the GSF Act.

Recommendation

Given the continued instances of non-compliance, NSW Treasury needs to promptly improve the guidance it provides agencies to ensure that expenditure of public monies is properly supported by authorised delegations.

Implementation of new accounting standards

This year, the State implemented the requirements of AASB 1059

AASB 1059 ‘Service Concession Arrangements: Grantors’

AASB 1059 is an Australian Accounting Standard that requires public sector entities (grantors) that enter service concession arrangements with private sector operators for the delivery of public services recognise service concession assets and liabilities in their financial statements. The standard was effective from 1 July 2020.

AASB 1059 requires a grantor to:

  • recognise an asset provided by the operator as a service concession asset if the grantor controls the asset
  • initially measure the service concession asset at current replacement cost (CRC) in accordance with AASB 13 ‘Fair Value Measurement’
  • recognise a corresponding liability measured initially at the fair value (CRC) of the service concession asset, adjusted for any consideration between the grantor and the operator
  • make sufficient disclosure in the financial statements so that users can understand the nature, amount and timing of assets, liabilities, revenue and cash flows arising from these.

The adoption of AASB 1059 increased the State’s total assets and liabilities by $19.5 billion and $19.6 billion respectively, with net worth reducing by $131 million at 1 July 2019

The State adopted a modified retrospective approach when adopting AASB 1059 and recognised and measured service concession assets and liabilities at the date of initial application of 1 July 2019, with any net adjustments recognised in accumulated funds at that date. This means comparatives were restated to reflect the impact of AASB 1059.

Most of the service concession assets recognised by the State related to Property, Plant & Equipment, in particular infrastructure assets.

Agencies had to devote significant effort to implement AASB 1059 and ensure their 2020–21 financial statements materially complied with the standard's requirements. Last year, the Audit Office highlighted advance preparation was key to ensuring agencies effectively transitioning to this new standard. Despite the new standard being issued well in advance of its commencement date, Sydney Water Corporation, Department of Customer Service, Transport for NSW (TfNSW) and TAHE did not prepare sufficiently for their respective implementations.

Whilst most agencies in 2019–20 had commenced assessing their existing commercial arrangements to determine whether they were within the scope of AASB 1059, calculating and posting the accounting entries to support the implementation of this standard was delayed for TfNSW. TfNSW had not finalised its opening balance adjustments in time for the Audit Office’s early close review. Critical assessments of AASB 1059 to identify the accounting implications for the Transport sector, in particular TfNSW and TAHE were still being considered as late as 30 September 2021.

Restart NSW

Restart NSW was established in 2011 to fund the State’s major infrastructure projects

Restart NSW funds Rebuilding NSW, the government’s 10-year plan to invest $23 billion in new infrastructure. Its infrastructure projects, including Sydney Metro West and Parramatta Light Rail, are primarily funded by proceeds from the government’s asset recycling program. The Restart Fund had a balance of $12.4 billion at 30 June 2021 ($15 billion in 2019–20).

The Fund paid $3.8 billion for infrastructure projects in 2020–21 ($4.3 billion in 2020–21). The largest payments were for transport projects, including Sydney Metro West, Parramatta Light Rail, and contributed $319 million of the $2.4 billion equity contribution to the Transport Asset Holding Entity (TAHE).

The funds are invested in the NSW Infrastructure Future Fund (NIFF), which is allowed under the Restart NSW Fund Act 2011 (Restart Act). The NIFF is an investment vehicle for the fund to help the NSW Government meet its infrastructure objectives and this fund is managed by TCorp. In 2020–21, the fund earned a net return of 7.9 per cent, higher than its annual benchmark return of 4.2 per cent, benefiting from improved returns in financial markets over 2020–21.

The fund directed 30.1 per cent of its payments towards rural and regional infrastructure projects in 2020–21

The Restart Act requires the fund to report on the percentage of payments directed to rural and regional infrastructure projects and whether this represents at least 30 per cent of the total payments from the fund. The Restart NSW Fund Amendment (Rural and Regional Infrastructure Funding) Bill 2020 introduced in Parliament in 2020 would amend the Restart Act by requiring at least 30 per cent of the total payments each financial year and for the life of the Restart NSW Fund be made on infrastructure projects in rural and regional areas.

This year the fund exceeded its target of directing at least 30 per cent of funding towards rural and regional infrastructure projects. However, since the funds’ commencement, only 23 per cent of total payments went towards rural and regional infrastructure projects. Current projections for the life of the fund indicate only 27.5 per cent of funding will be spent on rural and regional projects, which is below the funds target of 30 per cent target for the life of the fund.

Audit Office’s work plan for 2021–22

The Audit Office’s 2021–22 work plan focuses on the State’s response, recovery and impact from the COVID-19 pandemic and natural disaster emergencies

The COVID-19 pandemic continues to have a significant impact on the people and the public sector of New South Wales. Government continues to assist communities in their recovery from the 2019–20 bushfires and subsequent flooding. The scale of government responses to these events has been significant and has required a wide-ranging response involving emergency response coordination, service delivery, governance and policy.

Significant resources have been directed toward these responses, and in assisting rebuilding and economic recovery. Some systems and processes have changed to reflect the need for quick responses to immediate needs. The increasing and changing risk environment presented by these events has meant that we have recalibrated and focused our efforts on providing assurance on how effectively aspects of these emergency responses have been delivered. This includes financial and governance risks arising from the scale and complexity of government responses to these events.

While these emergencies are having a significant impact today, they are also likely to continue to have an impact into the future. We will take a phased approach to ensuring that our work addresses the following elements of the emergencies and government responses:

Appendix one – Prescribed entities

Appendix two – Legal opinions

Appendix three – TSS sectors and entities
 

Copyright notice

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Published

Actions for Customer Service 2021

Customer Service 2021

Finance
Asset valuation
Cyber security
Financial reporting
Information technology
Internal controls and governance
Shared services and collaboration

This report analyses the results of our audits of the Customer Service cluster agencies for the year ended 30 June 2021.

Our preferred approach is to table the ‘Report on State Finances’ in Parliament before any other cluster report. This is because the ‘Report on State Finances’ focuses on the audit results and observations relating to the Total State Sector Accounts, in effect a consolidation of all government agencies. This year the ‘Report on State Finances’ has been delayed due to significant accounting issues being considered in the Total State Sector Accounts and which may impact the Treasury and Transport clusters.

As there are no outstanding matters relating to audits in the Customer Service cluster impacting the Total State Sector Accounts we have decided to break with normal practice and table this cluster report ahead of the ‘Report on State Finances’.

What the report is about

The results of Customer Service cluster agencies' financial statement audits for the year ended 30 June 2021.

What we found

Unmodified audit opinions were issued for all Customer Service cluster agencies.

The number of monetary misstatements decreased from 48 in 2019–20 to 46 in 2020–21.

Seven out of eight agencies did not complete all mandatory early close procedures.

What the key issues were

Upon the implementation of AASB 1059 'Service Concession Arrangements: Grantors', the Department of Customer Service (the department) recognised a service concession asset, the land titling database, totalling $845 million for the first time at 1 July 2019.

The department reported several retrospective corrections of prior period errors.

The 2020–21 audits identified three high-risk and 59 moderate risk issues across the cluster. The high-risk issues were related to:

  • the Department of Customer Service – internal control qualifications and control deviations in GovConnect service providers
  • the Department of Customer Service – significant control deficiencies in information technology change management controls
  • Rental Bond Board – uncertainties in the accounting treatment of rental bonds.

The percentage of repeat issues we report to management and those charged with governance in management letters increased from 29 per cent in prior year to 42 per cent in 2020–21 while the number of items decreased from 94 to 93.

The magnitude and number of internal control exceptions in GovConnect service providers increased resulting in additional audit procedures to address the risks of fraud and errors in the financial statements.

What we recommended

The department should improve the validation process of key valuation assumptions and inputs provided by the private operator NSW Land Registry Services. It should revisit its accounting treatment of new land titling records.

The department should ensure GovConnect service providers prioritise the remediation of control deficiencies in information technology services.

The department should continue to improve controls in cyber security management.

Cyber Security NSW and NSW Government agencies need to prioritise improvements to their cyber security resilience as a matter of urgency.

The New South Wales Government Telecommunications Authority should improve its fixed assets management and financial reporting process to accommodate its growing fixed assets profile.

Fast facts

The Customer Service cluster aims to plan, prioritise, fund and drive digital transformation and customer service across every cluster in the NSW Government.

  • $3.9b total expenditure incurred in 2020–21 
  • $34.1b total administered income managed on behalf of the NSW Government in 2020–21
  • 100% unqualified audit opinions were issued on agencies' 30 June 2021 financial statements 
  • 3 high-risk management letter findings were identified
  • 46 monetary misstatements were reported in 2020–21
  • 42% of reported issues were repeat issues.

This report provides Parliament and other users of the Customer Service cluster’s financial statements with the results of our audits, our observations, analysis, conclusions and recommendations in the following areas:

  • financial reporting
  • audit observations.

Financial reporting is an important element of good governance. Confidence and transparency in public sector decision-making are enhanced when financial reporting is accurate and timely.

This chapter outlines our audit observations related to the financial reporting of agencies in the Customer Service cluster (the cluster) for 2021.

Section highlights

  • Unqualified audit opinions were issued on the financial statements of cluster agencies.
  • The number of reported misstatements has decreased from 48 in 2019–20 to 46 in 2020–21.
  • Agencies could do more work to improve the quality and timeliness of completing mandatory early close procedures.
  • The Department of Customer Service implemented the new accounting standard AASB 1059 'Service Concession Arrangements: Grantors', which resulted in recognition of a service concession asset of $845 million at 1 July 2019. The valuation of land titling database requires significant judgements and estimations.

Appropriate financial controls help ensure the efficient and effective use of resources and administration of agency policies. They are essential for quality and timely decision-making.

This chapter outlines our observations and insights from our financial statement audits of agencies in the Customer Service.

Section highlights

  • The 2020–21 audits identified three high-risk and 59 moderate risk issues across the cluster. Twenty-six moderate risk issues were repeat issues. The most common repeat issues related to information technology controls around user access management.
  • The magnitude and number of internal control qualification issues from GovConnect service providers have increased. Ineffective controls at service providers increase the risk of fraud, error and security to data. Urgent attention is required to remediate the internal control exceptions in information and technology services.
  • The NSW Public Sector's cyber security resilience needs urgent attention. Cyber Security NSW and NSW Government agencies need to prioritise improvements to their cyber security resilience as a matter of urgency.

Findings reported to management

Forty-two per cent of findings reported to management were repeat issues

Breakdowns and weaknesses in internal controls increase the risk of fraud and error. Deficiencies in internal controls, matters of governance interest and unresolved issues were reported to management and those charged with governance of agencies. The Audit Office does this through management letters, which include observations, related implications, recommendations and risk ratings.

In 2020–21, there were 93 findings raised across the cluster (94 in 2019–20). Forty-two per cent of all issues were repeat issues (29 per cent in 2019–20).

The most common repeat issues related to weaknesses in controls over information technology user access administration.

A delay in implementing audit recommendations increases the risk of intentional and accidental errors in processing information, producing management reports and generating financial statements. This can impair decision-making, affect service delivery and expose agencies to fraud, financial loss and reputational damage. Poor controls may also mean agency staff are less likely to follow internal policies, inadvertently causing the agency not to comply with legislation, regulation and central agency policies.

The table below describes the common issues identified across the cluster by category and risk rating. 

Risk rating Issue
Information technology
High3
1 new,
1 repeat

The financial audits identified the need for agencies to improve information technology processes and controls that support the integrity of financial data used to prepare agencies' financial statements. Of particular concern are issues associated with:

  • internal control exceptions in information and technology services provided by GovConnect service providers
  • inadequate change management controls
  • poor user access administration and no monitoring of privileged user activities
  • insufficient cybersecurity controls and processes.

High-risk issues are discussed later in the chapter.

Moderate2
5 new,
8 repeat

Low1
7 new,
5 repeat

Internal control deficiencies or improvements

Moderate2
5 new,
3 repeat

The financial audits identified internal control weaknesses across key business processes, including:

  • lack of documentation support for payroll transactions
  • untimely removal of unused transaction negotiation authority facility and old bank signatories
  • inadequate fixed asset management controls including timely capitalisation of project overhead costs.

 Low1
3 new,
2 repeat

Financial reporting

High3
1 new

The financial audits identified opportunities for agencies to strengthen financial reporting, including:

  • uncertainties in legislation to support accounting of rental bonds as funds held in trust
  • improvements required in lease accounting including the review of extension options, assessing indicators of impairment and reviewing the lease reports for completeness and accuracy 
  • the removal of fully depreciated assets in the fixed asset register was not timely
  • the quality and timeliness of completing early close procedures required improvement.

High-risk issues are discussed later in the chapter.

Moderate2
9 new,
8 repeat

Low1
7 new,
3 repeat

Governance and oversight
Moderate2
10 new,
3 repeat

The financial audits identified opportunities for agencies to improve governance and oversight processes, including:

  • renewing or finalising service arrangement agreements between agencies were required 
  • lack of formalised documentation regarding arrangements with external providers for leasing and use of assets.
Low1
3 new
Non-compliance with key legislation and/or central agency policies
Moderate2
4 new,
4 repeat

The financial audits identified the need for agencies to improve its compliance with key legislation and central agency policies, including:

  • non-compliance with contract and procurement management policy, including the use of purchasing cards
  • non-compliance with TC 21-02 'Statutory Act of Grace Payments'
  • annual leave in excess of 30 days where Circular 2020-12 requires agency heads to reduce employee recreation leave balances to 30 days or less.
Low1
1 repeat

4 Extreme risk from the consequence and/or likelihood of an event that has had, or may have a negative impact on the entity.
3 High-risk from the consequence and/or likelihood of an event that has had, or may have a negative impact on the entity.
2 Moderate risk from the consequence and/or likelihood of an event that has had, or may have a negative impact on the entity.
1 Low risk from the consequence and/or likelihood of an event that has had, or may have a negative impact on the entity.
Note: Management letter findings are based on management letters issued to agencies.

2020–21 audits identified three high-risk findings

High-risk findings, including repeat findings, were reported at the following cluster agencies. One of the 2019–20 high-risk findings were not resolved.

Agency Description
2020–21 findings  
Department of Customer Service
Repeat finding:
Qualifications and control deviations in GovConnect NSW controls assurance reports

The GovConnect information technology general controls (ITGC) provided by the department, Infosys and Unisys were qualified in 2020–21. The key controls over user access, system changes and batch process failed in all ITGC reports. Most of these deviations were not mitigated or sufficiently mitigated to address the risk of unauthorised user access.

The control deficiencies in ITGC increase:

  • the risk of unauthorised transactions, system and configuration changes (workflow approvals, three-way match etc.) and modifications to the system reports
  • incomplete, invalid and inappropriate system access, segregation of duties controls and system reports for the customers using the SAPConnect.

The role of the department has changed significantly from a coordinating agency on behalf of GovConnect customers to a GovConnect IT service provider. It is leading a new IT operating model called ‘Service Integration and Application Management’ (SIAM) to strengthen governance and improve performance of GovConnect service providers. The Department is responsible for the remediation of control deficiencies and continuous improvement in the GovConnect environment.

This matter was assessed as high-risk, if not adequately addressed, it had the potential to result in material fraud and error in the department's financial statements and reputation damages.

This issue is further discussed later in this chapter.

2020–21 findings  
Department of Customer Service
New finding:
Change management significant control deficiencies

Revenue NSW, a division of the department has a key role in managing the State’s finances. It administers State taxes, manages fines, recovers State debt and administers grants and subsidies.

The audit team found significant control deficiencies in change management controls:

  •  appropriate system controls were not in place to restrict developers from releasing changes to the live business systems
  • 8 developers had direct access to the business application servers used for calculating and administering State taxes.

We have included this matter as a high-risk management letter finding, as the audit team could not identify mitigating controls. The system activity of these developers was also not being independently logged and monitored. This increases the risk of unauthorised system change. This can significantly affect the integrity of tax calculation, business process approvals, invalid changes to bank accounts, unauthorised refunds and write-offs. The audit team conducted a risk analysis over the relevant business processes affected by this issue and performed additional audit procedures to address the audit risk.

Rental Bond Board
Repeat finding: Accounting treatment of rental bonds held in trust

The Rental Bond Board (the Board) holds rental bonds totalling $1.7 billion at 30 June 2021. The Board treated the rental bonds off-balance sheet and disclosed the rental bonds as ‘trust funds’. This treatment is based on management’s judgement that the Board does not have control of these funds.

Previously the Board obtained advices from the Crown Solicitors who stated that in their view the rental bond funds held in the rental bond account were not moneys held in trust and the Residential Tenancies Act 2010 (the Act) should be reviewed and amended to better support its accounting treatment of rental bonds. The Board has initiated the need to amend the Act, however the implementation of the legislative amendments is still pending.

This matter was assessed as high-risk, if not adequately supported, it had the potential to result in material misstatements in the Board's financial statements.


The number of moderate risk findings increased from prior year

Fifty-nine moderate risk findings were reported in 2020–21, which was a 11.3 per cent increase from 2019–20. Of these, 26 were repeat findings, and 33 were new issues.

Moderate risk findings include:

  • weaknesses in user access management, such as untimely access removal for terminated staff, and a lack of periodic user access review
  • accounting for leases such as the review of extension options, assessing indicators of impairment and reviewing the lease reports for completeness and accuracy
  • formalising arrangements between agencies including corporate service arrangements, funding arrangements, leases, use of SAP system and computer assets
  • use of purchasing cards where our data analytics performed indicated potential gaps and controls and non-compliance with government policies.

The magnitude and number of internal control exceptions in GovConnect service providers have increased

In 2015, the NSW Government selected Unisys Australia Pty Limited’s (Unisys) as an information technology (IT) outsourced service provider and Infosys Limited (Infosys) as a business process outsourced service provider. The outsourced services arrangement was branded GovConnect NSW (GovConnect). The Department of Customer Service (the department) is the contract authority for the NSW Government. In 2019, the NSW Government transitioned a number of Unisys’ IT services progressively to the department and ceased all Unisys's IT services in May 2021. In 2020-21, Infosys, Unisys and the Department were co-providers of business processes and information technology services that constitute the GovConnect environment.

The role of the department has changed significantly from a coordinating agency on behalf of GovConnect customers to a GovConnect IT service provider. The department is responsible for the remediation of control deficiencies and continuous improvement in GovConnect internal control environment.

The department leads the project management of GovConnect services, including the arrangement to provide internal control assurance reports to customers in 2020–21. It engages an independent service auditor (service auditor) from the private sector to perform annual assurance reviews of controls at GovConnect service providers in accordance with Australian Standard on Assurance Engagements 3402 'Assurance Reports on Controls at a Service Organisation' (ASAE 3402). The service auditor reports on the internal controls at a service organisation, which are relevant to a user entity's internal control environment.

The service auditor issued eight ASAE 3402 reports covering business processes controls and information technology general controls (ITGC) provided by the service providers. Four out of eight reports were qualified, a significant increase from previous years.

The table below shows the service auditor's ASAE 3402 opinions issued in various business processes and information technology services provided by service providers for the last five years.

ASAE 3402 controls report# 2015–16^ 2016–17 2017–18 2018–19 2019–20 2020–21
Infosys Accounts receivable Qualified Unqualified Unqualified Unqualified Unqualified Qualified
Infosys Accounts payable Qualified Qualified Unqualified Unqualified Unqualified Unqualified
Infosys Fixed assets Qualified Unqualified Unqualified Unqualified Unqualified Unqualified
Infosys General ledger Qualified Qualified Unqualified Unqualified Unqualified Unqualified
Infosys Payroll Adverse Qualified Unqualified Unqualified Unqualified Unqualified
Infosys ITGC Qualified Qualified Unqualified Unqualified Unqualified Qualified
Unisys ITGC Qualified Unqualified Qualified Qualified Unqualified Qualified
The department ITGC* -- -- -- -- Qualified Qualified
ServiceFirst** Disclaimer -- -- -- -- --

# The ASAE 3402 controls reports were issued by an independent private sector service auditor appointed by the Department of Customer Service.
* Information technology services were transitioned from Unisys to the department in phases from 2019–20 to 2020–21.
** ServiceFirst was the shared service centre and its last reporting period was from 1 July 2015 to 13 December 2015.
^ GovConnect first reporting period from 14 December 2015 to 30 June 2016.

In 2020–21, the information technology services controls reports issued to the department, Infosys and Unisys were qualified. Infosys' accounts receivable business process controls report was also qualified. The audit qualifications were because:

  • the service auditor did not get access to the complete set of records processed during the financial year for several ITGC controls. The system that stored these records was hosted at Unisys. From December 2019 to 28 May 2021, the services at Unisys were progressively migrated to the department's IT environment but this system could not be migrated to the department in the required format, resulting in audit scope limitation for service auditors
  • of the deviations identified during sample testing of ITGC controls
  • the monthly follow up of outstanding receivables was not performed regularly, which was the only key control to address the timely collection of accounts receivable.

Internal control exceptions in GovConnect information and technology services require urgent remediations

The relevant controls over user access, system changes and password controls failed in all three ASAE 3402 GovConnect ITGC reports. These control failures can lead to unauthorised system access, system and configuration changes (workflow approvals, three-way match, etc.) and modifications to key reports. It increases the risk of:

  • fraud and error in the financial statements
  • ineffective segregation of duties controls
  • accuracy and completeness of system generated reports for the agencies using the SAPConnect system.

The table shows the number of ITGC control deviations compared to prior year:

Year ended 30 June 2021 2020
  Total controls tested Total number of control deviations and findings Total controls tested Total number of control deviations and findings
Infosys ITGC 41 16 35 8
Unisys ITGC 25 11 33 4
DCS ITGC 31 9 10 5

Most of these deviations were not mitigated or sufficiently mitigated to address the risk of unauthorised user access.

The service auditor identified significant areas for remediation:

  • governance arrangement of the IT services
  • user access management controls
  • SAP database controls
  • logical access
  • incident management.

In response to the internal control qualifications, the audit teams performed data analytics over payroll and accounts payable. The data analytics identified several terminated employees that were paid long after their termination dates which resulted in salary overpayments during 2020–21. While management had put processes in place to recover these overpayments, the payroll processing controls need to be improved to prevent such overpayments.

The Department of Customer Service advised that it established a ‘Control Reframe Project’ (the project) to address the internal control exceptions at GovConnect service providers. The objective of the project is to ensure the GovConnect assurance model is aligned with clear lines of responsibility and remediation actions are in place to support the delivery of services and achieve an improved outcome for future years.

Recommendation

We recommend the Department of Customer Service:

  • improve governance and internal control environment over the information technology services
  • ensure GovConnect service providers prioritise remediation actions to address internal control exceptions
  • perform a post-implementation review of the transition of the Unisys arrangement to identify lessons learnt and continuous improvement
  • develop data analytics to help analyse and identify high-risk patterns and anomalies in GovConnect key transaction systems, augmenting their existing monitoring and detective controls.

The NSW Public Sector's cyber security resilience needs urgent attention

The 2020 'Central Agencies' Report to Parliament highlighted the need for Cyber Security NSW, a business unit within the Department of Customer Service, and NSW Government agencies to prioritise improvements to their cyber security resilience as a matter of urgency. A status update of the 2020 recommendation is included in Appendix five of this report.

The Audit Office's Annual Work Program identifies cyber security as a focus area for the Audit Office in 2021–24. It outlines a three-pronged approach to auditing cyber security in this period:

  • considering how agencies are responding to the risks associated with cyber security across our financial audits across the NSW public sector
  • examining the effectiveness of cyber security planning and governance arrangements for large NSW state government agencies for our Internal Controls and Governance report
  • conducting deep-dive performance audits of the effectiveness of specific agency activities in preparing for, and responding to cyber security risks.

A performance audit 'Managing cyber risks' was tabled in Parliament in July 2021. The audit made several recommendations to audited agencies to uplift their cyber security management. It also recommended the Department of Customer Service to:

  • clarify the requirement of the NSW Cyber Security Policy (CSP) reporting to all systems
  • require agencies to report the target level of maturity for each mandatory requirement.

A compliance audit 'Compliance with the NSW Cyber Security Policy' was tabled in October 2021. The audit examined whether agencies are complying with the NSW Cyber Security Policy to ensure all NSW Government departments and public service agencies are managing cyber security risks to their information and systems.

The report found that key elements to strengthen cyber security governance, controls and culture are not sufficiently robust and not consistently applied. There has been insufficient progress to improve cyber security safeguards across NSW Government agencies. The poor levels of cyber security maturity are a significant concern. Improvement requires dedicated leadership and resourcing. To comply with some elements of the government’s policy agencies will have to invest in technical uplift and some measures may take time to implement. However, other elements of the policy do not require any investment in technology. They simply require leadership and management commitment to improve cyber literacy and culture. And they require accountability and transparency. Transparent reporting of performance is a key means to improve performance.

The report noted that the CSP was not achieving the objective of improved cyber governance, controls and culture. The compliance audit made several recommendations to Cyber Security NSW and other NSW Government agencies.

The 2021 maturity self-assessment results against the Australian Cyber Security Centre Essential 8 for the 25 largest NSW State Government agencies are reported in the 2021 'Internal Control and Governance' Report to Parliament.

Repeat recommendation

Cyber Security NSW and NSW Government agencies need to prioritise improvements to their cyber security resilience as a matter of urgency.

Management of cyber security risk

Our 2020-21 financial audit assessed whether cyber security risks represent a risk of material misstatement to the department's own financial statements. A request performance audit 'Service NSW's handling of personal information' was tabled on 18 December 2020. The audit followed two cyber security incidents that resulted in data breaches of customer information. As part of our audit procedures, we obtained an understanding of the controls the department has in place to address the risk of cyber security incidents and respond to any incidences which may have occurred during the year, including its impact on the audit.

Our assessment of the department’s own cyber risk management shows that:

  • an approved security incident response plan was not in place during the reporting period. There was a lack of testing over incident detection and monitoring process
  • a formal process over patch management that includes assessment, determining relevance and priority, timely rollout and escalation and reporting of long outstanding patches to senior management is being established.

The department provides information security services including cyber security management to cluster agencies. We found that there were insufficient communications within the Customer Service cluster over the controls and assurance over cyber security risk management. Some cluster agencies had put in place limited controls over cyber security risk management.

Recommendation

We recommend the Department of Customer Service:

  • establish an approved security incident response plan and formal process over patch management
  • improve communications with cluster agencies over the controls and assurance in cyber security management.

Appendix one – Misstatements in financial statements submitted for audit

Appendix two – Early close procedures

Appendix three – Timeliness of financial reporting

Appendix four – Financial data

Appendix five – Status of 2020 recommendations

 

Copyright notice

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Published

Actions for Health 2021

Health 2021

Health
Asset valuation
Compliance
Cyber security
Financial reporting
Infrastructure
Internal controls and governance
Procurement

This report analyses the results of our audits of the Health cluster agencies for the year ended 30 June 2021.

Our preferred approach is to table the ‘Report on State Finances’ in Parliament before any other cluster report. This is because the 'Report on State Finances' focuses on the audit results and observations relating to the Total State Sector Accounts, in effect a consolidation of all government agencies. This year the 'Report on State Finances' has been delayed due to significant accounting issues being considered in the Total State Sector Accounts and which may impact the Treasury and Transport clusters.

As there are no outstanding matters relating to audits in the Health cluster impacting the Total State Sector Accounts we have decided to break with normal practice and table this cluster report ahead of the ‘Report on State Finances’.

What the report is about

The results of Health cluster (the cluster) agencies' financial statements audits for the year ended 30 June 2021.

What we found

Unmodified audit opinions were issued for the financial statements of all Health cluster agencies.

The COVID-19 pandemic increased the complexity and number of accounting matters faced by the cluster. The total gross value of corrected misstatements in 2020–21 was $250.2 million, of which $226.0 million were pandemic related.

A qualified audit opinion was issued on the Annual Prudential Compliance Statement. The basis of the qualification related to 19 instances (18 in 2018–19) of non-compliance relating to three of the 20 prudential requirements across five aged care facilities.

What the key issues were

The total number of matters we reported to management across the cluster increased from 112 in 2019–20 to 116 in 2020–21. Of the 116 issues raised in 2020–21, three were high risk (one in 2019–20) and 57 were moderate risk (47 in 2019–20). Nearly one half of the issues were repeat issues.

The three new high-risk issues identified were:

Hotel Quarantine (HQ) fees

The absence of a tailored debt recovery strategy, data integrity issues and uncertainties around future HQ arrangements increased risks around the recoverability of HQ fees from travellers.

COVID-19 inventories

Data errors and anomalies in the impairment model and difficulties forecasting key factors impacting the management of Personal Protective Equipment (PPE) increased uncertainty associated with the valuation and impairment of COVID-19 inventories.

COVID-19 vaccines

The Commonwealth did not provide information about the cost of vaccines provided to NSW free of charge, which required the performance of internal valuations to reflect the consumption of vaccines in the financial statements.

What we recommended

Hotel Quarantine (HQ) fees

Develop a tailored assessment methodology to estimate recoverability of HQ fees and work with Revenue NSW to develop a tailored debt recovery strategy.

COVID-19 inventories

Review the current stocktaking and impairment methodology to incorporate validation of data key to the management of COVID-19 related PPE.

COVID-19 vaccines

Work with the Commonwealth to obtain primary price information on COVID-19 vaccines.

Fast facts

The Health cluster, comprising 15 local health districts, five pillars agencies, two specialty health networks and six shared state-wise services agencies, deliver health services to the people of New South Wales.

  • 100% unqualified audit opinions were issued on agencies' 30 June 2021 financial statements
  • 24 monetary misstatements were reported in 2020–21
  • high risk management letter findings were identified
  • 47.4% of reported issues were repeat issues
  • $23.5b property, plant and equipment as at 30 June 2021
  • $26.8b total expenditure incurred in 2020–21

This report provides Parliament and other users of the Health cluster’s financial statements with the results of our audits, our observations, analysis, conclusions and recommendations in the following areas:

  • financial reporting
  • audit observations.

Financial reporting is an important element of good governance. Confidence and transparency in public sector decision-making are enhanced when financial reporting is accurate and timely. This chapter outlines our audit observations related to the financial reporting of agencies in the Health cluster (the cluster) for 2021.

Section highlights

  • Unqualified audit opinions were issued for all cluster agencies required to prepare general-purpose financial statements.

  • The total gross value of all corrected monetary misstatements for 2020–21 was $250.2 million, of which $226.0 million were related to complexities arising from the COVID-19 pandemic.

  • A qualified audit opinion was issued on the Ministry's Annual Prudential Compliance Statement.

Appropriate financial controls help ensure the efficient and effective use of resources and administration of agency policies. They are essential for quality and timely decision-making. This chapter outlines our observations and insights from our financial statement audits of agencies in the Health cluster.

Section highlights

  • The total number of internal control deficiencies has increased from 112 issues in 2019–20 to 116 in 2020–21. Of the 116 issues raised in 2020–21, three were high (one in 2019–20) and 57 were moderate (47 in 2019–20); with nearly one half of all control deficiencies reported in 2020–21 being repeat issues.
  • The complexities arising from accounting for agreements between governments to respond to the COVID-19 pandemic presented three new high risk audit findings with respect to the:
    • expected rate of recoverability of outstanding Hotel Quarantine fees
    • procurement, stocktaking and impairment of COVID-19 inventories
    • valuation and recognition of COVID-19 vaccines received from the Commonwealth Government.
  • Management of excessive leave balances and poor quality or lack of documentation supporting key agreements were amongst the repeat issues observed again in the 2020–21 financial reporting period.

Findings reported to management

The number of findings reported to management has increased, with 47.4 per cent of all issues being repeat issues

Breakdowns and weaknesses in internal controls increase the risk of fraud and error. Deficiencies in internal controls, matters of governance interest and unresolved issues were reported to management and those charged with governance of cluster agencies. The Audit Office does this through our management letters, which include observations, implications, recommendations and risk ratings.

In 2020–21, there were 116 findings raised across the cluster (112 in 2019–20). 47.4 per cent of all issues were repeat issues (38.4 per cent in 2019–20).

A delay in implementing audit recommendations increases the risk of intentional and accidental errors in processing information, producing management reports and generating financial statements. This can impair decision-making, affect service delivery and expose agencies to fraud, financial loss and reputational damage. Poor controls may also mean agency staff are less likely to follow internal policies, inadvertently causing the agency not to comply with legislation, regulation and central agency policies.

The table below describes the common issues identified across the cluster by category and risk rating.

Risk rating Issue
Information technology

Moderate2
7 new,
3 repeat

We identified the need for agencies to improve information technology processes and controls that support the integrity of financial data used to prepare agencies' financial statements. Of particular concern are issues associated with:

  • lack of reviews of user access and privileged user access for
  • HealthRoster
  • Assets and Facilities Management Online
  • vMoney Powerhouse
  • Patient Billing and Revenue Collection system.

Repeat issues included:

  • deficient password controls
  • no independent review for data integrity of any changes made to HealthRoster
  • incomplete reviews of StaffLink User Access.

Low1
4 new,
5 repeat

Internal control deficiencies or improvements

High3

1 new, 

0 repeat

We identified internal control weaknesses across key business processes, including new issues relating to:

  • procurement, stocktaking and impairment of COVID-19 inventories (personal protective equipment)
  • instances where employees' timesheets were approved in advance
  •  monthly reconciliations not reviewed in a timely manner
  • asset revaluation processes at Illawarra Shoalhaven Local Health District.
     

Repeat issues included:

  • forced finalisation of rosters in order to finalise processing of payroll
  • partial repeat issue relating to HealthShare NSW's stocktake process, refer to details in the following section of this report.

Moderate2
6 new,
12 repeat

 Low1
10 new,
4 repeat

Financial reporting

High3

2 new, 
0 repeat

We identified weaknesses with respect to financial reporting in relation to the:

  • expected rate of recoverability of outstanding Hotel Quarantine fees
  • valuation and recognition of COVID-19 vaccines received from the Commonwealth Government
  • application of AASB 16 'Leases'
  • improvement in health agencies' grant register to better support management's accounting treatment under the applicable revenue accounting standards.

Moderate2
6 new,
1 repeat

Low1
8 new,
3 repeat

Governance and oversight
Moderate2
9 new,
5 repeat

We identified opportunities for agencies to improve governance and oversight processes, including:

  • ensure better documentation around governance arrangements for major health capital works delivered by Health Infrastructure
  • absence of documented practices at health agencies level relating to Visiting Medical Officer claims.
     

Repeat issues include:

  • delegations manual for Health Infrastructure remains in draft and has done so since 2017.
Low1
2 new,
2 repeat
Non-compliance with key legislation and/or central agency policies
Moderate2
1 new,
7 repeat

We identified the need for agencies to improve compliance with key legislation and central agency policies, with new findings including:

  • bank signatories list not updated to remove terminated employees
  • subsequent changes made to Junior Medical Officers' approved rosters not approved by an authorised delegate.
     

Repeat issues include:

  • management of excessive annual leave
  • non-compliance with the Government Information (Public Access) Act 2009 (GIPA Act) by Ambulance NSW.
Low1
5 new,
13 repeat

4Extreme risk from the consequence and/or likelihood of an event that has had, or may have a negative impact on the entity.
3 High risk from the consequence and/or likelihood of an event that has had, or may have a negative impact on the entity.
2 Moderate risk from the consequence and/or likelihood of an event that has had, or may have a negative impact on the entity.
1 Low risk from the consequence and/or likelihood of an event that has had, or may have a negative impact on the entity.

Note: Management letter findings are based either on final management letters issued to agencies, or draft letters where findings have been agreed with management.

Complexities arising from the COVID-19 response

The 2020–21 audit identified three new high-risk findings

COVID-19 has presented the cluster with several new accounting challenges. New and evolving matters arose from changes to operating conditions, which characterised the 2020–21 financial reporting period. Issues with a high degree of estimation uncertainty will require ongoing attention as the strategies employed to deal with the COVID-19 pandemic evolve.

Expected rate of recovery of outstanding Hotel Quarantine invoices

The estimation of the amount likely to be recovered is complicated not only by the uncertainties that exist regarding the assumptions those estimations rely upon, but also the debt collection processes and strategies put into place to manage the accumulated debtors' balance. Debt collection is not administered by the cluster, but rather Revenue NSW. We observed an absence of a methodology to assess the likelihood of recovery. Instead, Sydney Local Health District was relying on Revenue NSW to develop and execute on a collection strategy. Sydney Local Health District was using the same approach to hotel quarantine debts as it did to other Health receivables. As the approach to managing international borders evolves over time, so too will the cluster's need to develop robust estimation models to assess the likely collectability of debtors. 

Procurement, management and impairment of COVID-19 inventories

$656.2 million of COVID-19 inventories were procured in 2020–21, with $220.2 million consumed; $558.7 million impaired and a further $217.1 million written off. Estimates of the degree to which inventories are expired, not fit for purpose or are faulty is often based on management judgement at all stages in the procurement cycle.

With respect to the stocktaking methodology applied, the following issues were identified:

  • discrepancies noted in the stock bin listing provided for audit
  • discrepancies in the recount sheet generated
  • inconsistent application of the stocktake methodology
  • inconsistent labelling of quarantined stock
  • a lack of an approach for validating stock expiry dates, which is a key input to the impairment calculations.

Although management had developed processes and a methodology to count as well as to assess the level of inventory that was not fit for purpose, ongoing attention to the operating environment that emerges post pandemic will be important in assessing the degree to which existing COVID-19 inventories can be integrated into a ‘business as usual’ model going forward. Further refinement of the key elements of the stocktaking methodology will also be required to ensure that key inputs upon which management relies to calculate the year-end inventory impairment provision can be appropriately validated.

Valuation and recognition of COVID-19 vaccines received from the Commonwealth Government

The 2020–21 financial reporting period saw the Commonwealth acquire COVID-19 vaccines and provide these to state jurisdictions to dispense to their communities. The vaccines, although provided free of charge require recognition. However, Health entities were not responsible for acquiring the vaccines and data on the vaccines' cost was not shared by the Commonwealth. Management undertook a valuation using publicly available data to estimate the value to attribute to the vaccine inventory; developed new systems and leveraged existing pharmacy systems to track physical quantities received from the Commonwealth and ultimately distributed to NSW citizens. As the response to the pandemic evolves, larger quantities, and new lines of vaccine stock will be dealt with, and policy settings will need to adapt when patterns of distribution of those vaccines (e.g., timing of third booster shots) emerge. The Ministry of Health will need to ensure that the valuations applied to the prices of inventory distributed and held in stock are as accurate as possible. This can be done through further refinement of the existing valuation methodology, obtaining price information from the Commonwealth and engaging specialist pharmaceutical valuers.

Emerging trends

Recognition of provisions without sufficient support

Several NSW Health entities raised accruals and provisions in 2020–21, which did not have an appropriate basis for recognition. Liabilities can only be recognised where there is a present obligation to make a payment arising from a past event. A number of these errors remain uncorrected in the financial statements of those entities as they are not material, individually or in aggregate to the financial statements as a whole. Increased training and guidance are required to ensure that treatment within the cluster is consistent and reflects events that have occurred and give rise to obligations.

Treatment of Commonwealth funding

In the 2020–21 and 2019–20 financial reporting periods, we observed prior period errors arising from the treatment of Commonwealth funding. These errors related to recognising revenue under funding agreements entered into with the Commonwealth in the incorrect period. The conditions of these funding arrangements, the transactional information requiring validation and the circumstances when revenue should be recognised are not always clear and can be complex. Early and continuous engagement with the Commonwealth is required to ensure that revenue recognition principles are consistently applied across the cluster.

Key repeat issues

Management of excessive annual leave

NSW Treasury guidelines stipulate annual leave balances exceeding 30 days are considered excess annual leave balances. Managing excess annual leave balances has been reported as an issue for the cluster for more than five years, with the average percentage of employees with excessive leave balances over the last five years being 36.1 per cent (35.5 per cent over five years covering 2015–16 to 2019–20).

The operational demands required to manage the COVID-19 pandemic have presented new challenges for the cluster in trying to manage its excessive leave balances. 39.2 per cent of employees now have excess leave balances at 30 June 2021 (35.4 per cent at 30 June 2020).

The state's leave policy C2020-12 Managing Accrued Recreation Leave Balances requires agencies to manage excessive leave balances to 30 days or less to maintain their workforces physical and mental health.

Accurate time recording

Forced-finalisation of time records by system administrators within HealthRoster remains an issue and we continue to observe time records forced-finalised by system administrators so pay runs can be finalised on a timely basis. During 2020–21, a total of two million (2.2 million in 2019–20) time records were force approved, which represents 5.7 per cent of total time records (6.9 per cent in 2019–20).

Existence, completeness and accuracy of key agreements

Delivery of major capital projects

Health Infrastructure (a division of the Health Administration Corporation) is responsible for the delivery of major capital projects with a budgeted spend of more than $10.0 million. Health Infrastructure oversee the planning, design, procurement, and construction phases. Capital works in progress are recognised in the financial statements of the health entity that intends to use those assets upon completion. The health entities recognise both the capital work in progress and the revenue associated with the capital funding from the Ministry for the construction of the assets. Capital funding is currently agreed with health entities as part of the annual Service Agreement. The assumption that the health entities control the assets during their construction is consistent with Health Infrastructure's role as an agent for the health entity and the Ministry's policy directive PD2020-033 'Management and control of Health Administration Corporation owned Real Property'.

We continued to observe a lack of clarity regarding agreements between Health Infrastructure, the Ministry and the cluster agency that will eventually receive the completed asset. This can lead to confusion and uncertainty around the rights and obligations of each party to the transaction.

Cross border patient funding arrangements

When patients require medical care in a jurisdiction where they are not generally domiciled, there are arrangements in place to provide funding to support cross border patient treatments. We have previously observed that agreements between NSW and other jurisdictions have not been finalised, and this continues to be the case. In the case of Victoria, no agreement has been finalised for the past seven years.

We continue to note that the cluster has long outstanding receivables and payables with other states. The absence of formal agreements between the states hampers the settlement of the debts relating to the treatment of cross border patients. The following table shows the status of Cross Border Agreements between NSW and other jurisdictions:

States 2014–15 2015–16 2016–17 2017–18 2018–19 2019–20 2020–21
Queensland Signed Signed Signed Signed Signed Not finalised Not finalised
Victoria Not finalised Not finalised Not finalised Not finalised Not finalised Not finalised Not finalised
Australian Capital Territory Signed Signed Signed Signed Signed Signed Not finalised
South Australia Signed Signed Signed Signed Signed Signed Not finalised
Tasmania Signed Signed Signed Signed Signed Signed Not finalised
Northern Territory Signed Signed Signed Signed Signed Signed Not finalised
Western Australia Signed Signed Signed Signed Signed Signed Not finalised

Albury Base Hospital

Albury Base hospital is located on the border of NSW and Victoria and services residents of both states. Documentation supporting the extension of the expired Intergovernmental Agreement 2009–2017 between NSW and Victoria in relation to the integration of health services in Wodonga and Albury could not be located.

Appendix one – Misstatements in financial statements submitted for audit

Appendix two – Early close procedures

Appendix three – Timeliness of financial reporting

Appendix four – Financial data

 

 

Copyright notice

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Published

Actions for Health 2020

Health 2020

Health
Compliance
Financial reporting
Infrastructure
Internal controls and governance
Service delivery

This report analyses the results of our audits of financial statements of the Health cluster for the year ended 30 June 2020. The table below summarises our key observations.

1. Financial reporting

Financial reporting

Unqualified financial audit opinions

The financial statements of NSW Health and its 25 controlled entities received unqualified opinions.

The number of corrected and uncorrected misstatements increased from the prior year. Misstatements related predominantly to the implementation of new accounting standards, asset revaluations and accounting for new revenue streams to cover the cost of HSW Health’s response to the COVID-19 pandemic.

Qualified compliance audit opinion

We issued a qualified audit opinion for the Ministry of Health’s Annual Prudential Compliance Statement for aged care facilities operated by NSW Health. We identified 18 instances of material non-compliance with the Fees and Payments Principles 2014 (No. 2) (the Principles) in 2019–20 (30 in 2018–19).

Financial performance

NSW Health received an additional $3.3 billion in funding to cover costs associated with its response to the COVID-19 pandemic.

The impacts of the COVID-19 pandemic on the cluster were significant for health entities and included changes to operations, increased revenues, expenditure, assets and liabilities. Cancellation of elective surgery and decreased emergency department presentations meant that despite the pandemic, activity levels at many health entities decreased. Health Pathology and HealthShare were notable exceptions.

In the period to the 30 June 2020, NSW Health reported that over 900,000 COVID-19 tests were conducted. Health Pathology conducted over 500,000 of these tests. Health Pathology's surge requirements were enhanced through arrangements with 13 private sector providers. HealthShare purchased $864.2 million of personal protective equipment.

Overall, NSW Health recorded an operating surplus of $3.1 billion in 2019–20, an increase of $2.0 billion from 2018–19. As in previous years, the surplus largely resulted from additional revenue received to fund capital projects including the construction of new facilities, upgrades and redevelopments. In 2019–20 additional Commonwealth and State funding for the purchase and stockpiling of personal protective equipment also contributed to the operating surplus.

Overtime payments The Ambulance Service of NSW’s (NSW Ambulance) reduced their overtime payments to $79.7 million in 2019–20 ($83.1 million in 2018–19). Overtime payments in 2019–20 included $6.8 million related to the response to the 2019–20 bushfire season. NSW Ambulance overtime payments represent 16.8 per cent of total overtime payments in the cluster.

2. Audit observations

Internal control deficiencies

We identified more internal control deficiencies in 2019–20. The number of repeat issues from prior years also remains high.

NSW Health addressed 18 out of the 25 information system control deficiencies during the year.

Several key agreements lacked formal documentation. This included agreements between the Ministry and health entities, between health entities and agencies in other clusters and between the Ministry and health departments in other jurisdictions.

Infrastructure delivery NSW Health had 44 ongoing major capital projects at 30 June 2020 with a total revised budget of $12.3 billion. The revised total budget of $12.3 billion is $2.0 billion more than the original budget. NSW Health revises budgets when it combines project stages.

This report provides parliament and other users of the Health cluster’s financial statements with the results of our audits, our observations, analysis, conclusions and recommendations in the following areas:

  • financial reporting
  • audit observations.

The impacts of the COVID-19 pandemic on the cluster were significant and included changes to the operations of the health entities and increased revenue, expenditure, assets and liabilities.

As a part of this year's audits of health entities, we have considered:

  • financial implications of the COVID-19 emergency at both health entity and cluster levels
  • changes to agencies' operating models
  • agencies' access to technology and the maturity of systems and controls to prevent unauthorised and fraudulent access to data.

Financial reporting is an important element of good governance. Confidence and transparency in public sector decision making are enhanced when financial reporting is accurate and timely.

The response to the COVID-19 pandemic primarily impacted the financial reporting of NSW Health through:

  • additional revenue from the State government in the form of grants and stimulus payments
  • additional revenue from the Commonwealth government under the National Partnership Agreement for COVID-19 to cover part of the cost of responding to the COVID-19 pandemic
  • increased expenses, largely due to increased payments to private health operators to maintain their viability during the COVID-19 pandemic and later to assist with public patient elective surgery waitlists and increased cleaning costs
  • increased purchases of personal protective equipment.

Chapter one outlines the impacts of NSW Health’s response to the COVID-19 pandemic. This chapter outlines our other audit observations related to the financial reporting of agencies in the Health cluster for 2020.

Section highlights

  • Unqualified audit opinions were issued for all health entities’ financial statements, although more misstatements were identified than last year.
  • NSW Health recorded an operating surplus of $3.1 billion, an increase of $2.0 billion from 2018–19. This is largely due to additional capital grants for new facilities, upgrades and redevelopments and additional Commonwealth and State funding for the purchase of personal protective equipment.
  • NSW Health’s expenses increased by 5.5 per cent in 2019–20 (7.0 per cent in 2018–19) despite the impact of the COVID-19 pandemic. The primary causes for the growth in expenses are increases in:
    • employee related expenses due to higher employee numbers, increased overtime and a 2.5 per cent award increase
    • payments to private health operators to maintain their viability during the COVID-19 pandemic and later to assist with public patient elective surgery waitlists
    • payments to private health operators due to the first full year of operation of the Northern Beaches hospital.
  • The Ambulance Service of NSW (NSW Ambulance) continued to report higher overtime payments than other health entities. However, despite the response to the 2019–20 bushfire season, their overtime payments were lower than last year. NSW Ambulance paid $79.7 million in overtime payments in 2019–20 ($83.1 million in 2018–19).
  • A qualified audit opinion was issued for the Ministry of Health’s Annual Prudential Compliance Statement for aged care facilities operated by NSW Health. There were 18 instances of material non-compliance with the Fees and Payments Principles 2014 (No. 2) (the Principles) in 2019–20 (30 in 2018–19)

Appropriate financial controls help ensure the efficient and effective use of resources and administration of agency policies. They are essential for quality and timely decision making.

The primary impact of the COVID-19 pandemic on the effectiveness of the internal controls of NSW Health and health entities relates to the effectiveness of controls implemented by HealthShare relating to the stocktake of personal protective equipment inventories. Inventory managed by HealthShare increased by 2,746 per cent during 2019–20. HealthShare’s inventory controls did not maintain pace with the sudden, significant increase.

The impacts of NSW Health’s response to the COVID-19 pandemic are outlined in chapter one. This chapter outlines other observations and insights from our financial statement audits of agencies in the Health cluster.

Section highlights

  • The number of internal control deficiencies has increased since 2018–19. More than a third of control deficiencies are repeat issues.
  • Control deficiencies that relate to managing employees’ leave and employee’s time recording continue to be difficult for entities to resolve, particularly during the ongoing response to the COVID-19 pandemic.
  • Several key agreements were undocumented. These included agreements between the Ministry and the health entities, between health entities, and between the Ministry and entities in other clusters and jurisdictions. These related to:
    • a loan arrangement between the Ministry and HealthShare for $319 million.
    • Northern Sydney Local Health District's use of land and buildings owned by the Graythwaite Charitable Trust
    • agreements for the treatment of New South Wales residents while they are interstate, and interstate residents receiving treatment while they are in New South Wales from Queensland, Victoria, South Australia and the ACT for both 2019–20 and 2018–19.
  • NSW Health reported that they completed nine major capital projects during 2019–20. As at 30 June 2020 there were 44 ongoing major capital health projects in NSW. The revised capital budget for these projects in total was $2.0 billion more than the original budget of $10.3 billion. NSW Health reported the budget revisions are largely the result of combining project stages.

Appendix one – List of 2020 recommendations 

Appendix two – Status of 2019 recommendations 

Appendix three – Financial data

Appendix four – Analysis of financial indicators 

Appendix five – Analysis of performance against budget

 

Copyright notice

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Auditor-General’s Report to Parliament

Health 2020

11 December 2020

This corrigendum has been prepared to amend the following text within the Auditor-General’s Report to Parliament on Health 2020, dated 10 December 2020.

NSW Health emergency department treatment times

On page five the original text was as follows:

NSW Health also measures the percentage of patients whose clinical care in emergency departments is completed within four hours. The measure is used as an indicator of accessibility to public hospital services.

NSW Health aims to complete clinical care in the emergency department for 81 per cent of patients within four hours. In 2019–20 NSW Health reports it completed clinical care within four hours for 72.1 per cent of patients (a 7.3 per cent decrease from 2018–19).

At Western Sydney Local Health District, 59 per cent of patients were treated within the targeted timeframe. NSW Health attribute this to the profile of patients presenting in emergency departments and additional time taken processing COVID-19 patients to ensure staff safety.

The original text has now been changed to:

NSW Health also measures the percentage of patients with total time in the emergency department of four hours or less for each local health district. The measure is used as an indicator of accessibility to public hospital services.

Local Health Districts Target % (2019–20) Actual % (2019–20)
Central Coast 77.0 59.9
Far West 90.2 86.6
Hunter New England 81.0 72.5
Illawarra Shoalhaven 79.0 60.2
Mid North Coast 82.0 76.7
Murrumbidgee 85.3 81.9
Nepean Blue Mountains 79.0 65.5
Northern NSW 81.0 78.2
Northern Sydney 79.0 73.9
South Eastern Sydney 78.0 70.3
South Western Sydney 78.0 61.2
Southern NSW 85.0 83.0
Sydney 76.0 70.9
Sydney Children’s Hospitals Network 80.0 72.1
Western NSW 85.9 81.0
Western Sydney 78.0 59.0
St Vincent's Health Network* 75.0 65.4
* St Vincent’s Health Network Sydney (SVHNS) comprises of St Vincent’s Hospital Sydney Limited as the affiliated health organisation in respect of four recognised establishments under the Health Services Act 1997 (NSW) (Health Services Act). Under the Health Services Act, St Vincent’s Hospital Sydney Limited, is treated as a Network for the purposes of the National Health Reform Agreement in respect of the three recognised establishments: St Vincent’s Hospital, Darlinghurst; Sacred Heart Health Service, Darlinghurst; St Joseph’s Hospital, Auburn; and St Vincent's Correctional Health, Parklea.
Source: NSW Health (unaudited)

The above changes will be reflected in the version of the report published on the Audit Office website and should be considered the true and accurate version.

Published

Actions for Internal controls and governance 2020

Internal controls and governance 2020

Education
Environment
Community Services
Finance
Health
Industry
Justice
Premier and Cabinet
Transport
Treasury
Compliance
Cyber security
Information technology
Internal controls and governance
Management and administration
Procurement

The Auditor-General for New South Wales, Margaret Crawford today released her report on the findings and recommendations from the 2019–20 financial audits that relate to internal controls and governance at 40 of the largest agencies in the NSW public sector.

The bushfire and flood emergencies and the COVID‑19 pandemic continue to have a significant impact on the people and public sector of New South Wales. The scale of the government response to these events has been significant. The report focuses on the effectiveness of internal controls and governance processes, including relevant agencies’ response to the emergencies. In particular, the report focuses on:

  • financial and information technology controls
  • business continuity and disaster recovery planning arrangements
  • procurement, including emergency procurement
  • delegations that support timely and effective decision-making.

Due to the ongoing impact of COVID‑19 agencies have not yet returned to a business‑as‑usual environment. ‘Agencies will need to assess their response to the recent emergencies and update their business continuity, disaster recovery and other business resilience frameworks to reflect the lessons learnt from these events’ the Auditor-General said.

The report noted that special procurement provisions were put in place to allow agencies to better respond to the COVID-19 pandemic. The Auditor-General recommended agencies update their procurement policies to reflect the current requirements of the NSW Procurement Framework and the emergency procurement requirements.

Read the PDF report

This report analyses the internal controls and governance of 40 of the largest agencies in the NSW public sector for the year ended 30 June 2020. These 40 agencies constitute an estimated 85 per cent of total expenditure for all NSW public sector agencies.

1. Internal control trends
New, repeat and high risk findings

Internal control deficiencies increased by 13 per cent compared to last year. This is predominately due to a seven per cent increase in new internal control deficiencies and 24 per cent increase in repeat internal control deficiencies. There were ten high risk findings compared to four last year.

The recent emergencies have consumed agency time and resources and may have contributed to the increase in internal control deficiencies, particularly repeat deficiencies.

Agencies should:

  • prioritise addressing high-risk findings
  • address repeat internal control deficiencies by re-setting action plans and timeframes and monitoring the implementation status of recommendations.
Common findings

A number of findings remain common across multiple agencies over the last four years, including:

  • out of date or missing policies to guide appropriate decisions
  • poor record keeping and document retention
  • incomplete or inaccurate centralised registers or gaps in these registers.
2. Information technology controls
IT general controls

We found deficiencies in information security controls over key financial systems including:

  • user access administration deficiencies relating to inadequate oversight of the granting, review and removal of user access at 53 per cent of agencies
  • privileged users were not appropriately monitored at 43 per cent of agencies
  • deficient password controls that did not align to the agency's own password policies at 25 per cent of agencies.

The deficiencies above increase the risk of non-compliance with the NSW Cyber Security Policy, which requires agencies to have processes in place to manage user access, including privileged user access to sensitive information or systems and remove that access once it is not required or employment is terminated.

3. Business continuity and disaster recovery planning
Assessing risks to business continuity and Scenario testing

The response to the recent emergencies and the COVID-19 pandemic has encompassed a wide range of activities, including policy setting, on-going service delivery, safety and availability of staff, availability of IT and other systems and financial management. Agencies were required to activate their business continuity plans in response, and with the continued impact of COVID-19 have not yet returned to a business-as-usual environment.

Our audits focused on the preparedness of agency business continuity and disaster recovery planning arrangements prior to the onset of the COVID-19 pandemic.

We identified deficiencies in agency business continuity and disaster recovery planning arrangements. Twenty-three per cent of agencies had not conducted a business impact analysis (BIA) to identify critical business functions and determine business continuity priorities. Agencies can also improve the content of their BIA. For example, ten per cent of agencies' BIAs did not include recovery time objectives and six per cent of agencies did not identify key IT systems that support critical business functions. Scenario testing improves the effectiveness with which a live crisis is handled, but 40 per cent of agencies had not conducted a business continuity scenario testing exercise in the period from 1 January 2019 to 31 December 2019. There were also opportunities to improve the effectiveness of scenario testing exercises by:

  • involving key dependent or inter-dependent third parties who support or deliver critical business functions
  • testing one or more high impact scenarios identified in their business continuity plan
  • preparing a formalpost-exercise report documenting the outcome of their scenario testing.

Agencies have responded to the recent emergencies but addressing deficiencies will ensure agencies have adequate safeguards in their processes to again respond in the future, if required.

During 2020–21 we plan to conduct a performance audit on 'Business continuity and disaster recovery planning'. This audit will consider the effectiveness of agency business continuity planning arrangements to maintain business continuity through the recent emergencies and/or COVID-19 pandemic and return to a business-as-usual environment. We also plan to conduct a performance audit on whole-of-government 'Coordination of emergency responses'.

Responding to disruptions

We found agencies' governance functions could have been better informed about responses to disruptive incidents that had activated a business continuity or disaster recovery response between 1 January 2019 to 31 December 2019. For instance:

in 89 per cent of instances where a business continuity response was activated, a post-incident review had been performed. In 82 per cent of these instances, the outcomes were reported to a relevant governance or executive management committee

in 95 per cent of instances where a disaster recovery response was activated, a post incident review had been performed. In 86 per cent of these instances, the outcomes were reported to a relevant governance committee or executive management committee.

Examples of recorded incidents included extensive air quality issues and power outages due to bushfires, system and network outages, and infected and hijacked servers.

Agencies should assess their response to the recent emergencies and the COVID-19 pandemic and update business continuity, disaster recovery and other business resilience frameworks to incorporate lessons learned. Agencies should report to those charged with governance on the results and planned actions.

Management review and oversight Eighty-two per cent and 86 per cent of agencies report to their audit and risk committees (ARC) on their business continuity and disaster recovery planning arrangements, respectively. Only 18 per cent and five per cent of ARCs are briefed on the results of respective scenario testing. Briefing ARCs on the results of scenario testing exercises helps inform their decisions about whether sound and effective business continuity and disaster recovery arrangements have been established.
4. Procurement, including emergency procurement
Policy framework

Agency procurement policies did not capture the requirements of several key NSW Procurement Board Directions (the Directions), increasing the risk of non-compliance with the Directions. We noted: 

  • 67 per cent of agencies did specify that procurement above $650,000 must be open to market unless exempt or procured through an existing Whole of Government Scheme or contract
  • 36 per cent of agencies did specify that procurements above $500,000 payable in foreign currencies must be hedged
  • 69 per cent of agencies' policies did specify that the agency head or cluster CFO must authorise the engagement of consultants where the engagement of the supplier does not comply with the standard commercial framework.

Recommendation: Agencies should review their procurement policies and guidelines to ensure they capture the key requirements of the NSW Government Procurement Policy Framework, including NSW Procurement Board Directions.

Managing contracts

Eighty-eight per cent of agencies maintain a central contract register to record all details of contracts above $150,000, which is a requirement of GIPA legislation. Of the agencies that maintained registers, 13 per cent did not capture all contracts and eight per cent did not include all relevant contract details.

Sixteen per cent of agencies did not periodically review their contract register. Timely review increases compliance with GIPA legislation, and enhances the effectiveness with which procurement business units monitor contract end dates, contract extensions and commence new procurement.

Training and support

Ninety-three per cent of agencies provide training to staff involved in procurement processes, and a further 77 per cent of agencies provide this training on an on-going basis. Of the seven per cent of agencies that had not provided training to staff, we noted gaps in aspects of their procurement activity, including:

  • not conducting value for money assessments prior to renewing or extending the contract with their existing supplier
  • not obtaining approval from a delegated authority to commence the procurement process
  • procurement documentation not specifying certain key details such as the conditions for participation including any financial guarantees and dates for the delivery of goods or supply of services.

Training on procurement activities ensures there is effective management of procurement processes to support operational requirements, and compliance with procurement directions.

Procurement activities While agencies had implemented controls for tender activities above $650,000, 43 per cent of unaccredited agencies did not comply with the NSW Procurement Policy Framework because they had not had their procurement endorsed by an accredited agency within the cluster or by NSW Procurement. This endorsement aims to ensure the procurement is properly planned to deliver a value for money outcome before it commences.
Emergency procurement

As at 30 June 2020, agencies within the scope of this report reported conducting 32,239 emergency procurements with a total contract value of $316,908,485. Emergency procurement activities included the purchase of COVID-19 cleaning and hygiene supplies.

The government, through NSW Procurement released the 'COVID-19 Emergency procurement procedure', which relaxed procurement requirements to allow agencies to make COVID-19 emergency procurements. Our review against the emergency procurement measures found most agencies complied with requirements. For example:

  • 95 per cent of agencies documented an assessment of the need for the emergency procurement for the good and/or service
  • 86 per cent of agencies obtained authorisation of the emergency procurement by the agency head or the nominated employee under Public Works and Procurement Regulation 2019
  • 76 per cent of agencies reported the emergency procurement to the NSW Procurement Board.

Complying with the procedure helps to ensure government resources are being efficiently, effectively, economically and in accordance with the law.

Recommendation: Agency procurement frameworks should be reviewed and updated so they can respond effectively to emergency situations that may arise in the future. This includes:

  • updating procurement policies and guidelines to define an emergency situation, specify who can approve emergency procurement and capture other key requirements
  • using standard templates and documentation to prompt users to capture key requirements, such as needs analysis, supplier selection criteria, price assessment criteria, licence and insurance checks
  • having processes for reporting on emergency procurements to those charged with governance and NSW Procurement.
5. Delegations
Instruments of delegation

We found that agencies have established financial and human resources delegations, but some had not revisited their delegation manuals following the legislative and machinery of government changes. For those agencies impacted by machinery of government changes we noted:

  • 16 per cent of agencies had not updated their financial delegations to reflect the changes
  • 16 per cent of agencies did not update their human resources delegations to reflect the changes.

Delegations manuals are not always complete; 16 per cent of agencies had no delegation for writing off bad debts and 26 per cent of agencies had no delegation for writing off capital assets.

Recommendation: Agencies should ensure their financial and human resources delegation manuals contain regular set review dates and are updated to reflect the Government Sector Finance Act 2018, machinery of government changes and their current organisational structure and roles and responsibilities.

Compliance with delegations

Agencies did not understand or correctly apply the requirements of the Government Sector Finance Act 2018 (GSF Act), resulting in non-compliance with the Act. We found that 18 per cent of agencies spent deemed appropriations without obtaining an authorised delegation from the relevant Minister(s), as required by sections 4.6(1) and 5.5(3) of the GSF Act.

Further detail on this issue will be included in our Auditor-General's Reports to Parliament on Central Agencies, Education, Health and Stronger Communities, which will be tabled throughout December 2020.

Recommendation: Agencies should review financial and human resources delegations to ensure they capture all key functions of laws and regulations, and clearly specify the relevant power or function being conferred on the officer.

6. Status of 2019 recommendations
Progress implementing last year's recommendations

Recommendations were made last year to improve transparency over reporting on gifts and benefits and improve the visibility management and those charged with governance had over actions taken to address conflicts of interest that may arise. This year, we continue to note:

  • 38 per cent of agencies have not updated their gifts and benefits register to include all the key fields required under the minimum standards set by the Public Service Commission
  • 56 per cent of agencies have not provided training to staff and 63 per cent of agencies have not implemented an annual attestation process for senior management
  • 97 per cent of agencies have not published their gifts and benefits register on their website and 41 per cent of agencies are not reporting on trends in the gifts and benefits register to those charged with governance.

While we acknowledge the significance of the recent emergencies, which have consumed agency time and resources, we note limited progress has been made implementing these recommendations. Further detail on the status of implementing all recommendations is in Appendix 2.

Recommendation: Agencies should re-visit the recommendations made in last year's report on internal controls and governance and action these recommendations.

Internal controls are processes, policies and procedures that help agencies to:

  • operate effectively and efficiently
  • produce reliable financial reports
  • comply with laws and regulations
  • support ethical government.

This chapter outlines the overall trends for agency controls and governance issues, including the number of audit findings, the degree of risk those deficiencies pose to the agency, and a summary of the most common deficiencies we found across agencies. The rest of this report presents this year’s controls and governance findings in more detail.

Section highlights

We identified ten high risk findings, compared to four last year with two findings repeated from the previous year. There was an overall increase of 13 per cent in the number of internal control deficiencies compared to last year due to a seven per cent increase in new internal control deficiencies, and a 24 per cent increase in repeat internal control deficiencies. The recent emergencies have consumed agency time and resources and may have contributed to the increase in internal control deficiencies, particularly repeat deficiencies.

We identified a number of findings that remain common across multiple agencies over the last four years. Some of these findings related to areas that are fundamental to good internal control environments and effective organisational governance. Examples include:

  • out of date or missing policies to guide appropriate decisions
  • poor record keeping and document retention
  • incomplete or inaccurate centralised registers, or gaps in these registers.

Policies, procedures and internal controls should be properly designed, be appropriate for the current organisational structure and its business activities, and work effectively.

This chapter outlines our audit observations, conclusions and recommendations, arising from our review of agency controls to manage key financial systems.

Section highlights

Government agencies’ financial reporting is heavily reliant on information technology (IT). We continue to see a high number of deficiencies related to IT general controls, particularly those related to user access administration. These controls are key in adequately protecting IT systems from inappropriate access and misuse.

IT is also important to the delivery of agency services. These systems often provide the data to help monitor the efficiency and effectiveness of agency processes and services they deliver. Our financial audits do not review all agency IT systems. For example, IT systems used to support agency service delivery are generally outside the scope of our financial audit. However, agencies should also consider the relevance of our findings to these systems.

Agencies need to continue to focus on assessing the risks of inappropriate access and misuse and the implementation of controls to adequately protect their systems, focussing on the processes in place to grant, remove and monitor user access, particularly privileged user access.

 

This chapter outlines our audit observations, conclusions and recommendations, arising from our review of agency business continuity and disaster recovery planning arrangements.

Section highlights

We identified deficiencies in agency business continuity and disaster recovery planning arrangements and opportunities for agencies to enhance their business continuity management and disaster recovery planning arrangements. This will better prepare them to respond to a disruption to their critical functions, resulting from an emergency or other serious event. Twenty-three per cent of agencies had not conducted a business impact analysis (BIA) to identify critical business functions and determine business continuity priorities and 40 per cent of agencies had not conducted a business continuity scenario testing exercise in the period from 1 January 2019 to 31 December 2019. Scenario testing improves the effectiveness with which a live crisis is handled.

This section focusses on the preparedness of agency business continuity and disaster recovery planning arrangements prior to the onset of the COVID-19 pandemic. While agencies have responded to the recent emergencies, proactively addressing deficiencies will ensure agencies have adequate safeguards in their processes to again respond in the future, if required.

During 2020–21 we plan to conduct a performance audit on 'Business continuity and disaster recovery planning'. This audit will consider the effectiveness of agency business continuity planning arrangements to maintain business continuity through the recent emergencies and/or COVID-19 pandemic and return to a business-as-usual environment. We also plan to conduct a performance audit on whole-of-government 'Coordination of emergency responses'.

 

This chapter outlines our audit observations, conclusions and recommendations, arising from our review of procurement agency procurement policies and procurement activity.

Section highlights

We found agencies have procurement policies in place to manage procurement activity, but the content of these policies was not sufficiently detailed to ensure compliance with NSW Procurement Board Directions (the Directions). The Directions aim to ensure procurement activity achieves value for money and meets the principles of probity and fairness.

Agencies have generally implemented controls over their procurement process. In relation to emergency procurement activity, agencies reported conducting 32,239 emergency procurements with a total contract value of $316,908,485 up to 30 June 2020. Our review of emergency procurement activity conducted during 2019–20 identified areas where some agencies did not fully comply with the 'COVID-19 Emergency procurement procedure'.

We also found not all agencies are maintaining complete and accurate contract registers. This not only increases the risk of non-compliance with GIPA legislation, but also limits the effectiveness of procurement business units to monitor contract end dates, contract extensions and commence new procurement in a timely manner. We noted instances where agencies renewed or extended contracts without going through a competitive tender process during the year.

 

This chapter outlines our audit observations, conclusions and recommendations, arising from our review of agency compliance with financial and human resources delegations.

Section highlights
We found that agencies are not always regularly reviewing and updating their financial and human resources delegations when there are changes to legislation or other organisational changes within the agency or from machinery of government changes. For example, agencies did not understand or correctly apply the requirements of the GSF Act, resulting in non-compliance with the Act. We found that 18 per cent of agencies spent deemed appropriations without obtaining an authorised delegation from the relevant Minister(s), as required by sections 4.6(1) and 5.5(3) of the GSF Act.
In order for agencies to operate efficiently, make necessary expenditure and human resource decisions quickly and lawfully, particularly in emergency situations, it is important that delegations are kept up to date, provide clear authority to decision makers and are widely communicated.

Appendix one – List of 2020 recommendations 

Appendix two – Status of 2019 recommendations

Appendix three – Cluster agencies

 

Copyright notice

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Published

Actions for Transport 2019

Transport 2019

Transport
Asset valuation
Financial reporting
Infrastructure
Internal controls and governance
Management and administration
Service delivery
Workforce and capability

This report details the results of the financial audits of NSW Government's Transport cluster for the financial year ended 30 June 2019. The report focuses on key observations and findings from the most recent financial statement audits of agencies in the Transport cluster.

Unqualified audit opinions were issued for all agencies' financial statements. However, valuations of assets continue to create challenges across the cluster. The Audit Office identified some deficiencies in relation to asset valuations at Transport for NSW, Roads and Maritime Services, Rail Corporation New South Wales and Sydney Metro.

The Audit Office noted an increase in findings on internal controls across the Transport cluster. Key themes related to information technology, asset management and employee leave entitlements. The report also highlights the status of significant infrastructure projects across the Transport cluster.

The report makes several recommendations including:

  • agency finance teams need to be consulted on major business decisions and commercial transactions at the time of their execution to assess the financial reporting impacts
  • the Department of Transport should ensure consistent accounting policies are applied across its controlled entities.

Download the Transport 2019 report (PDF)

This report analyses the results of our audits of financial statements of the Transport cluster for the year ended 30 June 2019. The table below summarises our key observations.

1. Machinery of Government changes
Transport for NSW, as the
lead agency, will absorb the
functions of Roads and
Maritime Services

The NSW Government announced its intention to integrate Roads and Maritime Services (RMS) into Transport for NSW (TfNSW) as part of the Machinery of Government changes.

This change was not included in the Administrative Orders as the Transport Administration Act 1988 No. 109 governs the composition of the Transport cluster. The Transport Administration Amendment (RMS Dissolution) Act 2019 (the Act) received assent on 22 November 2019. The Act dissolves RMS and transfers the assets, rights and liabilities of RMS to TfNSW. As at the date of this Report, the Act is not yet in force.

Transport is considering the impact of the changes on its operating model and financial reporting.

2. Financial reporting
Audit opinions

Unqualified audit opinions were issued on the 2018–19 financial statements of all agencies in the Transport cluster.

TfNSW and Sydney Metro obtained a three-week extension from NSW Treasury to submit their financial statements for audit to resolve accounting issues surrounding the valuation of property, plant and equipment.

The Department of Transport reported total consolidated property, plant and equipment of $158 billion at 30 June 2019. In 2018–19, there were issues with asset valuations at TfNSW, RMS, Sydney Metro and Rail Corporation New South Wales (RailCorp), resulting in adjustments after the submission of financial statements for audit and the correction of a prior period error.

There was also a prior period error resulting from an agreement between TfNSW and the former UrbanGrowth Development Corporation due to a lack of assessment of the financial reporting implications at the time of signing the agreement.

Recommendation: Agency finance teams need to be consulted on major business decisions and commercial transactions to assess their accounting impacts at the time of their execution, rather than at the end of a financial year. Agencies also need to resolve all key accounting issues such as valuations as part of the early close procedures.

This would improve the quality of financial reporting and avoid the need for extensions for agencies to submit their financial statements for audit.

Preparedness for new
accounting standards
Agencies across the cluster are progressing in their implementation of the new accounting standards.

Transport cluster agencies need to improve their contracts registers to ensure they have a complete list of contracts and agreements to assess the impact of the new accounting standards.
Valuation of assets remains
a challenge in the
Transport cluster

Whilst agencies complied with the requirements of the accounting standards and NSW Treasury policies on valuations, the Audit Office identified some deficiencies in relation to asset valuations across the cluster.

TfNSW reported a retrospective correction of a prior period error at 1 July 2017 which resulted in a reduction in the valuation of its Country Rail Network earthworks by $2.1 billion. This was due to survey results which identified the earthworks were flatter and lower than estimated in the valuation at 30 June 2017.

RMS made several adjustments during the year to correct asset values due to changes to valuation assumptions or data improvements. This included:

  • reduction of $318 million in the value of land under roads
  • decrease of $84.9 million to the value of land and buildings
  • changes to the value of traffic control and traffic signal network assets, due to data improvements.

Sydney Metro North West officially opened in May 2019 and reported total assets of $9.1 billion. Sydney Metro derecognised $322 million in assets constructed to facilitate its operation but transferred to councils and utilities.

Inconsistent accounting
policies across the
Transport cluster

There was an inconsistency identified in the cluster relating to the valuation of substratum land. In 2018–19, RailCorp derecognised $109 million of substratum land to ensure consistency in its approach with other Transport agencies.

As the parent entity, the Department of Transport needs to ensure accounting policies are consistently applied across all controlled entities for consolidation purposes. Inconsistencies in the application of accounting standards across agencies will impact comparability of financial reporting and decision making across the Transport cluster.

Recommendation: The Department of Transport should ensure consistent accounting policies are applied across its controlled entities.

Revenue growth

Public transport passenger revenue increased by $89.0 million (5.9 per cent) in 2018–19, and patronage increased by 37.8 million (4.9 per cent) across all modes of transport based on data provided by TfNSW.

The increase in revenue is mainly due to an increase in patronage as well as the annual increase in fares.

Negative Opal cards

Negative balance Opal cards resulted in $2.9 million in revenue not collected in 2018–19 ($10.4 million since the introduction of Opal).

In January 2019, Transport made a change to the Sydney Airport stations to prevent customers with high negative balances exiting the station. In addition, in late 2018, Transport increased the minimum top up values for new cards at the airport stations.

Recommendation (repeat): TfNSW should implement further measures to prevent the loss of revenue from passengers tapping off with negative balance Opal cards.

3. Audit observations
Internal controls There was an increase in findings on internal controls across the Transport cluster. Key themes relate to information technology, employee leave entitlements and asset management.

Twenty-nine per cent of all issues were repeat issues. The majority of the repeat issues related to information technology controls.
Write-off of assets In addition to a $322 million derecognition of assets transferred to councils and utilities by Sydney Metro and a $109 million derecognition of substratum land at RailCorp, the Transport cluster wrote-off $278 million of assets related to roads, bridges, maritime assets, traffic signals and controls network.

These mainly related to roads, bridges, maritime assets, traffic signals and the control network where new infrastructure assets substantially replaced an existing asset as part of construction activities.
Transport Asset Holding
Entity (TAHE)
TAHE was established to be a dedicated asset manager for the delivery of public transport asset management. The Transport Administration Amendment (Transport Entities) Act 2017 will transition RailCorp into TAHE. RailCorp is now expected to transition to TAHE from 1 July 2020 (previously 1 July 2019). Several working groups have been considering various aspects of the TAHE transition including its status as a for profit Public Trading Enterprise, the operating model and the impact of the new accounting standards AASB 16 'Leases' and AASB 1059 'Service Concession Arrangements: Grantors'. The considerations of these aspects identified several challenges in the implementation of TAHE which has led to the revised transition date. Given the delays in implementation, it is important to clarify the intent of the TAHE model.
Excess annual leave

Twenty-six per cent of Transport employees have annual leave balances exceeding 30 days. Of the employees with excess leave balances, 732 (10.3 per cent) did not take any annual leave in 2018–19.

Recommendation (repeat): Transport entities should further review the approach to managing excess annual leave in 2019–20. They should:

  • monitor current and projected leave balances to the end of the financial year each month
  • agree formal leave plans with employees to reduce leave balances over an acceptable timeframe
  • ensure leave plans are actioned appropriately
  • encourage all staff with excess leave balances take a minimum two-week period of leave per year.
Completeness and
accuracy of contracts
registers

There are no centralised processes to record all significant contracts and agreements in a register across the Transport cluster.

Across the Transport cluster, contracts and agreements are maintained by the individual agencies using disparate registers. Agencies must perform detailed assessments of their existing contracts and agreements to quantify the impact of the new accounting standards (AASB 16 ‘Leases’, AASB 15 ‘Revenue from Contracts with Customers’, AASB 1058 ‘Income of Not-for-Profit Entities’ and AASB 1059 'Service Concession Arrangements: Grantors').

In 2018–19, there was also a prior period error resulting from an agreement between TfNSW and another government agency due to a lack of assessment of the financial reporting implications at the time of signing the agreement.

A lack of a complete register of all contracts and agreements increases the risk that agencies may not be able to assess the full impact of the new accounting standards, as well as perform a complete assessment of the financial reporting implications of contracts and agreements.

Recommendation: Transport agencies should implement a process to centrally capture all significant contracts and agreements entered. This will ensure:

  • agencies are fully aware of contractual and other obligations
  • appropriate assessment of financial reporting implications
  • assessment of new accounting standards, in particular AASB 16 ‘Leases’, AASB 15 'Revenue from Contract with Customers', AASB 1058 'Income of Not-for-Profit Entities ' and AASB 1059 'Service Concession Arrangements: Grantors' are accurate and complete.

 

This report provides parliament and other users of the Transport cluster’s financial statements with the results of our audits, our observations, analysis, conclusions and recommendations in the following areas:

  • financial reporting
  • audit observations.

This cluster was impacted by the Machinery of Government changes on 1 July 2019. The NSW Government announced its intention to integrate Roads and Maritime Services (RMS) into Transport for NSW (TfNSW). This report is focused on the Transport cluster prior to these changes. Please refer to the section on Machinery of Government changes for more details.

Machinery of Government refers to how the government organises the structures and functions of the public service. Machinery of Government changes are where the government reorganises these structures and functions, and are given effect by Administrative orders.

The Transport cluster was impacted by recent Machinery of Government changes. These changes were announced by the Department of Premier and Cabinet but were not included in the Administrative Orders as the Transport Administration Act 1988 No. 109 governs the composition of the Transport cluster. It was the intention of government to transfer the functions of the RMS into TfNSW. This requires legislative changes to the Transport Administration Act 1988 No. 109.

Section highlights

Under the Machinery of Government changes, the NSW Government will transfer the functions of RMS into TfNSW.

  • The Transport Administration Amendment (RMS Dissolution) Act 2019 (the Act) received assent on 22 November 2019.
  • The Act will dissolve RMS and transfer its functions, assets, rights and liabilities to TfNSW.
  • As at the date of this report, the Act is not yet in force.
  • There are risks and challenges for asset and liability transfers, governance and retention of knowledge.
  • As of 1 July 2019, administrative arrangements (delegations and reporting line changes) were put in place to enable TfNSW and RMS to operate within a single management structure, while still remaining as separate legal entities.
  • Transport is working on a number of options as to how to implement the changes. 

Financial reporting is an important element of good governance. Confidence and transparency in public sector decision making are enhanced when financial reporting is accurate and timely.

This chapter outlines our audit observations related to the financial reporting of agencies in the Transport cluster for 2019.

Section highlights

  • Unqualified audit opinions were issued on all agencies' financial statements.
  • RMS required an extension from NSW Treasury for their early close procedures.
  • TfNSW and Sydney Metro required extensions to submit their year-end financial statements.
  • Valuation of assets remains a challenge across the cluster.
  • There remains Opal cards with negative balances.
  • Sydney Metro derecognised assets of $322 million in relation to assets constructed for third parties.
  • Inconsistencies in the application of accounting policies across cluster agencies impact comparability of financial reporting across the Transport cluster.

Appropriate financial controls help ensure the efficient and effective use of resources and administration of agency policies. They are essential for quality and timely decision making.

This chapter outlines our observations and insights from our financial statement audits of agencies in the Transport cluster.

Section highlights

  • There was an increase in findings on internal controls across the Transport cluster. Twenty-nine per cent of all issues were repeat issues.
  • Transport entities wrote-off over $278 million of assets which were replaced by new assets or technology.
  • Twenty-six per cent of Transport employees have excess annual leave.
  • There are no processes to ensure all significant contracts and agreements are captured by agencies in a centralised register.

Appendix one – Timeliness of financial reporting by agency 

Appendix two – Management letter findings by agency 

Appendix three – List of 2019 recommendations 

Appendix four – Status of 2017 and 2018 recommendations 

Appendix five – Cluster agencies 

 

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Published

Actions for Health 2019

Health 2019

Health
Asset valuation
Compliance
Financial reporting
Fraud
Information technology
Internal controls and governance
Management and administration
Procurement
Project management

This report focuses on key observations and findings from the most recent financial audits of the Ministry of Health, local health districts, specialty health networks, health corporations and independent health agencies in New South Wales. The report also summarises self-reported performance measures across the network.

The number and value of adjustments to financial statements of entities in the Health Cluster decreased from the prior year. And unqualified audit opinions were issued for all heath entities’ financial statements.

Audit findings relating to internal controls deficiencies increased across health entities. Contributing to this increase were deficiencies in information system controls, which accounted for nearly a quarter of all control deficiencies. Repeat audit findings also accounted for more than a quarter of all control deficiencies.

The report notes health entities continued to experience challenges with managing employees’ excessive annual leave and time recording practices. The Ambulance Service of New South Wales continued to report high overtime payments to its employees. 

Download Health 2019 report (PDF).

This report analyses the results of our audits of financial statements of the agencies comprising the Health cluster for the year ended 30 June 2019. The table below summarises our key observations.

1. Machinery of Government changes

Cluster changes Machinery of Government (MoG) changes refer to how the government reorganises agency structures and functions and realigns ministerial responsibilities. The Health cluster was not impacted by the MoG changes.

2. Financial reporting

Financial reporting

The financial statements of NSW Health and its controlled entities received unqualified audit opinions before the legislative deadline.

The number of corrected and uncorrected misstatements decreased from the prior year.

Management implemented more robust processes for its oversight of complex asset revaluations in 2018–19. We found no significant errors in 2018–19.

Financial performance Overall, NSW Health recorded an operating surplus of $1.1 billion in 2018–19, an increase of $699 million from 2017–18. This was the result of additional funding received for capital expenditure on the construction of new facilities, upgrades and redevelopments.

Budgeted expense for the 15 local health districts and two speciality networks increased from $18.3 billion to $19.4 billion in 2018–19. The 15 health entities recorded unfavourable variances between actual and budgeted expenses.
Excess annual leave

Managing excess annual leave remains a challenge for NSW Health, 36.9 per cent of the workforce have excess annual leave balances.

Recommendation: Health entities should further review their approach to managing excess annual leave in 2019–20, and:

  • monitor current and projected leave balances to the end of the financial year on a monthly basis
  • agree formal leave plans with employees to reduce leave balances over an acceptable timeframe
  • encourage staff who perform key control functions to take at least two consecutive weeks’ leave a year to mitigate fraud risks.
Overtime payments NSW Health entities generally manage overtime well. The Ambulance Service of NSW’s overtime payments of $83.1 million (9.8 per cent of total salaries and wages), remain significantly higher than other health entities.

Recommendation: The Ambulance Service of NSW should further review the effectiveness of its rostering practices to identify strategies to reduce overtime payments.

3. Audit observations

Internal control deficiencies We identified more internal control deficiencies in 2018–19. The number of repeat issues from prior years also remains high with more than one quarter of issues having been previously reported. More than a quarter of deficiencies related to information system controls.
Infrastructure delivery NSW Health defines projects with a budgeted cost greater than $50.0 million as 'major projects'. There were significant revisions to planned financial completion dates and budgeted costs of these projects. The revised total budgets for the 30 ongoing major capital projects at 30 June 2019 is $10.2 billion, $2.2 billion more than the original budget.
Health Infrastructure completed three major capital projects during 2018–19.
Asset maintenance The total cost of maintaining the health entities’ $19.8 billion of assets was $635 million for 2018–19. Health entities' approaches to setting maintenance budgets vary. Most entities are addressing their backlog maintenance, although many were not able to quantify the full extent of their backlog maintenance. Although health entities continue to use fully depreciated assets, the replacement cost of these assets is decreasing.

 

 

This report provides parliament and other users of the financial statements of agencies within the Health cluster with the results of our audits, our observations, analysis, conclusions and recommendations in the following areas for the year ended 30 June 2019:

  • financial reporting
  • audit observations. 

 The Health cluster was not impacted by the Machinery of Government changes on 1 July 2019. 

Financial reporting is an important element of good governance. Confidence and transparency in public sector decision making are enhanced when financial reporting is accurate and timely.

This chapter outlines our audit observations related to the financial reporting of agencies in the health cluster for 2019.

Section highlights

  • We issued unqualified audit opinions for all health entities’ financial statements and identified fewer misstatement than last year. Health entities continue to meet statutory deadlines.
  • The Ministry of Health sets significant accounting policies centrally and provides a template for the preparation of health entities’ financial statements. These processes promote consistent quality in the financial reports of health entities and reduce the number of misstatements we identify.
  • NSW Health recorded an operating surplus of $1.1 billion, an increase of $699 million from 2017–18. This is because of additional capital grants for new facilities, upgrades and redevelopments. The capital replacement ratio (investment in new assets divided by depreciation) for NSW Health is 2.6.
  • NSW Health’s expenses increased by 7.0 per cent in 2018–19 (5.5 per cent in 2017–18). This is one percentage point higher than the projected long-term annual expense growth rate of six per cent. The primary causes for the growth in expenses are increased:
    • employee related expenses because provisions for employee benefits increased when the discount rate decreased
    • operating expenses associated with the opening of Northern Beaches Hospital.
  • Excess annual leave balances continue to increase for the NSW Health workforce, with excess annual leave balances impacting 37 per cent of employees (34 per cent in 2017–18).
  • Health entities should further review their approach to managing excess annual leave in 2019–20 by monitoring current and projected leave balances on a regular basis, agreeing formal leave plans with employees and encouraging staff that perform key control functions to take a minimum of two consecutive weeks’ leave a year as a fraud mitigation strategy.
  • The Ambulance Services continued to report overtime payments higher than other health entities. The Ambulance Service paid its employees $83.1 million in overtime payments in 2018–19 ($74.8 million in 2017–18).
  • We issued a qualified audit opinion for the Ministry of Health's Annual Prudential Compliance Statement for aged care facilities operated by NSW Health. We identified 40 instances of material non-compliance with the Fees and Payments Principles 2014 (No. 2) (the Principles) in 2018–19 (17 in 2017–18).

Audit opinions 

We issued unqualified audit opinions for all health entities and quality of financial reporting continues to improve

We identified fewer misstatements this year, and the errors were less significant. In 2018–19 no errors exceeded $5.0 million (eight errors recorded in 2017–18). Ten health entities conducted a full revaluation of their land, buildings and infrastructure systems in 2018–19, but more robust processes avoided the errors identified in the previous year.

Number of misstatements
Year ended 30 June 2019 2018 2017
  green circle with white tick red circle with white exclamation mark green circle with white tick red circle with white exclamation mark green circle with white tick red circle with white exclamation mark
Less than $50,000 -- -- -- 6 3 3
$50,000 to $249,999 -- 1 -- -- 2 3
$250,000 to $999,999 1 -- -- -- 1 3
$1 million to $4,999,999 -- 2 -- 2 1 5
$5 million and greater -- -- 6 2 1 2
Total number of misstatements 1 3 6 10 8 16

green circle white tick Corrected mistatements. red circle white exclamation mark Uncorrected statements.
Source: Statutory Audit Reports issued by the Audit Office.

We issued a qualified audit opinion for our compliance audit of the Ministry of Health's Annual Prudential Compliance Statement

The Ministry of Health operates eight aged care facilities in NSW and is required to comply with the Fees and Payments Principles 2014 (No. 2) (the Principles) when entering into agreements with and managing payments to and from care recipients. The Principles are set by the Commonwealth Assistant Minister for Social Services. We identified 40 instances of material non-compliance in 2018–19, including:

  • not agreeing maximum accommodation amounts payable with aged care recipients before they entered the residential care services
  • not entering into accommodation agreements with care recipients within the specified period
  • charging incorrect fees for activities or services to one care recipient
  • not refunding two bond balances within the statutory framework
  • not paying the correct amount of interest for 14 care recipients’ bonds refunded during the year.

Appropriate financial controls help ensure the efficient and effective use of resources and administration of agency policies. They are essential for quality and timely decision making.

This chapter outlines our observations and insights from our financial statement audits of agencies in the health cluster.

Section highlights

  • The number of internal control deficiencies has increased since 2017–18. More than a quarter of control deficiencies are repeat issues and almost a quarter relate to information system controls. Both employee time recording and leave management remain as repeat issues in 2018–19.
  • Control deficiencies that relate to managing employees' leave, employees’ time recording or information system limitations can be difficult for entities to resolve in a timely manner.
  • Agreements for the treatment of New South Wales residents while they are interstate, and interstate residents while they are in New South Wales, are unsigned for Queensland, Victoria and the Australian Capital Territory for 2016–17, 2017–18 and 2018–19.
  • NSW Health recorded $113.6 million in revenue from fees charged to Medicare ineligible patients during 2018–19 but has received payment for less than half of this.
  • NSW Health reported that they completed three major capital projects during 2018–19.
  • As at 30 June 2019 there were 30 ongoing major capital health projects in NSW. The revised capital budget for these projects in total was $2.2 billion more than the original budget of $8.0 billion.
  • Health entities spent $635 million maintaining assets with a fair value of $19.8 billion of assets. Almost all entities were working through backlog maintenance during 2018–19, although several were unable to quantify the backlog.
  • While entities are now regularly reassessing the useful lives of their assets, entities are still using a high volume of assets that are fully depreciated. Due to the age and nature of these assets the impact was not material.

Appendix one – List of 2019 recommendations

Appendix two – Status of 2018 recommendations

Appendix three – Financial data 

Appendix four – Analysis of financial indicators

Appendix five – Analysis of performance against budget

 

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Published

Actions for Internal Controls and Governance 2019

Internal Controls and Governance 2019

Education
Community Services
Finance
Health
Industry
Justice
Planning
Premier and Cabinet
Transport
Treasury
Whole of Government
Compliance
Cyber security
Fraud
Information technology
Internal controls and governance
Management and administration
Procurement
Project management

This report covers the findings and recommendations from the 2018–19 financial audits that relate to internal controls and governance at 40 of the largest agencies in the NSW public sector. The 40 agencies selected for this report constitute around 84 per cent of total expenditure for all NSW public sector agencies.

The report provides insights into the effectiveness of controls and governance processes across the NSW public sector. It evaluates how agencies identify, mitigate and manage risks related to:

  • financial controls
  • information technology controls
  • gifts and benefits
  • internal audit
  • contingent labour
  • sensitive data.

The Auditor-General recommended that agencies do more to prioritise and address vulnerabilities in their internal controls and governance. The Auditor-General also recommended agencies increase the transparency of their management of gifts and benefits by publishing their registers on their websites.

This report analyses the internal controls and governance of 40 of the largest agencies in the NSW public sector for the year ended 30 June 2019.

1. Internal control trends

New, repeat and high risk findings

There was an increase in internal control deficiencies of 12 per cent compared to last year. The increase is predominately due to a 100 per cent increase in repeat financial and IT control deficiencies.

Some agencies attributed the delay in actioning repeat findings to the diversion of staff from their regular activities to implement and operationalise the recent Machinery of Government changes. As a result, actions to address audit recommendations have been deferred or re prioritised, as the changes are implemented.

Agencies need to ensure they are actively managing the risks associated with having these vulnerabilities in internal control systems unaddressed for extended periods of time.

Common findings

A number of findings were common to multiple agencies. These findings often related to areas that are fundamental to good internal control environments and effective organisational governance, such as:

  • out of date policies or an absence of policies to guide appropriate decisions
  • poor record keeping and document retention
  • incomplete or inaccurate centralised registers or gaps in these registers
  • policies, procedures or controls no longer suited to the current organisational structure or business activities.

2. Information technology controls

IT general controls

We examined information security controls over key financial systems that support the preparation of agency financial statements. We found:

  • user access administration deficiencies at 58 per cent of agencies related to granting, review and removal of user access
  • an absence of privileged user activity reviews at 35 per cent of agencies
  • password controls that did not align to password policies at 20 per cent of agencies.

We also found 20 per cent of agencies had deficient IT program change controls, mainly related to segregation of duties in approval and authorisation processes, and user acceptance testing of program changes prior to deployment into production environments. User acceptance testing helps identify potential issues with software incompatibility, operational workflows, absent controls and software issues, as well as areas where training or user support may be required.

3. Gifts and benefits

Gifts and benefits registers

All agencies had a gifts and benefits policy and 90 per cent of agencies maintain a gifts and benefits register. However, 51 per cent of the gifts and benefits registers we examined contained incomplete declarations, such as missing details for the approving officer, value of the gift and/or benefit offered and reasons supporting the decision.

In some cases, gaps in recorded information meant the basis for decisions around gifts and benefits was not always clear, making it difficult to determine whether decisions in those instances were appropriate, compliant with policy and were not direct or indirect inducements to the recipients to favour suppliers or service providers.

Agencies should ensure their gifts and benefits register includes all key fields specified in the Public Service Commission's minimum standards for gifts and benefits. Agencies should also perform regular reviews of the register to ensure completeness and ensure any gift or benefit accepted by a staff member meets the public's expectations for ethical behaviour.

Managing gifts and benefits

We found opportunities to improve gifts and benefits processes and enhance transparency. For example, only three per cent of agencies publish their gifts and benefits registers on their websites.

Agencies can improve management of gifts and benefits by:

  • ensuring agency policies comprehensively cover the elements necessary to make it effective in an operational environment, such as identifying risks specific to the agency and actions that will be taken in the event of a policy breach
  • establishing and publishing a statement of business ethics on the agency's website to clearly communicate expected behaviours to clients, customers, suppliers and contractors
  • providing on-going training, awareness activities and support to employees, not just at induction
  • publishing their gifts and benefits registers on their websites to demonstrate a commitment to a transparently ethical environment.
Reporting and monitoring

Only 35 per cent of agencies reported trends in the number and nature of gifts and benefits recorded in their registers to the agency's senior executive management and/or a governance committee.

Agencies should regularly report to the agency executive or other governance committee on trends in the offer and acceptance of gifts and benefits.

4. Internal audit

Obtaining value from the internal audit function

Agencies have established and maintained internal audit functions to provide assurance on the effectiveness of agency controls and governance systems. However, we identified areas where agencies' internal audit functions could improve their processes to add greater value. For example, only 73 per cent of CAEs regularly attend meetings of the agency board or executive management committee.

Internal audit functions can add greater value by involving the CAE more extensively in executive forums as an observer.

Internal audit functions should also consider producing an annual report on internal audit. An annual report allows the internal audit function to report on their performance and add value by drawing to the attention of audit and risk committees and senior management strategic issues, thematic trends and emerging risks.

Role of the Chief Audit Executive

Forty-five per cent of agencies assigned responsibilities to the Chief Audit Executive (CAE) that were broader than internal audit, but 17 per cent of these had not documented safeguards to protect the independence of the CAE.

The reporting lines and status of the CAE at some agencies also needs review. At two agencies, the CAE reported to the CFO.

Agencies should ensure:

  • the reporting lines for the CAE comply with the NSW Treasury policy, and the CAE does not report functionally or administratively to the finance function or other significant recipients of internal audit services
  • the CAE's duties are compatible with preserving their independence and where threats to independence exist, safeguards are documented and approved.
Quality assurance and improvement program

Thirty-five per cent of agencies did not have a documented quality assurance and improvement program for its internal audit function.

The policy and the International Standards for the Professional Practice of Internal Auditing require agencies to have a documented quality assurance and improvement program. The results of this program should be reported annually.

Agencies should ensure there is a documented and operational Quality Assurance and Improvement Program for the internal audit function that covers both internal and external assessments.

5. Managing contingent labour

Obtaining value for money from contingent labour

According to NSW Procurement data, spend on contingent labour has increased by 75 per cent over the last five years, to $1.5 billion in 2018–19. Improvements in internal processes and a renewed focus on agency monitoring and oversight of contingent labour can help ensure agencies get the best value for money from their contingent workforces.

Agencies can improve their management of contingent labour by:

  • preparing workforce plans to inform their resourcing strategy and ensure that engaging contingent labour aligns with the strategy and best meets business needs
  • involving agency human resources units in decisions about engaging contingent labour
  • regularly reporting on contingent labour use and tenure to agency executive teams
  • strengthening on-boarding and off-boarding processes.

We also found 57 per cent of the 23 agencies we examined with contingent labour spend of more than $5 million in 2018–19 have implemented the government's vendor management system and service provider 'Contractor Central'.

6. Managing sensitive data

Identifying and assessing sensitive data

Sixty-eight per cent of agencies maintain an inventory of their sensitive data and where it resides. However, these inventories are not always complete and risks may be overlooked.

Agencies can improve processes to manage sensitive data by:

  • identifying and maintaining an inventory of sensitive data through a comprehensive and structured process
  • assessing the criticality and sensitivity of the data so that protection of high risk data can be prioritised.
Managing data breaches

Eighty-eight per cent of agencies have established policies to respond to potential data breaches when they are identified and 70 per cent of agencies maintain a register to record key information in relation to identified data breach incidents.

Agencies should maintain a data breach register to effectively manage the actions undertaken to contain, evaluate and remediate each data breach.

 

This report covers the findings and recommendations from our 2018–19 financial audits that relate to internal controls and governance at 40 of the largest agencies (refer to Appendix three) in the NSW public sector. The 40 agencies selected for this volume constitute around 84 per cent of total expenditure for all NSW public sector agencies.

Although the report includes several agencies that have changed as a result of the Machinery of Government changes that were effective from 1 July 2019, its focus on sector wide issues and insights means that its findings remain relevant to NSW public sector agencies, including newly formed agencies that have assumed the functions of abolished agencies.

This report offers insights into internal controls and governance in the NSW public sector

This is the third report dedicated to internal controls and governance at NSW State Government agencies. The report provides insights into the effectiveness of controls and governance processes in the NSW public sector by:

  • highlighting the potential risks posed by weaknesses in controls and governance processes
  • helping agencies benchmark the adequacy of their processes against their peers
  • focusing on new and emerging risks, and the internal controls and governance processes that might address those risks.

Without strong governance systems and internal controls, agencies increase the risks associated with effectively managing their finances and delivering services to citizens. For example, if they do not have strong information technology controls, sensitive information may be at risk of unauthorised access and misuse.

Areas of specific focus of the report have changed since last year

Last year's report topics included transparency and performance reporting, management of purchasing cards and taxi use, and fraud and corruption control. We are reporting on new topics this year and re-visiting agency management of gifts and benefits, which we first covered in our 2017 report. Re-visiting topics from prior years provides a baseline to show the NSW public sectors’ progress implementing appropriate internal controls and governance processes to mitigate existing, new and emerging risks in the public sector.

Our audits do not review all aspects of internal controls and governance every year. We select a range of measures and report on those that present heightened risks for agencies to mitigate. This year the report focusses on:

  • internal control trends
  • information technology controls, including access to agency systems
  • protecting sensitive information held within agencies
  • managing large and diverse workforces (controls around employing and managing contingent workers)
  • maintaining an ethical culture (management of gifts and benefits)
  • effectiveness of internal audit function and its oversight by Audit and Risk Committees.

The findings in this report should not be used to draw conclusions on the effectiveness of individual agency control environments and governance arrangements. Specific financial reporting, internal controls and audit observations are included in the individual 2019 cluster financial audit reports, which will be tabled in parliament from November to December 2019.

Internal controls are processes, policies and procedures that help agencies to:

  • operate effectively and efficiently
  • produce reliable financial reports
  • comply with laws and regulations
  • support ethical government.

This chapter outlines the overall trends for agency controls and governance issues, including the number of audit findings, the degree of risk those deficiencies pose to the agency, and a summary of the most common deficiencies we found across agencies. The rest of this report presents this year’s controls and governance findings in more detail.

Key conclusions and sector wide learnings

We identified four high risk findings, compared to six last year. None of the findings are common with those in the previous year. There was an overall increase of 12 per cent in the number of internal control deficiencies compared to last year. The increase is predominately due to a 100 per cent increase in the number of repeat financial and IT control deficiencies.
 
Some agencies attributed the delay in actioning repeat findings to the diversion of staff from their regular activities to implement and operationalise the recent Machinery of Government changes. As a result, actions to address audit recommendations have been deferred or re-prioritised, as the changes are implemented. Agencies need to ensure they are actively managing the risks associated with having these vulnerabilities in internal control systems unaddressed for extended periods of time.
 
We also identified a number of findings that were common to multiple agencies. These common findings often related to areas that are fundamental to good internal control environments and effective organisational governance. Examples include:
  • out of date policies or an absence of policies to guide appropriate decisions
  • poor record keeping and document retention
  • incomplete or inaccurate centralised registers or gaps in these registers.

Policies, procedures and internal controls should be properly designed, be appropriate for the current organisational structure and its business activities, and work effectively.

This chapter outlines our audit observations, conclusions and recommendations, arising from our review of agency controls to manage key financial systems.

Key conclusions and sector wide learnings
Government agencies’ financial reporting is heavily reliant on information technology (IT). We continue to see a high number of deficiencies related to IT general controls, particularly those related to user access administration. These controls are key in adequately protecting IT systems from inappropriate access and misuse.
IT is also important to the delivery of agency services. These systems often provide the data to help monitor the efficiency and effectiveness of agency processes and services they deliver. Our financial audits do not review all agency IT systems. For example, IT systems used to support agency service delivery are generally outside the scope of our financial audit. However, agencies should also consider the relevance of our findings to these systems.
Agencies need to continue to focus on assessing the risks of inappropriate access and misuse and the implementation of controls to adequately protect their systems, focussing on the processes in place to grant, remove and monitor user access, particularly privileged user access.

This chapter outlines our audit observations, conclusions and recommendations, arising from our review of agency controls to manage gifts and benefits. 

Key conclusions and sector wide learnings

We found most agencies have implemented the Public Service Commission's minimum standards for gifts and benefits. All agencies had a gifts and benefits policy and 90 per cent of agencies maintained a gifts and benefits register and provided some form of training to employees on the treatment of gifts and benefits.

Based on our analysis of agency registers, we found some areas where opportunities existed to make processes more effective. In some cases, gaps in recorded information meant the basis for decisions around gifts and benefits was not always clear, making it difficult to determine whether decisions in those instances were appropriate and compliant with policy. Fifty-one per cent of the gifts and benefits registers reviewed contained declarations where not all fields of information had been completed. Seventy-seven per cent of agencies that maintained a gifts and benefits register did not include all key fields suggested by the minimum standards.

Areas where agencies can improve their management of gifts and benefits include:

  • ensuring agency policies comprehensively cover the elements necessary to make it effective in an operational environment, such as identifying risks specific to the agency and actions that will be taken in the event of a policy breach
  • establishing and publishing a statement of business ethics on the agency's website to clearly communicate expected behaviours to clients, customers,suppliers and contractors
  • updating gifts and benefits registers to include all key fields suggested by the minimum standards, as well as performing regular reviews of the register to ensure completeness
  • providing on-going training, awareness activities and support to employees, not just at induction
  • regularly reporting gifts and benefits to executive management and/or a governance committee such as the audit and risk committee, focussing on trends in the number and types of gifts and benefits offered to and accepted by agency staff
  • publishing their gifts and benefits registers on their websites to demonstrate a commitment to a transparently ethical environment.

This chapter outlines our audit observations, conclusions and recommendations, arising from our review of agency internal audit functions.

Key conclusions and sector wide learnings 

We found agencies have established and maintained internal audit functions to provide assurance on the effectiveness of agency controls and governance systems as required by TPP15-03 'Internal Audit and Risk Management Policy for the NSW Public Sector'. However, we identified areas where agencies' internal audit functions could improve their processes to add greater value, including: 

  • documenting and implementing safeguards to address conflicting roles performed by the Chief Audit Executive (CAE)
  • ensuring the reporting lines for the CAE comply with the NSW Treasury policy, and the CAE reports neither functionally or administratively to the finance function or other significant recipients of internal audit services
  • involving the CAE more extensively in executive forums as an observer
  • documenting a Quality Assurance and Improvement Program for the internal audit function and performing both internal and external performance assessments to identify opportunities for continuous improvement
  • reporting against key performance indicators or a balanced scorecard and producing an annual report on internal audit to bring to the attention of the audit and risk committee and senior management strategic issues, thematic trends and emerging risks that may require further attention or resources.

This chapter outlines our audit observations, conclusions and recommendations, arising from our review of agency controls to on-board, manage and off-board contingent labour.

Key conclusions and sector wide learnings

Agencies have implemented controls to manage contingent labour and most agencies have some level of reporting and oversight of contingent labour at an executive level. However, the increasing trend in spend on contingent labour warrants a renewed focus on agency monitoring and oversight of their use of contingent labour. Over the last five years spend on contingent labour has increased by 75 per cent, to $1.5 billion in 2018–19.

There are also some key gaps that limit the ability of agencies to effectively manage contingent labour. Key areas where agencies can improve their management of contingent labour include: 

  • preparing workforce plans to inform their resourcing strategy, and confirm prior to engaging contingent labour, that this solution aligns with the strategy and best meets business needs
  • involving agency human resources units in decisions about engaging contingent labour
  • regularly reporting on contingent labour use to agency executive teams, particularly in terms of trends in agency spend, tenure and compliance with policies and procedures
  • strengthening on-boarding and off-boarding processes, including establishing checklists to on-board and off-board contingent labour, making provisions for knowledge transfer, and assessing, documenting and capturing performance information.

This chapter outlines our audit observations, conclusions and recommendations, arising from our review of governance and processes in relation to the management of sensitive data.

Key conclusions and sector wide learnings

Information technology risks are rapidly increasing. More interfaces between agencies and greater connectivity means the amounts of data agencies generate, access, store and share continue to increase. Some of this information is sensitive information, which is protected by the Privacy Act 1988.

It is important that agencies understand what sensitive data they hold, the risks associated with the inadvertent release of this information and how they are mitigating those risks. We found that agencies need to continue to identify and record their sensitive data, as well as expand the methods they use to identify sensitive data. This includes data held in unstructured repositories, such as network shared drives and by agency service providers.

Eighty-eight per cent of agencies have established policies to respond to potential data breaches when they are identified and 70 per cent of agencies maintain a register to record key information in relation to identified data breach incidents.

Key areas where agencies can improve their management of sensitive data include:

  • identifying sensitive data, based on a comprehensive and structured process and maintaining an inventory of the data
  • assessing the criticality and sensitivity of the data so that the protection of high risk data can be prioritised
  • developing comprehensive data breach management policies to ensure data breaches are appropriately managed
  • maintaining a data breach incident register to record key information in relation to identified data breaches incidents, including the estimated cost of the breach
  • providing on-going training and awareness activities to employees in relation to sensitive data and managing data breaches.

Appendix one – List of 2019 recommendations 

Appendix two – Status of 2018 recommendations

Appendix three – In-scope agencies

 

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Published

Actions for Central Agencies 2018

Central Agencies 2018

Treasury
Premier and Cabinet
Finance
Financial reporting
Internal controls and governance
Management and administration
Risk

The Auditor-General for New South Wales, Margaret Crawford, released her report today on the results of the financial audits of NSW Government central agencies. The report focuses on key observations and findings from the most recent financial statement audits of agencies in the Treasury, Premier and Cabinet, and Finance, Services and Innovation clusters. While clear audit opinions were issued on all agency financial statements, the report notes that some complex accounting requirements caused significant errors in agency financial statements submitted for audit, which were corrected before the financial statements were approved. 

This report analyses the results of our audits of the Treasury, Premier and Cabinet and Finance, Services and Innovation cluster agencies for the year ended 30 June 2018. The table below summarises our key observations.

This report provides parliament and other users of the NSW Government's central agencies and their cluster agencies financial statements with the results of our audits, our observations, analysis, conclusions and recommendations in the following areas:

  • financial reporting
  • audit observations
  • liquidity risk management
  • government financial services.

The central agencies and their key responsibilities are set out below.

Central agencies Key central agency responsibilities Cluster responsibilities
The Treasury
  • Financial and economic advisor to NSW Government
  • Manages the NSW Government’s financial resources.

The cluster:

  • provides investment and debt management services though TCorp
  • manages residual business arising from privatisation of government businesses
  • provides insurance and compensation cover, including workers compensation insurance
  • includes NSW Government superannuation funds.
Department of Premier and Cabinet
  • Drives NSW Government’s objectives and sets targets
  • Works with clusters to coordinate policy and achieve NSW Government priorities.

The cluster:

  • includes integrity agencies, such as the Independent Commission Against Corruption, Audit Office of NSW and Ombudsman’s Office
  • other agencies, such as Barangaroo Delivery Authority and Infrastructure NSW.
Department of Finance, Services and Innovation
  • Supports agency service delivery in relation to the key enabling functions of NSW Government, including procurement, property and asset management, ICT and digital innovation.

The cluster:

  • is responsible for state revenue and rental bond administration
  • regulates statutory insurance schemes, workplace safety and consumer protection
  • provides access to a range of NSW Government services via Service NSW
  • manages the NSW Government communications network.
Public Service Commission
  • Works to promote and maintain a strong ethical culture across the government sector and improve the capabilities, performance and configuration of the sector’s workforce to deliver better services to the public.
  • The Public Service Commission is an independent agency within the Premier and Cabinet cluster.

Note: The Audit Office of NSW is an independent agency included in the Premier and Cabinet cluster for administrative purposes, but not commented on in this report.


A full list of agencies that this report covers by relevant cluster is included in Appendix three.

Financial reporting is an important element of good governance. Confidence and transparency in public sector decision making are enhanced when financial reporting is accurate and timely.

This chapter outlines our audit observations related to the financial reporting of agencies in the Treasury, Premier and Cabinet and Finance, Services and Innovation clusters for 2018.

Observation Conclusions and recommendations
2.1 Quality of financial reporting
Unqualified opinions were issued for all agencies' financial statements submitted to the Audit Office.

Complex accounting requirements caused significant errors in some agency financial statements, which were corrected before the financial statements were approved.
Sufficient audit evidence was obtained to conclude the financial statements were free of material misstatement.
Recommendation: Agencies should respond to key accounting issues when they are identified by preparing accounting papers and engaging with Treasury, the Audit Office and their Audit and Risk Committee when these matters are identified.
2.2 Timeliness of financial reporting
Most agencies complied with the statutory timeframe for completion of early close procedures, 48 agencies in the Treasury cluster did not comply with the statutory requirement to prepare financial statements, and the audits of nine agencies in the Treasury cluster were not completed within the statutory timeframe.
All financial statement information of the 48 agencies that did not prepare financial statements has been captured in the consolidated financial statements of their parent entity, which was subject to audit.
Early close procedures allow financial reporting issues and risks to be addressed early in the audit process. The timeliness of financial reporting can be improved by performing more robust early close procedures.

Appropriate financial controls help ensure the efficient and effective use of resources and administration of agency policies. They are essential for quality and timely decision making.

This chapter outlines our observations and insights from:

  • our financial statement audits of agencies in the Treasury, Premier and Cabinet and Finance, Services and Innovation cluster for 2018
  • the areas of focus identified in the Audit Office work program.

The Audit Office work program provides a summary of all audits to be conducted within the proposed time period as well as detailed information on the areas of focus for each of the NSW Government clusters.

Observation Conclusions and recommendations
3.1 Internal controls
The 2017–18 audits found one high risk issue and 83 moderate risk issues across the agencies. Nineteen per cent of all issues were repeat issues. Agencies should focus on rectifying repeat issues.
The high risk issue at Service NSW related to several deficiencies in procurement and contract management processes. Service NSW may not be achieving value-for-money
from their procurement and contract management activities. The high risk issue should be rectified as a matter of priority. This includes updating and implementing its procurement, vendor and contract management frameworks and delivering training to key staff involved in procurement and contract management activities.
Property NSW has implemented several controls during the year to rectify the high risk issue identified last year related to its transition to a new property and facility management service provider. However, the service providers performance remains below expectations and there are further opportunities to improve oversight and lift performance. Property NSW can better define roles and accountabilities with the service provider and formalise policies and processes associated with its monitoring and oversight of the service provider.

Implementing relevant KPIs, receiving timely reports and providing timely review and feedback to the service provider may help to lift performance.
GovConnect received unqualified opinions from their service auditor on all business process controls, except for information technology controls provided by Unisys, where a qualified opinion was received from the service auditor. A qualified opinion was received because of several deficiencies in user access controls. These internal control deficiencies increase the risk of unauthorised access to key business systems, and increase audit effort and costs associated with addressing the risks arising from the deficiencies.
3.2 Audit Office annual work program

Remediation of the Barangaroo site is now estimated to cost the Barangaroo Delivery Authority in excess of net $400 million.
 
The increase in the estimate over the last five years is mainly due to the extent of remediation required, as more evidence of contamination has become known.

Measuring the remaining costs to remediate requires the use of estimation techniques and judgements, making the actual outcome inherently uncertain. We reviewed evidence to support the provision for remediation, including future costs estimates and this evidence supported management’s estimate.
The State Insurance Regulatory Authority have administered the refund of $138 million in Green slip refunds to policy holders through Service NSW during 2017–18. At 30 June 2018, $112 million in refunds are yet to be claimed.
 
We reviewed the systems and processes supporting the refund process. While we found that this supports the disbursement of refunds to policyholders there were some deficiencies in Service NSW’s project controls when the program was being developed.

 
Service NSW should apply the lessons learnt from this program to other programs it is delivering or will be delivering for agencies.
Revenue NSW recorded $30.4 billion from taxes, fines and fees in 2017–18 ($30.0 billion in 2016–17) to support the State’s finances. 
 
Crown revenue has steadily increased over the last five years predominately driven by rises in payroll tax and land tax and responsibility for collection of the Emergency Services Levy transferring to Revenue NSW under the Emergency Services Levy Act 2017 effective from July 2017. 
3.3 Managing maintenance
Place Management NSW manages significant commercial and retail leases and maintains public domain spaces and other assets around the harbour foreshore. It has consistently underspent its asset maintenance budget. In 2017–18, asset maintenance expenses were only 34 per cent of budgeted maintenance expense.

Currently, Place Management NSW does not use any ratios or benchmarks to determine the adequacy of its maintenance spend or to monitor whether it is achieving its budgeted maintenance program. 
This may be contributing to a high proportion of unplanned maintenance, which Place Management NSW reports was 38 per cent of total maintenance expense in 2017–18.

Place Management NSW is outsourcing its property and facilities management function from 1 December 2018 to an external service provider. 
 

This chapter outlines our audit observations, conclusions and recommendations specific to NSW Government agencies providing financial services.

Observation Conclusions and recommendation
5.1 Superannuation funds
The SAS Trustee Corporation (STC) Pooled Fund and the Parliamentary Contributory Superannuation (PCS) Fund are not required to comply with the prudential and reporting standards issued by the Australian Prudential Regulation Authority (APRA). 
However, legislation allows the responsible Minister to prescribe prudential standards, reporting and audit requirements. 
Structured and comprehensive prudential oversight of these Funds is important as they operate in a volatile financial sector, have 103,000 members and manage investments of $43.3 billion.
Recommendation: Treasury should consult with the Trustees of the STC Pooled Fund and PCS Fund to prescribe appropriate prudential standards and requirements, including oversight arrangements.
5.2 Insurance and compensation
Nominal Insurer and NSW Self Insurance Corporation investment performance marginally exceeded benchmark over the past five years. Investment returns can impact on the premiums required to maintain an adequate funding ratio in addition to other factors such as claims experience and discount rates.
The Workers Compensation Nominal Insurer (Nominal Insurer) and NSW Self Insurance Corporation's net collected premiums and contributions decreased over the past five years.  The insurance schemes' investment performance and stable claim payments have enabled less reliance on net collected premiums and contributions as a source of funding, over the past five years. 
Reforms were introduced to manage the Home Warranty Scheme's financial sustainability risks.  The Home Warranty Scheme has not collected sufficient premiums to fund expected claims costs, since commencing operations in 2011. In 2017–18, the Crown contributed $181 million for historical shortfalls. New reforms started on 1 January 2018 enabling the Scheme to price premiums based on risk. 

Published

Actions for Internal Controls and Governance 2018

Internal Controls and Governance 2018

Education
Community Services
Finance
Health
Industry
Justice
Planning
Premier and Cabinet
Transport
Treasury
Whole of Government
Environment
Compliance
Cyber security
Financial reporting
Fraud
Information technology
Internal controls and governance
Management and administration
Procurement
Project management

The Auditor-General for New South Wales Margaret Crawford found that as NSW state government agencies’ digital footprint increases they need to do more to address new and emerging information technology (IT) risks. This is one of the key findings to emerge from the second stand-alone report on internal controls and governance of the 40 largest NSW state government agencies.

This report analyses the internal controls and governance of the 40 largest agencies in the NSW public sector for the year ended 30 June 2018.

This report covers the findings and recommendations from our 2017–18 financial audits that relate to internal controls and governance at the 40 largest agencies (refer to Appendix three) in the NSW public sector.

This report offers insights into internal controls and governance in the NSW public sector

This is our second report dedicated to internal controls and governance at NSW State Government agencies. The report provides insights into the effectiveness of controls and governance processes in the NSW public sector by:

  • highlighting the potential risks posed by weaknesses in controls and governance processes
  • helping agencies benchmark the adequacy of their processes against their peers
  • focusing on new and emerging risks, and the internal controls and governance processes that might address those risks.

Without strong governance systems and internal controls, agencies increase the risks associated with effectively managing their finances and delivering services to citizens. The way agencies deliver services increasingly relies on contracts and partnerships with the private sector. Many of these arrangements deliver front line services, but others provide less visible back office support. For example, an agency may rely on an IT service provider to manage a key system used to provide services to the community. The contract and service level agreements are only truly effective where they are actively managed to reduce risks to continuous quality service delivery, such as interruptions caused by system outages, cyber security attacks and data security breaches.

Our audits do not review all aspects of internal controls and governance every year. We select a range of measures, and report on those that present heightened risks for agencies to mitigate. This report divides these into the following five areas:

  1. Internal control trends
  2. Information technology (IT), including IT vendor management
  3. Transparency and performance reporting
  4. Management of purchasing cards and taxis
  5. Fraud and corruption control.

The findings in this report should not be used to draw conclusions on the effectiveness of individual agency control environments and governance arrangements. Specific financial reporting, controls and service delivery comments are included in the individual 2018 cluster financial audit reports, which will be tabled in Parliament from November to December 2018.

The focus of the report has changed since last year

Last year's report topics included asset management, ethics and conduct, and risk management. We are reporting on new topics this year. We plan to introduce new topics and re-visit our previous topics in subsequent reports on a cyclical basis. This will provide a baseline against which to measure the NSW public sectors’ progress in implementing appropriate internal controls and governance processes to mitigate existing, new and emerging risks in the public sector.

Agencies selected for the volume account for 95 per cent of the state's expenditure

While we have covered only 40 agencies in this report, those selected are a large enough group to identify common issues and insights. They represent about 95 per cent of total expenditure for all NSW public sector agencies.

Internal controls are processes, policies and procedures that help agencies to:

  • operate effectively and efficiently
  • produce reliable financial reports
  • comply with laws and regulations
  • support ethical government.

This chapter outlines the overall trends for agency controls and governance issues, including the number of findings, level of risk and the most common deficiencies we found across agencies. The rest of this volume presents this year’s controls and governance findings in more detail.

Observation Conclusions and recommendations
2.1 High risk findings
We found six high risk findings (seven in 2016–17), one of which was repeated from both last year and 2015–16. Recommendation: Agencies should reduce risk by addressing high risk internal control deficiencies as a priority.
2.2 Common findings
We found several internal controls and governance findings common to multiple agencies. Conclusion: Central agencies or the lead agency in a cluster can play a lead role in helping ensure agency responses to common findings are consistent, timely, efficient and effective.
2.3 New and repeat findings
Although internal control deficiencies decreased over the last four years, this year has seen a 42 per cent increase in internal control deficiencies. The increase in new IT control deficiencies and repeat IT control deficiencies signifies an emerging risk for agencies.
IT control deficiencies feature in this increase, having risen by 63 per cent since last year. The number of repeat IT control deficiencies has doubled and is driven by the increasing digital footprint left by agencies as government prioritises on-line interfaces with citizens, and the number of transactions conducted through digital channels increases

Recommendation: Agencies should reduce IT risks by:

  • assigning ownership of recommendations to address IT control deficiencies, with timeframes and actions plans for implementation
  • ensuring audit and risk committees and agency management regularly monitor the implementation status of recommendations.

 

Government agencies’ financial reporting is now heavily reliant on information technology (IT). IT is also increasingly important to the delivery of agency services. These systems often provide the data to help monitor the efficiency and effectiveness of agency processes and services they deliver. Our audits reviewed whether agencies have effective controls in place to manage both key financial systems and IT service contracts.

Observation Conclusions and recommendations
3.1 Management of IT vendors
Contract management framework 
Although 87 per cent of agencies have a contract management policy to manage IT vendors, one fifth require review.
 

Conclusion: Agencies can more effectively manage IT vendor contracts by developing policies and procedures to ensure vendor management frameworks are kept up to date, plans are in place to manage vendor performance and risk, and compliance with the framework is monitored by:

  • internal audit focusing on key contracting activities
  • experienced officers who are independent of contract administration performing spot checks or peer reviews
  • targeted analysis of data in contract registers.
Contract risk management
Forty-one per cent of agencies are not using contract management plans and do not assess contract risks. Half of the agencies that did assess contract risks, had not updated the risk assessments since the commencement of the contract.
 
Conclusion: Instead of applying a 'set and forget' approach in relation to management of contract risks, agencies should assess risk regularly and develop a plan to actively manage identified risks throughout the contract lifecycle - from negotiation and commencement, to termination.

Performance management
Eighty-six per cent of agencies meet with vendors to discuss performance. 

Only 24 per cent of agencies sought assurance about the accuracy of vendor reporting against KPIs, yet sixty-seven per cent of the IT contracts allow agencies to determine performance based payments and/or penalise underperformance.

Conclusion: Agencies are monitoring IT vendor performance, but could improve outcomes and more effectively manage under-performance by:

  • a more active, rigorous approach to both risk and performance management
  • checking the accuracy of vendor reporting against those KPIs and where appropriate seeking assurance over their accuracy
  • invoking performance based payments clauses in contracts when performance falls below agreed standards.

Transitioning services
Forty-three per cent of the IT vendor contracts did not contain transitioning-out provisions.

Where IT vendor contracts do make provision for transitioning-out, only 28 per cent of agencies have developed a transitioning-out plan with their IT vendor.

Conclusion: Contract transition/phase out clauses and plans can mitigate risks to service disruption, ensure internal controls remain in place, avoid unnecessary costs and reduce the risk of 'vendor lock-in'.
Contract Registers
Eleven out of forty agencies did not have a contract register, or have registers that are not accurate and/or complete.

Conclusion: A contract register helps to manage an agency’s compliance obligations under the Government Information (Public Access) Act 2009 (the GIPA Act). However, it also helps agencies more effectively manage IT vendors by:

  • monitoring contract end dates and contract extensions, and commence new procurements through their central procurement teams in a timely manner
  • managing their contractual commitments, budgeting and cash flow requirements.

Recommendation: Agencies should ensure their contract registers are complete and accurate so they can more effectively govern contracts and manage compliance obligations.

3.2 IT general controls
Governance
Ninety-five per cent of agencies have established policies to manage key IT processes and functions within the agency, with ten per cent of those due for review.
 
Conclusion: Regular review of IT policies ensures risks are considered and appropriate strategies and procedures are implemented to manage these risks on a consistent basis. An absence of policies can lead to ad-hoc responses to risks, and failure to consider emerging IT risks and changes to agency IT environments. 

User access administration
Seventy-two deficiencies were identified related to user access administration, including:

  • thirty issues related to granting user access across 43 per cent of agencies
  • sixteen issues related to removing user access across 30 per cent of agencies
  • twenty-six issues related to periodic reviews of user access across 50 per cent of agencies.
Recommendation: Agencies should strengthen the administration of user access to prevent inappropriate access to key systems.
Privileged access
Forty per cent of agencies do not periodically review logs of the activities of privileged users to identify suspicious or unauthorised activities.

Recommendation: Agencies should:

  • review the number of, and access granted to privileged users, and assess and document the risks associated with their activities
  • monitor user access to address risks from unauthorised activity.
Password controls
Twenty-three per cent of agencies did not comply with their own policy on password parameters.
Recommendation: Agencies should ensure IT password settings comply with their password policies.
Program changes
Fifteen per cent of agencies had deficient IT program change controls mainly related to segregation of duties and authorisation and testing of IT program changes prior to deployment.
Recommendation: Agencies should maintain appropriate segregation of duties in their IT functions and test system changes before they are deployed.

 

This chapter outlines our audit observations, conclusions and recommendations from our review of how agencies reported their performance in their 2016–17 annual reports. The Annual Reports (Statutory Bodies) Regulation 2015 and Annual Reports (Departments) Regulation 2015 (annual reports regulation) currently prescribes the minimum requirements for agency annual reports.

Observation Conclusion or recommendation
4.1 Reporting on performance

Only 57 per cent of agencies linked reporting on performance to their strategic objectives.

The use of targets and reporting performance over time was limited and applied inconsistently.

Conclusion: There is significant disparity in the quality and consistency of how agencies report on their performance in their annual reports. This limits the reliability and transparency of reported performance information.

Agencies could improve performance reporting by clearly linking strategic objectives to reported outcomes, and reporting on performance against targets over time. NSW Treasury may need to provide more guidance to agencies to support consistent and high-quality performance reporting in annual reports.

There is no independent assurance that the performance metrics agencies report in their annual reports are accurate.

Prior performance audits have noted issues related to the collection of performance information. For example, our 2016 Report on Red Tape Reduction highlighted inaccuracies in how the dollar-value of red tape reduction had been reported.

Conclusion: The ability of Parliament and the public to rely on reported information as a relevant and accurate reflection of an agency's performance is limited.

The relevance and accuracy of performance information is enhanced when:

  • policies and guidance support the consistent and accurate collection of data
  • internal review processes and management oversight are effective
  • independent review processes are established to provide effective challenge to the assumptions, judgements and methodology used to collect the reported performance information.
4.2 Reporting on reports

Agency reporting on major projects does not meet the requirements of the annual reports regulation.

Forty-seven per cent of agencies did not report on costs to date and estimated completion dates for major works in progress. Of the 47 per cent of agencies that reported on major works, only one agency reported detail about significant cost overruns, delays, amendments, deferments or cancellations.

NSW Treasury produce an annual report checklist to help agencies comply with their annual report obligations.

Recommendation: Agencies should comply with the annual reports regulation and report on all mandatory fields, including significant cost overruns and delays, for their major works in progress.

The information the annual reports regulation requires agencies to report deals only with major works in progress. There is no requirement to report on completed works.

Sixteen of 30 agencies reported some information on completed major works.

Conclusion: Agencies could improve their transparency if they reported, or were required to report:

  • on both works in progress and projects completed during the year
  • actual costs and completion dates, and forecast completion dates for major works, against original and revised budgets and original expected completion dates
  • explanations for significant cost overruns, delays and key project performance metrics.

 

This chapter outlines our audit observations, conclusions and recommendations, arising from our review of agency preventative and detective controls over purchasing card and taxi use for 2017–18.

Observation Conclusion or recommendation
5.1 Management of purchasing cards
Volume of credit card spend
Purchasing card expenditure has increased by 76 per cent over the last four years in response to a government review into the cost savings possible from using purchasing cards for low value, high volume procurement.
 
Conclusion: The increasing use of purchasing cards highlights the importance of an effective framework for the use and management of purchasing cards.
Policy framework
We found all agencies that held purchasing cards had a policy in place, but 26 per cent of agencies have not reviewed their purchasing card policy by the scheduled date, or do not have a scheduled revision date stated within their policy.
Recommendation: Agencies should mitigate the risks associated with increased purchasing card use by ensuring policies and purchasing card frameworks remain current and compliant with the core requirements of TPP 17–09 'Use and Management of NSW Government Purchasing Cards'.
Preventative controls
We found that:
  • all agencies maintained purchasing card registers
  • seventy-six per cent provided training to cardholders prior to being issued with a card
  • eighty-nine per cent appointed a program administrator, but only half of these had clearly defined roles and responsibilities
  • thirty-two per cent of agencies place merchant blocks on purchasing cards
  • forty-seven per cent of agencies place geographic restrictions on purchasing cards.

Agencies have designed and implemented preventative controls aimed at deterring the potential misuse of purchasing cards.

Conclusion: Further opportunities exist for agencies to better control the use of purchasing cards, such as:

  • updating purchasing card registers to contain all mandatory fields required by TPP17–09
  • appointing a program administrator for the agency's purchasing card framework and defining their role and responsibility for the function
  • strengthening preventive controls to prevent misuse.

Detective controls
Ninety-two per cent of agencies have designed and implemented at least one control to monitor purchasing card activity.

Major reviews, such as data analytics (29 per cent of agencies) and independent spot checks (49 per cent of agencies) are not widely used.

Agencies have designed and implemented detective controls aimed at identifying potential misuse of purchasing cards.

Conclusion: More effective monitoring using purchasing card data can provide better visibility over spending activity and can be used to:

  • detect misuse and investigate exceptions
  • analyse trends to highlight cost saving opportunities.
5.2 Management of taxis
Policy framework
Thirteen per cent of agencies have not developed and implemented a policy to manage taxi use. In addition:
  • a further 41 per cent of agencies have not reviewed their policies by the scheduled revision date, or do not have a scheduled revision date
  • more than half of all agencies’ policies do not offer alternative travel options. For example, only 36 per cent of policies promoted the use of general Opal cards.
Conclusion: Agencies can promote savings and provide more options to staff where their taxi use policies:
  • limit the circumstances where taxi use is appropriate
  • offer alternate, lower cost options to using taxis, such as general Opal cards and rideshare.
Detective controls
All agencies approve taxi expenditure by expense reimbursement, purchasing card and Cabcharge, and have implemented controls around this approval process. However, beyond this there is minimal monitoring and review activity, such as data monitoring, independent spot checks or internal audit reviews.
Conclusion: Taxi spend at agencies is not significant in terms of its dollar value, but it is significant from a probity perspective. Agencies can better address the probity risk by incorporating taxi use into a broader purchasing card or fraud monitoring program.

 

Fraud and corruption control is one of the 17 key elements of our governance lighthouse. Recent reports from ICAC into state agencies and local government councils highlight the need for effective fraud control and ethical frameworks. Effective frameworks can help protect an agency from events that risk serious reputational damage and financial loss.

Our 2016 Fraud Survey found the NSW Government agencies we surveyed reported 1,077 frauds over the three year period to 30 June 2015. For those frauds where an estimate of losses was made, the reported value exceeded $10.0 million. The report also highlighted that the full extent of fraud in the NSW public sector could be higher than reported because:

  • unreported frauds in organisations can be almost three times the number of reported frauds
  • our 2015 survey did not include all NSW public sector agencies, nor did it include any NSW universities or local councils
  • fraud committed by citizens such as fare evasion and fraudulent state tax self-assessments was not within the scope of our 2015 survey
  • agencies did not estimate a value for 599 of the 1,077 (56 per cent) reported frauds.

Commissioning and outsourcing of services to the private sector and the advancement of digital technology are changing the fraud and corruption risks agencies face. Fraud risk assessments should be updated regularly and in particular where there are changes in agency business models. NSW Treasury Circular TC18-02 NSW Fraud and Corruption Control Policy now requires agencies develop, implement and maintain a fraud and corruption control framework, effective from 1 July 2018. 

Our Fraud Control Improvement Kit provides guidance and practical advice to help organisations implement an effective fraud control framework. The kit is divided into ten attributes. Three key attributes have been assessed below; prevention, detection and notification systems.

This chapter outlines our audit observations, conclusions and recommendations, arising from our review of agency fraud and corruption controls for 2017–18.

Observation Conclusion or recommendation
6.1 Prevention systems

Prevention systems
Ninety-two per cent of agencies have a fraud control plan in place, 81 per cent maintain a fraud database and 79 per cent report fraud and corruption matters as a standing item on audit and risk committee agendas.

Only 54 per cent of agencies have an employment screening policy and all agencies have IT security policies, but gaps in IT security controls could undermine their policies.

Conclusion: Most agencies have implemented fraud prevention systems to reduce the risk of fraud. However poor IT security along with other gaps in agency prevention systems, such as employment screening practices heightens the risk of fraud and inappropriate use of data.

Agencies can improve their fraud prevention systems by:

  • completing regular fraud risk assessments, embedding fraud risk assessment into their enterprise risk management process and reporting the results of the assessment to the audit and risk committee
  • maintaining a fraud database and reviewing it regularly for systemic issues and reporting a redacted version of the database on the agency's website to inform corruption prevention networks
  • developing policies and procedures for employee screening and benchmarking their current processes against ICAC's publication ‘Strengthening Employment Screening Practices in the NSW Public Sector’
  • developing and maintaining up to date IT security policies and monitoring compliance with the policy.
Twenty-three per cent of agencies were not performing fraud risk assessments and some agency fraud risk assessments may not be as robust as they could be.  Conclusion: Agencies' systems of internal controls may be less effective where new and emerging fraud risks have been overlooked, or known weaknesses have not been rectified.
6.2 Detection systems
Detection systems
Several agencies reported they were developing a data monitoring program, but only 38 per cent of agencies had already implemented a program.
 

Studies have shown data monitoring, whereby entire populations of transactional data are analysed for indicators of fraudulent activity, is one of the most effective methods of early detection. Early detection decreases the duration a fraud remains undetected thereby limiting the extent of losses.

Conclusion: Data monitoring is an effective tool for early detection of fraud and is more effective when informed by a comprehensive fraud risk assessment.

6.3 Notification systems
Notification system
All agencies have notification systems for reporting actual or suspected fraud and corruption. Most agencies provide multiple reporting lines, provide training and publicise options for staff to report actual or suspected fraud and corruption.
Conclusion: Training staff about their obligations and the use of fraud notification systems promotes a fraud-aware culture