Reports
Actions for Internal controls and governance 2024
Internal controls and governance 2024
About this report
Internal controls are key to the accuracy and reliability of agencies’ financial reporting processes. This report analyses the internal controls and governance of 26 of the NSW public sector’s largest agencies for the 2023–24 financial year.
Findings
There are gaps in key business processes, which expose agencies to risks. These gaps are identified in 121 findings across the 26 agencies—including 4 high risk, 73 moderate risk and 44 low risk findings. All four high-risk issues related to IT controls and 19% of control deficiencies were repeat issues. Thirty-five per cent of agencies had deficiencies in control over privileged access.
Shared IT services
Six agencies provide IT shared services to 120 other customer agencies. All six had control deficiencies—three of these were high risk. Four agencies provide no independent assurance to their customers about the effectiveness of their own IT controls.
Cyber security
Eighteen agencies assessed cyber risk as being above their risk appetite. Fourteen of these agencies had not set a timeframe to resolve these risks and two agencies have not funded plans to improve cyber security.
Fraud and corruption control
Agencies need to improve fraud and corruption control. Instances of non-compliance with TC18-02 NSW Fraud and Corruption Policy were identified, including gaps such as a lack of comprehensive employment screening policies and not reporting matters to the audit and risk committee.
Gifts and benefits
Management of gifts and benefits requires better governance and transparency. All agencies had policy and guidance but all had gaps in management and implementation—such as not publishing registers nor providing ongoing training.
Information Technology
Nine agencies did not effectively restrict or monitor user access to privileged accounts.
Recommendations
The report makes recommendations to agencies to implement proper controls and improve processes in relation to:
- organisational processes
- information technology
- cyber security
- fraud and corruption, and
- gifts and benefits.
Read the PDF report
Internal controls are processes, policies and procedures that help agencies to:
- operate effectively and efficiently
- produce reliable financial reports
- comply with laws and regulations
- support ethical government.
This chapter outlines the overall trends for agency controls and governance issues, including the number of audit findings, the degree of risk those deficiencies pose to the agency, and a summary of the most common deficiencies found across agencies.
This chapter outlines our audit observations, conclusions and recommendations arising from our review of agency controls to manage key financial systems.
This chapter outlines our audit observations, conclusions and recommendations arising from our review of agencies' cyber security.
This chapter outlines our audit observations, conclusions and recommendations from our review of agencies' fraud and corruption control framework, policies and practices. Our Internal Controls and Governance 2018 found a number of fraud and corruption control gaps in NSW Government.
The NSW Treasury Circular TC18-02 NSW Fraud and Corruption Control Policy (the Circular) requires NSW government agencies to develop, implement and maintain a fraud and corruption control framework. The Circular sets out minimum standards for a NSW Government agency’s fraud and corruption control framework.
Previous Audit Office report on agency fraud and corruption control
Report on Internal Controls and Governance 2018 (published October 2018) The report found there were gaps in the fraud and corruption controls by some agencies, which increased the risk of reputational damage and financial loss. Where relevant, we have included the results from our 2018 report on Internal Controls and Governance below for comparison purposes. |
This chapter outlines our audit observations, conclusions and recommendations arising from our review of agencies' managing of gifts and benefits.
Actions for Threatened species and ecological communities
Threatened species and ecological communities
About this report
Over 1,100 native animals, plants and ecological communities are listed as threatened in New South Wales. The Department of Climate Change, Energy, the Environment and Water (DCCEEW) delivers programs and activities aiming to reduce the risk of extinction for threatened species and ecological communities.
This audit assessed whether DCCEEW has effectively delivered outcomes to support threatened species and ecological communities across New South Wales including delivery of the statutory Biodiversity Conservation Program (Saving our Species).
Findings
DCCEEW uses a risk‑based approach to guide and deliver a range of programs aiming to improve the outcomes for threatened species and ecological communities.
However, DCCEEW has not effectively determined departmental priorities, coordinated programs to align efforts, or reported on the overall outcomes it is delivering for threatened species and ecological communities.
Further, DCCEEW does not capture sufficient data to monitor species that it is not actively managing, creating a risk that it cannot readily identify or respond to further decline.
Under the Saving our Species program, DCCEEW is delivering conservation actions for less than one‑third of all threatened species and ecological communities. This number has reduced over time, in line with reduced program funding.
Gaps in core program planning and risk management frameworks create program delivery risks.
Recommendations
The report made several recommendations to DCCEEW, focusing on:
- Strengthening Saving our Species program compliance, governance, planning and risk management frameworks.
- Developing a long‑term framework to coordinate and align efforts across DCCEEW for the delivery of threatened species outcomes.
- Expanding activities to improve coordination with other parts of government delivering activities that impact on outcomes for threatened species.
This chapter assesses the effectiveness of DCCEEW’s ability to report on threatened species outcomes across its various programs and activities, and its strategic planning for the delivery of these outcomes at a departmental level.
Under Part 4, Division 6 of the BC Act, DCCEEW is required to deliver a Biodiversity Conservation Program. The program’s statutory objectives are to:
- maximise the long-term security of threatened species and ecological communities in nature
- minimise the impacts of key threatening processes on biodiversity and ecological integrity.
Under Section 4.36 of the BC Act, the program must have:
- strategies to achieve the objectives of the program in relation to each threatened species and threatened ecological community
- a framework to guide the setting of priorities for implementing the strategies
- a process for monitoring and reporting on the overall outcomes and effectiveness of the program.
Appendix one – Response from agency
Appendix two – Legislative and regulatory provisions relevant to threatened species
Appendix three – Programs and activities relevant to threatened species
Appendix four – Comparison of statutory provisions for the conservation of threatened species
Appendix five – About the audit
Appendix six – Performance auditing
© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.
Parliamentary reference - Report number #399 released 15 August 2024.
Actions for Regional Digital Connectivity program
Regional Digital Connectivity program
About this report
The Regional Digital Connectivity program (RDCP) is intended to improve mobile coverage and internet connectivity in regional NSW.
The RDCP includes two funding programs, one for improving mobile coverage and the other for improving internet connectivity. Both programs provide grant funding to commercial telecommunications providers for eligible mobile and internet projects.
This audit assessed whether the Department of Regional NSW (the department) is effectively administering the RDCP to meet program objectives.
Findings
The department's approach to identifying priority areas for RDCP funding was comprehensive and it largely distributed funding in line with these priorities.
The department has not specifically defined the overall objectives of the RDCP. The department has developed business cases that set out each program’s respective objectives, but these do not consistently describe the objectives of the RDCP.
The department also has not developed an overarching investment strategy, which would assist it in addressing potentially conflicting priorities.
Deficiencies in project and risk management have contributed to delays in the department’s implementation of the program.
The department is not monitoring progress against outcomes, which limits its ability to demonstrate that the program is achieving its intended purpose.
The department did not meet its original mobile coverage performance target but met its internet connectivity target.
Recommendations
To improve RDCP administration, the report recommends that by June 2025, the department should:
- develop an overarching investment strategy for the RDCP
- outline the expected timelines for RDCP projects and ensure that these timelines are updated regularly
- develop and report on RDCP outcome indicators
- update the RDCP evaluation plan
- update the expected benefits of the program to reflect changes in the RDCP.
The Regional Digital Connectivity program (RDCP) is funded through the Snowy Hydro Legacy Fund (SHLF). Under the Snowy Hydro Legacy Fund Act 2018 (SHLF Act), the purpose of the SHLF is to improve economic development in regional New South Wales and to fund infrastructure projects that primarily benefit regional New South Wales. A priority area for SHLF investment is delivering improved mobile coverage and internet connectivity in underserved and remote communities.
The RDCP has been implemented by the Department of Regional NSW (the department) since 2019. The RDCP is broadly split into two funding programs. The larger funding program is for improving mobile coverage and the other funding program is for improving internet connectivity and is referred to as the Gig State program. Both programs provide grant funding to commercial telecommunications providers for eligible mobile and internet projects.
Over $300 million from the RDCP was allocated to improve mobile phone coverage and increase the number of mobile service providers across regional NSW. The mobile coverage program is being delivered through the following sub-programs:
- Snowy Mountains Highway Safety project – co-funding with Snowy Hydro Limited to build five mobile towers along the Snowy Mountains Highway to improve mobile coverage.
- Active Sharing Partnership (ASP) pilot – co-funding with private providers to deliver active sharing mobile technology in regional areas.
- ASP main program – This is the main round of the mobile coverage program. A business case has been developed, but no funding has been distributed through this sub-program.
- Mobile Black Spot Program Round 5A – co-funding with the Australian Government’s Mobile Black Spot Program to deliver new or upgraded mobile towers in regional and remote locations.
- Mobile Black Spot Program Round 7 (MBSP7) – co-funding with the Australian Government’s Mobile Black Spot Program to deliver new mobile infrastructure.
Over $100 million from the RDCP was allocated to the Gig State program to improve regional internet connectivity through partnering with multiple providers and using a range of technologies suitable for rural and regional locations. The Gig State program was launched in 2019 and underwent significant changes in 2021 following an Infrastructure NSW deep dive review into the project. These changes to the program are referred to as the Gig State addendum. The Gig State program is being delivered through the following sub-programs:
- Cobar corridor connectivity – providing fixed wireless internet access to five locations between Narromine and Cobar.
- nbn regional NSW fixed wireless – co-funding with nbn to deliver new or co-located fixed wireless broadband towers in 56 locations.
- Wamboin, Bywong and Sutton connectivity – improving internet connectivity in these three towns as part of a NSW Government commitment.
- Regional Connectivity Program Round 3 (RCP3) – co-funding with the Australian Government’s Regional Connectivity Program to provide additional internet infrastructure.
The objective of this audit was to assess whether the Department of Regional NSW is effectively administering the Regional Digital Connectivity program to meet program objectives. The audit examined:
- how effectively the department identifies priority areas to target RDCP funding
- how effectively the department distributes RDCP funding in line with program objectives
- how effectively the department measures the performance of the RDCP.
The department has not specifically defined the overall objectives of the RDCP
The RDCP is delivered as part of the SHLF. Under the SHLF Act, the purpose of the SHLF is to improve economic development in regional New South Wales and, for that purpose, to fund infrastructure projects that primarily benefit regional New South Wales. One of the priority areas for SHLF investment is digital connectivity, which is being delivered through the RDCP.
While the purpose of the SHLF is set out in the SHLF Act, the department has not specifically set out the overall purpose and objectives of the RDCP and how it will focus the RDCP on achieving the SHLF’s purpose. Such a document would support future business case development, and support the coordination and prioritisation of objectives across the business cases that have already been developed.
While the overall objectives of the RDCP are yet to be defined, there are objectives set out in the business cases for the separate programs but these are not consistently described. The Gig State business case advises that the RDCP’s goal is to enable transformative long-term benefits for regional areas through investment in digital connectivity. This goal aligns with the purpose of the SHLF Act. However, this objective is not set out in the mobile coverage business case, or any other document, and it is not clear how the RDCP is intended to fulfil this objective.
The Gig State business case sets out three objectives for the RDCP that provide further definition to the SHLF Act’s purpose, though it is unclear how these were determined and whether these are intended to cover the entire RDCP:
- address the digital divide between regional and metro NSW
- resolve market failures in the regional NSW telecommunications market
- leverage Government assets and capabilities wherever possible.
The mobile coverage ASP pilot business case sets out a similar set of objectives, though there are some differences, such as the third objective being to ‘leverage Government assets and capabilities to achieve transformative results.’ It is important for the department to clarify the RDCP’s objectives to ensure a unified approach to investment decisions. At the time of the audit, the department’s website had a different set of objectives for the RDCP. They are:
- build digital infrastructure to increase capacity
- expand mobile coverage and provider choice
- improve internet service, speed and quality
- bridge the digital divide between regions and cities.
The department also provided a 2022–23 ‘division plan’, with goals for the mobile coverage and Gig State programs. These include:
- extend and improve internet coverage to deserving locations in regional NSW
- investigate emerging digital technologies to improve connectivity
- deliver new and improved mobile coverage to regional NSW communities
- encourage competition in the regional telecommunications market.
While these different sets of objectives broadly align, there is no consistency across these business cases in describing the objectives of the RDCP. This indicates that there is a lack of clarity about the intended objectives of the RDCP. Further, the origin of the list of objectives in the ‘division plan’ is unclear. This reinforces the need to clearly define objectives for the overall RDCP.
Each business case the department has developed for RDCP programs has defined objectives that align with the SHLF’s purpose
The Gig state and mobile coverage business cases also define objectives for each program. These objectives align with the SHLF’s purpose, set out above. The Gig State business case advises that the purpose of the Gig State program is to:
- address the digital divide between metro and regional NSW so that the price, quality, and choice of digital connectivity options in metro areas are made available in regional areas of NSW
- resolve market failures in regional NSW telecommunications
- leverage Government assets or investment where appropriate to achieve transformative long-term benefits for regional areas.
The ASP pilot business case states similar objectives, though it does not mention the ‘price, quality, and choice’ stated in the Gig State business case. The ASP pilot business case also lists another three objectives:
- address mobile black spots where people live and work
- investigate new and emerging technologies to future proof mobile coverage in regional NSW
- promote consumer choice in the delivery of mobile services.
The ASP main program has a different set of objectives to the ASP pilot and include:
- reduce the digital divide and enhance social inclusion by improving mobile coverage in regional locations not covered by existing programs
- encourage competition in the regional telecommunications market to provide consumers greater choice, lower prices and improved services
- address commercial viability and technical constraints to providing mobile coverage in regional areas
- improve community resilience to emergency events through improved regional mobile service.
The RDCP program objectives align with relevant whole-of-government strategic objectives
There are several whole-of-government strategies that seek to guide government investment in digital infrastructure. While there is no document setting out the overarching objectives of the RDCP, the objectives set out for the mobile coverage program and the Gig State program align with these whole-of-government objectives.
The objectives align with the 2018 and 2021 ‘20 Year Economic Vision for Regional NSW’. For example, the 2018 ‘20 Year Economic Vision for Regional NSW’ sets out principles for regional NSW investment, including ‘Affordable, reliable and fast internet to support people and businesses.’
The RDCP sub-programs also align with the 2018 and 2022 State Infrastructure Strategies. In particular, the 2018 strategy has a set of recommendations around improving connectivity across NSW and another set of recommendations around investing in technology that improves productivity and social outcomes. One of the roles of the Gig State program is to help to implement the 2018 strategy’s recommendation to support statewide access to 50Mbps download and 10Mbps upload capacity by 2025. These speeds are specifically stated in the Gig State grant guidelines as an eligibility requirement for funded programs.
Both sub-programs of the RDCP also align with the NSW Connectivity Strategy. The NSW Connectivity Strategy has two directions of particular relevance: ‘All customers have metropolitan equivalent digital capacity’ and ‘Connectivity blackspots continually decrease across the State’. The first of these objectives has three strategic directions which are directly relevant to both the Gig State program and the mobile coverage program:
- remote, rural and peri-urban citizens can access and effectively use digital systems and services for employment, justice, education, health, social, personal and entertainment use
- Aboriginal and Torres Strait Islander communities have equitable access to connectivity that meets their local community needs
- connectivity services are affordable for citizens no matter where they live, with access to a choice of providers.
Elements of both the Gig State and mobile coverage programs align with these, including the focus on expanding access and affordability.
In regard to regional Aboriginal communities, the RDCP may also contribute to the NSW Closing the Gap Implementation Plan, as the merit criteria in the grant guidelines for mobile coverage and Gig State grants include the extent to which the project will contribute to sustainable procurement and employment outcomes, including supporting Aboriginal businesses and employment. The criteria for prioritising locations for mobile coverage also includes extending coverage to discrete Aboriginal communities as something which could improve the score given to an application. However, this is not set out as an explicit objective of the program.
The department has not set out an overarching investment strategy for the RDCP to address potentially conflicting priorities or identify situations where funding may not align with program objectives
As noted above, the overall objectives of the RDCP have not been defined. The department does not have an overarching strategy setting out program objectives, how funding will be aligned with these objectives, and how the objectives will be prioritised. It is important to set out funding principles to establish how the elements of the stated objectives will be delivered and prioritised. Not setting these out risks funding decisions that do not align with program objectives.
As noted above, the mobile coverage ASP pilot business case lists two objectives around addressing mobile black spots and promoting consumer choice in the delivery of mobile services. These objectives may be potentially in conflict as expanding coverage can be done by funding one carrier to expand their own network, while promoting consumer choice could conceivably be done by funding a carrier to expand their network into areas already covered by only one existing carrier, thus increasing competition in those areas.
The department has not set out the relative weighting of its objectives across the RDCP funding packages and how it will prioritise funding in accordance with them. An overarching strategy would assist the department with prioritising funding in accordance with the objectives of the program, including determining the relative weight of each objective.
In addition, the department has not described the extent to which price reductions in the cost of internet will be prioritised as an objective of the Gig State program. The Gig State business case sets out that one of the objectives of the program will be to provide metropolitan equivalent or better service, quality and pricing for internet services in regional areas. It is unclear how internet pricing fits into the overarching objectives of the RDCP given that it is not mentioned as an objective of the SHLF. There would be value in setting out strategic investment principles and objectives to guide this decision-making and clarify the extent to which internet investment is intended to fulfil this purpose.
A lack of clarity about program objectives may also have impacted decisions about funding priorities. For example, the Gig State program business case sets out a plan to invest in Low Earth Orbit (LEO) satellites through a subsidy program. As noted above, the Gig State business case sets out some objectives for the RDCP, including leveraging government assets. While an investment in LEO satellites through subsidies may assist with bridging the digital divide, it is not clear how this aligns with the objective of leveraging government assets. More clarity over program objectives and a clear investment strategy may assist with clarifying this and similar investment decisions in future. As discussed below, the investment in LEO satellites did not proceed.
The department comprehensively identified priority areas that require improved mobile coverage for the mobile coverage program
As outlined above, the final business case for the mobile coverage ASP pilot program identifies three objectives for the mobile coverage program, including addressing the digital divide between metropolitan and regional NSW, and resolving market failures in regional NSW telecommunications. The department identified priority areas for improved mobile coverage in line with these objectives. The department refined its approach to prioritising locations for the mobile coverage ASP main program which resulted in a more comprehensive analysis of potential sites.
The department developed and implemented a structured process using a range of criteria to identify and prioritise suitable locations for funding. Before allocating funding to its mobile coverage program, it was necessary for the department to determine areas that required additional mobile coverage. The department undertook this work for both its mobile coverage ASP pilot program and the ASP main program as part of designing the grant programs. A key source of information it relied on for identifying priority areas for the pilot program was the Australian Government’s National Mobile Black Spot Database. The database identified around 4,000 mobile black spot locations across NSW. This database is no longer in use as it relied on community reports of mobile black spots which were unverified.
For its mobile coverage ASP pilot program, the department applied a series of filters to the mobile black spots identified in the database. It removed metropolitan areas, areas within a 10km radius of an existing mobile tower site, and areas that had already been selected for funding under either Commonwealth or State funded programs, such as the Connecting Country Communities Fund. This left the department with a list of around 1,200 potential sites.
The department then mapped the 1,200 identified black spot sites to their respective 383 unique locations and assessed and prioritised the mobile black spots and locations against a range of economic, community and feasibility criteria. Under the economic criteria, the department prioritised areas that had higher numbers of employed persons and higher proportions of land being used for agriculture or farming. Under the community criteria, the department prioritised areas based on the increase in the population that would benefit from expanded coverage, the increase in Aboriginal and Torres Strait Islander people that would benefit from the coverage, the increase in the kilometres of highway and main roads that would benefit that were within five kilometres of a mobile black spot, and areas with more square kilometres prone to bushfires or flooding that would benefit. Under feasibility criteria, the department prioritised areas that were closer to government and nbn infrastructure. This process resulted in 50 prioritised locations containing 307 black spot sites across 34 Local Government Areas in NSW.
For its mobile coverage ASP main program, the department undertook a detailed coverage analysis to identify locations with no and limited mobile coverage. It identified these using the latest publicly available coverage maps from the three mobile network operators and the distance of locations from existing sites/towers as published by the Australian Communications and Media Authority and the Radio Frequency National Site Archive databases. Using this data as the key source of information in determining mobile coverage resulted in a more comprehensive outcome than relying on the National Mobile Black Spot Database. The department did not use the National Mobile Black Spot Database, as this information was considered unreliable and had not been updated since 2018, and the coverage maps were more reliable.
The analysis focused on locations with small populations, road corridors, and tourism locations. It identified 257 locations with no or poor coverage consisting of 68 small population locations, 117 road corridors and 72 tourism locations. The department then analysed these possible locations against a range of criteria. These included maximising the number of people and businesses that would be supported, increasing the extent of existing coverage, determining whether coverage would support government strategies or Premier’s Priorities, other positive social impacts, focusing on the greatest length of road and most heavily used roads, and maximising the number of tourism businesses and points of interest impacted.
The department conducted analysis based on these criteria and shortlisted 24 small population locations, 24 road corridor locations and 12 visitor economy locations. These locations were taken forward for concept design, cost estimation, and economic and financial appraisal as part of the final business case.
The department’s initial approach to prioritising Gig State funding was based around larger regional centres
The department undertook a two-stage process for identifying priority areas for Gig State program investment. The first involved the identification of larger NSW towns that would benefit from additional internet coverage and where data centres could be located, and the second involved a selection of more remote locations to receive additional funding.
The department did not undertake an initial detailed analysis of internet coverage across NSW to prioritise funding for the Gig State program. Undertaking this work would have been in line with the Gig State program objectives of addressing the digital divide between metropolitan and regional NSW and resolving market failures in regional NSW telecommunications. In order to meet these objectives, it was important to first establish the extent of the digital divide and market failure before seeking to resolve it.
Instead, it categorised NSW towns according to their relative size and importance from a connectivity perspective. It prioritised towns with larger populations and more business users to maximise the potential benefit of the infrastructure. The department also prioritised locations that were closer to other telecommunications infrastructure, and it also considered proximity to other potential elements of the Gig State network for greater connectivity and to ensure that it was taking a whole-of-State approach to investment decisions. This process identified 14 major regional towns.
The department then prioritised two of these regional towns, Dubbo and Wagga Wagga, due to the higher prices paid by NSW Government agencies in the two locations for average internet bandwidth usage when compared to other regional and metropolitan population centres across NSW. The costs to government were considered a proxy for how much business users are likely to be charged for connectivity services in regional NSW towns. The department conducted surveys in both towns indicating that business users were paying higher prices than their metropolitan counterparts for higher-grade connectivity. This aligned with the department’s Gig State program objectives which related to providing price, quality and choice.
The department also included five satellite towns along the road from Dubbo to Cobar (Cobar corridor) in the Gig State final business case as well as the towns of Wamboin, Bywong and Sutton. The department’s prioritisation of funding for these locations was not based on any detailed analysis of need. The department identified that as part of its initial plan to expand the internet connectivity from Dubbo to Cobar, it would be able to connect a number of towns between those two at a reduced cost. There was no analysis of alternative options for expending this money, such as expanding coverage to other areas, or to determine the extent of coverage required in each town. The Wamboin, Bywong and Sutton project was prioritised as a result of a $5 million NSW Government commitment. This project is discussed further below.
The department strengthened its approach to targeting Gig State funding in 2021
The department reviewed and updated its approach to the Gig State program in September 2021. As part of this, it revised its approach to targeting funding, including the use of additional data and identifying areas with greater digital connectivity issues. This represented an improved approach compared to the original business case and aligned more closely with the changes that were made to the Gig State program in 2021, outlined in the Gig State addendum, which focussed more on the delivery of fixed wireless services rather than data centres.
The department carried out an analysis of areas that only have satellite internet coverage (i.e., no fibre or fixed wireless internet availability) to identify areas suitable for different types of technology such as fibre optic cables, fixed wireless and LEO satellites. This was more in line with the Gig State program objectives of addressing the digital divide and resolving market failures. It identified that these locations had challenging digital connectivity issues that were not likely to be resolved without government intervention. This process identified around 1,000 locations. This list was then refined by looking to maximise the number of premises and businesses, maximising the density of premises, prioritising locations with other Government assets, mobile sites and other technology available in the area, and locations close to an existing exchange to leverage existing infrastructure.
The location list was then prioritised based on scoring criteria for economic drivers, feasibility, risk and stakeholders. The economic criteria included the number of residential and business premises, the number of businesses, and the estimated construction costs for the infrastructure. The feasibility criteria included availability of existing and planned infrastructure. Stakeholder related criteria included identifying synergies with other government led programs, as well as sites that scored low on Australian Digital Inclusion Index (ADII) scores and the Socio-Economic Indexes for Areas. These criteria are appropriate and align with the objectives of the Gig State program.
The department’s process resulted in a list of 23 prioritised areas. These were generally areas with a higher density of premises and affordable access to infrastructure for power supply and data transmission.
The department considered socio-economic data when planning for Gig State and mobile coverage programs but did not use this to inform its pilot mobile coverage program
NSW Government Business Case Guidelines (TPP18-06) state that one of the main reasons for government action is promotion of equity where the distribution of economic costs and benefits is considered inequitable. It is therefore important for the department to consider socio-economic data in the planning of the RDCP.
The department has included some socio-economic data and ADII scores in the profiles it developed for each Local Government Area. It applied socio-economic data to identify additional priority areas for new and improved internet coverage through the Gig State program. However, it did not apply this data to identify priority areas across the pilot mobile coverage program of the RDCP. It improved its approach when developing the ASP main program by including socio-economic data as a component of its scoring for prioritising locations.
The department considered socio-economic data when selecting locations for grant funding. The mobile coverage grant guidelines and the Gig State grant guidelines both include merit criteria that consider whether the proposed solution would address disadvantage within a community. Both guidelines ask the grant applicants to consider the Index of Relative Socio-economic Advantage and Disadvantage.
The department engaged with key stakeholders when developing the RDCP
Under TPP18-06, NSW Government departments are required to identify and consult with key stakeholders as they can contribute to the development of the investment proposal by providing their expert opinions, research, and evidence.
The department identified key stakeholders, developed stakeholder engagement plans, and used feedback gained through consultations to design and adjust the RDCP. Key stakeholders have been involved on the RDC Steering Committee and the RDC Project Control Group ensuring that they have an avenue to provide input into the overall RDCP. This includes the Commonwealth department responsible for telecommunications infrastructure and telecommunication providers.
The department engaged with stakeholders when developing the ASP pilot program. As discussed below, the department transitioned the program from a one-stage pilot program, where telecommunication providers would be procured to provide the solution, to a two-stage program where the department would first work with telecommunication providers to identify technical solutions and then carry out the procurement. This involved significant engagement with stakeholders to identify the technical solution and procurement model.
The department has assessed the suppliers of internet and mobile connectivity to determine their capacity and willingness to participate in RDCP sub-programs
As part of procurement planning, when building a business case, NSW Government agencies are required to analyse and engage with the market. This involves developing a profile of the market, the capabilities of suppliers, innovative and emerging technology, and factors that influence the market such as customer preferences and competition.
The department considered the capacity of telecommunications suppliers, their level of interest, and willingness to participate in the program when developing the business cases for its mobile and internet coverage programs. In addition to doing this when constructing initial business cases, the department adjusted its approach when market factors changed, as evidenced by the changes it made to its Gig State program in 2021. In September 2020, the nbn announced an expansion of its fibre network nationally, with a focus on regional improvements. This meant that internet coverage for some of the locations included in the Gig State business case would be addressed by nbn and continued investment was not needed in those areas. The initial Gig State business case also planned an initial investment in data centres in regional NSW. Following this, a private market operator also announced plans to construct 14 regional data centres across NSW. This meant that the planned Gig State data centres were no longer required. The department changed it approach to avoid duplication by ceasing its planned internet coverage expansion into regional centres, including the data centres, and prioritising a range of new sites for coverage.
Conflicts of interest and probity procedures have largely been followed, although there were some gaps in declarations
Maintaining a record of conflict of interest declarations is important to provide a higher level of transparency, and therefore control, over officials in high-risk roles. Disclosing an interest before it becomes a conflict of interest also reduces the likelihood that an official will be tempted to conceal or favour the interest.
Conflict of Interest declaration forms have been completed for staff involved in the mobile coverage program, Gig State program and the Australian Government co-funded Regional Connectivity Program Round 3 (RCP3) and Mobile Black Spot Program Round 7 (MBSP7). Whilst the list of declarations is extensive, it is unclear whether it includes all relevant staff from the department, the NSW Telco Authority and consultants involved with the program.
In relation to the mobile coverage and Gig State programs, there was no declaration recorded for one consultant and three staff from the department, including the program sponsor. These omissions have the potential to create risks that conflicts of interest go unmanaged. The department advises that the register is now complete for all those working directly on the program. It also advises that, due to the breadth of programs senior staff oversee, conflicts of interest are managed by the department's Governance team centrally through a Declarations App.
Four declarations of a ‘real, potential or perceived conflict of interest’ were made under the RCP3 and MBSP7 grant programs, which were co-funded with the Australian Government. No declared conflicts were made for the other programs. The identified conflicts of interest have documented actions to manage them, and there is evidence to indicate that these were implemented. For example, a senior staff member and a consultant excluded themselves from parts of a grant process due to declared conflicts.
The NSW Grants Administration Guide states that officials must seek probity advice for all grant opportunities that are complex, high-risk or high-value, to support the design, application, assessment and decision-making phases. The department followed appropriate probity processes throughout and these probity reports did not find any material breaches of probity in the grant processes.
There have been delays in all streams of the RDCP which may have been reduced through proactive project and risk management
The business cases set out expected timelines for each program of the RDCP. The department has not met any of these expected timelines, with some projects delayed by over a year compared to their initial planned timelines. Some of these delays have been caused by changes to the department’s approach to the mobile coverage and Gig State business cases. While some of these changes were outside of the department’s control, others could have been anticipated and better managed by a stronger approach to project management and risk management.
Exhibits 1 and 2 set out the status of each Gig State and mobile coverage project reviewed as part of this audit as at April 2024 and the planned completion date for that project at the outset of the program. Note that this does not include projects co-funded by the Australian Government due to the department’s limited ability to influence the process. This also excludes projects which have not yet distributed funding, such as the mobile coverage ASP main program.
Project | Current status | Planned completion |
Cobar corridor | Solution design | June 2022 |
NBN fixed wireless | Feasibility studies | Early 2024 |
Other provider fixed wireless | Contract negotiation | Early 2024 |
Wamboin, Bywong and Sutton | Construction (paused) | Original business case: Gig State addendum: |
Source: Audit Office analysis.
Project | Current status | Planned completion |
Snowy Mountains Highway Safety program | Completed March 2023 | Early 2022 |
Active Sharing Partnership pilot | Construction | June 2023 |
Source: Audit Office analysis.
As can be seen from Exhibits 1 and 2, each project in the RDCP has been delayed past its initially planned completion date, and the Wamboin, Bywong and Sutton project has been delayed past both its original planned completion date and also the revised completion date in the Gig State addendum.
Some of these delays can be accounted for by the fact that the department revised its approach to both the mobile coverage ASP pilot and the Gig State programs. While some of these changes were outside of the department’s control, others could have been anticipated and managed by more proactive risk management. In the case of the mobile coverage program, some of this change in approach may have been foreseeable. The March 2021 mobile coverage ASP pilot business case set out a one-stage tendering process with construction planned for completion in June 2022. The department revised this approach in July 2021, when it changed to a two-stage process involving a technical stage and then a grant process. This was the result of additional research by the department that identified that the market may not have sufficient interest in the initial proposed approach. Undertaking this additional research earlier may have allowed for this alternative approach to be identified sooner.
In addition, the department only allowed two months in the business case for contract negotiations with providers for the mobile coverage ASP pilot program, however this has taken a significantly longer time and in one case has been ongoing for over twelve months. Given the complexities of the funding deed negotiations, this may also have been foreseeable. The department advised that some delays in the mobile coverage program can be attributed to the proposed merger of major mobile network operators which delayed funding deed negotiations.
As with the mobile coverage program, the Gig State program was also delayed by a change in approach, though this was driven by market changes. As part of the original Gig State business case, the department intended to deliver data centres in regional NSW, as well as expanding internet coverage. The business case was approved in December 2019 and the department intended to complete the Gig State program in June 2022. Little progress had been made by the time that the Gig State program underwent a significant change in scope following a review in September 2021. The department removed some aspects of the original business case, such as the construction of data centres in regional NSW, and changed the approach to other parts of the business case. The revised business case, called the Gig State addendum, delayed the planned delivery date of some projects into 2022.
The most significantly delayed sub-program has been the expansion of internet access to the towns of Wamboin, Bywong and Sutton as part of the Gig State program. In January 2019, the NSW Government announced $5 million of funding to provide internet access to these towns. The department ran a tender for this work in mid-2021 with a plan to start construction in late 2021. However, this tender resulted in no contract being awarded due to no providers being willing to provide the project within the proposed $5 million budget. The department started working on technical solutions with providers in late 2021 and gave them until May 2022 to identify solutions and potential budgets. The contract for Wamboin, Bywong and Sutton was executed in June 2022, with an expected completion date of June 2024, though given delays with construction this date will not be met. As discussed below, if the department had provided better advice to Government on the expected costs at the planning stage, it may have reduced the delays in this sub-program.
The department has not effectively managed RDCP timelines
The department has provided limited evidence of effective project management in place to monitor overall progress against program timelines, such as regularly updating a detailed project plan. The department may have identified and managed the above delays sooner through a stronger project management approach.
The department set out timelines at the outset of each of the sub-programs. This was not always done in detail but for all the sub-programs at least key milestones were mapped. While this was done at the outset, there is no evidence that the department regularly updated timelines across the various sub-programs to ensure that these projects were on track and to monitor expected completion dates.
The department provided regular updates on project status to relevant governance committees. This included providing information on upcoming milestones and associated delays. However, holistic monitoring of program completion dates and the impact of delays on subsequent milestones was not presented to the governance committees. As a result, there has been little monitoring and oversight of how projects are tracking against their target end dates.
Gaps in the governance framework have limited the oversight of the implementation of the RDCP
There are three key committees that oversee the implementation of the RDCP: the SHLF Steering Committee, the RDC Steering Committee, and the RDC Program Control Group. These three committees are intended to provide oversight of the implementation of the RDCP, however there are deficiencies that limit the effectiveness of their oversight.
The SHLF Steering Committee is intended to provide oversight of all programs funded through the SHLF, including the RDCP. Despite an intended meeting schedule of quarterly, the committee only met once in 2023 and three times in each of 2021 and 2022. While the Committee did receive reports on each of the programs funded through the SHLF at these meetings, this reporting did not identify any key risks for these projects that might affect achieving the objectives of the SHLF. This reduces the level of oversight that the SHLF Steering Committee can provide for these projects.
The RDC Steering Committee provides oversight of the RDCP and is intended to act as an escalation point for key issues in the program. While the committee receives regular reports on the components of the RDCP, including on program risks, there are some gaps that limit the oversight it can provide. The committee operated throughout 2021, 2022 and 2023 without finalised terms of reference, which were finalised in February 2024. Prior to this, it was unclear how often the RDC Steering Committee was intended to meet, but it met only four times in 2023 compared to six in 2022.
The RDC Steering Committee terms of reference include a role for the committee in making key decisions around program strategy and implementation. Prior to 2023, the committee was involved in many key decisions. For example, in 2022 it endorsed decisions around the ASP pilot grant guidelines. By contrast, a review of meeting minutes since the start of 2023 shows that the RDC Steering Committee has not made decisions or provided endorsements for any key decisions. The committee was not involved in endorsing the MBSP7 and RCP3 grant guidelines in 2023 and was not involved in strategic decision-making about the budget reprofiling in 2023 and the decision to remove the LEO satellite pilot from the Gig State program scope.
The RDC Program Control Group did not have terms of reference until February 2024. The purpose of the RDC Program Control Group is to oversee and support the strategic direction and implementation of the RDCP. This should be carried out through regular meetings and reporting, however the control group only met six times in 2023 despite an intention that they would meet monthly. The expected meeting frequency has since changed to every six weeks.
The RDC governance committees routinely discuss risks, but the department did not identify or mitigate all key risks at the outset of the program
The department has a structured approach to risk management for the RDCP, though this risk management approach has not always succeeded at mitigating key risks. The RDCP program team identified a number of key risks at the outset of each program and designed mitigations for them. In addition, the RDC Steering Committee and RDC Project Control Group both receive risk reports and discuss risks at meetings where appropriate. This reporting indicates a proactive approach to risk management throughout the program.
However, not all key risks were successfully mitigated or identified at the outset of the program. For example, one of the key causes of delays with the mobile coverage program has been protracted contract negotiations. Despite the fact that the program team understood the complexities of the mobile contract negotiations that would be required, this was not identified as a risk at the outset of the program. Later in the program this was identified by the RDC Program Control Group and Steering Committee as a key risk. While the risk was identified, it was not sufficiently mitigated, as demonstrated by the delays that resulted from the contract negotiations.
Other risks were not identified at the outset of the program. For example, the Snowy Mountains Highway Safety program was delayed due to the need to get development approval from the National Parks and Wildlife Service. There is no separate risk register for the Snowy Mountains Highway Safety program, and the potential for delays due to approval processes is not mentioned in any of the overall mobile business cases. Stronger initial project management may have allowed for this to be identified.
The Wamboin, Bywong and Sutton internet coverage program has been delayed numerous times throughout the course of its delivery. One of the key delays in 2023 was that, after the contract was signed and building works had commenced, it was discovered that challenging ground conditions with a higher than anticipated rock concentration around the towns was delaying construction. Potential delays from construction issues were not foreseen in the Gig State program risk register. While the specific issues relating to ground conditions may not have been easily foreseeable at the outset of the program, the department’s evaluation of potential providers in 2021 noted that rock was present and could have an impact on the cost of the program. It is reasonable to expect that this would have led to additional risk mitigation at the time, detailing the potential impact of the rock concentration on both cost and timelines. When the issue was eventually discussed in the RDC Project Control Group in 2023, the only mitigation for the risk was to review and monitor the existing and future schedule. This was not sufficient to mitigate the risk.
The department conducted cost-benefit analyses for all RDCP sub-programs, but did not implement the element with the highest return on investment
The ‘NSW Government Guide to Cost-Benefit Analysis’ requires that a cost-benefit analysis (CBA) be undertaken for capital, recurrent or ICT projects valued at more than $10 million. Undertaking a CBA provides a benefit-cost ratio (BCR) which helps to determine if a program will provide a net benefit to the people of New South Wales. A BCR greater than one indicates that the benefits will exceed the costs. For programs funded through the SHLF, such as the RDCP, there is no requirement for a program to achieve a BCR of greater than one.
The department conducted a CBA for the Gig State and mobile coverage programs, as well as all the sub-programs under both programs, including revising the CBA for the Gig State program after it was reviewed in late 2021. The BCR for the mobile coverage and Gig State programs are shown in Exhibit 3. Only the Gig State initial business case achieved a BCR of one, meaning that it delivers benefits equivalent to its costs. However, when this program was amended in 2021, this BCR reduced to 0.62. When combined, the RDCP does not have a BCR greater than one, meaning that it represents a net cost to New South Wales. However, as noted above, there is no requirement for the RDCP to reach a BCR of one.
Business Case | BCR |
Mobile coverage project pilot | 0.59 |
Mobile coverage ASP main program | 0.19 |
Gig State | 1.00 |
Gig State addendum | 0.62 |
Source: Department of Regional NSW.
The highest BCR was calculated for the planned investment in Low-Earth Orbit (LEO) satellites which is an element of the Gig State addendum, but this investment did not go ahead. LEO satellites can be used to provide digital connectivity to isolated properties. They sit closer to the Earth’s surface than a geostationary satellite and can transmit data with lower delay and improved connectivity. This LEO satellite pilot was identified to deliver a BCR of 2.62, including approximately 40% of the benefits attributable to the Gig State addendum. The Gig State addendum anticipated that the pilot would commence in 2022, however the department did not proceed with this. The 2023 budget reduced the funding for the Gig State program, and the department decided to discontinue the proposed pilot. The department advises it plans to revisit the LEO satellite project in mid 2025.
The RDCP’s grant guidelines largely comply with mandatory NSW Government requirements
In September 2022, the NSW Government released the revised ‘Grants Administration Guide’ (the guide) which, among other things, sets out mandatory requirements for NSW Government grant guidelines. Premier’s Memorandum ‘M2022-07 Grants Administration Guide’ makes it mandatory for agencies to follow the requirements of the guide for all grants released from 19 September 2022.
The guide states that clear and consistent grant guidelines must be prepared that contain the purpose and objectives of the grant, selection criteria (comprising eligibility and assessment criteria) and assessment process, grant value, opening and closing dates, application outcome date, the source agency, and the decision-maker.
The department developed grant guidelines for grant schemes funded by the RDCP. The guidelines explain the application and selection process, eligibility criteria and assessment criteria, and key dates. These include:
- Mobile Coverage Project – Active Sharing Partnership Grant Guidelines (September 2022)
- Gig State Grant Guidelines (October 2022)
- NSW Government Co-Investment in RCP3 and MBSP7 Program Guidelines (July 2023).
The guidelines for these three grant programs largely align with the requirements of the guide, but there were some gaps. The ASP pilot and Gig State program guidelines both note the contact person for complaints, but the RCP3 and MBSP7 guidelines do not state this. While the RCP3 and MBSP7 guidelines set out the relevant decision-maker and the role of key individuals in the assessment process, the guidelines for the ASP pilot did not identify the decision-maker and the Gig State Grant Guidelines did not provide the membership of the assessment panel making the recommendations.
The department’s grant programs were designed to target identified priority locations
Across the RDCP sub-programs, the department designed grant programs in a way that targeted funding towards its priority locations and other locations that met its eligibility criteria. The department has not been prescriptive about locations that would be funded through grant programs, but designed the programs in a way that encouraged providers to co-fund either the target locations or those that fit the criteria that the department was interested in funding.
For the Gig State grant program, the department released a list of preferred locations to potential applicants. The grant guidelines make clear that any proposals to build infrastructure to provide coverage to these areas would be given preferential treatment. The merit criteria are also aligned with this as the department awarded additional points for providing coverage to the target areas. Locations outside the preferred list were also eligible, provided they met the grant program’s objectives and eligibility criteria.
Similarly, for the mobile coverage ASP pilot program, the department released a list of preferred locations to potential applicants. The grant guidelines similarly encouraged potential applicants to follow this target list, both in terms of eligibility and also in terms of the way that the grants program provided additional points for providing coverage to the target areas. In addition, applicants could consider locations outside of the preferred list provided they met the grant program’s objectives and eligibility criteria set out in the grant guidelines.
For the co-funding opportunity with the Australian Government’s RCP3 and MBSP7 programs, a list of target locations was again provided. Applicants could consider locations outside of the target locations provided they were still eligible under Australian Government requirements for the RCP3 and MBSP7. Alternative solutions that provide mobile coverage on road corridors and mobile solutions for First Nations communities in other remote and very remote NSW locations could also be considered, however, funding was to be allocated to target locations and target transport corridors as a priority.
The department was not able to demonstrate a similar approach for the co-investment in the Mobile Black Spot Program Round 5A. The Australian Government developed eligibility criteria for the program, which align with the department’s mobile program objectives.
The department has selected grant recipients in line with its funding priorities
The department developed grant guidelines and an assessment methodology for the Gig State program and the ASP pilot program to guide its assessment panel, and applicants, through the process. The department assessed the applications for the Gig State and the ASP pilot grant programs against the eligibility and merit criteria contained in its guidelines, and in accordance with its assessment methodology. This resulted in the department funding locations that aligned with its target locations or areas that were in line with the purpose of each grant opportunity.
For the Gig State grant program, the department determined that projects were to be located in one of the 93 regional NSW Local Government Areas (LGA) identified in the grant guidelines. Eligible locations were in areas where internet access was via satellite services only and there were no committed or planned projects for fixed services in the area. The assessment panel for the Gig State grants recommended projects in 34 eligible locations from four applicants, for funding totalling $58.3 million (excl. GST), intended to bring improved connectivity to around 13,900 premises.
For the ASP pilot program, eligible locations were areas of regional NSW, where there was no existing handheld coverage provided by any Mobile Network Operators (MNO) or existing handheld coverage was provided by only one MNO. The assessment panel for the ASP pilot grants recommended 32 projects for funding totalling $30.4 million (excl. GST), intended to improve mobile coverage across ten regional LGAs. All other projects were considered not suitable for funding or ineligible.
The department provided a list of preferred locations for both grant programs. Applicants received a marginally higher score against assessment criteria if they put forward a preferred location but the location they identified could still be accepted if it was not in a preferred location but met the eligibility criteria. Funding was allocated to the majority of the Gig State program preferred locations identified in the Gig State business case addendum, but funding was allocated to only two of the 23 preferred locations identified in the business case for the ASP main program.
For the grants co-funded by the Australian Government (RCP3 and MBSP7), the department prioritised and selected grant recipients based on whether they met the eligibility criteria. It developed an assessment methodology to guide the assessment panel through this process. A probity advisor was present at both assessment panel meetings.
The department intends to further verify the RCP3 and MBSP7 application’s compliance with the RDCP objectives and eligibility criteria, following the assessment of applications by the Australian Government. Once verified, deeds will be negotiated and issued.
The department did not advise Government on the full cost of the Wamboin, Bywong and Sutton project, leading to a protracted and difficult process
The department’s process for awarding the grant to construct a fibre network for internet connectivity in the Wamboin, Bywong and Sutton regions was complex. The department appears to have estimated the initial costs of this program to be significantly higher than the funds allocated to the project. The department did not advise Government of this, and conducted the tender process based on the budget of $5 million committed by the Government. This budget proved insufficient, and the department had to request additional funds to contract the project. Not providing this advice to Government at an earlier stage means that the process which followed was more complex and protracted than it may have been if the department had provided this advice.
In January 2019, the NSW Government announced that it would provide $5 million to upgrade internet in the Wamboin, Bywong and Sutton region based on costings undertaken by a local community organisation. The department included this cost in the Gig State business case in December 2019 and also the Gig State addendum in September 2021. Documentation from late 2020 indicates that the department conducted an initial estimate that the full cost of the Wamboin, Bywong and Sutton project would be up to $16.3 million. It is unclear whether this was conducted before the Gig State business case was completed. The department was unable to provide the analysis that led to this initial cost estimate to the audit team. However, this indicates that the department was aware that the cost of the project would be greater than $5 million but did not provide this advice to Government. The additional cost was to be funded from the remainder of the Gig State business case.
In mid-2021, the department commenced a tender process with a budget of $5 million in January 2021. Only two applicants responded to this initial request for tender, and only one was evaluated as meeting the technical and construction requirements of the project. The cost estimates provided in the complying tender response were significantly higher than $5 million. As a result, the department did not award a contract following this tender.
The department then planned to undertake an in-depth analysis into alternative technology options. It noted the most promising option in terms of speed of delivery, quality of service, and value for money was LEO satellites. The department was unable to provide a copy of this analysis and so it is unclear the extent of the work undertaken to find alternative solutions for Wamboin, Bywong and Sutton rather than the construction of a fibre network to the premises.
After the initial market approach resulted in no contract being awarded, the department altered its procurement approach. A closed Expression of Interest (EOI) was sent to both respondents to the request for tender in November 2021 seeking a recommended technical solution, a proposed delivery method and timeframes. Both respondents achieved satisfactory scores for the EOI and were invited to submit a detailed design. As the department had determined through the tender process that the budget of $5 million was insufficient to ensure that it could provide internet services across the Wamboin, Bywong and Sutton region, the budget limit for the procurement was increased.
Both respondents submitted a detailed design and in May 2022 the department received approval to negotiate. The unsuccessful respondent scored marginally higher against the selection criteria. However, the assessment team considered that their proposal contained too much unmitigated risk. In May 2022, the department received approval to proceed to the negotiation phase with the successful proponent. Following this negotiation, a $9.5 million grant was awarded to the successful respondent to connect 1,352 premises. Around 140 premises were not included in the scope due to the significantly higher costs in connecting these premises.
The project cost has since increased to over $12 million, in part due to challenging terrain and ground conditions. Additional funding of around $1.7 million was also approved to connect an additional 134 properties that were identified during the detailed design phase. The department advises that these were initially missed due to boundary changes, incorrect council records and quality issues in the geospatial databases. It indicated that this is a separate group of properties to the 140 premises that were excluded due to higher connection costs.
The fact that the Wamboin, Bywong and Sutton project has a total cost of over $12 million, more closely aligned with the department’s internal cost estimate, indicates that fully advising Government of the costs may have saved significant time in the delivery of the project.
The department monitors the progress of its grant agreements but has not formalised its acquittal process
The department receives progress reports and milestone reports from grant recipients to assist in monitoring the progress of RDCP projects and assess if works provided match the requirements listed in the grant funding agreements. It also advises it has regular meetings with grant recipients, although no minutes are kept of these meetings.
The projects that have progressed to the construction phase are:
- Mobile coverage to Brewarrina and Wilcannia through the mobile coverage ASP pilot
- Improved internet to Wamboin, Bywong and Sutton.
The department receives regular progress reports for both projects, including some photographs and technical drawings. The reports provide information on progress against milestones and any changes to expected completion dates.
The department receives quarterly progress reports on improved internet for the Cobar corridor and the 56 other sites scheduled for fixed wireless internet, which are yet to progress to construction. The current scheduled completion date is March 2025. It also receives monthly reports on progress with mobile towers it is co-funding with the Australian Government as part of the Mobile Black Spot Program Round 5A.
The department provided few acquittal process documents or milestone acquittal documents, apart from the site qualification report for the Cobar corridor and its evaluation of the detailed design for the Wamboin, Bywong and Sutton project. The department advises it has an acquittal process in place for processing milestone reports, however it is yet to formalise this process. The three projects which have progressed enough to require acquittal are Wamboin, Bywong and Sutton, Wilcannia and Brewarrina, and the Cobar corridor.
The department has provided funding deeds for each project it has funded. Whilst the deeds include milestones, they do not include the dates for each milestone making it more difficult for the department to track the progress of each project.
The department’s approach to reporting its expenditure on consultants is inconsistent and does not always meet reporting requirements
Under the Annual Reports (Departments) Regulation 2015 agencies are required to report any consultancy engagements over $50,000 in their annual reports. The NSW Procurement Board Direction PBD-2023-05 Engagement of professional services suppliers defines a consultancy agreement as a type of professional services agreement where a person or organisation is engaged to provide recommendations or professional advice to assist decision-making by management.
The department has several professional services agreements as part of the RDCP, some of which are consultancy engagements within this definition and some of which contain elements of the contract that would be considered a consultancy agreement. For example, one of the major consultancy agreements involves providing strategic advice across the Gig State program, as well as providing advice on market engagement, and reviewing technical advice. This aligns with the definition of a consultancy agreement as the contracted organisation is providing professional advice to assist decision-making by management.
The department has not reported any of its agreements used as part of the RDCP in its annual reports, despite having several agreements that exceeded the $50,000 threshold which may fall into this definition.
The department advises that the agreements are categorised in the General Ledger as contractors and as such, are not required to be reported in the Department’s Annual Report. This interpretation is not in accordance with NSW Treasury and NSW Procurement Board requirements. It also identifies one contracted consultant as a ‘consultancy’ in its contract variation documentation but has not reported this expenditure in its annual reports.
Further, the department has not applied its interpretation consistently. For example, it has reported the preparation of some strategic and business planning documents as consultancies in its annual reports and not others.
The department is not monitoring the outcomes of the RDCP
Measuring outcomes of a program is important to determine whether that program is fulfilling its intended purpose. While many elements of the RDCP are still at an early stage, there is value in monitoring the outcomes of those elements which have completed construction to inform project implementation. There are no outcome measures for the effectiveness of the RDCP as a whole, and only limited measures for the mobile and Gig State programs. The department has the following outcome that it has set out for the Gig State program:
- Improve the digital connectivity (accessibility) in rural and remote NSW communities.
When developing the final business case for the Gig State program, the department utilised the ADII scores to identify the digital divide between Metropolitan Sydney and rural NSW. The ADII uses data from the Australian Internet Usage Survey to measure digital inclusion across three dimensions of access, affordability and digital ability. While the department utilised the ADII to determine the baseline for accessibility of digital connectivity in regional and remote NSW communities, the department is not using the ADII to measure whether the program has led to improvements in these communities. This limits the department’s ability to determine whether the RDCP has met its objectives.
At the time of the Gig State business case being developed, rural NSW ADII scores were reported, allowing the department to utilise the figures as a baseline, but since 2020 these are not publicly reported. The department is in the process of determining how it can use ADII scores to measure the performance of the program over time.
In addition to the Gig State program outcome measure, the department has one outcome measure for its mobile coverage program:
- Square kilometres with improved mobile coverage in regional NSW.
This outcome measure will not allow the department to understand the impact of the RDCP’s mobile coverage program. While measuring the number of square kilometres of coverage will allow the department to determine whether the mobile towers it is funding are achieving the intended extent of new mobile coverage, it will not allow the department to measure the quality of service, price of coverage, and other key information that could measure the impact of the new coverage.
In December 2023, the NSW Telco Authority released the NSW Digital Connectivity Index (DCI), which provides an overview of connectivity in each LGA and suburb across NSW. Each LGA and suburb is given a score out of 100 for access, affordability and demographics (as a proxy for the ability to use technology). The DCI includes several data points, including coverage from telecommunications providers, mobile signal strength, and internet speed. Given that the DCI includes useful data points and can allow for data to be inspected at the suburb level, there is an opportunity for the department to use this to identify the impact of its program both at a statewide level and in regions targeted for funding. However, the department has no plans to utilise the DCI to measure program performance.
In addition to not collecting data to measure the overall effectiveness of the RDCP, the department is also not collecting data to measure whether a number of the objectives of the Gig State and mobile coverage programs are being achieved. For example, both programs aim to reduce the price of digital services in regional areas, however there is no measurement of price in place to determine whether this is being achieved. Similarly, there is no plan in place to measure the speed of internet services or signal strength for mobile services, despite improvements in these things being part of the objectives of both programs as set out in their business cases.
The department is also not measuring whether there are improvements in competition in the mobile market through the mobile coverage program, despite one of the objectives of that program being to encourage competition in the regional telecommunications market. The department also has no plans to measure its contribution to the Closing the Gap target to understand the impact of the RDCP on Aboriginal communities. This is despite it identifying that seven locations with current or pending funding will support discrete Aboriginal communities. Four of these locations are part of the ASP project for Wilcannia and Brewarrina, and the other three are funded through the MBSP7 project.
The department has some output performance measures in place for the RDCP, but these focus on contracted outputs rather than outcomes
The department has identified performance measures for the program in reporting templates, in its final business cases for the Gig State and mobile coverage programs, and in its evaluation plan for the RDCP. These performance indicators measure the outputs of the program rather than the outcomes that would demonstrate whether program objectives have been met.
The measures that the department uses to report to NSW Treasury as part of its budgeting process have changed over time. Until June 2023, the department used two key output measures to determine the progress of the RDCP:
- Number of premises covered by signed contracts to deliver upgraded internet connectivity.
- Number of sites with signed contracts for new mobile coverage.
As noted, these are output measures and will not enable the department to determine whether the project is delivering its intended purpose. Since July 2023, the department has used two output measures:
- Number of premises covered by signed contracts to deliver upgraded internet connectivity.
- Contracted square kilometres for new and improved mobile coverage.
These four measures relate only to contracted coverage and do not provide a clear picture of ongoing progress with the construction and connection of new mobile and internet projects. Projects can have long lead times for a variety of reasons such as acquiring access to land, designing a solution and the time required to construct the solution. In addition, only measuring contracted coverage will not enable the department to determine whether these outputs are being delivered and will not reflect delays in those stages, nor will it enable the department to determine whether the towers are achieving their intended purpose. While there is value in measuring contracted coverage as an early lead indicator of performance, there is also value in reflecting the current state more accurately through measuring the progress of the construction of each project.
The department did not meet its original mobile coverage performance targets but met its Gig State program target
As noted above, the department had three metrics that it was using to measure the RDCP until June 2023. The department successfully achieved its Gig State program target but did not achieve its mobile coverage program targets. Exhibit 4 shows the results against targets for the RDCP measures. As can be seen, the result for square kilometres of improved mobile coverage delivered was significantly below the target.
Measure | Target | Target date | Results |
Square kilometres with improved mobile coverage in regional NSW | 36,00 | June 2023 | 718 |
Number of premises covered by signed contracts to deliver upgraded internet connectivity | 2,500 | June 2023 | 13,330 |
Number of sites with signed contracts for new mobile coverage | 25 | June 2023 | 24* |
* This comprises two towers funded through the ASP project and 22 towers co-funded through the Australian Government’s Mobile Black Spot Round 5A. This does not include five small towers for the Snowy Mountains Highway Safety project as the department has identified these as a temporary service.
Source: Audit Office analysis.
The department revised its performance measures after June 2023. This included revising output targets for the mobile and Gig state programs. The updated performance targets can be seen in Exhibit 5. The mobile coverage program performance measure was changed to measure the contracted square kilometres of new coverage rather than the actual square kilometres of new coverage. At the same time, the target value increased from 36,000 square kilometres to 60,000 square kilometres. The target value for the Gig State program was also updated compared to the 2023–24 target.
Measure | Target | Target date |
Contracted square kilometres for new and improved mobile coverage | 60,000 | December 2028 |
Number of premises covered by signed contracts to deliver upgraded internet connectivity | 15,000 | December 2025 |
Source: Department of Regional NSW.
The department had nearly achieved its December 2025 target for contracted upgrades to internet connectivity by June 2023. As can be seen in Exhibit 4, 13,330 premises were covered by signed contracts to deliver upgraded internet connectivity as at June 2023.
In early 2023, the department estimated that it would have 12,279 square kilometres of new or improved mobile coverage delivered by December 2025. The department advised that it is likely to deliver on this forecast as early as December 2024, through its co-funding of two ASP locations and 22 locations under the Commonwealth’s Mobile Back Spot Program 5A.
There is uncertainty around whether the data the department is using is reliable to measure its performance
The department is collecting or planning to collect data from grant recipients to determine whether they are delivering the intended projects to the required quality. The funding deeds contain obligations on the quality and extent of the services to be provided by grant recipients and require that the contracted organisations report to the department on the construction and the extent of coverage (new ground covered for the mobile towers and number of premises connected for internet coverage). This aligns with the output measures set out above. The department is not collecting information that it could use to inform outcome measurement as part of its grant funding deeds with each grant recipient.
Grant recipients provide the department with the data that it has requested in line with the terms of the funding deeds. This information is collected through a regular schedule of status reporting. These status reports include information on progress with internet or mobile coverage, including the number of premises that will be able to connect to a service.
Information on the availability of fixed fibre connections to premises should be reliable, as with the Wamboin, Bywong and Sutton project. However, data on the availability and quality of fixed wireless internet connectivity and mobile coverage is likely to vary with terrain. While the department is collecting this information, it currently has no plans or a formal process to undertake validation testing following each project completion. This means that the department will not be able to provide assurance that the information collected is accurate.
The department has not updated the expected benefits of the program despite significant changes in scope
In September 2021, following a review of the Gig State program, the department prepared an addendum to the original Gig State business case to change the program from capital expenditure to operational expenditure, and set out a range of other changes. The department’s addendum to the business case noted that the approach to delivering benefits would remain the same, and it did not revisit the benefits realisation register nor attempt to recalculate expected benefits. Given the significant scope changes in the business case addendum, it is likely that there would have been an impact on expected benefits that would justify recalculating the program benefits.
This was not the only time where significant changes in the Gig State program’s operations did not result in an updated benefits realisation register. As noted in the introduction, the RDCP budget was reduced in the 2023 budget, and the remaining budget was extended out to 2028. As discussed above, the change in budget coincided with the department’s decision to discontinue the LEO satellite pilot, which was anticipated to deliver 40% of the financial benefits of the program. The change in budget profile for the program has likely led to a change in the benefits profile of the program, however the department has not updated its program assumptions in line with this change.
The department has documented key lessons learned from its funding rounds to date
Documenting lessons learned from early delivery of any given program is important, particularly pilot programs, to ensure that these can be incorporated into future program development. The department has documented lessons learned across the two programs of the RDCP, including the early grant rounds.
For its Gig State program, the department documented lessons learned in relation to the management of grants, industry engagement, the grant guidelines, the assessment of grants, and the time that the grants went to market. These lessons include reinforcing positive experiences, such as releasing a list of preferred locations to applicants, which the department believes served to encourage funds to be directed to those areas. The department also identified potential improvements, including how it communicated with industry and the data that it would request from future applicants. There have been no grant programs run through the Gig State program since these lessons were documented so it is not yet clear whether the department will implement changes as a result of these lessons learned.
As noted above, the mobile coverage ASP pilot program was delivered across two phases: the first phase involved working with industry to determine potential technical solutions, and the second phase was a grant program to deliver the preferred solutions. The department commissioned a lessons learned report of the first phase of the ASP pilot program with the intention of using this to inform the mobile coverage ASP main program business case development. The lessons learned report and the mobile coverage ASP main program business case were both completed in the same month, however, meaning that lessons could not be fully incorporated into that business case. The department has also identified additional lessons learned specifically in relation to the grant process. There have been no grant programs run through the mobile coverage ASP main program since these lessons were documented so it is not yet clear whether the department will implement changes as a result of these lessons learned.
In addition, the department has conducted an internal audit on the governance of the RDCP. The internal audit had largely positive findings about the governance structures and the grant guidelines. The internal audit did not make findings on the governance issues outlined above, such as not having finalised terms of reference. However, the internal audit did note that not all probity advice had been documented and some had been provided verbally, which increased the risk of grant processes not being undertaken with integrity.
The department has planned evaluations for all grant programs within the RDCP
The department has a draft evaluation plan for the RDCP that includes evaluations for each program to validate whether they have achieved their objectives, as well as finalised evaluation plans for each of the programs. Both process and outcome evaluations are planned. Process evaluations ensure that planned processes were followed and that lessons are learned for future grant programs. The department is planning process evaluations for when all funding deeds have been signed and outcome evaluations are planned for after project delivery is largely complete.
The sub-programs have not yet reached the point where the department will undertake outcome evaluations. The department has indicated that the outcome evaluations will be undertaken when each project has been delivered, which means that while it will determine whether the project has achieved its objectives, it will not be measuring outcomes on an ongoing basis to determine whether changes are needed for the program to meet its objectives. The funding deeds with grant recipients make it clear that the department will undertake an evaluation and may collect relevant information for this purpose. While the department should be able to collect information, the limitations in data collection noted above may need to be resolved to ensure that required data is available.
Appendix one – Response from agency
Appendix two – About the audit
Appendix three – Performance auditing
© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.
Parliamentary reference - Report number #397 released 27 June 2024.
Actions for Universities 2023
Universities 2023
About this report
Financial audit results of the NSW public universities’ financial statements for the year ended 31 December 2023.
Audit findings
Unmodified audit opinions were issued for all ten universities.
Eight universities reported net deficits. Three of these improved on their 2022 results.
Total fees and charges returned to pre-pandemic levels, with 40.5% earned from overseas students from three countries.
Employee related expenses increased 10.2% in 2023 mainly due to an additional 2,830 full time equivalent staff, in response to increased teaching and research activities.
Key issues
The number of findings reported to management has increased to 111 matters in 2023 up from 88 in 2022.
These included one high risk finding and 62 moderate risk findings, a 72% increase from last year.
Gaps identified in universities governance processes included delays in responding to findings and recommendations; staff not attesting compliance with codes of conduct annually; and not capturing and recording staff conflicts of interests within central registers.
Seven of the ten universities have cyber security risks above what they determine as an acceptable risk. Four universities did not have a cyber security uplift program.
Recommendations
Universities should address all recommendations made in the report (see Appendix one for a summary of these).
In particular, there should be a focus on prioritising remediation of wage underpayments to affected employees; ensuring a centralised conflict of interest register is maintained for all staff; considering emerging risks in university risk registers; ensuring controlled entities are considered when determining internal audit plans; and focusing efforts to improve cyber security risk management and cyber resilience capability.
This report provides NSW Parliament with the results of our 2023 financial audits of universities in New South Wales and their controlled entities, including analysis, observations and recommendations in the following areas:
- financial reporting
- internal controls and governance
- teaching and enrolments
- cyber security.
Financial reporting is an important element of good governance. Confidence and transparency in university sector decision-making are enhanced when financial reporting is accurate and timely.
This chapter outlines audit observations related to the financial reporting of universities in NSW for 2023.
Appropriate financial controls help to ensure the efficient and effective use of resources and administration of policies. They are essential for quality and timely decision-making. Effective governance is essential for the stability, sustainability and ethical operation of universities. It ensures accountability, transparency and promotes responsible decision making.
This chapter outlines our observations and insights from our financial statement audits of NSW universities.
Our audits do not review all aspects of internal controls and governance every year. The more significant issues and risks are included in this chapter. These, along with the less significant matters, are reported to universities for management to address.
Section highlights
|
Universities' primary objectives are the functions of teaching and research. They invest most of their resources aiming to achieve quality outcomes in academia and student experience. Universities have committed to achieving certain government targets and compete to advance their reputation and their standing in international and Australian rankings.
This chapter outlines teaching and enrolment outcomes for universities in NSW for 2023.
Section highlights
|
This chapter of the report focuses on the cyber risk environment for universities, how universities have assessed that risk, what frameworks they use to strategically identify controls that respond to those risks, and the extent to which they have implemented or have plans to implement those controls. We also address some specific controls in respect of cyber resilience.
Section highlights
|
Appendix one – List of 2023 recommendations
Appendix two – Status of 2022 recommendations
Appendix three – Universities' controlled entities
Copyright notice
© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.
Actions for Security of student information
Security of student information
Schools collect and maintain detailed student data, including sensitive personal information. Schools can also require or encourage students, parents and carers to use third party software applications for learning and other school related activities. This audit will consider how effectively schools ensure student data is secure within their own systems and when provided to third or fourth parties.
Actions for Cyber security in local government
Cyber security in local government
What this report is about
NSW local councils provide a wide range of essential services and infrastructure to their communities and are increasingly reliant on digital technologies.
Councils need to manage cyber security risks to ensure their information, data and systems are appropriately safeguarded. Councils also need to be prepared to detect, respond and recover when a cyber security incident occurs.
The audit assessed how effectively three selected councils identified and managed cyber security risks.
The audit also included the Department of Planning, Housing and Infrastructure (Office of Local Government) and Department of Customer Service (Cyber Security NSW), due to their roles in providing guidance and support to local councils.
Audit findings
The audit found that the selected councils are not effectively identifying and managing cyber security risks. Each of the councils undertook activities to improve their cyber security during the audit period, but this audit found significant gaps in their cyber security risk management and cyber security processes.
Such gaps result in unmitigated risks to the security of information and assets which, if compromised, could impact their local communities, service delivery and public infrastructure.
Cyber Security NSW and the Office of Local Government recommend that councils adopt requirements in the Cyber Security Guidelines for Local Government, but could do more to monitor whether the Guidelines are enabling better cyber security risk management in the sector.
Audit recommendations
In summary, the councils should:
- integrate assessment and monitoring of cyber security risks into corporate governance processes
- self-assess their performance against Cyber Security NSW's guidelines for local government
- develop and implement a risk-based cyber security improvement plan and program of activities
- develop, implement and test a cyber incident response plan.
Cyber Security NSW and the Office of Local Government should regularly consult on cyber security risks facing local government, and review the effectiveness of guidelines and related resources for the sector.
While this report focuses on the performance of the selected councils, the findings and recommendations should be considered by all councils to better understand their risks and challenges relevant to managing cyber security risks.
Local councils in New South Wales (NSW) provide a wide range of essential services and infrastructure to their communities and are increasingly reliant on digital technologies for this.
Councils use various information systems and software to manage significant amounts of information and data relevant to their corporate functions, infrastructure and service delivery. This may include sensitive information about residents, customers and staff.
Audit Office of New South Wales reports to Parliament have highlighted gaps in councils' cyber security risk management approaches since 2020. The Local Government 2023 report, tabled in March 2024, found that 50 councils were yet to implement cyber security governance frameworks and related internal controls.
The threat from cyber security incidents continues to rise. Such incidents can harm local government service delivery and may include the theft of information, denial of access to critical technology, or even the hijacking of systems for profit or malicious intent.
It is important that councils are effectively identifying and managing cyber security risks to:
- protect their information, data and systems
- be prepared to detect, respond to and recover from cyber security incidents
- ensure confidence in the services they are providing for their communities.
This report outlines important findings and recommendations from a performance audit of three councils: City of Parramatta Council, Singleton Council and Warrumbungle Shire Council. This audit report has deidentified findings for each council, but the specific findings have been directly shared with each council to enable them to remediate and improve cyber safeguards. The findings and recommendations in this report are likely to be relevant to most local councils in NSW and councils are encouraged to ensure they have sufficient cyber safeguards.
This audit assessed how effectively the selected councils identified and managed cyber security risks. The audit considered whether the councils:
- effectively identify and plan for cyber security risks
- have controls in place to effectively manage identified cyber security risks
- have processes in place to detect, respond to, and recover from cyber security incidents.
This audit also included the Department of Customer Service and the Office of Local Government (OLG) within the Department of Planning and Environment (DPE) due to their roles in providing guidance and support to local government.1
Cyber Security NSW, part of the Department of Customer Service, supports local councils to improve their cyber resilience through a range of services and guidance, including the Cyber Security Guidelines – Local Government issued in December 2022.
The OLG is responsible for strengthening the sustainability, performance, integrity, transparency and accountability of the local government sector.
ConclusionThe three councils are not effectively identifying and managing cyber security risks. As a result, councils' information and systems are exposed to significant risks, which could have consequences for their communities and infrastructure. Ineffective cyber security risk management can result in unmitigated risks to the security of information and assets which, if compromised, could impact the councils' local communities, service delivery and public infrastructure. Poor management of cyber security can lead to consequences including theft of information or money, service interruptions, costs of repairing affected systems, and reputational damage. Each council undertook activities to improve their cyber security during the audit period, but there were significant gaps in the councils' risk management processes and controls meaning the councils are not effectively identifying and managing cyber security risks. Key findings include:
None of the councils have up to date plans and processes to support effective detection, response and recovery from cyber security incidents. Councils need to be prepared to identify when a cyber incident occurs, and be able to respond to cyber incidents to contain any compromises and minimise the impact. This is even more important for councils with low levels of maturity in their preventative cyber security controls. Key findings include:
Cyber Security NSW and the OLG recommend that councils adopt requirements set out in the Cyber Security Guidelines for Local Government, but could do more to monitor whether the Guidelines are enabling better cyber security risk management in the sector. Cyber Security NSW and the OLG recommend that local councils implement the Cyber Security Guidelines for Local Government. However, while the roles of both Cyber Security NSW and the OLG involve identifying and responding to specific sector risks, neither is monitoring the uptake of the Guidelines by local councils to identify whether they are enabling better cyber security risk management. Cyber Security NSW and the OLG did not ensure that their roles, responsibilities and actions relevant to cyber security management were coordinated and complementary during the audit period. Cyber Security NSW's Local Government Engagement Plan was updated in November 2023 to include information about its approach to stakeholder collaboration to support a cyber secure NSW Government, including through engagement with the OLG. |
1 The OLG was part of DPE up to 1 January 2024, when DPE was abolished and the OLG became part of the Department of Planning, Housing and Infrastructure (DPHI).
Local councils in New South Wales (NSW) provide a wide range of essential services and infrastructure to their communities. In doing so, councils use a range of information technology (IT) systems, assets, and digital services.
This audit follows several audit reports by the Audit Office of New South Wales that have considered how effectively NSW Government entities, including local councils have managed cyber security risks (see Appendix three).
The Audit Office of New South Wales has reported on how councils have managed cyber security risks since 2020. In the Local Government 2023 report, tabled in March 2024, gaps in cyber security frameworks and related internal controls were reported in 50 councils.
This chapter includes a summary of thematic key findings for the selected councils.
Cyber Security NSW is responsible for supporting local councils to improve their cyber resilience through a range of services and guidance and published its Local Government Engagement Plan in 2023 (discussed below).
The Office of Local Government (OLG) is responsible for strengthening the sustainability, performance, integrity, transparency and accountability of the local government sector. It does this through a range of activities including monitoring sector-wide and council-specific risks, issuing guidance, engaging with councils to build capacity and supporting the Minister for Local Government’s discretionary intervention powers.
Appendix one - Response from entities Cyber security in LG
Appendix two - Glossary- Cyber security in local government
Appendix five – About the audit- Cyber security in local government
Appendix six – Performance auditing -Cyber security in local government
Copyright notice
© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.
Parliamentary reference - Report number #392- released 26 March 2024
Actions for Local Government 2023
Local Government 2023
What this report is about
Results of the local government sector financial statement audits for the year ended 30 June 2023.
Findings
Unqualified audit opinions were issued for 85 councils, eight county councils and 12 joint organisations.
Qualified audit opinions were issued for 36 councils due to non-recognition of rural firefighting equipment vested under section 119(2) of the Rural Fires Act 1997.
The audits of seven councils, one county council and one joint organisation remain in progress at the date of this report due to significant accounting issues.
Fifty councils, county councils and joint organisations missed the statutory deadline of submitting their financial statements to the Office of Local Government, within the Department of Planning, Housing and Infrastructure, by 31 October.
Audit management letters included 1,131 findings with 40% being repeat findings and 91 findings being high-risk. Governance, asset management and information technology continue to represent 65% of the key areas for improvement.
Fifty councils do not have basic governance and internal controls to manage cyber security.
Recommendations
To improve quality and timeliness of financial reporting, councils should:
- adopt early financial reporting procedures, including asset valuations
- ensure integrity and completeness of asset source records
- perform procedures to confirm completeness, accuracy and condition of vested rural firefighting equipment.
To improve internal controls, councils should:
- track progress of implementing audit recommendations, and prioritise high-risk repeat issues
- continue to focus on cyber security governance and controls.
Pursuant to the Local Government Act 1993 I am pleased to present my Auditor-General’s report on Local Government 2023. My report provides the results of the 2022–23 financial audits of 121 councils, eight county councils and 12 joint organisations. It also includes the results of the 2021–22 audits for two councils and two joint organisations which were completed after tabling of the Auditor-General’s report on Local Government 2022. The 2022–23 audits for eight councils, one county council and one joint organisation remain in progress due to significant accounting issues.
This will be my last consolidated report on local councils in NSW as my term as Auditor-General ends in April. Without a doubt, the change in mandate to make me the auditor of the local government sector has been the biggest challenge in my term. Challenging for councils as they adjust to consistent audit arrangements and for the staff of the Audit Office of NSW as they learn about the issues facing NSW councils.
The change in mandate aimed to improve the quality of financial management and reporting across the sector. This will take time. But this report does show some ‘green shoots’ with more councils submitting financial reports to the Office of Local Government by 31 October and more councils having Audit, Risk and Improvement Committees.
I also want to acknowledge that councils face significant challenges responding to and recovering from emergency events whilst cost and resourcing pressures have been persistent.
The findings from our audits identify opportunities to further improve timeliness and quality of financial reporting and integrity of systems and processes. The recommendations in this report are also intended to improve financial management and reporting capability, encourage sound governance, and boost cyber resilience.
Margaret Crawford PSM
Auditor-General for New South Wales
Financial reporting is an important element of good governance. Confidence in and transparency of public sector decision-making are enhanced when financial reporting is accurate and timely.
This chapter outlines audit observations related to the financial reporting audit results of councils, county councils and joint organisations.
A strong system of internal controls enables councils to operate effectively and efficiently, produce reliable financial reports, comply with laws and regulations, and support ethical government.
This chapter outlines the overall trends in governance and internal controls across councils, county councils and joint organisations in 2022–23.
Financial audits focus on key governance matters and internal controls supporting the preparation of councils’ financial statements. Breakdowns and weaknesses in internal controls increase the risk of fraud and error. Deficiencies in internal controls, matters of governance interest and unresolved issues are reported to management and those charged with governance through audit management letters. These letters include our observations with risk ratings, related implications, and recommendations.
Appendix two – NSW Crown Solicitor’s advice
Appendix three – Status of previous recommendations
Appendix four – Status of audits
© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.
Actions for Regulation insights
Regulation insights
What this report is about
In this report, we present findings and recommendations relevant to regulation from selected reports between 2018 and 2024.
This analysis includes performance audits, compliance audits and the outcomes of financial audits.
Effective regulation is necessary to ensure compliance with the law as well as to promote positive social and economic outcomes and minimise risks with certain activities.
The report is a resource for public sector leaders. It provides insights into the challenges and opportunities for more effective regulation.
Audit findings
The analysis of findings and recommendations is structured around four key themes related to effective regulation:
- governance and accountability
- processes and procedures
- data and information management
- support and guidance.
The report draws from this analysis to present insights for agencies to promote effective regulation. It also includes relevant examples from recent audit reports.
In this report, we also draw out insights for agencies that provide a public sector stewardship role.
The report highlights the need for agencies to communicate a clear regulatory approach. It also emphasises the need to have a consistent regulatory approach, supported by robust information about risks and accompanied with timely and proportionate responses.
The report highlights the need to provide relevant support to regulated parties to facilitate compliance and the importance of transparency through reporting of meaningful regulatory information.
I am pleased to present this report, Regulation insights. This report highlights themes and generates insights about effective regulation from the last six years of audit.
Effective regulation is necessary to ensure compliance with the law. Effective regulation also promotes social, economic, and environmental outcomes, and minimises risks or negative impacts associated with certain activities. But regulation can be challenging and costly for governments to implement. It can also involve costs and impact on the regulated parties, including other public sector and private entities, and individuals. As such, effective regulation needs to be administered efficiently, and with integrity.
Having a clearly articulated and communicated regulatory approach is essential to achieving this outcome, particularly when this promotes voluntary compliance and sets performance standards that are informed by community expectations. A consistent approach to exercising regulatory powers is important: it should be supported by robust information about regulatory risks and issues, and accompanied with timely, proportionate responses. Providing relevant support to the regulated parties and coordinating activities to facilitate compliance and performance can generate efficiencies.
Finally, transparency matters. It matters so that government has oversight of and can be held accountable for its leadership of public sector compliance, and in regulating the activities of third parties. Transparency also matters because it can provide insights into the effective exercise of government power. To achieve this, meaningful regulatory information needs to be reported.
While these issues are most pertinent for government agencies that exercise traditional regulatory functions, they are also relevant to lead government agencies that provide a stewardship role in promoting compliance and performance by other government agencies in relation to particular areas of risk.
Over the past six years, our audit work has found many common and repeat performance gaps, creating risks, inefficiencies, and limiting outcomes of regulatory activities. In considering these gaps, this report provides public sector leaders with insights into the challenges and opportunities they may encounter when aiming for more effective regulation, including the good governance of regulatory activities. This includes insights for lead agencies that provide a public sector stewardship role. Through applying these insights and maximising regulatory effectiveness, unintended impacts on the people and sectors government serves and protects can be avoided or at the very least minimised.
Margaret Crawford PSM
Auditor-General for NSW
This report brings together key findings and recommendations relevant to regulation from selected performance and compliance audits between 2018 and early 2024 (19 in total), and from two reports that summarise results of financial audits during the same period. It aims to provide insights into the challenges and opportunities the public sector may encounter when aiming to enhance regulatory effectiveness.
The report is structured in two sections, each setting out insights from relevant audits and providing summaries as illustrative examples.
Section 3 is focused on insights from audits of agencies that administer regulatory powers and functions over other entities or activities (typically known as 'regulators'). The powers and functions of regulators are defined in law, and often relate to issuing approvals (e.g., licensing) for certain activities, and/or monitoring allowable activities within certain limits. Regulators often have compliance and enforcement powers that can be exercised in particular circumstances, such as when a regulated entity has not complied with relevant requirements.
Agencies may be primarily established as regulators or perform regulatory activities alongside other functions. Depending on the context, the regulated activity may relate to other state agencies, local government entities, non-government entities or individuals.
Section 4 summarises insights from a selection of audits of agencies that provide a stewardship role in promoting compliance by and performance of other state agencies and local government entities in relation to specific regulations or policies. These policies may or may not be mandatory and, unlike a more traditional regulator, the coordinating agency may not have enforcement powers to ensure compliance.
These policies, and accompanying guidelines and frameworks, are typically issued by ‘central agencies’ such as the Premier's Department that have a public sector stewardship role. They can also be issued by agencies with a leadership role in particular policy areas ('lead agencies'). While individual agencies and local government entities implementing these policies are responsible for their own compliance and performance, lead and central agencies have an oversight role including by promoting accountability and coordinating activities towards achieving compliance and performance outcomes across the public sector.
Readers are encouraged to view the full reports for further information. Links to versions published on our website are provided throughout this document, and a full list is in Appendix one. An overview of the rationale for selecting these audits and the approach to developing this report is in Appendix two.
The status of agencies' responses to audit recommendations
Findings from the audits referred to in this report were current at the time each respective report was published. In many cases, agencies accepted audit recommendations, as reflected in the letters from agency heads that are included in the appendix of each audit report.
The Public Accounts Committee of the NSW Parliament has a role in reporting on and ensuring that agencies respond appropriately to audit recommendations. Readers are encouraged to review the Public Accounts Committee's inquiries on agencies' implementation of audit recommendations, which can be found on the Committee's website.
Actions for Driver vehicle system
Driver vehicle system
What this report is about
Transport for NSW (TfNSW) uses the Driver vehicle System (DRIVES) to support its regulatory functions. The system covers over 6.2 million driver licences and over seven million vehicle registrations.
DRIVES first went live in 1991 and has been significantly extended and updated since, though is still based around the same core system. The system is at end of life but has become an important service for Service NSW and the NSW Police Force.
DRIVES now includes some services to other parts of government and non-government entities which have little or no connection to transport. There are 141 users of DRIVES in total, including commercial insurers, national regulators, and individual citizens.
This audit assessed whether TfNSW is effectively managing DRIVES and planning to transition it to a modernised system.
Audit findings
TfNSW has not effectively planned the replacement of DRIVES.
It is now working on its third business case for a replacement system but has failed to learn lessons from its past attempts.
In the meantime, TfNSW has not taken a strategic approach to managing DRIVES’ growth.
TfNSW has been slow to reduce the risk of misuse of personal information held in DRIVES. With its delivery partner Service NSW, TfNSW has also been slow to develop and implement automatic monitoring of access.
TfNSW uses recognised processes for managing most aspects of DRIVES, but has not kept the system consistently available for users. TfNSW has lacked accurate service availability information since June 2022, when it changed its technology support provider.
TfNSW needs to significantly prioritise cyber security improvements to DRIVES. TfNSW is seeking to lift DRIVES’ cyber defences, but it will not achieve its stated target safeguard level until December 2025.
Even then, one of the target safeguards will not be achieved in full until DRIVES is modernised.
Audit recommendations
TfNSW should:
- implement a service management framework including insight into the views of DRIVES users, and ensuring users can influence the service
- ensure it can accurately and cost effectively calculate when DRIVES is unavailable due to unplanned downtime
- ensure implementation of a capability to automatically detect anomalous patterns of access to DRIVES
- ensure that DRIVES has appropriate cyber security and resilience safeguards in place as a matter of priority
- develop a clear statement of the future role in whole of government service delivery for the system
- resolve key issues currently faced by the DRIVES replacement program including by:
- clearly setting out a strategy and design for the replacement
- preparing a specific business case for replacement.
The DRIver VEhicle System1 (often known as DRIVES) is the Transport for NSW (TfNSW) system which is used to manage over 6.2 million driver licences and over seven million vehicle registrations in New South Wales.
DRIVES first went live in 1991 and has been significantly extended and enhanced over the past 33 years. DRIVES is a significant NSW Government information system — containing personal information such as home addresses for most of the NSW adult population, sensitive health information such as medical conditions, and biometric data in photographs.
Service NSW, part of the Department of Customer Service, is the NSW Government's 'one stop shop' for services to NSW citizens and businesses. It uses DRIVES when it delivers many transport-related services to NSW citizens such as licence renewals and checks the identity information stored in DRIVES as part of other services delivered to NSW citizens, such as a 'working with children check'.
DRIVES supports TfNSW's regulatory functions and the collection of more than $5 billion in revenue annually for the NSW Government. The system is also used by many organisations outside of the NSW Government including commercial insurers and national regulators, as well as individual citizens who access DRIVES for services such as 'Renew my registration' or 'Book a driver knowledge test'.
TfNSW owns and manages DRIVES. It intends to replace DRIVES with a modernised system to improve its cost, performance, and security.
The objective of this performance audit was to assess whether TfNSW is effectively:
- managing the current system, and
- planning to transition DRIVES to a modernised system.
The auditee is TfNSW. We have consulted with the Department of Customer Service as a key stakeholder during the audit process.
This part of the report considers whether Transport for NSW (TfNSW) is effectively managing the current system. It considers DRIVES’:
- role in NSW Government service delivery
- ease of use and appropriateness for a modern system
- mechanisms to ensure the service is available for users.
This part of the report considers whether Transport for NSW (TfNSW) is effectively planning to transition DRIVES to a modernised system. It makes findings on the:
- effort to develop a business case to fund the replacement of DRIVES
- issues which have contributed to the slow progress of the replacement program.
Appendix one – Response from entity
Appendix two – Statutory and regulatory framework related to DRIVES
Appendix three – About the audit
Appendix four – Performance auditing
Parliamentary reference - Report number #388 - released 20 February 2024.
Actions for State Finances 2023
State Finances 2023
What this report is about
Results of the audit of the Consolidated State Financial Statements of the New South Wales General Government Sector (GGS) and Total State Sector (TSS) for the year ended 30 June 2023.
Findings
The audit opinion on the 2022–23 Consolidated State Financial Statements was qualified in relation to two issues and included an emphasis of matter.
The first qualification matter is a continuation of the prior year limitation of scope on the audit relating to the Catholic Metropolitan Cemeteries Trust (CMCT), a controlled state entity, who continued to deny access to its management, books and records for the purposes of a financial audit. As a result, the Audit Office was unable to obtain sufficient appropriate audit evidence to support the assets, liabilities, income and expenses relating to CMCT recorded in the TSS and the equity investment recognised in the GGS relating to the net assets of CMCT.
The second qualification matter relates to the limitations on the accuracy and reliability of financial information relating to Statutory Land Managers (SLMs) and Common Trust entities (CTs) controlled by the State and were either exempted from requirements to prepare financial reports, or who were required to submit financial reports and have not done so. The Audit Office was unable to obtain sufficient appropriate audit evidence to determine the impact on the value of non-land assets and liabilities, income and expenses that should be recognised in the 2022–23 Consolidated State Financial Statements and which have not been recorded in the Consolidated State Financial Statements.
The independent audit opinion also includes an emphasis of matter drawing attention to key decisions made by the NSW Government regarding the future of the Transport Asset Holding Entity of New South Wales (TAHE).
Recommendations
The report includes recommendations for NSW Treasury to address several high-risk findings, including:
- ensuring accurate and reliable financial information is available to recognise the non-land balances of SLMs and CTs
- ensuring the CMCT, SLMs and CTs meet their statutory reporting obligations
- conducting a broader review of the financial reporting exemption framework
- continued monitoring of TAHE's control over its assets
- providing timely guidance to the sector relating to legislative or policy changes that impact financial reporting
- developing an accounting policy for the reimbursement of unsuccessful tender bid cost contributions.
Pursuant to section 52A of the Government Sector Audit Act 1983, I am pleased to present my Report on State Finances, for the year ended 30 June 2023.
The report highlights the maturity of financial reporting across the sector, with most New South Wales (NSW) government agencies that consolidate into the whole-of-government accounts having unqualified audit reports.
This report also highlights important areas for improvement. Improving the timely completion of the NSW Government's consolidated financial statements, and resolving matters on the quality of the Total State Sector Accounts that have resulted in modifications to the independent audit opinion, should be a key focus.
Colleagues in NSW Treasury and key agencies, along with staff of the Audit Office, have worked extremely hard and collaboratively throughout the year to resolve significant accounting and audit matters, and address recommendations from past audits. I thank them for their diligence and commitment to ensuring the quality and timeliness of financial management and reporting in the NSW public sector.
This level of professionalism needs to be sustained in view of the significant challenges that lie ahead, including embedding sustainability reporting and the disclosure of climate-related financial information. The State and the Audit Office are well placed to meet these challenges.
As this is the last report I will present on State Finances during my term as Auditor-General, I would like to conclude by saying what an honour it has been to serve the Parliament of NSW in such an important role. A commitment to independent assurance and transparent reporting on the activities of government have been a hallmark of NSW for two centuries. We should all take pride in and protect this commitment to good government.
Margaret Crawford PSM
Auditor-General for New South Wales
The Independent Auditor's report was qualified
The audit opinion on the Consolidated State Financial Statements of the New South Wales General Government Sector (GGS) and Total State Sector (TSS) for the year ended 30 June 2023 was qualified in relation to two issues and included an emphasis of matter. These matters are detailed below.
From here on, the Consolidated State Financial Statements are referred to as the Total State Sector Accounts (TSSA), in line with NSW Treasury's naming convention.
The audit opinion continued to be qualified due to a limitation on the scope of the audit relating to the Catholic Metropolitan Cemeteries Trust
The first qualification matter is a continuation of the prior year limitation of scope relating to the Catholic Metropolitan Cemeteries Trust (CMCT), who continued to deny access to its management, books and records for the purposes of a financial audit.
NSW Treasury's position remains that CMCT is a controlled entity of the State for financial reporting purposes. This means CMCT is a GSF agency and is obliged under Section 7.6 of the Government Sector Finance Act 2018 (GSF Act) to prepare financial statements and give them to the Auditor-General for audit.
To date, CMCT has not met its statutory obligations under the GSF Act. CMCT has not submitted its financial statements to the Auditor-General for audit despite repeated requests and has not provided access to its books and records for the purposes of a financial audit. As a controlled entity, NSW Treasury is required by Australian Accounting Standards to consolidate the CMCT into the TSSA.
Consequently, the Audit Office was unable to obtain sufficient appropriate audit evidence on the carrying amount of assets and liabilities recognised in the TSS as at 30 June 2023 and of the amount of income and expenses for the year then ended. The value of the net assets of CMCT consolidated into the TSS is $321 million, and the total comprehensive income of CMCT consolidated into the TSS for the year is $25.8 million. The GGS financial statements for the year ended 30 June 2023 also recognised an equity investment in the net assets of CMCT ($321 million).
This limitation of scope resulted in a qualified audit opinion being issued on the TSS and the GGS.
Section 3 of this report titled 'Limitation of scope relating to CMCT' discusses this matter in further detail.
The audit opinion was qualified due to a limitation on the scope of the audit relating to the non-land assets, liabilities, income and expenses of controlled entities that manage crown land and associated assets and for which reliable financial information is not available
There are 579 Category 2 Statutory Land Managers and 119 Commons Trust entities controlled by the State.
A category 2 Statutory Land Manager (SLM) is a type of Crown Land Manager that is controlled by the State. It excludes other Crown Land Managers such as councils, metro cemeteries and Crown Holiday Parks land managers. Commons Trusts (CT) are responsible for the care, control and management of commons for which the trust is established. A common is a parcel of land that has been set aside by the Governor or the Minister for specific use in a certain locality, such as grazing, camping or bushwalking.
NSW Treasury has determined that SLMs and CTs are controlled entities of the State. Consequently these should be recognised in the TSSA as required by Australian Accounting Standards. However, the non-land assets, liabilities, income and expenses of SLMs and CTs have not been recognised in the TSSA.
Most of these entities have not prepared financial statements, upon which to consolidate the non-land assets, liabilities, income and expenses of SLMs and CTs into the TSSA. This is because they have either not complied with their financial reporting obligations under section 7.6 of the GSF Act, or they were not required to prepare financial statements as they met the prescribed reporting exemption criteria set out in the Government Sector Finance Regulation 2018.
In 2022–23 NSW Treasury reviewed available financial information to estimate the aggregate value of non-land assets, liabilities, income and expenses relating to SLMs and CTs that were not recognised in the TSSA.
NSW Treasury estimates the aggregate value of non-land assets not recognised in the TSSA to be in the range of $351.6 million to $382.4 million. However, there are significant limitations on the accuracy and reliability of financial information that support these estimates. Only 12 entities were supported by what NSW Treasury defined as ‘highly reliable financial data’. Two hundred and eighty-four entities provided self-reported information and 288 entities had not submitted any financial data. The balances of the remaining entities were supported by what NSW Treasury defined as ‘somewhat reliable financial data’. This included ‘lower-quality’ financial statements and assessments of asset values performed by the former Department of Planning and Environment (DPE).
Because of the limitations on the accuracy and reliability of financial information relating to SLMs and CTs, the Audit Office was unable to obtain sufficient appropriate audit evidence to determine the impact on the value of non-land assets and liabilities that should be recognised in the TSSA as at 30 June 2023 and of the amount of income and expenses that should be recognised in the TSSA for the year then ended.
Accordingly, this limitation of scope resulted in a qualified audit opinion being issued on the TSSA.
Section 4 of this report titled 'Limitation of scope relating to Category 2 Statutory Land Managers and Commons Trusts' discusses this matter in further detail.
The audit opinion included an emphasis of matter drawing attention to key decisions regarding the future of the Transport Asset Holding Entity of New South Wales (TAHE)
The Independent Auditor’s Report also includes an emphasis of matter, drawing attention to key decisions made by the government in August 2023 regarding the future of TAHE.
The decisions are likely to have a significant impact on TAHE's financial position and future operating model, including converting TAHE from a for-profit State Owned Corporation (SOC) to a non-commercial Public Non-Financial Corporation (PNFC).
These decisions may impact the future commercial agreements with the public rail operators and the future valuation of TAHE’s assets that are consolidated in the TSS. The decisions also mean that cash contributions made to TAHE are treated as grant expenses, rather than equity investments, the audit matter that has previously been reported.
Section 5 of this report titled 'Investment in TAHE' discusses this matter in further detail.
Other significant matters relating to the TSSA audit are covered in Section 6 titled 'Key audit findings'.
The number of identified errors increased in 2022–23
In 2022–23, agency financial statements presented for audit contained 29 errors, where each error exceeded $20 million (20 errors in 2021–22). The total value of these errors was $2.5 billion, an increase from the previous year ($973 million in 2021–22).
The following graph shows the number of reported errors (both corrected and uncorrected), exceeding $20 million over the past five years in agencies’ financial statements presented for audit.
Most errors related to:
- the incorrect application of Australian Accounting Standards and NSW Treasury policies
- issues with the data, judgements and assumptions used when valuing non-current physical assets and liabilities
- non-recognition of provisions related to the enhanced paid parental leave scheme that became effective 1 October 2022.
CMCT continues to deny the NSW Government and the Auditor-General access to its management, books and records
NSW Treasury has reconfirmed the CMCT is a controlled entity of the State. The Audit Office accepts the position of NSW Treasury.
The reaffirmation of this position means CMCT is a GSF agency under the provisions of the GSF Act. Section 7.6 of the GSF Act places an obligation on CMCT to prepare financial statements and give them to the Auditor-General. Further, section 34 of the Government Sector Audit Act 1983 (the GSA Act) requires the Auditor-General to furnish an audit report on these financial statements.
The Audit Office recommended in the ‘State Finances 2022’ report that NSW Treasury and DPE should ensure CMCT meets its statutory reporting obligations. CMCT continues to contest NSW Treasury’s determination and asserts they are not a controlled entity of the NSW Government.
To date, CMCT has not met its statutory obligations to prepare financial statements under the GSF Act and provide them to the Auditor-General for audit. CMCT has not submitted their financial statements to the Auditor-General for audit despite repeated requests and has not provided access to its books and records for the purposes of a financial audit. There continued to be correspondence between the Audit Office of NSW, CMCT, NSW Treasury and DPE in 2022–23 regarding this matter.
Category 2 Statutory Land Managers and Commons Trusts should be consolidated in the TSSA
A category 2 Statutory Land Manager (SLM) is a type of Crown Land Manager that is controlled by the State. It excludes other Crown Land Managers such as councils, metro cemeteries and Crown Holiday Parks land managers. SLMs are persons or entities appointed by the Minister to be responsible for the care, control and management of Crown reserves on behalf of the people of New South Wales.
Commons Trusts (CTs) are responsible for the care, control and management of commons for which the trust is established. A common is a parcel of land that has been set aside by the Governor or the Minister for specific use in a certain locality, such as grazing, camping or bushwalking. CTs are considered to be controlled entities of the Minister who administers the Commons Management Act 1989. CTs are not SLMs.
Category 2 SLMs and CTs are controlled entities of the State and should be consolidated in the Total State Sector Accounts as required by Australian Accounting Standards.
Most of these entities have not prepared audited financial statements, upon which to consolidate the non-land assets, liabilities, income and expenses of SLMs and CTs into the Total State Sector Accounts. This is because they have either not complied with their financial reporting obligations under section 7.6 of the GSF Act or they were not required to prepare audited financial statements as they met the prescribed reporting exemption criteria set out in the Government Sector Finance Regulation 2018. Further information on this compliance matter is included in Section 6 of this report titled 'Key audit findings'.
Insufficient financial information is available to estimate the value of non-land assets, liabilities, revenues and expenses of SLMs and CTs that should be consolidated in the TSSA
In 2022–23, NSW Treasury reviewed the available financial information to estimate the aggregate value of assets, liabilities, income, and expenses relating to SLMs and CTs that should be consolidated in the TSSA.
Land managed by the SLMs and CTs is valued each year by the former Department of Planning and Environment (DPE) and included in the TSSA in aggregate ($466 million, 2021–22: $318 million). However, there were significant issues with the accuracy and reliability of financial information to support non-land assets, liabilities, income and expenses of SLMs and CTs.
NSW Treasury considered the financial statements of 30 of the largest SLMs and CTs, self-reported financial information for around 400 SLMs and CTs, asset valuations, aerial photography, review of business operations, risks, legal claims, insurance arrangements and limitations imposed due to the scale and bespoke nature of the operations. DPE facilitated further engagement with SLMs and CTs to identify additional information.
NSW Treasury estimates the aggregate value of non-land assets not recognised in the TSSA to be in the range of $351.6 million to $382.4 million. However, there are significant limitations on the accuracy and reliability of financial information that support these estimates. Only 12 entities were supported by what NSW Treasury defined as ‘highly reliable financial data’. Two hundred and eighty-four entities provided self-reported information and 288 entities had not submitted any financial data. The balances of the remaining entities were supported by what NSW Treasury defined as ‘somewhat reliable financial data’. This included ‘lower-quality’ financial statements and assessments of asset values performed by DPE.
Although the review provided some information about the SLMs and CTs, NSW Treasury concluded that there were significant limitations in the financial information available from the SLMs and CTs, and limited information to support compliance with accounting policies and relevant Treasurer’s directions.
The TSSA audit opinion was qualified in relation to SLMs and CTs
The opinion in the TSSA’s audit report was qualified due to the limitations on the accuracy and reliability of financial information relating to SLMs and CTs. This is a new audit qualification for 2022–23.
This limitation was appropriately disclosed in Note 1 'Statement of Significant Accounting Policies' of the TSSA. The Statement of Compliance signed by the Secretary of NSW Treasury and the Treasurer on 18 January 2024 was also updated to acknowledge the disclosure in Note 1 regarding SLMs and CTs.
In September 2023, the NSW Government announced its intention to convert TAHE into a non-commercial PNFC.
TAHE’s new operating model is expected to be implemented in three phases:
- Phase 1: the government expects to transition TAHE to not-for-profit status by taking administrative actions under the State Owned Corporations Act 1989.
- Phase 2: the government expects to introduce an initial wave of legislative changes to allow for the introduction of the new operating model.
- Phase 3: the government expects to introduce further legislative changes to remove TAHE’s status as a SOC. The corporation is expected to be renamed.
Cash contributions from NSW Treasury to TAHE in 2022–23 have been expensed and are no longer treated as equity contributions
In prior years the cash transfers from NSW Treasury (an entity in the GGS) to TAHE, an entity controlled by the State that is classified in the PNFC sector, were treated as equity contributions.
The equity contributions were recognised on the basis there was a reasonable expectation to earn a sufficient rate of return of 2.5% (including recovering any holding losses) on the investment in TAHE. The exception to this treatment is if there is no reasonable expectation of a sufficient rate of return on the contribution, in which case, the transfer should be recorded as a capital transfer expense. Returns include dividends, income tax equivalents and holding gains or losses.
The accounting treatment of the cash contributions to TAHE has been an area of significant audit focus in previous years, and significant audit findings reported to Parliament. The significant uncertainty relating to the assumptions and estimates used to forecast a 2.5% return on GGS investments into TAHE, that supported the recognition of an equity contribution in the prior year, was reported as an emphasis of matter in the 2021–22 TSSA audit report.
In 2022–23 the government changed the intent and expectations in relation to the future operating model of TAHE. This change in direction meant the government will no longer account for cash contributions to TAHE as equity, but rather will treat such contributions as an expense. This is because the government is no longer demonstrating that there is a reasonable expectation of a sufficient rate of return on the contributions made by the GGS to TAHE.
As a result, from 1 July 2022, the capital funding of $1.6 billion provided to TAHE in 2022–23 has been recorded as a capital transfer expense in the GGS Statement of Comprehensive Income.
The emphasis of matter included in last year’s TSSA audit report relating to the significant uncertainty relating to the assumptions and estimates used to forecast returns on GGS investments into TAHE is no longer relevant this year. However, the Audit Office have included a new emphasis of matter in the 2022–23 TSSA audit report, drawing attention to the key decisions made by the government in August 2023 regarding the future of TAHE.
'Emphasis of matter' paragraphs are included in an agency's Independent Auditor's Report for matters that have been presented or disclosed by the agency in its certified financial statements. Whilst they do not constitute an audit qualification, they do highlight matters that are, in our judgment, relevant to the users' understanding of the financial statements.
Further information on last year's audit of the government's investment in TAHE can be found in our ‘State Finances 2022’ report.
Valuation of TAHE assets in TAHE's accounts
At 30 June 2023, TAHE reported $16.5 billion in property, plant and equipment and related intangibles within the cash generating units (CGUs) – a $2.8 billion or 15% decrease from the same time last year (2021–22: $19.3 billion). The fair value of these assets at balance date is determined using the income approach – appropriate for TAHE given its current for-profit status. Such an approach is reliant on, and is sensitive to TAHE’s judgements, estimates and assumptions.
The reduction in the carrying value of reported assets was largely driven by the uncertainty of TAHE's future operating model under the new government, which increased the risk and discount rates applied to the valuation model.
Given the uncertainty over the future of TAHE, NSW Treasury and TAHE will need to assess whether the income approach remains an appropriate basis of valuation going forward.
Control of TAHE assets
TAHE's position on control of assets for the current year was accepted
TAHE assessed that it maintains control of its assets as it has exercised authority and power over its assets during the year, as well as continuing to operate as an independent SOC.
Consistent with the prior year, the audit did not find evidence that the assets held by TAHE are not controlled by TAHE. However, given the constraints that can be imposed through the operating licence, there is a risk that limitations could be placed on the operations or functions of TAHE. Future limitations to the degree of control TAHE, and its board, can exercise over it functions may impact the degree of control TAHE has over its assets going forward. The current operating licence issued by the Minister for Transport expires on 30 June 2024.
Furthermore, the government’s decision to change the operating model for TAHE in future years could impact the control TAHE has over its assets. The control of these assets by TAHE will be a continued area of audit focus.
RecommendationNSW Treasury and TAHE should continue to monitor the risk that control of TAHE assets could change in future reporting periods based on the government’s decision on TAHE’s new operating model. TAHE must continue to demonstrate control of its assets; or the current accounting presentation would need to be reconsidered. |
Performance audit on the design and implementation of TAHE
In January 2023, the Auditor-General tabled a performance audit on the 'Design and implementation of the Transport Asset Holding Entity', which assessed the effectiveness of NSW government agencies' design and implementation of TAHE. The audit included TAHE, Transport for NSW and NSW Treasury.
The audit found the design and implementation of TAHE, which spanned seven years, was not effective.
The process was not cohesive or transparent. It delivered an outcome that is unnecessarily complex in order to support an accounting treatment to meet the NSW Government's short-term Budget objectives, while creating an obligation for future governments.
The budget benefits of TAHE were claimed in the 2015–16 NSW Budget before the enabling legislation was passed by Parliament in 2017. This committed the agencies to implement a solution that justified the 2015–16 Budget impacts, regardless of any challenges that arose.
Rail safety arrangements were a priority throughout TAHE's design and implementation, and risks were raised and addressed.
Agencies relied heavily on consultants on matters related to the creation of TAHE, but failed to effectively manage these engagements. Agencies failed to ensure that consultancies delivered independent advice as an input to decision-making. A small number of firms were used repeatedly to provide advice on the same topic. The final cost of TAHE-related consultancies was $22.6 million compared to the initial estimated cost of $12.9 million.
Deficit of $10.6 billion compared with a budgeted deficit of $11.3 billion
The General Government Sector (GGS) comprises of 210 entities and provides public services or carries out policy or regulatory functions. Agencies in this sector are funded centrally by the State.
A principal measure of the government's overall activity and policies is its net operating balance (budget result). This is the difference between the cost of general government service delivery and the revenue earned to fund these sectors.
Outside the GGS, a further 104 government-controlled entities are included within the TSSA. These entities form part of the PNFC (32) and PFC (72) sectors, and generally provide goods and services for which consumers pay for directly (including water and electricity).
The GGS's budget result for the 2022–23 financial year was a deficit of $10.6 billion compared to an original forecast of a budget deficit of $11.3 billion.
Revenues increased $6.6 billion to $113.2 billion
The State’s total revenues increased $6.6 billion to $113.2 billion, an increase of 6.2% compared to the previous year. Total revenue growth in 2021–22 was 18.2%. The State's increase in revenue was mostly from $2 billion in sale of goods and services, $1.5 billion in fines, regulatory fees and other revenue, and $1.4 billion in interest.
Sale of goods and services increased by 14.8%
Sale of goods and services revenue increased by $2 billion, mainly due to the return of the State's operations and services post the COVID-19 pandemic, including the:
- return of elective surgery, increased patient services and sale of high-cost drugs under the Pharmaceutical Benefits Scheme co-payment for Section 100 Highly Specialised Drugs for both private and public patients
- increased user demand for public transport
- re-opening of schools contributing to higher revenue from student fees, sports and extracurricular activities.
Fines, regulatory fees and other revenue increased by 19.8%
Fines, regulatory fees and other revenue increased by $1.5 billion, mainly due to higher mining royalties collected by the State of $949 million. Extracted volume and weight of coal, gold and copper increased in 2022–23, as the COVID-19 pandemic lockdown restrictions eased, increasing the demand for export commodities.
Interest revenue increased by 137.6%
Interest revenue increased by $1.5 billion because of the strong interest rate environment and increases in the cash rate impacting securities, investment deposits and government agencies. As a result, this is passed on to new client loans as TCorp’s own borrowing costs increase.
Assets grew by $75.1 billion to $651 billion
The State’s assets include physical assets such as land, buildings and infrastructure systems, and financial assets such as cash, and other financial instruments and equity investments. The value of total assets increased by $75.1 billion or 13.1% to $651 billion. The increase was largely due to increases in the carrying value of land, buildings and infrastructure systems.
Valuing the State’s physical assets
The State’s physical assets were valued at $489 billion
The value of the State’s physical assets increased by $52.6 billion to $489 billion in 2022–23 ($46.7 billion increase in 2021–22). The State’s physical assets include land and buildings ($214 billion), infrastructure systems ($256 billion) and plant and equipment ($19.4 billion).
The movement in physical asset values between years includes additions, disposals, depreciation and valuation adjustments. Other movements include assets reclassified to held for sale.
Appendix one – Prescribed entities
Appendix two – TSS sectors and entities
© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.