Reports
Actions for Premier and Cabinet 2021
Premier and Cabinet 2021
This report analyses the results of our audits of the Premier and Cabinet cluster agencies for the year ended 30 June 2021.
Our preferred approach is to table the ‘Report on State Finances’ in Parliament before any other cluster report. This is because the 'Report on State Finances' focuses on the audit results and observations relating to the Total State Sector Accounts, in effect a consolidation of all government agencies. This year the 'Report on State Finances' has been delayed due to significant accounting issues being considered in the Total State Sector Accounts and which may impact the Treasury and Transport clusters.
As there are no outstanding matters relating to audits in the Premier and Cabinet cluster impacting the Total State Sector Accounts we have decided to break with normal practice and table this cluster report ahead of the ‘Report on State Finances’.
What the report is about
The results of the Premier and Cabinet cluster (the cluster) agencies' financial statement audits for the year ended 30 June 2021.
What we found
Unmodified audit opinions were issued for all Premier and Cabinet cluster agencies.
The number of monetary misstatements decreased from 49 in 2019–20 to 38 in 2020–21.
The Library Council of New South Wales corrected a prior period error of $325 million. In 2017, the council split its collection assets into six asset classes, but not the related asset revaluation reserves. To correct this error, some revaluation decrements previously recognised in asset revaluation reserves were reclassified to accumulated funds.
Eight agencies did not complete all of the mandatory early close procedures.
What the key issues were
The Premier and Cabinet cluster was impacted by three Machinery of Government (MoG) changes during 2020–21.
The changes resulted in the transfer of activities and functions in and out of the cluster and the creation of a new entity - Investment NSW.
The transferor entities continued to provide services to Investment NSW subsequent to 30 June 2021. There were no formal service level agreements in place for the provision of these services.
The New South Wales Electoral Commission (the Commission) and Sydney Opera House Trust obtained letters of financial support from their relevant Minister and/or NSW Treasury in 2020–21. The postponement of local government elections impacted the Commission's operations due to increased planned expenditure to support a COVID-safe election. Sydney Opera House Trust's ability to generate revenue was impacted due to the closure of the Concert Hall partly due to COVID-19 and planned renovations.
The number of repeated audit issues raised with management and those charged with governance increased from 22 in 2019–20 to 24 in 2020–21.
There were 47 moderate risk and 28 low risk findings identified. Of the total findings there were 24 repeat issues.
What we recommended
Investment NSW should ensure services received from other agencies are governed by service level agreements.
Fast facts
The Department of Premier and Cabinet supports the Premier and Cabinet to deliver the government's objectives, infrastructure, preparedness for disaster, incident recovery, arts and culture.
- $11.9b of property, plant and equipment as at 30 June 2021
- $4.4b total expenditure incurred in 2020-21
- 100% unqualified audit opinions were issued on agencies' 30 June 2021 financial statements
- 47 moderate risk findings were reported to management
- 38 monetary misstatements were reported in 2020-21
- 32% of all reported issues were repeat issues.
This report provides Parliament and other users of the Premier and Cabinet’s financial statements with the results of our audits, our observations, analysis, conclusions and recommendations in the following areas:
- financial reporting
- audit observations.
Financial reporting is an important element of good governance. Confidence and transparency in public sector decision making are enhanced when financial reporting is accurate and timely.
This chapter outlines our audit observations related to the financial reporting of agencies in the Premier and Cabinet cluster (the cluster) for 2021.
Section highlights
|
Appropriate financial controls help ensure the efficient and effective use of resources and administration of agency policies. They are essential for quality and timely decision making.
This chapter outlines our observations and insights from our financial statement audits of agencies in the Premier and Cabinet cluster.
Section highlights
|
Appendix one – Misstatements in financial statements submitted for audit
Appendix two – Early close procedures
Appendix three – Timeliness of financial reporting
Appendix four – Financial data
Copyright notice
© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.
Actions for Rail freight and Greater Sydney
Rail freight and Greater Sydney
What the report is about
The movement of freight contributes $66 billion annually to the NSW economy. Two thirds of all freight in NSW moves through Greater Sydney, and the volume of freight moving through Greater Sydney is expected to increase by 48 per cent by 2036.
This audit assessed the effectiveness of transport agencies in improving the use of rail freight capacity in Greater Sydney, and to meet current and future freight demand.
What we found
Transport agencies do not have strategies or targets in place to improve the efficiency or capacity of the metropolitan shared rail network for freight.
The transport agencies acknowledge that they do not have sufficient information to achieve the most efficient freight outcomes and they do not know how to use the shared rail network to maximise freight capacity without compromising passenger rail services.
The Freight and Ports Plan 2018-2023 contains one target for rail freight - to increase the use of rail at Port Botany to 28 per cent by 2021. However, Transport for NSW (TfNSW)'s data indicates this target will not be met.
Sydney Trains records data on train movements and collects some data on delays and incidents. TfNSW collects data for the construction of the Standard Working Timetable and third-party contracts.
However, a lack of clarity around what data is gathered and who has ownership of the data makes data sharing difficult and limits its analysis and reporting.
The Freight and Ports Plan 2018-2023 includes the goal of 'Reducing avoidable rail freight delays', but the transport agencies do not have any definition for an avoidable delay and, as a result, do not measure or report them.
TfNSW and Sydney Trains are appointed to manage and deliver the Transport Asset Holding Entity of New South Wales (TAHE)'s obligations to allow rail freight operators to use the shared rail network. There are no performance measures in rail freight operator contracts or inter-agency agreements. This limits transport agencies' ability to improve performance.
TfNSW’s Freight Branch is working on four freight-specific strategies; a review of the Plan, a freight rail strategy, a port efficiency strategy and a freight data strategy.
TfNSW has not yet determined the timeframes or intended outcomes of these strategies.
What we recommended
Transport agencies should:
- commit, as part of the review of Future Transport 2056, to delivering the freight-specific strategies currently in development and develop whole-of-cluster accountability for this work including timeframes, specific targets and clear roles and responsibilities
- improve the collection and sharing of freight data
- develop a plan to reduce avoidable freight delays
- systematically collect data on the management of all delays involving and/or impacting rail-freight
- develop and implement key performance indicators for the agreements between the transport agencies.
Fast facts
-
288 million tonnes of freight volume predicted to pass through Greater Sydney in 2036, up from 194 million in 2016 (an increase of 48%)
-
54 trucks that can be replaced by one 600 m long port shuttle freight train
-
26,671 freight trains that passed through the metropolitan shared rail network between 1 July 2020 and 30 June 2021
The movement of freight contributes $66.0 billion annually to the New South Wales economy — or 13 per cent of the Gross State Product. Two thirds of all freight in New South Wales moves through Greater Sydney, and the volume of freight moving through Greater Sydney is expected to increase by 48 per cent by 2036. This increasing demand is driven by increasing population and economic growth.
The sequence of activities required to move goods from their point of origin to the eventual consumer (the supply chain) is what matters most to shippers and consumers. Road can provide a single-mode door-to-door service, whereas conveying goods by rail typically involves moving freight onto road at some point. In Greater Sydney, 80 per cent of all freight is moved on road. Freight often passes through intermodal terminals (IMTs) as it transitions from one mode of transport to the next.
In 2016, Transport for NSW (TfNSW) released Future Transport 2056 - the NSW Government's 40-year vision for transport in New South Wales, which is intended to guide investment over the longer term. In Future Transport 2056, TfNSW noted that New South Wales will struggle to meet increasing demand for freight movements unless rail plays a larger role in the movement of freight.
Sydney Trains manages the metropolitan shared rail network, which is made up of rail lines that are used by both passenger and freight trains. The Transport Administration Act 1988 requires that, for the purposes of network control and timetabling, NSW Government transport agencies give ‘reasonable priority’ to passenger trains on shared lines. As the Greater Sydney population and rail patronage continue to grow, so too will competition for access to the shared rail network. See Appendix two for details of the area encompassed by Greater Sydney.
Freight operators can also use dedicated rail freight lines operated by the Australian Rail Track Corporation (ARTC - an Australian Government statutory-owned corporation). As the metropolitan shared rail network connects with dedicated freight lines, freight operators often use both to complete a journey.
TfNSW, Sydney Trains and the Transport Asset Holding Entity (TAHE) work in conjunction with other rail infrastructure owners and private sector entities, including port operators, privately operated IMTs and freight-shipping companies. TfNSW and Sydney Trains are responsible for managing the movement of freight across the metropolitan shared rail network. TAHE is the owner of the rail infrastructure that makes up the metropolitan shared rail network. The NSW Government established TAHE, a NSW Government state-owned corporation, on 1 July 2020 to replace the former rail infrastructure owner - RailCorp. The Auditor-General for New South Wales has commenced a performance audit on TAHE which is expected to table in 2022.
On 1 July 2021, TAHE entered into new agreements with TfNSW and Sydney Trains to operate, manage and maintain the metropolitan shared rail network. Until 30 June 2021, and in accordance with TAHE's Implementation Deed, TAHE operated under the terms of RailCorp's existing arrangements and agreements.
This audit assessed the effectiveness of TfNSW, Sydney Trains and TAHE in improving the use of rail freight capacity in Greater Sydney, and to meet current and future freight demand.
The audit focused on:
- the monitoring of access to shared rail lines
- the management of avoidable delays of rail freight movements
- steps to increase the use of rail freight capacity in Greater Sydney.
Conclusion
Transport agencies do not have clear strategies or targets in place to improve the freight efficiency or capacity of the metropolitan shared rail network. They also do not know how to make best use the rail network to achieve the efficient use of its rail freight capacity. These factors expose the risk that rail freight capacity will not meet anticipated increases in freight demand.
Future Transport 2056 notes that opportunities exist to shift more freight onto rail, and that making this change remains an important priority for the NSW Government. However, the transport agencies acknowledge that they do not have sufficient information to achieve the most efficient freight outcomes. In particular, transport agencies do not know how to use the shared rail network in a way that maximises freight capacity without compromising passenger rail services.
Neither Future Transport 2056 nor the Freight and Ports Plan 2018–2023 give any guidance on how transport agencies will improve the efficiency or capacity of the shared rail network. Other than a target for rail freight movements to and from Port Botany, which TfNSW's data indicates will not be met, there are no targets for improving rail freight capacity across the shared network. The lack of specific strategies, objectives and targets reduces accountability and makes it difficult for transport agencies to effectively improve the use of rail freight capacity in line with their commitment to do so.
Sydney Trains and Transport for NSW do not effectively use data to improve rail freight performance and capacity.
To drive performance improvement when planning for the future, transport agencies need good quality data on freight management and movements. Sydney Trains records data on train movements in real-time and collects some data on delays and incidents. TfNSW collects data for the construction of the Standard Working Timetable (SWTT) and third-party contracts. However, the different types of data gathered and the separation between the teams responsible mean that there is a lack of clarity around what data is gathered and who has ownership it. This lack of coordination prevents best use of the data to develop a single picture of how well the network is operating or how performance could be improved.
Sydney Trains' ability to evaluate the effectiveness of its incident and delay mitigation strategies is also limited by a lack of information on its management of rail-freight related delays or incidents. While Sydney Trains collects data on major incidents, it can only use this to conduct event-specific analysis on the causes of an incident, and to review the operational and management response. The use of complete and accurate incident data would assist to define, identify and reduce avoidable delays. Reducing avoidable delays is a goal of the Freight and Ports Plan 2018–2023. More complete data on all incidents would help TfNSW to have more effective performance discussions with rail freight operators to help improve performance.
TfNSW has started developing strategies to identify how it can use rail freight capacity to achieve efficient freight outcomes, but it has not committed to implementation timeframes for this work.
TfNSW’s Freight Branch has started work on four freight-specific strategies to improve freight efficiency: a review of the Plan, a freight rail strategy, a port efficiency strategy and a freight data strategy. However, none of these strategies will be fully developed before the end of 2022. TfNSW has not yet determined the implementation timeframes or intended outcomes of these strategies, although TfNSW reports that it is taking an iterative approach and some recommendations and initiatives will be developed during 2022.
Appendix one - Response from agencies
Appendix two - The Greater Sydney region
Appendix three - TfNSW strategic projects
Appendix four - Sydney Trains path priority principles
Appendix five - Sydney Trains delay management
Appendix six - About the audit
Appendix seven - Performance auditing
Copyright notice
© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.
Parliamentary reference - Report number #357 - released (19 October 2021).
Actions for Managing cyber risks
Managing cyber risks
What the report is about
This audit assessed how effectively Transport for NSW (TfNSW) and Sydney Trains identify and manage their cyber security risks.
The NSW Cyber Security Policy (CSP) sets out 25 mandatory requirements for agencies, including implementing the Australian Cyber Security Centre’s Essential 8 strategies to mitigate cyber security incidents, and identifying the agency’s most vital systems, their ‘crown jewels’.
The audited agencies have requested that we do not disclose detail of the significant vulnerabilities detected during the audit, as these vulnerabilities are not yet remediated. We provided a detailed report to the agencies in December 2020 outlining significant issues identified in the audit. We have conceded to the agencies' request but it is disappointing that transparency to the Parliament and the public on issues that potentially directly affect them needs to be limited in this way.
What we found
TfNSW and Sydney Trains are not effectively managing their cyber security risks.
Both agencies have assessed their cyber security risks as unacceptably high and both agencies had not identified all of the risks we detected during this audit – some of which are significant.
Both agencies have cyber security plans in place that aim to address cyber security risks. TfNSW and Sydney Trains have combined this into the Transport Cyber Defence Rolling Program, part of the Cyber Defence Portfolio (CDP).
However, neither agency has reached its target ratings for the CSP and the Essential 8 and maturity is low in relation to significant risks and vulnerabilities exposed.
Further, neither agency is fostering a culture where cyber security risk management is an important and valued aspect of decision-making.
TfNSW is not implementing cyber security training effectively across the cluster with only 7.2% of staff having completed basic cyber security training.
What we recommended
TfNSW and Sydney Trains should:
- develop and implement a plan to uplift the Essential 8 controls to the agency's target state
- as a matter of priority, address the vulnerabilities identified as part of this audit and previously described in a detailed Audit Office report provided to both agencies
- ensure cyber security risk reporting to executives and the Audit and Risk Committee
- collect supporting information for the CSP self assessments
- classify all information and systems according to importance and integrate this with the crown jewels identification process
- require more rigorous analysis to re-prioritise CDP funding
- increase uptake of cyber security training.
TfNSW should assess the appropriateness of its target rating for each of the CSP mandatory requirements.
Department of Customer Service should:
- clarify the requirement for the CSP reporting to apply to all systems
- require agencies to report the target level of maturity for each mandatory requirement.
Fast facts
- $42m Total value of the Transport Cyber Defence Rolling Program over three years.
- 7.2% Percentage of staff across the Transport cluster who had completed introductory cyber security training
Response to requests by audited agencies to remove information from this report
In preparing this audit report, I have considered how best to balance the need to support public accountability and transparency with the need to avoid revealing information that could pose additional risk to agencies’ systems. This has involved an assessment of the appropriate level of detail to include in the report about the cyber security vulnerabilities identified in this audit.
In making this assessment, the audit team consulted with Transport for NSW (TfNSW), Sydney Trains, and Cyber Security NSW to identify content which could potentially pose a threat to the agencies’ cyber security.
In December 2020, my office also provided TfNSW and Sydney Trains with a detailed report of many of the significant vulnerabilities identified in this audit, to enable the agencies to address the cyber security risks identified. The detailed report was produced as a result of a 'red team' exercise, which was conducted with both agencies' knowledge and consent. The scope of this exercise reflected the significant input provided by both agencies. More information on this exercise is at page 12 of this report.
TfNSW and Sydney Trains have advised that in the six months from December 2020 and at the time of tabling this audit report, they have not yet remediated all the vulnerabilities identified. As a result, they, along with Cyber Security NSW, have requested that we not disclose all information contained in this audit report to reduce the likelihood of an attack on their systems and resulting harm to the community. I have conceded to this request because the vulnerabilities identified have not yet been remediated and leave the agencies exposed to significant risk.
It should be stressed that the risks identified in the detailed report exist due to the continued presence of these previously identified vulnerabilities, rather than due to their potential publication. The audited agencies, alone, are accountable for remediating these vulnerabilities and addressing the risks they pose.
It is disappointing that transparency to the Parliament and the public on issues that potentially directly affect them needs to be limited in this way.
That said, the conclusions drawn in this report are significant in terms of risk and remain valid, and the recommendations should be acted upon with urgency.
Cyber security risk is an increasing area of concern for governments in Australia and around the world. In recent years, there have been a number of high-profile cyber security attacks on government entities in Australia, including in New South Wales. Malicious cyber activity in Australia is increasing in frequency, scale, and sophistication. The Audit Office of New South Wales is responding to these risks with a program of audits in this area, which aim to identify the effectiveness of particular agencies in managing cyber risks, as well as their compliance with relevant policy.
Cyber Security NSW, part of the Department of Customer Service (DCS) releases and manages the NSW Cyber Security Policy (CSP). The CSP sets out 25 mandatory requirements for agencies, including making it mandatory for agencies to implement the Australian Cyber Security Centre Essential 8 Strategies to Mitigate Cyber Security Incidents (the Essential 8). The Essential 8 are key controls which serve as a baseline set of protections which agencies can put in place to make it more difficult for adversaries to compromise a system. Agencies are required to self-assess their maturity against the CSP and the Essential 8, and report that assessment to Cyber Security NSW annually.
The CSP makes agencies responsible for identifying and managing their cyber security risks. The CSP sets out responsibilities and governance regarding risk identification, including making agencies responsible for identifying their 'crown jewels', the agency's most valuable and operationally vital systems. Once these risks are identified, agencies are responsible for developing a cyber security plan to mitigate those risks.
This audit focussed on two agencies: Transport for NSW (TfNSW) and Sydney Trains. TfNSW is the lead agency for the Transport cluster and provides a number of IT services to the entire cluster, including Sydney Trains. This audit focussed on the activities of TfNSW's Transport IT function, which is responsible for providing cyber security across the cluster, as well as directly overseeing four of TfNSW's crown jewels. Sydney Trains is one of the agencies in the Transport cluster. While it receives some services from TfNSW, it is also responsible for implementing its own IT controls, as well as controls to protect its Operational Technology (OT) environment. This OT environment includes systems which are necessary for the operation and safety of the train network.
To test the mitigations in place and the effectiveness of controls, this audit involved a 'red team' simulated exercise. A red team involves authorised attackers seeking to achieve certain objectives within the target's environment. The red team simulated a determined external cyber threat actor seeking to gain access to TfNSW's systems. The red team also sought to test the physical security of some Sydney Trains' sites relevant to the agency's cyber security. The red team exercise was conducted with the knowledge of TfNSW and Sydney Trains.
This audit included the Department of Customer Service as an auditee, as they have ownership of the CSP through Cyber Security NSW. This audit did not examine the management of cyber risk in the Department of Customer Service.
This audit assessed how effectively selected agencies identify and manage their cyber security risks. The audit assessed this with the following criteria:
- Are agencies effectively identifying and planning for their cyber security risks?
- Are agencies effectively managing their cyber security risks?
Following this in-depth portfolio assessment, the Auditor-General for NSW will also table a report on NSW agencies' compliance with the CSP in the first quarter of 2021–22.
Conclusion
Transport for NSW and Sydney Trains are not effectively managing their cyber security risks. Significant weaknesses exist in their cyber security controls, and both agencies have assessed that their cyber risks are unacceptably high. Neither agency has reached its Essential 8 or Cyber Security Policy target levels. This low Essential 8 maturity exposes both agencies to significant risk. Both agencies are implementing cyber security plans to address identified cyber security risks.
This audit identified other weaknesses, such as low numbers of staff receiving basic cyber security awareness training. Cyber security training is important for building and supporting a cyber security culture. Not all of the weaknesses identified in this audit had previously been identified by the agencies, indicating that their cyber security risk identification is only partially effective.
Agency executives do not receive regular detailed information about cyber risks and how they are being managed, such as information on mitigations in place and the effectiveness of controls for cyber risk. As a result, neither agency is fostering a culture where cyber security risk management is an important and valued aspect of executive decision-making.
TfNSW and Sydney Trains are partially effective at identifying their cyber security risks and both agencies have cyber security plans in place
Both agencies regularly carry out risk assessments and have identified key cyber security risks, including risks that impact on the agencies' crown jewels. These risks have been incorporated into the overall enterprise risk process. However, neither agency regularly reports detailed cyber risk information to agency executives to adequately inform them about cyber risk. The Cyber Security Policy (CSP) requires agencies to foster a culture where cyber security risk management is an important and valued aspect of decision-making. By not informing agency executives in this way, TfNSW and Sydney Trains are not fulfilling this requirement.
Agencies' cyber security risk assessment processes are not sufficiently comprehensive to identify all potential risks. Not all of the weaknesses identified in this audit had previously been identified by the agencies.
To address identified cyber security risks, both agencies have received funding approval to implement cyber security plans. TfNSW first received approval for its cyber security plan in 2017. Sydney Trains received approval for its cyber security plan in February 2020. In 2020–21 TfNSW and Sydney Trains combined their plans into the Transport Cyber Defence Rolling Program business case valued at $42.0 million over three years. This is governed as part of a broader Cyber Defence Portfolio (CDP). The CDP largely takes a risk-based approach to annual funding. The Cyber Defence Portfolio Steering Committee and Board can re-allocate funds from an approved project to a different project. This re-allocation process could be improved by making it more risk-based.
TfNSW and Sydney Trains are not effectively managing their cyber security risks
Neither agency has fully mitigated its cyber security risks. These risks are significant. Neither TfNSW nor Sydney Trains have reduced their cyber risk to levels acceptable to the agencies. Both agencies have set a risk tolerance for cyber security risks, and the identified enterprise-level cyber security risks remain above this rating. Both agencies' self-attested maturity against the Essential 8 remains low in comparison to the agencies' target levels, and in relation to the significant risks and vulnerabilities that are exposed. Little progress was made against the Essential 8 in 2020.
Neither agency has reached its target levels of maturity for the CSP mandatory requirements. Not reaching the target rating of the CSP mandatory requirements risks information and systems being managed inconsistently or not in alignment with good governance principles. The Transport Cyber Defence Rolling Program has a KPI to achieve a target rating of three for all CSP requirements where business appropriate. TfNSW considers this target rating to be its target for all the CSP requirements. However TfNSW has not undertaken analysis to determine whether this target is appropriate to its business.
The CSP makes agencies accountable for the cyber risks of their ICT service providers. While both agencies usually included their cyber security expectations in contracts with third-party suppliers, neither agency was routinely conducting audits to ensure that these expectations were being met.
The CSP requires agencies to make staff aware of cyber security risks and deliver cyber security training. TfNSW is responsible for delivering cyber security training across the Transport cluster, including in Sydney Trains. TfNSW was not effectively delivering cyber security training across the cluster because training was not mandatory for all staff at the time of the audit and completion rates among those staff assigned the training was low. As such, only 7.2 per cent of staff across the Transport cluster had completed introductory cyber security training as at January 2021.
Agencies have assessed their cyber risks as being above acceptable levels
An agency's risk tolerance is the amount of risk which the agency will accept or tolerate without developing further strategies to modify the level of risk. Risks that are within an agency's risk tolerance may not require further mitigation and may be deemed acceptable, while risks which are above the agency's risk tolerance likely require further mitigation before they become acceptable to the agency.
Both agencies have defined their risk tolerance and have identified risks which are above this level, indicating that they are unacceptable to the agency. TfNSW has defined 'very high' risks as generally intolerable and 'high' risks as undesirable. Its risk tolerance is 'medium'. Sydney Trains has four classifications of risk: A, B, C and D. A and B risks are deemed 'unacceptable' and 'undesirable' respectively, while C risks are considered 'tolerable'. This aligns with the TfNSW definition of a medium risk tolerance.
Transport IT reported five enterprise-level cyber security risks through its enterprise risk reporting tool in September 2020, all of which relate to cyber security or have causes relating to cyber security. These risks are in aggregate form, rather than relating to specific vulnerabilities. At the time of the audit, one of these risks was rated as very high and the other four rated as high. At this time, Transport IT had identified a further seven divisional-level risks which were above the agency’s risk tolerance.
Similarly, Sydney Trains has identified one main cyber security risk in its IT enterprise-level risk register and another with a potential cyber cause. Both of these IT risks are deemed to have a residual risk of ‘unacceptable’.
Similarly, two cyber-related OT risks have been determined to be above the agency's risk tolerance. One risk is rated as 'unacceptable'. Another risk, while not entirely cyber rated, is rated 'undesirable' and is deemed to have some causes which may stem from a cyber-attack.
Agencies have assessed their current cyber risk mitigations as requiring improvement
In addition to the risk ratings stated above, at the time of the audit neither agency believed that its controls were operating effectively. Transport IT had rated the control environments for its cyber security enterprise risks as 'requires improvement'. Mitigations were listed in the risk register for these risks but, in some cases, they were unlikely to reduce the risk to the target state or by the target date. For example, one risk had actions listed as 'under review' and no further treatment actions listed, but a due date of July 2021, while another risk was being treated by the CDP with a due date of July 2021. The CDP identified in May 2020 that while the average risk identified as part of that program will be reduced to a medium level by this date, ten high risks will still remain. Given the delays in the program, this number may be higher. As such, it seems unlikely that the enterprise risk will be reduced to below a 'high' level by July 2021.
Sydney Trains’ IT and OT risk registers cross-reference controls and mitigations against the causes and consequences. The IT cyber security risk identified in the register had causes with no mitigations designed for them. Further, some of these causes did not have future mitigations designed for them. This risk also had controls in place which are identified as partially effective. For the unacceptable OT risk noted above, while there was a control designed for each of the potential causes, Sydney Trains had identified all of the controls in place as either partially effective or ineffective. This indicates that Sydney Trains was not effectively mitigating the causes of its cyber risks and, even where it had designed controls or mitigations, these were not always implemented to fully mitigate the cause of the risk.
Additional information on gaps in cyber mitigations which were exposed in the course of this audit has been detailed to both agencies. The Foreword of this report provides information about why this detail is not included here.
Essential 8 maturity is low across TfNSW and Sydney Trains and little progress was made in 2020
CSP mandatory requirement 3.2 states that agencies must implement the ACSC Essential 8. Agencies must also rate themselves against each of the Essential 8 on a maturity scale from zero to three and report this to Cyber Security NSW. A full list of the Essential 8 can be found in Exhibit 1. Both agencies have a low level of maturity against the Essential 8 not just in comparison to the targets they have set, but also in relation to the risks and vulnerabilities exposed. Both agencies have set target maturity ratings for the Essential 8 but none of the Essential 8 ratings across either agency are currently implemented to this level. Having a low level of Essential 8 maturity exposes both agencies to significant risks and vulnerabilities. Little progress was made between the 2019 and 2020 attestation periods.
Transport IT has set a target rating of three across all of the Essential 8. Sydney Trains has set a target rating of three for its IT systems. Sydney Trains had an interim target of two for its OT systems in 2020 and advised that this has since increased to three. It should be noted that not all the Essential 8 are applicable to OT systems.
None of the Essential 8 ratings across either agency are currently implemented to the target levels. Given that the Essential 8 provide the controls which are most commonly able to deter cyber-attacks, having maturity at a low level potentially exposes agencies to a cyber security attack.
Some work is underway across both TfNSW and Sydney Trains to improve the Essential 8 control ratings. The CDP provided some resources to the Essential 8 over 2019–20, with uplift focusing on specific systems. The CDP work in 2019 and 2020 relevant to the Essential 8 largely focussed on determining the current state of the Essential 8 and creating a target state roadmap. As a result, there was little improvement between the 2019 and 2020 attestation periods. The CDP has a workstream for the Essential 8 in its FY 2020–21 funding allocation, however as noted above in Exhibit 6 this was delayed as resources were redeployed to Project La Brea. Regardless, work on some specific aspects of the Essential 8 remain part of the 2020–21 CDP allocation, with workstreams allocated to improving three of the Essential 8. In addition, some work from Project La Brea should lead to an improvement in the Essential 8.
Sydney Trains' Cyber Uplift Program included a workstream which had in scope the uplift in the Essential 8 in IT. There were also other workstreams which aimed to improve some of the Essential 8 for OT systems. Work is also ongoing as part of the CDP to uplift these scores in Sydney Trains.
TfNSW and Sydney Trains have not reached their target maturity across the CSP mandatory requirements and TfNSW has not evaluated its cluster-wide target to ensure it is appropriate
Cyber Security NSW allows each agency to determine its target level of maturity for the first 20 CSP mandatory requirements. Agencies can tailor their target levels to their risk profile. Not reaching the target rating of the CSP mandatory requirements risks information and systems being managed inconsistently or not in alignment with good governance principles.
Sydney Trains has set its target level of maturity for IT and OT. All of Sydney Trains' target maturity levels are at least a three (defined), with a target of four (quantitatively managed) for many of the mandatory requirements. While Cyber Security NSW does not currently mandate a minimum level of maturity, in 2019 there was a requirement for each agency to target a minimum level of three.
Sydney Trains has not met its target ratings across the mandatory requirements.
The Transport Cyber Defence Rolling Program has a program KPI to ensure that the entire cluster reaches a minimum maturity level of three against all the CSP requirements by 2023. TfNSW has not reviewed its CSP mandatory requirement targets to determine if a three is desirable for all requirements or if a higher target level may be more appropriate. It is important for senior management to set cyber security objectives as a demonstration of leadership and a commitment to cyber security.
TfNSW has not met its target ratings across the mandatory requirements for its Group IT ISMS, which was the focus of this audit.
Both agencies claimed progress in their implementation of the mandatory requirements between 2019 and 2020. The audit did not seek to verify the self-assessed results from either agency.
Both agencies operate ISMS in line with the CSP
CSP mandatory requirement 3.1 requires agencies to implement an Information Security Management System (ISMS) or Cyber Security Framework (CSF), with scope at least covering systems identified as the agency's ‘crown jewels’. The ISMS or CSF should be compliant with, or modelled on, one or more recognised IT or OT standard. As noted in the introduction, an ISMS ‘consists of the policies, procedures, guidelines, and associated resources and activities, collectively managed by an organisation, in the pursuit of protecting its information assets.’ Both agencies operate an ISMS compliant with the CSP requirement.
As noted in the introduction, TfNSW operates four ISMS. The Transport IT ISMS is certified against ISO27001, the most common standard for ISMS certification. Three of TfNSW’s six crown jewels are managed within this ISMS. The other ISMS are not certified to relevant standards, though TfNSW claims that they align with relevant controls. This is sufficient for the purposes of the CSP.
Sydney Trains operates two ISMS, one for IT and another for OT. Neither of these are certified to relevant ISMS Standards, however there have been conformance reviews of both IT and OT with relevant standards. These ISMS cover all crown jewels in the agency.
There are currently 11 ISMS in operation across the Transport cluster. TfNSW has proposed moving towards a holistic approach to these ISMS, with the CDP Board responsible for governing the available security controls and directing agency IT and OT teams to implement these.
Agencies are not routinely conducting audits of third-party suppliers to ensure compliance with contractual obligations
CSP mandatory requirement 1.5 makes agencies accountable for the cyber risks of their ICT service providers and ensuring that providers comply with the CSP and any other relevant agency security policies. The ACSC has provided advice on what organisations should do when managing third party suppliers of ICT. The ACSC advises that organisations should use contracts to define cyber security expectations and seek assurance to ensure that these contract expectations are being met. While both agencies usually include specific cyber security expectations in contracts, neither is routinely seeking assurance that these expectations are being met.
The NSW Government has mandated the use of the 'Core& One' contract template for low-value IT procurements and the Procure IT contract template for high-value IT procurements. Both of these contracts contain space for the procuring agency to include cyber security controls for the contractor to implement. The Procure IT contract template also includes a right-to-audit clause which allows agencies to receive assurance around the implementation of these controls. TfNSW and Sydney Trains used the mandated contracts for relevant contracts examined as part of this audit.
TfNSW included security controls in all the contracts examined as part of this audit. Compliance with ISO27001 was the most commonly stated security expectation. Of the contracts examined as part of this audit, only one contract did not have a right-to-audit clause. This contract was signed in October 2016. While these clauses are in place, TfNSW rarely conducted these audits on its third-party providers. Of the eight TfNSW contracts examined in detail, only two of these had been audited to confirm compliance with the stated security controls.
Sydney Trains included security controls in all but one of the contracts examined as part of this audit. Sydney Trains did not require contractors to be compliant with ISO27001, but only required compliance with whole-of-government policies. Sydney Trains does not routinely conduct audits of its third-party suppliers, however it did conduct deep-dive risk analyses of its top ten highest risk IT suppliers. This involved a detailed review of both the suppliers' security posture and also the contract underpinning the relationship with the supplier.
The CDP funding for 2020–21 includes a workstream for strategic third-party contract remediation. This funding is to conduct some foundational work which will allow the CDP to make further improvements in future years. While this funding will not address gaps in contract requirements or management across all contracts, this workstream aims to reduce the risks posed by strategic suppliers covering critical assets. Similarly, work is currently underway as part of the CDP to conduct OT risk assessments for key suppliers to Sydney Trains in a similar way to the work undertaken for IT suppliers.
Sydney Trains has risk assessed its third-party suppliers but TfNSW has not done so
It is important to conduct a risk assessment of suppliers to identify high-risk contractors. This allows agencies to identify those contractors who may require additional controls stated in the contract, those who require additional oversight, and also where auditing resources are best targeted.
Sydney Trains has risk assessed all its IT suppliers and, as noted above, has conducted a deep-dive risk analysis of its top ten highest risk suppliers. TfNSW has not undertaken similar analysis of its key suppliers, however it has identified risks attached to each of its strategic suppliers and has documented these. As a result of not risk assessing its suppliers, TfNSW cannot take a targeted approach to its contract management.
TfNSW demonstrated poor records handling relating to the contracts examined as part of this audit
TfNSW was not able to locate one of the contracts requested as part of the audit's sample. Other documentation, such as contract management plans, could not be located for many of the other contracts requested as part of this audit. These poor document handling practices limits TfNSW's ability to effectively oversee service providers and ensure that they are implementing agreed controls. It also limits public transparency on the effectiveness of these controls.
The Transport cluster is not effectively implementing cyber security awareness training
Agencies are responsible for implementing regular cyber security education for all employees and contractors under mandatory requirement 2.1 in the CSP. TfNSW is responsible for delivering this training to the whole Transport cluster, including Sydney Trains. The Transport cluster has basic cyber awareness training available for all staff. TfNSW also offers additional training provided by Cyber Security NSW targeted at executives and executive assistants. While TfNSW has training available to staff, it is not delivering this effectively. TfNSW does not make training mandatory for most staff nor does it require staff to repeat training regularly. Even among those staff who have been assigned the training, completion rates are low, meaning that delivery is not effectively monitored. Cyber security training is important for building and supporting a cyber security culture.
TfNSW is responsible for creating and rolling out all forms of training to agencies within the Transport cluster. Both TfNSW and Sydney Trains have the same mandatory cyber awareness training that is automatically assigned to new starters. At the time of the audit, this training was not mandatory for ongoing staff. TfNSW does make additional cyber security training available to staff who can choose to undertake the training themselves, or can be assigned the training by their manager. All TfNSW cyber security training is delivered via online modules and it is the responsibility of managers to ensure that it is completed.
Cyber security training completion rates for both TfNSW and Sydney Trains are low. Only 13.5 per cent of staff across the Transport cluster had been assigned the Cyber Safety for New Starters training as of January 2021. Although this course is mandatory for new starters, only 53 per cent of staff assigned the Cyber Safety for New Starters training module had completed the course by January 2021. As a result, only 7.2 per cent of staff across the entire Transport cluster had completed this training at that time. In Sydney Trains, less than one per cent of staff had completed this training as at January 2021 and a further 7.6 per cent of staff have completed the 'Cyber Security: Beyond the Basics' training. These low completion rates indicate that TfNSW is not effectively rolling out cyber security training across the cluster.
In October 2020, the Department of Customer Service released 'DCS-2020-05 Cyber Security NSW Directive - Practice Requirement for NSW Government', which made annual cyber security training mandatory for all staff from 2021. In line with this requirement, TfNSW has advised that it will be gradually implementing mandatory annual training from July 2021 for all staff.
The Transport cluster undertakes activities to build a cyber-aware culture in accordance with the CSP, but awareness remains low
Increasing staff awareness of cyber security risks and maintaining a cyber secure culture are both mandatory requirements of the CSP. While TfNSW does undertake some activities to build a cyber aware culture, awareness of cyber security risks remains low. This can be demonstrated by the low training rates outlined above, and the 'Spot the Scammer' exercise, described in Exhibit 7. TfNSW is responsible for delivering these awareness raising activities across the cluster.
TfNSW frequently communicates with staff across the Transport cluster about various cyber security risks through multiple avenues. Both agencies use the intranet, emails and other awareness raising activities to highlight the importance for staff to be aware of the seriousness of cyber risks. Advice given on the intranet includes tips for spotting scammers on mobile phones, promoting the cluster-wide training courses, as well as various advice that staff could use when dealing with cyber risks in the workplace.
In addition to these awareness raising activities, TfNSW has also undertaken a cluster-wide phishing email exercise called 'Spot the Scammer'. This is outlined in Exhibit 7. This exercise was carried out in 2019 and 2020 and allowed the Transport cluster to measure the degree to which staff were able to identify phishing emails. As can be seen in Exhibit 7, the results of this exercise indicate that staff awareness of phishing emails remains low.
In both 2019 and 2020, TfNSW performed a ‘Spot the Scammer’ exercise in which they sent out over 25,000 emails to staff based on a real phishing attack in order to measure awareness and response. The exercise tested staff 'click through rate', the percentage of staff who clicked on the fake phishing link. In 2019, these results were then compared to industry benchmarks, with over a 20 per cent click through rate being considered 'very high'. Both TfNSW and Sydney Trains were considered to have a ‘very high’ click through rate in comparison to these benchmarks in both 2019 and 2020. This indicates that staff awareness of phishing emails was low. The click through rate for TfNSW was 24 per cent in 2020, an increase from 22 per cent in 2019. For Sydney Trains, the click through rate in 2020 was 32 per cent, which was a decrease from 40 per cent in 2019. |
Appendix one – Response from agencies
Appendix two – Cyber Security Policy mandatory requirements
Appendix three – About the audit
Appendix four – Performance auditing
© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.
Parliamentary reference - Report number #353 - released (13 July 2021).
Actions for WestConnex: changes since 2014
WestConnex: changes since 2014
What the report is about
The report examined whether Transport for NSW (TfNSW) and Infrastructure NSW (INSW) effectively assessed and justified major scope changes to the WestConnex project since 2014.
What we found
NSW Government decisions to fund WestConnex-related projects outside WestConnex's $16.812 billion budget have reduced transparency and understate the full cost of WestConnex.
The NSW Government's decision to separate Sydney Gateway from WestConnex has reduced transparency over the cost of the road component of Sydney Gateway. $1.76 billion of the cost to complete Sydney Gateway is funded outside the WestConnex budget.
Network integration costs, currently estimated at $2.3 billion, are also funded outside the WestConnex budget. Many of these costs are directly attributable to WestConnex and ought to be included in the reported budget.
The Parramatta Road Urban Amenity Improvement Program, costing $198 million, should also be included as part of the WestConnex reported budget.
Decisions to exclude or remove these elements from WestConnex without justification have seen $4.26 billion of projects funded outside the $16.8 billion budget.
Positively, robust analysis was used to develop and incorporate design improvements into the 2015 WestConnex Updated Strategic Business Case.
The separate components of WestConnex underwent all required assurance reviews. However, the NSW Government's assurance framework does not require ongoing ‘whole-of-program’ assurance for large and complex projects like WestConnex. The absence of a holistic review of WestConnex allows for some costs and benefits to avoid scrutiny.
What we recommended
TfNSW should:
- review the impact of scope changes on project objectives, costs and benefits for complex infrastructure projects
- ensure that estimated costs and benefits of works which are reasonably required to meet consent conditions are included in business cases for complex large infrastructure projects
- establish centralised and project specific record keeping for major infrastructure projects.
Infrastructure NSW should provide transparent whole of program assurance on total costs and benefits when complex projects are split into sub-projects.
Government should consider enhancing public transparency of existing infrastructure assurance processes by requiring that large complex infrastructure programs undergo periodic review at a whole-of-program level.
Fast facts
|
WestConnex
WestConnex is a 33 km motorway network that will link the western and south‑western suburbs with the Sydney CBD and the Airport and Port Botany precinct. It will also connect with proposed future motorway links to the north shore, northern beaches, and southern Sydney. The project is being delivered in three stages, with completion scheduled for 2023.
When first conceived by Infrastructure NSW (INSW) in 2012, WestConnex was described as a single integrated concept. In August 2013, government approved a business case for an integrated concept of WestConnex, with an estimated cost of $14.881 billion (in nominal outturn costs). Transport for NSW (TfNSW) is the government agency (sponsor agency) accountable for the delivery of WestConnex in accordance with the business case. In August 2014, the NSW Government established the Sydney Motorway Corporation to fund, deliver and operate WestConnex.
In November 2015, the NSW Government publicly released an updated WestConnex business case with greater detail and design enhancements, which increased the estimated cost to $16.812 billion.
Subsequent to this update, further changes were made to the design, including realignment of the M4 to M5 Link connection to the Western Harbour Tunnel project, an expanded interchange at Rozelle, the deletion of the Camperdown Intersection, and the addition of the Iron Cove Link. The reported budget for WestConnex was not changed as a result of these design updates.
To fund WestConnex, Sydney Motorway Corporation consolidated a concessional loan of $2 billion from the Australian Government, private sector debt and equity funding from the State. The Australian Government also provided a $1.5 billion contribution to the State to partially fund construction of WestConnex.
In August 2018, the NSW Government sold 51 per cent of its stake in Sydney Motorway Corporation for $9.26 billion. At the time of writing, the NSW Government is in the process of selling its remaining 49 per cent stake of Sydney Motorway Corporation.
About this audit
In the course of delivering a complex major infrastructure project, it is reasonable to expect changes to the original design and scope. Changes may occur as the design moves from a high‑level concept to a detailed design for project delivery, as new risks or issues are identified, as demands change, or as other interdependent projects are approved. Changes can also occur in response to potential cost or delivery overruns which arise as a result of planning deficiencies. Where design and scope changes significantly change the project costs and/or expected benefits, the justification for these changes should be robust and transparent.
Following our 2014 performance audit, 'WestConnex: Assurance to the government', the NSW Government established the Infrastructure Investor Assurance Framework (IIAF) to improve accountability and transparency over major projects that are developed, procured, or delivered by government agencies. Under the framework, TfNSW, as project sponsor, is responsible for ensuring the WestConnex project meets all IIAF requirements. These include ensuring the project remains strategically aligned and viable, and benefits are on track. INSW is responsible for coordinating the assurance review process and reporting directly to NSW Cabinet on project delivery against time, budget and risks to project delivery.
The objective of this performance audit is to assess whether TfNSW and INSW effectively assessed and justified major scope changes to the WestConnex project since 2014.
ConclusionGovernment decisions to separate WestConnex related projects and deliver them outside WestConnex's 2015 business case budget of $16.812 billion has understated the total cost of WestConnex achieving its objectives. The rationale for separating these elements from the WestConnex project scope has not been transparent. Together, these projects represent costs of $4.26 billion funded outside the $16.812 billion WestConnex budget. Since 2015, the NSW Government has removed several projects from the scope described in the 2015 WestConnex business case, and funded them separately:
Work required to integrate WestConnex with existing roads ('network integration') was funded outside the $16.812 billion budget for the November 2015 WestConnex business case. TfNSW is obliged to deliver network integration works to meet the conditions of planning approval for WestConnex. As such, these costs should be included in the WestConnex budget. The current estimated cost of these network integration works is $2.3 billion. The rationale to exclude or remove each of these elements from the WestConnex project scope has not been transparent, nor supported by robust analysis and justification. These elements are required for WestConnex to achieve its objectives. The additional project costs will also deliver additional benefits not included in the 2015 WestConnex business case. Removing them understates the total cost of achieving the objectives set out in the 2013 and 2015 WestConnex business cases. WestConnex's complex financing arrangements further reduce transparency on costs. Transparency over the total cost of WestConnex – including elements funded from other project budgets – is further limited by the project's complex financing arrangements. Prior to 2018, the Audit Office provided assurance on costs borne and levied by Sydney Motorway Corporation and its controlled entities. Since the NSW Government sold its majority stake in WestConnex in August 2018, the Auditor‑General no longer has the mandate to provide this assurance. Considering this, and the lack of transparency on the cost of projects removed from the WestConnex project scope, there is no transparent or comprehensive view of the total cost to deliver WestConnex – nor of how these cost would be offset by the sale of the government's remaining stake. There is no 'whole‑of‑program' assurance over the WestConnex program of works. This limits transparency and confidence that WestConnex will meet intended objectives within its budget. After INSW conducted a gateway review of a draft of the 2015 WestConnex Business Case under the IIAF, the project was broken up into separate components to support staged delivery. Each of these projects, including the Sydney Gateway, as well as the Network Integration Program, underwent the required assurance reviews under the IIAF. INSW also provided monthly progress updates to government. These individual projects are, in themselves, significant in scale and complexity. Addressing them as discrete components for the purposes of the assurance review process is justified and there is no requirement under the IIAF to holistically review projects which together deliver final benefits of the WestConnex program. However, whole‑of‑program review would improve transparency over total costs and benefits. In 2016, TfNSW revised the design of the M4‑M5 Link and Rozelle to address traffic and integration issues. TfNSW identified that the concept designs used for the M4‑M5 Link and Rozelle Interchange in the 2015 WestConnex Business Case would not integrate well with surface roads, including the proposed Bays Precinct, and would result in increased traffic on Victoria Road and the ANZAC Bridge. Following a comprehensive review conducted in mid‑2016, TfNSW refined the design of the M4‑M5 Link and Rozelle Interchange to address these limitations without increasing the cost of delivery. TfNSW documented the rationale for the design changes, including how the changes improved on the original design to increase capacity, improve traffic conditions and create more open space. |
1. Key findings
Government decisions to fund WestConnex related projects outside of WestConnex's $16.812 billion reported budget have reduced transparency over costs and understate the full cost of WestConnex
In 2015, the work required to integrate WestConnex with existing roads ('network integration') was funded as a separate project with an estimated cost of $1.534 billion outside the 2015 WestConnex budget of $16.812 billion. TfNSW then created the Network Integration Program to respond to the conditions of planning approval for WestConnex. The current estimated cost to deliver all network integration works is $2.3 billion.
Since the 2015 WestConnex Business Case, the NSW Government has removed several elements from the scope of WestConnex and funded them as separate projects, while keeping the published WestConnex budget at an estimated $16.812 billion. Projects removed include:
- Sydney Gateway, currently costed at $2.56 billion (with an $800 million contribution from WestConnex)
- Parramatta Road Urban Amenity Improvement Program, costed at $198 million in late 2018 and funded though new funding to the Greater Sydney Commission.
Together, these projects represent costs of $4.26 billion that are not included in the WestConnex budget, but are required for WestConnex to achieve the objectives of the 2013 and 2015 WestConnex Business Cases. The costs of these elements in supporting the objectives of WestConnex is not tracked centrally, and there is no single point of oversight over them. Exhibit 1 compares total WestConnex forecast costs (including related projects) between November 2015 and April 2021.
November 2015 |
April 2021 ($ million) |
|
WestConnex | ||
Stage 1 | ||
Stage 1A (M4 Widening) | 497 | 517 |
Stage 1B (M4 East) | 3,802 | 3,782 |
Total | 4,299 | 4,299 |
Stage 2 | ||
King Georges Road Interchange | 131 | 131 |
New M5 | 4,335 | 4,335 |
Sydney Gateway Contribution | 800 | 800 |
Total | 5,266 | 5,266 |
Stage 3 | ||
M4‑M5 Link and Rozelle Interchange | 7,049 | 7,049 |
Urban renewal (Parramatta Road) | 198 | ‑‑ |
Urban renewal (Rozelle) | ‑‑ | 198 |
Total | 7,247 | 7,247 |
Total reportable WestConnex | 16,812 | 16,812 |
November 2015 ($ million) |
April 2021 ($ million) |
|
Related projects | ||
Network integration | 1,534 | 2,300 |
Urban renewal (Parramatta Road) | ‑‑ | 198 |
Sydney Gateway Road Component | ‑‑ | 1,760 |
Total | 1,534 | 4,258 |
Many network integration costs are directly attributable to WestConnex and ought to be included in the reported budget for WestConnex
Prior to 2015, the scope of WestConnex included enabling works needed before or during construction, as well as funding for future works to address any adverse traffic outcomes created by WestConnex which become apparent after its opening. These works are also known as network integration works.
When government approved the 2015 WestConnex Business Case, it noted that the project would require $1.534 billion for network integration works to address the impacts of WestConnex on the road network. However, the WestConnex project budget of $16.812 billion did not include funding for network integration works. Instead, Roads and Maritime Services (RMS, now TfNSW) was to fund network integration through its normal budget allocation.
It is important to recognise these costs as part of the total WestConnex project cost because:
- TfNSW created the Network Integration Program to respond to network traffic and transport elements of the planning conditions of approval for WestConnex granted by the then NSW Department of Planning and Environment under the Environment, Planning and Assessment Act 1979.
- NSW Treasury guidelines for business cases note that accurate cost estimates include assessment of the financial impact of meeting the conditions of planning approval.
- Travel time and vehicle operating cost benefits attributed to the WestConnex project in the 2015 WestConnex Business Case assume that some network integration works, then costed at $373 million, were in place.
Refer to Appendix two for more detail on network integration works.
Some of the projects in the WestConnex Network Integration Program provide community and place benefits, such as parklands and cycleways. These benefits have not been attributed to WestConnex. Additionally, some network integration works are likely to deliver additional traffic related benefits to WestConnex. As the Network Integration Program’s primary purpose is to meet the conditions of planning approval for WestConnex, TfNSW should attribute all the costs and benefits of the program to WestConnex.
To September 2021, the total funded cost of the Network Integration Program is approximately $2.077 billion. TfNSW estimates that it will need a further $222 million to complete all expected network integration works.
The NSW Government's decision to separate Sydney Gateway from WestConnex has reduced transparency and accountability for TfNSW's underestimation of the cost of the road component of Sydney Gateway
Sydney Gateway is a high‑capacity connection between the new St Peters Interchange and the Sydney Airport and Port Botany precinct. It includes a road and rail components. The road component was included in the scope of WestConnex in the 2015 WestConnex Business Case. The November 2015 design, which TfNSW costed at $800 million, involved separate roadways from the St Peters Interchange to the International terminal, and to the domestic terminals and Mascot airport precinct.
By October 2016, TfNSW was aware that the $800 million budget for Sydney Gateway was insufficient and revised the forecast cost for the road component to $1.8 billion. The original cost estimate did not sufficiently consider the cost of:
- constructing a complex design adjacent to the airport precinct
- obtaining access to land required for the project
- managing environmental contamination.
On 9 August 2017, the then Minister for WestConnex announced that the Sydney Gateway project was not part of WestConnex.
The 2015 WestConnex Business Case notes that material changes to the WestConnex budget, funding, scope, or timeframe are subject to Cabinet approval processes. It states that, when seeking approval for material changes, the portfolio Minister will make a submission to the relevant Cabinet Committee. Changes in project scope required the approval of the then Cabinet Committee on Infrastructure and should have been endorsed by the WestConnex Interdepartmental Steering Committee.
TfNSW and the NSW Department of Premier and Cabinet (DPC) assert that there is no documentation to support the government’s decision to separate Sydney Gateway from the WestConnex Program, or the WestConnex Interdepartmental Steering Committee's endorsement of a submission to Cabinet seeking approval for the separation.
The established governance processes for major scope changes were not followed in this instance. The lack of transparency regarding government's decision to separate Sydney Gateway from WestConnex also reduces visibility of TfNSW's underestimation of the cost of delivering the road component of Sydney Gateway.
The November 2018 Final Business Case for Sydney Gateway, which was approved by the government, included an estimate of $2.45 billion (nominal outturn cost) for the road component. This estimate included an $800 million contribution from WestConnex. A more recent estimate (late 2020) for this project is $2.56 billion (nominal outturn cost).
The Parramatta Road Urban Amenity Improvement Program should be included as part of the WestConnex budget
A specific objective of the 2015 WestConnex Business Case was the creation of opportunities for urban renewal along and around Parramatta Road. The business case included an allocation of $198 million in the $16.812 billion WestConnex budget for the Parramatta Road Urban Amenity Improvement program, designed to implement aspects of the objective. In November 2018, the NSW Government removed the Parramatta Road Urban Amenity Improvement Program from the WestConnex program of works and reallocated the $198 million (inside the $16.812 billion WestConnex budget) for urban renewal works around the Rozelle Interchange. As part of this decision, government approved new funding of $198 million to the Greater Sydney Commission for the urban amenity program, outside the $16.812 billion WestConnex budget. This understates the cost of WestConnex meeting its objectives by $198 million.
There is no requirement for ongoing ‘whole‑of‑program’ assurance of the WestConnex program of works, including related projects
In August 2015, INSW conducted its first Gateway Review of WestConnex as a program consisting of composite projects. Following that review, TfNSW registered each of the components of WestConnex with INSW as individual projects, rather than keeping WestConnex registered as a program or mega‑project. This is not inconsistent with the IIAF and all WestConnex related projects, including Sydney Gateway and the Network Integration Program, have undergone independent assurance reviews as individual projects under the IIAF.
Once a program like WestConnex is broken down into its composite parts, there is no requirement for the sponsor agency (TfNSW) or INSW to provide independent assurance on the program as a whole until it is completed. This is then done as part of the Gateway review for benefits realisation, which examines whether project benefits are being measured and meet expectations. These individual projects are, in themselves, significant in scale and complexity. While addressing them as discrete components for the purposes of the assurance review process can be justified, the absence of strategic, holistic reviews of WestConnex allows for total costs and benefits to become opaque and avoid scrutiny. Programs of this scale require greater ongoing transparency on total costs and benefits in order to ensure confidence they will meet intended objectives within budget.
There is a lack of public transparency on the total costs and benefits of the WestConnex project
Prior to 2018, the Audit Office provided assurance on costs borne and levied by Sydney Motorway Corporation and its controlled entities. Since the NSW Government sold 51 per cent of its stake in WestConnex in August 2018, the Auditor‑General no longer has the mandate to provide this assurance. The Audit Office is also unable to provide any assurance regarding the performance of tolling concessions.
This means that the total costs of WestConnex, including those levied on road users through tolling, are not reported alongside the full cost of delivering the project. This information, and independent assurance over that information, would provide transparency and context to the outcome of government's sale of its interest in WestConnex.
To enhance the transparency of existing infrastructure assurance processes, government could consider requiring large and complex infrastructure programs to undergo periodic review at a whole‑of‑program level. This could take the form of annual reports to Parliament on the total costs and benefits of selected large and complex projects by the responsible agency. The reports could include an assessment of the cost to government and cost to the community of funding and financing. Independent assurance of the agency report would provide Parliament with greater confidence that infrastructure is delivered economically and providing value for money for the people of NSW.
The Australian National Audit Office provides similar assurance on selected Department of Defence acquisition projects as part of its annual Major Projects Report.
Design enhancements included in the 2015 WestConnex Updated Strategic Business Case were supported by robust analysis
The 2015 WestConnex Business Case contained more detail than the 2013 WestConnex business case. Design enhancements were made as a result of modelling analysis conducted over the two years since the 2013 business case. Enhancements included a full underground link between Kingsgrove and St Peters as part of the New M5 and re‑alignment of the M4‑M5 link tunnel (Stage 3) to include the Rozelle Interchange. The Rozelle Interchange will provide a direct connection to the Anzac Bridge and Victoria Road, and will enable a connection to the proposed Western Harbour Tunnel and Beaches Link. A map and description of these elements can be found at Exhibits 2 and 3 of this report.
In 2016, TfNSW revised the design of the M4‑M5 Link and Rozelle to address traffic and integration issues
As part of preparing the 2015 WestConnex Business Case, TfNSW prepared a Project Definition and Delivery Report (PDDR) for the M4‑M5 Link. This report describes the scope of the project, including a high‑level concept design. TfNSW identified limitations with the proposed design of the M4‑M5 in the PDDR, which it would need to address as the project moved to a detailed design stage. In particular, these limitations included:
- poor integration with the Bays Precinct masterplan
- traffic capacity constraints on Victoria Road and Anzac Bridge
- construction complexity.
Following a comprehensive review in mid‑2016, TfNSW changed the design of the M4‑M5 Link and Rozelle Interchange to address these limitations. These changes included:
- deletion of the Camperdown intersection to improve traffic conditions on Parramatta Road
- a fully underground and larger Rozelle Interchange with 10‑hectare dedicated parklands
- a toll‑free tunnel link from Iron Cove Bridge to Anzac Bridge
- increasing the lanes in the dual tunnels from three to four each way.
TfNSW documented, but did not publish, the rationale for the design changes, including how the changes addressed the limitations of the previous design while providing increased community benefit through the creation of open space. TfNSW undertook cost comparison studies which estimated that these changes would have a neutral impact on the estimated project cost while achieving the same or improved benefits.
TfNSW's record‑keeping systems for large infrastructure investments negatively impact accountability and transparency
In response to our formal requests for relevant information, made during the conduct of this audit, TfNSW advised that complete and valid records of key decision‑making processes, analysis and advice were unavailable. Additionally, TfNSW often provided information that was incomplete or unverifiable (for instance, unsigned briefing notes). This is not consistent with accepted governance practices and does not comply with the requirements of the State Records Act 1998.
We also requested that TfNSW provide a list of relevant documents held by the Sydney Motorway Corporation (SMC). While TfNSW acknowledged that SMC may hold material relevant to the audit, TfNSW did not have a list or description of these documents. As SMC is now a majority privately held entity, both the Audit Office and TfNSW have limited power to require SMC to provide documentation.
The delivery timeframe for large and complex infrastructure projects such as WestConnex frequently exceeds five years, and some projects can take over a decade to deliver. These projects represent a significant investment of public resources and government agencies should expect independent review and assurance activities such as performance audits. The establishment of dedicated record keeping facilities for major infrastructure projects, such as data rooms, would improve transparency and accountability. This would ensure that the use of public resources is fully auditable in line with public expectations and the requirements of the Government Sector Finance Act 2018, the State Records Act 1998 and the Public Finance and Audit Act 1983.
2. Recommendations
By December 2021, TfNSW should:
1. review the impact of scope changes on project objectives, costs and benefits for complex infrastructure projects
2. when preparing business cases for complex large infrastructure projects, ensure that the estimated costs and benefits of works which are reasonably expected to meet consent conditions are included in the overall project cost and its benefits (as per Treasury guidelines)
3. establish and maintain centralised and project‑specific record keeping, including through dedicated project data rooms, to ensure major infrastructure projects can readily be subject to external oversight and assurance.
By June 2022, INSW should:
4. provide transparent whole‑of‑program assurance on total costs and benefits throughout the project life‑cycle when complex projects are split into sub‑projects.
By June 2022, NSW Government should:
5. consider enhancing the public transparency of existing infrastructure assurance processes by requiring that large complex infrastructure programs undergo periodic review at a whole‑of‑program level. This could take the form of reports to Parliament on the total costs and benefits on selected large and complex projects by the responsible agency, including cost to government and cost to community of funding and financing, as well as an accompanying independent assessment of the agency report.
Following our 2014 performance audit report 'WestConnex: Assurance to the government', the NSW Government established the Infrastructure Investor Assurance Framework (IIAF). INSW is responsible for the development, implementation and administration of the IIAF. The assurance framework involves gateway reviews, health checks, deep dive reviews, and project monitoring and reporting at various stages in the lifecycle of a project. The main aims of the IIAF are to help ensure major infrastructure projects are delivered on time and on budget, and to ensure that reports are regularly monitored by the Cabinet of the NSW Government. The IIAF gateway review process is compulsory for all significant investments and expenditure under the NSW Treasury Gateway Policy.
In accordance with the IIAF, INSW is responsible for the following:
- providing a dedicated Assurance Team including Gateway Review Managers to coordinate Reviews
- determining appropriate expert reviewers, and manages scheduling, commissioning and administration of Assurance Review reports. Infrastructure NSW is independent of the Expert Review Team
- monitoring Tier 1 – High Profile/High Risk projects, Tier 2 and Tier 3 (if required) project performance through independent Assurance Reviews
- providing independent analysis and advice on key risks and any corrective actions recommended for Tier 1 – High Profile/High Risk, Tier 2 and Tier 3 projects
- escalating projects to Infrastructure Investor Assurance Committee (IIAC) and Cabinet where projects present ‘red flag issues’ and where corrective action is needed
- working with delivery agencies to register all capital projects with an estimated cost greater than $10.0 million and ensures they are risk profiled and assigned a risk‑based project tier with an endorsed IIAF Project Registration report
- preparing forward looking annual Cluster Assurance Plans
- maintaining and continuously improves the IIAF process
- reporting to the IIAC, Cabinet and Infrastructure NSW Board
- regularly report to NSW Treasury on the performance of the IIAF.
In relation to WestConnex, TfNSW is the sponsor agency responsible for meeting relevant IIAF requirements, including:
- registering and risk profiling projects
- IIAF gateway, health check, and deep dive assurance reviews
- regular reporting.
Under the IIAF, it is mandatory for all capital projects valued over $10.0 million to be registered with INSW. Capital projects can be registered either as a program (comprising of a group of related projects or activities) or as a project (which may or may not be part of a program).
According to the IIAF, programs tend to have a lifespan of several years and aim to deliver outcomes and benefits related to an organisation's strategic objectives. Projects tend to have a shorter lifespan, and deal with outputs. Projects can, however, be grouped under a single program if they are similar in nature or if they are aimed at collectively achieving a strategic objective. Complex projects can be delivered in multiple stages, under different contracts, and across different time periods.
The last assurance review of the entire WestConnex program of works as a whole was in 2015
INSW conducted the first IIAF gateway review of WestConnex in August 2015. TfNSW developed a draft WestConnex Updated Strategic Business Case to consolidate the latest analysis on WestConnex, and to confirm that the project remained fit for purpose, economically viable, and financially deliverable. The review followed a recommendation in our 2014 performance audit report that business cases be thoroughly revisited.
During September 2015, INSW conducted additional informal reviews to identify strategic risks associated with public release of the WestConnex business case. Subsequently, INSW gave the Premier of NSW its views on the draft business case, including the following points:
- The $398 million budget for Sydney Gateway was insufficient to meet the benefits claimed in the business case for a ‘functional’ connection to Sydney Airport and Port Botany. INSW studies indicate a future‑proof solution would require a minimum spend of $755 million.
- Enabling works for WestConnex estimated at $1.534 billion were excluded from the cost of WestConnex. Significant work remained for RMS to identify mitigation measures to address planning approvals and network performance issues.
- Enabling works (a Southern Connector), an access ramp and surface road improvements within St Peters were excluded from the draft 2015 business case despite their inclusion in the WestConnex scope in the 2014–15 State Budget.
- The overall cost of works not funded within the WestConnex budget ranged from $2.011 billion to $2.196 billion. This included the enabling works, access ramp and surface road improvements and the shortfall for Sydney Gateway.
All WestConnex related projects, including Sydney Gateway have undergone independent assurance reviews under the IIAF
Since INSW submitted the first WestConnex progress update report to Cabinet in June 2015, INSW has been reporting monthly on the different stages of the WestConnex Program, including Sydney Gateway, as the projects were registered with INSW as High‑Profile, High‑Risk projects. Separate reporting enabled INSW to report and review each stage with more detailed scrutiny, compared to the reporting and reviewing at a program level.
WestConnex Stage 2 (New M5) underwent both mandatory and non‑mandatory reviews at key points in the project lifecycle. Three mandatory gateway reviews – at Gate 2 (Final business case), Gate 3 (Readiness for market), and Gate 4 (Tender evaluation) – were conducted by TfNSW before the introduction of IIAF. Four non‑mandatory health check reviews and one non‑mandatory deep dive review were conducted after the introduction of the IIAF managed by INSW.
Similarly, WestConnex Stage 3 projects – M4‑M5 link, M4‑M5 Tunnels, and Rozelle Interchange – also underwent mandatory and non‑mandatory reviews at key points in their lifecycle under IIAF.
The M4‑M5 Link had two mandatory gateway reviews and one non‑mandatory health check review under IIAF. These reviews were conducted before Stage 3 was split into two stages, due to major design changes to the Rozelle Interchange and the M4‑M5 tunnels.
The M4‑M5 tunnels had two mandatory gateway reviews (at Gates 3 and 4), one non‑mandatory health check review, and one non‑mandatory deep dive review under IIAF.
Rozelle Interchange also underwent three mandatory gateway reviews at Gate 3 (part 1), Gate 3 (part 2), and Gate 4, two non‑mandatory health check reviews, and one non‑mandatory deep dive review under IIAF.
Since mid‑2017, the Sydney Gateway project has undergone required independent assurance reviews, as well as a number of optional assurance reviews
In November 2016, INSW conducted a mandatory Gate 1 gateway review on a strategic business case for the Sydney Gateway Project. TfNSW did not proceed with this business case. Following the separation of Sydney Gateway from WestConnex in mid‑2017, TfNSW developed a new business case for Sydney Gateway. It has undergone the required Gate 1, Gate 2, and Gate 3 gateway reviews, as well as two non‑mandatory health check reviews, and three non‑mandatory deep dive reviews under IIAF.
Network integration works have undergone all IIAF required assurance reviews
TfNSW completed a strategic business case for the Network Integration Program in August 2020, and INSW completed a gateway review in November 2020. This is despite network integration projects starting as early as 2015, with $645 million having been spent by June 2020. The strategic business case included a prioritisation process for completing remaining works in the program. Prior to November 2020, TfNSW registered individual network integration projects with INSW, and these projects have undergone gateway reviews where required.
The Network Integration Program strategic business case does not include Rozelle interchange network integration works ($353 million) and additional network integration works to settle a contractor claim adjacent to St Peters Interchange ($190 million). These were excluded from the business case on the basis they had already been approved by government, and as such were not subject to the prioritisation elements of the business case. TfNSW has not developed separate business cases for these works, although the scope of the St Peters Interchange works was developed through a negotiated process.
TfNSW did not prepare business cases for some network integration works which have commenced, including the $323 million Campbell Road/Euston Road works
Prior to its development of the August 2020 strategic business case, TfNSW did not prepare business cases for many network integration works that have commenced, and in some instances were completed, before 2019. Significantly, TfNSW did not prepare a business case for the Campbell Road/Euston Road works, which cost $323 million and have been completed.
In 2016, TfNSW’s Business Case Policy requires the creation of business cases for capital projects costing over $1.0 million. At the time of writing this report, TfNSW’s draft policy requires full business cases for capital projects costing $10.0 million or more.
There is no requirement for ongoing ‘whole‑of‑program’ assurance of the WestConnex program of works, including related projects
INSW conducted its first gateway review of WestConnex (as a program, which consisted of composite projects) in August 2015. Following that review, TfNSW registered each of the components of WestConnex with INSW as individual projects, rather than keeping WestConnex registered as a program or complex project. The IIAF allows this to occur.
Separate registration enabled INSW to report and review each stage with more scrutiny compared to whole‑of‑program level review.
Such an approach has merit, considering the individual stages (and components of these stages) are multi‑million dollar works in their own right. Each project has its own timing for gateway reviews at stages such as 'Readiness for Market' and 'Tender Evaluation'.
Once a program such as WestConnex is broken down into its composite parts, there is no requirement for the sponsor agency (TfNSW) or INSW to conduct independent assurance on the program of works as a whole until the whole program is completed as part of the Benefits Realisation (Gate 6) gateway review. The absence of strategic, holistic reviews of projects of the scale and complexity such as WestConnex during their delivery allows for total costs and benefits to become opaque and avoid scrutiny. Projects of this scale require greater ongoing transparency on total costs and benefits in order to ensure confidence they will meet intended objectives within budget.
INSW has advised us that it has prepared a proposal to expand its assurance function to include whole‑of‑program review of inter‑related infrastructure projects.
Appendix one – Responses from agencies
Appendix two – Network integration works
Appendix three – About the audit
Appendix four – Performance auditing
© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.
Parliamentary reference - Report number #351 - released (17 June 2021).
Actions for Acquisition of 4–6 Grand Avenue, Camellia
Acquisition of 4–6 Grand Avenue, Camellia
The Auditor-General for New South Wales, Margaret Crawford, has today released a report on Transport for NSW’s (TfNSW) acquisition of 4–6 Grand Avenue in Camellia.
This audit, which was requested on 17 November 2020 by the Hon. Andrew Constance MP, the Minister for Transport and Roads, examined:
- whether TfNSW conducted an effective process to purchase 4–6 Grand Avenue, Camellia
- whether TfNSW has effective processes and procedures to identify and acquire property required to deliver the NSW Government’s major infrastructure projects.
The audit found that TfNSW conducted an ineffective process when it purchased 4–6 Grand Avenue, Camellia. The audit also found that TfNSW’s internal policies and procedures to guide the transaction were, and continue to be, insufficient.
The Auditor-General has made seven recommendations to address the issues identified in the report.
On 17 November 2020, the Hon. Andrew Constance MP, the Minister for Transport and Roads, requested this audit under section 27B(3)(c) of the Public Finance and Audit Act 1983.
On 15 June 2016, Transport for New South Wales (TfNSW) acquired 6.3 hectares of land at 4–6 Grand Avenue, Camellia, by agreement from Grand 4 Investments Pty Ltd. Grand 4 Investments was a business entity established by the owners of Billbergia Pty Ltd, a property development and investment company.
TfNSW paid Grand 4 Investments $53.5 million and assumed liability for addressing environmental issues and contamination associated with the site. This took place seven months after the vendor acquired the land as part of a competitive Expression of Interest process, in which TfNSW also participated, for $38.15 million.
TfNSW is the NSW Government agency responsible for most major transport infrastructure projects in New South Wales. TfNSW acquired the Camellia site for use as a stabling and maintenance depot to support the Parramatta Light Rail (PLR) project.
Consistent with the minister’s request, this audit assessed:
- whether TfNSW conducted an effective process to purchase 4–6 Grand Avenue, Camellia
- whether TfNSW has effective processes and procedures to identify and acquire property required to deliver the NSW Government’s major infrastructure projects.
In considering the effectiveness of the processes for this purchase, the audit considered:
- the requirements of the Land Acquisition (Just Terms Compensation) Act 1991 (the Act)
- the application of sound processes to manage risk to the NSW Government and to achieve value for money
- the application of disciplines associated with complex procurement, such as probity, in a NSW Government context.
The acquisition of the 4–6 Grand Avenue site in Camellia was consistent with a 2014 feasibility study for the PLR, but occurred before the completion of detailed project planning or an acquisition strategy.
TfNSW made two attempts to acquire the 4–6 Grand Avenue site in Camellia, and was successful on the second attempt. TfNSW recognised the risks associated with early acquisition and had high-level strategies in place should the site not be required.
The specific site had been identified in a feasibility study for the PLR commissioned by TfNSW in 2014 as one of several options in Camellia for a stabling and maintenance depot. However, TfNSW had not done any substantive analysis of the various options to identify a preferred location before the two opportunities to acquire 4–6 Grand Avenue were brought to TfNSW’s attention by the landowners (or their agents). On both occasions, TfNSW chose to actively pursue acquisition in advance of any such analysis.
The acquisition was also not informed by a Property Acquisition Strategy, which TfNSW policy recommends in order to guide the process and manage acquisition specific risks.
In 2015, TfNSW identified that it would require a stabling and maintenance depot in the Camellia area for the Parramatta Light Rail
In 2014, TfNSW commissioned an external engineering consultancy to undertake a feasibility design study for the Parramatta Light Rail - the Parramatta Transport Corridor Strategy Feasibility Design study (herein referred to as ‘the feasibility study’). In early 2015, TfNSW received the feasibility study, which was one of several key sources that informed the development of business cases for the PLR.
The feasibility study recommended that TfNSW should consolidate the maintenance and cleaning operations with overnight stabling facilities on one site. The study noted that the optimal location for any such site would be in close proximity to the proposed network, and noted that the site must have access to road connections to accommodate access for cars and trucks.
The study found that a centrally located stabling and maintenance facility would be required for all routes serving the Parramatta CBD, and that the Camellia industrial area was a preferred location for such a facility. The study noted that the Camellia area was contaminated.
The feasibility study notes that its conclusions were based on assumptions about the light rail system adopted and decisions made by the future operator of the system, who had not yet been selected or appointed.
TfNSW's decision to progress a potential acquisition in 2015 considered the risk that the site may not be required
TfNSW's FIC was responsible for making decisions on funding allocations at a whole of program level within TfNSW. FIC was also responsible for approving ‘high-risk/high-value’ variations to program budgets. Members of the FIC included:
- Secretary of Transport for NSW
- Deputy Secretary, Infrastructure and Services
- Deputy Secretary, Freight, Strategy and Planning
- Deputy Secretary, Customer Services
- Deputy Secretary Finance and Investment
- Deputy Secretary People and Corporate Services.
An April 2015 submission, from the then Deputy Director-General to the agency’s FIC, sought authorisation and funding approval to participate in an Expression of Interest sale process. It noted the risk that the project may not go ahead. The submission advised that:
By acquiring a strategic site now, it reduces the risk of having to pay an improved value or a value that may be subject to rapidly improving land values due to changes in land use and rezoning.
The property can be acquired for the project, held strategically and income generated by leasing the site as hardstand 1 space until the project requires the land for the Parramatta Light Rail project.
If the project does not proceed in the medium to longer term, the property can be sold at a premium to what has been paid today as property fundamentals improve.
This submission acknowledged the risks associated with environmental contamination and proposed that these risks would be managed by negotiating a contract where the remediation and associated expenses would be at the landowner’s cost.
TfNSW assessed the 4–6 Grand Avenue site as one of several sites in Camellia that was a feasible location for a stabling and maintenance facility
The Departmental feasibility study assessed six potential sites for a stabling and maintenance facility, including 4–6 Grand Avenue, noting strengths and weaknesses of each site. A different site on Grand Avenue was assessed as the ‘base case’ option (1 Grand Avenue). The study’s comments on the 4–6 Grand Avenue site included the following:
With an area of approximately 63,000m2, this site has sufficient space for a depot with the required stabling yard and maintenance facilities. The location allows for good road access and LRT [light rail transit] access would be from Grand Avenue, which may require a road crossing or signalised intersection. The site has been used for general industrial uses; however the land has been cleared and is currently undergoing remediation 2. The site is not affected by flooding based on one in 100-year flood data.
In early 2015, once the opportunity to acquire 4–6 Grand Avenue emerged, TfNSW commissioned a specific feasibility study of the 4–6 Grand Avenue site. The feasibility studies clearly documented the existence of environmental contamination. In April 2015, the report concluded:
Given the limitations of this report and within the parameters that have been set it is concluded that from a spatial and geographic perspective the site at 6 Grand Avenue would be suitable as a stabling and maintenance depot for the Parramatta light rail project. There are few engineering and environmental constraints that would affect the feasibility level analysis of this site and all issues identified, within this desk study, are considered to be resolvable. However this being said there is a significant amount of work necessary to reach the final layout and definition of the stabling and maintenance depot. There are numerous items which require further consideration and conformation; planning approvals could impose restrictions on building heights, noise mitigation measures, light and visual impact requirements all of which can have significant impacts on the spatial requirements of any stabling and maintenance depot.
The acquisition of 4–6 Grand Avenue was not informed by a Property Acquisition Strategy
For major projects, TfNSW typically requires the project team to complete a Property Acquisition Strategy, which is intended to guide both process as well as specific acquisition issues expected to be faced during the project. The Property Acquisition Strategy is not a mandated document but is a recommended tool to support property acquisition as part of major projects.
TfNSW did not have a Property Acquisition Strategy in place to guide the 2015 Expression of Interest process. On 6 November 2015, the then Project Director for the PLR project emailed the property team, noting a need to develop a Property Acquisition Strategy to close off the scoping design and preliminary business case.
In January 2016, TfNSW developed a draft Property Acquisition Strategy for the Parramatta Light Rail Project, although it was silent on the potential sites for the stabling and maintenance facility.
TfNSW focussed on 4–6 Grand Avenue because it was available and aligned to TfNSW's strategic interests
In early 2015, officials commenced monitoring the market for industrial real estate in the Camellia area and surrounds for possible sites for a stabling and maintenance facility.
In March 2015, then owner of the site, Akzo Nobel Pty Limited released the 4–6 Grand Avenue site through an Expression of Interest process managed by CBRE.
TfNSW’s then Deputy Director-General, Planning, sought approval from FIC to lodge an Expression of Interest up to $30.0 million. Approval was sought on the basis that it would ‘provide certainty for the Parramatta Light Rail project by allowing for a depot site in a suitable location and potentially avoid higher costs or longer timeframes associated with compulsory acquisition following completion of the project’s business case’. FIC approved the request at its meeting on 9 April 2015.
At this time, TfNSW had not conducted any analysis of financial or operational benefits and costs of the potential sites identified in earlier feasibility studies. TfNSW staff advised us that the decision to participate in the Expression of Interest process for 4–6 Grand Avenue was because it was available. There is no documentation substantiating this statement, which TfNSW staff provided verbally as part of this audit.
In November 2015, TfNSW was advised that it was unsuccessful in the Expression of Interest process and that Grand 4 Investments (a related entity of Billbergia) had purchased 4–6 Grand Avenue. TfNSW did not conduct any further analysis of alternative potential sites in Camellia between this date and commencing discussions with Grand 4 Investments in April 2016. In that time there had been some movement on other properties that were included in the feasibility study, including 37–39a Grand Avenue being under offer in September 2015.
In March 2016, TfNSW approached CBRE to organise a meeting with Grand 4 Investments. On 1 April 2016, TfNSW met with Grand 4 Investments.
TfNSW advises that a perceived benefit of the 4–6 Grand Avenue site was that it was not subject to other uses or leaseholds that would increase the cost of compulsory acquisition. Officers involved in the acquisition advised that other nominated sites in the feasibility study were subject to other uses or leaseholds.
2 Officers familiar with the acquisition could not confirm the nature of remediation being undertaken, but noted that the previous landowner had cleared buildings from the site, which may have been considered part of remediation.
TfNSW's independent valuation, which it commissioned and received after the acquisition, specifically excluded consideration of environmental contamination risk. As a result, TfNSW is exposed to the risk that the acquisition was not fully compliant with the Land Acquisition (Just Terms Compensation) Act 1991 (the Act) because it did not use an accurate estimate of market value during negotiations. That said, the acquisition of 4–6 Grand Avenue by agreement was consistent with preferred processes described in the Act.
TfNSW acquired the site from the landowner by agreement, and this is consistent with provisions in the Act. Obtaining approval for compulsory acquisition should negotiations for agreement break down is also consistent with the Act. That said, TfNSW did not at any time assess whether a compulsory acquisition could have resulted in acquisition at a lower cost than what was negotiated by agreement.
Despite the high risks associated with the acquisition, TfNSW did not commission a formal valuation in time to inform the negotiation and purchase. Instead, TfNSW relied on internal advice to estimate market value, but did not obtain a formal valuation from those advisors. For high-risk transactions, the greater expertise and arm's-length independence of an external specialist valuer should be preferred over an agency's own staff.
On 15 June 2016, the settlement date for the acquisition, TfNSW commissioned a formal independent valuation of the site. On 23 November 2016, TfNSW received the final formal valuation report. By not obtaining a formal independent valuation of the property in advance of acquisition to inform the acquisition value, TfNSW exposed itself to non-compliance with the Act by not establishing the market value as the basis for the acquisition price. TfNSW also breached its own internal policies.
TfNSW instructed the valuer to conduct its valuation within the following parameters:
- Market valuation on an ‘as is’ basis – market value based on the methodology described in the Act. This approach valued the site at $25.0 million.
- Market valuation on a speculative development basis – market value based on the financial value of the vendor's intended use of the site which, in this case, involved leasing the site for industrial use. This approach valued the site at $52.0 million, and TfNSW advised us this valuation supported the purchase price.
- Disregard the impact of environmental contamination – TfNSW specifically instructed the independent valuer to disregard any known (or unknown) site contamination. As TfNSW knew of the significant environmental contamination affecting the site, this parameter resulted in a valuation that overstated the value of the site as it did not consider the cost of environmental remediation. The valuer applied this assumption for both market valuation approaches.
Additionally, as the independent valuer completed the valuation after the purchase was finalised, there is a risk that the valuation may have been influenced by the known purchase price.
TfNSW's failure to acquire a formal valuation and an assessment of the financial impact of environmental remediation before it purchased 4–6 Grand Avenue represents ineffective administration and governance.
TfNSW acquired the site at a time when there was demand and increasing prices for industrial property in the area. However, TfNSW did not effectively assess and manage the risks associated with the acquisition, and gaps in process led to increased risk. Briefings to decision-makers did not contain important information, and we found no evidence that gaps in advice were queried or explored by decision-makers.
TfNSW did not have plans or advice in place to assist in managing risk, such as:
- a property acquisition plan
- a comprehensive and up-to-date risk management plan
- a negotiation strategy, or any authorisation limit or minimal acceptable position
- an independent professional evaluation
- external expert advice (with the exception of legal advice relating to the contract of sale).
TfNSW was aware of contamination issues affecting the land and had access to considerable information about the environmental conditions, such as site environmental audit reports and information on the NSW Environment Protection Authority's contaminated land register. However, TfNSW had not analysed specific technical information about the contamination and therefore was not aware of the risk implications and cost for remediation. Despite this, TfNSW changed its position from not accepting the risks and costs of contamination, to acquiring the site unconditionally. The basis for this decision is unclear and undocumented.
Briefing to senior leaders on the acquisition was silent on a number of important matters that would have been important for approvers to consider, including:
- an explanation of the 40 per cent increase in purchase price between November 2015 and May 2016, and a 165 per cent increase from TfNSW’s offer in April 2015
- the contamination risks associated with the site and an evidence-based estimate of potential costs to remediate the site
- advice that an independent valuation had not been obtained, inconsistent with TfNSW policy.
Consideration of the acquisition by FIC was based on a summary business paper and was managed out-of-session, thereby removing the ability for comprehensive consideration of the acquisition proposal and its risks.
The probity management controls and assurances in place for the acquisition of the 4–6 Grand Avenue site were insufficient. These insufficiencies were exacerbated by the probity risk profile of the transaction.
The 4–6 Grand Avenue acquisition was a high-risk/high-value transaction, undertaken in a volatile property market in a short timeframe under pressure from Grand 4 Investments. TfNSW was engaging in a direct negotiation in advance of detailed planning for the acquisition, or the PLR as a whole. These circumstances contribute to heightened probity risk.
TfNSW did not establish a probity plan and sought no probity support throughout the acquisition. Also, with one exception, the staff involved in the acquisition did not complete conflict of interest declarations.
TfNSW was aware of the potential for probity or integrity issues with the transaction when it commissioned an internal audit in connection with the transaction in 2019. Internal discussions considered whether a misconduct investigation may be more appropriate, however no such investigation was undertaken.
TfNSW's insufficient probity practices, in addition to its failure to keep complete or comprehensive records of negotiations or decisions, reduce transparency of the process and its outcome and expose TfNSW to a greater risk of misconduct, corruption and maladministration.
At the time of the transaction, the TfNSW policy framework was not sufficiently risk-focussed and did not provide clarity on when officers ought to apply specific guidance or procedures. TfNSW's policies and procedures are more focussed on acquiring land to meet project needs and timeframes, and less on assuring value for money and managing risks.
At the time of its acquisition of 4–6 Grand Avenue, TfNSW had property acquisitions policies and procedures in place. Each of these were broadly sound in their content and intent. However, they lacked specificity on how or when to apply guidance, and when risk levels should elevate the importance of recommended guidance.
TfNSW's key guidance was principles based and relied on agency staff using their experience and expertise to apply guidance according to the circumstances of an individual transaction. This guidance was not duly applied in the acquisition of 4–6 Grand Avenue, Camellia. In addition, TfNSW does not have quality or control assurance to identify when TfNSW officers did not apply important policies or processes.
The primary focus of the TfNSW’s property acquisition guidance is to achieve vacant possession of land in a timeframe that meets the need of the relevant transport project. There is less specific focus on the need to meet the requirements of the NSW Government financial management framework.
Appendix one – Response from agency
Appendix two – About the audit
Appendix three – Performance auditing
Copyright Notice
© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.
Parliamentary reference - Report number #349 - released (18 May 2021).
Actions for Transport 2017
Transport 2017
The following report focuses on key observations and findings from the most recent financial statement audits of agencies in the Transport cluster.
Unqualified audit opinions were issued for all agencies' financial statements. However, the report notes the agencies can improve their asset revaluation processes.
Actions for Central Agencies 2017
Central Agencies 2017
This report highlights the results of the financial audits of NSW Government central agencies. The report focuses on key observations and findings from the most recent financial statement audits of agencies in the Treasury, Premier and Cabinet, and Finance, Services and Innovation clusters.
The report includes a range of findings in respect to service delivery. One repeat finding is that while the Government regularly reports on the 12 Premier's priorities, there is no comprehensive reporting on the 18 State priorities.
1. Financial reporting and controls
Audit Opinions | Unqualified audit opinions were issued for all agencies' 30 June 2017 financial statements. |
Early close | Early close procedures continue to facilitate the timely preparation of financial statements and completion of audits, but agencies can make further improvement. |
Deficient user administration access | User access administration over financial systems remains an area of weakness. Agencies need to strengthen user access administration to critical systems. |
Transitioning to outsourced service providers | Transitioning of services to outsourced service providers can be improved. Outsourcing services can lead to better outcomes, which may include lower transaction costs and improved services, but it also introduces new risks. |
2. Service delivery
Premier and State Priorities | A comprehensive report of performance against the 18 State Priorities is yet to be published. While some measures are publicly reported through agency annual reports or other sources, a comprehensive report of performance against the 18 State Priorities would ensure all State Priorities are publicly reported, provide a single and easily accessible source of reference and improve transparency. |
ICT and digital government | The Digital Government Strategy was released in May 2017. Targets will need to be set to assess and monitor progress against the Strategy. |
Digital information security | Not all agencies are complying with the NSW Government's information security policy. This increases the risk of noncompliance with legislation, information security breaches and difficulty restoring data or maintaining business continuity in the event of a disaster or disruption. |
Property and asset utilisation | Property NSW's performance reporting would be enhanced by developing and reporting on customer satisfaction, reporting against set targets and benchmarking cost of service to the private sector. |
3. Government financial services
Prudential oversight of NSW Government superannuation funds |
Prudential oversight of SAS Trustee Corporation Pooled Fund and Parliamentary Contributory Superannuation Fund has not been prescribed. Structured and comprehensive prudential oversight of these funds remains important as they operate in a specialised, complex and continuously changing investment market sector, have over 106,000 members and manage investments in excess of $42.4 billion. |
Green slip scheme affordability | Currently, Green Slips in NSW are the most expensive in Australia. However, CTP reforms are expected to reduce the cost of Green Slips. |
This report sets out the results of the 30 June 2017 financial statement audits of NSW Government's central agencies and their cluster agencies.
Central agencies play a key role in ensuring policy coordination, good administrative and people management practices and prudent fiscal management. The central agencies and their key responsibilities are set out below.
Confidence in public sector decision‑making and transparency is enhanced when financial reporting is accurate and timely. Appropriate financial controls help ensure the efficient and effective use of resources and administration of agency policies. This chapter outlines our audit observations, conclusions or recommendations related to financial reporting and controls of agencies for 2016–17.
Observation | Conclusion or recommendation |
2.1 Quality of financial reporting | |
Unqualified audit opinions were issued for all agency financial statements. | The quality of financial reporting continues to remain strong across the clusters. |
2.2 Timeliness of financial reporting | |
Most agencies complied with the statutory timeframes for completion of early close procedures and preparation and audit of financial statements. | Early close procedures continue to facilitate the timely preparation of financial statements and completion of audits, but agencies can make further improvement. |
2.3 Financial performance and sustainability | |
We assessed the performance of agencies listed in Appendix six against some key financial sustainability indicators. This highlighted two agencies with negative operating margins of more than ten per cent and one agency with a liquidity ratio of less than 0.5. | These agencies have strategies in place to remain financially sustainability and manage their liquidity. Our analysis found that, overall, the agencies are not at high risk of sustainability concerns. |
2.4 Internal Controls | |
User access administration over financial systems remains an area of weakness. Sixteen moderate risk and ten low risk issues related to user access administration across eight agencies were identified. |
Recommendation: Agencies should review user access administration to critical systems to ensure:
|
Transitioning of services to outsourced service providers can be improved. Our 2016–17 audits identified one high risk issue relating to Property NSW's outsourcing of property and facility management services to the private sector. While a high risk issue was identified in 2015–16 from the Department of Finance, Services and Innovation's outsourcing of transactional and information technology services to GovConnect there has been an improvement in GovConnect's internal control environment throughout |
Outsourcing services can lead to better outcomes, which may include lower transaction costs and improved services, but it also introduces new risks. The transition needs to be carefully managed and requires thorough planning and effective project governance. This should be supported by oversight and direction from senior management and independent project assurance. |
2.5 Human Resources | |
The percentage of full‑time equivalent staff with annual leave greater than 30 days in the Finance, Services and Innovation, Premier and Cabinet and the Treasury clusters is 7.9 per cent, 17.1 per cent and 18.4 per cent respectively. | Agencies have strategies in place to reduce annual leave balances that are greater than 30 days. The effectiveness of these strategies will need to be monitored to ensure they are helping to achieve the desired outcome. |
This chapter outlines our audit observations, conclusions and recommendations relating to service delivery for 2016–17.
Observation | Conclusion or recommendation |
3.1 Premier and State priorities | |
The Department of Premier and Cabinet monitors the achievement of targets and the implementation of initiatives to deliver the 12 Premier’s Priorities. Responsible ministers and agencies manage the 18 State Priorities. A comprehensive report of performance against the 18 State Priorities is yet to be published. |
While some measures are publicly reported through agency annual reports or other sources, a comprehensive report of performance against the 18 State Priorities would ensure all State Priorities are publicly reported, provide a single and easily accessible source of reference and improve transparency. Where possible, independent sources are used to measure performance, however without independent assurance there is an increased risk that the target measures are inaccurate, not relevant or do not fairly represent actual performance. |
Performance against the State Priority to make NSW the easiest state to start a business is not currently published. |
Initiatives, such as easy to do business and red tape reduction are in place to help achieve this priority. The regulatory policy framework is under review following an October 2016 performance audit on ‘Red tape reduction’ that found the regulatory burden of legislation had increased. |
3.2 Financial management | |
Revenue NSW earned record crown revenue of $30.0 billion in 2016–17 to support the state's finances. | Record crown revenue has been driven by the sustained increase in duties revenue, which has increased by 93.7 per cent over the last five years. This is a consequence of the continued strength in the property market over this time and large one off NSW Government business asset sales and leases. |
3.3 ICT and digital government | |
The Digital Government Strategy (the Strategy) was released in May 2017 to build on reforms set out in previous ICT strategies. | The Strategy’s priorities and enablers aim to support digital innovation. Targets and measures will need to be set to assess and monitor progress against the Strategy. |
The Digital Information Security Policy (DISP) is a key tool that helps ensure a minimum set of information security controls are implemented across NSW Government agencies. A review of 2016 annual reports found 15 agencies (13 in 2015) did not attest to compliance with the DISP and of the agencies that attested to compliance, 34 reported issues associated with their compliance. |
The Strategy’s priorities and enablers aim to support digital innovation. Targets and measures will need to be set to assess and monitor progress against the Strategy. |
3.4 Property and asset utilisation | |
Property NSW's performance reporting could be |
Property NSW's performance reporting would be enhanced by developing and reporting on customer satisfaction, reporting against set targets and benchmarking cost of service to the private sector. |
This chapter outlines our audit observations, conclusions and recommendations specific to NSW Government agencies providing financial services.
Observation | Conclusion or recommendation |
4.1 Key issues | |
The SAS Trustee Corporation (STC) Pooled Fund and the Parliamentary Contributory Superannuation (PCS) Fund are not required to comply with the prudential and reporting standards issued by the Australian Prudential Regulation Authority (APRA). Amendments to relevant legislation allows the Minister for Finance, Services and Property to prescribe applicable prudential standards and audit requirements. |
Structured and comprehensive prudential oversight of these funds remains important as they operate in a specialised, complex and continuously changing investment market sector, have over 106,000 members and manage investments of more than $42.4 billion. Recommendation: The Treasury should liaise with the respective Trustees to implement appropriate prudential standards and oversight arrangements for the exempt public sector superannuation funds. |
Currently, Green Slips in NSW are the most expensive in Australia. Average premiums for Sydney Metropolitan vehicles increased by 10.4 per cent between 1 January 2016 and 31 December 2016. |
CTP reforms are expected to reduce the cost of Green Slips. The State Insurance Regulatory Authority will need to ensure it has appropriate processes in place to track and report against the expected benefits. |
4.2 Financial performance and sustainability | |
Net unfunded superannuation liabilities were $15.0 billion at 30 June 2017. Under the Fiscal Responsibility Act 2012, the NSW Government’s target is to eliminate unfunded superannuation liabilities by 2030. |
The superannuation funds’ strategic asset allocation and investment strategies are monitored and adjusted to help achieve a fully funded position by 2030. |
The Home Warranty Scheme commenced in 2011. Over this time total premiums collected have not been sufficient to cover expected claim costs. | Funding arrangements introduced during 2016–17 allow the Home Building Compensation Fund to apply to the Crown for reimbursement of unfunded realised losses from under-pricing of premiums. Other reforms are planned to address the long term sustainability of the home building compensation scheme. |
4.3 Investment performance | |
The NSW Government’s main superannuation funds have maintained the management expense ratio (MER) at consistent levels over the past two years. The Parliamentary Contributory Superannuation (PCS) Fund does not set an MER target. | MER is an industry recognised ratio to measure the performance of funds and investment managers. Recommendation: The Fund Secretary for the PCS Fund, in conjunction with the Trustee, should consider establishing an appropriate management expense ratio target to measure performance. |
Actions for State Finances 2017
State Finances 2017
Total State Sector Accounts received an unqualified audit opinion for the fifth consecutive year.
There was a $5.7 billion State budget surplus and continued investment in new infrastructure, in part funded by the long-term leases of Ausgrid and Endeavour Energy assets. This report also comments on key accounting matters, including the correction of some previously reported balances and the first time reporting of combined Cabinet members’ compensation in the Total State Sector Accounts.
Pursuant to the Public Finance and Audit Act 1983, I present my Report on State Finances 2017.
You will note that the format of this report has changed from previous years.
The intent of this change is to draw attention to the key matters that have been the focus of our audit and highlight significant factors that have contributed to the outcome.
First, it is pleasing to report once again that I issued a clear audit opinion on the State’s consolidated financial statements. This outcome demonstrates the Government’s continued focus on the quality of financial reporting across the NSW public sector.
High quality financial management and reporting are crucial to properly inform the public and build community confidence in our system of government.
The Treasury’s Financial Management Transformation program also aims to improve financial governance, budgeting and reporting arrangements across the sector. My Office is working collaboratively with The Treasury on reforms to reduce the burden of reporting, without weakening established safeguards.
The reforms should include measures to provide independent assurance of the budget process, of outcome reporting by agencies, and the power to “follow the dollar” given the increasing use of non-government organisations to deliver Government programs.
This Report also highlights another year of strong financial performance. The State’s budget result was a $5.7 billion surplus, and investment in new infrastructure has continued, in part funded by the long-term leases of Ausgrid and Endeavour Energy assets.
Finally, could I take this opportunity to thank the staff of The Treasury for the way they approached this audit. Our partnership is critical to ensuring NSW is an exemplar of quality financial management and reporting.
Margaret Crawford
24 October 2017
A clear audit opinion on the State’s consolidated financial statements was issued.
Timely and accurate financial reporting is essential for informed decision making, effective management of public funds and enhancing public accountability.
This year’s clear audit opinion reflects the Government’s continued efforts to improve the quality of financial reporting across the NSW public sector.
Since the introduction of ‘early close procedures’ in 2011-12, the number of significant errors in financial statements of agencies has generally fallen largely due to identifying and resolving complex accounting issues early. Agencies’ 2016-17 financial statements submitted for audit contained nine errors exceeding $20 million. All errors were subsequently corrected in the individual agencies financial statements.
Agencies should continue to respond to key accounting issues as soon as they are identified. Where issues are identified, accounting position papers should be prepared for consideration by the Audit Office, their Audit and Risk Committee members, and when relevant, The Treasury.
The State addressed the following key accounting matters during 2016-17.
The State recognised rail tunnels and earthworks valued at $8.5 billion.
Some rail tunnels and earthworks have never been valued by the State. These include the City Circle, the country rail network and other tunnels and earthworks built before the year 2000. Some of these tunnels and earthworks date back to the early 1900s.
For many years, the State did not account for these assets as they believed that their value could not be reliably measured. This year an independent valuer was engaged to perform a comprehensive valuation. The methodology used demonstrated
that the assets could have been reflected in the financial statements earlier.
The State recorded an additional $8.5 billion to correct the value of infrastructure assets at 1 July 2016.
Cabinet member’s compensation and related party transactions were reviewed.
Due to changes in Accounting Standards, the State had to consider 'related party information' in the financial statements. Previously this only applied to for-profit entities.
This year, requirements to report related party information extended to members of Cabinet, considered to be “key management personnel” of the State, as defined by Accounting Standards.
The Treasury implemented a process to assess and report Cabinet member’s compensation, and transactions between Cabinet members and/or their close family members, and government agencies.
Collectively, Cabinet members’ remuneration was $8.8 million, which was mainly salaries and allowances, and $3.5 million of non-monetary benefits such as security and drivers. The Treasury determined there were no other specific “related party” transactions or balances that required disclosure in the State’s financial statements.
Information system limitations continue at TAFE NSW.
TAFE NSW has experienced ongoing issues with its student administration system.
TAFE NSW has again implemented additional processes to verify the accuracy and completeness of revenue from sales of goods and services.
TAFE NSW expects to spend up to $89 million on a new information system to address these issues. Modules of the new student enrolment system are expected to be in place for the 2018 enrolment period.
Restatements relating to the General Government Sector's investment in the commercial sector.
The State corrected two previously reported balances relating to the General Government Sector’s investment in the commercial sector.
Accounting Standards require the General Government Sector to effectively store gains or losses related to its investment in the commercial sector in reserves until the investment is derecognised.
When these investments are disposed of, the cumulative gains and losses must be cleared and recognised in the operating result. However, the Government had previously cleared the cumulative gains and losses directly to Accumulated Funds within equity.
To comply with Accounting Standards, a total of $6 billion previously reported as a movement in equity at 30 June 2016, has now been corrected to the operating result.
In addition, Accounting Standards only allow gains or losses on its investments to be stored in reserves. In past years, the State recognised all changes in the value of its investment in Available for Sale Reserves, including the capital contributed to establish the State’s investment. In 2016-17, a total of $23.4 billion of contributed capital was corrected to accumulated funds at 1 July 2015.
The State’s budget result was a $5.7 billion surplus, $2.0 billion higher than the budget estimate.
The Total State Sector comprises 310 entities controlled by the NSW Government.
Of the total, the General Government Sector comprises 215 entities that provide goods and services not directly paid for by consumers.
The non-General Government Sector comprises 95 Government businesses that provide goods and services such as water and electricity, or financial services.
A principal measure of a Government’s overall performance is its Net Operating Balance, or Budget Result. The Net Operating Balance reports the difference between the cost of General Government service delivery and the revenue earned to fund these sectors.
The State has recorded budget surpluses and exceeded the original budget result in nine of the last ten years.
The State maintained its AAA credit rating.
The object of the Act is to maintain the AAA credit rating.
NSW’s finances are managed in alignment with the Fiscal Responsibility Act 2012 (the Act).
The Act established the framework for fiscal responsibility and strategy needed to protect the State’s AAA credit rating and service delivery to the people of NSW.
The purpose of maintaining the AAA credit rating is to reduce the cost of, and ensure the broadest access to, borrowings.
A triple-A credit rating also helps maintain business and consumer confidence so economic activity and employment are sustained. The legislation sets out targets and principles for financial management to achieve this.
New South Wales has credit ratings of AAA/Negative from Standard & Poor’s and Aaa/Stable from Moody’s Investors Service.
The fiscal targets for achieving this objective are:
General Government expenditure growth is lower than long term revenue growth.
General Government expenditure growth was 4.2 per cent in 2016-17, below the long-term revenue growth of 5.6 per cent.
Eliminating unfunded superannuation liabilities by 2030.
The Act sets a target of eliminating unfunded defined benefit superannuation liabilities by 2030. The State’s net superannuation liability was $58.6 billion at 30 June 2017 ($71.2 billion at 30 June 2016).
The Government predicts the 2030 target will be achieved. The State’s funding plan is to contribute amounts escalated by five per cent each year so the schemes will be fully funded by 2030. In 2016-17, the State made employer contributions of $1.5 billion, which is largely consistent with contributions over the past five years.
The liability values in the graph below do not reflect the values recorded in the Total State Sector Accounts. For financial reporting purposes, Accounting Standards (AASB 119 Employee Benefits) require the State to discount its superannuation liability using the government bond rate (refer to page 10 of this report).
The relevant government bond rate in the current economic climate is 2.62 per cent.
The State’s target for the unfunded superannuation liability is measured using AASB 1056 Superannuation Entities. This is because it adopts a measurement basis that reflects expected earnings on fund assets, which are currently between 5.9 and 7.4 per cent. Using these rates, the liability is $15.0 billion at 30 June 2017 ($16.1 billion at 30 June 2016). The unfunded liability is $2.4 billion less than when the Act was introduced.
The State’s assets grew by $31.6 billion during 2016-17 to $409 billion.
Valuing the State’s physical assets.
When we audit the financial statements, we focus on areas we consider as higher risk. These areas are often complex, and require the use of estimates and judgements.
The State has $307.2 billion of physical assets measured at fair value in accordance with Australian Accounting Standards. Fair value calculations are inherently complex and sensitive to assumptions and estimates, increasing the risk these assets are incorrectly valued.
In our audits, we assess the reasonableness and appropriateness of assumptions used in valuing physical assets. This includes obtaining an understanding of the valuation methodologies applied and judgements made. We also review the completeness of asset registers, and the mathematical accuracy of valuation models.
Net movements between years includes additions, disposals, depreciation and valuations. This year, valuations of physical assets added $16.2 billion to the State’s assets, comprising:
-
Transport for NSW and Railcorp $8.5 billion
-
New South Wales Land and Housing Corporation $4.8 billion
-
Roads and Maritime Services $930 million
-
Crown Entity $400 million.
The State’s financial assets increased $27.5 billion in 2016-17
The State’s financial assets have increased by 88 per cent over the past four years. In 2016-17, financial assets increased primarily due to proceeds from the sale of government assets and businesses.
The Government implemented reforms to better use the State’s financial assets. A key element was the creation of an Asset and Liability Committee (ALCO) to provide advice on ways to improve balance sheet management.
Since the creation of the ALCO, reforms include:
-
Establishment of the New South Wales Infrastructure Future Fund (NIFF). The net proceeds from the State’s asset recycling program are invested into the NIFF, which is managed by TCorp, with a balance of $14.6 billion by 30 June 2017. Funds raised are invested through the NIFF until the Government requires them for critical infrastructure projects that are part of the Restart NSW and Rebuilding NSW program of works. ALCO and TCorp provide advice on the NIFF’s performance and management
-
Establishment of the Social and Affordable Housing Fund ($1.1 billion at 30 June 2017). ALCO oversees the Fund to ensure an appropriate investment approach that will maintain funding certainty for new social and affordable housing stock
-
Cash and liquidity management reforms to centralise cash previously held by agencies in the Treasury Banking System. This reform is designed to ensure agencies have adequate levels of liquidity but with surplus funds invested centrally for better returns.
The State’s liabilities decreased by $13.1 billion during 2016-17 to $182 billion.
Valuing the State’s liabilities relies on an actuarial assessment.
Nearly half of the State’s liabilities relate to its employees. This includes unfunded superannuation, and employee benefits, such as long service and recreation leave.
Valuation of these obligations is subject to complex estimation techniques and significant judgements. Small changes in assumptions can materially impact the financial statements.
We address the risk associated with auditing these balances:
-
using actuarial specialists
-
testing controls around underlying employee data used in data models, and testing the accuracy of the calculations
-
evaluating assumptions applied in calculating employee entitlements such as the discount rate and the probability of long service leave vesting conditions being met.
The State’s superannuation obligations reduced by $12.6 billion in 2016-17.
The State’s $58.6 billion superannuation liability represents obligations for past and present employees, less the value of assets set aside to meet those obligations. The superannuation liability decreased from $71.2 billion to $58.6 billion, largely due to an increase in the discount rate from 1.99 per cent to 2.62 per cent. This alone reduced the liability by $9.2 billion
The State’s borrowings totalled $70.6 billion at 30 June 2017.
The State’s borrowings totalled $70.6 billion at 30 June 2017, $9.5 billion less than the previous year. This was largely due to the repayment of borrowings when the assets of Ausgrid and Endeavour Energy were leased to the private sector.
TCorp issues bonds to raise funds for NSW Government agencies. The bonds are actively traded in financial markets providing price transparency and liquidity to public sector borrowers and institutional investors. All TCorp bonds are guaranteed by the NSW Government.
The Government manages its debt liabilities through its balance sheet management strategy. The strategy extends to TCorp, which applies an active risk management strategy to the Government’s debt portfolio.
General Government Sector debt is being restructured by replacing shorter-term debt with longer-term debt. This lengthens the portfolio to better match liabilities with the funding requirements of infrastructure assets and reduces refinancing risks. It also allows the Government to take advantage of the low interest rate environment.
The State recorded revenue of $83.5 billion in 2016-17, an increase of $5.3 billion from 2015-16.
The State’s results are underpinned by revenue growth in taxation, fees and fines.
Taxation, fees, fines and other revenue comprises $30.5 billion of taxation ($28.7 billion in 2015-16) and $5.3 billion of fees, fines and other revenue ($4.6 billion).
Tax revenue for the Total State Sector increased by $1.8 billion, or 6.4 per cent compared to 2015-16, primarily due to:
-
one-off business asset sales and lease transactions, including $718 million in transfer duty from the Ausgrid and Endeavour Energy lease transactions
-
$385 million increase in payroll tax from growth in NSW employment and average employee compensation
-
a $426 million increase in land taxes.
Growth in stamp duty is expected to slow over the next 4 years.
General Government Sector stamp duties have increased from $6.2 billion in 2012-13 to $11.5 billion in 2016-17, an annual average growth rate of 16.5 per cent. The Government’s budget forecasts the growth in stamp duties to decline, to an average annual growth rate of 2.6 per cent between 2016-17 and 2020-21.
The State received Commonwealth grants and subsidies of $30.8 billion in 2016-17.
The State received $30.8 billion from the Commonwealth Government in 2016-17, $1.6 billion more than in 2015-16. This was primarily due to transaction based asset recycling grants of $1.0 billion and a $720 million increase in national land transport grants. This increase was offset by a $435 million decrease in General Purpose Grants, which mainly comprises New South Wales’ share of the Goods and Services Tax (GST).
The State spent $79.4 billion in 2016-17 to deliver services to the community, an increase of $3.9 billion from 2015-16.
Overall expenses increased 5.2 per cent from last year. Most of the increase was due to higher employee costs and operating costs.
Total salaries and wages increased by 4.2 per cent from 2015-16.
Total salaries and wages increased to $30 billion from $28.8 billion in 2015-16. The Government wages policy aims to limit the growth in remuneration and other employee costs to no more than 2.5 per cent per annum.
Operating expenses increased by 12.4 per cent from 2015-16.
Within operating expenses, payments for supplies, services and other expenses increased, in part, due to the State:
-
reacquiring mining licenses worth $482 million and additional land remediation costs of $101 million
-
spending more on health including additional drug supplies relating to Hepatitis C.
State spend on transport and communications increased by 68.1 per cent since 2012-13.
While spending on health and education remain the largest functional areas provided by Government, expenditure on transport and communication increased, on average, by 13.9 per cent annually between 2012-13 and 2016-17. This increase reflects the Government’s investment in transport infrastructure such as the Sydney Metro and Westconnex. Over the same period, spending on health increased by $3.9 billion.
Expenditure on fuel and energy has decreased by an average of 44.7 per cent since 2012-13, reflecting the State’s leases of electricity network assets.
In 2011, the Government established Restart NSW to fund high priority infrastructure projects.
Restart NSW projects are primarily funded from the proceeds from the asset recycling program enabling Government to deliver new infrastructure investment.
Restart NSW provides funding for the delivery of Rebuilding NSW, which is the Government’s 10-year plan to invest $20 billion in new infrastructure.
The State finalised long-term leases of Ausgrid and Endeavour Energy assets.
In June 2017, the Government finalised its long-term lease of 50.4 per cent of Endeavour Energy. This transaction follows on from the long-term leases of TransGrid in December 2015 and 50.4 per cent of Ausgrid in December 2016. Net proceeds of $15.0 billion were paid into Restart NSW relating to these transactions.
The Government also finalised an arrangement for the private sector to provide land titling and registry services to the public for 35 years. The State, through Restart NSW, received an upfront payment of $2.6 billion from the new operator.
Restart NSW is funding $29.8 billion of new infrastructure.
The Government has detailed its plan to invest $20 billion into the Rebuilding NSW plan from Restart NSW.
At 30 June 2017, around $2.9 billion has already been spent on Rebuilding NSW projects from Restart NSW, with a further $9 billion included in the budget aggregates. The Government has also earmarked a further $8.1 billion in Restart NSW for future projects.
The most significant project is the Sydney Metro. The Government has committed $7.0 billion from Restart NSW to build a 30-kilometre metro line, linking Sydney Metro Northwest at Chatswood, through new stations in the lower North Shore, the Sydney CBD and southwest to Bankstown. At 30 June 2017, $2.4 billion has been spent on this project from Restart NSW.
Other significant projects funded by Restart NSW include a $1.8 billion contribution to WestConnex and reserved funding of $1 billion towards the State’s Major Stadia Network program.
The Treasury initiated the Financial Management Transformation (FMT) program with the aim of changing and improving financial governance, budgeting and reporting arrangements of the New South Wales public sector.
FMT aims to deliver better outcomes for the people of New South Wales and focuses on transparency and accountability for expenditure, and better value for money.
New Financial Management System
PRIME is the Information Technology (IT) solution component of the FMT program, replacing several historical systems. PRIME will provide both financial and performance information within one IT platform for all agencies in the NSW public sector.
It is expected to give Government more timely information to plan and deliver its policy priorities and the budget.
Independent assurance over the budget process would improve confidence in the reliability of the State’s financial information.
Actions for Sydney Road Maintenance Contracts
Sydney Road Maintenance Contracts
In November 2013, Roads and Maritime Services (RMS) outsourced the maintenance of State roads in the Sydney region south and west zones using an innovative contracting approach called the Stewardship Maintenance Contract (SMC). The SMC links risk to reward, and uses a performance framework where outcomes should drive improved performance over time.
WA | VIC | QLD | NSW | |
---|---|---|---|---|
Roads managed (lane kms) | 52,659 | 50,510 | 71,353 | 80,348 |
Estimated spend ($/lane km) | 5,000 | 4,500 | 6,000 | 7,000 |
Road quality measure (%) | 99 | 99 | 94 | 91 |
Parliamentary reference - Report number #288 - released 15 June 2017
Actions for NorthConnex
NorthConnex
The processes used to assess NorthConnex adequately considered value for money for taxpayers.This report also found that the impact of tolling concessions on road users and the motorway network was consistent with policy objectives described in the 2012 NSW Long Term Transport Master Plan.
Parliamentary reference - Report number #287 - released 8 June 2017