Refine search Expand filter

Reports

Published

Actions for Local Government 2021

Local Government 2021

Local Government
Asset valuation
Cyber security
Financial reporting
Information technology

What the report is about

Results of the local government sector council financial statement audits for the year ended 30 June 2021.

What we found

Unqualified audit opinions were issued for 126 councils, 13 joint organisation audits and nine county councils in 2020–21. 

A qualified audit opinion was issued for Central Coast Council who was unable to provide evidence to support the carrying value of $5.5 billion of roads, bridges, footpaths, bulk earthworks, stormwater drainage, water supply and sewerage network assets.

The audit of Kiama Municipal Council is still in progress as at the date of this report due to significant accounting issues not resolved resulting in corrections to the financial statements and prior period errors.

Forty-one councils and joint organisations (2020: 16) received extensions to submit audited financial statements to the Office of Local Government (OLG). 

Councils were impacted by recent emergency events, including bushfires, floods and the COVID-19 pandemic. The financial implications from these events varied across councils. Councils adapted systems, processes and controls to enable staff to work flexibly.

What the key issues were

There were 1,277 audit findings reported to councils in audit management letters.

Ninety-two high-risk matters were identified across the sector:

  • 69 high-risk matters relating to asset management (see page 30)
  • six high-risk matters relating to information technology (see page 39)
  • six high-risk matters relating to financial reporting (see page 26)
  • six high-risk matters to council governance procedures (see page 22)
  • five high-risk matters relating to financial accounting (see page 28).

More needs to be done to reduce the number of errors identified in financial reports. Twenty-nine councils required material adjustments to correct errors in previous audited financial statements.

Rural firefighting equipment

Sixty-eight councils did not record rural firefighting equipment estimated to be $145 million in their financial statements.

The financial statements of the NSW Total State Sector and the NSW Rural Fire Service do not include these assets, as the State is of the view that rural firefighting equipment that has been vested to councils under the Rural Fires Act 1997 is not controlled by the State. In reaching this conclusion, the State argued that on balance it would appear the councils control rural firefighting equipment that has been vested to them.

The continued non-recording of rural firefighting equipment in financial management systems of some councils increases the risk that these assets are not properly maintained and managed.

What we recommended

Councils should perform a full asset stocktake of rural firefighting equipment, including a condition assessment for 30 June 2022 financial reporting purposes and recognise this equipment as assets in their financial statements. 

Consistent with OLG’s role to assess council’s compliance with legislative responsibilities, standards or guidelines, OLG should intervene where councils do not recognise rural firefighting equipment.

Fast facts

  • 150 councils and joint organisations in the sector
  • 99% unqualified audit opinions issued for the 30 June 2021 financial statements
  • 489 monetary misstatements reported in 2020–21
  • 54 prior period errors reported
  • 92 high-risk management letter findings identified
  • 53% of reported issues were repeat issues.

Early financial reporting procedures

Fifty-nine per cent of councils performed some early financial reporting procedures, less than the prior year.

What we recommended

OLG should require early financial reporting procedures across the local government sector by April 2023. Policy requirements should be discussed with key stakeholders to ensure benefits of the procedures are realised.

Asset valuations

Audit management letters reported 288 findings relating to asset management. Fifty-eight councils had deficiencies in their processes to revalue infrastructure assets.

Thirty-five councils corrected errors relating to revaluations amounting to $1 billion and 13 councils had prior period errors relating to asset revaluations that amounted to $253 million.

What we recommended

Councils should have all asset revaluations completed by April of the financial year subject to audit.

Integrity/completeness of asset records

Sixty-seven councils had weak processes over maintenance, completeness and security of fixed asset registers.

Thirty-five councils corrected errors to the financial statements relating to poor record keeping of asset data that amounted to $102.1 million. Nineteen councils had 27 prior period financial statement errors that amounted to $417.1 million relating to the quality of asset records such as found and duplicate assets.

What we recommended

Councils need to improve controls and processes to ensure integrity and completeness of asset source records.

Cybersecurity

Our audits found that cybersecurity frameworks and related controls were not in place at 65 councils.

These councils have yet to implement basic governance and internal controls to manage cybersecurity such as having a cybersecurity framework, policy and procedure, register of cyber incidents, system penetrations testing and training.

What we recommended

OLG needs to develop a cybersecurity policy to be applied by councils as a matter of high priority in order to ensure cybersecurity risks over key data and IT assets are appropriately managed across councils and key data is safeguarded.

Councils should monitor the implementation of recommendations

Fifty-three per cent of total findings reported in 2020–21 audit management letters were repeat or partial repeat findings from prior years.

What we recommended

Councils and those charged with governance should track the progress of implementing recommendations from financial audits, performance audits and public inquiries.

Key financial information

In 2020–21, councils:

  • collected $7.6b in rates and annual charges
  • received $5.1b in grants and contributions
  • incurred $4.8b of employee benefits and on costs
  • held $15.3b of cash and investments
  • managed $161.7b of infrastructure, property, plant and equipment
  • entered into $3.4b of borrowings.

Pursuant to the Local Government Act 1993 I present my report Local Government 2021. My report provides the results of the 2020–21 financial audits of 127 councils, 13 joint organisations and nine county councils.

Unqualified audit opinions were issued for 126 councils, 13 joint organisation and nine county councils in 2020–21. My independent auditor’s opinion was qualified for Central Coast Council who was unable to provide evidence to support the carrying value of $5.5 billion of roads, bridges, footpaths, bulk earthworks, stormwater drainage, water supply and sewerage network assets.

The 2020–21 year was challenging from many perspectives, not least being the continuing impact of and response to the recent emergency events, including bushfires, floods and the COVID-19 pandemic. We appreciate the efforts of council staff and management right across local government and they must be congratulated for their responsiveness and resilience in meeting their financial reporting obligations in such challenging circumstances.

This report makes a number of recommendations to councils and to the regulator, the Office of Local Government within the Department of Planning and Environment. These are intended to support councils to further improve the timeliness, accuracy and strength of financial reporting and their governance arrangements. Arguably, when faced with challenges, it is even more important to prioritise and invest in systems and processes to protect the integrity of councils' operations and promote accurate and transparent reporting.

I look forward to continuing engagement and constructive dialogue with councils in 2022–23 and beyond.

Margaret Crawford
Auditor-General for New South Wales

Financial reporting is an important element of good governance. Confidence in and transparency of public sector decision-making are enhanced when financial reporting is accurate and timely.

This chapter outlines audit observations related to the financial reporting of councils and joint organisations.

Highlights

  • One hundred and nine councils and joint organisations (2020: 133) lodged audited financial statements with OLG by the statutory deadline of 31 October (2020: 30 November).
  • Forty-one councils and joint organisations (2020: 16) received extensions to submit audited financial statements to OLG.
  • Unqualified audit opinions were issued for 126 councils, 13 joint organisations and nine county councils in 2020–21. A qualified audit opinion was issued for Central Coast Council in both 2019–20 and 2020–21.
  • The audit of Kiama Municipal Council is still in progress as at the date of this report due to significant accounting issues.
  • Fifty-nine per cent of councils performed some early financial reporting procedures, less than the prior year. We recommended that OLG should require early close procedures across the local government sector by 30 April 2023.
  • The total number and dollar value of corrected financial statement errors increased compared with the prior year, however uncorrected financial statement errors and prior period financial statement errors decreased compared to the prior year.
  • Sixty-eight councils (2020: 68 councils) did not record rural firefighting equipment in their financial statements worth an estimated $145 million (2020: $119 million). The NSW Government has confirmed these assets are not controlled by the NSW Rural Fire Service and are not recognised in the financial records of the NSW Government. We recommended that consistent with the OLG's role to assess council’s compliance with legislative responsibilities, standards or guidelines, OLG should intervene where councils do not recognise rural firefighting equipment. Councils should perform a full asset stocktake of rural firefighting equipment, including a condition assessment for 30 June 2022 financial reporting purposes.

A strong system of internal controls enables councils to operate effectively and efficiently, produce reliable financial reports, comply with laws and regulations, and support ethical government.

This chapter outlines the overall trends in governance and internal control findings across councils, county councils and joint organisations in 2020–21.

Financial audits focus on key governance matters and internal controls supporting the preparation of councils' financial statements. Audit findings are reported to management and those charged with governance through audit management letters.

Highlights

  • Total number of audit findings reported in audit management letters decreased from 1,435 in 2019–20 to 1,277 in 2020–21.
  • No extreme risk audit findings were identified in 2020–21 (2019–20: 1).
  • Total number of high-risk audit findings increased from 53 in 2019–20 to 92 in 2020–21. Sixty of the high-risk findings in 2020–21 related to the non-recording of rural firefighting equipment in councils' financial statements. Twenty-six per cent of the high-risk findings identified in 2019–20 were reported as high-risk findings in 2020–21.
  • Fifty-three per cent of findings reported in audit management letters were repeat or partial repeat findings. We recommend councils and those charged with governance should track progress of implementing recommendation from our audits.
  • Governance, asset management and information technology comprise over 62% of findings and continue to be key areas requiring improvement.
  • A number of recommendations were made relating to asset valuations and integrity of asset data records, in response to the findings that:
    • 67 councils had weak processes over maintenance and security of fixed asset registers
    • 58 councils had deficiencies in their processes to revalue infrastructure assets.
  • Sixty-five councils have yet to implement basic governance and internal controls to manage cybersecurity. We recommended that OLG needs to develop a cybersecurity policy to be applied by councils as a matter of high priority.

Total number of findings reported in audit management letters decreased

In 2020–21, 1,277 audit findings were reported in audit management letters (2019–20: 1,435 findings). No extreme audit risk findings were identified this year. The extreme risk relating to Central Coast Council's use of externally restricted funds in 2019–20 was partially addressed by management and has been rated as a high-risk for 2020–21. The total number of high-risk findings increased to 92 (2019–20: 53 high-risk findings).

Findings are classified as new, repeat or ongoing, based on:

  • new findings were first reported in 2020–21 audits
  • repeat findings were first reported in prior year audits, but remain unresolved in 2020–21
  • ongoing findings were first reported in prior year audits, but the action due dates to address the findings are after 2020–21.

Findings are categorised as governance, financial reporting, financial accounting, asset management, purchases and payables, payroll, cash and banking, revenue and receivables, or information technology. The high-risk and common audit findings across these areas are explored further in this chapter.

Audit Office’s annual work program for 2021–22 onwards

Focus on integrity of systems, good governance and good advice

We have a fundamental role in helping the Parliament hold government accountable for the use of public resources. In doing so, we examine whether councils' systems and processes are effective in supporting integrity, accountability and transparency. Key aspects of integrity that we expect to through conduct of our financial and performance audits over the next three years include the integrity of systems, good governance and good advice. These focus areas have arisen from the collation of key findings and recommendations from our past reports.

Focus on local councils' continued response to recent emergencies

The COVID-19 pandemic continues to have a significant impact on the people and the public sector of New South Wales. Local councils are continuing to assist communities in their recovery from the 2019–20 bushfires and subsequent and recent flooding. The full extent of some of these events remain unclear and will likely continue to have an impact into the future.

Image of a bus stop that's been completely burned because of a bushfire

The Office of Local Government within the Department of Planning and Environment continues to work with other state agencies to assist local councils and their communities to recover from these unprecedented events.

The increasing and changing risk environment presented by these events has meant that we have recalibrated and focused our efforts on providing assurance on how effectively aspects of responses to these emergencies have been delivered.

This includes financial and governance risks arising from the scale and complexity of government responses to these events.

We will take a phased approach to ensure our financial and performance audits address the following elements of the emergencies and the Local Government's responses:

  • local councils' planning and preparedness for emergencies
  • local councils' initial responses to support people and communities impacted by COVID-19 and the 2019–20 bushfires and recent floods
  • governance and oversight risks that arise from the need for quick decision-making and responsiveness to emergencies
  • effectiveness and robustness of processes to direct resources toward recovery efforts and ensure good governance and transparency in doing so
  • the mid to long-term impact of government responses to the natural disasters and COVID-19
  • whether government investment has achieved desired outcomes.

Focus on the effectiveness of cybersecurity in local government

The increasing global interconnectivity between computer networks has dramatically increased the risk of cybersecurity incidents. Such incidents can harm local government service delivery and may include theft of information, denial of access to critical technology, or even hijacking of systems for profit or malicious intent.

Outdated IT systems and capability present risks to government cybersecurity. Local councils need to be alert to the need to update and replace legacy systems, and regularly train and upskill staff in their use. To add to this, cybersecurity risks have been exacerbated by recent emergencies, which have resulted in greater and more diverse use of digital technology.

Our approach to auditing cybersecurity across in the sector involves:

  • considering how local councils are responding to the risks associated with cybersecurity across our financial audits
  • examining the effectiveness of cybersecurity planning and governance arrangements within local councils
  • conducting deep-dive performance audits of the effectiveness of cybersecurity measures in selected councils.

Local government elections

Local government elections took place in 2021–22

The local government elections were deferred for one year due to the COVID-19 pandemic and were held on 4 December 2021.

As part of our audits, we will consider the impact of any significant change on key decisions and activities for councils, county councils and joint organisations following the local government elections.

New rate peg methodology to support growing councils

The Independent Pricing and Regulatory Tribunal (IPART) has completed its review of the local government rate peg methodology to include population growth.

On 10 September 2021, IPART provided the final report on this review to the Minister for Local Government.

The minister has endorsed the new rate peg methodology and has asked IPART to give effect to it in setting the rate peg from the 2022–23 financial year.

As part of our audits, we will consider the impact of these changes on the financial statements and on key decisions and activities for councils, county councils and joint organisations.

Appendix one – Response from the Office of Local Government within the Department of Planning and Environment

Appendix two – Status of previous recommendations

Appendix three – Status of audits

 

Copyright notice

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Published

Actions for COVID-19: response, recovery and impact

COVID-19: response, recovery and impact

Community Services
Education
Health
Justice
Premier and Cabinet
Transport
Treasury
Whole of Government
Cross-agency collaboration
Financial reporting
Management and administration
Service delivery
Shared services and collaboration

What the report is about

This report draws together the financial impact of COVID-19 on the agencies integral to responses across the state government sector of New South Wales.

What we found

Since the COVID-19 pandemic hit NSW in January 2020, and until 30 June 2021, $7.5 billion was spent by state government agencies for health and economic stimulus. The response was largely funded by borrowings.

The key areas of spending since the start of COVID-19 in NSW to 30 June 2021 were:

  • direct health response measures – $2.2 billion
  • personal protective equipment – $1.4 billion
  • small business grants – $795 million
  • quarantine costs – $613 million
  • increases in employee expenses and cleaning costs across most agencies
  • vaccine distribution, including vaccination hubs – $71 million.

The COVID-19 pandemic significantly impacted the financial performance and position of state government agencies.

Decreases in revenue from providing goods and services were offset by increases in appropriations, grants and contributions, for health and economic stimulus funding in response to the pandemic.

Most agencies had expense growth, due to additional operating requirements to manage and respond to the pandemic along with implementing new or expanded stimulus programs and initiatives.

Response measures for COVID-19 have meant the NSW Government is unlikely to meet targets in the Fiscal Responsibility Act 2012 being:

  • annual expense growth kept below long-term average revenue growth
  • elimination of State’s unfunded superannuation liability by 2030.

 Fast facts

  • First COVID-19 case in NSW on 25 January 2020
  • COVID-19 vaccinations commenced on 21 February 2021
  • By 31 December 2021, 25.2 million PCR tests had been performed in NSW and 13.6 million vaccines administered, with 93.6% of the 16 and over population receiving two doses
  • During 2020–21, NSW Health employed an extra 4,893 full-time staff and incurred $28 million in overtime mainly in response to COVID-19
  • During 2020–21, $1.2 billion was spent on direct health COVID-19 response measures and $532 million was spent on quarantine for incoming international travellers

Section highlights

  • Up to 30 June 2021, $7.5 billion has been spent by state government agencies for health and economic stimulus.
  • Revenue increased for most agencies as falling revenue from providing goods and services was offset by additional funding from appropriations, grants and contributions.
  • Expenses increased as most agencies incurred additional costs to manage and respond to the pandemic along with delivering stimulus and support programs.
  • Borrowings of $7.5 billion over the last two years helped to fund the response to COVID-19.

Section highlights

  • NSW Government unlikely to meet targets in Fiscal Responsibility Act 2012.

Published

Actions for Transport 2021

Transport 2021

Transport
Asset valuation
Compliance
Financial reporting
Information technology
Infrastructure
Internal controls and governance

What the report is about

The results of the Transport cluster agencies’ financial statement audits for the year ended 30 June 2021.

What we found

Unmodified financial statement audit opinions were issued for all Transport cluster agencies. Resolution of issues delayed signing the Transport Asset Holding Entity of NSW (TAHE) until 24 December 2021. Matters relating to TAHE are also reported in the report on State Finances 2021.

Emphasis of Matter - TAHE

An Emphasis of Matter paragraph was included in TAHE's audit opinion to draw attention to uncertainty associated with:

  • future access and licence fees that are subject to re-signed agreements
  • an additional $4.1 billion of funding that is outside the forward estimates period
  • a significant portion of the fair value of TAHE’s non-financial assets is reflected in the terminal value, which is outside the ten-year contract period to 30 June 2031, and the risk that TAHE will not be able to negotiate contract terms to support current projections.

TAHE's transition from RailCorp also changed its valuation of assets to an income approach, resulting in a $20.3 billion decrease to the fair value. The fair value decrease was because the cash flows were not sufficient to support the previous recorded value.

TAHE corrected a misstatement of $1.2 billion relating to the valuation of its assets. This followed significant deliberation on key judgements and assumptions, with TAHE adopting risk assumptions in its valuation that were not in line with comparable benchmarks.

Emphasis of Matter - State Transit Authority of New South Wales

An Emphasis of Matter paragraph was included in the State Transit Authority of NSW's (the Authority) audit opinion to draw attention to the financial statements not prepared on a going concern basis. This was because the NSW Government put the Authority's bus contracts out to competitive tender and accordingly, management assessed the Authority's principal activities are not expected to operate for a full 12 months after 30 June 2021.

The implementation of AASB 1059 ‘Service Concession Arrangements: Grantors’ resulted in a net increase in assets of $23.5 billion across the Transport cluster.

The 2020–21 audits identified six high-risk and 45 moderate risk issues across the cluster. Fourteen of the moderate risk issues were repeat issues, including information technology controls around management of user access for key financial systems and payroll processes.

The high-risk issues, in addition to those related to TAHE and previously reported in the report on State Finances 2021, include:

  • absence of conflict of declarations related to land acquisition processes at Transport for NSW
  • no evidence of conflict of interest declarations obtained by TAHE from consultants and contractors regarding involvement in other engagements.

What we recommended

TAHE needs to:

  • finalise revised commercial agreements to reflect fees detailed in a Heads of Agreement signed on 18 December 2021
  • prepare robust projections and business plans to support the required rate of return.

NSW Treasury and TAHE should monitor the risk that control of TAHE assets could change in the future.

Transport for NSW needs to significantly improve its processes to ensure all key information is identified and shared with the Audit Office.

Transport agencies should implement a process to ensure conflicts of interest declarations are completed for land acquisitions and applied consistently across the cluster.

Transport agencies should implement a process to capture all contracts and agreements entered to ensure:

  • agencies are aware of contractual obligations
  • financial reporting implications are assessed, particularly with respect to leases, revenue and service concession arrangements.

Fast facts

The Transport cluster plans and delivers infrastructure and integrated services across all modes of transport. This includes road, rail, bus, ferry, light rail, cycling and walking. There are 11 agencies in the cluster.

  • $128b road and maritime system infrastructure assets as at 30 June 2021
  • 100% unqualified audit opinions were issued on agencies 30 June 2021 financial statements
  • 26 monetary misstatements were reported in 2020–21
  • $24.9b rail systems infrastructure assets as at 30 June 2021
  • high-risk management letter findings were identified
  • 37% of reported issues were repeat issues

 

This report provides Parliament and other users of the transport cluster (the cluster) agencies’ financial statements with the results of our audits, our observations, analysis, conclusions and recommendations in the following areas:

  • financial reporting
  • audit observations.

Financial reporting is an important element of good governance. Confidence and transparency in public sector decision making are enhanced when financial reporting is accurate and timely.

This chapter outlines our audit observations related to the financial reporting of agencies in the cluster for 2021.

Section highlights

  • Unqualified audit opinions were issued on all Transport agencies' financial statements.
  • An 'Emphasis of Matter' paragraph was included in the Transport Asset Holding Entity of New South Wales' (TAHE) Independent Auditor's Report to draw attention to significant uncertainty associated with the judgements, estimates and assumptions supporting the valuation of TAHE’s property, plant and equipment (PPE) and intangible assets.
  • In 2020–21, the former RailCorp transitioned to TAHE, a for-profit state-owned corporation. When TAHE became a for-profit entity, it was required to change its valuation approach. The value of a for-profit entity's assets cannot exceed the cash flows they might realise either through their sale or continued use. This change in the basis of valuation resulted in a decrease of $20.3 billion in the fair value of the assets. The decrease in fair value was because the cash flows, which support measurement under the income approach, were insufficient to support the previous valuation based on the current replacement cost of those assets.
  • TAHE also corrected a misstatement of $1.2 billion relating to the valuation of its assets after significant deliberation on key judgements and assumptions, with TAHE adopting higher risk assumptions in its valuation when compared to the relevant market benchmarks.
  • On 18 December 2021, a Heads of Agreement (HoA) was signed between TAHE, Transport for NSW, Sydney Trains and NSW Trains. This HoA reflected TAHE's intention to negotiate higher access and licence fees in order to meet the shareholding ministers' revised expectation of a higher rate of return. This matter resolved the treatment of a significant accounting issue in the State’s consolidated (whole-of-government) financial statements. Refer to the Report on State Finances tabled on 9 February 2022. The expectation of an additional $5.2 billion in fees added to the valuation of TAHE's PPE and intangibles, with a final value of $17.15 billion.
  • The implementation of AASB 1059 ‘Service Concession Arrangements: Grantors’ resulted in a net increase in assets of $23.5 billion across the cluster. AASB 1059 had a significant impact on Transport for NSW, Sydney Metro, Sydney Ferries and TAHE's 2020–21 financial statements.
  • TAHE corrected a misstatement of $97.2 million relating to the application of AASB 1059 'Service Concession Arrangements: Grantors' for the Airport Link Company Contract. 

Appropriate financial controls help ensure the efficient and effective use of resources and administration of agency policies. They are essential for quality and timely decision making.

This chapter outlines our observations and insights from our financial statement audits of agencies in the cluster.

Section highlights

  • The number of findings reported to management increased from 56 in 2019–20 to 73 in 2020–21.
  • Thirty-seven per cent were repeat findings. Many repeat issues related to information technology controls around user access management and payroll processes. These included deficiencies in the monitoring of privileged user access to key financial systems, review of user access to key financial systems and segregation of duties between preparer and reviewer for new employee hires.
  • Six new high-risk issues were identified in 2020–21, an increase of three compared to last year.
  • One high-risk issue related to conflicts of interests not being declared by all officers involved in the land acquisition process at Transport for NSW.
  • Five high-risk issues arose from the audit of TAHE, with respect to:
    • control over TAHE assets and operations
    • asset valuations
    • access price build up
    • detailed business modelling to support returns
    • conflict of interest management.
  • Based on the access and licence agreements signed at 30 June 2021 between TAHE, Sydney Trains and NSW Trains, our review of the expected returns calculated by NSW Treasury did not support the assumption that there was a reasonable expectation that a sufficient rate of return could be achieved from the NSW Government's investment in TAHE.
  • On 14 December 2021 the shareholding ministers' increased their expectations as to TAHE's target average return from 1.5 per cent to the expected long-term inflation rate of 2.5 per cent.
  • On 18 December 2021 the revised shareholder expectations were confirmed in a signed Heads of Agreement. The Heads of Agreement will increase access fees paid by rail operators to TAHE by $5.2 billion.
  • TAHE's access and licence agreements specified fees that were well short of the IPART regulated maximum (ceiling price).
  • The finalisation of the access and licence agreements with Sydney Trains and NSW Trains resulted in a significant write-down of TAHE's asset value by $20.3 billion. The revaluation loss will need to be recovered as part of the shareholders’ rate of return of 2.5 per cent in order to sustain the whole-of-government accounting treatment of cash contributions recorded as an equity contribution and not a grant expense.
  • There was a significant adjustment to TAHE’s valuation between the financial statements originally submitted for the audit and the final, signed financial statements due to differences in risk assumptions resulting in a correction of a $1.2 billion misstatement. 

Findings reported to management

The number of findings reported to management has increased, and 37 per cent of all issues were repeat issues

Breakdowns and weaknesses in internal controls increase the risk of fraud and error. Deficiencies in internal controls, matters of governance interest and unresolved issues were reported to management and those charged with governance of agencies. The Audit Office does this through management letters, which include observations, related implications, recommendations and risk ratings.

In 2020–21, there were 73 findings raised across the cluster (56 in 2019–20) and 37 per cent of all issues were repeat issues (43 per cent in 2019–20).

In view of the recent performance audit ‘Managing Cyber Risks’ and compliance audit ‘Compliance with the NSW Cyber Security Policy’ involving the cluster, it is noted with concern that the most common repeat issues related to weaknesses in controls over information technology user access administration and password management. Moderate risk issues included completeness and accuracy of contract registers, accounting for assets and management of supplier and payroll masterfiles.

A delay in implementing audit recommendations increases the risk of intentional and accidental errors in processing information, producing management reports, and generating financial statements. This can impair decision-making, affect service delivery and expose agencies to fraud, financial loss and reputational damage. Control deficiencies may also mean agency staff are less likely to follow internal policies, inadvertently causing the agency not to comply with legislation, regulation, and central agency policies.

The table below describes the common issues identified across the cluster by category and risk rating. 

Risk rating Issue
Information technology
Moderate: 7 new, 4 repeat**

The financial audits identified opportunities for agencies to improve information technology processes and controls that support the integrity of financial data used to prepare agencies' financial statements. Of particular concern are issues associated with:

  • monitoring of privileged user access
  • user access management
  • password configuration management.
Low: 4 new, 1 repeat***
Internal control deficiencies or improvements
High: 1 new*

The financial audits identified internal control deficiencies across key business processes, including:

  • declarations of conflicts of interest over land acquisitions (see further details below)
  • management of contracts and agreement register
  • accounting for assets
  • management of payroll and supplier masterfiles
  • payroll processes.
Moderate: 15 new, 8 repeat**
Low: 2 new, 5 repeat***
Financial reporting
High: 3 new*

The financial audits identified opportunities for agencies to strengthen financial reporting, including:

  • asset valuations (see further details below)
  • detailed business modelling to support returns (see further details below)
  • access price build-up (see further details below)
  • timely capitalisation of completed assets.
Moderate: 3 new, 1 repeat**
Low: 2 new***
Governance and oversight
High: 1 new*

The financial audits identified opportunities for agencies to improve governance and oversight processes, including:

  • control over TAHE assets and operations
  • governance over Cyber Security.
Moderate: 2 new**
Non-compliance with key legislation and/or central agency policies
High: 1 new*

The financial audits identified the need for agencies to improve its compliance with key legislation and central agency policies, including:

  • conflict of interest (COI) management
  • outdated policies and procedures
  • incomplete probation procedures.
Moderate: 4 new, 1 repeat**
Low: 1 new, 7 repeat***

* High-risk from the consequence and/or likelihood of an event that has had, or may have a negative impact on the entity.
** Moderate risk from the consequence and/or likelihood of an event that has had, or may have a negative impact on the entity.
*** Low risk from the consequence and/or likelihood of an event that has had, or may have a negative impact on the entity.
Note: Management letter findings are based either on final management letters issued to agencies.

2020–21 audits identified six high-risk findings

High-risk findings were reported at the following cluster agencies.

Agency Description
2020–21 findings
Transport for NSW (new finding)

Declaration of conflicts of interest in the land acquisition process

In 2021, we conducted a performance audit over the Acquisition of 4–6 Grand Avenue, Camellia which examined:

  • whether Transport for NSW conducted an effective process to purchase 4–6 Grand Avenue, Camellia
  • whether Transport for NSW has effective processes and procedures to identify and acquire property required to deliver the NSW Government’s major infrastructure projects.

The report made several recommendations over Transport for NSW’s internal policies and procedures to guide the land acquisition process. As part of the financial audit, we obtained an understanding of key controls and processes relating to the acquisition of land, relevant to the audit of the financial statements. We found that conflicts of interests were not always declared by all officers involved in the land acquisition process. Furthermore, processes for declaring conflicts of interests are not consistently applied across cluster agencies.

Out of a sample of 19 land acquisitions tested, we identified:

  • 14 instances where there was no evidence of declarations of conflicts of interests made by the team members involved in the acquisition process
  • 2 instances where conflicts of interest declarations were completed by key members of the acquisition team only at a project level
  • 1 instance where conflicts of interest declarations were only completed by the property negotiator and the valuer, but not the other members of the acquisition team.

Management advised that the land acquisition processes, at the time of the land acquisitions, did not require formal conflicts of interests to be declared as they believe that as per Transport for NSW code of conduct, declaration is only required where the staff member considers that a potential or perceived Conflict of Interest exists. However, Transport for NSW's Procurement Policy requires the documentation of formal declarations from all staff involved in procurement activities to formally disclose any conflicts of interest or state that they do not have a conflict of interest.

This matter has been included as a high-risk finding in the management letter as absence of rigorous and consistent management of conflicts of interests, and non-compliance with established policies increases the risk that Transport for NSW may be exposed to reputational damage or financial losses in relation to land acquisitions. Furthermore, this may result in lack of probity or value-for money considerations during the land acquisition process.

Further details are elaborated below under 'Land acquisitions'.

Transport Asset Holding Entity of New South Wales (new finding)

Control over TAHE assets and operations

The State-Owned Corporations Act 1989 maintains that all decisions relating to the operation of a statutory state-owned corporation (SOC) are to be made by or under the authority of the board. However, under the Transport Administration Act 1988 (TAA), the functions of TAHE may only be exercised under one or more operating licences issued by the portfolio minister. The current Operating Licence confers terms and conditions for TAHE to carry out its functions, and imposes constraints on TAHE, including (but not limited to):

  • railway operations not permitted
  • transport services not permitted
  • TAHE must not carry out maintenance of its assets.

Such operating licences are short term in nature, and the TAA allows the transport minister (portfolio minister) to grant one or more operating licences to TAHE and may amend, substitute, or impose, amend or revoke conditions of the operating licence.

For the current year, the legal form of the arrangements established in its first year of operation imply TAHE has control over the assets based on the Implementation Deed and the agreements signed with the public operators.

However, risks remain as TAHE is in its early stages, and the actual substance of operations will need to be observed and considered.

Given the restrictions that can be placed on the entity through the Operating Licence, and the ability to make further changes to the Operating Licence and Statement of Expectations set by the portfolio minister, there is a risk there could be limitations placed on the Board of Directors to operate with sufficient independence in its decision-making with respect to the operations of TAHE. Over time, this may further impact the degree of control required by TAHE to satisfy the recognition criteria over its assets. It may also fundamentally change the presentation of TAHE’s financial statements.

Future limitations to the degree of control TAHE, and its Board, can exercise over its functions may impact the degree of control TAHE has over its assets going forward. As part of the 2021–22 audit, we will monitor and assess whether, in substance, these assets continue to be controlled by TAHE and whether, in substance, TAHE can operate as an independent SOC. We require management continue to demonstrate that TAHE continues to maintain control over its assets and has the ability to operate as an independent SOC. Further details are described below under 'Transport Asset Holding Entity'.

Transport Asset Holding Entity of New South Wales (new finding)

Asset valuation

The final updated valuation was based on cash flows that were in a signed Heads of Agreement, which stated that it set out the proposed indicative future access and licence fees which will form the basis of the negotiations between TAHE, Transport for NSW, Sydney Trains and NSW Trains, who will work together to review access fees and licence fees payable under the agreements and to make all necessary changes to the Operating Agreements by 1 July 2022.

This adds uncertainty in the cash flows. It is crucial that TAHE formalises these updated fees in legally binding signed access and licence agreements with the relevant parties as soon as possible.

Refer below for further details on the Heads of Agreement.

Transport Asset Holding Entity of New South Wales (new finding)

Conflict of interest (COI) management

For procurement transactions through direct negotiation with single quotes, there was no evidence of COI declarations obtained from the consultants and contractors regarding involvement in other engagements. Contractors and consultants are required to declare actual COI. However, there was no requirement to confirm nil conflict of interest. In addition, there is a risk that perceived COI may not be adequately assessed or managed. TAHE is expected to operate as an independent SOC and would need to ensure any perceived or actual conflict of interest is adequately addressed.

Management should implement a process to:

  • ensure conflicts of interest declarations are completed when engaging all consultants and contractors (including involvement with other engagements and confirmation of nil conflicts of interests)
  • ensure probity is undertaken to identify any actual or perceived conflicts of interest.

The declarations should consider individuals and relationships that may create, or may be perceived to create, conflicts of interest.

Transport Asset Holding Entity of New South Wales (new finding)

Detailed business modelling to support returns

On 18 December 2021, Transport for NSW, TAHE and the operators, Sydney Trains and NSW Trains entered into a Heads of Agreement (HoA). This HoA forms the basis of negotiations to revise the pricing within the existing 10-year contracts and deliver upon the shareholders' expectation of a return of 2.5 per cent per annum of contributed equity, including recovering the revaluation loss incurred in 2020–21.

TAHE needs to revise its business plan and include detailed business modelling that supports the shareholding ministers' revised expectations of return (2.5 per cent return on the State’s equity injections and recovery of the write-down of assets over the average useful life of those assets) and align the business plan and Statement of Corporate Intent. This requires more detailed projections, estimates and plans that support how TAHE expects to recover the asset write-down and expected returns to government. The current modelling for ten years needs to be enhanced with modelling over the expected recovery period of approximately 33 years.

Transport Asset Holding Entity of New South Wales (new finding)

Access price build-up

Management explained that in determining access and licence fees for the agreements with Sydney Trains and NSW Trains, assets prior to the commencement of equity injections in 2015–16 were excluded from the calculations. Management explained the premise being that these assets were previously funded by government through capital grants. The replacement and refurbishment of these assets is expected to be through government funded maintenance performed through the public rail operators and/or the equity injections from NSW Treasury rather than through access and licence fees.


The number of moderate risk findings increased from prior year

Forty-five moderate risk findings were reported in 2020–21, representing a 73.1 per cent increase from 2019–20. Of these, 14 were repeat findings, and 31 were new issues. 

Key moderate risk findings related to:

  • weaknesses in user access management to key financial systems
  • management of contracts and agreements register
  • management of supplier and payroll masterfiles
  • accounting for assets
  • control deficiencies at service organisations
  • segregation of duties relating to the hiring of employees
  • conflict of interest management
  • annual leave management
  • review of internal audit charter
  • disaster recovery planning.

Transport Asset Holding Entity of New South Wales

Background

The establishment of TAHE was originally announced by the NSW Government in the 2015–16 State Budget. On 1 July 2020, the former Rail Corporation New South Wales (RailCorp), a not-for-profit entity, transitioned to the Transport Asset Holding Entity of New South Wales (TAHE), a for-profit statutory state-owned corporation under the Transport Administration Act 1988. There was no change in the structure of TAHE as a new entity was not created. Ownership remains fully with the government. TAHE, and the former RailCorp, were both classified as Public Non-Financial Corporation (PNFC) entities within the Total State Sector Accounts.

Prior to 1 July 2015, the government paid appropriations to Transport for NSW, a General Government Sector (GGS) agency, to construct transport assets. When completed, these assets were granted to the former RailCorp, a not for-profit entity within the PNFC sector. The grants to the former RailCorp were recorded as an expense in the State’s GGS budget result.

From 1 July 2015, the government announced the creation of TAHE (a dedicated asset manager). Funding for new capital projects was to be provided through equity injections and was no longer recorded as an expense to the GGS budget, even though the business model was yet to be determined. The change, as explained in the 2015–16 State Budget, was due to the expectation that the former RailCorp will transition to TAHE, which was intended, over time to provide a commercial return. That Budget also highlighted how the change, which was largely a change in the basis of accounting, was intended to improve the GGS budget result each year. In total, the GGS has contributed approximately $11.1 billion to TAHE since 2015–16. This includes the equity injections from the GGS to TAHE made in the current year of $2.4 billion.

NSW Treasury initially set a timetable for the stand-up of TAHE of 1 July 2019, which included finalising the business model, operating model and contracts for the use of TAHE's assets. The enactment of the Transport Administration Act 1988 resulted in RailCorp transitioning to TAHE on 1 July 2020, 12 months after its originally planned operational date. Contributions paid to the former RailCorp and subsequently to TAHE by the GGS were treated as equity investments from July 2015 forward. This treatment continued, despite delays in settling the business model. In 2020, the Audit Office raised a high-risk finding due to the significance of the financial reporting impacts and business risks for NSW Treasury and TAHE.

The business model adopted and the flow of funds between transport agencies in the GGS and PNFC sectors is shown in the diagram below. For further details refer to the Report on State Finances 2021.

Appendix one – Misstatements in financial statements submitted for audit

Appendix two – Early close procedures

Appendix three – Financial data

Copyright notice

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Published

Actions for Treasury 2021

Treasury 2021

Treasury
Finance
Compliance
Financial reporting
Internal controls and governance
Management and administration

What the report is about

The results of Treasury cluster agencies' financial statement audits for the year ended 30 June 2021. The results of the audit of the NSW Government's consolidated Total State Sector Accounts (TSSA), which are prepared by NSW Treasury, are reported separately in our report on State Finances 2021.

What we found

Unmodified audit opinions were issued for all Treasury cluster agencies.

The number of identified monetary misstatements increased from 16 in 2019–20 to 24 in 2020–21.

Reported corrected monetary misstatements decreased from 15 in 2019–20 to seven with a gross value of $1.1 billion in 2020–21.

The largest corrected misstatement was in NSW Treasury's financial statements and was a $1 billion correction to administered borrowings.

Reported uncorrected monetary misstatements increased from one in 2019–20 to 17 with a gross value of $168 million in 2020–21.

Seven of the 2020–21 uncorrected misstatements related to one common decision relating to investment management funds terminated during the year by the NSW Treasury Corporation (TCorp).

All agencies submitted their 2020–21 financial statements within NSW Treasury's reporting deadlines.

What the key issues were

Significant audit findings were identified with respect to NSW Treasury's processes to prepare the NSW Government's consolidated TSSA (whole of government accounts). This included one extreme finding and several high-risk findings related to NSW Treasury processes. These are reported in our report on State Finances 2021.

Two high-risk issues raised in 2019–20 were also not addressed by NSW Treasury during the year and were repeat issues reported to management. These related to the appropriations framework and resolution of cross cluster payments, and instances where some agencies spent deemed appropriations money without an authorised delegation.

A number of previously reported audit findings and recommendations with respect to icare continue to be ongoing issues, namely:

  • The Workers Compensation Nominal Insurer continues to hold less assets than the estimated present value of its future payment obligations.
  • The Workers Compensation Nominal Insurer's four week return-to-work rate fell from 68% to 64%. This is below icare's 70% target. Contributing factors include COVID-19 lockdowns which have impacted claims handling processes, and increased barriers to claimants returning to work.
  • Instances were noted where inadequate documentation was kept on file to support claims, including pre-injury average weekly earnings (PIAWE) calculations.

The Workers Compensation (Dust Diseases) Authority increased its outstanding claims liability by $93.9 million, which included $39.3 million to remediate historical underpayments, resulting from workers not being paid the rate required by existing legislation.

The icare Board approved a new approach for remediating PIAWE underpayments on 24 September 2021, the date the Workers Compensation Nominal Insurer’s financial statements were approved for issue. The impact of the decision on the financial statements was not discussed with the Audit Office and assessed as an ‘after balance date event’.

What we recommended

Our report on State Finances 2021 made several recommendations to improve NSW Treasury processes. These included:

  • improve processes to ensure information is shared with audit on a timely basis
  • seek legislative amendments to resolve statutory inconsistencies relating to statutory reporting time frames
  • implement effective quality review processes over key accounting information
  • establish a policy to determine the minimum expected rate of return on equity injections in other public sector entities
  • prepare robust financial projections to support accounting decisions
  • re-confirm sector classifications of TAHE, Sydney Trains and NSW Trains
  • ensure sufficient oversight of its use of consultants and assess the risk of an overdependence on consultants at the cost of internal capability
  • improve disclosures of equity injections invested in other public sector entities
  • determine a state-wide policy on when borrowings are recognised in agency financial statements
  • make legislative amendments to ensure expenditure incurred across financial years does not exceed the appropriation authority and assess the financial reporting impact
  • improve the guidance provided to agencies to ensure expenditure of public money is properly supported by authorised delegations.

We also recommended icare should ensure:

  • it has sufficient controls over claim payments including an effective quality assurance program, to minimise claim payment errors
  • that documentation to support injured worker benefit calculations is appropriately maintained, and the documentation requirements are set out in a policy
  • the impact of ‘after balance date events’ on financial statements is appropriately assessed
  • its operational practices are improved to ensure the correct payment of claims in compliance with legislative requirements. icare also needs to act on a timely basis on received legal advice and amend operational practices to ensure correct payments are made.

Fast facts 

NSW Treasury notes that it is the Government's principal financial and economic adviser to guide the State’s growth for the benefit of the people who live, work and study in NSW.

  • $111b funds under management as at 30 June 2021
  • 100% unqualified audit opinions were issued on agencies’ 30 June 2021 financial statements
  • 24 monetary misstatements were reported in 2020–21
  • $17b total expenditure incurred in 2020–21
  • 12 extreme and high-risk findings were identified
  • 30% of reported issues were repeat issues

This report focuses on agencies within the Treasury cluster and provides parliament and other users of the Treasury cluster's financial statements with the results of our audits, our observations, analysis, conclusions and recommendations in the following areas:

  • financial reporting
  • audit observations.

NSW Treasury also prepares the consolidated NSW whole of government financial statements (the Total State Sector Accounts), which is reported in the report on State Finances 2021.

Financial reporting is an important element of good governance. Confidence and transparency in public sector decision making is enhanced when financial reporting is accurate and timely.

This chapter outlines our audit observations related to the financial reporting of agencies in the Treasury cluster (the cluster) for 2021.

Section highlights

  • Unmodified audit opinions were issued on all the cluster agencies 2020–21 financial statements.
  • The number of identified monetary misstatements increased from 16 in 2019–20 to 24 in 2020–21.
  • Reported corrected monetary misstatements decreased from 15 in 2019–20 to seven with a gross value of $1.1 billion in 2020–21. The largest corrected misstatement was in NSW Treasury's financial statements resulting in a $1 billion correction to its administered borrowings. The correction was to address an understatement by NSW Treasury which did not recognise a liability for funds raised by NSW Treasury Corporation (TCorp) on its behalf as it applied settlement date accounting rather than trade date when recognising these borrowings. A corresponding receivable from TCorp was also recognised to reflect that funds were to be received on 1 July 2021.
  • The number of uncorrected misstatements increased from one in 2019–20 to 17 in 2020–21. Two of the misstatements above $5 million related to investment valuations within the SAS Trustee Corporation Pooled Fund, two related to premium income overstatements within the Workers Compensation Nominal Insurer, and one related to NSW Treasury administered liabilities and expenses where it recognised a provision for remediation costs when it had no present obligation. A further seven related to investment management funds that were terminated during the year by TCorp.
  • Nine agencies that were required to perform early close procedures did not complete a total of 25 mandatory procedures. The most common incomplete early close procedures include inter and intra (cluster) agency balances and transactions not confirmed with the counterparty agency and significant management judgements and assumptions made when estimating transactions and balances not documented.
  • To ensure compliance with Australian Accounting Standards, transactions and balances that were formerly reported in the Crown Entity’s financial statements are now reported by NSW Treasury as it primarily controls or administers the transactions and balances on behalf of the State.
  • icare changed the risk margin applied to measure the Workers Compensation Nominal Insurer's outstanding claims liability. If the risk margin used when valuing its 2019–20 outstanding claims liability had been retained, its net asset deficiency would have worsened compared to the prior year. The change in risk margin aligns the Nominal Insurer’s ‘probability of adequacy’ with the Australian Prudential Regulation Authority’s minimum reporting requirements for general insurers.
  • The icare Board approved a new approach for remediating pre-injury average weekly earnings underpayments (subject to legal advice, and assessment by a wage remediation expert), on 24 September 2021 and announced on 11 November 2021. The impact of the decision on the Nominal Insurer's financial statements was not assessed by icare as an ‘after balance date event’ and was not raised with the Audit Office prior to icare finalising its 2021 financial statements on 24 September 2021.

Appropriate financial controls help ensure the efficient and effective use of resources and administration of agency policies. They are essential for quality and timely decision making.

This chapter outlines our observations and insights from our financial statement audits of agencies in the Treasury cluster.

Section highlights

  • The 2020–21 audits identified one new Extreme Risk and 11 High Risk findings. The extreme risk finding related to the incomplete provision and timely access to information to the Total State Sector Accounts (TSSA) audit and the accounting for the General Government Sector's investment in TAHE. Findings related to the TSSA audit are reported in the report on State Finances 2021. Of the 11 high risk findings, two were repeat findings relating to cross cluster payments and authorisation to spend deemed funds. High risk repeat findings need to be addressed with greater priority.
  • There were 21 moderate risk findings reported to management in 2020–21, ten of which were repeat findings. The most common repeat finding related to claims processing, information technology user access administration. Repeat findings, particularly those that relate to data protection, need greater prioritisation and should be implemented on a timely basis.
  • icare is in the process of implementing organisational reform in response to findings in recent external reviews. These reviews identified 151 recommendations for icare to improve in the areas of risk and governance, performance, and culture and accountability. All of the recommendations were accepted by icare and are expected to be addressed through their ‘Improvement Program’. A number of the observations referred to in this report were also identified in the external reviews.
  • The Nominal Insurer's four week return-to-work rate fell from 68% at 30 June 2020 to 64% at 30 June 2021 and was at 63% at 30 September 2021. This is below icare's target of 70%.
  • The Nominal Insurer overpaid, and underpaid claims to policyholders due to claims processing weaknesses. There was also insufficient documentation to support key inputs to weekly benefit payments, thereby further increasing the risk of claims being overpaid, and underpaid.
  • The Home Building Compensation Fund's net liability position reduced from $746 million at 30 June 2020 to $534 million at 30 June 2021 due to increases in premium rates and increased building activity from stimulus measures.
  • The Nominal Insurer's provision for errors in pre-injury average weekly earnings decreased from $21 million to 30 June 2020, to $11.6 million at 30 June 2021. The provision was not reassessed for icare’s decision to proactively remediate PIAWE underpayments.
  • The NSW Self Insurance Corporation also recognised a $12.8 million provision at 30 June 2021 to remediate past underpayments.

Findings reported to management

The number of findings reported to management has decreased, but 30% of all issues were repeat issues and these need greater focus and prioritisation

Breakdowns and weaknesses in internal controls increase the risk of fraud and error. Deficiencies in internal controls, matters of governance interest and unresolved issues were reported to management and those charged with governance of agencies. The Audit Office does this through management letters, which include observations, related implications, recommendations and risk ratings.

In 2020–21, there were 57 findings raised across the cluster (71 in 2019–20), 30% of which were repeat issues (32% in 2019–20).

The most common repeat issues related to claims processing and information technology user access administration.

A delay in implementing audit recommendations increases the risk of intentional and accidental errors in processing information, producing management reports and generating financial statements. This can impair decision-making, affect service delivery and expose agencies to fraud, financial loss and reputational damage. Poor controls may also mean agency staff are less likely to follow internal policies, inadvertently causing the agency not to comply with legislation, regulation and central agency policies.

The table below describes the common issues identified across the cluster by category and risk rating.

Risk rating Issue
Information technology

Moderate2
4 new
2 repeat

Low1
6 new
4 repeat

The financial audits identified the need for agencies to improve information technology processes and controls that support the integrity of financial data used to prepare agencies' financial statements. Of particular concern are issues associated with:
  • poor user access administration and monitoring of privileged user activities
  • lack of disaster recovery planning.
Internal control deficiencies or improvements

High3
1 repeat

Moderate2
5 new
7 repeat

Low1
9 new
 

 

The financial audits identified internal control weaknesses across key business processes, including:
  • lack of controls to ensure cluster expenditure does not exceed a minister's appropriation authority received under the annual Appropriations Act and the GSF Act
  • inadequate procurement controls including purchase orders not being used and policy documents not stipulating thresholds which require minimum quotations or tenders
  • inadequate claim processing controls leading to documentation not kept to support claims, and errors in payments.
High risk issues are discussed later in this chapter.
Financial reporting

High3
2 new

Moderate2
2 new
1 repeat

Low1
2 new 

The financial audits identified opportunities for agencies to strengthen financial reporting, including:
  • need to review significant judgements, and continue to assess whether assets are controlled
  • grants being incorrectly accounted for leading to errors
  • provisions not including costs to settle the obligation and errors in the accuracy and completeness of underlying data used in valuations.
High risk issues are discussed later in this chapter.
Governance and oversight

Extreme4
1 new

High3
7 new

Low1
1 new
 

The financial audits identified the need for agencies to improve governance and oversight processes, including:
  • documentation was inadequate and key documents were either not provided to the Audit Office, or were not provided on a timely basis, or their existence was not made known to the Audit Office
  • inconsistencies in the GSF Act and GSA Act relating to statutory timeframes
  • numerous versions of working papers were submitted all of which contained errors, omissions and/or poor logic
  • no formal policy or benchmark on expected investment returns from other government sectors
  • addressing significant uncertainty relating to access fees to be paid by rail operators raised in the Total State Sector Accounts audit opinion
  • the sector classification of certain Public Non-Financial Corporations needs to be confirmed with the Australian Bureau of Statistics
  • external consultants were used extensively to advise government agencies on matters related to TAHE
  • there is no state-wide policy about borrowings which provides guidance around performance obligations arising under trades between government agencies.
Extreme and high risk issues are discussed later in this chapter and in the report on State Finances 2021.
Non-compliance with key legislation and/or central agency policies

High3
1 repeat

Low1
1 new
1 repeat

The financial audits identified the need for agencies to improve its compliance with key legislation and central agency policies, including:
  • non-compliance with the GSA Act and expenditure of public monies not supported by authorised delegations or spent for an authorised and valid purpose
  • input tax credits were not always claimed correctly.
High risk issues are discussed later in this chapter.

 Extreme risk from the consequence and/or likelihood of an event that has had, or may have a negative impact on the entity.
3 High risk from the consequence and/or likelihood of an event that has had, or may have a negative impact on the entity.
2 Moderate risk from the consequence and/or likelihood of an event that has had, or may have a negative impact on the entity.
1 Low risk from the consequence and/or likelihood of an event that has had, or may have a negative impact on the entity.

 Note: Management letter findings are based either on final management letters issued to agencies, or draft letters where findings have been agreed with management.

The number of moderate risk findings decreased from prior year

There were 21 moderate risk findings reported in 2020–21, representing a 30% decrease from 2019–20. Of these, ten were repeat findings, and 11 were new issues.

Moderate risk repeat findings include:

  • claims processing weaknesses including claim payment errors, and inadequate documentation to support calculations and evidence claims were reviewed by someone with appropriate delegation
  • inadequate review of user access and higher risks of unintended or unauthorised system access
  • controls assurance reports from an outsourced service provider did not cover the services it provided to the government agency
  • failure to review procurement contracts register to ensure it is accurate and complete
  • ongoing control deficiencies with grant application and approval processes
  • key policies including delegations not being reviewed in a number of years and do not incorporate new requirements from more recent legislation
  • quality review processes failing to identify material classification errors associated with grant funding.

NSW Treasury related matters

Accounting for the Government's investment in Transport Asset Holding Entity

A total of seven recommendations were made with respect to NSW Treasury's processes to prepare the NSW Government's consolidated whole of government accounts (the TSSA). This included one extreme risk finding and six high risk findings. The extreme finding related to NSW Treasury needing to significantly improve its processes to ensure all key information is identified and shared with the Audit Office on a timely basis. Other high-risk findings were identified which resulted in the following recommendations for NSW Treasury:

  • establishing a policy to determine the minimum expected rate of return on the GGS equity injections in other public sectors entities and report on the performance of these GGS investments in the TSSA, including how much and what type of returns the government is obtaining from its investments compared to its targeted return
  • facilitate revised commercial agreements to reflect access and license fees that were agreed in the 18 December 2021 Heads of Agreement between Transport for NSW, TAHE and the operators Sydney Trains and NSW Trains
  • with TAHE, prepare robust projections and business plans to support GGS investment returns beyond FY2031.
  • liaising with the ABS to re-confirm the classification of TAHE, NSW Trains and Sydney Trains as entities within the PNFC sector
  • monitoring the risk that control of TAHE assets could change in future reporting periods and the implications on the TSSA
  • consider whether there is sufficient competent oversight of its use of consultants and assess the risk of an over dependence on consultants at the cost of internal capability.

More details on the recommendations to NSW Treasury relating to its accounting for the GGS investment in TAHE are included on pages 7 to 24 of the State Finances 2021 NSW Auditor-General’s Report to Parliament. 

Borrowings of $1 billion were understated by NSW Treasury

NSW Treasury, a GGS agency, made agreements to borrow $1 billion from New South Wales Treasury Corporation (TCorp), a PFC sector agency. Some of these agreements were entered as early as 17 May 2021 and all agreements for borrowings were entered into before 30 June 2021. However, NSW Treasury requested that settlement of those additional borrowings be deferred until 1 July 2021.

As TCorp raised the funds before 30 June 2021, it recognised a financial asset and liability to NSW Treasury on 30 June 2021. Despite TCorp having raised the funds by 30 June 2021 under the mutually agreed trade deal, NSW Treasury did not recognise any borrowings at year end on the basis that it requested the settlement date and receipt of cash to be deferred to past the balance sheet date. This led to an understatement of debt liabilities of $1 billion by NSW Treasury, and an inconsistent accounting treatment between the two agencies. NSW Treasury subsequently corrected the misstatement after the matter was raised by the audit, resulting in the GGS recognising $1 billion in financial assets and borrowings at 30 June 2021.

More detail on these inconsistencies is on page 37 of the State Finances 2021 NSW Auditor-General’s Report to Parliament. We recommended NSW Treasury seek develop a state-wide accounting policy for borrowings which ensure correct and consistent accounting treatment between agencies and sectors.

Inconsistencies exist in the GSF Act and GSA Act related to key statutory timeframes

There are inconsistencies between key statutory reporting timeframes imposed on the Treasurer and Auditor-General for the Consolidated State Financial Statements (the Statements) in the Government Sector Finance Act 2018 (GSF Act) and Government Sector Audit Act 1983 (GSA Act). Ambiguity in the statutory reporting timeframes could impact on the future timely provision of this information to Parliament. More detail on these inconsistencies is on page 54 of the State Finances 2021 NSW Auditor-General’s Report to Parliament. We recommended NSW Treasury seek legislative amendments in Parliament to resolve these inconsistencies.

NSW Treasury lacks a framework to monitor and provide assurance to ministers that they are in compliance with their appropriation authority

In July 2021, NSW Treasury highlighted a potential issue associated with certain cross-cluster payments which was based on advice received from the Crown Solicitor in January 2021. After being made aware of the issue, the Audit Office obtained its own advice on matters related to the appropriations framework under relevant state legislation. In the advice to the Audit Office, the Crown Solicitor advised that an agency is not subject to its own legally appropriated expenditure limit (assuming it is not subject to any annual spending limit imposed through an instrument of delegation or a budget control authority issued by the Treasurer under section 5.1 of the GSF Act). In effect, because responsible ministers are given appropriations, these legal expenditure limits, rest in aggregate, with the principal department and agencies the minister is responsible for. It is not possible for an individual agency to monitor or determine at what ‘point in time’ expenditure has been incurred in excess of the minister’s appropriation authority and there is currently no framework to monitor this.

Further detail on this matter is on pages 54 to 56 of the State Finances 2021 NSW Auditor-General’s Report to Parliament. In this report, we recommended that NSW Treasury:

  • ensure a framework exists to monitor and provide assurance to ministers that expenditure incurred across a financial year by agencies under the relevant minister's coordination does not exceed the appropriation authority conferred by the annual Appropriations Act and the GSF Act
  • assess how the requirement to prepare a Summary of Compliance under Australian Accounting Standards impacts relevant principal departments and cluster agencies financial statement disclosures.

Agencies have again spent monies without an authorised delegation

In the State Finances NSW Auditor-General's Report to Parliament for 2020 and 2021 we reported instances where agencies spent money received from an annual appropriation and/or deemed appropriation money without an authorised delegation from the relevant minister(s) as required by sections 4.6(1) and 5.5(3) of the GSF Act. Further detail on this matter is on pages 56 to 57 of the State Finances 2021 NSW Auditor-General’s Report to Parliament. In this report, we recommended NSW Treasury promptly improve the guidance it provides agencies to ensure that expenditure of public monies is properly supported by authorised delegations.

Control deficiencies at NSW Treasury's service providers

NSW Treasury's business processes and information technology services were provided by Infosys, Unisys and the Department of Customer Service during 2020–21. Together this constitutes the GovConnect environment.

The GovConnect information technology general controls (ITGC) were qualified in 2020–21. The key controls over user access, system changes and batch process failed in all ITGC reports. Most of these deviations were not mitigated or sufficiently mitigated to address the risk of unauthorised user access.

In response to the internal control qualifications, the audit teams performed data analytics over payroll and accounts payable to obtain reasonable assurance that these control deficiencies did not materially impact on relevant agencies' financial statements.

Refer to the Customer Service 2021 NSW Auditor-General’s Report to Parliament for further details.

Insurance related matters

icare is in the process of implementing organisational reform in response to findings in recent external reviews. These reviews have identified 151 recommendations for icare to improve in the areas of risk and governance, performance, and culture and accountability. The reviews include the April 2021 McDougall Review, and the February 2021 ‘Independent Review of icare governance, accountability and culture’ which was recommended by SIRA in the Dore Report.

All of these recommendations were accepted by icare and are expected to be addressed through their ‘Improvement Program’. As at February 2022, icare report that 21 have been addressed, 139 are in progress, and 15 still to commence.

A number of the observations referred to in this report were also identified in the above reviews and are expected to be actioned as part of the improvement program.

Workers Compensation Nominal Insurer (the Nominal Insurer)

The Nominal Insurer’s net asset deficiency at 30 June 2021

Last year's Central Agencies Report to Parliament reported that the Workers Compensation Nominal Insurer (the Nominal Insurer), the NSW Self Insurance Corporation and the Lifetime Care and Support Authority of New South Wales all had negative net assets at 30 June 2020. After strong investment returns in 2020–21, only the Nominal Insurer continued to have negative net assets at 30 June 2021.

The Nominal Insurer's negative net assets of $252.9 million at 30 June 2021 ($316.2 million at 30 June 2020) means that it still does not hold sufficient capital to meet the estimated present value of its future payment obligations, when measured in accordance with the accounting framework. The financial statements continued to be prepared on a going concern basis because the future payment obligations are not all due for settlement within the next 12 months.

As noted in section 2.4 ‘Key accounting issues’, icare changed from an 'Accounting Ratio', to an 'Insurance Ratio', to assess the Nominal Insurer’s capital position from 2020–21. The insurance ratio uses a (higher) discount rate based on the expected earnings rate on the Nominal Insurer’s assets, rather the ‘risk free’ rate which is used for financial reporting.

Last year's Report to Parliament also noted that the deterioration in the value of the Nominal Insurer’s net assets has resulted in its funding ratio at 30 June 2020 being outside of the ‘target operating zone’ set by the Board of icare. The Insurance Ratio at 30 June 2021 is 122%, which is less than icare's target operating zone of over 130%.

icare is assessing how it can increase the Nominal Insurer’s funding ratio, and advises that actions taken to date include the execution of the Nominal Insurer Improvement Program (the Improvement Program) and an increase in premium rates.

icare were given approval by the State Insurance Regulatory Authority (SIRA) to increase workers compensation premium rates from 1.4% to 1.44%  of wages (2.9%) for the 2021–22 policy year. icare advises that their pricing strategy for workers compensation premiums is for ‘modest increases over the medium term’.

Return-to-work rates have worsened

Last year's Central Agencies Report to Parliament noted that the Nominal Insurer has experienced deteriorating return-to-work rates since late 2017. According to data published by SIRA, the Nominal Insurer’s monthly four week return-to-work rate has continued to decline, falling from 68% at 30 June 2020 to 64% at 30 June 2021, and down to 63% at 30 September 2021.

A key assumption when measuring the Nominal Insurer’s outstanding claims liability, is the amount of time that injured workers will remain on benefits (i.e. continuance rates). This assumption is significantly aligned with return-to-work rate measures. At 30 June 2021, the liability was increased by $296 million due to changes in continuance rate assumptions, with workers expected to remain on benefits longer. This change is consistent with the fall in four week return-to-work rates.

The four week return-to-work rate trend since August 2017 is shown in the graph below.

Appendix one - Misstatements in financial statements submitted for audit

Appendix two – Early close procedures

Appendix three – Timeliness of financial reporting

Appendix four – Financial data

Appendix five – Acquittals and other opinions

 

Copyright notice

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

 

Published

Actions for Planning, Industry and Environment 2021

Planning, Industry and Environment 2021

Environment
Industry
Local Government
Planning
Asset valuation
Financial reporting
Information technology
Internal controls and governance
Risk

This report analyses the results of our audits of the Planning, Industry and Environment cluster agencies for the year ended 30 June 2021.

Our preferred approach is to table the ‘Report on State Finances’ in Parliament before any other cluster report. This is because the 'Report on State Finances' focuses on the audit results and observations relating to the Total State Sector Accounts, in effect a consolidation of all government agencies. This year the 'Report on State Finances' has been delayed due to significant accounting issues being considered in the Total State Sector Accounts and which may impact the Treasury and Transport clusters.

As there are no outstanding matters relating to audits in the Planning, Industry and Environment cluster impacting the Total State Sector Accounts we have decided to break with normal practice and table this cluster report ahead of the ‘Report on State Finances’.

What the report is about

The results of the Planning, Industry and Environment cluster agencies' financial statements audits for the year ended 30 June 2021.

What we found

Unmodified audit opinions were issued for all completed 30 June 2021 financial statements audits of cluster agencies. Three audits are ongoing.

An 'Other Matter' paragraph was included in the Independent Planning Commission's (the IPC) audit opinion because the prior year comparative figures were not audited. Prior to 2020–21, the IPC was not required to prepare separate financial statements under the Public Finance and Audit Act 1983 (PF&A Act). The financial reporting provisions of the Government Sector Finance Act 2018 now require the IPC to prepare financial statements.

The number of identified misstatements increased from 51 in 2019–20 to 54 in 2020–21.

The 2010–11 to 2019–20 audits of the Water Administration Ministerial Corporation’s (the Corporation) financial statements are incomplete due to insufficient records and evidence to support the transactions of the Corporation, particularly for the earlier years. Management has commenced actions to improve the governance and financial management of the Corporation. These audits are currently in progress and the 2020–21 audit will commence shortly.

There are 609 State controlled Crown land managers (CLMs) across New South Wales that predominantly manage small parcels of Crown land.

Eight CLMs prepared and submitted 2019–20 financial statements by the revised deadline of 30 June 2021. A further 24 CLMs did not prepare financial statements in accordance with the PF&A Act. The remaining CLMs were not required to prepare 2019–20 financial statements as they met NSW Treasury's financial reporting exemption criteria.

The Department of Planning, Industry and Environment's (the department) preliminary assessment indicates that 60 CLMs are required to prepare financial statements in 2020–21. To date, no CLMs have prepared and submitted financial statements for audit in 2020–21.

There are also 120 common trusts that have never submitted financial statements for audit. Common trusts are responsible for the care, control and management of land that has been set aside for specific use in a certain locality, such as grazing, camping or bushwalking.

What the key issues were

The number of matters we reported to management increased from 135 in 2019–20 to 180 in 2020–21, of which 40 per cent were repeat findings.

Seven high-risk issues were identified in 2020–21:

  • system control deficiencies at the department relating to user access to HR and payroll management systems, vendor master data management and journal processing, which require manual reviews to mitigate risks
  • deficiencies related to the Centennial Park and Moore Park Trust's tree assets valuation methodology
  • the Lord Howe Island Board did not regularly review and monitor privileged user access rights to key information systems
  • the Natural Resources Access Regulator identified and adjusted three prior period errors retrospectively, which indicate deficiencies within the financial reporting processes
  • deficiencies relating to the Parramatta Park Trust's tree assets valuation methodology
  • lease arrangements have not been confirmed between the Planning Ministerial Corporation and Office of Sport regarding the Sydney International Regatta Centre
  • the Wentworth Park Sporting Complex land manager (the land manager) has a $6.5 million loan with Greyhound Racing NSW (GRNSW). GRNSW requested the land manager to repay the loan. However, the land manager subsequently requested GRNSW to convert the loan to a grant. Should this request be denied, the land manager would not be able to continue as a going concern without financial support. This matter remains unresolved for many years.

There continues to be significant deficiencies in Crown land records. The department uses the Crown Land Information Database (CLID) to record key information relating to Crown land in New South Wales that are managed and controlled by the department and land managers (including councils and land managers controlled by the state). The CLID system was not designed to facilitate financial reporting and the department is required to conduct extensive adjustments and reconciliations to produce accurate information for the financial statements.

The department is implementing a new system to record Crown land (the CrownTracker project). The department advised that the project completion date will be confirmed by June 2022.

What we recommended

The department should ensure CLMs and common trusts meet their statutory reporting obligations.

Cluster agencies should prioritise and action recommendations to address internal control deficiencies, with a focus on addressing high-risk and repeat issues.

The department should prioritise action to ensure the Crown land database is complete and accurate. This will allow the department and CLMs to be better informed about the Crown land they control.

Fast facts

The Planning, Industry and Environment cluster aims to make the lives of people in New South Wales better by developing well-connected communities, preserving the environment, supporting industries and contributing to a strong economy.

There are 54 agencies, 609 State controlled Crown land managers that predominantly manage small parcels of Crown land and 120 common trusts in the cluster.

  • 42% of the area of NSW is Crown land
  • $33.2b water and electricity infrastructure as at 30 June 2021
  • 100% unqualified audit opinions were issued for all completed 30 June 2021 financial statements audits
  • 7 high-risk management letter findings were identified
  • 54 monetary misstatements were reported in 2020–21
  • 40% of reported issues were repeat issues

This report provides parliament and other users of the Planning, Industry and Environment cluster (the cluster) agencies’ financial statements with the results of our audits, our observations, analysis, conclusions and recommendations in the following areas:

  • financial reporting
  • audit observations.

Financial reporting is an important element of good governance. Confidence and transparency in public sector decision-making are enhanced when financial reporting is accurate and timely.

This chapter outlines our audit observations related to the financial reporting of agencies in the Planning, Industry and Environment cluster (the cluster) for 2021.

Section highlights

  • Unmodified audit opinions were issued for all completed 30 June 2021 financial statements audits of cluster agencies. Three audits are ongoing.
  • An 'Other Matter' paragraph was included in the Independent Planning Commission’s (the IPC) audit opinion because the prior year comparative figures were not audited. Prior to 2020–21, the IPC was not required to prepare separate financial statements under the Public Finance and Audit Act 1983. From 2020–21, the IPC is required to prepare financial statements under the Government Sector Finance Act 2018.
  • The 2010–11 to 2019–20 audits of the Water Administration Ministerial Corporation’s (the Corporation) financial statements were incomplete due to insufficient records and evidence to support the transactions of the Corporation, particularly for the earlier years. These audits are currently underway, and the 2020–21 audit will commence shortly.
  • The Department of Planning, Industry and Environment's (the department) preliminary assessment indicates that 60 State controlled Crown land managers (CLMs) are required to prepare financial statements in 2020–21. To date, no CLMs have prepared and submitted financial statements for audit in 2020–21. All 120 common trusts have never submitted their financial statements for audit. The department needs to do more to ensure that the CLMs and common trusts meet their statutory reporting obligations.
  • Nine agencies that were required to perform early close procedures did not complete a total of 20 mandatory procedures. The most common incomplete early close procedures include the revaluation of property, plant and equipment, documenting all significant management judgments and assumptions, and the implementation of new and updated accounting standards.

Appropriate financial controls help ensure the efficient and effective use of resources and administration of agency policies. They are essential for quality and timely decision-making.

This chapter outlines our observations and insights from our financial statements audits of agencies in the Planning, Industry and Environment cluster.

Section highlights

  • The number of findings reported to management has increased from 135 in 2019–20 to 180 in 2020–21, and 40 per cent were repeat issues.
  • Seven high-risk issues were identified in 2020–21, and three high-risk findings were repeat issues.
  • There continues to be significant deficiencies in Crown land records. The department should prioritise action to ensure the Crown land database is complete and accurate.

Appendix one - Misstatements in financial statements submitted for audit

Appendix two – Early close procedures

Appendix three – Timeliness of financial reporting

Appendix four – Financial data

 

Copyright notice

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Published

Actions for Stronger Communities 2021

Stronger Communities 2021

Justice
Community Services
Financial reporting
Internal controls and governance

This report analyses the results of our audits of the Stronger Communities cluster agencies for the year ended 30 June 2021.

Our preferred approach is to table the ‘Report on State Finances’ in Parliament before any other cluster report. This is because the 'Report on State Finances' focuses on the audit results and observations relating to the Total State Sector Accounts, in effect a consolidation of all government agencies. This year the 'Report on State Finances' has been delayed due to significant accounting issues being considered in the Total State Sector Accounts and which may impact the Treasury and Transport clusters.

As there are no outstanding matters relating to audits in the Stronger Communities cluster impacting the Total State Sector Accounts we have decided to break with normal practice and table this cluster report ahead of the ‘Report on State Finances’.

What the report is about

The results of the Stronger Communities cluster agencies' financial statement audits for the year ended 30 June 2021.

What we found

Unqualified audit opinions were issued for all 30 June 2021 financial statements of cluster agencies.

Eleven of the 15 cluster agencies required to submit 2020–21 early close financial statements and other mandatory procedures did not meet the statutory deadline. Five agencies did not perform all mandatory procedures.

The implementation of AASB 1059 'Service Concession Arrangements: Grantors' had a significant impact on the Department of Communities and Justice's (the department) 2020–21 financial statements. The department applied a modified retrospective approach upon initial adoption at 1 July 2020 and recognised service concession assets and liabilities of $1.0 billion and $1.2 billion respectively (relating to three correctional centres with private sector operators).

The department was, this year for the first time, able to reliably measure Incurred But Not Reported (IBNR) claims relating to its Victims Support Scheme. The department recorded a liability of $200 million at 30 June 2021. Liabilities for Child Sexual Assault IBNR claim continue to be not recorded on the basis they are unable to be reliably measured.

The number of monetary misstatements identified during the audit of the financial statements for the cluster increased from 61 in 2019–20 to 72 in 2020–21.

What the key issues were

The number of issues reported to management decreased from 191 in 2019–20 to 172 in 2020–21. However, 45 per cent were repeat issues related to information technology, governance and oversight controls.

Seven high risk issues were identified in 2020–21, an increase of five compared to last year. High risk issues related to deficiencies in IT access controls at Sydney Cricket and Sports Ground Trust; a lack of a formal agreement between the Office of Sport and Planning Ministerial Corporation over the management of a sporting venue; asset revaluations at both Fire and Rescue NSW and the Trustees of the Anzac Memorial Building; and three issues related to revenue recognition control deficiencies at New South Wales Aboriginal Land Council and two of its subsidiaries.

What we recommended

Cluster agencies should ensure all applicable mandatory early close procedures are completed and the outcomes provided to the audit team in accordance with the deadlines set by NSW Treasury.

We recommend cluster agencies action recommendations to address internal control weaknesses promptly. Focus should be given to addressing high risk and repeat issues.

Fast facts

The Stronger Communities cluster, consisting of 28 agencies, aims to deliver community services that support a safe and just New South Wales.

  • $14.0b property, plant and equipment as at 30 June 2021 
  • $20.9b total expenditure incurred in 2020–21
  • 100% unqualified audit opinions were issued for all 30 June 2021 financial statements
  • 7 high risk management letter findings were identified
  • 72 monetary misstatements were reported in 2020–21
  • 45% of reported issues were repeat issues.

This report provides Parliament and other users of the Stronger Communities cluster’s financial statements with the results of our audits, our observations, analysis, conclusions and recommendations in the following areas:

  • financial reporting
  • audit observations.

Financial reporting is an important element of good governance. Confidence and transparency in public sector decision making are enhanced when financial reporting is accurate and timely.

This chapter outlines our audit observations related to the financial reporting of agencies in the Stronger Communities cluster (the cluster) for 2021.

Section highlights

  • Unqualified audit opinions were issued for all 30 June 2021 financial statements of cluster agencies including the acquittal and compliance audits for the Legal Aid Commission of New South Wales and Crown Solicitor's Office.
  • An 'Other Matter' paragraph was included within the Multicultural NSW and Office of the Ageing and Disability Commissioner’s Independent Auditor's Report. While the paragraph did not modify the audit opinion, it noted the agencies did not have a signed instrument of delegation from their responsible Minister(s) to incur expenditure for the 2020–21 financial year and therefore were non‑compliant with section 5.5 of the Government Sector Finance Act 2018 .
  • 11 of the 15 cluster agencies required to submit 2020–21 early close financial statements and all other mandatory procedures did not meet the statutory deadlines. The agencies cited changes in key staff, delays in finalising actuarial and valuation work and the timing of Audit and Risk Committee meetings as the main reasons for not meeting the deadlines. Five agencies did not complete all mandatory procedures.
  • The Department of Communities and Justice (the department) was, for the first time, able to reliably measure and record a liability of $200 million at 30 June 2021 for Incurred But Not Reported (IBNR) claims relating to its Victims Support Scheme. Child Sexual Assault IBNR claim liabilities continue to be not recorded on the basis they are still unable to be reliably measured.
  • The International Financial Reporting Standards Interpretations Committee released an agenda decision on 'Configuration or customisation costs in a cloud computing arrangement' (the IFRIC agenda decision). The department treated the financial impacts of the IFRIC agenda decision as a change in accounting policy and retrospectively recorded prepaid assets and expenses of $52.3 million and $90.5 million respectively relating to intangible assets they had previously capitalised.
  • The implementation of AASB 1059 'Service Concession Arrangements: Grantors' had a significant impact on the department's 2020–21 financial statements. The department applied a modified retrospective approach upon initial adoption at 1 July 2020 and recognised service concession assets and liabilities of $1.0 billion and $1.2 billion respectively in relation to three correctional centres with private sector operators.

Appropriate financial controls help ensure the efficient and effective use of resources and administration of agency policies. They are essential for quality and timely decision making.

This chapter outlines our observations and insights from our financial statement audits of agencies in the Stronger Communities cluster.

Section highlights

  • The number of issues reported to management has decreased from 191 in 2019–20 to 172 in 2020–21, and 45 per cent were repeat issues. Many repeat issues related to information technology, governance and oversight controls.
  • Seven high risk issues were identified in 2020–21, an increase of five compared to last year.
  • The two high risk issues identified in 2019–20 relating to New South Wales Institute of Sport were resolved.

Findings reported to management

The overall number of findings has decreased, but the level of repeat issues increased

Breakdowns and weaknesses in internal controls increase the risk of fraud and error. Deficiencies in internal controls, matters of governance interest and unresolved issues were reported to management and those charged with governance of agencies. The Audit Office does this through management letters, which include observations, related implications, recommendations and risk ratings.

In 2020–21, there were 172 findings raised across the cluster (191 in 2019–20). 45 per cent of all issues were repeat issues (32 per cent in 2019–20).

Repeat issues largely related to weaknesses in controls over information technology (IT), governance and oversight.

A delay in implementing audit recommendations increases the risk of intentional and accidental errors in processing information, producing management reports and generating financial statements. This can impair decision‑making, affect service delivery and expose agencies to fraud, financial loss and reputational damage. Poor controls may also mean agency staff are less likely to follow internal policies, inadvertently causing the agency not to comply with legislation, regulation and central agency policies.

2020–21 audits identified seven high risk findings

High risk findings were reported at the following cluster agencies. Two high risk findings reported in 2019–20 were resolved.

Agency Description
2020–21 findings
Sydney Cricket and Sports Ground Trust (new finding) * The audit of Sydney Cricket and Sports Ground Trust's IT access controls identified:
  • activity (audit) logs of privileged access within iPOS (purchasing system) and Microsoft Dynamics (sales system) are not maintained and periodically reviewed by an independent officer
  • the review of privileged activity logs of booking system Event Business Management Software (EBMS) is not formally documented
  • 8 generic super user accounts are being shared across four IT systems including iPOS, Microsoft Dynamics, EBMS and SUN (accounting system).
The matter has been included as a high risk finding in the management letter as there is an increased risk of:
  • unauthorised transactions and changes to financial data
  • unauthorised users gaining access to financial systems
  • data breaches or financial loss.
Fire and Rescue NSW (new finding) Fire and Rescue NSW (FRNSW) completed a comprehensive revaluation of its fire appliances in 2020–21. The audit of the revaluation found there was inadequate analysis and quality control by management over the valuation process prior to the outcomes being included in the financial statements.
FRNSW had 57 fleet assets that have not been revalued due to problems with data supplied by the valuer. The written down value:
  • did not agree to the valuer's calculations for 28 assets
  • was provided by the valuer for 29 assets, but there were no supporting calculations.
These assets have been left at their previous book values of $3.0 million. The accounting standards require the entire class of assets to be revalued when a revaluation is performed.
The review also found:
  • inconsistent valuation of vehicles of the same make, model, age and specifications
  • errors had been made when the previous valuation was uploaded into the fixed asset register
  • the valuer incorrectly included additional equipment in the replacement cost estimate for vehicles that did not have that equipment.
The matter has been included as a high risk finding as it resulted in monetary misstatements and caused delays to the overall timeframes for the audit.
New South Wales Aboriginal Land Council (NSWALC) (new finding) The audit of NSWALC's revenue identified there was no formal assessment of relevant contracts for the nature, amount and timing of revenue recognition before preparing the financial statements.
This matter has been included as a high risk finding as it contributed to material monetary misstatements and disclosure deficiencies relating to revenue transactions.
NSWALC Employment and Training Limited (new finding) The audit of NSWALC Employment and Training Limited's revenue found:
  • there was no formal assessment of relevant contracts for the nature, amount and timing of revenue recognition before preparing the financial statements
  • the financial statements' preparation did not include updated accounting policies reflecting the requirements of AASB 15 'Revenue from Contracts with Customers' (AASB 15) and AASB 1058 'Income of Not-for-Profit Entities' (AASB 1058).
This matter has been included as a high risk finding as it contributed to material monetary misstatements and disclosure deficiencies relating to revenue transactions.
NSWALC Housing Limited (new finding) The audit of NSWALC Housing Limited's revenue identified it:
  • did not perform formal assessments of relevant contracts for the nature, amount and timing of revenue recognition before preparing the financial statements
  • deferred revenue recognition for funding received from NSWALC  (the parent entity). There are no sufficiently specific performance obligations in the funding letter, hence revenue should be recognised on receipt of the funding
  • recognised rental income from managing properties from the Aboriginal Housing Office (AHO) without considering the agreement, which requires remittance of profit to the AHO
  • the financial statements did not include updated accounting policies according to the requirements of AASB 15 and AASB 1058.
This matter has been included as a high risk finding as it contributed to material monetary misstatements and disclosure deficiencies relating to revenue transactions.
Office of Sport (new finding)

The Olympic Co-ordination Authority Dissolution Act 2002 transferred the assets, rights and liabilities relating to the Sydney International Regatta Centre (SIRC) to the Planning Ministerial Corporation (the Corporation) effective from 1 July 2002. The Corporation recognised the related land assets but did not recognise any of the built assets at the time of transfer. The total value of the land and built assets at 30 June 2021 was
$13.8 million and $11.2 million (written down value) respectively.

The SIRC has been managed by the Office of Sport (the Office) for many years in accordance with a not yet executed management agreement.

It appears there was a clear intention in 2005 that the control of SIRC built assets was to be transferred from the then Department of Planning to the then Department of Tourism, Sport and Recreation (a predecessor of the Office), through the exchange of letters between the relevant Ministers and an Administrative Order (the Order). The Order transferred the SIRC staff from the then Department of Planning to the then Department of Tourism, Sport and Recreation. However, it was silent on whether the relevant built assets were transferred.

Currently, the Office recognises the SIRC built assets in the financial statements whilst the Corporation recognises the land assets as the legal owner of the property.

This matter has been included as a high risk finding as the lack of a formal management agreement casts doubt over the accounting treatment of SIRC property.

The Trustees of the Anzac Memorial Building (new finding)

The audit of the Trustees of the Anzac Memorial Building's property, plant and equipment identified:

  • the fixed assets register for plant and equipment had not previously included sufficient detail about the individual assets to which costs related to reconcile it to the work performed by management's valuation expert
  • the financial statements did not meet the requirement of AASB 108 ‘Accounting Policies, Changes in Accounting Estimates and Errors’  to disclose the nature and reason why it corrected a prior period error of $778,000.

This matter has been included as a high risk finding as it contributed to material monetary misstatements and disclosure deficiencies relating to property, plant and equipment.


*         The finding related to the former Sydney Cricket and Sports Ground Trust (based on the completion audit for the period 1 March 2020 to 30 November 2020). This agency was dissolved and transferred to Venues NSW on 1 December 2020.
 

Recommendation (repeat issue)

We recommend cluster agencies action recommendations to address internal control weaknesses promptly. Focus should be given to addressing high risk and repeat issues.

The table below describes issues commonly identified across the cluster by category and risk rating.

Risk rating Issue
Information technology

High3
1 new

The financial audits identified weaknesses in information technology processes and controls that support the integrity of financial data used to prepare agencies' financial statements. Of particular concern are issues with:

  • user access administration
  • cyber security including governance arrangements, monitoring of third-party system access and patch management
  • password security and policy parameters
  • development, review and testing of disaster recovery plans.

Moderate2
8 new,
22 repeat

Low1
5 new,
6 repeat
Internal control deficiencies or improvements

High3
1 new

The financial audits identified internal control weaknesses across the following key business processes: 

  • expenditure, including the approval of purchase requisitions and review of open purchase orders
  • supplier and employee masterfile maintenance
  • segregation of duties.

Moderate2
6 new,
3 repeat

 Low1
23 new,
7 repeat

Financial reporting

High3
4 new

The financial audits identified weaknesses in financial reporting processes, including:

  • fully depreciated assets still in use, indicating the need to perform more frequent assessments of useful lives of assets
  • robustness of property, plant and equipment asset revaluations
  • incomplete or inaccurate recording of balances in the financial statements.

Moderate2
9 new,
1 repeat

Low1
11 new,
5 repeat

Governance and oversight
High3
1 new

The financial audits identified areas where agencies could strengthen governance and oversight processes, including:

  • review and update of policies and procedures
  • formalising existing key business arrangements
  • records management practices.
Moderate2
5 new,
11 repeat
Low1
12 new,
8 repeat
Non-compliance with key legislation and/or central agency policies
Moderate2
7 new,
6 repeat

The financial audits identified the need for agencies to improve their compliance with key legislation and/or central agency policies, including:

  • management of excessive annual leave balances
  • existence of and compliance with financial delegations
  • related party transactions disclosures from key management personnel.
Low1
2 new,
8 repeat

4 Extreme risk from the consequence and/or likelihood of an event that has had, or may have a negative impact on the entity.
3 High risk from the consequence and/or likelihood of an event that has had, or may have a negative impact on the entity.
2 Moderate risk from the consequence and/or likelihood of an event that has had, or may have a negative impact on the entity.
1 Low risk from the consequence and/or likelihood of an event that has had, or may have a negative impact on the entity.
Note: Management letter findings are based either on final management letters issued to agencies, or draft letters where findings have been agreed with management.

The number of moderate risk findings decreased from prior year

Seventy‑eight moderate risk findings were reported in 2020–21, representing a 22 per cent decrease from 2019–20. Of these, 43 were repeat findings, and 35 were new issues.

Moderate risk findings reported in 2020–21 include:

  • weaknesses in governance arrangements, including outdated policies and procedures and arrangements that do not align with NSW Government guidelines, such as the NSW Government Procurement Policy Framework and NSW Cyber Security Policy
  • weaknesses in user access administration including:
    • user access reviews
    • monitoring of privileged user access and activities
    • password policy configuration
  • cyber security improvements including:
    • implementation and update of governance arrangements
    • monitoring of third‑party system access
    • patch management improvement
  • outdated instruments of financial delegation and non‑compliance with established financial delegations
  • weaknesses in supplier and employee masterfile maintenance.

Appendix one – Misstatements in financial statements submitted for audit

Appendix two – Early close procedures

Appendix three – Timeliness of financial reporting

Appendix four – Financial data

 

Copyright notice

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

 

Published

Actions for Health 2021

Health 2021

Health
Asset valuation
Compliance
Cyber security
Financial reporting
Infrastructure
Internal controls and governance
Procurement

This report analyses the results of our audits of the Health cluster agencies for the year ended 30 June 2021.

Our preferred approach is to table the ‘Report on State Finances’ in Parliament before any other cluster report. This is because the 'Report on State Finances' focuses on the audit results and observations relating to the Total State Sector Accounts, in effect a consolidation of all government agencies. This year the 'Report on State Finances' has been delayed due to significant accounting issues being considered in the Total State Sector Accounts and which may impact the Treasury and Transport clusters.

As there are no outstanding matters relating to audits in the Health cluster impacting the Total State Sector Accounts we have decided to break with normal practice and table this cluster report ahead of the ‘Report on State Finances’.

What the report is about

The results of Health cluster (the cluster) agencies' financial statements audits for the year ended 30 June 2021.

What we found

Unmodified audit opinions were issued for the financial statements of all Health cluster agencies.

The COVID-19 pandemic increased the complexity and number of accounting matters faced by the cluster. The total gross value of corrected misstatements in 2020–21 was $250.2 million, of which $226.0 million were pandemic related.

A qualified audit opinion was issued on the Annual Prudential Compliance Statement. The basis of the qualification related to 19 instances (18 in 2018–19) of non-compliance relating to three of the 20 prudential requirements across five aged care facilities.

What the key issues were

The total number of matters we reported to management across the cluster increased from 112 in 2019–20 to 116 in 2020–21. Of the 116 issues raised in 2020–21, three were high risk (one in 2019–20) and 57 were moderate risk (47 in 2019–20). Nearly one half of the issues were repeat issues.

The three new high-risk issues identified were:

Hotel Quarantine (HQ) fees

The absence of a tailored debt recovery strategy, data integrity issues and uncertainties around future HQ arrangements increased risks around the recoverability of HQ fees from travellers.

COVID-19 inventories

Data errors and anomalies in the impairment model and difficulties forecasting key factors impacting the management of Personal Protective Equipment (PPE) increased uncertainty associated with the valuation and impairment of COVID-19 inventories.

COVID-19 vaccines

The Commonwealth did not provide information about the cost of vaccines provided to NSW free of charge, which required the performance of internal valuations to reflect the consumption of vaccines in the financial statements.

What we recommended

Hotel Quarantine (HQ) fees

Develop a tailored assessment methodology to estimate recoverability of HQ fees and work with Revenue NSW to develop a tailored debt recovery strategy.

COVID-19 inventories

Review the current stocktaking and impairment methodology to incorporate validation of data key to the management of COVID-19 related PPE.

COVID-19 vaccines

Work with the Commonwealth to obtain primary price information on COVID-19 vaccines.

Fast facts

The Health cluster, comprising 15 local health districts, five pillars agencies, two specialty health networks and six shared state-wise services agencies, deliver health services to the people of New South Wales.

  • 100% unqualified audit opinions were issued on agencies' 30 June 2021 financial statements
  • 24 monetary misstatements were reported in 2020–21
  • high risk management letter findings were identified
  • 47.4% of reported issues were repeat issues
  • $23.5b property, plant and equipment as at 30 June 2021
  • $26.8b total expenditure incurred in 2020–21

This report provides Parliament and other users of the Health cluster’s financial statements with the results of our audits, our observations, analysis, conclusions and recommendations in the following areas:

  • financial reporting
  • audit observations.

Financial reporting is an important element of good governance. Confidence and transparency in public sector decision-making are enhanced when financial reporting is accurate and timely. This chapter outlines our audit observations related to the financial reporting of agencies in the Health cluster (the cluster) for 2021.

Section highlights

  • Unqualified audit opinions were issued for all cluster agencies required to prepare general-purpose financial statements.

  • The total gross value of all corrected monetary misstatements for 2020–21 was $250.2 million, of which $226.0 million were related to complexities arising from the COVID-19 pandemic.

  • A qualified audit opinion was issued on the Ministry's Annual Prudential Compliance Statement.

Appropriate financial controls help ensure the efficient and effective use of resources and administration of agency policies. They are essential for quality and timely decision-making. This chapter outlines our observations and insights from our financial statement audits of agencies in the Health cluster.

Section highlights

  • The total number of internal control deficiencies has increased from 112 issues in 2019–20 to 116 in 2020–21. Of the 116 issues raised in 2020–21, three were high (one in 2019–20) and 57 were moderate (47 in 2019–20); with nearly one half of all control deficiencies reported in 2020–21 being repeat issues.
  • The complexities arising from accounting for agreements between governments to respond to the COVID-19 pandemic presented three new high risk audit findings with respect to the:
    • expected rate of recoverability of outstanding Hotel Quarantine fees
    • procurement, stocktaking and impairment of COVID-19 inventories
    • valuation and recognition of COVID-19 vaccines received from the Commonwealth Government.
  • Management of excessive leave balances and poor quality or lack of documentation supporting key agreements were amongst the repeat issues observed again in the 2020–21 financial reporting period.

Findings reported to management

The number of findings reported to management has increased, with 47.4 per cent of all issues being repeat issues

Breakdowns and weaknesses in internal controls increase the risk of fraud and error. Deficiencies in internal controls, matters of governance interest and unresolved issues were reported to management and those charged with governance of cluster agencies. The Audit Office does this through our management letters, which include observations, implications, recommendations and risk ratings.

In 2020–21, there were 116 findings raised across the cluster (112 in 2019–20). 47.4 per cent of all issues were repeat issues (38.4 per cent in 2019–20).

A delay in implementing audit recommendations increases the risk of intentional and accidental errors in processing information, producing management reports and generating financial statements. This can impair decision-making, affect service delivery and expose agencies to fraud, financial loss and reputational damage. Poor controls may also mean agency staff are less likely to follow internal policies, inadvertently causing the agency not to comply with legislation, regulation and central agency policies.

The table below describes the common issues identified across the cluster by category and risk rating.

Risk rating Issue
Information technology

Moderate2
7 new,
3 repeat

We identified the need for agencies to improve information technology processes and controls that support the integrity of financial data used to prepare agencies' financial statements. Of particular concern are issues associated with:

  • lack of reviews of user access and privileged user access for
  • HealthRoster
  • Assets and Facilities Management Online
  • vMoney Powerhouse
  • Patient Billing and Revenue Collection system.

Repeat issues included:

  • deficient password controls
  • no independent review for data integrity of any changes made to HealthRoster
  • incomplete reviews of StaffLink User Access.

Low1
4 new,
5 repeat

Internal control deficiencies or improvements

High3

1 new, 

0 repeat

We identified internal control weaknesses across key business processes, including new issues relating to:

  • procurement, stocktaking and impairment of COVID-19 inventories (personal protective equipment)
  • instances where employees' timesheets were approved in advance
  •  monthly reconciliations not reviewed in a timely manner
  • asset revaluation processes at Illawarra Shoalhaven Local Health District.
     

Repeat issues included:

  • forced finalisation of rosters in order to finalise processing of payroll
  • partial repeat issue relating to HealthShare NSW's stocktake process, refer to details in the following section of this report.

Moderate2
6 new,
12 repeat

 Low1
10 new,
4 repeat

Financial reporting

High3

2 new, 
0 repeat

We identified weaknesses with respect to financial reporting in relation to the:

  • expected rate of recoverability of outstanding Hotel Quarantine fees
  • valuation and recognition of COVID-19 vaccines received from the Commonwealth Government
  • application of AASB 16 'Leases'
  • improvement in health agencies' grant register to better support management's accounting treatment under the applicable revenue accounting standards.

Moderate2
6 new,
1 repeat

Low1
8 new,
3 repeat

Governance and oversight
Moderate2
9 new,
5 repeat

We identified opportunities for agencies to improve governance and oversight processes, including:

  • ensure better documentation around governance arrangements for major health capital works delivered by Health Infrastructure
  • absence of documented practices at health agencies level relating to Visiting Medical Officer claims.
     

Repeat issues include:

  • delegations manual for Health Infrastructure remains in draft and has done so since 2017.
Low1
2 new,
2 repeat
Non-compliance with key legislation and/or central agency policies
Moderate2
1 new,
7 repeat

We identified the need for agencies to improve compliance with key legislation and central agency policies, with new findings including:

  • bank signatories list not updated to remove terminated employees
  • subsequent changes made to Junior Medical Officers' approved rosters not approved by an authorised delegate.
     

Repeat issues include:

  • management of excessive annual leave
  • non-compliance with the Government Information (Public Access) Act 2009 (GIPA Act) by Ambulance NSW.
Low1
5 new,
13 repeat

4Extreme risk from the consequence and/or likelihood of an event that has had, or may have a negative impact on the entity.
3 High risk from the consequence and/or likelihood of an event that has had, or may have a negative impact on the entity.
2 Moderate risk from the consequence and/or likelihood of an event that has had, or may have a negative impact on the entity.
1 Low risk from the consequence and/or likelihood of an event that has had, or may have a negative impact on the entity.

Note: Management letter findings are based either on final management letters issued to agencies, or draft letters where findings have been agreed with management.

Complexities arising from the COVID-19 response

The 2020–21 audit identified three new high-risk findings

COVID-19 has presented the cluster with several new accounting challenges. New and evolving matters arose from changes to operating conditions, which characterised the 2020–21 financial reporting period. Issues with a high degree of estimation uncertainty will require ongoing attention as the strategies employed to deal with the COVID-19 pandemic evolve.

Expected rate of recovery of outstanding Hotel Quarantine invoices

The estimation of the amount likely to be recovered is complicated not only by the uncertainties that exist regarding the assumptions those estimations rely upon, but also the debt collection processes and strategies put into place to manage the accumulated debtors' balance. Debt collection is not administered by the cluster, but rather Revenue NSW. We observed an absence of a methodology to assess the likelihood of recovery. Instead, Sydney Local Health District was relying on Revenue NSW to develop and execute on a collection strategy. Sydney Local Health District was using the same approach to hotel quarantine debts as it did to other Health receivables. As the approach to managing international borders evolves over time, so too will the cluster's need to develop robust estimation models to assess the likely collectability of debtors. 

Procurement, management and impairment of COVID-19 inventories

$656.2 million of COVID-19 inventories were procured in 2020–21, with $220.2 million consumed; $558.7 million impaired and a further $217.1 million written off. Estimates of the degree to which inventories are expired, not fit for purpose or are faulty is often based on management judgement at all stages in the procurement cycle.

With respect to the stocktaking methodology applied, the following issues were identified:

  • discrepancies noted in the stock bin listing provided for audit
  • discrepancies in the recount sheet generated
  • inconsistent application of the stocktake methodology
  • inconsistent labelling of quarantined stock
  • a lack of an approach for validating stock expiry dates, which is a key input to the impairment calculations.

Although management had developed processes and a methodology to count as well as to assess the level of inventory that was not fit for purpose, ongoing attention to the operating environment that emerges post pandemic will be important in assessing the degree to which existing COVID-19 inventories can be integrated into a ‘business as usual’ model going forward. Further refinement of the key elements of the stocktaking methodology will also be required to ensure that key inputs upon which management relies to calculate the year-end inventory impairment provision can be appropriately validated.

Valuation and recognition of COVID-19 vaccines received from the Commonwealth Government

The 2020–21 financial reporting period saw the Commonwealth acquire COVID-19 vaccines and provide these to state jurisdictions to dispense to their communities. The vaccines, although provided free of charge require recognition. However, Health entities were not responsible for acquiring the vaccines and data on the vaccines' cost was not shared by the Commonwealth. Management undertook a valuation using publicly available data to estimate the value to attribute to the vaccine inventory; developed new systems and leveraged existing pharmacy systems to track physical quantities received from the Commonwealth and ultimately distributed to NSW citizens. As the response to the pandemic evolves, larger quantities, and new lines of vaccine stock will be dealt with, and policy settings will need to adapt when patterns of distribution of those vaccines (e.g., timing of third booster shots) emerge. The Ministry of Health will need to ensure that the valuations applied to the prices of inventory distributed and held in stock are as accurate as possible. This can be done through further refinement of the existing valuation methodology, obtaining price information from the Commonwealth and engaging specialist pharmaceutical valuers.

Emerging trends

Recognition of provisions without sufficient support

Several NSW Health entities raised accruals and provisions in 2020–21, which did not have an appropriate basis for recognition. Liabilities can only be recognised where there is a present obligation to make a payment arising from a past event. A number of these errors remain uncorrected in the financial statements of those entities as they are not material, individually or in aggregate to the financial statements as a whole. Increased training and guidance are required to ensure that treatment within the cluster is consistent and reflects events that have occurred and give rise to obligations.

Treatment of Commonwealth funding

In the 2020–21 and 2019–20 financial reporting periods, we observed prior period errors arising from the treatment of Commonwealth funding. These errors related to recognising revenue under funding agreements entered into with the Commonwealth in the incorrect period. The conditions of these funding arrangements, the transactional information requiring validation and the circumstances when revenue should be recognised are not always clear and can be complex. Early and continuous engagement with the Commonwealth is required to ensure that revenue recognition principles are consistently applied across the cluster.

Key repeat issues

Management of excessive annual leave

NSW Treasury guidelines stipulate annual leave balances exceeding 30 days are considered excess annual leave balances. Managing excess annual leave balances has been reported as an issue for the cluster for more than five years, with the average percentage of employees with excessive leave balances over the last five years being 36.1 per cent (35.5 per cent over five years covering 2015–16 to 2019–20).

The operational demands required to manage the COVID-19 pandemic have presented new challenges for the cluster in trying to manage its excessive leave balances. 39.2 per cent of employees now have excess leave balances at 30 June 2021 (35.4 per cent at 30 June 2020).

The state's leave policy C2020-12 Managing Accrued Recreation Leave Balances requires agencies to manage excessive leave balances to 30 days or less to maintain their workforces physical and mental health.

Accurate time recording

Forced-finalisation of time records by system administrators within HealthRoster remains an issue and we continue to observe time records forced-finalised by system administrators so pay runs can be finalised on a timely basis. During 2020–21, a total of two million (2.2 million in 2019–20) time records were force approved, which represents 5.7 per cent of total time records (6.9 per cent in 2019–20).

Existence, completeness and accuracy of key agreements

Delivery of major capital projects

Health Infrastructure (a division of the Health Administration Corporation) is responsible for the delivery of major capital projects with a budgeted spend of more than $10.0 million. Health Infrastructure oversee the planning, design, procurement, and construction phases. Capital works in progress are recognised in the financial statements of the health entity that intends to use those assets upon completion. The health entities recognise both the capital work in progress and the revenue associated with the capital funding from the Ministry for the construction of the assets. Capital funding is currently agreed with health entities as part of the annual Service Agreement. The assumption that the health entities control the assets during their construction is consistent with Health Infrastructure's role as an agent for the health entity and the Ministry's policy directive PD2020-033 'Management and control of Health Administration Corporation owned Real Property'.

We continued to observe a lack of clarity regarding agreements between Health Infrastructure, the Ministry and the cluster agency that will eventually receive the completed asset. This can lead to confusion and uncertainty around the rights and obligations of each party to the transaction.

Cross border patient funding arrangements

When patients require medical care in a jurisdiction where they are not generally domiciled, there are arrangements in place to provide funding to support cross border patient treatments. We have previously observed that agreements between NSW and other jurisdictions have not been finalised, and this continues to be the case. In the case of Victoria, no agreement has been finalised for the past seven years.

We continue to note that the cluster has long outstanding receivables and payables with other states. The absence of formal agreements between the states hampers the settlement of the debts relating to the treatment of cross border patients. The following table shows the status of Cross Border Agreements between NSW and other jurisdictions:

States 2014–15 2015–16 2016–17 2017–18 2018–19 2019–20 2020–21
Queensland Signed Signed Signed Signed Signed Not finalised Not finalised
Victoria Not finalised Not finalised Not finalised Not finalised Not finalised Not finalised Not finalised
Australian Capital Territory Signed Signed Signed Signed Signed Signed Not finalised
South Australia Signed Signed Signed Signed Signed Signed Not finalised
Tasmania Signed Signed Signed Signed Signed Signed Not finalised
Northern Territory Signed Signed Signed Signed Signed Signed Not finalised
Western Australia Signed Signed Signed Signed Signed Signed Not finalised

Albury Base Hospital

Albury Base hospital is located on the border of NSW and Victoria and services residents of both states. Documentation supporting the extension of the expired Intergovernmental Agreement 2009–2017 between NSW and Victoria in relation to the integration of health services in Wodonga and Albury could not be located.

Appendix one – Misstatements in financial statements submitted for audit

Appendix two – Early close procedures

Appendix three – Timeliness of financial reporting

Appendix four – Financial data

 

 

Copyright notice

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Published

Actions for Regional NSW 2021

Regional NSW 2021

Environment
Industry
Asset valuation
Compliance
Financial reporting
Infrastructure
Internal controls and governance
Management and administration
Service delivery

This report analyses the results of our audits of the Regional NSW cluster agencies for the year ended 30 June 2021.

Our preferred approach is to table the ‘Report on State Finances’ in Parliament before any other cluster report. This is because the 'Report on State Finances' focuses on the audit results and observations relating to the Total State Sector Accounts, in effect a consolidation of all government agencies. This year the 'Report on State Finances' has been delayed due to significant accounting issues being considered in the Total State Sector Accounts and which may impact the Treasury and Transport clusters.

As there are no outstanding matters relating to audits in the Regional NSW cluster impacting the Total State Sector Accounts we have decided to break with normal practice and table this cluster report ahead of the ‘Report on State Finances’.

What the report is about

The results of the Regional NSW cluster (the cluster) agencies’ financial statement audits for the year ended 30 June 2021.

What we found

Unmodified audit opinions were issued for all completed 30 June 2021 financial statement audits of cluster agencies. Four audits are ongoing.

The number of misstatements identified in the financial statements of cluster agencies decreased from 27 in 2019–20 to seven in 2020–21.

The Department corrected an understatement of $82.2 million in prepaid income related to the Bushfire Clean-up Program.

What the key issues were

Local Land Services (LLS) undertook a comprehensive revaluation of asset improvements on land reserves used for moving stock (travelling stock reserves).

The revaluation process identified that improvements on land reserves, with a value of $93.0 million, had not been previously recognised in the financial statements. LLS corrected this error by restating the 2019–20 comparative balances in its 2020–21 financial statements.

The Forestry Corporation of NSW revalued its biological assets that comprise approximately 225,000 hectares of softwood plantations and 34,000 hectares of hardwood forests. The current year valuation resulted in $71.4 million decrement in the total biological assets from $824.9 million in 2019–20 to $753.5 million in 2020–21.

The number of matters reported to management decreased from 36 in 2019–20 to 19 in 2020–21. Twelve moderate risk issues were identified and 47 per cent of reported issues were repeat issues.

What we recommended

Cluster agencies should prioritise and action recommendations to address internal control deficiencies.

 

Fast facts

The Regional NSW cluster plans and delivers regional programs and infrastructure to respond to regional issues, creating and preserving regional jobs, driving regional economy, growing existing and supporting emerging industries. There are 31 agencies in the cluster.

  • $2.3b of regional land and buildings as at 30 June 2021.

  • 100% unqualified audit opinions were issued for all completed 30 June 2021 financial statements audits.

  • monetary misstatements were reported in 2020–21.

  • $603m of grants and subsidies administered to the regional community in 2020–21.

  • 12 moderate risk management letter findings were identified and reported to management.

  • 47% of reported issues were repeat issues. 

This report provides Parliament and other users of the Regional NSW cluster agencies’ financial statements with the results of our audits, our observations, analysis, conclusions and recommendations in the following areas:

  • financial reporting
  • audit observations.

Financial reporting is an important element of good governance. Confidence and transparency in public sector decision making are enhanced when financial reporting is accurate and timely.

This chapter outlines our audit observations related to the financial reporting of agencies in the Regional NSW cluster for 2021.

Section highlights

  • Unqualified audit opinions were issued for all completed 30 June 2021 financial statements audits of cluster agencies. Four audits are ongoing.
  • The number of monetary misstatements identified during the audit decreased from 27 in 2019–20 to seven in 2020–21.
  • Three cluster agencies could improve their early close process by completing all required procedures.
  • Local Land Services disclosed a prior period error relating to the completeness of asset improvements on travelling stock reserves.

 

Appropriate financial controls help ensure the efficient and effective use of resources and administration of agency policies. They are essential for quality and timely decision making.

This chapter outlines our observations and insights from our financial statement audits of agencies in the Regional NSW cluster.

Section highlights

  • The number of findings reported to management decreased from 36 in 2019–20 to 19 in 2020–21, and 47 per cent were repeat findings.
  • The 2020–21 audits identified 12 moderate risk and seven low risk issues across the cluster.
  • Four moderate risk issues and five low risk issues were repeat findings from
    2019–20.

 

Appendix one - Misstatements in financial statements submitted for audit

Appendix two - Early close procedures

Appendix three - Financial data

 

Copyright notice

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Published

Actions for Managing cyber risks

Managing cyber risks

Whole of Government
Transport
Cyber security
Information technology
Internal controls and governance
Procurement
Risk

What the report is about

This audit assessed how effectively Transport for NSW (TfNSW) and Sydney Trains identify and manage their cyber security risks.

The NSW Cyber Security Policy (CSP) sets out 25 mandatory requirements for agencies, including implementing the Australian Cyber Security Centre’s Essential 8 strategies to mitigate cyber security incidents, and identifying the agency’s most vital systems, their ‘crown jewels’. 

The audited agencies have requested that we do not disclose detail of the significant vulnerabilities detected during the audit, as these vulnerabilities are not yet remediated. We provided a detailed report to the agencies in December 2020 outlining significant issues identified in the audit. We have conceded to the agencies' request but it is disappointing that transparency to the Parliament and the public on issues that potentially directly affect them needs to be limited in this way.

What we found

TfNSW and Sydney Trains are not effectively managing their cyber security risks.

Both agencies have assessed their cyber security risks as unacceptably high and both agencies had not identified all of the risks we detected during this audit – some of which are significant.

Both agencies have cyber security plans in place that aim to address cyber security risks. TfNSW and Sydney Trains have combined this into the Transport Cyber Defence Rolling Program, part of the Cyber Defence Portfolio (CDP). 

However, neither agency has reached its target ratings for the CSP and the Essential 8 and maturity is low in relation to significant risks and vulnerabilities exposed.

Further, neither agency is fostering a culture where cyber security risk management is an important and valued aspect of decision-making.

TfNSW is not implementing cyber security training effectively across the cluster with only 7.2% of staff having completed basic cyber security training.

What we recommended

TfNSW and Sydney Trains should:

  • develop and implement a plan to uplift the Essential 8 controls to the agency's target state
  • as a matter of priority, address the vulnerabilities identified as part of this audit and previously described in a detailed Audit Office report provided to both agencies
  • ensure cyber security risk reporting to executives and the Audit and Risk Committee
  • collect supporting information for the CSP self assessments 
  • classify all information and systems according to importance and integrate this with the crown jewels identification process
  • require more rigorous analysis to re-prioritise CDP funding 
  • increase uptake of cyber security training.

TfNSW should assess the appropriateness of its target rating for each of the CSP mandatory requirements.

Department of Customer Service should:

  • clarify the requirement for the CSP reporting to apply to all systems
  • require agencies to report the target level of maturity for each mandatory requirement.

Fast facts

  • $42m Total value of the Transport Cyber Defence Rolling Program over three years.
  • 7.2% Percentage of staff across the Transport cluster who had completed introductory cyber security training

Response to requests by audited agencies to remove information from this report

In preparing this audit report, I have considered how best to balance the need to support public accountability and transparency with the need to avoid revealing information that could pose additional risk to agencies’ systems. This has involved an assessment of the appropriate level of detail to include in the report about the cyber security vulnerabilities identified in this audit.

In making this assessment, the audit team consulted with Transport for NSW (TfNSW), Sydney Trains, and Cyber Security NSW to identify content which could potentially pose a threat to the agencies’ cyber security.

In December 2020, my office also provided TfNSW and Sydney Trains with a detailed report of many of the significant vulnerabilities identified in this audit, to enable the agencies to address the cyber security risks identified. The detailed report was produced as a result of a 'red team' exercise, which was conducted with both agencies' knowledge and consent. The scope of this exercise reflected the significant input provided by both agencies. More information on this exercise is at page 12 of this report.

TfNSW and Sydney Trains have advised that in the six months from December 2020 and at the time of tabling this audit report, they have not yet remediated all the vulnerabilities identified. As a result, they, along with Cyber Security NSW, have requested that we not disclose all information contained in this audit report to reduce the likelihood of an attack on their systems and resulting harm to the community. I have conceded to this request because the vulnerabilities identified have not yet been remediated and leave the agencies exposed to significant risk.

It should be stressed that the risks identified in the detailed report exist due to the continued presence of these previously identified vulnerabilities, rather than due to their potential publication. The audited agencies, alone, are accountable for remediating these vulnerabilities and addressing the risks they pose.

It is disappointing that transparency to the Parliament and the public on issues that potentially directly affect them needs to be limited in this way.

That said, the conclusions drawn in this report are significant in terms of risk and remain valid, and the recommendations should be acted upon with urgency.

Cyber security risk is an increasing area of concern for governments in Australia and around the world. In recent years, there have been a number of high-profile cyber security attacks on government entities in Australia, including in New South Wales. Malicious cyber activity in Australia is increasing in frequency, scale, and sophistication. The Audit Office of New South Wales is responding to these risks with a program of audits in this area, which aim to identify the effectiveness of particular agencies in managing cyber risks, as well as their compliance with relevant policy.

Cyber Security NSW, part of the Department of Customer Service (DCS) releases and manages the NSW Cyber Security Policy (CSP). The CSP sets out 25 mandatory requirements for agencies, including making it mandatory for agencies to implement the Australian Cyber Security Centre Essential 8 Strategies to Mitigate Cyber Security Incidents (the Essential 8). The Essential 8 are key controls which serve as a baseline set of protections which agencies can put in place to make it more difficult for adversaries to compromise a system. Agencies are required to self-assess their maturity against the CSP and the Essential 8, and report that assessment to Cyber Security NSW annually.

The CSP makes agencies responsible for identifying and managing their cyber security risks. The CSP sets out responsibilities and governance regarding risk identification, including making agencies responsible for identifying their 'crown jewels', the agency's most valuable and operationally vital systems. Once these risks are identified, agencies are responsible for developing a cyber security plan to mitigate those risks.

This audit focussed on two agencies: Transport for NSW (TfNSW) and Sydney Trains. TfNSW is the lead agency for the Transport cluster and provides a number of IT services to the entire cluster, including Sydney Trains. This audit focussed on the activities of TfNSW's Transport IT function, which is responsible for providing cyber security across the cluster, as well as directly overseeing four of TfNSW's crown jewels. Sydney Trains is one of the agencies in the Transport cluster. While it receives some services from TfNSW, it is also responsible for implementing its own IT controls, as well as controls to protect its Operational Technology (OT) environment. This OT environment includes systems which are necessary for the operation and safety of the train network.

To test the mitigations in place and the effectiveness of controls, this audit involved a 'red team' simulated exercise. A red team involves authorised attackers seeking to achieve certain objectives within the target's environment. The red team simulated a determined external cyber threat actor seeking to gain access to TfNSW's systems. The red team also sought to test the physical security of some Sydney Trains' sites relevant to the agency's cyber security. The red team exercise was conducted with the knowledge of TfNSW and Sydney Trains.

This audit included the Department of Customer Service as an auditee, as they have ownership of the CSP through Cyber Security NSW. This audit did not examine the management of cyber risk in the Department of Customer Service.

This audit assessed how effectively selected agencies identify and manage their cyber security risks. The audit assessed this with the following criteria:

  • Are agencies effectively identifying and planning for their cyber security risks?
  • Are agencies effectively managing their cyber security risks?

Following this in-depth portfolio assessment, the Auditor-General for NSW will also table a report on NSW agencies' compliance with the CSP in the first quarter of 2021–22.

Conclusion

Transport for NSW and Sydney Trains are not effectively managing their cyber security risks. Significant weaknesses exist in their cyber security controls, and both agencies have assessed that their cyber risks are unacceptably high. Neither agency has reached its Essential 8 or Cyber Security Policy target levels. This low Essential 8 maturity exposes both agencies to significant risk. Both agencies are implementing cyber security plans to address identified cyber security risks.
This audit identified other weaknesses, such as low numbers of staff receiving basic cyber security awareness training. Cyber security training is important for building and supporting a cyber security culture. Not all of the weaknesses identified in this audit had previously been identified by the agencies, indicating that their cyber security risk identification is only partially effective.
Agency executives do not receive regular detailed information about cyber risks and how they are being managed, such as information on mitigations in place and the effectiveness of controls for cyber risk. As a result, neither agency is fostering a culture where cyber security risk management is an important and valued aspect of executive decision-making.
TfNSW and Sydney Trains are partially effective at identifying their cyber security risks and both agencies have cyber security plans in place

Both agencies regularly carry out risk assessments and have identified key cyber security risks, including risks that impact on the agencies' crown jewels. These risks have been incorporated into the overall enterprise risk process. However, neither agency regularly reports detailed cyber risk information to agency executives to adequately inform them about cyber risk. The Cyber Security Policy (CSP) requires agencies to foster a culture where cyber security risk management is an important and valued aspect of decision-making. By not informing agency executives in this way, TfNSW and Sydney Trains are not fulfilling this requirement.

Agencies' cyber security risk assessment processes are not sufficiently comprehensive to identify all potential risks. Not all of the weaknesses identified in this audit had previously been identified by the agencies.

To address identified cyber security risks, both agencies have received funding approval to implement cyber security plans. TfNSW first received approval for its cyber security plan in 2017. Sydney Trains received approval for its cyber security plan in February 2020. In 2020–21 TfNSW and Sydney Trains combined their plans into the Transport Cyber Defence Rolling Program business case valued at $42.0 million over three years. This is governed as part of a broader Cyber Defence Portfolio (CDP). The CDP largely takes a risk-based approach to annual funding. The Cyber Defence Portfolio Steering Committee and Board can re-allocate funds from an approved project to a different project. This re-allocation process could be improved by making it more risk-based.

TfNSW and Sydney Trains are not effectively managing their cyber security risks

Neither agency has fully mitigated its cyber security risks. These risks are significant. Neither TfNSW nor Sydney Trains have reduced their cyber risk to levels acceptable to the agencies. Both agencies have set a risk tolerance for cyber security risks, and the identified enterprise-level cyber security risks remain above this rating. Both agencies' self-attested maturity against the Essential 8 remains low in comparison to the agencies' target levels, and in relation to the significant risks and vulnerabilities that are exposed. Little progress was made against the Essential 8 in 2020.

Neither agency has reached its target levels of maturity for the CSP mandatory requirements. Not reaching the target rating of the CSP mandatory requirements risks information and systems being managed inconsistently or not in alignment with good governance principles. The Transport Cyber Defence Rolling Program has a KPI to achieve a target rating of three for all CSP requirements where business appropriate. TfNSW considers this target rating to be its target for all the CSP requirements. However TfNSW has not undertaken analysis to determine whether this target is appropriate to its business.

The CSP makes agencies accountable for the cyber risks of their ICT service providers. While both agencies usually included their cyber security expectations in contracts with third-party suppliers, neither agency was routinely conducting audits to ensure that these expectations were being met.

The CSP requires agencies to make staff aware of cyber security risks and deliver cyber security training. TfNSW is responsible for delivering cyber security training across the Transport cluster, including in Sydney Trains. TfNSW was not effectively delivering cyber security training across the cluster because training was not mandatory for all staff at the time of the audit and completion rates among those staff assigned the training was low. As such, only 7.2 per cent of staff across the Transport cluster had completed introductory cyber security training as at January 2021.

Agencies have assessed their cyber risks as being above acceptable levels

An agency's risk tolerance is the amount of risk which the agency will accept or tolerate without developing further strategies to modify the level of risk. Risks that are within an agency's risk tolerance may not require further mitigation and may be deemed acceptable, while risks which are above the agency's risk tolerance likely require further mitigation before they become acceptable to the agency.

Both agencies have defined their risk tolerance and have identified risks which are above this level, indicating that they are unacceptable to the agency. TfNSW has defined 'very high' risks as generally intolerable and 'high' risks as undesirable. Its risk tolerance is 'medium'. Sydney Trains has four classifications of risk: A, B, C and D. A and B risks are deemed 'unacceptable' and 'undesirable' respectively, while C risks are considered 'tolerable'. This aligns with the TfNSW definition of a medium risk tolerance.

Transport IT reported five enterprise-level cyber security risks through its enterprise risk reporting tool in September 2020, all of which relate to cyber security or have causes relating to cyber security. These risks are in aggregate form, rather than relating to specific vulnerabilities. At the time of the audit, one of these risks was rated as very high and the other four rated as high. At this time, Transport IT had identified a further seven divisional-level risks which were above the agency’s risk tolerance.

Similarly, Sydney Trains has identified one main cyber security risk in its IT enterprise-level risk register and another with a potential cyber cause. Both of these IT risks are deemed to have a residual risk of ‘unacceptable’.

Similarly, two cyber-related OT risks have been determined to be above the agency's risk tolerance. One risk is rated as 'unacceptable'. Another risk, while not entirely cyber rated, is rated 'undesirable' and is deemed to have some causes which may stem from a cyber-attack.

Agencies have assessed their current cyber risk mitigations as requiring improvement

In addition to the risk ratings stated above, at the time of the audit neither agency believed that its controls were operating effectively. Transport IT had rated the control environments for its cyber security enterprise risks as 'requires improvement'. Mitigations were listed in the risk register for these risks but, in some cases, they were unlikely to reduce the risk to the target state or by the target date. For example, one risk had actions listed as 'under review' and no further treatment actions listed, but a due date of July 2021, while another risk was being treated by the CDP with a due date of July 2021. The CDP identified in May 2020 that while the average risk identified as part of that program will be reduced to a medium level by this date, ten high risks will still remain. Given the delays in the program, this number may be higher. As such, it seems unlikely that the enterprise risk will be reduced to below a 'high' level by July 2021.

Sydney Trains’ IT and OT risk registers cross-reference controls and mitigations against the causes and consequences. The IT cyber security risk identified in the register had causes with no mitigations designed for them. Further, some of these causes did not have future mitigations designed for them. This risk also had controls in place which are identified as partially effective. For the unacceptable OT risk noted above, while there was a control designed for each of the potential causes, Sydney Trains had identified all of the controls in place as either partially effective or ineffective. This indicates that Sydney Trains was not effectively mitigating the causes of its cyber risks and, even where it had designed controls or mitigations, these were not always implemented to fully mitigate the cause of the risk.

Additional information on gaps in cyber mitigations which were exposed in the course of this audit has been detailed to both agencies. The Foreword of this report provides information about why this detail is not included here.

Essential 8 maturity is low across TfNSW and Sydney Trains and little progress was made in 2020

CSP mandatory requirement 3.2 states that agencies must implement the ACSC Essential 8. Agencies must also rate themselves against each of the Essential 8 on a maturity scale from zero to three and report this to Cyber Security NSW. A full list of the Essential 8 can be found in Exhibit 1. Both agencies have a low level of maturity against the Essential 8 not just in comparison to the targets they have set, but also in relation to the risks and vulnerabilities exposed. Both agencies have set target maturity ratings for the Essential 8 but none of the Essential 8 ratings across either agency are currently implemented to this level. Having a low level of Essential 8 maturity exposes both agencies to significant risks and vulnerabilities. Little progress was made between the 2019 and 2020 attestation periods.

Transport IT has set a target rating of three across all of the Essential 8. Sydney Trains has set a target rating of three for its IT systems. Sydney Trains had an interim target of two for its OT systems in 2020 and advised that this has since increased to three. It should be noted that not all the Essential 8 are applicable to OT systems.

None of the Essential 8 ratings across either agency are currently implemented to the target levels. Given that the Essential 8 provide the controls which are most commonly able to deter cyber-attacks, having maturity at a low level potentially exposes agencies to a cyber security attack.

Some work is underway across both TfNSW and Sydney Trains to improve the Essential 8 control ratings. The CDP provided some resources to the Essential 8 over 2019–20, with uplift focusing on specific systems. The CDP work in 2019 and 2020 relevant to the Essential 8 largely focussed on determining the current state of the Essential 8 and creating a target state roadmap. As a result, there was little improvement between the 2019 and 2020 attestation periods. The CDP has a workstream for the Essential 8 in its FY 2020–21 funding allocation, however as noted above in Exhibit 6 this was delayed as resources were redeployed to Project La Brea. Regardless, work on some specific aspects of the Essential 8 remain part of the 2020–21 CDP allocation, with workstreams allocated to improving three of the Essential 8. In addition, some work from Project La Brea should lead to an improvement in the Essential 8.

Sydney Trains' Cyber Uplift Program included a workstream which had in scope the uplift in the Essential 8 in IT. There were also other workstreams which aimed to improve some of the Essential 8 for OT systems. Work is also ongoing as part of the CDP to uplift these scores in Sydney Trains.

TfNSW and Sydney Trains have not reached their target maturity across the CSP mandatory requirements and TfNSW has not evaluated its cluster-wide target to ensure it is appropriate

Cyber Security NSW allows each agency to determine its target level of maturity for the first 20 CSP mandatory requirements. Agencies can tailor their target levels to their risk profile. Not reaching the target rating of the CSP mandatory requirements risks information and systems being managed inconsistently or not in alignment with good governance principles.

Sydney Trains has set its target level of maturity for IT and OT. All of Sydney Trains' target maturity levels are at least a three (defined), with a target of four (quantitatively managed) for many of the mandatory requirements. While Cyber Security NSW does not currently mandate a minimum level of maturity, in 2019 there was a requirement for each agency to target a minimum level of three.

Sydney Trains has not met its target ratings across the mandatory requirements.

The Transport Cyber Defence Rolling Program has a program KPI to ensure that the entire cluster reaches a minimum maturity level of three against all the CSP requirements by 2023. TfNSW has not reviewed its CSP mandatory requirement targets to determine if a three is desirable for all requirements or if a higher target level may be more appropriate. It is important for senior management to set cyber security objectives as a demonstration of leadership and a commitment to cyber security.

TfNSW has not met its target ratings across the mandatory requirements for its Group IT ISMS, which was the focus of this audit.

Both agencies claimed progress in their implementation of the mandatory requirements between 2019 and 2020. The audit did not seek to verify the self-assessed results from either agency.

Both agencies operate ISMS in line with the CSP

CSP mandatory requirement 3.1 requires agencies to implement an Information Security Management System (ISMS) or Cyber Security Framework (CSF), with scope at least covering systems identified as the agency's ‘crown jewels’. The ISMS or CSF should be compliant with, or modelled on, one or more recognised IT or OT standard. As noted in the introduction, an ISMS ‘consists of the policies, procedures, guidelines, and associated resources and activities, collectively managed by an organisation, in the pursuit of protecting its information assets.’ Both agencies operate an ISMS compliant with the CSP requirement.

As noted in the introduction, TfNSW operates four ISMS. The Transport IT ISMS is certified against ISO27001, the most common standard for ISMS certification. Three of TfNSW’s six crown jewels are managed within this ISMS. The other ISMS are not certified to relevant standards, though TfNSW claims that they align with relevant controls. This is sufficient for the purposes of the CSP.

Sydney Trains operates two ISMS, one for IT and another for OT. Neither of these are certified to relevant ISMS Standards, however there have been conformance reviews of both IT and OT with relevant standards. These ISMS cover all crown jewels in the agency.

There are currently 11 ISMS in operation across the Transport cluster. TfNSW has proposed moving towards a holistic approach to these ISMS, with the CDP Board responsible for governing the available security controls and directing agency IT and OT teams to implement these.

Agencies are not routinely conducting audits of third-party suppliers to ensure compliance with contractual obligations

CSP mandatory requirement 1.5 makes agencies accountable for the cyber risks of their ICT service providers and ensuring that providers comply with the CSP and any other relevant agency security policies. The ACSC has provided advice on what organisations should do when managing third party suppliers of ICT. The ACSC advises that organisations should use contracts to define cyber security expectations and seek assurance to ensure that these contract expectations are being met. While both agencies usually include specific cyber security expectations in contracts, neither is routinely seeking assurance that these expectations are being met.

The NSW Government has mandated the use of the 'Core& One' contract template for low-value IT procurements and the Procure IT contract template for high-value IT procurements. Both of these contracts contain space for the procuring agency to include cyber security controls for the contractor to implement. The Procure IT contract template also includes a right-to-audit clause which allows agencies to receive assurance around the implementation of these controls. TfNSW and Sydney Trains used the mandated contracts for relevant contracts examined as part of this audit.

TfNSW included security controls in all the contracts examined as part of this audit. Compliance with ISO27001 was the most commonly stated security expectation. Of the contracts examined as part of this audit, only one contract did not have a right-to-audit clause. This contract was signed in October 2016. While these clauses are in place, TfNSW rarely conducted these audits on its third-party providers. Of the eight TfNSW contracts examined in detail, only two of these had been audited to confirm compliance with the stated security controls.

Sydney Trains included security controls in all but one of the contracts examined as part of this audit. Sydney Trains did not require contractors to be compliant with ISO27001, but only required compliance with whole-of-government policies. Sydney Trains does not routinely conduct audits of its third-party suppliers, however it did conduct deep-dive risk analyses of its top ten highest risk IT suppliers. This involved a detailed review of both the suppliers' security posture and also the contract underpinning the relationship with the supplier.

The CDP funding for 2020–21 includes a workstream for strategic third-party contract remediation. This funding is to conduct some foundational work which will allow the CDP to make further improvements in future years. While this funding will not address gaps in contract requirements or management across all contracts, this workstream aims to reduce the risks posed by strategic suppliers covering critical assets. Similarly, work is currently underway as part of the CDP to conduct OT risk assessments for key suppliers to Sydney Trains in a similar way to the work undertaken for IT suppliers.

Sydney Trains has risk assessed its third-party suppliers but TfNSW has not done so

It is important to conduct a risk assessment of suppliers to identify high-risk contractors. This allows agencies to identify those contractors who may require additional controls stated in the contract, those who require additional oversight, and also where auditing resources are best targeted.

Sydney Trains has risk assessed all its IT suppliers and, as noted above, has conducted a deep-dive risk analysis of its top ten highest risk suppliers. TfNSW has not undertaken similar analysis of its key suppliers, however it has identified risks attached to each of its strategic suppliers and has documented these. As a result of not risk assessing its suppliers, TfNSW cannot take a targeted approach to its contract management.

TfNSW demonstrated poor records handling relating to the contracts examined as part of this audit

TfNSW was not able to locate one of the contracts requested as part of the audit's sample. Other documentation, such as contract management plans, could not be located for many of the other contracts requested as part of this audit. These poor document handling practices limits TfNSW's ability to effectively oversee service providers and ensure that they are implementing agreed controls. It also limits public transparency on the effectiveness of these controls.

The Transport cluster is not effectively implementing cyber security awareness training

Agencies are responsible for implementing regular cyber security education for all employees and contractors under mandatory requirement 2.1 in the CSP. TfNSW is responsible for delivering this training to the whole Transport cluster, including Sydney Trains. The Transport cluster has basic cyber awareness training available for all staff. TfNSW also offers additional training provided by Cyber Security NSW targeted at executives and executive assistants. While TfNSW has training available to staff, it is not delivering this effectively. TfNSW does not make training mandatory for most staff nor does it require staff to repeat training regularly. Even among those staff who have been assigned the training, completion rates are low, meaning that delivery is not effectively monitored. Cyber security training is important for building and supporting a cyber security culture.

TfNSW is responsible for creating and rolling out all forms of training to agencies within the Transport cluster. Both TfNSW and Sydney Trains have the same mandatory cyber awareness training that is automatically assigned to new starters. At the time of the audit, this training was not mandatory for ongoing staff. TfNSW does make additional cyber security training available to staff who can choose to undertake the training themselves, or can be assigned the training by their manager. All TfNSW cyber security training is delivered via online modules and it is the responsibility of managers to ensure that it is completed.

Cyber security training completion rates for both TfNSW and Sydney Trains are low. Only 13.5 per cent of staff across the Transport cluster had been assigned the Cyber Safety for New Starters training as of January 2021. Although this course is mandatory for new starters, only 53 per cent of staff assigned the Cyber Safety for New Starters training module had completed the course by January 2021. As a result, only 7.2 per cent of staff across the entire Transport cluster had completed this training at that time. In Sydney Trains, less than one per cent of staff had completed this training as at January 2021 and a further 7.6 per cent of staff have completed the 'Cyber Security: Beyond the Basics' training. These low completion rates indicate that TfNSW is not effectively rolling out cyber security training across the cluster.

In October 2020, the Department of Customer Service released 'DCS-2020-05 Cyber Security NSW Directive - Practice Requirement for NSW Government', which made annual cyber security training mandatory for all staff from 2021. In line with this requirement, TfNSW has advised that it will be gradually implementing mandatory annual training from July 2021 for all staff.

The Transport cluster undertakes activities to build a cyber-aware culture in accordance with the CSP, but awareness remains low

Increasing staff awareness of cyber security risks and maintaining a cyber secure culture are both mandatory requirements of the CSP. While TfNSW does undertake some activities to build a cyber aware culture, awareness of cyber security risks remains low. This can be demonstrated by the low training rates outlined above, and the 'Spot the Scammer' exercise, described in Exhibit 7. TfNSW is responsible for delivering these awareness raising activities across the cluster.

TfNSW frequently communicates with staff across the Transport cluster about various cyber security risks through multiple avenues. Both agencies use the intranet, emails and other awareness raising activities to highlight the importance for staff to be aware of the seriousness of cyber risks. Advice given on the intranet includes tips for spotting scammers on mobile phones, promoting the cluster-wide training courses, as well as various advice that staff could use when dealing with cyber risks in the workplace.

In addition to these awareness raising activities, TfNSW has also undertaken a cluster-wide phishing email exercise called 'Spot the Scammer'. This is outlined in Exhibit 7. This exercise was carried out in 2019 and 2020 and allowed the Transport cluster to measure the degree to which staff were able to identify phishing emails. As can be seen in Exhibit 7, the results of this exercise indicate that staff awareness of phishing emails remains low.

Exhibit 7 - Spot the Scammer exercise
In both 2019 and 2020, TfNSW performed a ‘Spot the Scammer’ exercise in which they sent out over 25,000 emails to staff based on a real phishing attack in order to measure awareness and response. The exercise tested staff 'click through rate', the percentage of staff who clicked on the fake phishing link. In 2019, these results were then compared to industry benchmarks, with over a 20 per cent click through rate being considered 'very high'. Both TfNSW and Sydney Trains were considered to have a ‘very high’ click through rate in comparison to these benchmarks in both 2019 and 2020. This indicates that staff awareness of phishing emails was low. The click through rate for TfNSW was 24 per cent in 2020, an increase from 22 per cent in 2019. For Sydney Trains, the click through rate in 2020 was 32 per cent, which was a decrease from 40 per cent in 2019.
Source: Audit Office analysis of TfNSW documents.

Appendix one – Response from agencies

Appendix two – Cyber Security Policy mandatory requirements

Appendix three – About the audit

Appendix four – Performance auditing

 

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Parliamentary reference - Report number #353 - released (13 July 2021).

Published

Actions for Universities 2020 audits

Universities 2020 audits

Universities
Cyber security
Financial reporting
Internal controls and governance

What the report is about

Results of the financial statement audits of the public universities in NSW for the year ended 31 December 2020.

What we found

Unqualified audit opinions were issued for all ten universities.

Two universities reported retrospective corrections of prior period errors.

Universities were impacted by the COVID-19 pandemic with student enrolments decreasing in 2020 compared to 2019 by 10,032 (3.3 per cent). Of this decrease 8,310 students were from overseas.

In response to the pandemic, each university provided welfare support, created student hardship funds, provided accommodation and flexibility on payment of course fees. State and Commonwealth governments provided additional support to the sector.

Six universities recorded negative net operating results in 2020 (two in 2019). The combined revenues of the ten universities from fees and charges decreased by $361 million (5.8 per cent).

Despite the impact of the COVID-19 pandemic, which will continue to impact the financial results of universities in 2021, enrolments of overseas students in semester one of 2021 increased at two universities. This growth meant that total overseas student enrolments increased by 7,944 or 5.8 per cent across the sector as a whole. However, eight universities experienced decreases in overseas student enrolments compared to semester one of 2020. All universities have experienced growth in domestic student enrolments.

What the key issues were

There were 110 findings reported to universities in audit management letters.

Three high risk findings were identified. One related to the continued work by the University of New South Wales to assess its liability for underpayment of casual staff entitlements. The other two deficiencies were at Charles Sturt University, relating to financial reporting implications of major contracts, and resolving issues identified by an internal review of its employment contracts to reliably quantify the university’s liability to its employees.

What we recommended

Universities should prioritise actions to address repeat findings. Forty-five findings were repeated from 2019, of which 23 related to information technology.

Fast facts

There are ten public universities in NSW with 51 local controlled entities and 23 overseas controlled entities.

  • $10.9bn Total combined revenue in 2020, a decrease of $538.5 million (4.7 per cent) from 2019.
  • 106,984 Overseas student enrolments in 2020, a decrease of 8,310 students (7.2 per cent) from 2019.
  • 3 High risk management letter findings were identified.
  • $11.0bn Total combined expenditure in 2020, a decrease of $147.8 million (0.9 per cent) from 2019.
  • 182,683 Domestic student enrolments in 2020, a decrease of 1,722 students (0.9 per cent) from 2019.
  • 41% Of reported issues were repeat issues.

Further information

Please contact Ian Goodwin, Deputy Auditor-General on 9275 7347 or by email.

This report analyses the results of our audits of the financial statements of the ten universities in NSW for the year ended 31 December 2020. The table below summarises our key observations.

1. Financial reporting

Financial reporting The 2020 financial statements of all ten universities received unmodified audit opinions.

Two universities reported retrospective corrections of prior period errors. The University of Sydney reported errors relating to the underpayment of staff entitlements and the fair value of buildings. Charles Sturt University reported an error relating to how it had calculated right‑of‑use assets and lease liabilities on initial application of the new leasing standard in the previous year.

Impacts of COVID‑19

Student enrolments decreased in 2020 compared to 2019 by 10,032 (3.3 per cent). Of this decrease, 8,310 students were from overseas.

The ongoing impact of COVID‑19 in the short‑term, on semester one enrolments for 2021 compared to semester one of 2020, has been mixed:

  • all universities in NSW experienced a growth in their domestic student enrolments
  • eight universities experienced decreases in overseas student enrolments.

During 2020, universities provided welfare support to students, created student hardship funds, provided accommodation, and flexibility on payment of course fees.

State and Commonwealth governments provided additional support to the sector:

  • those university controlled entities eligible to receive JobKeeper payments received a combined amount under the Commonwealth scheme totalling $47.6 million in 2020
  • the NSW Government launched a University Loan Guarantee scheme.
Financial results

Six universities recorded negative net operating results in 2020 (two in 2019). While most universities experienced decreased revenue in 2020, only four had reduced their expenses to a level that was less than revenue.

Revenue from operations

Universities' revenue streams were impacted in 2020 by the COVID‑19 pandemic, with fees and charges decreasing by $361 million (5.8 per cent).

Government grants as a proportion of total revenue increased for the first time in five years to 34 per cent in 2020.

Nearly 40 per cent of universities' total revenue from course fees in 2020 (40.9 per cent in 2019) came from overseas students from three countries: China, India and Nepal (same in 2019). Students from these countries of origin contributed $2.2 billion ($2.4 billion in 2019) in fees. Some universities continue to be dependent on revenues from students from these destinations and their results are more sensitive to fluctuations in demand as a result.

Other revenues

Overall philanthropic contributions to universities increased by 32.2 per cent in 2020 to $222 million ($167.9 million in 2019). The University of Sydney and the University of New South Wales attracted 75.2 per cent of the total philanthropic contributions in 2020 (69.5 per cent in 2019).

Total research income for universities was $1.4 billion in 20191, with the University of Sydney and the University of New South Wales attracting 66.5 per cent of the total research income of all universities in NSW (65.2 per cent in 2018).

Expenditure Universities initiated cost saving measures in response to the COVID‑19 pandemic. The cost of redundancy programs increased employee related expenses in 2020 by 4.4 per cent to $6.5 billion ($6.2 billion in 2019). The cost of redundancies offered in 2020 across the universities totalled $293.9 million. Combined other expenses decreased to $2.8 billion in 2020, a reduction of $436 million (13.4 per cent).

2. Internal controls and governance

Internal control findings One hundred and ten internal control deficiencies were identified in 2020 (108 in 2019). Forty‑five findings were repeated from 2019, of which 23 related to information technology.

Recommendation: Universities should prioritise actions to address repeat findings on internal control deficiencies in a timely manner. Risks associated with unmitigated control deficiencies may increase over time.

Three high risk internal control deficiencies were identified, namely:

  • The University of New South Wales should continue work to assess its liability for the underpayment of casual staff entitlements. This issue was also reported last year.
  • Two high risk deficiencies were identified at Charles Sturt University. One related to misunderstanding the requirements of the new accounting standard in relation to recognising grant funding revenue for construction work. The second related to resolving issues identified by an ongoing internal review of its employment contracts to enable a reliable quantification as to the university's liability to its employees.

Gaps in information technology (IT) controls comprised the majority of the remaining deficiencies. Deficiencies included a lack of sufficient privileged user access reviews and monitoring, payment files being held in editable formats and accessible by unauthorised persons, and password settings not aligning with the requirements of information security policies.

Business continuity and disaster recovery planning All universities have a business continuity policy supported with a business impact analysis.

Except for Macquarie University, all other universities had disaster recovery plans prepared for all of the IT systems that support critical business functions. Macquarie University’s disaster recovery plans were still in progress at 31 December 2020.

Only half of the universities' policies require regular testing of their business continuity plans and six universities' plans do not specify staff must capture, asses and report disruptive incidents.

3. Teaching and research

Graduate employment outcomes Eight out of ten universities were reported as having full‑time employment rates of their undergraduates in 2020 that were greater than the national average.

Six universities were reported as having full‑time employment rates of their postgraduates in 2020 that were greater than the national average.

Student enrolments by field of education Enrolments at universities in NSW decreased the most in Management and Commerce courses and Engineering and Related Technologies courses. The largest increase in enrolments was in Society and Culture courses.
Achieving diversity outcomes Five universities in 2019 were reported as meeting the target enrolment rate for students from low socio‑economic status (SES) backgrounds.

Seven universities were reported to have increased their enrolments of students from Aboriginal and Torres Strait Islander backgrounds in 2019. The target growth rate for increases in enrolments of Aboriginal and Torres Strait Islander students (to exceed the growth rate of enrolments of non‑indigenous students by at least 50 per cent) was achieved in 2019.

 1 2020 data, which is compiled by the Australian Department of Education and Training, is not yet available.

This report provides Parliament with the results of our financial audits of universities in NSW and their controlled entities in 2020, including our analysis, observations and recommendations in the following areas:

  • financial reporting
  • internal controls and governance
  • teaching and research.

Financial reporting is an important element of governance. Confidence and transparency in university sector decision making are enhanced when financial reporting is accurate and timely.

This chapter outlines our audit observations on the financial reporting of universities in NSW for 2020.

Financial results

The graph below shows the net results of individual universities for 2020.

Appropriate and robust internal controls help reduce risks associated with managing finances, compliance and administration of universities.

This chapter outlines the internal controls related observations and insights across universities in NSW for 2020, including overall trends in findings, level of risk and implications.

Our audits do not review all aspects of internal controls and governance every year. The more significant issues and risks are included in this chapter. These along with the less significant matters are reported to universities for management to address.

Universities' primary objectives are teaching and research. They invest most of their resources to achieve quality outcomes in academia and student experience. Universities have committed to achieving certain government targets and compete to advance their reputation and their standing in international and Australian rankings.

This chapter outlines teaching and research outcomes for universities in NSW for 2020.