Reports
Actions for Internal Controls and Governance 2017
Internal Controls and Governance 2017
Agencies need to do more to address risks posed by information technology (IT).
Effective internal controls and governance systems help agencies to operate efficiently and effectively and comply with relevant laws, standards and policies. We assessed how well agencies are implementing these systems, and highlighted opportunities for improvement.
1. Overall trends
New and repeat findings |
The number of reported financial and IT control deficiencies has fallen, but many previously reported findings remain unresolved. |
High risk findings |
Poor systems implementations contributed to the seven high risk internal control deficiencies that could affect agencies. |
Common findings |
Poor IT controls are the most commonly reported deficiency across agencies, followed by governance issues relating to cyber security, capital projects, continuous disclosure, shared services, ethics and risk management maturity. |
2. Information Technology
IT security |
Only two-thirds of agencies are complying with their own policies on IT security. Agencies need to tighten user access and password controls. |
Cyber security |
Agencies do not have a common view on what constitutes a cyber attack, which limits understanding the extent of the cyber security threat. |
Other IT systems |
Agencies can improve their disaster recovery plans and the change control processes they use when updating IT systems. |
3. Asset Management
Capital investment |
Agencies report delays delivering against the significant increase in their budgets for capital projects. |
Capital projects |
Agencies are underspending their capital budgets and some can improve capital project governance. |
Asset disposals |
Eleven per cent of agencies were required to sell their real property through Property NSW but didn’t. And eight per cent of agencies can improve their asset disposal processes. |
4. Governance
Governance arrangements |
Sixty-four per cent of agencies’ disclosure policies support communication of key performance information and prompt public reporting of significant issues. |
Shared services |
Fifty-nine per cent of agencies use shared services, yet 14 per cent do not have service level agreements in place and 20 per cent can strengthen the performance standards they set. |
5. Ethics and Conduct
Ethical framework |
Agencies can reinforce their ethical frameworks by updating code‑of‑conduct policies and publishing a Statement of Business Ethics. |
Conflicts of interest |
All agencies we reviewed have a code of conduct, but they can still improve the way they update and manage their codes to reduce the risk of fraud and unethical behaviour. |
6. Risk Management
Risk management maturity |
All agencies have implemented risk management frameworks, but with varying levels of maturity. |
Risk management elements |
Many agencies can improve risk registers and strengthen their risk culture, particularly in the way that they report risks to their lead agency. |
This report covers the findings and recommendations from our 2016–17 financial audits related to the internal controls and governance of the 39 largest agencies (refer to Appendix three) in the NSW public sector. These agencies represent about 95 per cent of total expenditure for all NSW agencies and were considered to be a large enough group to identify common issues and insights.
The findings in this report should not be used to draw conclusions on the effectiveness of individual agency control environments and governance arrangements. Specific financial reporting, controls and service delivery comments are included in the individual 2017 cluster financial audit reports tabled in Parliament from October to December 2017.
This new report offers strategic insight on the public sector as a whole
In previous years, we have commented on internal control and governance issues in the volumes we published on each ‘cluster’ or agency sector, generally between October and December. To add further value, we then commented more broadly about the issues identified for the public sector as a whole at the start of the following year.
This year, we have created this report dedicated to internal controls and governance. This will help Parliament to understand broad issues affecting the public sector, and help agencies to compare their own performance against that of their peers.
Without strong control measures and governance systems, agencies face increased risks in their financial management and service delivery. If they do not, for example, properly authorise payments or manage conflicts of interest, they are at greater risk of fraud. If they do not have strong information technology (IT) systems, sensitive and trusted information may be at risk of unauthorised access and misuse.
These problems can in turn reduce the efficiency of agency operations, increase their costs and reduce the quality of the services they deliver.
Our audits do not review every control or governance measure every year. We select a range of measures, and report on those that present the most significant risks that agencies should mitigate. This report divides these into the following six areas:
- Overall trends
- Information technology
- Asset management
- Governance
- Ethics and conduct
- Risk management.
Internal controls are processes, policies and procedures that help agencies to:
- operate effectively and efficiently
- produce reliable financial reports
- comply with laws and regulations.
This chapter outlines the overall trends for agency controls and governance issues, including the number of findings, level of risk and the most common deficiencies we found across agencies. The rest of this volume then illustrates this year’s controls and governance findings in more detail.
Issues |
Recommendations |
1.1 New and repeat findings |
|
The number of internal control deficiencies reduced over the past three years, but new higher-risk information technology (IT) control deficiencies were reported in 2016–17. Deficiencies repeated from previous years still make up a sizeable proportion of all internal control deficiencies. |
Recommendation Agencies should focus on emerging IT risks, but also manage new IT risks, reduce existing IT control deficiencies, and address repeat internal control deficiencies on a more timely basis. |
1.2 High risk findings |
|
We found seven high risk internal control deficiencies, which might significantly affect agencies. |
Recommendation Agencies should rectify high risk internal control deficiencies as a priority |
1.3 Common findings |
|
The most common internal control deficiencies related to poor or absent IT controls. We found some common governance deficiencies across multiple agencies. |
Recommendation Agencies should coordinate actions and resources to help rectify common IT control and governance deficiencies. |
Information technology (IT) has become increasingly important for government agencies’ financial reporting and to deliver their services efficiently and effectively. Our audits reviewed whether agencies have effective controls in place over their IT systems. We found that IT security remains the source of many control weakness in agencies.
Issues | Recommendations |
2.1 IT security |
|
User access administration While 95 per cent of agencies have policies about user access, about two-thirds were compliant with these policies. Agencies can improve how they grant, change and end user access to their systems. |
Recommendation Agencies should strengthen user access administration to prevent inappropriate access to sensitive systems. Agencies should:
|
Privileged access Sixty-eight per cent of agencies do not adequately manage who can access their information systems, and many do not sufficiently monitor or restrict privileged access. |
Recommendation Agencies should tighten privileged user access to protect their information systems and reduce the risks of data misuse and fraud. Agencies should ensure they:
|
Password controls Forty-one per cent of agencies did not meet either their own standards or minimum standards for password controls. |
Recommendation Agencies should review and enforce password controls to strengthen security over sensitive systems. As a minimum, password parameters should include:
|
2.2 Cyber Security |
|
Cyber security framework Agencies do not have a common view on what constitutes a cyber attack, which limits understanding the extent of the cyber security threat. |
Recommendation The Department of Finance, Services and Innovation should revisit its existing framework to develop a shared cyber security terminology and strengthen the current reporting requirements for cyber incidents. |
Cyber security strategies While 82 per cent of agencies have dedicated resources to address cyber security, they can strengthen their strategies, expertise and staff awareness. |
Recommendations The Department of Finance, Services and Innovation should:
Agencies should ensure they adequately resource staff dedicated to cyber security. |
2.3 Other IT systems |
|
Change control processes Some agencies need to improve change control processes to avoid unauthorised or inaccurate system changes. |
Recommendation Agencies should consistently perform user acceptance testing before system upgrades and changes. They should also properly approve and document changes to IT systems. |
Disaster recovery planning Agencies can do more to adequately assess critical business systems to enforce effective disaster recovery plans. This includes reviewing and testing their plans on a timely basis. |
Recommendation Agencies should complete business impact analyses to strengthen disaster recovery plans, then regularly test and update their plans. |
Agency service delivery relies on developing and renewing infrastructure assets such as schools, hospitals, roads, or public housing. Agencies are currently investing significantly in new assets. Agencies need to manage the scale and volume of current capital projects in order to deliver new infrastructure on time, on budget and realise the intended benefits. We found agencies can improve how they:
- manage their major capital projects
- dispose of existing assets.
Issues | Recommendations or conclusions |
3.1 Capital investment |
|
Capital asset investment ratios Most agencies report high capital investment ratios, but one-third of agencies’ capital investment ratios are less than one. |
Recommendation Agencies with high capital asset investment ratios should ensure their project management and delivery functions have the capacity to deliver their current and forward work programs. |
Volume of capital spending Most agencies have significant forward spending commitments for capital projects. However, agencies’ actual capital expenditure has been below budget for the last three years. |
Conclusion The significant increase in capital budget underspends warrant investigation, particularly where this has resulted from slower than expected delivery of projects from previous years. |
3.2 Capital projects |
|
Major capital projects Agencies’ major capital projects were underspent by 13 percent against their budgets. |
Conclusion The causes of agency budget underspends warrant investigation to ensure the NSW Government’s infrastructure commitment is delivered on time. |
Capital project governance Agencies do not consistently prepare business cases or use project steering committees to oversee major capital projects. |
Conclusion Agencies that have project management processes that include robust business cases and regular updates to their steering committees (or equivalent) are better able to provide those projects with strategic direction and oversight. |
3.3. Asset disposals |
|
Asset disposal procedures Agencies need to strengthen their asset disposal procedures. |
Recommendations Agencies should have formal processes for disposing of surplus properties. Agencies should use Property NSW to manage real property sales unless, as in the case for State owned corporations, they have been granted an exemption. |
Governance refers to the high-level frameworks, processes and behaviours that help an organisation to achieve its objectives, comply with legal and other requirements, and meet a high standard of probity, accountability and transparency.
This chapter sets out the governance lighthouse model the Audit Office developed to help agencies reach best practice. It then focuses on two key areas: continuous disclosure and shared services arrangements. The following two chapters look at findings related to ethics and risk management.
Issues | Recommendations or conclusions |
4.1 Governance arrangements |
|
Continuous disclosure Continuous disclosure promotes improved performance and public trust and aides better decision-making. Continuous disclosure is only mandatory for NSW Government Businesses such as State owned corporations. |
Conclusion Some agencies promote transparency and accountability by publishing on their websites a continuous disclosure policy that provides for, and encourages:
|
4.2 Shared services |
|
Service level agreements Some agencies do not have service level agreements for their shared service arrangements. Many of the agreements that do exist do not adequately specify controls, performance or reporting requirements. This reduces the effectiveness of shared services arrangements. |
Conclusion Agencies are better able to manage the quality and timeliness of shared service arrangements where they have a service level agreement in place. Ideally, the terms of service should be agreed before services are transferred to the service provider and:
|
Shared service performance Some agencies do not set performance standards for their shared service providers or regularly review performance results. |
Conclusion Agencies can achieve better results from shared service arrangements when they regularly monitor the performance of shared service providers using key measures for the benefits realised, costs saved and quality of services received. Before agencies extend or renegotiate a contract, they should comprehensively assess the services received and test the market to maximise value for money. |
All government sector employees must demonstrate the highest levels of ethical conduct, in line with standards set by The Code of Ethics and Conduct for NSW government sector employees.
This chapter looks at how well agencies are managing these requirements, and where they can improve their policies and processes.
We found that agencies mostly have the appropriate codes, frameworks and policies in place. But we have highlighted opportunities to improve the way they manage those systems to reduce the risks of unethical conduct.
Issues | Recommendations or conclusions |
5.1 Ethical framework |
|
Code of conduct All agencies we reviewed have a code of conduct, but they can still improve the way they update and manage their codes to reduce the risk of fraud and unethical behaviour. |
Recommendation Agencies should regularly review their code-of-conduct policies and ensure they keep their codes of conduct up-to-date. |
Statement of business ethics Most agencies maintain an ethical framework, but some can enhance their related processes, particularly when dealing with external clients, customers, suppliers and contractors. |
Conclusion Agencies can enhance their ethical frameworks by publishing a Statement of Business Ethics, which communicates their values and culture. |
5.2 Potential conflicts of interest |
|
Conflicts of interest All agencies have a conflicts-of-interest policy, but most can improve how they identify, manage and avoid conflicts of interest. |
Recommendation Agencies should improve the way they manage conflicts of interest, particularly by:
|
Gifts and benefits While all agencies already have a formal gifts-and-benefits policy, we found gaps in the management of gifts and benefits by some that increase the risk of unethical conduct. |
Recommendation Agencies should improve the way they manage gifts and benefits by promptly updating registers and providing annual training to staff. |
Risk management is an integral part of effective corporate governance. It helps agencies to identify, assess and prioritise the risks they face and in turn minimise, monitor and control the impact of unforeseen events. It also means agencies can respond to opportunities that may emerge and improve their services and activities.
This year we looked at the overall maturity of the risk management frameworks that agencies use, along with two important risk management elements: risk culture and risk registers.
Issues | Recommendations or conclusions |
6.1 Risk management maturity |
|
All agencies have implemented risk management frameworks, but with varying levels of maturity in their application. Agencies’ averaged a score of 3.1 out of five across five critical assessment criteria for risk management. While strategy and governance fared best, the areas that most need to improve are risk culture, and systems and intelligence. |
Conclusion Agencies have introduced risk management frameworks and practices as required by the Treasury’s:
However, more can be done to progress risk management maturity and embed risk management in agency culture. |
6.2 Risk management elements |
|
Risk culture Most agencies have started to embed risk management into the culture of their organisation. But only some have successfully done so, and most agencies can improve their risk culture.
|
Conclusion Agencies can improve their risk culture by:
|
Risk registers and reporting Some agencies do not report their significant risks to their lead agency, which may impair the way resources are allocated in their cluster. Some agencies do not integrate risk registers at a divisional and whole-of-enterprise level. |
Conclusion Agencies not reporting significant risks at the cluster level increases the likelihood that significant risks are not being mitigated appropriately. |
Effective risk management can improve agency decision-making, protect reputations and lead to significant efficiencies and cost savings. By embedding risk management directly into their operations, agencies can also derive extra value for their activities and services.
Actions for Justice 2017
Justice 2017
The following report focuses on key observations and findings from the most recent audits of law and order and emergency services agencies in the Justice cluster.
No qualified audit opinions were issued on Justice agencies' financial statements. However, agencies that used the Department of Justice as their service provider experienced difficulties finalising their accounts. This was due to issues with the department’s implementation of a new financial accounting and reporting system and the continued establishment of its Business Support Centre. The Department is working to remediate the new finance system.
Financial reporting | Unqualified audit opinions were issued for all agencies' 30 June 2017 financial statements. However, some agencies' year end financial reporting procedures were impacted by the implementation of a new finance system and processes at the Department. |
Early Close | Early close procedures continue to help agencies present audited financial statements on time, but there is room for further improvement. |
NSW Police Force Death and Disability Scheme | The cost of the NSW Police Force Death and Disability Scheme was higher than the statutory target. |
Fire and Rescue NSW Death and Disability Scheme | The Fire and Rescue NSW Death and Disability Scheme liability was $179 million, but is projected to reach $257 million by 30 June 2022. |
Internal Controls |
The Department experienced significant, but avoidable internal control issues in its payroll and finance functions following implementation of a new IT finance system (Justice SAP) and continued establishment of its Business Support Centre. We found 94 internal controls issues, including 28 findings repeated from the previous year. |
Human Resources | Agencies have not met State targets for managing annual leave balances. |
2. Service Delivery
Domestic violence reoffending | The Department reports decreases in domestic violence reoffending rates, but they remain above the Premier's target |
Rates of reoffending | Adult reoffending rates remain above the State's priority target. Last year, more than half had returned to prison or Corrective Services within two years of release. The Department has introduced initiatives to reduce reoffending, but their impact will not be known for several years |
Road Fatalities | New South Wales' road fatalities decreased slightly in 2016–17, but remains slightly above the State priority target.. |
NSW crime trends | NSW Bureau of Crime statistics and Research data shows the trend in most crime categories in New South Wales has been better than national trends over the last five years. |
Adult inmate numbers | Departmental data shows that NSW prisons remained overcrowded in 2016–17, but the rate of growth in inmate numbers slowed. |
Adult inmate resources | Data from the Department and the Justice Heath and Forensic Mental Health Network shows inmate access to some resources and services has not kept pace with increases in prison populations. |
NSW District Court case backlog | After falling last year, the backlog of cases in the NSW District Court again increased but the age of backlog cases decreased, according to Departmental data. |
Hazard Reduction works | The Office of the NSW Rural Fire Service advise adverse weather conditions reduced the total hectares of completed hazard reduction works by 50.7 per cent in 2016–17 compared to 2015–16. |
Financial reporting is an important element of good governance. Confidence in public sector decision making and transparency is enhanced when financial reporting is accurate and timely. Appropriate financial controls help ensure the efficient and effective use of resources and administration of agency policies. They are essential for quality and timely decision making.
This chapter outlines audit observations, conclusions and recommendations for financial reporting and controls of Justice cluster agencies.
Observation | Conclusion or recommendation |
2.1 Financial reporting | |
Unqualified audit opinions were issued for all agencies' financial statements. | Unqualified audit opinions were issued for all agencies' 30 June 2017 financial statements. The Department and agencies that used the Department as their service provider, were impacted by the Department's Justice SAP, and Business Support Centre implementations. |
2.2 Timeliness of financial reporting | |
Most agencies complied with the statutory timeframes for completion of early close procedures and preparation and audit of financial statements. | Early close procedures continue to facilitate the timely preparation of financial statements and completion of audits. Early close procedures for some agencies was diminished by the Department's Justice SAP and Business Support Centre implementations. |
2.3 Death and disability schemes | |
The cost of the NSW Police Blue Ribbon scheme reportedly decreased, but remains above the statutory target of 4.6 per cent of total NSW Police Officer's remuneration. The Fire and Rescue Death and Disability Scheme liability has almost doubled over the past five years. |
The Blue Ribbon Scheme cost $12.7 million or 10.4 per cent less in 2016–17 following an improvement in claims' experience. The was reflected in the cost of the scheme, which decreased from 6 per cent to 5.45 per cent of total NSW Police Officers’ remuneration. The Scheme’s liability was $179 million at 30 June 2017, almost double the $92 million recorded at 30 June 2013. A five-year period has been used due to the sensitivity of annual movements in the liability to changes in discount rates. According to Fire and Rescue NSW projections the liability will reach $257 million by 30 June 2022. |
2.5 Internal Controls | |
There were significant payroll and general finance related issues resulting from the Department's Justice SAP system implementation and establishment of the Business Support Centre. | Recommendation: The Department should reinstate controls over financial information as soon as possible, and capture and apply lessons learned from recent project implementations, including LifeLink, in any relevant future implementations. |
2.7 Human Resources | |
More than a third of Justice cluster employees have annual leave balances above the State's target. | Recommendation: Cluster agencies with annual leave balances above the State's target should proactively manage their leave balances. Particular focus should be given to employees who have taken little or no leave in the last 12 months. |
Achievement of government outcomes can be improved through effective delivery of the right mix of services, whether from the public, private or not for profit sectors. Service delivery reform will be most successful if there is clear accountability for service delivery outcomes, decisions are aligned to strategic direction and performance is monitored and evaluated.
The Justice cluster is an integrated cluster with key service delivery inter-dependencies. Achieving State priorities and ensuring communities are safe requires both upstream and downstream agencies to be adequately resourced. This is a delicate balance. Increases in frontline policing can subsequently impact the court system. Court backlogs can in turn increase prison overcrowding, and limit the opportunities for inmate rehabilitation. Failure to successfully rehabilitate prisoners and prevent reoffending could impact future police resourcing.
This chapter outlines our audit observations, conclusions and recommendations related to service delivery by agencies in the Justice cluster for 2016–17.
Observation | Conclusion or recommendation |
Data from the NSW Bureau of Crime Statistics and Research shows that domestic violence reoffending decreased from 15.9 per cent in 2014–15 to 15.5 per cent in 2015–16, but remains 4.8 percentage points above the Premier's target. | Reducing domestic violence reoffending is challenging. While there was a marginal improvement in 2015–16, the Justice cluster needs to continue efforts to reduce reoffending rates, if the Premier's priority target is to be met by 2019. |
Productivity Commission data shows that in the year to 30 June 2016, 50.7 per cent of released prisoners had returned to prison and 55.1 per cent to Corrective Services, within two years of release. | There has been a consistent increase in reoffending rates over the last five years. Recommendation: The Department should reassess the sufficiency and effectiveness of measures aimed at reducing reoffending, including the recently announced initiatives, if the State priority target is to be met by 2019. A $237 million program to reduce reoffending was announced in August 2016. While new initiatives were introduced in 2016–17, their impact on reoffending rates will not be known for several years. |
New South Wales' road fatalities per 100,000 people slightly exceeded the 2016–17 target. | Statistics from the NSW Centre for Road Safety shows that New South Wales' road fatalities decreased to 4.6 deaths per 100,000 people in 2016–17, slightly above the State priority target of 4.3 deaths. This is better than the 5.1 deaths recorded in 2015–16, but worse than the 4.0 deaths in 2014–15. |
Between 31 December 2012 and 31 December 2016, the number of crimes has trended down in most crime categories, except for sexual assault, which has increased in each of the last five years. | The downward trend in most crime categories indicates the cluster is effectively achieving the State’s priority to prevent and reduce crime. However, the Department should assess whether the mix of offered programs is consistent with crime trends. |
Department data shows that the NSW prison system remained overcrowded in 2016–17. Overcrowding of correctional centres can negatively impact all aspects of custodial life, and ultimately higher reoffending rates. |
Data from the Department shows that the inmate population reached 13,253, compared to an operational capacity of 13,402 beds on 27 August 2017. This equates to an operational vacancy rate of 1.1 per cent, which is significantly less than the recommended 5.0 per cent buffer. However, the rate of inmate growth slowed to 5.1 per cent, from 11.8 per cent in 2015–16. The Department should ensure that measures aimed at reducing reoffending are not compromised by continued overcrowding. Reoffending, will in the long term contribute to further overcrowding. |
Adult inmate resources. | Inmate access to some resources and services has not kept pace with increases in prison populations, such as the ratio of nurses to inmates. In addition, Productivity Commission information on out-of-cell hours in 2015–16 shows New South Wales prisoners' average time out-of-cell of 7.8 hours was the lowest of any Australian jurisdiction. |
After falling in 2015–16, the backlog of cases in the NSW District Court increased again in 2016–17. The age of cases however decreased in 2016–17 compared to 2015–16. | A working group which includes the Department and the Chief Judge of the District Court has identified a number of new measures to address the backlog. The Department needs to assess whether these measures will be sufficient, given that the backlog increased again in 2016–17. As noted in financial reporting and controls chapter, staffing levels in a number of just cluster agencies increased in 2016–17, in response to the backlog. |
Department data shows the annual cost of a juvenile detainee decreased from $355,444 to $335,840 (5.5 per cent) in the three-year period between 2014–15 and 2016–17. | The Department has been analysing the Juvenile Justice division's operating costs in the context of declining custodial numbers, and has achieved some cost savings. The savings in part reflect decreases in the number of detainees. |
The Office of the NSW Rural Fire Service data shows that completed hazard reduction works decreased in 2016–17. | The total hectares of completed hazard reduction works decreased 50.7 per cent in 2016–17 compared to 2015–16. The Office of the NSW Rural Fire Service attributes the decrease to adverse weather conditions during the peak burning period |
Actions for Energy rebates for low income households
Energy rebates for low income households
The Department of Planning and Environment provides more than $245 million in energy rebates to around 27 percent of NSW households. This report highlights that the department is not monitoring the rebate schemes to understand whether they are delivering the best outcomes.
Most rebates are ongoing payments applied directly to energy bills reducing the amount payable by the householder. The structure of these rebates is complex and can be inequitable. Some households are eligible for four different rebates, each with its own eligibility criteria. Also, some households in very similar circumstances receive different levels of support depending on what type of energy is used in their home or which adult in the house is the energy account holder. For example, a household using both electricity and gas receives more assistance than a household with electricity alone even if total energy bills are the same.
By September 2018, the Department of Planning and Environment should:
- Ensure effective strategies are in place to make information about rebates available to all eligible, low-income households
- Evaluate alternative models and develop advice for government to reduce complexity and improve equity of ongoing rebates
- Establish measurable objectives for schemes that provide ongoing support, and monitor and measure performance of all schemes against objectives and outcome measures
- Assess the impacts of the forecast increase in embedded networks and develop strategies to manage any increased administrative risk
- Strengthen assurance that EAPA is being provided in accordance with its objectives and guidelines by implementing accreditation and compliance programs
- Ensure those eligible for EAPA financial support are not disadvantaged by inflexible payments, inconsistent provider practices, or inability to access an EAPA provider in a timely manner. Options include:
- moving from a fixed-value voucher to a flexible payment based on need irrespective of energy type
- establishing a ‘Provider of Last Resort’ facility for households that cannot access an EAPA Provider.
Parliamentary reference - Report number #292 - released 19 September 2017
Actions for Mining Rehabilitation Security Deposits
Mining Rehabilitation Security Deposits
The Department of Planning and Environment requires mining companies to rehabilitate sites according to conditions set in the mining development approval. The Department holds mining rehabilitation security deposits that are meant to cover the full cost of rehabilitation if a mining company defaults on its rehabilitation obligations.
Parliamentary reference - Report number #285 - released 11 May 2017
Actions for Therapeutic programs in prisons
Therapeutic programs in prisons
Corrective Services NSW should ensure eligible prisoners receive timely programs to reduce the risk they will reoffend on release.
Parliamentary reference - Report number #283 - released 3 May 2017
Actions for 2016 - An overview
2016 - An overview
This report focuses on key observations and findings from 2016 audits and highlights key areas of focus for financial and performance audits in 2017.
Financial reporting | |
Observation | Conclusion |
Only one qualified audit opinion was issued on the 2015–16 financial statements of NSW public sector agencies, compared to two in 2014–15. | The quality of financial reporting continued to improve across the NSW public sector. |
More 2015–16 financial statements and audit opinions were signed within three months of the year end. | Timely financial reporting was facilitated by more agencies resolving significant accounting issues early, completing asset valuations on time and compiling sufficient evidence to support financial statement balances. |
NSW Treasury’s early close procedures in 2015–16 were again successful in improving the quality and timeliness of financial reporting, largely facilitated by the early resolution of accounting issues. For 2016–17, NSW Treasury has narrowed the scope of mandatory early close procedures. |
The narrowed scope of mandatory early close procedures may diminish the good performance in ensuring the quality and timeliness of financial reporting achieved in recent years. To mitigate this risk, NSW Treasury has mandated that agencies perform non-financial asset valuations and prepare proforma financial statements in their early close procedures. It also encourages them to continue with the good practices embedded in recent years. |
Although most agencies complied with NSW Treasury’s early close asset revaluation procedures we identified areas where they can improve. | Asset revaluations need to commence early enough to ensure all assets are identified and the results are analysed, recorded and reflected accurately in the early close financial statements. |
Number of misstatements | |||||
Year ended 30 June | 2015-16 | 2014-15 | 2013-14 | 2012-13 | 2011-12 |
Total reported misstatements | 298 | 396 | 459 | 661 | 1,077 |
All material misstatements identified by agencies and audit teams were corrected before the financial statements and audit opinions were signed. A material misstatement relates to an incorrect amount, classification, presentation or disclosure in the financial statements that could reasonably be expected to influence the economic decisions of users.
Significant matters reported to the portfolio Minister, Treasurer and Agency Head
In 2015–16, we reported the following significant matters to the portfolio Minister, Treasurer and agency head in our Statutory Audit Reports:
Appropriate financial controls help ensure the efficient and effective use of resources and the implementation and administration of agency policies. They are essential for quality and timely decision making.
In 2015–16, our audit teams made the following key observations on the financial controls of NSW public sector agencies.
Financial controls | |
Observation | Conclusion |
More needs to be done to implement audit recommendations on a timely basis. We found 212 internal control issues identified in previous audits had not been adequately addressed by 30 June 2016. |
Delays in implementing audit recommendations can impact the quality of financial information and the effectiveness of decision making. Agencies need to ensure they have action plans, timeframes and assigned responsibilities to address recommendations in a timely manner. |
Agencies continue to face challenges managing information security. Most information technology issues we identified related to poor IT user administration in areas like password controls and inappropriate access. | Agencies should review the design and effectiveness of information security controls to ensure data is adequately protected. |
We found shared service provider agreements did not always adequately address information security requirements. |
Where agencies use shared service providers they should consider whether the service level arrangements adequately address information security. |
Thirteen of 108 agencies required to attest to having a minimum set of information security controls did not do so in their 2015 annual reports. | The 'NSW Government Digital Information Security Policy' recognises the growing need for effective information security. With cyber security threats continuing to increase as digital services expand we plan to look at cyber security as part of our 2017–18 performance audit program. |
We identified instances where service level agreements with shared service providers were outdated, signed too late or did not exist. | Corporate and shared service arrangements are more effective when service level arrangements are negotiated and signed in time, clearly detail rights and responsibilities and include meaningful KPIs, fee arrangements and dispute resolution processes. |
Internal controls at GovConnect, the private sector provider of transactional and information technology services to many NSW public sector agencies were ineffective in 2015–16. We found mitigating actions taken to manage transition risks from ServiceFirst to GovConnect were ineffective in ensuring effective control over client transactions and data. | The Department of Finance, Services and Innovation should ensure GovConnect addresses the control deficiencies. It should also examine the breakdowns in the transition of the shared service arrangements and apply the learnings to other services being transitioned to the private sector. |
Maintenance backlogs exist in several NSW public sector agencies, including Roads and Maritime Services, Sydney Trains, NSW Health, the Department of Education and the Department of Justice. | To address backlog maintenance it is important for agencies to have asset lifecycle planning strategies that ensure newly built and existing assets are funded and maintained to a desired service level. |
Actions for Assessing major development applications
Assessing major development applications
The Planning Assessment Commission (the Commission) has improved its decision-making processes for major development applications in recent years. The Commission has improved how it consults the public and manages conflicts of interest, and now also publishes records of its meetings with applicants and stakeholders.
The Planning Assessment Commission (the Commission) is an independent body established in 2008 under the Environmental Planning and Assessment Act 1979 (the EP&A Act). It makes decisions on major development applications in New South Wales. Along with the Department of Planning and Environment (the Department) and the Land and Environment Court, it is one of three bodies that have a role in making decisions on these applications.
The Department refers development applications to the Commission where 25 or more objections have been received from the community, a local council objects to the proposal, or the applicant has donated to a political party.
These applications are often complex and controversial, and can attract a high level of public interest. This may mean that, regardless of the process, not all stakeholders are satisfied with the outcome.
The Commission is required to take into account section 79C of the EP&A Act when making decisions. Section 79C includes consideration of the likely environmental, social and economic impacts of the development.
This audit assessed the extent to which the Commission’s decisions on major development applications are made in a consistent and transparent manner. To assist us in making this assessment, we asked whether the Commission:
- has sound processes in place to help it make decisions on major development applications that are informed and made in a consistent manner
- ensures its decisions are free from bias and transparent to stakeholders and the public.
Conclusion
Over the last two years, the Commission has improved its decision-making process. It has improved how it consults the public and manages conflicts of interest, and now also publishes records of its meetings with applicants and stakeholders.
However, there are still some vital issues to be addressed to ensure it makes decisions in a consistent and transparent manner. Most importantly, the Commission was not able to show in every decision we reviewed how it met its statutory obligation to consider the matters in section 79C of the EP&A Act.
Despite improved probity measures put in place by the Commission, there is a perception among some stakeholders that it is not independent of the Department. The reasons for some of these concerns are outside of the Commission’s control. For example, the Commission becomes involved after the Department has prepared an assessment report which recommends whether a development should proceed. This creates the perception that the Commission is acting on the recommendation of the Department. The Department’s assessment report should state whether an application meets relevant legislative and policy requirements, but not recommend whether a development should be approved or not.
More can also be done to improve transparency in decision-making and the public’s perception of the independence of Commissioners. The Commission should continue to improve how it communicates the reasons for its decisions and also publish on its website a summary of Commissioners’ conflict of interest declarations for each development application.
Decision-making processes have improved but some key aspects need to be addressed
Although not articulated in one document, there is a framework in place to assist Commissioners make decisions on major development applications. This includes setting out the information to be considered, who to consult, and that a report is to be prepared. The Commission has recently improved how it conducts public meetings and the level of support provided to Commissioners to ensure they understand the decision-making process. The Commissioners we interviewed all showed a good understanding of their role.
As a consent authority, the Commission is required to consider the matters in section 79C of the EP&A Act when making a decision. However, it was not able to show how it met this requirement in every decision we reviewed. We found some evidence of these considerations in six of the nine cases we reviewed, for example in meeting notes or in its report on a decision. Of these six cases, the degree to which the Commission considered all matters under section 79C varied considerably. The larger, more complex applications were more likely to address these considerations. To demonstrate compliance with the EP&A Act, the Commission must be able to show how it considers all matters in section 79C for each decision it makes.
We found that the Commission has access to relevant information to make a decision and consults stakeholders for their views of the development. The level of consultation depends on the size and complexity of an application. If Commissioners decide they need more information to make a decision, they consult local councils, the community, other government agencies and experts as needed.
The Commission’s public meetings are a valuable part of the decision-making process, where new perspectives or issues are often raised. However, some aspects could be improved. For example, many stakeholders thought the five minutes allowed for individual speakers was insufficient. The Commission could be more flexible with this timeframe. Identifying new ways to notify the public of its meetings, other than advertisements on its website and in newspapers, would also ensure it reaches as many interested parties as possible.
Improved transparency and probity but the Commission is not seen by some as impartial
The Commission has sound processes in place to ensure that its decisions are impartial and transparent to the community. It has improved its probity measures over the last two years, following a review by the NSW Ombudsman in 2014. We found that the Commission:
- has probity policies and procedures which are available on its website
- has improved its record keeping of some processes, such as meetings with applicants and stakeholders
- publishes its decision and supporting documentation, such as meeting notes, on its website.
Conflicts of interest are a significant risk for the Commission because they could lead to corruption, abuse of public office, and affect the public’s view of its independence. The Commission manages this risk well. It has a policy in place to address potential, perceived or actual conflicts. Commissioners update their conflicts of interest records annually, and declare any conflicts when the Commission assigns them to a development application. Unlike the Commission’s probity polices, Commissioners’ conflict of interest declarations are not available on its website. Providing a summary of this information on its website when Commissioners are allocated to a development application would further improve transparency around conflicts of interest.
The Commission has been improving how it communicates its decisions to the public. It now produces fact sheets for its decisions on matters that attract a high level of public interest. Its reports on decisions for complex applications also discuss issues raised by the community. However, the level of detail varied in the decisions we reviewed, and it was not always clear how conditions placed on a development would resolve identified issues. Similarly, the reports did not clearly address the matters under section 79C of the EP&A Act. Reporting this would further improve the transparency of its decisions, and clearly demonstrate compliance with the EP&A Act.
While we did not find any issues that would make us question the integrity or independence of Commissioners, there remains a perception among some stakeholders that the Commission is not impartial. Some of these concerns are within the Commission’s control to fix, such as allowing individual speakers at public meetings extra time to discuss their issues, therefore avoiding perceptions of bias.
Other perceptions, such as the Commission being part of the Department and not an independent decision making authority, are outside the Commission’s immediate control. For example, the Commission receives applications at the end of the assessment process, after the Department has prepared an assessment report recommending whether the application should be approved. This means there are effectively two reports on an application; the Department’s assessment report and the Commission’s report on its decision. However, there is only one decision-maker: the Commission. This may cause community confusion about the roles of the Department and the Commission in the decision-making process. Clearer separation of their roles in assessing applications and preparing reports is needed.
To minimise the perception that the Commission is simply ‘rubber stamping’ the Department’s recommendations, assessment reports should not recommend whether or not a project be approved. Instead, they should provide the Department’s views on whether a project meets relevant legislative and policy requirements. The Commission should also be involved earlier in the process, so it can establish key facts and identify relevant issues sooner. It should request that the Department’s assessment report covers matters Commissioners consider particularly important when assessing projects under section 79C. Earlier referral of applications should also help the Commission to plan its work in assessing applications, and may reduce the time taken to reach a decision.
Unless these issues are addressed, stakeholders will continue to believe the Commission does not act in a transparent and impartial manner, which could erode public confidence in the Commission.
The Planning Assessment Commission
The Planning Assessment Commission (the Commission) is a planning authority established in 2008 under the Environmental Planning and Assessment Act 1979 (the EP&A Act). One of its functions is to make decisions on major development applications.
The Commission is independent of the Department of Planning and Environment (the Department) and the Minister for Planning. This means its decisions are not subject to the direction or control of the Department or the Minister.
The Department refers applications for major development to the Commission, including state significant development and infrastructure applications. These projects are generally initiated by the private sector. Applications are referred to the Commission when one or more of the following criteria are met:
- more than 25 objections are received about the proposal
- the local council objects to the proposal
- the applicant has donated $1,000 or more to a political party or member of parliament.
These applications are often controversial and may attract a high level of public interest. Of the 29 development applications the Commission received in 2015–16, almost 40 per cent were in the mining and energy sectors, and another 40 per cent related to urban development.
Section 79C of the EP&A Act outlines the matters the Commission must consider when making decisions about major development applications. These include:
- any relevant environmental and planning instruments
- likely environmental, social and economic impacts of the development
- suitability of the site for the development
- submissions received about the application
- the public interest.
In addition to making decisions about major development applications, the Commission also reviews major developments as part of the planning process, and provides independent expert advice to the government on planning and development matters. Since the Commission’s inception, it has provided advice on 76 matters, conducted 39 reviews, and made 444 decisions on development applications.
Process for approving major development applications
The Commission is one of three bodies that have a role in the planning and approval process for major development applications in New South Wales, as seen in Exhibit 1. The other two bodies are the Department of Planning and Environment, and the Land and Environment Court.
The Department determines the outcomes of major development applications. When an application meets one of the criteria listed above, it refers these to the Commission to make the decision. In certain circumstances, the Land and Environment Court hears appeals against decisions made by either the Department or the Commission.
A Memorandum of Understanding between the Commission and the Department sets out timeframes the Commission must meet when making a decision, specifically:
- two weeks where no stakeholder meetings are required
- three weeks where stakeholder meetings are required
- six weeks when a public meeting is required.
Parliamentary reference - Report number #279 - released 19 January 2017
Actions for Volume Seven 2011 focus on Law, Order and Emergency Services
Volume Seven 2011 focus on Law, Order and Emergency Services
The audits of these agencies’ financial statements for the year ended 30 June 2011 resulted in unmodified audit opinions within the Independent Auditor’s Reports. It is recommended that emergency services agencies continue to develop and implement comprehensive volunteer workforce management plans to ensure they have the right volunteer resources.
Actions for Volume Six 2011 focus on Environment, Water and Regional Infrastructure
Volume Six 2011 focus on Environment, Water and Regional Infrastructure
The Environment Protection Authority’s expenditure for the financial year 2010/11 was $92 million - $76 million of this was for environment protection and regulation. The Office of Environment and Heritage and the Environment Protection Authority commenced 145 prosecutions for environmental offences and 106 were completed in the financial year 2010/11, down from the 134 prosecutions completed in 2009/10. Financial penalties for 2010/11 totalled $969,000 down from $1,403,000 in 2009/10. The average fine decreased from $10,468 in 2009/10 to $9,141 in 2010/11.
Actions for Responding to Domestic and Family Violence
Responding to Domestic and Family Violence
Organisations generally work together to improve the safety of victims when there is an overt and serious crisis, particularly where children are involved. There are no standard ways for victims and perpetrators to access help that might prevent ongoing violence and address underlying issues. This is particularly problematic where there are repeat victims and perpetrators, many of whom have complex mental health, drug and alcohol problems and are difficult to work with. New South Wales has trialled a number of projects to improve the way that organisations work together to support vulnerable people in particular communities.
Parliamentary reference - Report number #218 - released 8 November 2011