About this report

The reliance on information technology in modern government, in addition to the global interconnectivity between computer networks, has dramatically increased the risk of cyber security incidents. Such incidents can harm government service delivery and may include the theft of information, breaches of private information, denial of access to critical technology, or even the hijacking of systems for profit or malicious intent. These outcomes can have adverse impacts on the community and harm trust in government.

This report presents our analysis of the NSW Cyber Security Policy compliance data submitted by State agencies to Cyber Security New South Wales in 2024, along with insights into the cyber security environment drawn from selected reports published between 2018 and 2025. This analysis includes reports from performance audits, compliance audits and financial audits.

The report is a resource for the public sector. It provides insights into the challenges and opportunities for strengthening cyber resilience.

Insights

Key insights from the report’s analysis of Cyber Security policy compliance data include:

• the need for agencies to focus on the cyber resilience gaps particularly in implementing ‘protect’ domain controls
• a lack of independent assurance over agency reporting against the Cyber Security Policy
• limited oversight of third-party providers
• risk that aggregate reporting reduces visibility into agency compliance levels and cyber risks.

The report’s analysis of selected Auditor-General reports from 2018 and 2025 identifies that while cyber security governance in the NSW public sector has improved through broader adoption of policies and frameworks, there is still a critical need to:

• address unclear roles
• adequately identify information assets
• manage third-party cyber security risk
• address failures to meet basic protection standards
• perform phishing simulations more regularly
• align culture with cyber security environment to ensure controls are fit for purpose. 

The reliance on information technology in modern government, in addition to the global interconnectivity between computer networks, has dramatically increased the risk of cyber security incidents. Such incidents can harm government service delivery and may include the theft of information, breaches of private information, denial of access to critical technology, or even the hijacking of systems for profit or malicious intent. These outcomes can have adverse impacts on the community and harm trust in government.

This chapter presents key insights from analysis of the latest cyber security status reporting to Cyber Security NSW by NSW Government departments and public sector agencies. While equivalent sector analysis is not available for the university and local government sectors, the insights presented here are relevant to those sectors.

This chapter focuses on thematic insights from audits of the cyber security environments within NSW state agencies, universities and the local government sectors between 2018 and the present. Key themes were identified and structured according to the Mandatory Requirements categories of ‘Govern and Identify’ ‘Detect, Respond and Recover’ and ‘Protect’, which are commonly used in the cyber security frameworks adopted across NSW Government entities.

Appendix 1 - Included reports 2018–2025

Appendix 2- Timeline of cyber security controls implementation across sectors

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

About this report

In NSW, mining companies are legally required to rehabilitate disturbed land and water to a safe and stable condition. Mining companies must also provide a security deposit to cover the cost of rehabilitation in case they default on their obligations.

The Department of Primary Industries and Regional Development (the Department) is responsible for overseeing and enforcing these requirements. These functions are delivered by a unit in the Department, known as the NSW Resources Regulator.

This audit assessed the effectiveness of the Department in monitoring compliance with and enforcing mine rehabilitation requirements. This audit focused on the rehabilitation of large mines.

Findings

The Department is not effectively monitoring and reporting on compliance with mining rehabilitation requirements. However, regulatory reforms introduced in July 2021 provide a more robust regulatory framework for mine rehabilitation. These changes, if implemented effectively, should provide the Regulator with a consolidated view of rehabilitation progress for large mines.

Current gaps in the Department’s data framework mean that it does not have a comprehensive and reliable view of rehabilitation progress and enforcement outcomes. This limits the Regulator’s ability to effectively regulate mine rehabilitation. Further, there is no current plan to evaluate the effectiveness of its regulatory program.

While the Regulator collects data on the amount of land under rehabilitation, it does not collect data on the amount of disturbed land available to mining companies for rehabilitation. Without this data, the Regulator is unable to determine whether a mining company has rehabilitated disturbed land as soon as reasonably practicable after the disturbance occurs.

The total value of rehabilitation security deposits held by the Department was around $4 billion in 2023–24. If there is a shortfall in deposits held for one mine, that shortfall cannot be covered by another mining company’s security deposit. A Rehabilitation Cost Estimate tool is used to calculate required security deposits for each mine. The Regulator updates this tool around every four years, but there is no allowance between reviews to account for inflation or changes to industry rates.

Recommendations

The audit makes four recommendations, including to:

1. implement an evaluation plan to measure regulatory outcomes
2. address gaps in the data framework
3. develop and report publicly on key performance indicators and targets
4. enhance governance and regulation for mine rehabilitation, including by ensuring planning documents consider emerging risks.

Mine rehabilitation requirements

The Mining Act 1992 (Mining Act) and Mining Regulation 2016 (Mining Regulation) provide the regulatory framework for mining in NSW. The Mining Act aims to foster social and economic benefits, while also minimising impacts on the environment.

Under the Mining Act and Mining Regulation, mining companies in NSW are required to:

• as soon as reasonably practicable, restore land and water disturbed by mining to a safe and stable condition
• provide a security deposit that covers the full cost of rehabilitation.

The lifecycle of a mine can span several decades. The mining approvals needed and the associated rehabilitation requirements over a mine’s lifecycle are shown in Exhibit 1.

Appendix 1 – Response from entity

Appendix 2 – About the audit

Appendix 3 – Performance auditing

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Parliamentary reference - Report number #411 - released 25 June 2025

About this report

This audit assessed the effectiveness of the regulation of gaming machines in clubs and hotels, with a focus on harm minimisation requirements.

In NSW, the Independent Liquor and Gaming Authority (ILGA) and the Department of Creative Industries, Tourism, Hospitality and Sport (the Department) share responsibility for regulating gaming machines in clubs and hotels.

Findings

More than half of all gaming machines in Australia are located in NSW.

The Department and ILGA regulate gaming machines in a structured and consistent manner but are not supporting harm minimisation outcomes effectively.

The Department has a regulatory strategy that sets out its priorities clearly. It has communicated this to stakeholders. However, the strategy does not have a sufficient focus on the areas that are considered high-risk for gambling harm and does not set targets for reducing harm associated with gaming machines. Gaming machine losses and the social costs of gambling harm continue to be disproportionately concentrated in socio-economically disadvantaged communities.

ILGA and the Department have clear processes for assessing applications to operate gaming machines. However, ILGA does not proactively review licence conditions after they are granted.

Most venues that have the largest number of gaming machines have not had their licence conditions reviewed in recent years and are operating gaming machines with licence conditions that may not be consistent with contemporary approaches to harm minimisation.

A legislated forfeiture scheme that aims to reduce the number of gaming machines in NSW has existed since 2001. The number of gaming machines operating in NSW has decreased gradually, noting there has been an increase in the number of gaming machines in NSW since 2021–22.

Recommendations

The report made recommendations including:

• the Department should increase the focus of its regulatory strategy on improving harm minimisation outcomes and ensure the gaming machine forfeiture scheme is achieving its legislative objectives
• ILGA should commence periodic reviews of licence conditions for venues operating gaming machines and increase clarity to industry and other stakeholders about the reasons for its decisions.

Appendix 1 – Responses from audited entities

Appendix 2 – About the audit

Appendix 3 – Performance auditing

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Parliamentary reference - Report number #409 - released 12 June 2025

About this report

The NSW and Commonwealth governments announced the Special Disaster Assistance (SDA) grant program to support primary production businesses affected by significant flood events in areas of NSW in August and September 2022.

This audit assessed whether the NSW Rural Assistance Authority (RAA) and the NSW Reconstruction Authority (Reconstruction Authority) implemented the SDA - storms and floods AGRN 1030 and AGRN 1034 program in line with the principles and mandatory requirements outlined in the Grants Administration Guide, and in line with the program guidelines.

This audit was conducted following a request from the Special Minister of State that the Auditor-General conduct a recurring performance audit of emergency relief grants under section 27B(3)(c) of the Government Sector Audit Act 1983.

Findings

The RAA and the Reconstruction Authority followed the program guidelines and met most of the requirements of the Grants Administration Guide in administering the program.

However, the RAA did not implement appropriate controls to mitigate the risk of fraud for applicants who received only the upfront payment of $25,000. It did not require evidence of how these funds would be spent, or validate claims of estimated damage, before distributing the payments. The total value of these payments was approximately $40 million.

The RAA conducted an effective process to determine each applicant’s eligibility for the program and implemented appropriate fraud controls for higher-value grants.

The Memorandum of Understanding between the RAA and the Reconstruction Authority has not been updated since 2015. Neither agency conducted a cost-benefit analysis to assess value for money or planned an evaluation of the program. There were also gaps in the way that the RAA managed program risks.

Recommendations

Both audited agencies should:

• update the Memorandum of Understanding to better define responsibilities for grants administration.

The NSW Rural Assistance Authority should:

• improve its risk management of grant programs by:
  • defining its risk tolerance
  • ensuring appropriate controls to reduce fraud risks are in place
• ensure that conflict of interest declarations are collected from all assessment and claims staff
• update its cost estimate model
• develop additional performance measures for future grant programs.

The NSW Reconstruction Authority should:

• complete the cost-benefit analysis and outcome evaluation for the program.

New South Wales experienced multiple rain events between February and November 2022, which resulted in flooding across the state. Owing to the significant impact of this flooding on primary producers, the NSW and Commonwealth governments announced a series of SDA grant programs to support primary production businesses.³

The purpose of the AGRN⁴ 1030 (Southern and Central West NSW Floods from August 2022 onwards) and AGRN 1034 (NSW Flooding from 14 September 2022 onwards) SDA program was to provide a timely and proportionate response to minimise the impact these storm and flood events had on primary producers and allow them to return to normal operations as soon as possible. Applications for the SDA program opened on 18 November 2022 and closed on 30 June 2023.

Under the AGRN 1030 and 1034 SDA program, 28 LGAs were declared disaster-affected in Southern and Central West NSW in August 2022. A further 47 LGAs were declared disaster-affected across NSW in September 2022, including all 28 LGAs affected by the August event, bringing the total to 75 declared LGAs plus the Unincorporated Far West Area.

The agencies’ Memorandum of Understanding does not clearly set out responsibilities for key aspects of grant program development and evaluation

The GAG sets out expectations for how multiple agencies involved in grants administration should define responsibilities, including:

• agencies should agree between themselves which agency is responsible for applicable mandatory requirements set out in the GAG during the planning and design phase of a grant program
• mandatory requirements are recommended to be captured in a MoU, particularly if funds are transferred between the agencies for the purpose of delivering the grant.

The MoU between the Reconstruction Authority and the RAA was last updated in 2015 and does not clearly set out responsibilities for some of the mandatory requirements of the GAG.

For example, the MoU does not specify which agency was responsible for the design of the program, including the responsibility for conducting a CBA during its development. A CBA was not conducted during the program’s development. This is discussed in more detail below. The MoU sets out some responsibilities relating to the evaluation of the program but it does not establish responsibility for determining whether the outcomes and benefits of the program were realised. Under the MoU:

• the RAA is required to submit a Post Disaster Assessment Report which captures data on the number of applications, number of approvals and value of grants paid
• the Reconstruction Authority is required to operate a compliance function to ensure that expenditure claimed against the DRFA complies with the NSW Disaster Assistance Guidelines and the MoU.

These evaluation mechanisms only relate to financial and probity oversight and do not include responsibilities for key aspects of evaluation, including determining if the program met intended outcomes and the impact of the program relative to its costs.

In addition, the MoU does not outline which agency was responsible for probity in program design, defining the risk tolerance for the program or for the management of program risks. Key risk management activities such as defining program risk tolerance and the ongoing monitoring of program risks were not conducted.

The RAA and the Reconstruction Authority are working together to draft an updated MoU. However, as at April 2025 the MoU had not been finalised.

The Rural Assistance Authority did not clearly define its risk tolerance for this program

The Reconstruction Authority identified key risks and defined its tolerance for strategic risks, such as those relating to the administration of the DRFA. The Reconstruction Authority did not define a risk tolerance that was relevant to this program, but it was not responsible for administering the program and so the RAA was best placed to identify a relevant program risk tolerance.

The RAA did not define its tolerance for key program risks, such as in a risk appetite statement. Although the GAG does not mandate the development of risk appetite statements for grant programs, the lack of a risk appetite statement meant that there was no guidance available for the RAA as the administering agency to inform risk-based decisions, including risks relating to balancing the risk of fraud with speed of assessment.

The program’s Assurance and Probity Plan assessed the program as having a low probity risk, but the RAA did not retain documentation to explain how this risk rating was determined. The RAA advised that the program was assessed as low-risk because:

• it was open and non-competitive
• it did not involve any discretionary decision-making or external involvement in decision-making
• there was no comparative merit-based assessment against other applicants.

The RAA also advised that the program was considered low-risk because the agency had previously administered similar programs and therefore was aware of the inherent program, grantee and governance risks. As there was no risk appetite statement in place, this assessment was made without a formal framework that considered the RAA’s overall approach to risk.

A risk appetite statement may have informed key decision points in the program. For example, the RAA did not require evidence of how funds would be spent before distributing upfront payments. This increased the risk that fraudulent applications would be approved. Defining its risk tolerance for the program may have helped the RAA to manage this risk.

In addition, in October 2023, the RAA implemented a rule which stated that it would not validate proof of payment for reimbursements below $2,500, which it termed the ‘de minimis’ rule. The RAA considered the impact of this change on fraud risk. However, because it did not have a defined risk tolerance to assist with decision-making, the RAA did not have a framework to determine whether these risks were within the tolerance it was willing to accept.

The Department of Regional NSW (DRNSW) had a risk management framework in place at the time of the program; it defined a risk tolerance across all of DRNSW for various types of risk, including for entities like the RAA, which formed part of DRNSW at the time. It stated that the agency had a low-risk appetite for fraud and corruption. Although the RAA’s risk management plan aligns with DRNSW’s approach, there is no evidence that the RAA used DRNSW’s risk appetite statement to guide its decision-making in relation to risk-based decisions.

The Rural Assistance Authority identified risks for the program but it did not adequately monitor these risks

The RAA Risk Management Plan states that the program Steering Committee is responsible for overseeing and monitoring the program risk register throughout the program’s lifecycle. Although the Steering Committee monitored risks prior to the program launch, it did not meet after the program launched and there is no evidence that the program risk register or program risks were reviewed, discussed or monitored beyond this point. This lack of monitoring meant that the RAA did not have a comprehensive view of how changes in the program risk profile may have impacted program delivery. Risks were reported at each of the Steering Committee meetings that occurred before program launch, but these risks remained the same at each meeting even when those risks were no longer relevant. The Steering Committee’s minutes are not clear on whether the risks were discussed in detail or reassessed during these meetings.

The RAA created a risk register for the program, including designing controls for each of the identified risks and identifying actions to further reduce those risks. The program risk register was last updated in October 2022, with no evidence that this document was updated regularly after this date. This is despite changes in the program’s risk profile. For example, the risk register identified a risk related to the program being upgraded from DRFA category C to category D which would result in a more complex application process. This change in category occurred, impacting the program’s overall risk profile. However, there was no evidence that the program’s risk register was revised once the program changed to a category D program.

The RAA designed and implemented mitigating controls to reduce the likelihood or impact of identified risks. For example, to reduce the risk of fraudulent applications, the agency required financial assessments of all applicants to be conducted to ensure their eligibility for the program. The RAA undertook these financial assessments for each applicant. The RAA also included a declaration on the application form to provide a legal avenue to recover fraudulently acquired funds.

The RAA also identified a risk that program delivery would not be timely. To mitigate this risk, the RAA planned to monitor and report on processing and notification times for the program. As discussed below, the RAA regularly reported to the executive on program timelines, though there were long processing times for both assessments and grant claims.

The RAA’s enterprise risk management occurs through the agency-wide Assurance Working Group (AWG). This group is responsible for reviewing key business processes, high-risk areas and key risk controls that inform business improvement processes. The group only discusses broader, enterprise-wide risks relevant to the RAA’s agency-wide objectives, rather than program-specific risks. Although some of the risks that are reviewed by the AWG may be relevant to the management of the RAA’s programs, risks specific to each program are not discussed in the AWG. The AWG did not review or discuss the program’s risk register, demonstrating that it was not responsible for the program-level risks. The AWG monitoring alone was not sufficient to manage risks to the AGRN 1030 and 1034 program, as program-level risks were not monitored specifically.

The Rural Assistance Authority implemented appropriate fraud controls for higher-value grants, but not for applicants who only received the up-front payments

The GAG requires agencies to develop and implement fraud controls that are proportionate to the value and risk of the grant. RAA identified the risk of fraudulent applications being submitted to the program as high, due to the substantial value of the grants. However, the controls in place to mitigate the risk of fraud posed by people only claiming the upfront payment were not appropriate given the value of the grant.

Under the program guidelines, applicants were able to receive the upfront payment of up to $25,000 without providing proof of payment. The program guidelines stated that the payment would be provided on the basis of quotes or estimated costs. The RAA required applicants to provide an estimated value of damage and a description of the impact of the flood event(s). If applicants did not claim any further funding above the $25,000 threshold, they were not required to submit any further documentation to prove that the applicant planned to spend the upfront payment on eligible expenditure in compliance with the guidelines.

In addition to not requiring evidence of how the grant recipient planned to use their upfront payment, the RAA also did not collect proof that the payment had been spent on eligible items to confirm that it complied with the grant guidelines, unless an applicant was making subsequent claims for funding above the upfront payment. As it did not seek to validate the planned or actual use of the upfront payment, the RAA did not put in place appropriate controls to manage the risk of fraud among the upfront payments.

Of the 8,959 approved and disbursed applications to the program, 1,701 claimed $25,000 or less and were therefore only required to submit an estimate of their damage to receive the grant. This made up 19% of applications to the program, with a total value of approximately $40 million. Some of these applicants provided further evidence to support their claim, but this was not required. The provision of up-front grants is discussed further in the next chapter.

The RAA did require paid tax invoices to be provided prior to payment of claims above the upfront $25,000. For payments above this threshold, applicants were required to provide invoices and proof of payment for both the upfront payment and any amount over the $25,000. A payment officer checked this evidence for claims, and this work was verified by a program officer. This served as an appropriate control for the risk of fraudulent applications above the upfront payment threshold.

The RAA advised that it engaged with Service NSW and the RAA’s equivalent agencies in Queensland and Victoria to ensure applicants were not applying for payments under other grant programs that may have resulted in their ineligibility for the SDA program. Applicant details were cross-referenced with a list of applicants from these grant programs as part of the eligibility assessment process.

The RAA identified 32 out of 10,715 applications as potentially fraudulent. The value of these applications was $982,002, with only one of these grants being disbursed. The RAA is in the process of reclaiming the $25,000 payment from this applicant.⁷ The limitations of the fraud controls in place mean that the RAA is not able to determine if potential fraud rates within the program are higher.

The Rural Assistance Authority obtained internal probity advice for the program

The GAG requires officials to seek probity advice for complex, high-risk or high-value programs to support the design, application, assessment and decision-making phases of the program. The RAA identified this program as having a low probity risk and as such the GAG requirement did not apply. As noted above, the rationale for assessing the program as low-risk was not documented.

The program’s Assurance and Probity Plan outlined its assurance activities, along with the responsibilities for and frequency of these activities. The plan advised that due to the program being assessed as low-risk, an external probity advisor was not required. As such, the RAA sought internal probity advice, which was provided by staff from the governance team.

The Rural Assistance Authority did not effectively identify conflicts of interest

The GAG states that officials should ensure that any real or perceived conflicts of interest are effectively avoided, managed and disclosed. The RAA’s Fraud and Corruption Control Plan documents a series of controls and their owners, and outlines how the agency should identify and control potential fraud and corruption by its staff and third parties. The plan describes a series of controls to manage conflicts of interest, including developing conflict of interest registers for each program and training with common scenarios and guidance from senior staff. The RAA did not ensure that conflicts of interest for those administering and overseeing the program were identified and therefore effectively managed.

The Assurance and Probity Plan outlined a requirement for all Steering Committee members to make an active conflict of interest declaration for the program, including declaring if they did not have a conflict. Five of the 16 members of the Steering Committee did not make any declaration for the program, and four of these five members had not made an annual conflict of interest declaration.

In addition, 63 of the 88 officers involved in the assessment or payments processes for the program did not have a conflict of interest declaration recorded. Most of these officers were temporary staff employed specifically to process applications for the SDA programs. This was because the RAA’s onboarding documentation only required staff to identify if they had a conflict of interest. It did not require staff to assert that they did not have a conflict of interest, which is not in line with good conflict of interest management. All staff, including those engaged temporarily, are required to complete a training module on DRNSW’s code of ethics and conduct during onboarding and to complete it again annually as part of their refresher training.

The Assurance and Probity Plan stated that RAA policies and procedures relating to conflicts of interest are consistent with DRNSW conflict of interest policies. However, DRNSW did not have a specific conflict of interest policy in place when the program was being administered. In place of a specific policy, DRNSW’s Code of Ethics and Conduct contained a brief outline of the process for declaring conflicts of interest. The process outlined did not cover risk mitigation strategies for conflicts, review of disclosures or the process for handling breaches.

The Department of Primary Industries and Regional Development, which RAA is now a part of, implemented a specific conflict of interest policy in November 2024, along with an updated Code of Ethics and Conduct. The new policy requires staff who work in high-risk roles to submit an annual conflict of interest declaration. High-risk roles are defined in the policy to include those involved in administering or advising on grants or approvals. The RAA advised that it has adjusted its procedures to require all RAA staff to complete an annual conflict of interest declaration, in line with this policy.

The Rural Assistance Authority did not actively manage conflicts of interest for the program

The conflict of interest declarations made by RAA assessment and payment officers are held in a register managed by DRNSW. The Fraud and Corruption Control Plan advised that the RAA’s conflicts of interest would be managed by key RAA staff for the SDA programs. Due to DRNSW’s management of the conflict of interest register, the RAA could not readily access declared conflicts of interest without having to make a specific request to DRNSW. This limited the RAA’s oversight of conflicts of interest.

RAA advised that assessment and payment officers were able to see some details of each applicant prior to processing their applications so they could determine if they had a conflict of interest. If they identified that they had a conflict of interest, they would be deemed unable to complete the assessment or approval and another staff member would undertake it. If a staff member wished to apply for a grant under the program, the staff member had to declare the application through DRNSW’s declarations portal. The assessment and approval of this application had to be performed by an independent staff member.

The RAA was reliant on staff identifying conflicts and recusing themselves from processing applications and claims where required. There is no evidence that line managers actively monitored the processing of applications or claims to ensure staff were not processing applications or claims where there was a declared conflict of interest.

In addition, staff were required to recuse themselves from assessment or approval of grants for their relatives. This was an informal process managed by the officer’s line manager, and the RAA advised that these situations were recorded as a file note. The RAA did not monitor these cases at a program level. If it was perceived as a conflict, officers were required to formally submit a conflict of interest declaration for the register.

The program guidelines mostly aligned with Grants Administration Guide requirements

The GAG mandates that grant program guidelines include the following information:

• the purpose and objectives of the grant
• selection criteria and assessment process
• grant value
• opening and closing dates
• any support available to grant applicants
• application outcome date (not relevant for this program)
• source agency or agencies
• the decision-maker.

The program guidelines met all of the above requirements. The program’s overall compliance with the mandatory requirements of the GAG is set out in Appendix 2.

The GAG also states that, where relevant, a description of complaint handling and review and/or access to information mechanisms should be included in program guidelines. The guidelines for the program did not include a description of the complaint handling process, despite the RAA having an appeals process for the program. This process was attached to refusal emails sent to applicants, along with a link to lodge an appeal. Although refused applicants were made aware of this process, this was not communicated to all potential grantees in the program guidelines. Publishing this information in the guidelines could have provided a more accessible and transparent system for applicants.

Neither agency conducted a cost-benefit analysis to assess value for money in the program design as required by the Grants Administration Guide

The GAG requires public officials to demonstrate at the planning and design stage of the program how it will deliver value for money by identifying benefits and costs. This CBA provides a valuable tool for decision-makers to understand the expected impact of a program.

Neither the RAA nor the Reconstruction Authority conducted a CBA at the program design stage to assess the grant program’s value for money. As a mandatory requirement of the GAG it was necessary for the agencies to ensure that the CBA for the program was undertaken. Neither agency was assigned responsibility for conducting a CBA in the MoU.

The GAG advises that for time-critical grant opportunities, which likely includes emergency relief grants, it may be possible to assess value for money through a more streamlined rapid CBA. This was not undertaken as an alternative. NSW Treasury’s Disaster Cost Benefit Framework (TPG23-17) also outlines the requirements for disaster-related programs’ CBA. It advises that when responding to a disaster there may be insufficient time to complete a CBA prior to funding.

For grant programs over $50 million, the GAG recommends that the post-program evaluation includes a CBA. In addition, TPG23-17 states that where disaster resilience initiatives valued at over $10 million are not supported by a business case and CBA, it is mandatory to complete an evaluation and ex-post CBA within a reasonable period of time. The Reconstruction Authority plans to conduct an economic evaluation of the program that will include a post-program CBA. A CBA conducted after the program can assist in determining whether the program achieved its intended objectives and provided value for money.

The Rural Assistance Authority’s model for estimating the total cost of the program significantly underestimated the total expenditure

While a CBA was not undertaken, the RAA did estimate the costs of the program before it launched. The RAA had commissioned modelling in 2021 to allow it to estimate the costs of future disaster events. The model used previous disaster events, including flood events, to predict the number of applicants, the number of approved applications, the amount of funding predicted to be approved and the amount of funding predicted to be disbursed to applicants. The RAA model used data from the February to March 2021 and the November 2021 flood events to underpin its assumptions. While these were the two most recent completed flood programs, the 2022 flood events were significantly larger and saw different applicant behaviour than that observed in the previous two events. There is now an opportunity for the RAA to revisit its cost estimate modelling to update the assumptions that are used with data from the 2022 SDA programs.

Using this model, the RAA estimated that the total cost of the program would be $267.6 million; it provided this estimate to the then Resilience NSW to inform the overall program budget. The RAA first advised the then Resilience NSW about this figure on 27 October 2022 and again on 7 November 2022. When the RAA first provided this advice, 55 LGAs had been disaster-declared and were therefore eligible for the program. When the RAA provided this advice the second time, 66 LGAs had been disaster-declared but the RAA did not update its assumptions to revise the expected program expenditure. If it had updated its assumptions, the RAA could have provided more accurate figures to the then Resilience NSW to estimate the program budget. A total of 75 LGAs and the Unincorporated Far West Area were disaster-declared.

The total program cost of $536.5 million was double the initial estimate. The model had a number of assumptions that resulted in this cost being underestimated. Even if cost estimates had factored in all of the disaster declared areas, the total cost of the program would most likely have been underestimated due to these other assumptions proving inaccurate. The assumptions and estimates compared to actual expenditure are outlined in Table 2 and include:

• an underestimation of the amount that each applicant would apply for
• the percentage of applicants that would be approved
• the amount of money that each approved applicant would claim back from their allowed maximum.

Source: Rural Assistance Authority modelling and Audit Office of NSW analysis.

Further, there were some differences between the 2021 flood programs and the AGRN 1030 and 1034 flood events. In particular, the previous events allowed six months for applications and 12 months for claims. In this case, the program was open for seven months and claims were open for 18 months, providing a greater opportunity for businesses to lodge applications and claims. The RAA advised that the Reconstruction Authority did not request forecasting based on these extended application and claim periods.

Inaccurate cost estimates meant that decisions were made on the basis of incorrect assumptions. The approved program budget assumed that $267.6 million was an accurate forecast, however the Reconstruction Authority had to seek approval in August 2023 and May 2024 for additional funds to make up the program shortfall. The RAA advised that monthly forecasts were provided to the Reconstruction Authority to support the request for additional funds. In addition, the RAA based its resourcing and administration assumptions on the initial cost estimate, meaning that its estimated administration costs and the number of staff that were contracted to administer this program was significantly lower than would have been the case if the assumptions had been more accurate. The RAA added more staff during the program when it became clear that the program would exceed the expected level of demand.

⁷ A ‘Show Cause’ letter was issued to this applicant to provide them the opportunity to rectify the issues identified with their application. As the applicant did not respond, a tax invoice was issued requesting the payment to be repaid to RAA.

The Rural Assistance Authority conducted an effective process to determine each applicant’s eligibility for the program

The GAG states that all grants should have clear eligibility criteria that outline the minimum requirements an applicant must meet to be eligible for funding. The program guidelines outlined the criteria that would determine applicant eligibility for the grant. Administering a program in accordance with its guidelines is a mandatory requirement of the GAG. This is essential to ensure the program is administered fairly and that the program achieves its objectives. The program’s overall compliance with the mandatory requirements of the GAG is set out in Appendix 2.

To determine whether the grant program had been administered in line with the program guidelines, the audit team tested a sample of applications, which included the assessment of application eligibility. All approved applicants examined by the audit team were correctly found to be eligible. All rejected applicants in the sample were correctly found to be ineligible.

To ensure applicants were assessed equitably against the eligibility criteria, assessment officers were provided with an assessment template and training guidance. This documentation provided guidance on interpreting the program guidelines and was designed to ensure that each applicant would be assessed consistently.

In line with the program guidelines, assessment officers reviewed the lodged tax returns and financial statements to ensure that applicants derived at least 50% of their gross income from the primary production enterprise. They also reviewed applicant ABNs to ensure that these were active and current at the time of the flood event(s), and LGA rate notices to determine if the enterprises were located within an eligible area. Applicants were also required to provide an estimated value and description of damage incurred.

The assessment of this evidence was entered into the assessment template for each applicant and the completed template was provided as written advice to a program officer as the decision-maker. The program officer then approved or declined the application based on the advice provided by the assessment officer. For each application, the RAA retained documentation that related to the application outcome and the reasoning behind the outcome. It also documented the decisions on both approved and rejected applications.

The Rural Assistance Authority processed most claims for the grant program in accordance with the program guidelines and the Grants Administration Guide

The program guidelines outlined a list of items and activities that were eligible for reimbursement, along with the evidence required to claim. This list was created to ensure that only eligible expenses were reimbursed. In addition, the RAA provided further guidance to payment officers, particularly covering more difficult situations that may arise. This included creating a payment schedule template. This documentation aimed to ensure that each claim was assessed against the same criteria.

For anyone seeking to claim additional funds after receiving the upfront payment, payment officers reviewed the invoices submitted, including the supplier, date, invoice amount and the description for each claim. Payments officers reviewed the invoice item descriptions to determine if expenses were eligible for reimbursement under the program guidelines. In addition, payment officers reviewed proof of payment for these invoices, usually in the form of bank statements. The payment schedule and the supporting evidence was provided to the program officer as written advice for approval or denial.

The procedure for assessing and processing the upfront payments is discussed in detail below.

The audit team tested a sample of applications for the program, which included the processing of claims for these applications. The sample demonstrated that invoices and proof of payment were retained for all applicants who claimed funding above the $25,000 upfront payment amount. Payment schedules were generated for these applicants, and invoice and payment data was entered into the schedule template to evidence claim eligibility. The payments made aligned with the invoices and followed the established process.

Most of the applicants in the sample were only reimbursed for eligible expenditure. The audit team identified one applicant who was reimbursed for ‘business advice post-flood’, which was not eligible expenditure under the program guidelines. The documentation retained for this applicant did not outline any reasons for approving the ineligible expense, as required by the GAG.

Applicants were required to provide proof of payment for any previous SDA grants they had made under the other 2021 and 2022 storm and flood disaster events before they could receive payment from the AGRN 1030 and 1034 SDA program. Payment officers checked if applicants had made claims under previous programs and validated this expenditure as per the guidelines.

The Rural Assistance Authority did not require evidence of how funds would be spent or validate claims of estimated damage before distributing the upfront payments

Applicants who had not successfully applied for grants under previous iterations of the SDA program were entitled to an upfront payment of $25,000 without the need to provide invoices at the point of application. Applicants who had received grant payments under previous SDA programs were only eligible for the upfront payment if they had fully validated their previous grant funding. The RAA advised that this was to assist primary producers with their cash flow by providing them with enough money to begin recovery works.

The program guidelines, which were designed by the RAA and approved by the then Resilience NSW, stated that payment would be provided on the basis of quotes or estimated costs. The guidelines also included an application checklist which specified the documentation the applicant would need to provide at the point of application. This checklist included ‘quotes, estimates, photos, valid tax invoices and proof of payment (if you have them)’. The program guidelines did not explicitly require applicants to provide evidence to support their estimates or to validate their expenditure post payment.

The frequently asked questions (FAQs) for the program, which were published on the RAA website, stated that reasonable evidence was required to be submitted by all applicants to prove damage from the flood event(s). The following examples of evidence were listed:

• quotes or estimates for works to be completed
• tax invoices of expenses incurred for clean-up or salvage works already completed following the flood event(s)
• photos of damaged property with time, date and location stamps (not mandatory).

The audit team tested a sample of 16 applicants who received only an upfront payment of $25,000 or less. Two applicants in the sample submitted evidence of their intention to spend this money in accordance with the program guidelines although this was not required by the guidelines. The remaining applicants submitted an estimated value of the damage and explained the impact of the flood on their business, which was confirmed by an assessment officer through a phone call. The RAA advised that the purpose of this phone call was to test the applicant’s claim against results from the Primary Industries Natural Disaster damage survey. This is an online survey that farmers, DPIRD, Local Land Services Staff and agricultural industry representatives can use to record damage to primary production and animals from natural disasters such as floods, fires and storms. Assessment officers could use this data to assess if applicants’ claims were consistent with the level of damage recorded in the survey results.

While it was in line with the guidelines, by not collecting this evidence, the RAA could not ensure that applicants who applied for payments below the $25,000 threshold had estimated damage accurately or validate that applicants intended to spend, or had in fact spent the grant in line with the program guidelines. The lack of appropriate controls increased the risk of fraudulent applications being made for these upfront payments and funds disbursed to those applications, as well as the risk that the upfront payments were not spent on eligible activities.

The program guidelines included a provision for the RAA to request additional evidence from applicants once a payment had been made. However, the RAA did not validate these applications post program to confirm that grant money had been spent in line with the guidelines.

There were long processing times for both assessments and grant claims throughout most of the life of the program

As discussed above, and as shown in Exhibits 3 and 4, there was a steady flow of applications and claims throughout the program before a sharp increase prior to the program closing. Due to the number of applications and grant claims exceeding the original estimates for the program, the RAA was not adequately prepared for the volume of applications, and this resulted in long processing times for both assessments and grant claims.

As can be seen in Exhibit 5, the average number of days required to process a grant application increased from 19 days for applications lodged in November 2022, the first month of the program, to 118 days for applications lodged in June 2023, the final month that applications were open. This excludes time where the RAA was waiting for additional information from the applicant. The RAA’s target was to process 80% of applications within 20 days. However, only 13.5% of grant applications for the AGRN 1030 and 1034 program were assessed in this timeframe. The average processing time for applications across the course of the program was 73 days.

The Rural Assistance Authority developed performance measures but there were no indicators for program outcomes

The RAA describes its overall objective as ‘farming businesses and other rural industries are more innovative, productive and resilient due to efficient provision of well-targeted government assistance programs by the RAA’.

To support this, the RAA has developed the following three performance measures that apply across all of the grant programs it administers:

• timeframe to provide RAA assistance to the point of decision for grant applications – 80% of grant applications have a decision in 20 days
• level of RAA customer satisfaction at the point of application – 80% of customers report a positive point of application experience
• level of RAA customer satisfaction post-application – 80% of customers report a positive post-application experience.

The RAA aggregates performance across these indicators for all its grant programs, and the RAA also measures performance against these indicators for its programs individually. While these measures are all valuable in understanding the RAA’s grant administration performance, they do not allow for the outcomes of RAA programs to be evaluated. In particular, they do not consider a program’s impact on the RAA’s overall objective, such as the impact of the program on innovation, productivity and resilience. Measuring the outcomes of a program allows for an agency to determine whether the program has achieved its objective and was an effective use of money.

The timeliness indicator allows the RAA to measure one element of its efficiency by identifying the speed with which grant applications are assessed. However, there is no performance indicator in place to consider the timeliness of claim processing. Developing this performance indicator would allow the RAA to determine more clearly whether claims processing is occurring in a timely manner.

While customer satisfaction with the program was high, the Rural Assistance Authority did not meet its timeliness target

The RAA’s performance against its established targets for customer satisfaction at the point of application and post-application exceeded the targets of 80% of customers reporting a positive experience. To collect information about customer satisfaction, the RAA conducted an online customer survey with each applicant, where applicants were asked to rate their satisfaction with a variety of metrics, including satisfaction with program guidelines and ease of application.

The results of the RAA customer satisfaction surveys are shown in Table 3.

Note that satisfied includes both ‘satisfied’ and ‘very satisfied’ as a response, and ‘unsatisfied’ includes both ‘unsatisfied’ and ‘very unsatisfied’.
Source: RAA customer satisfaction surveys

The results demonstrate that customer satisfaction with the program was high. This includes satisfaction with the processing time of applications which, as noted in the previous chapter, consistently worsened throughout the course of the program.

The RAA also asked about the difficulty of applications and the contract approval process. The results of these surveys are shown in Table 4.

Note that ‘easy’ includes both ‘easy and ‘very easy’ as a response, and ‘difficult’ includes both ‘difficult’ and ‘very difficult’.
Source: RAA customer satisfaction surveys.

The RAA advised that it uses the difficulty of application and difficulty of contract approval results, shown in Table 4, to determine whether it has met its customer satisfaction results of 80% of customers having a positive experience. The RAA aggregates the easy and neutral results to determine whether the target has been met, meaning that even neutral results are considered positive experiences. Calculated this way, 93% of customers had a positive experience at point of application and 96% had a positive experience post application. This calculation means that the RAA exceeded its target of 80% of customers having a positive experience at the point of application and post approval. However, as shown in Table 4, if neutral responses are excluded from this analysis and only ‘easy’ or ‘very easy’ responses are included, the RAA did not meet this target.

The RAA had a target of 80% of grant applications having a decision in 20 days. The RAA advised that this only includes business days and does not include time that is spent waiting for applicants to provide additional information after RAA has requested it. With these rules applied, only 13.5% of grant applications for the AGRN 1030 and 1034 program were assessed within 20 days. It was important for RAA to assess applications in a timely way in order to fulfil the program purpose of providing a timely and proportionate response to the disaster event.

Program performance was regularly reported to the Rural Assistance Authority’s management, allowing it to provide oversight of the program

Each week, the performance of the RAA in the AGRN 1030 and 1034 program was reported to management as a high-level dashboard. This included a review of the number of applications per day, the number of applications completed each day, outstanding cases, customer satisfaction and total funding disbursed through the program. This allowed management to provide a degree of oversight of the program’s performance against its key performance indicators.

In addition, the RAA reported performance against all of its grant programs to its Audit and Risk Committee (ARC) on a quarterly basis. These reports contained an aggregation of the performance across all of the disaster grants being administered by the RAA, including the volume of applications, the completion rates of assessments and the amount of money disbursed. In addition, performance against the three performance indicators outlined above was also reported to the ARC. This reporting allowed the ARC to receive an agency-wide view of grant administration performance.

The Reconstruction Authority is planning to conduct an outcome evaluation for the program

While the GAG does not set out a mandatory requirement for officials to undertake an evaluation of the outcomes of a grant program, it does recommend that agencies make a decision on evaluating based on the value, risk and significance of the grant program. The GAG refers to the NSW Treasury policy TPG 22-22 Policy and Guidelines: Evaluation, which recommends an evaluation of programs valued at over $50 million. Given that the program disbursed $536.5 million, it is reasonable to expect an outcome evaluation to be undertaken as a matter of good practice.

As noted above, the MoU between the Reconstruction Authority and the RAA does not set out the responsibility for undertaking an outcome evaluation of the program. Similarly, there is no responsibility established in the MoU to determine the overall benefits delivered by the program as part of a CBA. Not outlining these responsibilities risks gaps in program evaluation for future grant programs. As a result of this gap, neither agency was assigned initial responsibility for planning an evaluation.

In December 2024, the Reconstruction Authority received approval to undertake an outcome evaluation that will allow it to determine the outcomes achieved by the program. This evaluation is also planned to include an evaluation of the overall benefits and outcomes of the program, an economic evaluation – which will fulfil the purpose of an ex ante CBA, discussed above – and a process evaluation, which will consider how the program has been delivered. In addition, the RAA conducted a process evaluation of the program in August 2023.

Appendix 1 – Responses from audited agencies

Appendix 2 – Program compliance with the Grants Administration Guide

Appendix 3 – About the audit

Appendix 4 – Performance auditing

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Parliamentary reference - Report number #405 released 20 May 2025.

About this report 

The land titles registry is a collection of registers established under the Real Property Act 1900 and related legislation. It is the source of truth for land and property ownership in NSW and underpins significant economic activity.

The registry is owned by the NSW Government. From 1 July 2017, a private operator has operated and maintained the registry under a 35-year concession granted by the NSW Government.

The Office of the Registrar General is the regulator of the private operator’s activity under the concession. It is a business unit in the Department of Customer Service.

This audit examined the effectiveness of the regulator in overseeing and monitoring the operation and maintenance of the registry to ensure its integrity and security.

Conclusion

The Office of the Registrar General has implemented an effective system and supporting processes to oversee and monitor the integrity and security of the land titles registry.

However, the audit found opportunities for the Office of the Registrar General to improve how it conducts its regulatory functions.

Recommendations

The audit recommended that the Office of the Registrar General should:

1. develop and publish its approach to exercising its regulatory functions and powers
2. publish a regulatory charter to ensure greater regulatory transparency
3. review the skills and capabilities required to regulate the land titles registry
4. ensure greater clarity on the rights to use data, and the application of privacy legislation
5. ensure compliance with the NSW Cyber Security Policy, including the requirements relating to third parties
6. perform an audit of the subscriber compliance process.

The land titles registry is a collection of registers that record property-related information

The registers collectively referred to in this report as the ‘land titles registry’ include the:

• Torrens Title Register – the primary register for land held in NSW under the Real Property Act 1900
• Register of Plans – comprises plans, that is a representation of a property’s boundary, submitted for registration by registered surveyors
• General Register of Deeds – established under the Registration of Deeds Act 1825, this was the first land register in NSW recording deeds in the system used prior to the introduction of the Torrens Title System, and includes the register of Causes Writs and Orders, Bills of Sale, Register of Resumptions, Powers of Attorney and other miscellaneous deeds
• Central Register of Restrictions – where participating organisations maintain up to date information about possible, or actual, interests they hold against NSW properties (for example for heritage or infrastructure reasons).

The 35-year concession for a private company to operate and maintain the land titles registry

In April 2017, the NSW Government granted a 35-year concession² to a private operator to operate and maintain the titling and registry services business area of NSW Land and Property Information (LPI). The private operator paid the State $2.6 billion for the concession, as well as committed to pay $8 million (indexed) annually in consideration for the ORG to perform the regulatory and enabling functions contemplated by the concession deed.

The private operator has the right to generate revenue by selling land information products and services, including through search and subscription fees, as well as by charging administrative fees, such as for registering land titles and other transactions. Each year, the operator facilitates over four million searches on titles and images, records 900,000 updates to land title records and creates 50,000 new titles.

NSW Treasury managed the bidding process for the concession and prepared the enabling legislation, the Land and Property Information NSW (Authorised Transaction) Act 2016. The concession deed was executed between the Minister for Finance, the Registrar General and the successful bidder.

The successful bidder was Australian Registry Investments (ARI), which in turn established NSW Land Registry Services (NSW LRS or ‘the private operator’) as a private, single purpose company to operate and maintain the land titles registry. ARI is a consortium of institutional investors and superannuation funds, which at the time of this audit included Aware Super, Macquarie Infrastructure Fund and UTA Registry Investments Trust.

The NSW Government retains ownership of the land titles registry, including the information it contains.

The land titles registry is a critical information asset for NSW as it is the basis of private ownership of property, which in turn supports property-related economic activity. In 2016, it was estimated that the land titles system underpinned over $130 billion dollars of economic activity in NSW each year. As of 2023, the total value of land in NSW was approximately $2.8 trillion.

The land titles registry is a ‘crown jewel’ IT asset under the NSW Government Cyber Security Policy. The land and titling information maintained by the private operator is provided to other government departments and agencies, such as Revenue NSW, Spatial Services and the Valuer General.

A key assurance provided by the NSW Government when granting the concession was that the ORG would be responsible for the regulation of the performance of the private operator under the concession deed. The ORG is a business unit in the Fair Trading and Regulatory Services division of the Department of Customer Service (‘the department’). The Registrar General is a statutory position and has a range of responsibilities, including under the Real Property Act 1900. The establishment of an ‘office’ to support the Registrar General accompanied the granting of the concession in 2017.

The ORG is not a separate auditable entity under the Government Sector Audit Act 1983. As such, the auditee for this performance audit is formally the Department of Customer Service.

NSW Treasury is also an auditee as it managed the scoping study, bidding process, legislation development process and the development of the concession arrangements. NSW Treasury does not have an ongoing role in the routine oversight and monitoring of the land titles registry. The audit has made no recommendations for NSW Treasury and the agency has elected not to provide a formal response to the audit.

Objectives of the concession

The concession deed includes a statement of the Government’s objectives for the concession. These objectives include achieving the following:

a) maintaining the security, integrity, performance and availability of the registers, core assets and core services

b) ensuring the registers are accurate and up-to-date, including that they accurately reflect all registered documents, plans and other matters that are required to be recorded in them

c) maintaining the confidence of the affected parties and the NSW public in the registers and the core services

d) promoting improvements, innovation and increased efficiency, and utilising greater expertise and investment in technology, in the delivery of the core services

e) minimising Torrens Assurance Fund Payments and

f) protecting current competition and the opportunities for future competition in the supply of downstream services by ensuring fair, transparent, predictable and non-discriminatory dealing by the operator with customers and prospective customers.

The deed also includes the private operator’s acknowledgment and agreement that its achievement of these objectives is of critical importance to NSW.

Regulation of the land titles system, including under the concession deed

The ORG has described its role as ‘... a regulator, advisor and litigator, working to ensure the integrity of NSW’s land title system’. While the ORG directly regulates the private operator of the land titles registry under the concession deed (as well as in accordance with any applicable legislation and delegations made by the Registrar General), the system of land titles is a complex one, with many different participants. These participants include:

• ELNOs – which provide the means for transacting parties to collaborate electronically on the preparation of registry instruments; there are currently two ELNOs operating in NSW, although PEXA is by far the dominant market participant compared to its competitor, Sympli
• subscribers – a person or business authorised to complete electronic conveyancing transactions using an ELNO, such as financial institutions, solicitors and licensed conveyancers
• government agencies – selected NSW government agencies and local governments are authorised to obtain information from the system, including Revenue NSW, Valuation NSW, the Surveyor General and local councils
• registered surveyors – who are responsible for conducting survey plans of property boundaries and lodging those plans for registration with the private operator
• information brokers – there are 12 wholesale information brokers with which the private operator has entered into agreements under the concession deed to provide access to NSW titling information held by the private operator
• users of the Central Register of Restrictions – including selected NSW government agencies and non-government entities, such as utility companies providing electricity, water and gas and the Commonwealth Department of Defence.

The data flows within the system are complex and interdependent. Many of the participants are critical to maintaining the integrity and security of the land titles registry. Each class of participant has different governance arrangements and controls for their participation. As shown in Figure 1, the ORG regulates and oversees, to varying degrees, this system of multi-layered rules, relationships and arrangements, with the concession deed between the NSW Government and private operator being at the core of the system.

In granting the concession, the government committed to a ‘robust regulatory regime’ and a ‘tight regulatory framework’ overseen by a ‘strong regulator’

In granting the 35-year concession to the private operator, the NSW Government committed to ensuring that the monopoly functions of providing titling and registry services would be ‘appropriately regulated’.

In commencing the process of granting the concession, the NSW Government set out what it described as a ‘robust regulatory regime’ that would apply to the concession. Of particular relevance to this audit, the government also established that:

• the Registrar General would monitor and enforce the operator’s compliance with regulatory requirements, including the terms of the concession deed
• the Registrar General would have a general power to direct the private operator to perform tasks ‘… in the public interest’.

In the September 2016 second reading speech accompanying the passage of the enabling legislation for the concession through NSW Parliament, the then Treasurer further highlighted that:

• the service standards defined in the concession would include ‘… a penalty regime should the private operator fail to comply’
• the Registrar General would have regulatory oversight of ensuring that the private operator adopted ‘appropriate data security and fraud detection practices’.

The second reading speech also highlighted the role of the Registrar General in overseeing how other participants in the land titling and registry system should perform. This included approving the standard terms on which the concession holder is to deal with its wholesale customers and intermediaries (including ‘subscribers’ to the operator’s services, such as banks, conveyancers and solicitors).

In January 2017, the then Registrar General explained his view that the arrangements for the concession would ensure that the ORG would be able to provide an ‘… independent, credible, stable and well mandated regulatory framework [that] will give confidence to customers and the business itself’. He further explained that:

On 6 April 2017, the then Registrar General further said that his office would follow a ‘modern regulatory approach’, which would include a ‘… focus on material things – where an operator’s actions are not in the spirit of the deed’s objectives’. The audit did not find evidence of how the ORG assesses deviation from the ‘spirit of the deed’s objectives’.

On 12 April 2017, the Premier and the Treasurer jointly announced the successful bidder for the concession. In doing so, their media release drew attention to the:

• ‘tight regulatory framework’
• ‘rigorous legislative and contractual safeguards around the concession to ensure the continued security of property rights and data’
• establishment of a ‘… new external regulator – the Registrar General – to enforce [the operator’s] performance during the concession, with power to monitor and audit performance, and even resume control of the LPI business if required’.

The Registrar General was not a newly established statutory position, although the role was provided with new regulatory functions and powers under the concession deed.

The task of overseeing and monitoring a private company operating and maintaining a monopoly service that uses government-owned systems (and where title is government-guaranteed) poses new and complex challenges for a regulator like the ORG, which previously performed stable and mature administrative and regulatory functions.

The ORG has made only limited use of the compliance and enforcement tools available to it under the concession deed

Seven years into the concession, the ORG is still in the relatively formative stages of settling its approach to the use of its regulatory powers under the concession deed.

The ORG has an experienced and highly qualified workforce, with substantial capability in areas such as property law, as well as a directorate focused on cadastral integrity. It has substantial capacity to administer its longstanding and relatively wide-ranging pre-concession responsibilities. This includes actioning matters under the Torrens Assurance Fund, conducting compliance audits of property plans prepared by registered surveyors and providing advice to government on relevant policy and reform.

In comparison to these longstanding, well-organised and well-understood responsibilities outlined above, the ORG is still forming its approach to exercising the full spectrum of its compliance and enforcement powers under the regulator–operator model. In some instances, this has limited its effectiveness in resolving regulatory issues raised later in this report.

The ORG has eight regulatory compliance and enforcement options available to it under the concession deed and the enabling legislation. The options are listed below, ranked according to their seriousness and frequency, with step-in and termination powers being both the most serious and least likely option to be applied:

• raise issues at governance forums
• informal letters escalating to formal letters
• approvals with conditions attached
• audit and review powers
• financial penalties for breach of service levels
• reserve power directions
• corrective action plans
• step-in and termination powers.

These options can be specific to circumstances and not all are available for all matters. For example, the ORG does have not a broad-based power to issue financial penalties for performance gaps except where specified in the concession deed.

Since the commencement of the concession, most issues with the private operator’s performance have been addressed without escalation beyond the exchange of formal letters. However, this approach has not always led to adequate or timely resolution.

A number of longstanding issues have been raised by the ORG regarding plan examination and subscriber compliance audits, as set out in section 5 of this report. Despite their significant importance to the integrity of the land titles registry and the potential for errors with financial and personal impacts on customers, these matters have not generally been escalated beyond discussions or letters.

The ORG does not have a formalised approach to how it will routinely and effectively exercise its compliance and enforcement functions and powers

The audit assessed whether the ORG has a clear statement of its regulatory posture or its approach to regulation on which to base its regulatory decision making. In its ‘Regulation insights’ report (March 2024), the Audit Office of NSW highlighted that regulators need clear escalation thresholds and enforcement policies to promote credible and proportionate regulatory actions. The concession deed sets out that the materiality of service level breaches is determined based on the operator’s culpability, the impact on the customer and whether the breach has occurred previously.

The ORG lacks a clear approach to how it would effectively exercise the regulatory tools available to it under the concession, such as:

• requiring ad hoc reports that are prepared in a timely manner and to an adequate standard
• issuing penalties for non-compliance
• conducting its own audits
• conducting a major review of the concession (the prospect of which was raised by the ORG with the private operator in 2022 but has not proceeded).

This is despite assurances (as described earlier) from the NSW Government at the commencement of the concession that these tools would be available and used by the regulator.

In September 2023, the ORG developed an initial approach to the use of concession deed levers to provide a ‘practical and proportionate approach’ to exercising its monitoring and oversight functions for the concession. However, neither these principles, nor any alternative, have been drawn upon to inform a codified regulatory or enforcement policy. The ORG advised that it is developing an approach to escalating matters through the hierarchy of available regulatory and enforcement tools.

The ORG is spending less on its regulatory functions than the fee paid by the private operator to support those functions

Under the concession, the private operator provides an annual indexed fee to fund the services delivered by the regulator. The concession deed says that this fee is paid ‘… in consideration for the [Registrar General] performing the regulatory and enabling functions contemplated by this Deed’.

In 2017–18, $8 million was allocated in the NSW Budget ‘… to be spent on regulating the operator of the NSW land title and registry system, ensuring its security and stability while enhancing service levels’.

In 2023–24, the department requested from NSW Treasury a budget of $8.26 million for the ORG, ($260,000 more than the 2017–18 allocation). This was also around 25% less than the mandatory fee paid by the private operator under the concession deed, which was $10.49 million. The balance of the fee paid by the private operator is retained by the NSW Government in the Consolidated Fund for general purposes.

The ORG undertakes a range of policy and reform projects that it tracks separately from its ‘business as usual’ activities. Not all these projects were envisaged when the concession was granted. For example, the interoperability project to support the introduction of national competition in the electronic lodgment network (ELN) is a substantial and complex national reform that has been led by the ORG on behalf of NSW.

NSW’s contribution to this project-based work is undertaken effectively within the same budget parameters and staffing as established when the concession was granted. At the time of the audit, the ORG’s project workplan includes 32 distinct projects, with one additional recent project being reclassified as ‘business as usual’ and two previous projects put on hold. The project plan includes activities relating to significant government reforms such as interoperability and digital survey plans reform, as well as matters that are regulatory in nature or which support regulatory priorities.

The audit heard from some stakeholders that the ORG’s focus on project-based work, including government reform initiatives, risks reducing resources available for its functions to monitor and oversee participants in the land titles registry system to the degree anticipated by government when the concession was granted.

As discussed in sections 6 and 9 of this report, this audit found that the ORG has capability and capacity gaps in specialist skills, particularly in strategic IT and regulatory policy and implementation. It is beyond the scope of this audit to consider whether these gaps could be addressed within the existing funding or whether the ORG required a revised budget that more closely aligns with the fee paid by the private operator.

The complexity of the land titles system limits the extent to which the ORG can oversee potential integrity and security risks on a whole of system basis

The ORG has varying approaches, powers and functions to regulate different participants in the land titles system, the complexity of which is increased by various third-party users and reseller arrangements that apply to land titles data. As discussed later, this complexity limits the ORG’s direct monitoring and oversight of potential risks or non-performance by system participants other than the private operator.

Table 1 provides further information on the regulatory arrangements for stakeholders accessing and informing the land titles registry.

Source: Audit Office analysis.

The ORG does not have a longer-term strategic plan for proactive compliance activities

Since December 2018, the ORG has issued the private operator an annual letter setting out ‘joint priorities’ for the forward year. While each letter is signed and issued by the Registrar General, the private operator has the opportunity to comment on proposed ‘joint’ priorities.

The annual priority letters are not issued under the terms of the concession deed and are statements of the regulator’s expectations, rather than binding obligations on the operator. The priorities are derived primarily from internal staff consultation, but also consider external stakeholders, existing or emerging reform topics, and progress achieved in meeting previous priorities. While the letters set out annual priorities, they are also intended to ‘… track progress on long-term objectives’.

These annual priority letters are effective in demonstrating a considered approach to articulating the regulator’s expectations of the private operator for that period. The ORG sets out specific ‘success measures’ (usually in the form of milestone progress or completion dates) for how priorities will be assessed.

The priorities set out in the annual letters are subsequently discussed and tracked at various governance meetings, as required under the concession deed. However, there have been few consequences if the private operator does not meet its priorities. Over the course of the concession, a number of reoccurring priorities point to intractable issues, about which the ORG has been dissatisfied. This has included matters that go directly to the integrity of the registers, such as the examination of submitted plans and subscriber compliance (particularly as assessed by the subscriber compliance examination process).

Until recently, the ORG did not include its own annual priorities in these letters. Rather, yearly priority letters to the private operator referenced government or joint priorities. In comparison, the most recent priority letter for 2025 provided a clearer articulation of the rationale between the annual priorities and the intended outcomes of the concession deed. The audit did not source evidence that the ORG set longer-term or strategic priorities for how it will proactively exercise its regulatory functions, such as a forward program of compliance activity, ad hoc reviews or audits.

The ORG ensures that the private operator meets its obligations to provide service level performance reporting

The concession deed provides for extensive performance reporting by the private operator against defined service levels or KPIs. While government statements at the commencement of the concession suggested there were 55 KPIs, this is inaccurate as it includes numerous sub-measures. Currently, 14 service level KPIs are reported quarterly on the ORG’s website. The publishing of service level performance has been explained by the ORG as bringing ‘… a new level of transparency to the NSW’s land titles registry’ to better hold to account the private operator and be a feature of the new regulator–operator model.

The private operator exceeded all published services for each of 24 consecutive quarters from the start of the concession until January–March 2024. This may suggest that the existing published service levels are not sufficiently challenging to support continuous improvement in the future. In addition, as discussed below, not all service level KPIs are published.

The ORG has proposed a review of service levels to identify those no longer relevant. This considers the substantial reforms to the land titles registry system have occurred since the concession commenced, including the move to 100% electronic conveyancing. Stakeholders also expressed a view to the audit that the existing published service levels are too focused on time measures, and do not sufficiently address quality and client satisfaction. It was also understood between the regulator and private operator early in the concession that ‘… as we move forward, customer behaviour will change, along with what is important to customers’.

The ORG has granted penalty relief for service level breaches, although there has been no public transparency about these decisions

There have been instances where the ORG has elected not to issue financial penalties where the private operator breached required service levels. While this discretion is a matter for the regulator to exercise, public transparency is lacking as to the underlying breach or the penalty decision. Service levels not achieved are not included among those published on the ORG’s website.

For example, from October 2020 to September 2023, the ORG granted penalty relief for 33 breaches of the private operator’s obligation to ensure specific data feeds to NSW Government agencies and local councils occurred within specified timeframes.³ A series of data feed failures in a legacy IT system was the catalyst for the private operator’s failure to meet the service level. The audit notes that the private operator’s interpretation of the relevant service level varied from the ORG’s interpretation, and suggested a smaller number of breaches than the 33 assessed by the regulator.

This penalty relief was initially granted in October 2020, then extended in May 2022 until September 2023. The ORG granted the penalty relief:

• in recognition of the private operator’s commitment to upgrade the legacy IT system causing the data feed failures
• because the ORG considered the impact on affected customers to be negligible.

As early as December 2019, the ORG had identified to the private operator that upgrading the legacy IT system was a priority. In August 2020, the ORG described the upgrade as ‘… critical to ensure accurate and complete data is provided to customers’ and asked the private operator to ensure that it is completed ‘… without further delay’.

The ORG did not extend its penalty relief beyond 30 September 2023. No breaches were reported to have occurred after this time. The upgrade to the legacy IT system is expected to be completed no earlier than January 2025.

The service level that was not met on up to 33 occasions is not included among the 14 service levels reported publicly on the ORG’s website. There was no public transparency about the operator’s non-compliance, or the ORG’s decision to provide penalty relief to the operator. The ORG did not publish a notice that it had afforded penalty relief to the operator, nor was this mentioned in the department’s annual report. The ORG’s view is that publication of these service level breaches was not required as they only affected government agencies.

This audit has not assessed the merits of the ORG’s evaluation of the service level breaches or its decision to extend penalty relief for non-compliance. The concession deed allows the ORG to make these types of decisions. However, when the concession commenced, the NSW Government stated that a consumer benefit of the concession would be ‘increased transparency’ due to the regulator being able to:

Prior to the concession, it was already the Registrar General’s practice to publish statistics about claims and payments under the Torrens Assurance Fund in the department’s annual reports. Since the concession, the only opportunity for increased transparency is through reporting on service levels and breaches, including about how the ORG responds to breaches, such as by extending penalty relief over extended periods of time.

When the concession commenced, the NSW Government also highlighted that, as the regulator, the ORG would have a range of regulatory options including ‘… a penalty regime should the private operator fail to comply’. The community and stakeholders were not told that the ORG could choose to waive penalties in response to breaches. Nor were the community and stakeholders told the circumstances in which such relief might be extended. This underscores the importance of the ORG being publicly transparent when it makes these decisions, including to explain their justification, so as to ensure that community trust and confidence in the regulator is maintained.

The ORG’s monitoring and oversight of how the private operator manages legacy IT systems is discussed further in section 6.

The detailed terms of the concession are not publicly available and there is a statutory presumption against their disclosure under the Government Information (Public Access) Act 2009

Much of the substantive detail about the regulatory requirements for granting the concession is contained in the concession deed document that was executed between the NSW Government and the private operator. This document is not public. Moreover, the enabling legislation for the concession included an amendment to the Government Information (Public Access) Act 2009. This amendment established that it is to be conclusively presumed that there is an overriding public interest against disclosure of information contained in any document ‒ including the concession deed ‒ prepared for the purposes of, or in connection with, the authorised transaction unless approved by the NSW Treasurer. NSW Treasury was not able to provide an explicit reason why this provision was included in the enabling legislation, other than to note that a similar provision was included in the 2015 electricity network transaction enabling legislation.

Key elements of the concession deed were modelled on the arrangements for the franchising of the Sydney ferries service, including:

• the model for service levels and penalties
• the transfer of administrative powers and functions to the operator
• the approach of adopting minimalist legislation supported by a detailed contract.

This framework is also similar to that adopted for the Greater Sydney Bus Contract. Both contracts (ferries and buses) are publicly available on Transport for NSW’s website (with redactions where necessary to maintain commercial confidentiality).

During consultation on the enabling legislation for the concession, external stakeholders noted that the delegation of key provisions to a confidential document detracts from promoting transparency and community confidence in the regulatory arrangements for the concession.

The ORG has not published a ‘regulatory charter’ as provided for under the concession deed

Clause 29.1(b) of the concession deed provides that the ORG may publish a ‘regulatory charter’ that contains:

• the division of responsibilities between the ORG and the private operator
• ring fencing and non-discrimination requirements
• dispute resolution processes
• the ORG’s rights in relation to reserve power directions
• the ‘customer terms’
• obligations in respect of ELNOs
• complaint handling arrangements.

The ORG has not published a regulatory charter, although some of the content envisaged by clause 29.1(b) is available across the ORG’s website. For example, the ORG’s website provides information about how individuals may apply to have a decision of the private operator reviewed by the ORG.

The ORG reviews an annual customer satisfaction survey conducted by the private operator, which has reported increased rates of satisfaction over the term of the concession

Regarding other measures of performance, the concession deed requires the private operator to conduct an annual customer satisfaction survey. The private operator has reported to the ORG improved levels of customer satisfaction with its services. While the audit has not assessed the survey data, the private operator has reported in its most recent survey that 71% of respondents were satisfied, up from around 50% at the start of the concession. Over the duration of the concession to date, these surveys have been run both internally by the private operator, and more recently by an external survey provider commissioned by the operator.

The private operator is also required to submit at regular intervals (annually or up to 18 months) updates to its technology roadmap and business plan. These documents are assessed by relevant subject matter experts within the ORG or the wider department and feedback is provided to the private operator on their adequacy. For example, a range of annual reporting requirements for FY23 relating to fraud and crime prevention, error reports, business continuity and incident management, and the technology roadmap were provided to Department of Customer Service IT for review.

The ORG has implemented an effective governance structure to support its regulation of the land titles registry system

The ORG has implemented a series of forums with the private operator to discuss strategic and operational matters. As required by the concession deed, these are:

• a Joint Consultation Committee (JCC)
• an Operations and Performance Committee (OPC)
• an Information Technology sub-committee (ITC).

The concession deed specifies that this governance framework is intended to:

• guide and monitor the performance of the concession
• oversee compliance with specified service levels
• resolve issues as required
• establish a framework to maintain an effective relationship between key personnel of the ORG and the operator.

These committees have clear terms of reference, which have been subject to review. The ORG has demonstrated, through meeting papers and minutes, that these committees meet regularly, consider substantive matters as envisaged by the concession deed, and are effectively administered and recorded.

The ORG has also established a stakeholder forum that includes senior representatives of key stakeholder groups. This forum is intended to foster multilateral communication between the regulator, operator and stakeholders. Some stakeholders expressed the view to the audit that the focus of this forum has evolved to facilitate feedback and updates from the regulator and operator, rather than provide opportunities for industry stakeholders to ask questions or raise issues. Notwithstanding, the ORG did provide evidence that issues raised by stakeholders at this forum were subsequently escalated to JCC or OPC meetings.

The ORG also has a series of bilateral regular engagements with key stakeholders, as well as specialist or project based working groups with the private operator and other system participants.

The ORG appropriately manages potential conflicts of interest

The ORG has recognised that the separation of the former Land and Property Information unit of the Department of Customer Service into separate regulator and operator entities meant that staff working in each entity may have close pre-existing professional and personal relationships. This heightens the need to identify and manage potential conflicts of interest to ensure credible and transparent regulation.

The ORG manages conflicts of interest by following applicable department policies. The audit reviewed conflict of interest declarations made by all ORG managers at NSW public service clerk levels 11/12 and above for the past three years. The audit found that declarations had been submitted and any conflicts addressed.
 

³ The breaches were of the ‘Core Data for Government Agencies Service Level’, which measures the number and availability of Core Data supplied to certain Government agencies that the operator successfully provides within required timeframes and hours of availability.

The land titles registry system is multi-party, with different powers and tools available to the ORG for each party. In summary, the ORG can address non-performance to varying degrees over:

• the private operator, through the multi-tiered framework described under section one of this report
• the ELNOs, which may be subject to suspension or termination (neither of which are practical options if the system is to function), as well as compliance examinations, remedial directions and application to the NSW Supreme Court for financial penalties
• authorised subscribers, who may have their access to the ELN suspended or cancelled (this regime is currently under review to broaden the Registrar General’s enforcement options)
• registered surveyors, who may be referred to the Board of Surveying and Spatial Information (BOSSI) for professional disciplinary action.

The number of claims and the total annual payments under the Torrens Assurance Fund have declined since 2014–15

The Torrens Assurance Fund (TAF) is a statutory compensation scheme designed to compensate people who, through no fault of their own, suffer loss or damage as a result of the operation of the Real Property Act 1900. This loss or damage can be a result of an error, misdescription or omission in the register. When granting the concession to the private operator, the government gave the assurance that the TAF would continue to operate and be administered by the ORG. The ORG has a longstanding function to receive and determine claims made under the TAF.

Relative to the number and value of matters addressed by the land titles system, the number of claims and total payments paid under the TAF is relatively small. As shown in Figure 2, between 2014–15 and 2022–23, the number of claims varied between seven and 40, while the payments paid under the TAF varied between $93,032.21 and $3,168,143.

This audit has focused on two primary processes when considering how the ORG obtains reasonable assurance about the quality of information held on the registers maintained by the private operator. These are:

• the examination and registration of plans by the private operator
• the registration of dealings by the private operator.

The concession deed requires that the private operator, in undertaking these functions, must, among other things, act in good faith, as well as act reasonably and on reasonable grounds. In each case, plans and documents must be entered promptly and accurately onto the relevant register.

These two processes and their role in supporting the integrity of the land titles registry are discussed in turn below.

The land titles registry is one of the department’s IT ‘crown jewels’

As the principal department for the ORG, the Department of Customer Service has identified the IT system supporting the land titles registry as a ‘crown jewel’ under the NSW Government Cyber Security Policy. Classification as a crown jewel provides the land titles registry with priority within the department when investment, fixes, patching and resource allocation are considered.

The ORG receives dedicated cyber security support from the department’s Office of the Chief Information Security Officer in the form of an identified business support officer. During the audit there did not appear to be a similar dedicated resource from the department’s general ICT division. The ORG has stated that the lack of dedicated support in this area risks that ‘institutional technology expertise is not built up or retained within Government to effectively monitor the [operator’s] management of this asset’.

However, from October 2024, DCS ICT has provided the ORG with a dedicated business partner who attends monthly meetings to discuss ICT matters and attends ICT Committee meetings on an as-needed basis.

While the IT system supporting the land titles registry is a critical IT asset, it is unclear how roles and responsibility are assigned for ensuring compliance with the NSW Government Cyber Security Policy

The NSW Cyber Security Policy provides guidance and mandatory requirements for agencies relating to cyber security. The ORG could not clarify whether it, or the department more widely, is responsible for ensuring compliance with the NSW Cyber Security Policy, as well as the role expected by the private operator. This creates a potential risk that protections contained in the policy will not be extended to the land titles registry and that there may be gaps in accountability.

The 2023–24 version of the policy contains three requirements relating specifically to crown jewels:

• agencies to identify and document external upstream and downstream dependencies of enterprise ICT (including cloud), operational technology and Internet of Things assets (specific requirement 1.6.4)
• agencies must assess and identify crown jewels and classify systems (mandatory requirement 1.7)
• agencies must conduct periodic reconciliation of data assets against data retention requirements (specific requirement 1.8.2).

The department appears to have complied with mandatory requirement 1.7, in that it has identified the land titles registry as a crown jewel. However, it explained that it did not have visibility or control over the upstream and downstream systems used by the private operator. Accordingly, to the extent that it may be responsible, the department acknowledged that it does not comply with specific requirement 1.6.4. While it was not specifically examined, the audit did not receive any evidence that the department complied with specific requirement 1.8.2.

While the department is not fully compliant with the requirements of the NSW Cyber Security Policy, its view is that:

• the concession deed requires the private operator to maintain technical and organisational measures that are no less rigorous than those that applied prior to the concession
• the cyber security measures taken surpass those that would apply under Department of Customer Service policies
• the regulator retains oversight of the private operator’s compliance with its requirements under the concession.

Notwithstanding these assurances, neither the department, nor the ORG itself, provided any evidence demonstrating that the protections provided by the private operator have been reconciled against all the requirements of the NSW Cyber Security Policy, including the specific clauses that apply to crown jewels. As discussed below, neither the department nor the ORG have considered the implications of the private operator being deemed a ‘third-party service provider’ under the NSW Cyber Security Policy.

The NSW Cyber Security Policy allows that not all its requirements must be uniformly implemented across the agency. However, where an agency seeks an exception to the policy, it should ensure that the exception is ‘… documented and approved by an appropriate authority through a formal process’. The ORG did not provide evidence that any exception to the requirements of the Cyber Security Policy (such as non-compliance with specific requirement 1.6.4) had been documented and approved.

The ORG has determined that the private operator is a third-party service provider under the NSW Cyber Security Policy, although the implications of this have not been fully examined by the ORG or the department

During this audit, in November 2024, the ORG obtained advice from Cyber Security NSW that the private operator is a ‘third-party service provider’ under the NSW Cyber Security Policy. The policy has a number of specific requirements relating to third-parties.

Mandatory requirement 1.10 of the NSW Cyber Security Policy requires agencies to ‘identify and manage third-party service provider risks, including shared ICT services supplied by other NSW Government agencies’.

Section 6.12 of the Cyber Security Policy provides agencies with guidance on their responsibilities for managing the cyber security requirements and risks posed by third-party providers to assist agencies implement mandatory requirement 1.10. This section includes responsibilities such as:

• ensuring third-party risks are considered in enterprise risk management processes
• conducting regular management of third-party risks through ongoing risk-based reviews to verify compliance with contractual agreements and security measures.

The designation of the operator as a third-party service provider to the ORG is a recent classification and the implications of this have not been fully considered by the ORG or the department.

The ORG has ensured that cyber security obligations are included in the private operator’s arrangements with its own contractors

The audit also considered what assurance the department or the ORG has obtained regarding the adequacy of cyber security provided by contractors to the private operator. Clause 39 of the concession deed establishes that:

• the private operator must ensure that its third-party service providers and subcontractors comply with all terms of the deed relevant to the operator’s obligations, including to maintain adequate cyber security
• the private operator is liable for all acts and omissions of its subcontractors.

The ORG and the private operator have agreed to a process whereby the latter notifies the regulator when new subcontractors are engaged and provides assurance that subcontractors comply with the requirements of clause 39.

The ORG has also approved a table of clauses that must be included in any subcontracting agreements that the private operator makes with its own third parties. These clauses include obligations for adequate cyber security.

The ORG has ensured security testing is conducted on the core systems and services of the land titles registry

The concession deed imposes requirements on the private operator relating to the security of the land titles registry, including that the private operator must:

• ‘… establish, maintain, enforce and continuously improve reasonable technical and organisational measures’ across a range of specific areas aimed at protecting data and preventing unauthorised access and use
• maintain technical and organisational measures that are no less rigorous than those the land registry was subject to prior to the concession
• engage in third-party audits in relation to its compliance with the applicable information security standard (ISO 27001), and provide these reports to the ORG.

The ORG has relied on subject matter expert advice from within the wider department to determine that the private operator is satisfying these requirements, including by providing third-party certification of its compliance with ISO 27001. The ORG provided evidence of this certification.

Clause 25.1 of the concession deed requires that the private operator must, to the extent reasonably requested by the ORG, test and evaluate the performance of core systems and services, which may include security testing such as ‘… vulnerability testing, penetration testing, manual configuration tests and reviews, self-assurance testing and other vulnerability and threat assessment testing’. This testing and evaluation has included assessment of the operator’s controls relevant to the System and Organisation Control 2 (SOC 2) Security and Availability Trust Services Criteria.

The ORG has ensured that the private operator has completed ISO2001 certification and has conducted SOC 2 assessments. Relevant materials are reviewed by subject matter experts from both the ORG and broader department and discussed at ITC meetings. This audit reviewed a sample of SOC 2 documents and found no significant weaknesses.

Consistent with clause 25.1 of the concession deed, the ORG has also required the private operator to conduct a program of penetration tests on its systems. Penetration testing is a useful mechanism for assessing the potential vulnerabilities of an IT system. However, penetration testing does not offer assurance of the security of a system. Reasonable assurance can only be derived by the effectiveness of security controls, including those implemented to address any vulnerabilities identified by penetration testing.

The ORG assesses and monitors how the private operator responds to vulnerabilities identified by its penetration testing program. The ORG reviewed test reports and discussed these with the private operator during ITC meetings. However, the effectiveness of this monitoring has been hampered by the ORG’s lack of a central registry of issues or vulnerabilities. This limits the ability of the regulator to easily monitor trends and risks or review historic issues.

The concession deed does not specify minimum acceptable standards for the conduct of penetration testing or other forms of system test. Moreover, it is the private operator that is responsible for conducting the testing. When the ORG reviews the results of the operator’s security testing, it also has the opportunity to assess the adequacy of the design and conduct of the tests (including to ensure that the scope and timing of each test provides adequate assurance that vulnerabilities have been identified).

However, as security testing is a requirement of the concession deed, the ORG – as the regulator and consistent with regulatory good practice – should be clear about its expectations for what constitutes appropriately rigorous test methods. These expectations should be effectively and proactively communicated to the private operator, and not left to be raised in retrospective review comments.

The ORG has become increasingly focused on potential risks posed by aging legacy IT systems and how any risks should be mitigated

When granting the concession, the NSW Government’s stated expectation was that the private sector would ‘… have strong incentives to invest in new technology, resulting in significant improvements to the system, and benefits for consumers’. There was an expectation at the outset of the transaction that the successful bidder would, at some time, ‘refresh’ the existing legacy IT systems on which the land titles system operates. While unspecific at the time, a system refresh could include either upgrade or replacement.

However, it was not clear in the bidding documents exactly when and how a successful bidder would be required to address the risks from legacy IT systems. The Information Memorandum provided by NSW Treasury to potential bidders noted that the expected response of the successful bidder:

Commitments to replace legacy systems were included in the private operator’s business plan and technology roadmap submitted as part of its bid, with the business plan committing to the ‘decommissioning of legacy systems by the end of 2019’.

The private operator has ‘de-risked’ some parts of the legacy environment, including the Historical Land Records Viewer and its website, and is currently working (albeit to a delayed schedule) to upgrade a key system, the Integrated Property Warehouse (IPW). However, the replacement of legacy systems ITS (Integrated Titling System) and DIIMS (Document and Integrated Imaging Management System) was removed from the operator’s 2023–24 technology roadmap. An external strategic technology review commissioned by the ORG in 2023 recommended to the regulator that the operator should be asked to re-include this work in future roadmaps. This was so that a ‘complete risk assessment and project complexity, cost and delivery schedule’ could be understood.

While the matter had been raised previously, it appears that since 2023, the ORG has become increasingly concerned about the private operator’s management of legacy IT systems. The ORG has noted that the private operator has not conducted discovery work or risk assessments on these systems. In 2023, the ORG assessed the removal of ITS discovery work from the 2023–24 technology roadmap as ‘highly concerning’ and noted that it would, in response, ‘… consider the full range of levers under the Concession Deed’.

In July 2024, after considering an ‘escalated regulatory response’ to the operator’s perceived reluctance to conduct its own risk assessment, the ORG determined to initiate its own risk-based review of the longevity of the legacy core systems in conjunction with Department of Customer Service ICT personnel.

This performance audit has not assessed the risks posed by legacy IT systems and notes that such questions can raise complex technical issues. It is not necessarily the case that a legacy system is inherently insecure and there is evidence that the private operator has conducted work to insulate the core legacy systems from potential risks. Accordingly, the audit has made no finding about any level of risk posed by the legacy systems underpinning the land titles registry.

The approach taken by the ORG from July 2024 seems consistent with guidance published by the Australian Signals Directorate and the Australian Cyber Security Centre. This guidance highlights the need for agencies to implement a sound strategy to manage legacy IT, starting with developing an understanding of the business and security risks posed by such systems.

The ORG has recognised the importance of privacy to retaining confidence in the land titles system and actively addresses privacy issues with the private operator

The registers operated and maintained under the concession deed are public registers. That is, they can be accessed by anyone (in some circumstances, after the payment of a fee). While there are public interest reasons for this information to be publicly available, public registers can create a tension with individual privacy, where the information held in a register is personal identifiable information about an individual.

This tension can be exacerbated when it is compulsory to record information in a public register, thereby reducing the individual’s choice and control over their personal information. In some circumstances, it has been found that community concerns are exacerbated where public registers are operated and maintained by the private sector, for example, when the UK Government considered privatising its land titles registry.

In its privacy policy, the private operator of the NSW land titles system explains that the personal information that it may collect can include:

• name, address, age or date of birth, contact details
• information collected in connection with maintaining the various registers, including information about an individual’s property dealings, such as transfer and leasehold documents
• information related to the operator’s products or services, such as credit card or bank account details
• verification of identity information, such as passport information, rates notices, Medicare card details and drivers licence details.

In recognition of the privacy risks inherent to public registers, and the potential volume of personal information collected, privacy issues are recognised and discussed between the ORG and the private operator, including at JCC meetings between the Registrar General and the chief executive officer of the private operator.

For example, the ORG recognised a potential privacy risk in how the private operator was collecting information for its subscriber compliance audit process. This resulted in the ORG requiring the private operator to put in place a more secure method for collecting this information. Similarly, the private operator itself identified a potential privacy issue regarding the length of time it retained personal information for the same process.

As discussed below, privacy is also considered by the ORG in regard to new non-core service proposals from the private operator.

New services proposed by the private operator are subject to approval by the Registrar General and have been subject to privacy impact assessments

Privacy risks inherent to public registers can become greater where there are pressures to use that information for purposes unrelated to the original purpose of the public register (‘function creep’).

It was explicit in the NSW Government’s announcement regarding the granting of the concession that it was expected, not just permitted, that the private operator would identify, develop and deliver additional services using information collected for the purposes of the registry, while ensuring appropriate recognition of potential privacy concerns.

The concession deed has a mechanism requiring ORG approval of proposed new ‘non-core services’ by the operator. Since the concession was made, there have been four additional non-core services approved. These have each been accompanied by a privacy impact assessment prepared by the private operator and at the instigation of the operator. The ORG does not have standards for an acceptable privacy impact assessment other than the assessment should be prepared by a ‘reputable organisation’. Guidance published by the NSW Privacy Commissioner is that, where possible, privacy impact assessments should be published, which has not been the case for those assessed by the ORG (although commercial and competition issues around potential new information products could offer a justification for not publishing).

The audit assessed a sample of privacy impact assessments submitted to the ORG by the private operator. Consistent with the NSW Privacy Commissioner’s guidance, the assessments were found to be fit for purpose, in that their size and scope appeared consistent with the inherent assessed risk. The same guidance highlights that privacy impact assessments should be more than just compliance checks. This good practice advice is similar to that published by the Australian Office of the Information Commissioner.

The ORG has developed a template for assessing new non-core services. The template requires ORG staff to consider a range of issues, including privacy, when new non-core services are proposed by the private operator.

The ORG has limited visibility of how effectively other system participants ensure privacy of personal information

The ORG maintains a regulatory role over the operator. However, there are numerous other system participants who could adversely impact the integrity and security of the registry, including by impacting the privacy of personal information (whether deliberately or incidentally). The extent of the ORG’s regulatory oversight and powers varies according to the type of system participant.

For example, the ORG has powers under the concession deed to regulate the private operator directly, although it relies on the private operator to conduct compliance activities for subscribers. Its range of regulatory enforcement options also vary between system participants. Similarly, the concession deed provides for the ORG to issue penalties against the private operator, although not against subscribers or surveyors for non-compliance with their respective obligations.

In December 2018, the then Registrar General nominated a ‘joint comprehensive review of all potential privacy risks to LRS’ as a priority for the coming year to be completed by December 2019. By July 2019, minutes of the JCC record this priority as ‘deferred’. Subsequently, a comprehensive review of privacy risks has not been conducted. Such a review may assist in better understanding any potential system-wide privacy risks to the land titles system.

The ORG and NSW Treasury offered strong public assurance at the start of the concession that statutory privacy protections would apply to the land titles registry

The handling of personal information by NSW Government agencies is regulated by the Privacy and Personal Information Protection Act 1988 (PPIP Act). As well as setting out privacy principles with which NSW government agencies are required to comply, the PPIP Act also provides a statutory right for individuals to take complaints about the handling of their personal information to the NSW Privacy Commissioner, who may make binding decisions on agencies. The PPIP Act does not generally extend to private sector companies.

While NSW government agencies are covered by the PPIP Act, most private sector companies in Australia (as well as most Commonwealth government agencies) are covered by the Commonwealth Privacy Act 1988 (Privacy Act). The Privacy Act contains similar protections to the PPIP Act, although the regulator and dispute handler is the Australian Privacy Commissioner. Unlike the NSW Privacy Commissioner, the Australian Privacy Commissioner may make an enforceable determination requiring that a complainant be paid compensation for financial or non-financial loss. Section 39 of the enabling legislation for the transaction that underpinned the concession established that:

This was made clear in the second reading speech to the bill for the enabling legislation, which stated that the PPIP Act ‘… applies to the private operator as if it were a public sector agency in the same way that it currently applies to LPI titling and registry Services’.

In April 2017, NSW Treasury published a fact sheet offering ‘consumer assurance’ that:

Similarly, in March and April 2017, the then Registrar General made public presentations highlighting that the private operator was subject to statutory privacy obligations:

Accordingly, there appears to have been clear intention to offer assurance to the community that statutory privacy protections would apply to the land titles registry once the concession was made.

The ORG has not obtained assurance whether the private operator is covered by the Commonwealth Privacy Act

Despite the strong public assurances outlined above, there was uncertainty when the concession was granted about whether and how the Commonwealth Privacy Act applied to the operator.

As outlined above, the Commonwealth Privacy Act does not cover NSW government agencies. While it does generally cover private sector businesses (such as the private operator), there is an exemption for private sector contract service providers to NSW Government agencies for the purpose of providing services under their contract. Specifically, s. 7B(5) provides that the ‘acts or practices’ of private sector organisation are exempt where:

• the organisation is a contracted service provider for a state contract
• the act is done, or the practice is engaged in for the purposes of meeting (directly or indirectly) an obligation under the contract.

This was recognised in an information memorandum provided to bidders during the bid process for the concession. The information memorandum explained that the successful bidder may be subject to the Commonwealth Privacy Act, including to the exemption available ‘… as a provider of services to State Government’. The information memorandum concluded that ‘Compliance with the Commonwealth Privacy Act will be a matter for the private operator to assess’.

Accordingly, notwithstanding the confidence inherent in government public statements around the time that the concession was made, it appears unclear whether (and to what extent) Commonwealth privacy legislation applies to the land titles registry operator.

The ORG has not clarified whether an individual would complain about a privacy breach to the NSW or Australian Privacy Commissioner

Part 6 of the PPIP Act provides specific provisions for ‘public registers’ operated and maintained by NSW government agencies (noting that the private operator is deemed to be a NSW government agency by s. 39 of the enabling legislation for the transaction).

Part 6 of the PPIP Act sets out two specific protections for public registers held by NSW government agencies, these being:

• an agency keeping a public register must not disclose any personal information kept in the register unless the agency is satisfied that it is to be used for a purpose relating to the purpose of the register or the Act under which the register is kept
• an individual may request that their personal information be suppressed from a public register if they can establish that its open inclusion would affect their safety or well-being.

However, clause 7 of the Privacy and Personal Information Protection Regulation 2019 exempts public sector agencies responsible for keeping certain prescribed public registers from the requirements set out in Part 6 of the PPIP Act. The registers operated and maintained under the land titles registry are included in the list of the public registers that are exempt from Part 6.

Accordingly, the two statutory protections specifically focused on public registers in the PPIP Act do not apply to the land titles registry.

While there are equivalent contractual restrictions in the concession deed, these measures are not accompanied by a statutory right for individuals to complain to the NSW Privacy Commissioner if their personal information is handled in a manner that would otherwise breach Part 6. In these same circumstances, for the reasons discussed above, it is also unclear whether an individual could complain to the Australian Privacy Commissioner if the potential breach relates to the private operator performing functions as a contract service provider to the NSW Government.

This jurisdictional complexity is further complicated by the private operator collecting different types of personal information, namely:

• personal information that must be collected onto registers to meet titling and registry legal requirements, such as the name of the title owner or mortgage information
• personal information that is collected by the private operator to support the operation and maintenance of the register and other products offered by the operator, such as payment and identity verification information.

The private operator publishes a detailed privacy policy on its website. This policy states that the private operator is required to comply with both the PIPP Act and Privacy Act, and to the extent of any inconsistency, it would comply with the latter. While this demonstrates a clear intention to ensure compliance with legislative privacy obligations, further clarity is required as to how this intention can be reconciled with the issues outlined above.

As the lead agency in managing the transaction and overseeing the preparation of its enabling legislation and concession arrangements, NSW Treasury could not provide evidence that the NSW Privacy Commissioner had been consulted during the drafting of either the enabling legislation for the concession transaction or the concession deed document.

The ORG has detailed policy and procedures for ordering the suppression of personal information on the land titles registry, although third-party information reseller arrangements mean that the ORG cannot ensure that personal information will be fully suppressed

The ORG may direct the private operator, as well as other parties, such as specific government agencies that use land registry information, to suppress personal information held on the land titles registry. Information about this option is provided on the ORG website. A suppression may be ordered in response to a request from a member of the public advising that their well-being or safety is at risk because the register may disclose their whereabouts.

In the 12 months to July 2024:

• 107 applications to suppress personal information were assessed
• 60 were accepted
• 47 were declined.

Due to the critical nature of name suppressions and the potential danger to the individual, it is a requirement that a suppression application be actioned on the day it is received by the private operator (when received during business hours).

The ORG has detailed policy and process documents for the suppression of personal information. These documents detail the information that is required to be provided by an applicant, as well as describing the decision-making process and how an accepted application will be actioned. The Suppression Policy requires the private operator and a specific government agency that uses and distributes land registry information to complete the suppression request within one business day.

Analysis performed by the ORG in September and October 2019 found that action in response to at least six suppression applications had been delayed by periods between three and six days. The ORG’s policy on the suppression of personal information now specifies that its privacy contact officer will actively monitor the action time of a suppression direction to ensure that the private operator actions any suppression order within one working day. For a sample period of January to June (inclusive) 2024, the ORG reported that the performance measure was met for each month. However, the complex flows of land titles information, and the multiple parties who may handle it, mean that it could reasonably be expected to take up to two weeks for suppression orders to be given full effect.

The audit reviewed a small sample of successful and unsuccessful suppression applications that had been received and determined during 2023–24. These are discussed below.

A sample of five successful applications highlighted the difficulties that the complexity of the land titles system poses in managing data. From the sample, it was found that the private operator actioned suppression orders in a timely manner. However, the time taken to action suppression orders was longer in the case of the government user.

When the government user receives a suppression notice from the ORG, it informs its seven data customers that they (and in turn their own unknown number of customers or resellers) have seven days to ‘remove all elements of personal information including the property sales information from any record held’. As the ORG is not a party to this data sharing arrangement and has no visibility of the agreements between the various parties, it has no mechanism to offer assurance about the effectiveness of the suppression process.

The ORG was able to demonstrate that the sample of unsuccessful suppression applications had been handled in accordance with its policy, including by explaining the process to the unsuccessful applicant and affording them the opportunity to provide further information.

The ORG is preparing a policy to explain the rights of the private operator, government agencies and other third parties to use land titles registry data for new services and products

The concession deed sets out a number of clearly defined ‘core services’ that the private operator is required to provide. In addition, the private operator may apply to the ORG for permission to use land titles registry data for other ‘non-core’ services. These non-core services can generate revenue for the private operator.

The NSW Government made clear when granting the concession that a policy objective was to promote innovation and improved customer service, including by permitting the private operator to develop new services, while also ensuring that the principles of the NSW Government Open Data policy were maintained. An objective of the Open Data policy is to promote the release of government data ‘… for use by the community, research, business and industry’ and to ‘inform the design of policy, programs and procurement’. The Open Data Policy is not a ‘free data’ policy but is based on the principle of ‘free, where appropriate’.

Under the concession deed, the private operator is entitled to claim compensation for prescribed ‘compensation events’. In broad terms, compensation events include where the private operator loses its exclusive right to maintain and operate the NSW land titles registry, including to facilitate authoritative searches of titles.

On 28 September 2021, the private operator submitted a claim for compensation under the concession deed. This claim concerned the use of data by the Spatial Services business unit of the department to create the NSW Spatial Digital Twin (‘Spatial Digital Twin’).

The Spatial Digital Twin is described by the department as ‘… a cross-sector, collaborative digital workbench for whole-of-government use, that will visualise location information, in a 4D model of the real world (3D plus time)’. It brings together many data elements from multiple sources across government, including information from strata plans registered in the land titles registry.

On 23 October 2021, the NSW Government rejected the private operator’s compensation claim. However, while rejected, the claim has not been withdrawn. The department has assessed the claim as being unfounded and, consistent with financial audit standards, it is not recorded as a liability in the department’s financial accounts. However, the department does include the claim in its ‘emerging issues return’ that agencies are required to provide to NSW Treasury.

It was beyond the scope of this audit to assess the merits of this specific claim. However, at a general level, the matter highlights that there may be different interpretations of the concession deed in regard to the permitted uses of land titles registry data and the related compensation provisions. This includes NSW Government agencies that had existing pre-concession rights to obtain data for specific purposes, as well as other system participants that obtain land titles data, such as ELNOs. If a common understanding is not established, then there are dual risks that:

• the potential for compensation claims may mute innovation in how NSW government agencies, and potentially others, use land titles registry data
• current or further claims for compensation by the private operator for uses of data by third parties may create financial liabilities for the State.

The concession deed includes provisions that permit certain government agencies to obtain land registry data. Those agencies may also enter into individual memoranda of understanding (MOU) with the ORG. These MOUs set out details about how and for what purposes each agency may obtain data. Consistent with the deed, the MOUs also permit agencies to use land titles registry data for ‘similar governmental purposes’ to those purposes specified in the concession deed. There is no guidance on the interpretation of ‘similar governmental purposes’.

The ORG first formally proposed an approach to resolve this matter in August 2021. However, it remains a live issue. The ORG’s annual priorities letter to the private operator for 2023–24 identified the need to achieve ‘clarity around the use of land registry data’, explaining that:

Achieving greater clarity in this matter remains one of the ORG’s annual priorities for both itself and the private operator for 2024–25. The ORG is developing a data use policy intended to assist in addressing risks around data use by clearly communicating to stakeholders the ORG's position on the use of data from the various registers operated under the concession. This policy was still in draft form during this audit.

The ORG has ensured that business continuity and recovery planning has been prepared for the land titles registry

The private operator is required by the concession deed to develop, submit and test a business continuity plan. During the concession, the private operator has met this requirement by providing the ORG with required and related documents, including its Business Continuity Plan, Business Continuity Management System and Disaster Recovery Strategy, as well as a third-party assessment of the adequacy of the planning.

The private operator is required to annually test its continuity planning. The audit team sighted evidence of third-party testing of the business continuity plan, as well as ORG feedback on the adequacy of business continuity plans and engagement with tests.

The audit team assessed a sample of business continuity plans provided by the private operator to the ORG against the applicable international standard (ISO 22332). In addition, a sample of incident management and recovery plans were assessed against both ISO 22332: 2022 and ISO 27035.1:2017.

The audit team found that while the plans did not expressly claim to be prepared in accordance with any formal standard, they were broadly consistent with the requirements of the standards. For example:

• there was evidence that sampled plans had been reviewed annually or as required as a result of organisational changes or post incident review
• assumptions for the operation of the plan, and intersections with other key documents were clear
• specific roles and team members, including alternates where available, were identified with defined roles and responsibilities
• where scenarios were detailed, there were specific steps and tasks clearly outlined
• plans contained rating frameworks that defined the criticality of events, and the subsequent recovery objectives.

The private operator also has a business continuity management framework that sits across business continuity plans for specific functions, as well as a disaster recovery strategy. These higher-level documents also provide detail on the operator’s requirements for more specific plans and processes to be tested. The business continuity management framework, for example, requires annual business continuity exercises to take place.

The ORG has a local business unit continuity plan, although this has not been tested

As part of Department of Customer Service business continuity planning, the ORG has a local business continuity plan for its own business unit. This plan addresses three specific critical business functions:

• managing the concession
• administering the TAF
• regulating ELNOs.

Each of these critical business functions has a maximum acceptable outage time of one day, with a recovery time objective of three days. The ORG has not tested these recovery time objectives, or the operation of continuity plans for critical business functions.

The alignment of regulator and operator response and recovery plans is a recent improvement that has been identified through joint scenario testing

A joint exercise was conducted in November 2023. An external cyber security consultant was commissioned to design and deliver a cyber incident response exercise between the department, the ORG and the private operator.

The consultant produced a report that identified strengths across the engaged stakeholders, including the collaborative culture with clear decision-making protocols, awareness of the current threat landscape, and active involvement and identification of areas of improvement.

The report broadly identified the need for interconnected communication plans, harmonised incident response plans and pre-defined authority to act as key opportunities for improvement. This was due to uncertainty regarding who should initiate contact with different parties, the need for enhanced coordination and uncertainty during the exercise about who had the authority to engage with the threat actor.

This seems to be the only joint exercise that has been conducted between the regulator and operator to date. No further joint exercises are currently planned.

The ORG has not tested whether it could use back-up data to operationally manage the land titles registry

The concession deed requires the private operator to provide the ORG with a daily back-up of the ‘core data’ contained in the land titles registry (except for core imaging repository data, which is subject to weekly back-up). This is consistent with pre-concession disaster recovery arrangements where core databases and transaction logs were replicated to an off-site disaster recovery centre daily.

The ORG has taken steps to ensure that the back-up data provided by the operator is reliable. The content of the back-ups provided by the private operator was validated by Department of Customer Service ICT in August 2024, with a regular automated testing protocol now in place. This was not always the case, as ORG audits of back-up data had identified deficiencies earlier in the concession.

While the ORG has access to accurate back-up data, the value of the back-ups and whether the ORG can effectively restore the state back-up (for example, if it is ever required to exercise its step-in powers) has not been determined. The audit was told ‘there is no guarantee’ that existing back-ups could be used to restore the system.

The appropriate use, utility and purpose of the state back-up is a current issue for the ORG. This issue was also identified in the 2023 strategic technology review, which noted the potential for developing a real time replica of the land titles registry data. As a result of this review, the ORG is reviewing best practice for the use of the state back-up, including analysing its purpose, situational need and methods to audit and assess back-ups in the future. These findings are due in mid-2025. Any changes to state back-up arrangements will likely require changes to the concession deed.

If future circumstances require the ORG to rely on the state back-up of the registry data, the ability of the ORG to use the state back-up would be critical, including if there was a technical or operational failure with the private operator. The ORG has commenced initial analysis on the required documentation, procedures and scenarios required to exercise its step-in powers. However, the ORG has not tested how effectively it could restore the state back-up, or how it would use the back-up data in practice, if it was needed.

There is evidence that the ORG has taken steps to identify regulatory weaknesses and areas for improvement

The ORG has several internal processes to identify and review issues around its own performance. These include weekly and fortnightly team meetings at various levels, quarterly executive meetings, and an annual team development day. The ORG also notes that a weekly email identifies good regulatory practice, however there is no formalised approach in terms of a framework that benchmarks the ORG’s performance in comparison to similar regulators or guides its continuous improvement processes.

The ORG has identified several internal improvement areas. These include workforce capability or capacity gaps and managing the risk of regulatory capture.

• Workforce capability: while the ORG has a small IT team, it does not have senior or strategic IT expertise. Workforce capability in this area is a key risk to the long-term regulation of the land titles registry. It was raised by several stakeholders in interviews with the audit team and identified as a risk in both the Strategic Technology Review, and the ORG’s 2023 annual team development day.
• Regulatory capture: ORG staff should refrain from becoming involved in discussions with the private operator and surveyors about plan issues, due to its role as the decision-making authority in administrative reviews.

The ORG is addressing a gap in strategic technology and regulatory practice capability to ensure it can effectively regulate the land titles registry in the long term

The land titles registry is an increasingly technology-focused system, having transitioned since the early 1980s from a paper-based system, where documents were submitted or searched for in-person, to a digital system with remote online access. This means that the ORG is increasingly regulating technology solutions and operations.

While the ORG has identified strategic technology expertise as a gap, it does not yet have a long-term capability development and retention plan. It has also not mapped its existing skills base to ongoing requirements of overseeing the concession deed and regulating the land titles registry. Its existing workforce plans respond to workforce survey findings and focus on developing and retaining its current workforce.

To address this capability gap in the immediate term, the ORG has engaged an external consultant to address strategic technology skills, reallocated its spending on consultancies to fund ongoing roles and requested support from Department of Customer Service ICT.

In 2024, as part of Fair Trading and Regulatory Services, the ORG was provided with a dedicated business information support officer from the department’s cyber security area who supports it with advice related to cyber security. Prior to this the ORG was also able to receive advice from the department’s Chief Information Security Officer. Advice has included risk assessments, responses to ad hoc requests and formal advice on reporting required from the operator. There is a potential risk in relation to this key role being outside the ORG’s structure and therefore not able to be fully managed by the ORG.

Broader Department of Customer Service ICT support has been more limited outside of cyber security. Leadership meetings have occurred inconsistently, for example, limiting ORG’s ability to influence the department’s ICT support.

The NSW Public Service Commission (now located within the Premier’s Department) has published a Strategic Workforce Planning Framework that provides guidance for agencies to understand and prepare for their future workforce needs. This framework identifies three levels of workforce planning.

• Strategic workforce planning: identifies actions and addresses challenges, risks and opportunities, entailing longer term planning covering a 3–5 year period. The framework notes that strategic planning is not ‘resource management to fill immediate operational needs’.
• Tactical workforce planning: specifies how work should be done in a specific area to efficiently achieve goals outlined in the strategic workforce plan.
• Operational workforce planning: Ensures daily work is done effectively.

ORG activity to address this capability gap is mainly tactical and operational. Quarterly executive meetings review resourcing needs with an 18-month time horizon, while the Strategic Workforce Planning Framework recommends a longer time horizon. Executive review assesses anticipated workload and, in addition to specific technological capability, has identified the need for additional capacity across the ORG in the areas of policy, regulation and cadastral integrity.

The ORG advises that it is currently reviewing the most effective approach to engaging strategic technology expertise and relies on expertise from within the Department of Customer Service for guidance on workforce planning.

The ORG’s wider regulatory context also creates capability needs in regulatory policy and practice. The ORG performs regulatory functions over a complex and multi-participant system. Its primary regulated entity, the private operator, has unique characteristics, being a monopoly exercising important titling functions using an asset that remains the property of the NSW Government.

At the same time, there are a range of other system participants, such as lawyers, conveyancers, surveyors and banks, who are primarily regulated by other bodies. The other main group of participants, the ELNOs, are themselves subject to new and dynamic market pressures as the industry evolves from a monopoly to a competitive market. The Australian Registrars' National Electronic Conveyancing Council has described a future-state in which multiple ELNOs inter-operate, resulting in a ‘growing compliance burden for government’ within ten years.

The concession deed contains mechanisms to support continuous improvement in the operation of the concession, including an optional five-year major review clause that has not yet been exercised

The concession deed provides for the ORG to conduct:

• ‘annual reviews’ of the operator’s performance, including its achievement of service levels and a review of its latest business plan, as well as a broad range of other matters
• ‘ad hoc and other reviews’, whereby the ORG may review or ‘spot check’ the operator’s performance of any core service provided under the concession
• a ‘major review’ of the operator’s performance under the deed no more than once every five years, including the extent to which the operator is acting consistently with the objectives of the concession and a broad range of other matters – a major review may also consider whether any changes are required under the concession deed.

The ORG conducts annual reviews of the private operator’s performance, including by reviewing and providing feedback on iterations of the private operator’s business plan. As discussed earlier, the ORG has also required the private operator to provide ad hoc reports on two occasions relating to the quality of the private operator’s plan examinations. While the annual priority letters described earlier in this report (see section 3) also encompass an element of performance review, that process is not a function of the concession deed.

To date, the ORG has not exercised its option to conduct a major review of the concession. The ORG did consider conducting a major review in 2022, but it was determined at the time that progressively evolving the concession using iterative contract variations agreed with the private operator was an adequate course of action.

The range of matters anticipated by the major review mechanism is substantial and would prompt consideration of matters that may not emerge iteratively or ad hoc, including matters that are more than simply routine or operational. For example, the major review mechanism provides for the review of significant and strategic matters, including those ‘… that were not anticipated as at the execution date, but which ought to be addressed having regard to the objectives’. Notwithstanding the long duration of the concession, and the complex and evolving environment in which it operates, the ORG has not commenced preparatory work to scope when, or in what circumstances, a major review would be appropriate.

Appendix 1 – Response from Department of Customer Service

Appendix 2 – Glossary

Appendix 3 – About the audit

Appendix 4 – Performance auditing

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Parliamentary reference - Report number #403 released 12 February 2025.

About this report

Results and key themes from our audits of the state agencies’ financial statements for the year ended 30 June 2024.

It also includes observations on the following areas of focus:

• risk management
• capital projects
• shared service arrangements.

Findings

The Treasurer did not table the audited Total State Sector Accounts (TSSA) in Parliament as required by the Government Sector Finance Act 2018, and Responsible Ministers did not table 16 annual reports in Parliament by the required date.

Audit results

Unqualified opinions were issued for all but one agency.  The quality of financial statements submitted for audit improved, with reported misstatements down to a gross value of $3.9 billion in 2023–24, compared to $10.8 billion in 2022–23.

Key themes

Errors in accounting for assets led to financial statements adjustments of $1.4 billion. 

Our audits identified deficiencies in key controls across financial management, payroll, contract management and procurement.

Risk management

Risk management maturity is low across most agencies. Some of the largest 40 agencies self-assess their risk maturity as requiring improvement.

Capital projects

There is a lack of transparency in the NSW budget papers relating to significant capital projects. The estimated total costs for some major projects are not published as the amounts are considered commercially sensitive. The budget papers do not provide a complete and accurate reflection of the actual costs of large infrastructure projects.

Shared service arrangements

Three of the five agencies that provide shared services to 108 customer agencies did not obtain independent assurance over the effectiveness of their control environment. 

Recommendations

The report makes recommendations to agencies to improve controls and processes in relation to:

• financial reporting
• financial management
• risk management
• shared service arrangements
• capital projects.

Financial reporting is an important element of good governance. Confidence in, and transparency of, public sector decision making is enhanced when financial reporting is accurate and timely.

This chapter outlines our audit observations relating to the financial reporting of State Government agencies.

Appropriate financial controls help ensure the efficient and effective use of resources and administration of agency policies. They are also essential for quality and timely decision making.

This chapter outlines observations and insights from our audits of financial statements of the 40 largest agencies in the State sector. These agencies are listed in Appendix 3.

This chapter outlines audit observations, conclusions and recommendations from our review of agencies’ risk maturity, assessment processes, governance, systems and culture across the 40 largest agencies in the state sector. These agencies are listed in Appendix 3.

This chapter outlines observations, conclusions and recommendations from our review of the 15 most significant capital projects in the State.

Shared service arrangements can centralise corporate services functions such as finance, human resources, procurement and information technology (IT). Across NSW Government agencies, many business processes and IT functions are provided on a shared services model, that is, one agency operates a business function or IT platform that is used by other agencies rather than each agency maintaining their own. These services are shared by several agencies (‘customers’), but generally are operated and managed by one agency or department (‘provider’).

This chapter outlines audit observations, conclusions and recommendations from our review of shared service arrangements provided and received by the 40 largest agencies in the state sector. These agencies are listed in Appendix 3.

This report outlines the findings on shared service arrangements.

Appendix 1 – Status of audits of consolidated entities

Appendix 2 – Status of audits of non-consolidated entities

Appendix 3 – Forty largest State agencies contents

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

About this report

Local councils in NSW manage a large proportion of roads across the state. Roads often represent a significant proportion of total council
expenditure.

How councils manage roads is impacted by their revenue, local conditions, and the needs of residents, businesses and other road users.

This audit was undertaken within the wider context of natural disasters and weather events that have significantly impacted the road network in NSW in recent years.

It assessed whether three councils had effectively managed their road assets to meet the needs of their communities, makes detailed findings and recommendations to each audited council, and identifies key lessons for the wider local government sector.

Key findings

All councils can improve how they link community consultation with planned service levels. Formalising these processes could help better demonstrate how current service levels meet community needs.

Clarence Valley Council

• has established a strategic priority for road asset management but not formal governance arrangements or a long-term capital works program
• is delivering and reporting on its work to respond to natural disasters but does not report against targets for road asset quality and service
• has set benchmarks for road asset maintenance, replacement and renewal but needs clear service levels.

Gwydir Shire Council

• did not have aligned, up-to-date asset plans during the audit period
• did not have a long-term capital works program but adopted a prioritisation program for capital works in August 2024
• did not effectively implement formal governance, or coordinate management oversight, to manage its road assets.

Wollondilly Shire Council

• has a strategic framework for road asset management and has used long-term plans to guide its asset capital and maintenance works
• has reported asset management outcomes against a planned capital works program but could improve how it uses KPIs to demonstrate performance.

This is the first performance audit of the local government sector that I am tabling in Parliament as Auditor-General for New South Wales.

Our performance audits are designed to provide valuable information to parliamentarians, sector stakeholders and the public. Ultimately, our aim is to ensure transparency, a principle that underpins effective and efficient use of public resources.

The management of roads and associated assets is a critical issue for local councils across the state. In recent years, many councils have had to contend with the immediate and ongoing effects of natural disasters.

These natural disasters, along with increased community expectations, population changes and complex regulatory obligations all contribute to financial sustainability risks for councils. Some councils have used short-term funding allocations (including emergency relief grants) to cover the costs of managing long-term assets. These councils do not have the capacity to generate sufficient income from their own sources, and therefore depend on assistance from other levels of government. Councils’ ability to plan and budget for the long term has also been disrupted by the need for new or restored infrastructure outside asset life cycles.

Several reports and inquiries in recent years have highlighted these significant financial sustainability risks. The parliamentary inquiry into the ‘Ability of local governments to fund infrastructure and services’,¹ due to be tabled soon, will be a critical input to a long-term solution.

The three councils audited in this report – Clarence Valley, Gwydir Shire and Wollondilly Shire –each experienced significant natural disasters, including fires, storms and floods during the audit period. Despite this, each audited council was able to deliver a large volume of road asset management works.

This report provides valuable lessons from these audited councils that can help all councils manage their roads more effectively in the face of evolving risks and competing resource demands.

I acknowledge this has been a difficult time for some councils across NSW. This report supports councils with practical steps to manage their roads as effectively as possible, improve their resilience to climate challenges and meet legislative requirements.

¹ The inquiry into the ‘Ability of local governments to fund infrastructure and services’ by the NSW Legislative Council Standing Committee on State Development commenced on 14 March 2024 to inquire into, and report on, the ability of local governments to fund infrastructure and services.

Background

Local councils in New South Wales (NSW) manage over 180,000 km of local and regional roads combined. These roads are crucial to travel within local government areas and across the state, improving community accessibility. Reliable roads ensure commercial and public transport can run on time, increase safety and keep the environment clean.

As roads age and deteriorate, they become more expensive to repair. Road surfaces and formations are vulnerable to both extreme heat and water exposure. These kinds of exposure have varying effects on the ways roads degrade, depending on the amount of traffic and the kinds of vehicles that use them.

Local conditions, business and road-user needs, and the impacts of natural disasters vary between councils and influence the way each council manages its roads. Regularly maintaining roads can keep roads functional and safe and prevent costly, unbudgeted repairs and replacements.

In the 2022–23 financial year (FY2022–23), the estimated total replacement cost of council road assets across NSW was around $102 billion. In the same year, local councils reported collective road asset maintenance expenditure of around $1 billion.

Since 2017, financial audits of local councils have identified asset management-related issues, including gaps in asset management processes, governance and systems. The Audit Office’s ‘Local Government 2023’ report outlined 266 asset management-related findings across the local government sector, including gaps in revaluation processes, maintenance of information in asset management systems and accounting practices.

Councils also provide a wide range of other services and infrastructure, including water and sewer infrastructure and services, waste management, environmental protection, housing, and community transport. Through integrated planning and reporting, councils determine how they will allocate resources to their services and infrastructure. Understanding community expectations for assets and services, alongside technical requirements, supports effective planning for function, cost and quality.

Audit objective

This audit assessed how effectively three councils – Clarence Valley Council, Gwydir Shire Council and Wollondilly Shire Council – are managing their road assets to meet the needs of their communities.

The audit assessed whether the selected councils:

• have a strategic framework in place for managing their road assets
• have effective governance, data and systems for road asset management
• are managing their road assets in line with planned service levels and quality outcomes.

Overview of findings

This audit assessed how effectively Clarence Valley Council, Gwydir Shire Council and Wollondilly Shire Council managed their road assets to meet the needs of their communities.

In assessing each Council’s performance, this audit concluded:

Clarence Valley Council has effectively established a strategic priority for road asset management, but delivery of this priority was not supported by formal governance arrangements or a long-term capital works program. While the Council is delivering and reporting on a large volume of road asset works in response to natural disasters, it does not report on consolidated targets for road asset quality and service. The Council has set benchmarks for maintenance, replacement and renewal of roads. It now needs to enhance this with clear service levels to ensure community needs and expectations are met.

Detailed conclusions and recommendations for the Council are outlined in sections 2.2 and 2.3. Recommendations include that Clarence Valley Council:

• updates and implements its asset management plan and associated improvement actions
• reviews and implements key performance indicators (KPIs)
• captures lessons learned from its natural disaster responses
• implements a long-term capital works program.

Gwydir Shire Council did not have aligned, up-to-date long-term asset management plans to support a strategic framework for road asset management across the audit period. The Council did not effectively implement formal governance and coordinated management oversight for its road assets. The Council implemented updates to its asset management plans in June 2024 and governance arrangements in July 2024.

The Council has reported on the large volume of works it is delivering, including in response to natural disasters, but is not reporting in the context of information about targets and quality benchmarks. The Council does not have a long-term capital works program, but adopted a prioritised rolling program of works in August 2024 to guide its priorities and efforts over time.

Detailed conclusions and recommendations for the Council are outlined in sections 3.2 and 3.3. Recommendations include that Gwydir Shire Council:

• implements its asset management plans and associated improvement actions
• formalises and documents community priorities and service level expectations for roads
• captures lessons learned from its natural disaster responses.

Wollondilly Shire Council has effectively applied a coordinated and strategic framework to deliver road asset management. The Council has long-term plans to guide its efforts and uses data to inform its approach. The Council has delivered a large volume of works in response to natural disasters during the audit period. The Council is reporting its road asset management outcomes and can demonstrate progress against a clearly defined capital works program, but its use of performance indicators could be improved.

Detailed conclusions and recommendations for the Council are outlined in sections 4.2 and 4.3. Recommendations include that Wollondilly Shire Council:

• finalises and implements its transport asset management plan
• reviews performance indicators for road assets
• formalises and documents community priorities within its integrated planning and reporting (IP&R) and asset management frameworks.

Key observations of good practice

While each council was separately audited, this report also identifies practices that contribute to effective road asset management across all local councils.

These include:

1. a good understanding and articulation of the community’s vision, priorities and purpose for local roads
2. asset management documents that are current and aligned with broader strategies and financial plans
3. long-term capital works planning that considers associated ongoing costs, and is supported by systematic prioritisation of works
4. clear and documented decision making processes
5. transparent performance reporting on progress and outcomes
6. reliable, accurate and assured data and systems
7. continuous improvement through both formal reviews and capturing lessons learned
8. resilience and responsiveness to natural disasters with a planned approach to disaster recovery.

Further lessons for local government can be found in Appendix 3.

Appendix 1 – Response from entity

Appendix 2 – Council expenditure profile

Appendix 3 – Lessons for local government road asset management

Appendix 4 – About the audit

Appendix 5 – Performance auditing

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Parliamentary reference - Report number #401 - released 21 November 2024.

About this report

The Regional Digital Connectivity program (RDCP) is intended to improve mobile coverage and internet connectivity in regional NSW.

The RDCP includes two funding programs, one for improving mobile coverage and the other for improving internet connectivity. Both programs provide grant funding to commercial telecommunications providers for eligible mobile and internet projects.

This audit assessed whether the Department of Regional NSW (the department) is effectively administering the RDCP to meet program objectives.

Findings

The department's approach to identifying priority areas for RDCP funding was comprehensive and it largely distributed funding in line with these priorities.

The department has not specifically defined the overall objectives of the RDCP. The department has developed business cases that set out each program’s respective objectives, but these do not consistently describe the objectives of the RDCP.

The department also has not developed an overarching investment strategy, which would assist it in addressing potentially conflicting priorities.

Deficiencies in project and risk management have contributed to delays in the department’s implementation of the program.

The department is not monitoring progress against outcomes, which limits its ability to demonstrate that the program is achieving its intended purpose.

The department did not meet its original mobile coverage performance target but met its internet connectivity target.

Recommendations

To improve RDCP administration, the report recommends that by June 2025, the department should:

1. develop an overarching investment strategy for the RDCP
2. outline the expected timelines for RDCP projects and ensure that these timelines are updated regularly
3. develop and report on RDCP outcome indicators
4. update the RDCP evaluation plan
5. update the expected benefits of the program to reflect changes in the RDCP.

The Regional Digital Connectivity program (RDCP) is funded through the Snowy Hydro Legacy Fund (SHLF). Under the Snowy Hydro Legacy Fund Act 2018 (SHLF Act), the purpose of the SHLF is to improve economic development in regional New South Wales and to fund infrastructure projects that primarily benefit regional New South Wales. A priority area for SHLF investment is delivering improved mobile coverage and internet connectivity in underserved and remote communities.

The RDCP has been implemented by the Department of Regional NSW (the department) since 2019. The RDCP is broadly split into two funding programs. The larger funding program is for improving mobile coverage and the other funding program is for improving internet connectivity and is referred to as the Gig State program. Both programs provide grant funding to commercial telecommunications providers for eligible mobile and internet projects.

Over $300 million from the RDCP was allocated to improve mobile phone coverage and increase the number of mobile service providers across regional NSW. The mobile coverage program is being delivered through the following sub-programs:

• Snowy Mountains Highway Safety project – co-funding with Snowy Hydro Limited to build five mobile towers along the Snowy Mountains Highway to improve mobile coverage.
• Active Sharing Partnership (ASP) pilot – co-funding with private providers to deliver active sharing mobile technology in regional areas.
• ASP main program – This is the main round of the mobile coverage program. A business case has been developed, but no funding has been distributed through this sub-program.
• Mobile Black Spot Program Round 5A – co-funding with the Australian Government’s Mobile Black Spot Program to deliver new or upgraded mobile towers in regional and remote locations.
• Mobile Black Spot Program Round 7 (MBSP7) – co-funding with the Australian Government’s Mobile Black Spot Program to deliver new mobile infrastructure.

Over $100 million from the RDCP was allocated to the Gig State program to improve regional internet connectivity through partnering with multiple providers and using a range of technologies suitable for rural and regional locations. The Gig State program was launched in 2019 and underwent significant changes in 2021 following an Infrastructure NSW deep dive review into the project. These changes to the program are referred to as the Gig State addendum. The Gig State program is being delivered through the following sub-programs:

• Cobar corridor connectivity – providing fixed wireless internet access to five locations between Narromine and Cobar.
• nbn regional NSW fixed wireless – co-funding with nbn to deliver new or co-located fixed wireless broadband towers in 56 locations.
• Wamboin, Bywong and Sutton connectivity – improving internet connectivity in these three towns as part of a NSW Government commitment.
• Regional Connectivity Program Round 3 (RCP3) – co-funding with the Australian Government’s Regional Connectivity Program to provide additional internet infrastructure.

The objective of this audit was to assess whether the Department of Regional NSW is effectively administering the Regional Digital Connectivity program to meet program objectives. The audit examined:

• how effectively the department identifies priority areas to target RDCP funding
• how effectively the department distributes RDCP funding in line with program objectives
• how effectively the department measures the performance of the RDCP.

The department has not specifically defined the overall objectives of the RDCP

The RDCP is delivered as part of the SHLF. Under the SHLF Act, the purpose of the SHLF is to improve economic development in regional New South Wales and, for that purpose, to fund infrastructure projects that primarily benefit regional New South Wales. One of the priority areas for SHLF investment is digital connectivity, which is being delivered through the RDCP.

While the purpose of the SHLF is set out in the SHLF Act, the department has not specifically set out the overall purpose and objectives of the RDCP and how it will focus the RDCP on achieving the SHLF’s purpose. Such a document would support future business case development, and support the coordination and prioritisation of objectives across the business cases that have already been developed.

While the overall objectives of the RDCP are yet to be defined, there are objectives set out in the business cases for the separate programs but these are not consistently described. The Gig State business case advises that the RDCP’s goal is to enable transformative long-term benefits for regional areas through investment in digital connectivity. This goal aligns with the purpose of the SHLF Act. However, this objective is not set out in the mobile coverage business case, or any other document, and it is not clear how the RDCP is intended to fulfil this objective.

The Gig State business case sets out three objectives for the RDCP that provide further definition to the SHLF Act’s purpose, though it is unclear how these were determined and whether these are intended to cover the entire RDCP:

• address the digital divide between regional and metro NSW
• resolve market failures in the regional NSW telecommunications market
• leverage Government assets and capabilities wherever possible.

The mobile coverage ASP pilot business case sets out a similar set of objectives, though there are some differences, such as the third objective being to ‘leverage Government assets and capabilities to achieve transformative results.’ It is important for the department to clarify the RDCP’s objectives to ensure a unified approach to investment decisions. At the time of the audit, the department’s website had a different set of objectives for the RDCP. They are:

• build digital infrastructure to increase capacity
• expand mobile coverage and provider choice
• improve internet service, speed and quality
• bridge the digital divide between regions and cities.

The department also provided a 2022–23 ‘division plan’, with goals for the mobile coverage and Gig State programs. These include:

•  extend and improve internet coverage to deserving locations in regional NSW
• investigate emerging digital technologies to improve connectivity
• deliver new and improved mobile coverage to regional NSW communities
• encourage competition in the regional telecommunications market.

While these different sets of objectives broadly align, there is no consistency across these business cases in describing the objectives of the RDCP. This indicates that there is a lack of clarity about the intended objectives of the RDCP. Further, the origin of the list of objectives in the ‘division plan’ is unclear. This reinforces the need to clearly define objectives for the overall RDCP.

Each business case the department has developed for RDCP programs has defined objectives that align with the SHLF’s purpose

The Gig state and mobile coverage business cases also define objectives for each program. These objectives align with the SHLF’s purpose, set out above. The Gig State business case advises that the purpose of the Gig State program is to:

• address the digital divide between metro and regional NSW so that the price, quality, and choice of digital connectivity options in metro areas are made available in regional areas of NSW
• resolve market failures in regional NSW telecommunications
• leverage Government assets or investment where appropriate to achieve transformative long-term benefits for regional areas.

The ASP pilot business case states similar objectives, though it does not mention the ‘price, quality, and choice’ stated in the Gig State business case. The ASP pilot business case also lists another three objectives:

• address mobile black spots where people live and work
• investigate new and emerging technologies to future proof mobile coverage in regional NSW
• promote consumer choice in the delivery of mobile services.

The ASP main program has a different set of objectives to the ASP pilot and include:

• reduce the digital divide and enhance social inclusion by improving mobile coverage in regional locations not covered by existing programs
• encourage competition in the regional telecommunications market to provide consumers greater choice, lower prices and improved services
• address commercial viability and technical constraints to providing mobile coverage in regional areas
• improve community resilience to emergency events through improved regional mobile service.

The RDCP program objectives align with relevant whole-of-government strategic objectives

There are several whole-of-government strategies that seek to guide government investment in digital infrastructure. While there is no document setting out the overarching objectives of the RDCP, the objectives set out for the mobile coverage program and the Gig State program align with these whole-of-government objectives.

The objectives align with the 2018 and 2021 ‘20 Year Economic Vision for Regional NSW’. For example, the 2018 ‘20 Year Economic Vision for Regional NSW’ sets out principles for regional NSW investment, including ‘Affordable, reliable and fast internet to support people and businesses.’

The RDCP sub-programs also align with the 2018 and 2022 State Infrastructure Strategies. In particular, the 2018 strategy has a set of recommendations around improving connectivity across NSW and another set of recommendations around investing in technology that improves productivity and social outcomes. One of the roles of the Gig State program is to help to implement the 2018 strategy’s recommendation to support statewide access to 50Mbps download and 10Mbps upload capacity by 2025. These speeds are specifically stated in the Gig State grant guidelines as an eligibility requirement for funded programs.

Both sub-programs of the RDCP also align with the NSW Connectivity Strategy. The NSW Connectivity Strategy has two directions of particular relevance: ‘All customers have metropolitan equivalent digital capacity’ and ‘Connectivity blackspots continually decrease across the State’. The first of these objectives has three strategic directions which are directly relevant to both the Gig State program and the mobile coverage program:

• remote, rural and peri-urban citizens can access and effectively use digital systems and services for employment, justice, education, health, social, personal and entertainment use
• Aboriginal and Torres Strait Islander communities have equitable access to connectivity that meets their local community needs
• connectivity services are affordable for citizens no matter where they live, with access to a choice of providers.

Elements of both the Gig State and mobile coverage programs align with these, including the focus on expanding access and affordability.

In regard to regional Aboriginal communities, the RDCP may also contribute to the NSW Closing the Gap Implementation Plan, as the merit criteria in the grant guidelines for mobile coverage and Gig State grants include the extent to which the project will contribute to sustainable procurement and employment outcomes, including supporting Aboriginal businesses and employment. The criteria for prioritising locations for mobile coverage also includes extending coverage to discrete Aboriginal communities as something which could improve the score given to an application. However, this is not set out as an explicit objective of the program.

The department has not set out an overarching investment strategy for the RDCP to address potentially conflicting priorities or identify situations where funding may not align with program objectives

As noted above, the overall objectives of the RDCP have not been defined. The department does not have an overarching strategy setting out program objectives, how funding will be aligned with these objectives, and how the objectives will be prioritised. It is important to set out funding principles to establish how the elements of the stated objectives will be delivered and prioritised. Not setting these out risks funding decisions that do not align with program objectives.

As noted above, the mobile coverage ASP pilot business case lists two objectives around addressing mobile black spots and promoting consumer choice in the delivery of mobile services. These objectives may be potentially in conflict as expanding coverage can be done by funding one carrier to expand their own network, while promoting consumer choice could conceivably be done by funding a carrier to expand their network into areas already covered by only one existing carrier, thus increasing competition in those areas.

The department has not set out the relative weighting of its objectives across the RDCP funding packages and how it will prioritise funding in accordance with them. An overarching strategy would assist the department with prioritising funding in accordance with the objectives of the program, including determining the relative weight of each objective.

In addition, the department has not described the extent to which price reductions in the cost of internet will be prioritised as an objective of the Gig State program. The Gig State business case sets out that one of the objectives of the program will be to provide metropolitan equivalent or better service, quality and pricing for internet services in regional areas. It is unclear how internet pricing fits into the overarching objectives of the RDCP given that it is not mentioned as an objective of the SHLF. There would be value in setting out strategic investment principles and objectives to guide this decision-making and clarify the extent to which internet investment is intended to fulfil this purpose.

A lack of clarity about program objectives may also have impacted decisions about funding priorities. For example, the Gig State program business case sets out a plan to invest in Low Earth Orbit (LEO) satellites through a subsidy program. As noted above, the Gig State business case sets out some objectives for the RDCP, including leveraging government assets. While an investment in LEO satellites through subsidies may assist with bridging the digital divide, it is not clear how this aligns with the objective of leveraging government assets. More clarity over program objectives and a clear investment strategy may assist with clarifying this and similar investment decisions in future. As discussed below, the investment in LEO satellites did not proceed.

The department comprehensively identified priority areas that require improved mobile coverage for the mobile coverage program

As outlined above, the final business case for the mobile coverage ASP pilot program identifies three objectives for the mobile coverage program, including addressing the digital divide between metropolitan and regional NSW, and resolving market failures in regional NSW telecommunications. The department identified priority areas for improved mobile coverage in line with these objectives. The department refined its approach to prioritising locations for the mobile coverage ASP main program which resulted in a more comprehensive analysis of potential sites.

The department developed and implemented a structured process using a range of criteria to identify and prioritise suitable locations for funding. Before allocating funding to its mobile coverage program, it was necessary for the department to determine areas that required additional mobile coverage. The department undertook this work for both its mobile coverage ASP pilot program and the ASP main program as part of designing the grant programs. A key source of information it relied on for identifying priority areas for the pilot program was the Australian Government’s National Mobile Black Spot Database. The database identified around 4,000 mobile black spot locations across NSW. This database is no longer in use as it relied on community reports of mobile black spots which were unverified.

For its mobile coverage ASP pilot program, the department applied a series of filters to the mobile black spots identified in the database. It removed metropolitan areas, areas within a 10km radius of an existing mobile tower site, and areas that had already been selected for funding under either Commonwealth or State funded programs, such as the Connecting Country Communities Fund. This left the department with a list of around 1,200 potential sites.

The department then mapped the 1,200 identified black spot sites to their respective 383 unique locations and assessed and prioritised the mobile black spots and locations against a range of economic, community and feasibility criteria. Under the economic criteria, the department prioritised areas that had higher numbers of employed persons and higher proportions of land being used for agriculture or farming. Under the community criteria, the department prioritised areas based on the increase in the population that would benefit from expanded coverage, the increase in Aboriginal and Torres Strait Islander people that would benefit from the coverage, the increase in the kilometres of highway and main roads that would benefit that were within five kilometres of a mobile black spot, and areas with more square kilometres prone to bushfires or flooding that would benefit. Under feasibility criteria, the department prioritised areas that were closer to government and nbn infrastructure. This process resulted in 50 prioritised locations containing 307 black spot sites across 34 Local Government Areas in NSW.

For its mobile coverage ASP main program, the department undertook a detailed coverage analysis to identify locations with no and limited mobile coverage. It identified these using the latest publicly available coverage maps from the three mobile network operators and the distance of locations from existing sites/towers as published by the Australian Communications and Media Authority and the Radio Frequency National Site Archive databases. Using this data as the key source of information in determining mobile coverage resulted in a more comprehensive outcome than relying on the National Mobile Black Spot Database. The department did not use the National Mobile Black Spot Database, as this information was considered unreliable and had not been updated since 2018, and the coverage maps were more reliable.

The analysis focused on locations with small populations, road corridors, and tourism locations. It identified 257 locations with no or poor coverage consisting of 68 small population locations, 117 road corridors and 72 tourism locations. The department then analysed these possible locations against a range of criteria. These included maximising the number of people and businesses that would be supported, increasing the extent of existing coverage, determining whether coverage would support government strategies or Premier’s Priorities, other positive social impacts, focusing on the greatest length of road and most heavily used roads, and maximising the number of tourism businesses and points of interest impacted.

The department conducted analysis based on these criteria and shortlisted 24 small population locations, 24 road corridor locations and 12 visitor economy locations. These locations were taken forward for concept design, cost estimation, and economic and financial appraisal as part of the final business case.

The department’s initial approach to prioritising Gig State funding was based around larger regional centres

The department undertook a two-stage process for identifying priority areas for Gig State program investment. The first involved the identification of larger NSW towns that would benefit from additional internet coverage and where data centres could be located, and the second involved a selection of more remote locations to receive additional funding.

The department did not undertake an initial detailed analysis of internet coverage across NSW to prioritise funding for the Gig State program. Undertaking this work would have been in line with the Gig State program objectives of addressing the digital divide between metropolitan and regional NSW and resolving market failures in regional NSW telecommunications. In order to meet these objectives, it was important to first establish the extent of the digital divide and market failure before seeking to resolve it.

Instead, it categorised NSW towns according to their relative size and importance from a connectivity perspective. It prioritised towns with larger populations and more business users to maximise the potential benefit of the infrastructure. The department also prioritised locations that were closer to other telecommunications infrastructure, and it also considered proximity to other potential elements of the Gig State network for greater connectivity and to ensure that it was taking a whole-of-State approach to investment decisions. This process identified 14 major regional towns.

The department then prioritised two of these regional towns, Dubbo and Wagga Wagga, due to the higher prices paid by NSW Government agencies in the two locations for average internet bandwidth usage when compared to other regional and metropolitan population centres across NSW. The costs to government were considered a proxy for how much business users are likely to be charged for connectivity services in regional NSW towns. The department conducted surveys in both towns indicating that business users were paying higher prices than their metropolitan counterparts for higher-grade connectivity. This aligned with the department’s Gig State program objectives which related to providing price, quality and choice.

The department also included five satellite towns along the road from Dubbo to Cobar (Cobar corridor) in the Gig State final business case as well as the towns of Wamboin, Bywong and Sutton. The department’s prioritisation of funding for these locations was not based on any detailed analysis of need. The department identified that as part of its initial plan to expand the internet connectivity from Dubbo to Cobar, it would be able to connect a number of towns between those two at a reduced cost. There was no analysis of alternative options for expending this money, such as expanding coverage to other areas, or to determine the extent of coverage required in each town. The Wamboin, Bywong and Sutton project was prioritised as a result of a $5 million NSW Government commitment. This project is discussed further below.

The department strengthened its approach to targeting Gig State funding in 2021

The department reviewed and updated its approach to the Gig State program in September 2021. As part of this, it revised its approach to targeting funding, including the use of additional data and identifying areas with greater digital connectivity issues. This represented an improved approach compared to the original business case and aligned more closely with the changes that were made to the Gig State program in 2021, outlined in the Gig State addendum, which focussed more on the delivery of fixed wireless services rather than data centres.

The department carried out an analysis of areas that only have satellite internet coverage (i.e., no fibre or fixed wireless internet availability) to identify areas suitable for different types of technology such as fibre optic cables, fixed wireless and LEO satellites. This was more in line with the Gig State program objectives of addressing the digital divide and resolving market failures. It identified that these locations had challenging digital connectivity issues that were not likely to be resolved without government intervention. This process identified around 1,000 locations. This list was then refined by looking to maximise the number of premises and businesses, maximising the density of premises, prioritising locations with other Government assets, mobile sites and other technology available in the area, and locations close to an existing exchange to leverage existing infrastructure.

The location list was then prioritised based on scoring criteria for economic drivers, feasibility, risk and stakeholders. The economic criteria included the number of residential and business premises, the number of businesses, and the estimated construction costs for the infrastructure. The feasibility criteria included availability of existing and planned infrastructure. Stakeholder related criteria included identifying synergies with other government led programs, as well as sites that scored low on Australian Digital Inclusion Index (ADII) scores and the Socio-Economic Indexes for Areas. These criteria are appropriate and align with the objectives of the Gig State program.

The department’s process resulted in a list of 23 prioritised areas. These were generally areas with a higher density of premises and affordable access to infrastructure for power supply and data transmission.

The department considered socio-economic data when planning for Gig State and mobile coverage programs but did not use this to inform its pilot mobile coverage program

NSW Government Business Case Guidelines (TPP18-06) state that one of the main reasons for government action is promotion of equity where the distribution of economic costs and benefits is considered inequitable. It is therefore important for the department to consider socio-economic data in the planning of the RDCP.

The department has included some socio-economic data and ADII scores in the profiles it developed for each Local Government Area. It applied socio-economic data to identify additional priority areas for new and improved internet coverage through the Gig State program. However, it did not apply this data to identify priority areas across the pilot mobile coverage program of the RDCP. It improved its approach when developing the ASP main program by including socio-economic data as a component of its scoring for prioritising locations.

The department considered socio-economic data when selecting locations for grant funding. The mobile coverage grant guidelines and the Gig State grant guidelines both include merit criteria that consider whether the proposed solution would address disadvantage within a community. Both guidelines ask the grant applicants to consider the Index of Relative Socio-economic Advantage and Disadvantage.

The department engaged with key stakeholders when developing the RDCP

Under TPP18-06, NSW Government departments are required to identify and consult with key stakeholders as they can contribute to the development of the investment proposal by providing their expert opinions, research, and evidence.

The department identified key stakeholders, developed stakeholder engagement plans, and used feedback gained through consultations to design and adjust the RDCP. Key stakeholders have been involved on the RDC Steering Committee and the RDC Project Control Group ensuring that they have an avenue to provide input into the overall RDCP. This includes the Commonwealth department responsible for telecommunications infrastructure and telecommunication providers.

The department engaged with stakeholders when developing the ASP pilot program. As discussed below, the department transitioned the program from a one-stage pilot program, where telecommunication providers would be procured to provide the solution, to a two-stage program where the department would first work with telecommunication providers to identify technical solutions and then carry out the procurement. This involved significant engagement with stakeholders to identify the technical solution and procurement model.

The department has assessed the suppliers of internet and mobile connectivity to determine their capacity and willingness to participate in RDCP sub-programs

As part of procurement planning, when building a business case, NSW Government agencies are required to analyse and engage with the market. This involves developing a profile of the market, the capabilities of suppliers, innovative and emerging technology, and factors that influence the market such as customer preferences and competition.

The department considered the capacity of telecommunications suppliers, their level of interest, and willingness to participate in the program when developing the business cases for its mobile and internet coverage programs. In addition to doing this when constructing initial business cases, the department adjusted its approach when market factors changed, as evidenced by the changes it made to its Gig State program in 2021. In September 2020, the nbn announced an expansion of its fibre network nationally, with a focus on regional improvements. This meant that internet coverage for some of the locations included in the Gig State business case would be addressed by nbn and continued investment was not needed in those areas. The initial Gig State business case also planned an initial investment in data centres in regional NSW. Following this, a private market operator also announced plans to construct 14 regional data centres across NSW. This meant that the planned Gig State data centres were no longer required. The department changed it approach to avoid duplication by ceasing its planned internet coverage expansion into regional centres, including the data centres, and prioritising a range of new sites for coverage.

Conflicts of interest and probity procedures have largely been followed, although there were some gaps in declarations

Maintaining a record of conflict of interest declarations is important to provide a higher level of transparency, and therefore control, over officials in high-risk roles. Disclosing an interest before it becomes a conflict of interest also reduces the likelihood that an official will be tempted to conceal or favour the interest.

Conflict of Interest declaration forms have been completed for staff involved in the mobile coverage program, Gig State program and the Australian Government co-funded Regional Connectivity Program Round 3 (RCP3) and Mobile Black Spot Program Round 7 (MBSP7). Whilst the list of declarations is extensive, it is unclear whether it includes all relevant staff from the department, the NSW Telco Authority and consultants involved with the program.

In relation to the mobile coverage and Gig State programs, there was no declaration recorded for one consultant and three staff from the department, including the program sponsor. These omissions have the potential to create risks that conflicts of interest go unmanaged. The department advises that the register is now complete for all those working directly on the program. It also advises that, due to the breadth of programs senior staff oversee, conflicts of interest are managed by the department's Governance team centrally through a Declarations App.

Four declarations of a ‘real, potential or perceived conflict of interest’ were made under the RCP3 and MBSP7 grant programs, which were co-funded with the Australian Government. No declared conflicts were made for the other programs. The identified conflicts of interest have documented actions to manage them, and there is evidence to indicate that these were implemented. For example, a senior staff member and a consultant excluded themselves from parts of a grant process due to declared conflicts.

The NSW Grants Administration Guide states that officials must seek probity advice for all grant opportunities that are complex, high-risk or high-value, to support the design, application, assessment and decision-making phases. The department followed appropriate probity processes throughout and these probity reports did not find any material breaches of probity in the grant processes.

There have been delays in all streams of the RDCP which may have been reduced through proactive project and risk management

The business cases set out expected timelines for each program of the RDCP. The department has not met any of these expected timelines, with some projects delayed by over a year compared to their initial planned timelines. Some of these delays have been caused by changes to the department’s approach to the mobile coverage and Gig State business cases. While some of these changes were outside of the department’s control, others could have been anticipated and better managed by a stronger approach to project management and risk management.

Exhibits 1 and 2 set out the status of each Gig State and mobile coverage project reviewed as part of this audit as at April 2024 and the planned completion date for that project at the outset of the program. Note that this does not include projects co-funded by the Australian Government due to the department’s limited ability to influence the process. This also excludes projects which have not yet distributed funding, such as the mobile coverage ASP main program.

Source: Audit Office analysis.

Source: Audit Office analysis.

As can be seen from Exhibits 1 and 2, each project in the RDCP has been delayed past its initially planned completion date, and the Wamboin, Bywong and Sutton project has been delayed past both its original planned completion date and also the revised completion date in the Gig State addendum.

Some of these delays can be accounted for by the fact that the department revised its approach to both the mobile coverage ASP pilot and the Gig State programs. While some of these changes were outside of the department’s control, others could have been anticipated and managed by more proactive risk management. In the case of the mobile coverage program, some of this change in approach may have been foreseeable. The March 2021 mobile coverage ASP pilot business case set out a one-stage tendering process with construction planned for completion in June 2022. The department revised this approach in July 2021, when it changed to a two-stage process involving a technical stage and then a grant process. This was the result of additional research by the department that identified that the market may not have sufficient interest in the initial proposed approach. Undertaking this additional research earlier may have allowed for this alternative approach to be identified sooner.

In addition, the department only allowed two months in the business case for contract negotiations with providers for the mobile coverage ASP pilot program, however this has taken a significantly longer time and in one case has been ongoing for over twelve months. Given the complexities of the funding deed negotiations, this may also have been foreseeable. The department advised that some delays in the mobile coverage program can be attributed to the proposed merger of major mobile network operators which delayed funding deed negotiations.

As with the mobile coverage program, the Gig State program was also delayed by a change in approach, though this was driven by market changes. As part of the original Gig State business case, the department intended to deliver data centres in regional NSW, as well as expanding internet coverage. The business case was approved in December 2019 and the department intended to complete the Gig State program in June 2022. Little progress had been made by the time that the Gig State program underwent a significant change in scope following a review in September 2021. The department removed some aspects of the original business case, such as the construction of data centres in regional NSW, and changed the approach to other parts of the business case. The revised business case, called the Gig State addendum, delayed the planned delivery date of some projects into 2022.

The most significantly delayed sub-program has been the expansion of internet access to the towns of Wamboin, Bywong and Sutton as part of the Gig State program. In January 2019, the NSW Government announced $5 million of funding to provide internet access to these towns. The department ran a tender for this work in mid-2021 with a plan to start construction in late 2021. However, this tender resulted in no contract being awarded due to no providers being willing to provide the project within the proposed $5 million budget. The department started working on technical solutions with providers in late 2021 and gave them until May 2022 to identify solutions and potential budgets. The contract for Wamboin, Bywong and Sutton was executed in June 2022, with an expected completion date of June 2024, though given delays with construction this date will not be met. As discussed below, if the department had provided better advice to Government on the expected costs at the planning stage, it may have reduced the delays in this sub-program.

The department has not effectively managed RDCP timelines

The department has provided limited evidence of effective project management in place to monitor overall progress against program timelines, such as regularly updating a detailed project plan. The department may have identified and managed the above delays sooner through a stronger project management approach.

The department set out timelines at the outset of each of the sub-programs. This was not always done in detail but for all the sub-programs at least key milestones were mapped. While this was done at the outset, there is no evidence that the department regularly updated timelines across the various sub-programs to ensure that these projects were on track and to monitor expected completion dates.

The department provided regular updates on project status to relevant governance committees. This included providing information on upcoming milestones and associated delays. However, holistic monitoring of program completion dates and the impact of delays on subsequent milestones was not presented to the governance committees. As a result, there has been little monitoring and oversight of how projects are tracking against their target end dates.

Gaps in the governance framework have limited the oversight of the implementation of the RDCP

There are three key committees that oversee the implementation of the RDCP: the SHLF Steering Committee, the RDC Steering Committee, and the RDC Program Control Group. These three committees are intended to provide oversight of the implementation of the RDCP, however there are deficiencies that limit the effectiveness of their oversight.

The SHLF Steering Committee is intended to provide oversight of all programs funded through the SHLF, including the RDCP. Despite an intended meeting schedule of quarterly, the committee only met once in 2023 and three times in each of 2021 and 2022. While the Committee did receive reports on each of the programs funded through the SHLF at these meetings, this reporting did not identify any key risks for these projects that might affect achieving the objectives of the SHLF. This reduces the level of oversight that the SHLF Steering Committee can provide for these projects.

The RDC Steering Committee provides oversight of the RDCP and is intended to act as an escalation point for key issues in the program. While the committee receives regular reports on the components of the RDCP, including on program risks, there are some gaps that limit the oversight it can provide. The committee operated throughout 2021, 2022 and 2023 without finalised terms of reference, which were finalised in February 2024. Prior to this, it was unclear how often the RDC Steering Committee was intended to meet, but it met only four times in 2023 compared to six in 2022.

The RDC Steering Committee terms of reference include a role for the committee in making key decisions around program strategy and implementation. Prior to 2023, the committee was involved in many key decisions. For example, in 2022 it endorsed decisions around the ASP pilot grant guidelines. By contrast, a review of meeting minutes since the start of 2023 shows that the RDC Steering Committee has not made decisions or provided endorsements for any key decisions. The committee was not involved in endorsing the MBSP7 and RCP3 grant guidelines in 2023 and was not involved in strategic decision-making about the budget reprofiling in 2023 and the decision to remove the LEO satellite pilot from the Gig State program scope.

The RDC Program Control Group did not have terms of reference until February 2024. The purpose of the RDC Program Control Group is to oversee and support the strategic direction and implementation of the RDCP. This should be carried out through regular meetings and reporting, however the control group only met six times in 2023 despite an intention that they would meet monthly. The expected meeting frequency has since changed to every six weeks.

The RDC governance committees routinely discuss risks, but the department did not identify or mitigate all key risks at the outset of the program

The department has a structured approach to risk management for the RDCP, though this risk management approach has not always succeeded at mitigating key risks. The RDCP program team identified a number of key risks at the outset of each program and designed mitigations for them. In addition, the RDC Steering Committee and RDC Project Control Group both receive risk reports and discuss risks at meetings where appropriate. This reporting indicates a proactive approach to risk management throughout the program.

However, not all key risks were successfully mitigated or identified at the outset of the program. For example, one of the key causes of delays with the mobile coverage program has been protracted contract negotiations. Despite the fact that the program team understood the complexities of the mobile contract negotiations that would be required, this was not identified as a risk at the outset of the program. Later in the program this was identified by the RDC Program Control Group and Steering Committee as a key risk. While the risk was identified, it was not sufficiently mitigated, as demonstrated by the delays that resulted from the contract negotiations.

Other risks were not identified at the outset of the program. For example, the Snowy Mountains Highway Safety program was delayed due to the need to get development approval from the National Parks and Wildlife Service. There is no separate risk register for the Snowy Mountains Highway Safety program, and the potential for delays due to approval processes is not mentioned in any of the overall mobile business cases. Stronger initial project management may have allowed for this to be identified.

The Wamboin, Bywong and Sutton internet coverage program has been delayed numerous times throughout the course of its delivery. One of the key delays in 2023 was that, after the contract was signed and building works had commenced, it was discovered that challenging ground conditions with a higher than anticipated rock concentration around the towns was delaying construction. Potential delays from construction issues were not foreseen in the Gig State program risk register. While the specific issues relating to ground conditions may not have been easily foreseeable at the outset of the program, the department’s evaluation of potential providers in 2021 noted that rock was present and could have an impact on the cost of the program. It is reasonable to expect that this would have led to additional risk mitigation at the time, detailing the potential impact of the rock concentration on both cost and timelines. When the issue was eventually discussed in the RDC Project Control Group in 2023, the only mitigation for the risk was to review and monitor the existing and future schedule. This was not sufficient to mitigate the risk.

The department conducted cost-benefit analyses for all RDCP sub-programs, but did not implement the element with the highest return on investment

The ‘NSW Government Guide to Cost-Benefit Analysis’ requires that a cost-benefit analysis (CBA) be undertaken for capital, recurrent or ICT projects valued at more than $10 million. Undertaking a CBA provides a benefit-cost ratio (BCR) which helps to determine if a program will provide a net benefit to the people of New South Wales. A BCR greater than one indicates that the benefits will exceed the costs. For programs funded through the SHLF, such as the RDCP, there is no requirement for a program to achieve a BCR of greater than one.

The department conducted a CBA for the Gig State and mobile coverage programs, as well as all the sub-programs under both programs, including revising the CBA for the Gig State program after it was reviewed in late 2021. The BCR for the mobile coverage and Gig State programs are shown in Exhibit 3. Only the Gig State initial business case achieved a BCR of one, meaning that it delivers benefits equivalent to its costs. However, when this program was amended in 2021, this BCR reduced to 0.62. When combined, the RDCP does not have a BCR greater than one, meaning that it represents a net cost to New South Wales. However, as noted above, there is no requirement for the RDCP to reach a BCR of one.

Source: Department of Regional NSW.

The highest BCR was calculated for the planned investment in Low-Earth Orbit (LEO) satellites which is an element of the Gig State addendum, but this investment did not go ahead. LEO satellites can be used to provide digital connectivity to isolated properties. They sit closer to the Earth’s surface than a geostationary satellite and can transmit data with lower delay and improved connectivity. This LEO satellite pilot was identified to deliver a BCR of 2.62, including approximately 40% of the benefits attributable to the Gig State addendum. The Gig State addendum anticipated that the pilot would commence in 2022, however the department did not proceed with this. The 2023 budget reduced the funding for the Gig State program, and the department decided to discontinue the proposed pilot. The department advises it plans to revisit the LEO satellite project in mid 2025.

The RDCP’s grant guidelines largely comply with mandatory NSW Government requirements

In September 2022, the NSW Government released the revised ‘Grants Administration Guide’ (the guide) which, among other things, sets out mandatory requirements for NSW Government grant guidelines. Premier’s Memorandum ‘M2022-07 Grants Administration Guide’ makes it mandatory for agencies to follow the requirements of the guide for all grants released from 19 September 2022.

The guide states that clear and consistent grant guidelines must be prepared that contain the purpose and objectives of the grant, selection criteria (comprising eligibility and assessment criteria) and assessment process, grant value, opening and closing dates, application outcome date, the source agency, and the decision-maker.

The department developed grant guidelines for grant schemes funded by the RDCP. The guidelines explain the application and selection process, eligibility criteria and assessment criteria, and key dates. These include:

• Mobile Coverage Project – Active Sharing Partnership Grant Guidelines (September 2022)
• Gig State Grant Guidelines (October 2022)
• NSW Government Co-Investment in RCP3 and MBSP7 Program Guidelines (July 2023).

The guidelines for these three grant programs largely align with the requirements of the guide, but there were some gaps. The ASP pilot and Gig State program guidelines both note the contact person for complaints, but the RCP3 and MBSP7 guidelines do not state this. While the RCP3 and MBSP7 guidelines set out the relevant decision-maker and the role of key individuals in the assessment process, the guidelines for the ASP pilot did not identify the decision-maker and the Gig State Grant Guidelines did not provide the membership of the assessment panel making the recommendations.

The department’s grant programs were designed to target identified priority locations

Across the RDCP sub-programs, the department designed grant programs in a way that targeted funding towards its priority locations and other locations that met its eligibility criteria. The department has not been prescriptive about locations that would be funded through grant programs, but designed the programs in a way that encouraged providers to co-fund either the target locations or those that fit the criteria that the department was interested in funding.

For the Gig State grant program, the department released a list of preferred locations to potential applicants. The grant guidelines make clear that any proposals to build infrastructure to provide coverage to these areas would be given preferential treatment. The merit criteria are also aligned with this as the department awarded additional points for providing coverage to the target areas. Locations outside the preferred list were also eligible, provided they met the grant program’s objectives and eligibility criteria.

Similarly, for the mobile coverage ASP pilot program, the department released a list of preferred locations to potential applicants. The grant guidelines similarly encouraged potential applicants to follow this target list, both in terms of eligibility and also in terms of the way that the grants program provided additional points for providing coverage to the target areas. In addition, applicants could consider locations outside of the preferred list provided they met the grant program’s objectives and eligibility criteria set out in the grant guidelines.

For the co-funding opportunity with the Australian Government’s RCP3 and MBSP7 programs, a list of target locations was again provided. Applicants could consider locations outside of the target locations provided they were still eligible under Australian Government requirements for the RCP3 and MBSP7. Alternative solutions that provide mobile coverage on road corridors and mobile solutions for First Nations communities in other remote and very remote NSW locations could also be considered, however, funding was to be allocated to target locations and target transport corridors as a priority.

The department was not able to demonstrate a similar approach for the co-investment in the Mobile Black Spot Program Round 5A. The Australian Government developed eligibility criteria for the program, which align with the department’s mobile program objectives.

The department has selected grant recipients in line with its funding priorities

The department developed grant guidelines and an assessment methodology for the Gig State program and the ASP pilot program to guide its assessment panel, and applicants, through the process. The department assessed the applications for the Gig State and the ASP pilot grant programs against the eligibility and merit criteria contained in its guidelines, and in accordance with its assessment methodology. This resulted in the department funding locations that aligned with its target locations or areas that were in line with the purpose of each grant opportunity.

For the Gig State grant program, the department determined that projects were to be located in one of the 93 regional NSW Local Government Areas (LGA) identified in the grant guidelines. Eligible locations were in areas where internet access was via satellite services only and there were no committed or planned projects for fixed services in the area. The assessment panel for the Gig State grants recommended projects in 34 eligible locations from four applicants, for funding totalling $58.3 million (excl. GST), intended to bring improved connectivity to around 13,900 premises.

For the ASP pilot program, eligible locations were areas of regional NSW, where there was no existing handheld coverage provided by any Mobile Network Operators (MNO) or existing handheld coverage was provided by only one MNO. The assessment panel for the ASP pilot grants recommended 32 projects for funding totalling $30.4 million (excl. GST), intended to improve mobile coverage across ten regional LGAs. All other projects were considered not suitable for funding or ineligible.

The department provided a list of preferred locations for both grant programs. Applicants received a marginally higher score against assessment criteria if they put forward a preferred location but the location they identified could still be accepted if it was not in a preferred location but met the eligibility criteria. Funding was allocated to the majority of the Gig State program preferred locations identified in the Gig State business case addendum, but funding was allocated to only two of the 23 preferred locations identified in the business case for the ASP main program.

For the grants co-funded by the Australian Government (RCP3 and MBSP7), the department prioritised and selected grant recipients based on whether they met the eligibility criteria. It developed an assessment methodology to guide the assessment panel through this process. A probity advisor was present at both assessment panel meetings.

The department intends to further verify the RCP3 and MBSP7 application’s compliance with the RDCP objectives and eligibility criteria, following the assessment of applications by the Australian Government. Once verified, deeds will be negotiated and issued.

The department did not advise Government on the full cost of the Wamboin, Bywong and Sutton project, leading to a protracted and difficult process

The department’s process for awarding the grant to construct a fibre network for internet connectivity in the Wamboin, Bywong and Sutton regions was complex. The department appears to have estimated the initial costs of this program to be significantly higher than the funds allocated to the project. The department did not advise Government of this, and conducted the tender process based on the budget of $5 million committed by the Government. This budget proved insufficient, and the department had to request additional funds to contract the project. Not providing this advice to Government at an earlier stage means that the process which followed was more complex and protracted than it may have been if the department had provided this advice.

In January 2019, the NSW Government announced that it would provide $5 million to upgrade internet in the Wamboin, Bywong and Sutton region based on costings undertaken by a local community organisation. The department included this cost in the Gig State business case in December 2019 and also the Gig State addendum in September 2021. Documentation from late 2020 indicates that the department conducted an initial estimate that the full cost of the Wamboin, Bywong and Sutton project would be up to $16.3 million. It is unclear whether this was conducted before the Gig State business case was completed. The department was unable to provide the analysis that led to this initial cost estimate to the audit team. However, this indicates that the department was aware that the cost of the project would be greater than $5 million but did not provide this advice to Government. The additional cost was to be funded from the remainder of the Gig State business case.

In mid-2021, the department commenced a tender process with a budget of $5 million in January 2021. Only two applicants responded to this initial request for tender, and only one was evaluated as meeting the technical and construction requirements of the project. The cost estimates provided in the complying tender response were significantly higher than $5 million. As a result, the department did not award a contract following this tender.

The department then planned to undertake an in-depth analysis into alternative technology options. It noted the most promising option in terms of speed of delivery, quality of service, and value for money was LEO satellites. The department was unable to provide a copy of this analysis and so it is unclear the extent of the work undertaken to find alternative solutions for Wamboin, Bywong and Sutton rather than the construction of a fibre network to the premises.

After the initial market approach resulted in no contract being awarded, the department altered its procurement approach. A closed Expression of Interest (EOI) was sent to both respondents to the request for tender in November 2021 seeking a recommended technical solution, a proposed delivery method and timeframes. Both respondents achieved satisfactory scores for the EOI and were invited to submit a detailed design. As the department had determined through the tender process that the budget of $5 million was insufficient to ensure that it could provide internet services across the Wamboin, Bywong and Sutton region, the budget limit for the procurement was increased.

Both respondents submitted a detailed design and in May 2022 the department received approval to negotiate. The unsuccessful respondent scored marginally higher against the selection criteria. However, the assessment team considered that their proposal contained too much unmitigated risk. In May 2022, the department received approval to proceed to the negotiation phase with the successful proponent. Following this negotiation, a $9.5 million grant was awarded to the successful respondent to connect 1,352 premises. Around 140 premises were not included in the scope due to the significantly higher costs in connecting these premises.

The project cost has since increased to over $12 million, in part due to challenging terrain and ground conditions. Additional funding of around $1.7 million was also approved to connect an additional 134 properties that were identified during the detailed design phase. The department advises that these were initially missed due to boundary changes, incorrect council records and quality issues in the geospatial databases. It indicated that this is a separate group of properties to the 140 premises that were excluded due to higher connection costs.

The fact that the Wamboin, Bywong and Sutton project has a total cost of over $12 million, more closely aligned with the department’s internal cost estimate, indicates that fully advising Government of the costs may have saved significant time in the delivery of the project.

The department monitors the progress of its grant agreements but has not formalised its acquittal process

The department receives progress reports and milestone reports from grant recipients to assist in monitoring the progress of RDCP projects and assess if works provided match the requirements listed in the grant funding agreements. It also advises it has regular meetings with grant recipients, although no minutes are kept of these meetings.

The projects that have progressed to the construction phase are:

• Mobile coverage to Brewarrina and Wilcannia through the mobile coverage ASP pilot
• Improved internet to Wamboin, Bywong and Sutton.

The department receives regular progress reports for both projects, including some photographs and technical drawings. The reports provide information on progress against milestones and any changes to expected completion dates.

The department receives quarterly progress reports on improved internet for the Cobar corridor and the 56 other sites scheduled for fixed wireless internet, which are yet to progress to construction. The current scheduled completion date is March 2025. It also receives monthly reports on progress with mobile towers it is co-funding with the Australian Government as part of the Mobile Black Spot Program Round 5A.

The department provided few acquittal process documents or milestone acquittal documents, apart from the site qualification report for the Cobar corridor and its evaluation of the detailed design for the Wamboin, Bywong and Sutton project. The department advises it has an acquittal process in place for processing milestone reports, however it is yet to formalise this process. The three projects which have progressed enough to require acquittal are Wamboin, Bywong and Sutton, Wilcannia and Brewarrina, and the Cobar corridor.

The department has provided funding deeds for each project it has funded. Whilst the deeds include milestones, they do not include the dates for each milestone making it more difficult for the department to track the progress of each project.

The department’s approach to reporting its expenditure on consultants is inconsistent and does not always meet reporting requirements

Under the Annual Reports (Departments) Regulation 2015 agencies are required to report any consultancy engagements over $50,000 in their annual reports. The NSW Procurement Board Direction PBD-2023-05 Engagement of professional services suppliers defines a consultancy agreement as a type of professional services agreement where a person or organisation is engaged to provide recommendations or professional advice to assist decision-making by management.

The department has several professional services agreements as part of the RDCP, some of which are consultancy engagements within this definition and some of which contain elements of the contract that would be considered a consultancy agreement. For example, one of the major consultancy agreements involves providing strategic advice across the Gig State program, as well as providing advice on market engagement, and reviewing technical advice. This aligns with the definition of a consultancy agreement as the contracted organisation is providing professional advice to assist decision-making by management.

The department has not reported any of its agreements used as part of the RDCP in its annual reports, despite having several agreements that exceeded the $50,000 threshold which may fall into this definition.

The department advises that the agreements are categorised in the General Ledger as contractors and as such, are not required to be reported in the Department’s Annual Report. This interpretation is not in accordance with NSW Treasury and NSW Procurement Board requirements. It also identifies one contracted consultant as a ‘consultancy’ in its contract variation documentation but has not reported this expenditure in its annual reports.

Further, the department has not applied its interpretation consistently. For example, it has reported the preparation of some strategic and business planning documents as consultancies in its annual reports and not others.

The department is not monitoring the outcomes of the RDCP

Measuring outcomes of a program is important to determine whether that program is fulfilling its intended purpose. While many elements of the RDCP are still at an early stage, there is value in monitoring the outcomes of those elements which have completed construction to inform project implementation. There are no outcome measures for the effectiveness of the RDCP as a whole, and only limited measures for the mobile and Gig State programs. The department has the following outcome that it has set out for the Gig State program:

• Improve the digital connectivity (accessibility) in rural and remote NSW communities.

When developing the final business case for the Gig State program, the department utilised the ADII scores to identify the digital divide between Metropolitan Sydney and rural NSW. The ADII uses data from the Australian Internet Usage Survey to measure digital inclusion across three dimensions of access, affordability and digital ability. While the department utilised the ADII to determine the baseline for accessibility of digital connectivity in regional and remote NSW communities, the department is not using the ADII to measure whether the program has led to improvements in these communities. This limits the department’s ability to determine whether the RDCP has met its objectives.

At the time of the Gig State business case being developed, rural NSW ADII scores were reported, allowing the department to utilise the figures as a baseline, but since 2020 these are not publicly reported. The department is in the process of determining how it can use ADII scores to measure the performance of the program over time.

In addition to the Gig State program outcome measure, the department has one outcome measure for its mobile coverage program:

• Square kilometres with improved mobile coverage in regional NSW.

This outcome measure will not allow the department to understand the impact of the RDCP’s mobile coverage program. While measuring the number of square kilometres of coverage will allow the department to determine whether the mobile towers it is funding are achieving the intended extent of new mobile coverage, it will not allow the department to measure the quality of service, price of coverage, and other key information that could measure the impact of the new coverage.

In December 2023, the NSW Telco Authority released the NSW Digital Connectivity Index (DCI), which provides an overview of connectivity in each LGA and suburb across NSW. Each LGA and suburb is given a score out of 100 for access, affordability and demographics (as a proxy for the ability to use technology). The DCI includes several data points, including coverage from telecommunications providers, mobile signal strength, and internet speed. Given that the DCI includes useful data points and can allow for data to be inspected at the suburb level, there is an opportunity for the department to use this to identify the impact of its program both at a statewide level and in regions targeted for funding. However, the department has no plans to utilise the DCI to measure program performance.

In addition to not collecting data to measure the overall effectiveness of the RDCP, the department is also not collecting data to measure whether a number of the objectives of the Gig State and mobile coverage programs are being achieved. For example, both programs aim to reduce the price of digital services in regional areas, however there is no measurement of price in place to determine whether this is being achieved. Similarly, there is no plan in place to measure the speed of internet services or signal strength for mobile services, despite improvements in these things being part of the objectives of both programs as set out in their business cases.

The department is also not measuring whether there are improvements in competition in the mobile market through the mobile coverage program, despite one of the objectives of that program being to encourage competition in the regional telecommunications market. The department also has no plans to measure its contribution to the Closing the Gap target to understand the impact of the RDCP on Aboriginal communities. This is despite it identifying that seven locations with current or pending funding will support discrete Aboriginal communities. Four of these locations are part of the ASP project for Wilcannia and Brewarrina, and the other three are funded through the MBSP7 project.

The department has some output performance measures in place for the RDCP, but these focus on contracted outputs rather than outcomes

The department has identified performance measures for the program in reporting templates, in its final business cases for the Gig State and mobile coverage programs, and in its evaluation plan for the RDCP. These performance indicators measure the outputs of the program rather than the outcomes that would demonstrate whether program objectives have been met.

The measures that the department uses to report to NSW Treasury as part of its budgeting process have changed over time. Until June 2023, the department used two key output measures to determine the progress of the RDCP:

• Number of premises covered by signed contracts to deliver upgraded internet connectivity.
• Number of sites with signed contracts for new mobile coverage.

As noted, these are output measures and will not enable the department to determine whether the project is delivering its intended purpose. Since July 2023, the department has used two output measures:

• Number of premises covered by signed contracts to deliver upgraded internet connectivity.
• Contracted square kilometres for new and improved mobile coverage.

These four measures relate only to contracted coverage and do not provide a clear picture of ongoing progress with the construction and connection of new mobile and internet projects. Projects can have long lead times for a variety of reasons such as acquiring access to land, designing a solution and the time required to construct the solution. In addition, only measuring contracted coverage will not enable the department to determine whether these outputs are being delivered and will not reflect delays in those stages, nor will it enable the department to determine whether the towers are achieving their intended purpose. While there is value in measuring contracted coverage as an early lead indicator of performance, there is also value in reflecting the current state more accurately through measuring the progress of the construction of each project.

The department did not meet its original mobile coverage performance targets but met its Gig State program target

As noted above, the department had three metrics that it was using to measure the RDCP until June 2023. The department successfully achieved its Gig State program target but did not achieve its mobile coverage program targets. Exhibit 4 shows the results against targets for the RDCP measures. As can be seen, the result for square kilometres of improved mobile coverage delivered was significantly below the target.

* This comprises two towers funded through the ASP project and 22 towers co-funded through the Australian Government’s Mobile Black Spot Round 5A. This does not include five small towers for the Snowy Mountains Highway Safety project as the department has identified these as a temporary service.

Source: Audit Office analysis.

The department revised its performance measures after June 2023. This included revising output targets for the mobile and Gig state programs. The updated performance targets can be seen in Exhibit 5. The mobile coverage program performance measure was changed to measure the contracted square kilometres of new coverage rather than the actual square kilometres of new coverage. At the same time, the target value increased from 36,000 square kilometres to 60,000 square kilometres. The target value for the Gig State program was also updated compared to the 2023–24 target.

Source: Department of Regional NSW.

The department had nearly achieved its December 2025 target for contracted upgrades to internet connectivity by June 2023. As can be seen in Exhibit 4, 13,330 premises were covered by signed contracts to deliver upgraded internet connectivity as at June 2023.

In early 2023, the department estimated that it would have 12,279 square kilometres of new or improved mobile coverage delivered by December 2025. The department advised that it is likely to deliver on this forecast as early as December 2024, through its co-funding of two ASP locations and 22 locations under the Commonwealth’s Mobile Back Spot Program 5A.

There is uncertainty around whether the data the department is using is reliable to measure its performance

The department is collecting or planning to collect data from grant recipients to determine whether they are delivering the intended projects to the required quality. The funding deeds contain obligations on the quality and extent of the services to be provided by grant recipients and require that the contracted organisations report to the department on the construction and the extent of coverage (new ground covered for the mobile towers and number of premises connected for internet coverage). This aligns with the output measures set out above. The department is not collecting information that it could use to inform outcome measurement as part of its grant funding deeds with each grant recipient.

Grant recipients provide the department with the data that it has requested in line with the terms of the funding deeds. This information is collected through a regular schedule of status reporting. These status reports include information on progress with internet or mobile coverage, including the number of premises that will be able to connect to a service.

Information on the availability of fixed fibre connections to premises should be reliable, as with the Wamboin, Bywong and Sutton project. However, data on the availability and quality of fixed wireless internet connectivity and mobile coverage is likely to vary with terrain. While the department is collecting this information, it currently has no plans or a formal process to undertake validation testing following each project completion. This means that the department will not be able to provide assurance that the information collected is accurate.

The department has not updated the expected benefits of the program despite significant changes in scope

In September 2021, following a review of the Gig State program, the department prepared an addendum to the original Gig State business case to change the program from capital expenditure to operational expenditure, and set out a range of other changes. The department’s addendum to the business case noted that the approach to delivering benefits would remain the same, and it did not revisit the benefits realisation register nor attempt to recalculate expected benefits. Given the significant scope changes in the business case addendum, it is likely that there would have been an impact on expected benefits that would justify recalculating the program benefits.

This was not the only time where significant changes in the Gig State program’s operations did not result in an updated benefits realisation register. As noted in the introduction, the RDCP budget was reduced in the 2023 budget, and the remaining budget was extended out to 2028. As discussed above, the change in budget coincided with the department’s decision to discontinue the LEO satellite pilot, which was anticipated to deliver 40% of the financial benefits of the program. The change in budget profile for the program has likely led to a change in the benefits profile of the program, however the department has not updated its program assumptions in line with this change.

The department has documented key lessons learned from its funding rounds to date

Documenting lessons learned from early delivery of any given program is important, particularly pilot programs, to ensure that these can be incorporated into future program development. The department has documented lessons learned across the two programs of the RDCP, including the early grant rounds.

For its Gig State program, the department documented lessons learned in relation to the management of grants, industry engagement, the grant guidelines, the assessment of grants, and the time that the grants went to market. These lessons include reinforcing positive experiences, such as releasing a list of preferred locations to applicants, which the department believes served to encourage funds to be directed to those areas. The department also identified potential improvements, including how it communicated with industry and the data that it would request from future applicants. There have been no grant programs run through the Gig State program since these lessons were documented so it is not yet clear whether the department will implement changes as a result of these lessons learned.

As noted above, the mobile coverage ASP pilot program was delivered across two phases: the first phase involved working with industry to determine potential technical solutions, and the second phase was a grant program to deliver the preferred solutions. The department commissioned a lessons learned report of the first phase of the ASP pilot program with the intention of using this to inform the mobile coverage ASP main program business case development. The lessons learned report and the mobile coverage ASP main program business case were both completed in the same month, however, meaning that lessons could not be fully incorporated into that business case. The department has also identified additional lessons learned specifically in relation to the grant process. There have been no grant programs run through the mobile coverage ASP main program since these lessons were documented so it is not yet clear whether the department will implement changes as a result of these lessons learned.

In addition, the department has conducted an internal audit on the governance of the RDCP. The internal audit had largely positive findings about the governance structures and the grant guidelines. The internal audit did not make findings on the governance issues outlined above, such as not having finalised terms of reference. However, the internal audit did note that not all probity advice had been documented and some had been provided verbally, which increased the risk of grant processes not being undertaken with integrity.

The department has planned evaluations for all grant programs within the RDCP

The department has a draft evaluation plan for the RDCP that includes evaluations for each program to validate whether they have achieved their objectives, as well as finalised evaluation plans for each of the programs. Both process and outcome evaluations are planned. Process evaluations ensure that planned processes were followed and that lessons are learned for future grant programs. The department is planning process evaluations for when all funding deeds have been signed and outcome evaluations are planned for after project delivery is largely complete.

The sub-programs have not yet reached the point where the department will undertake outcome evaluations. The department has indicated that the outcome evaluations will be undertaken when each project has been delivered, which means that while it will determine whether the project has achieved its objectives, it will not be measuring outcomes on an ongoing basis to determine whether changes are needed for the program to meet its objectives. The funding deeds with grant recipients make it clear that the department will undertake an evaluation and may collect relevant information for this purpose. While the department should be able to collect information, the limitations in data collection noted above may need to be resolved to ensure that required data is available.

Appendix one – Response from agency

Appendix two – About the audit

Appendix three – Performance auditing

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Parliamentary reference - Report number #397 released 27 June 2024.

What this report is about 

This report assesses how effectively SafeWork NSW, a part of the Department of Customer Service (DCS), has performed its regulatory compliance functions for work health and safety in New South Wales. 

The report includes a case study examining SafeWork NSW's management of a project to develop a real-time monitoring device for airborne silica in workplaces. 

Findings 

There is limited transparency about SafeWork NSW's effectiveness as a regulator. The limited performance information that is available is either subsumed within DCS reporting (or other sources) and is focused on activity, not outcomes. 

As a work health and safety (WHS) regulator, SafeWork NSW lacks an effective strategic and data-driven approach to respond to emerging WHS risks. 

It was slow to respond to the risk of respirable crystalline silica in manufactured stone. 

SafeWork NSW is constrained by an information management system that is over 20 years old and has passed its effective useful life. 

While it has invested effort into ensuring consistent regulatory decisions, SafeWork NSW needs to maintain a focus on this objective, including by ensuring that there is a comprehensive approach to quality assurance. 

SafeWork NSW's engagement of a commercial partner to develop a real-time silica monitoring device did not comply with key procurement obligations. 

There was ineffective governance and process to address important concerns about the accuracy of the real-time silica monitoring device. 

As such, SafeWork NSW did not adequately manage potential WHS risks. 

Recommendations 

The report recommended that DCS should: 

• ensure there is an independent investigation into the procurement of the research partner for the real-time silica detector 
• embed a formal process to review and set its annual regulatory priorities 
• publish a consolidated performance report 
• set long-term priorities, including for workforce planning and technology uplift 
• improve its use of data, and start work to replace its existing complaints handling system 
• review its risk culture and its risk management framework 
• review the quality assurance measures that support consistent regulatory decisions

SafeWork NSW is the work health and safety regulator in New South Wales. It was established by the State Insurance and Care Governance Act 2015.

As the regulator, SafeWork NSW is responsible for, among other things, enforcing compliance with the Work Health and Safety Act 2011 (the WHS Act) and the Work Health and Safety Regulation 2017. The regulator’s full functions are set out in section 152 of the WHS Act.

SafeWork NSW’s operations are guided by seven regulatory priorities for 2023, which contribute to three strategic outcomes:

• Workers understand their rights and responsibilities.
• Employers ensure that work is healthy and safe, with no advantage for cutting corners.
• Regulation is fair and efficient.

This audit assesses the effectiveness of SafeWork NSW in monitoring and enforcing compliance with the WHS Act, through the examination of three lines of inquiry:

1. Does SafeWork NSW have evidence-based processes to set its objectives and priorities for monitoring and enforcing compliance?
2. How effectively does SafeWork NSW measure and report its performance in monitoring and enforcing compliance against the WHS Act?
3. Are SafeWork NSW's policies and procedures for monitoring and enforcing compliance applied consistency across different sectors?

As SafeWork NSW is part of the NSW Department of Customer Service (DCS), the department is the auditee. Prior to 2019, SafeWork NSW was located in the former Department of Finance, Services and Innovation. Unless otherwise stated, any reference to SafeWork NSW should be read as including the broader department in which it sits.

This chapter considers whether SafeWork NSW has evidence-based processes to set its objectives and priorities, including how it takes into account operational feedback and expertise. It also includes how existing and emerging risks are assessed as part of the priority-setting process, and how planning and prioritisation takes into account resourcing, including workforce skills and capacity.

SafeWork NSW's operating model is now based on annual regulatory priorities, rather than longer-term priorities

From 2016 to 2022, SafeWork NSW worked under a six-year Work Health and Safety Roadmap (‘the Roadmap’). The Roadmap was revised in August 2018 and included the following statements:

In addition to the Roadmap, SafeWork NSW operated under its 2019–20 Strategic Business Plan.

After SafeWork NSW was moved into DCS, the Roadmap was subject to a mid-term evaluation by ARTD Consultants in 2020. SafeWork NSW management subsequently accepted all nine recommendations of that mid-term evaluation, which included the following:

• Strengthen business intelligence data systems to allow managers and inspectors to access to real-time data on safety incidents and workers compensation claim data (Rec 5).
• Improve evidence available to assess Roadmap outcomes in 2022 (Rec 9).

In 2023, SafeWork NSW replaced its six-year Roadmap with a model of setting annual regulatory priorities. Seven regulatory priorities were set for 2023. These priorities were:

•  gig economy – increase safety and WHS compliance in the sector, particularly food delivery riders and health care
• safety around moving plant – reduce workplace safety incidents, particularly forklifts
• seasonal workplaces – increase WHS compliance to support itinerant workers, particularly in the agricultural sector and those working with amusement devices
• psychological safety – reduce the prevalence of psychological injury at workplaces, with a focus on mental health and well being
• respect at work – reduce the incidence of bullying, sexual harassment, and customer aggression in the workplace, particularly in make dominated sectors and healthcare
• exposure to harmful substances – reduce the incidence of worker exposure to dangerous substances in the workplace, particularly silica and dangerous chemicals
• falls – reduce the incidence of falls from heights with a particular focus on construction.

These priorities are intended 'to deliver on three strategic outcomes’:

• Workers understand their rights and responsibilities.
• Employers ensure that work is healthy and safe, with no advantage for cutting corners.
• Regulation is efficient and fair.

As SafeWork NSW works to deliver on these outcomes, the focus is on priority or vulnerable groups of workers – these being younger workers, workers from culturally and linguistically diverse backgrounds (especially newly arrived workers), and Aboriginal people.

Shorter-term priorities are intended to enable SafeWork NSW to be more responsive to work health and safety risks and were developed in consultation with operational staff

The adoption of shorter-term priority-setting is intended to enable a more agile approach to regulation that, according to DCS, is better able to adapt to changes in risk profiles and industries. It was put to the audit by some interviewees that the six-year plan was less able to respond to rapid changes in the economy that may lead to quickly emerging work health safety risks. An example commonly cited was the significant increase in gig economy workers, including in areas such as food delivery workers and personal care workers. It was put to the audit that this example highlighted new WHS risks unique to those emerging workplaces.

According to DCS, in addition to being more agile and responsive to macro changes in the workforce, the annual priorities are intended to enhance accountability by creating a more timely and contemporaneous link between activities and outcomes. The more immediate nature of annual priorities is also designed to provide a more immediate and tangible link to SafeWork NSW’s activities and ensure better accountability for delivery.

The annual priorities are intended to complement SafeWork NSW’s commitments under the national Australian Work Health and Safety Strategy 2023-33. This strategy sets a high-level vision and goal for Australia’s work health and safety regulators, including to address agreed persistent challenges, such as psychosocial risks, vulnerable workers, and ensuring that small businesses are adequately supported to meet their work health and safety obligations.

The process for developing regulatory priorities for 2023 involved internal consultation with SafeWork NSW executive directors, directors, managers, inspectors, project leads, as well as consultation with external stakeholders and experts. There is evidence that SafeWork NSW considered the feedback it received, including from its inspectors.

SafeWork NSW staff identified potential risks that SafeWork NSW will need to manage as the process for developing regulatory priorities continues to develop

The audit team interviewed almost all SafeWork NSW executive directors, directors, and team managers, particularly those performing regulatory functions. These interviews revealed a strong level of commitment to the purpose and functions of SafeWork NSW, as well as a shared desire to see the organisation fulfil its potential.

In regard to the annual priorities, senior executives and the majority of team managers we interviewed supported the adoption of annual priorities and expressed confidence that establishing annual priorities would improve the effectiveness of SafeWork NSW in delivering its compliance functions. It was noted by SafeWork NSW that the shift towards regulatory priorities 'brings us to a level of maturity mirroring the approach of regulators such as ASIC and the ACCC'.

While most staff interviewed during this audit welcomed the sharper focus and greater flexibility afforded by shorter-term priorities, others identified a range of risks. Some experienced people managers in SafeWork NSW expressed significant doubts about the pursuit of annual regulatory priorities. Risks identified during audit interviews included:

• That the short-term focus had prevented SafeWork NSW from establishing a longer-term goal or vision.
• That the annual priorities were simplistic and lacked sufficient detail to engage the regulator, industry, and the community.
• That short-term priorities would make it difficult to meaningfully measure and report progress, especially for activities and initiatives that may take longer to achieve demonstratable change.
• That the process of considering the next annual priorities may need to commence well before initiatives for the current year have been completed (or even commenced), hindering how effectively lessons can be incorporated into future planning.
• That frequent changes in regulatory priorities may make it difficult to ensure that the SafeWork NSW workforce has appropriate capability and capacity, particularly for potentially complex emerging threats such as artificial intelligence in workplaces.

In response to these risks, SafeWork NSW has noted that:

• SafeWork NSW has a separate vision in addition to the regulatory priorities. This is 'healthy, safe and productive working lives'.
• A review process will occur to understand what went well and what did not from the first year of regulatory priorities before finalising priorities for 2024.
• Planning will improve over time as the process reoccurs, and lessons learned will be linked to future priorities.

The inability to achieve full ‘buy-in’ from experienced people managers in SafeWork NSW suggests that change management, including consultative and communication processes, has not been completely successful. SafeWork NSW advised that this initiative was a significant shift for all its staff and in particular middle management. Given this, the leadership of SafeWork NSW should prioritise investment in effective change management processes, especially if the annual regulatory priorities are anticipated to change in 2024.

Importantly, the SafeWork NSW leadership team should undertake strategic planning to ensure that a meaningful set of longer-term priorities underpin their investment decision-making on organisational fundamentals, such as a capable and sustainable workforce and fit-for purpose technology systems. Without this, there is a real risk that the regulator's business needs and priorities will be overtaken by the priorities of a much bigger department.

SafeWork NSW consulted with external stakeholders in determining its 2023 annual regulatory priorities

SafeWork NSW developed a discussion paper in 2022 for external stakeholders as a precursor to consultation on its 2023 annual priorities. This discussion paper outlined an intent by SafeWork NSW to develop a new strategy that would prioritise activities that were the biggest points of leverage to drive material change and were the biggest risks and most important trends affecting WHS in NSW.

SafeWork NSW considered expert feedback and expertise in the development of its regulatory priorities through this process. A summary document detailing the rationale for its regulatory priorities provides evidence that feedback from external stakeholders, such as unions and industry groups, were taken into account.

SafeWork NSW has not established a formal process for determining its regulatory priorities for 2024 and beyond

SafeWork NSW has an indicative timeline for preparing its 2024 priorities which provides that the priorities will not be settled until March 2024 and will be based on the results of the previous year’s priorities to December 2023. However, no ongoing process for determining annual priorities in each future year was settled at the time of writing this report. Some priorities might be expected to remain relatively constant, especially persistent challenges such as preventing falls from heights. However, if the annual priorities model is to meet the expectation of being agile, then new and emerging priorities will need to be identified, understood, scoped, and responded to with relatively short notice.

Elements of the 2023 regulatory priorities will overlap with any new or revised priorities, such as the monitoring and evaluation framework, and the three-year Construction Services Blueprint. SafeWork NSW explains that these longer-term initiatives are 'intended to support the delivery of priorities that are likely to run over many years, providing more granular detail on specific drivers of harm, regulatory responses and targets'.

SafeWork NSW does not effectively use data to inform its priority-setting or assessment of risk, despite adopting the recommendations from the 2020 mid-term Roadmap evaluation

SafeWork NSW states that it chose its regulatory priorities in 2023 based on the following factors - potential for serious harm or death, new or emerging risks, and increases in the frequency of an issue. An emerging issue is where:

SafeWork NSW has a substantial data repository, with over 20 years of case and activity data contained in its Workplace Services Management System (WSMS). However, SafeWork NSW does not effectively interrogate this data to provide an evidence base for its regulatory functions.

SafeWork NSW has only recently established a data governance committee. SafeWork NSW also advised that a data science function was created within the Centre for Work Health and Safety during 2023, repurposing existing resources and supported by a business intelligence working group comprising of inspector representatives from operational directorates.

While this data science function is newly created, SafeWork NSW does not have a strategic business intelligence function that is both recognised and understood across each directorate and team, and the ability of its technology infrastructure to deliver sophisticated strategic and operational data intelligence has been limited.

As a result of this lack of central coordination and capability, directorates have sought to develop their own data analysis capability, with inconsistent, fragmented and potentially duplicative results. The audit did find specific (albeit isolated) examples of data being used to inform decision-making, though these efforts were disparate and uncoordinated at the directorate level.

SafeWork NSW said that data is used to inform leadership discussions at the quarterly SafeWork NSW Leadership Meetings, and monthly operational executive meetings. The audit did not review the agenda papers for these meetings.

At the 2020–21 NSW Parliament Budget Estimates Committee hearing, SafeWork NSW stated that it:

SafeWork NSW has started to use artificial intelligence to interrogate historical compliance data to rate the risk of different employers. However, this is used inconsistently across SafeWork NSW and there is limited evidence about its effectiveness. A similar tool does not exist for industry or product-related trends or relationships that may assist SafeWork to proactively identify high-risk workplaces and issues.

Outdated technology and uncertainty in planning its replacement is limiting SafeWork NSW's ability to effectively use its data for analytics and insights

SafeWork NSW uses WSMS to manage work health and safety data. This system has been in place for over 20 years. It was noted in interviews conducted during this audit that this data system is at the end of its effective life.

Issues noted by users of WSMS include:

The lack of governance associated with data management of WSMS. There is no data custodian, and a formalised data quality assurance process does not exist. This means that data can be extracted from the system with no controls on the accuracy of the analysis.

Access to WSMS cannot be tracked (and is therefore not auditable).

• Data quality is variable, depending on the quality of notes provided by inspectors (with individuals noting that these notes could be full of speculation), and inconsistent approaches to entering information into the system. At the same time, inspectors noted that entering information into the system can be an administrative burden due to duplication and time requirements.
• Analysis cannot readily be undertaken on a geographic basis (for example, all high-risk employers within a particular region).
• As WSMS does not track information about the directors of companies, it is unable to identify risks associated with 'phoenixing', where directors of wound-up businesses establish new entities, or other forms of related-entity risk. The audit team linked WSMS data with ASIC data to match company directors with company and notice data. This was done in order to understand the additional intelligence that could be used to inform risk-based decision-making. As an example, the audit found that there is a large number of companies that have not received notices from SafeWork NSW but may be at higher risk due to the conduct of their directors:
  • There were approximately 151,000 companies with directors that were also linked to at least one other company that had received at least one type of notice from SafeWork NSW.
  • There were approximately 24,500 companies with directors that were also linked to one or more companies that had cumulatively received over 100 notices from SafeWork NSW.
  • There were approximately 8,600 companies with directors that were also linked to one or more other companies that had cumulatively received over 400 notices from SafeWork NSW.

In addition to the feedback provided by WSMS users within SafeWork NSW, the audit team also found related data quality issues during the course of our own analysis, including:

•  Industry analysis is more challenging to perform because specific industry data points and grouping details are not captured in WSMS.
• There was no systematic method to identify all silica-related incidents. The search terms were not standardised and relied on judgement, for example: ‘silic’ (potentially capturing both ‘silica’ and ‘silicosis’) and ‘benchtop’, though SafeWork NSW advised that consultation with subject matter experts informed these searches. There is a high-risk of false positives and incomplete analysis without time intensive manual review of each identified case. WSMS was not readily able to provide data on silica-related complaints without workarounds and manual file review (which proved unreliable) and requiring significant effort from data staff in both the Audit Office and SafeWork NSW.
• Test data is captured in production systems, rather than in test systems. These records do not have a unique identifier and are difficult to identify and isolate for business intelligence analysis.
• Data validations are not enforced (for example, on Australian Business Number, Australian Company Number columns). Instead, the data entry fields allow for incorrect details to be captured or left blank without explanation from the staff entering the data.

SafeWork NSW provided advice to the audit team that an upgrade of WSMS was planned as part of the broader e-regulation program across DCS (that is, the single digital platform for all 28 business regulators). However, this upgrade is now uncertain as there is no funding for SafeWork NSW to be onboarded to the new platform. This means that for the foreseeable future SafeWork NSW will be constrained by the limitations inherent to WSMS.

SafeWork NSW took around eight years to actively and sufficiently respond to the emerging risk of respirable crystalline silica in manufactured stone

Silicosis is a progressive, occupational lung disease resulting from inhalation of respirable crystalline silica (RCS). Silicosis is one of the oldest known occupational diseases, particularly affecting industries like mining. In Australia, silicosis has been a known cause of death and disability for over 100 years. This disease is preventable through appropriate workplace practices in a hierarchy of controls, which includes the use of correct personal protective equipment.

The use of manufactured stone for applications such as kitchen benchtops became popular in Australia in the early 2000s. Other substances that contain silica, such as rock, stone, clay, gravel, concrete and brick, may contain between 2% and 40% silica. In contrast, manufactured stone contains up to 95% silica. Workers exposed to respirable crystalline silica from manufactured stone are more likely to develop severe silicosis (and other serious lung diseases), and more quickly, than workers exposed to silica from other sources.

In 2010, international research was published that pointed to the specific heightened risk posed by the high silica content of manufactured stone used primarily for kitchen countertops and bathroom fixtures. This was confirmed by subsequent research published in 2012, which concluded that, in regard to a documented outbreak of silicosis among manufactured stone workers in Israel:

This research was relevant to Australia as the sample of workers was derived from the same Israeli-based manufacturer and exporter of manufactured stone that supplies the majority of the product used in Australia.

The first identified group of related workers who contracted silicosis in NSW was reported in literature in 2015. Further cases have been reported in the media since 2015. These included examples of relatively young workers developing silicosis, presumptively from inhaling silica dust derived from manufactured stone.

In 2017, SafeWork NSW listed RCS as one of the top ten priority chemicals in its 2017–2022 Hazardous Chemicals and Materials Exposures Baseline and Reduction Strategy (dated October 2017).

A legislatively-mandated case finding study conducted by SafeWork NSW in 2021³ reported that screening conducted by icare between 2017–18 and 2019–20 found an average of 29 cases per year of silicosis among workers in the manufactured stone industry.⁴ Despite the relatively small size of this workforce, this was three times the number of cases of all workers engaged in all other at-risk industries.

While the heightened risk posed by respirable crystalline silica in manufactured stone was first published in research in 2010 and detected in cases from 2015, SafeWork NSW’s first substantial practical response commenced in 2018–19.

From July 2018, SafeWork NSW convened a Manufactured Stone Industry Taskforce, including representatives from industry, unions, health, education and other government agencies. During the term of this taskforce (which ended at 30 June 2019), SafeWork NSW conducted 523 visits to 246 manufactured stone sites. These inspections resulted in 656 improvement notices being issued, along with 43 prohibition notices (this included matters not related to silica). Prior to this, the extent of SafeWork NSW’s active response to the emerging risk was to conduct a limited inspection program of six work sites in May 2017 (one site) and August 2017 (five sites). The results of these six workplace visits were incorporated into a research project report that was finalised in August 2018.

In the period from 2012 to 2018, SafeWork NSW also received complaints about silica-related matters, including matters not related to manufactured stone. These are detailed in Exhibit 1 below. The number of complaints was a relatively small proportion of all complaints received, though the number increased after 2018. This increase may be a result of increased community and industry awareness through media reporting and SafeWork NSW’s proactive audit work.⁵ The majority of these complaints did not result in further regulatory action by SafeWork NSW beyond preliminary inquiries and, in some cases, site visits. The right-hand column of the below table shows key events leading up to and shortly after SafeWork NSW’s first regulatory interventions.

*         2023 data are to 30 November 2023.
Note: Complaints received by SafeWork NSW where the issue description includes ‘silic*’ or ‘benchtop’. This will include silica derived from sources other than manufactured stone, including relating to those products listed in the Safe Work Australia 2020 national guide.
Source: Audit Office analysis of WSMS data.

High-profile media reporting in 2018, 2021, and early 2023 appeared to provide impetus to SafeWork NSW’s regulatory actions. SafeWork NSW subsequently conducted further rounds of proactive compliance, education and awareness activities among identified workplaces. This work increasingly targeted high-risk workplaces. Since 2018–19, SafeWork NSW has conducted three rounds of workplace inspections that have progressively focused on the highest risk workplaces. This program has adopted a strategic and evidence-based approach.

Since October 2019, 17 matters were progressed to further investigation with a view to prosecution. Five silica-related matters have been filed in court for prosecution. Three of these matters were still in court at the time of this audit, and two matters have been finalised.

In 2020, NSW introduced a range of legislative reforms including:

• Banning the practice of dry cutting engineered stone containing crystalline silica. Maximum penalty of $30,000 for a body corporate and $6,000 for an individual, with on-the-spot fines for uncontrolled dry processing of engineered stone.
• Halving the Workplace Exposure Standard from 0.1mg/m3 to 0.05 mg/m3 (ahead of the national deadline to implement it).
• Silicosis becoming a notifiable disease requiring clinicians to report each case of silicosis diagnosed in NSW. Those notifications are shared with SafeWork NSW to manage a NSW Dust Disease Register. An annual report is tabled in Parliament and published on the NSW Government website www.nsw.gov.au (NSW Silica Dashboard) alongside some information on compliance activities.
• On 27 October 2020, silicosis became a notifiable disease requiring clinicians to report each case of silicosis diagnosed in NSW. Those notifications are shared with SafeWork NSW to manage a NSW Dust Disease Register. In August 2021, SafeWork NSW published the first NSW Dust Disease Register Annual Report, detailing diagnosed cases of silicosis, asbestosis, and mesothelioma in NSW during 2020–21 and the Case Finding Study Report on silica exposure in the Manufactured Stone Industry. The Annual Report is tabled in Parliament and published on the NSW Government website www.nsw.gov.au (NSW Silica Dashboard) alongside some information on compliance activities.

Also in 2020, SafeWork NSW released the NSW Dust Strategy 2020-2022, which identified silica as one of three focus areas for the regulator.

In February 2022, New South Wales introduced the NSW Code of Practice – Managing the risks of respirable crystalline silica from engineered stone in the workplace, based on the National Model Code that was finalised in late 2021. The Code provides practical information on how to manage health and safety risks associated with respirable crystalline silica from engineered stone in the workplace.

Silica continues to be a priority for SafeWork NSW in 2023 under the SafeWork NSW regulatory priority: Exposure to harmful substances - Reduce the incidence of worker exposure to dangerous substances in the workplace, particularly silica and dangerous chemicals.

The online NSW Silica Dashboard provides members of the public with information on SafeWork NSW’s silica workplace visit program that commenced in 2018 through to 30 September 2023.

Organisational silos within SafeWork NSW contribute to inconsistent regulatory decision-making, duplication of effort, and inefficient practices

There is evidence indicating that SafeWork NSW works in silos, with limited communication, collaboration, and awareness of activities across functions.

We note the finding made by the South Australian Independent Commission Against Corruption in reviewing SafeWork SA:

The existence of silos was evidenced by the audit team through:

• The inconsistent application of policies and procedures. For example, performance management practices differ between directorates and individual teams. This is further discussed in Chapter 4.
• How data is used across SafeWork NSW. While there are pockets of effective data analysis, they often seem to operate in isolation from each other, resulting in duplication and a failure to achieve economies of scale and the benefits of synergies.
• Limited feedback loops across SafeWork NSW. SafeWork NSW does not have an overarching continuous improvement framework, and communication surrounding decision-making is limited. For example, where the Investigations and Emergency Response team decide to discontinue an investigation, there is no requirement to inform the referring inspector that this has occurred, or the rationale behind the decision.

Similar findings on the existence of silos, and the need to improve teamwork and collaboration, have been made by SafeWork NSW in internal reviews undertaken as part of restructuring activities.

This audit also found broader issues of concern regarding organisational structure. SafeWork NSW staff frequently expressed reservations about the effectiveness of the current structure and compared it unfavourably to the regulator’s previous form. In particular, some SafeWork NSW staff said that the existing structure:

• reduced SafeWork NSW’s profile as the regulator for work health and safety in NSW
• confused lines of accountability for senior strategic leadership
• diluted the regulator’s focus and the cohesion of the staff.

The Independent Review of SafeWork NSW being conducted by Mr Robert McDougall KC is examining organisational structural issues. In the interim, the decision has been made by DCS that SafeWork NSW will transition out of the Better Regulation Division of DCS from 1 December 2023, to become a standalone division within DCS.

Organisational restructuring and any uncertainty that it involves in the short- to medium-term could impact on the SafeWork NSW's progress in achieving desired policy outcomes, especially if the change management process is not effective.

The lack of a strategic approach to data and intelligence by SafeWork NSW hampers effective targeting and prioritisation of proactive compliance activity

Effective proactive compliance work is an important part of an effective regulatory approach. For SafeWork NSW, these activities range from dedicated state-wide programs over extended periods through to specific, localised ‘blitzes’ of targeted workplaces. These activities are performed alongside 'reactive compliance activities' such as responding to incidents, complaints, or requests by ‘persons conducting a business or undertaking’ (PCBUs) for education and awareness-building activities.

In accordance with Safe Work Australia’s National Compliance and Enforcement Policy, proactive compliance activities are intended to be:

SafeWork NSW’s proactive compliance activity is intended to be based on:

• SafeWork NSW’s annual regulatory priorities
• data and insights on high-risk harms, industries or businesses
• the identification of new or emerging risks
• targeted programs focused on reducing the greatest harms.

As discussed earlier in this section, SafeWork NSW does not effectively use data to inform priorities or to assess risk.

While managers at SafeWork NSW referred to an overall target for proactive work (it was commonly suggested that between 60% and 70% of regulatory activities should be proactive), we were informed by the Head of SafeWork NSW (and Deputy Secretary of the Better Regulation Division) that there was no specific target.

In practice, there is significant variation in the mix of proactive and reactive compliance activities between directorates and teams, with some teams doing either largely proactive or largely reactive activities. This can depend on the nature of the industry sectors and geographic areas in which they function, and the extent of teams’ non-discretionary reactive workload.

Planning, implementing and evaluating proactive compliance work is inconsistently done across SafeWork NSW, making it hard to assess whether resources are being used effectively

The audit team found widely differing approaches to how directorates and even individual teams within the same directorate used evidence to identify and target risk areas for proactive work programs, such as blitzes. While there was evidence that data was used to inform how activities would be targeted, this was not consistent. For example, some teams draw on intelligence generated by dedicated interventions staff in their directorates, while others rely entirely on opportunistically identifying potential worksites for proactive work by driving or walking past sites. The audit found examples of effective use of data and intelligence to plan proactive activities.

There is also no consistent approach to planning, implementing, or evaluating proactive compliance work across SafeWork NSW. Even within the same directorate, there can be significant differences in approach. Some of these differences can be explained by the different types of matters and circumstances that apply to PCBUs across different industries. However, inconsistencies extended to fundamental aspects of proactive compliance work such as:

• the rigour of evidence and intelligence by which priorities are determined and targeted, which was partly reflected by directorates having different levels of internal data capability
• the degree of project management capability and resourcing, including where some directorates have dedicated specialist project management skills, while others rely on inspectors to perform project management
• the extent to which different directorates and teams had a clear approach to how programs would be evaluated, beyond simply measuring activity, something which appears undermined by the absence of an evaluation framework
• whether the strategic intent of programs and blitz activities are to drive meaningful behavioural change or just, as some interviewees expressed it, to ‘make sure they tick some boxes.’

These material differences and lack of consistency in approaches to proactive compliance makes it difficult to assess whether these activities are effective and efficient regulatory interventions. While there was strong support for proactive compliance activity among both managers and inspectors (indeed, most thought that there should be more proactive activity), there were relatively few who could provide an evidence base to justify the significant staff resources that they consume.

The Centre for Work Health and Safety has a function to improve data, research, and evidence to support risk identification

The Centre for Work Health and Safety (CWHS), a functional unit within SafeWork NSW, was established in December 2017 under the WHS Roadmap 2016-2022. Among other things, it has an insights and analytics function. Its establishment was driven by the recognition that SafeWork NSW was not effectively using data and evidence to support its decision-making and activities.

Two pieces of work undertaken by the CWHS are intended to provide SafeWork NSW with greater capability in identifying and addressing risk in both strategic and operational contexts.

First, the WHS Radar project is intended to deliver ‘…regular and actionable insights about WHS in an Australian context.’ Conducted twice a year, the WHS Radar synthesises information about work health and safety by drawing on five sources of evidence:

• existing data, including incidents, worker’s compensation, ABS, and prosecutions
• analysis of grey literature (non-peer reviewed sources, such as government reports, some conference papers, and reports from academic, business and industry bodies)
• social media listening
• nationwide survey of WHS inspectors and experts
• nationwide survey of Australian workers across all industries.

The WHS Radar is intended to reduce the extent to which SafeWork NSW is dependent on lag data, by actively collecting more contemporaneous data from multiple sources. The first WHS Radar report was released publicly in April 2023.

A second piece of work delivered by the CWHS is the WHS Risk Rating tool for a PCBU.⁶ This tool attributes a rating to many businesses in NSW based on assessment of their future risk of non-compliance with WHS legislation. The WHS Risk Rating is intended to:

• support existing SafeWork NSW Triage decision-making
• support IDMP decision-making
• select high-risk profiles during blitz operations
• proactively screen and target high-risk profiles.

While some managers in SafeWork NSW did use the WHS Risk Rating tool, others were less confident in its value, expressing doubts about the accuracy and completeness of the data, or were not aware of it at all. These inconsistent views between different managers and directors, between those who use the WHS Risk Rating tool and those who do not use it or do not even have awareness about it, suggests that its purpose and functionalities have not been fully communicated to the wider inspectorate.

The governance of the CWHS, and particularly its relationship to SafeWork NSW, is somewhat unclear. While the Centre sits under the Executive Director, Regulatory Engagement, it identifies on its website as ‘A division of the Department of Customer Service’. Structurally, it is equivalent to a directorate under the Regulatory Engagement business area of SafeWork NSW, rather than a division of the department.

SafeWork NSW's inspectors are its core asset, and its ability to recruit, train and retain inspectors is key to fully performing its functions and meeting the internationally recognised benchmark

SafeWork NSW is funded to fully operate with up to 370 inspectors, though with 352 inspectors at August 2023 it has not recruited to full capacity.

Staff retention within the inspectorate has been a historic strength of the regulator. However, there has been a recent increase in inspector turnover. SafeWork NSW notes that from 2020 to 2022 attrition rates doubled from 5.3% to 10.6% within the inspectorate, which – due to the average age of its workers – was anticipated. Nearly one-third of inspectors were 56 years or older in the 2021–22 financial year. SafeWork NSW also experienced a general increase in resignations since the COVID-19 pandemic.

Increased recruitment activity is intended to mitigate the impact of ongoing attrition due to retirement. However, given the training requirements for new inspectors, there is a significant lag time between recruitment and the utility of inspectors in the field to progress regulatory priorities. SafeWork NSW notes however that inspectors receive authorisations to use their powers throughout the 12-month training period, with individuals assessed at a number of stages based on individual competence.

Where there have been capacity limitations, there have been localised responses such as the sharing of inspectors between teams, or the change in resourcing profile of investigations where instead of one inspector working on a case, a case is assigned to a team.

The International Labour Organization sets a benchmark of one labour inspector per 10,000 workers in industrial market economies. This benchmark is considered the number of inspectors deemed sufficient to ensure the effective discharge of the duties of the inspectorate. In October 2022, SafeWork NSW reported at the Parliamentary Budget Estimates Committee hearings that recruiting the full contingent of 370 inspectors would have meant that there was one SafeWork NSW inspector for every 10,000 workers, allowing it to meet this benchmark.

SafeWork NSW provided advice to the audit team that forecast increases in the number of workers and workplaces in New South Wales will result in 471 inspectors being required to meet the International Labour Organization benchmark by 2027.

SafeWork NSW inspectors can take up to two years to be considered ready to be fully utilised, due to training requirements and variations in their experience

Once recruitment is completed and new inspectors commence employment, they will start the New Inspector Training Program (NITP). The NITP is a 12-month comprehensive training program which prepares new Inspectors to perform the duties required of an Inspector within SafeWork NSW as well as providing training and assessment required for the PSP50116 Diploma of Government (Workplace Inspection) qualification. Inspectors will be fully trained after 12 months.

They will be issued with their instrument of appointment (authorities) to use their powers throughout the 12 month course. However it was noted throughout interviews with the inspectorate that it can take up to two years for new inspectors to be deployed in the field on their own and confidently making decisions. SafeWork NSW notes that the level of mentoring and support provided to individual inspectors, and access to a variety of experiences to build a range of skills contributes to variations in new inspectors building their confidence.

SafeWork NSW also provides:

• a structured framework for new inspector onboarding and capacity-building, including in May 2023 formalising requirements for accompanied field visits, and delivering the NITP, delivered by the SafeWork NSW Registered Training Organisation (RTO) and utilising experienced inspectors from across the directorate to deliver training across the 12-month period
• a SafeWork NSW Inspectorate and Manager Continuing Professional Development Program Policy
• formal processes for Inspectorate Continuing Professional Development and Manager Continuing Professional Development, including recognition of prior learning through credit transfer from other registered training organisations
• a formalised procedure for inspectors to progress to senior inspector and principal inspector.

While it was beyond the scope of this audit to assess the effectiveness of this training and capability development framework, it was recognised by interviewees that the commitment of time and resources provided by SafeWork NSW to training inspectors was significant. This underscores the importance of ensuring the effective use of inspectors.

There are inconsistent expectations around the responsibilities of SafeWork NSW inspectors and managers for identifying new and emerging issues

Inspectors may apply to the Inspector Progression Panel of SafeWork NSW to progress from Inspector to the level of Senior Inspector, or Senior Inspector to the level of Principal Inspector. In addition to the overarching requirements of the (Department of Customer Service – SafeWork NSW Inspectors 2007) Reviewed Award, this process is governed by a formal written procedure.

This procedure sets out that in considering applications for progression, the panel should take into account whether the applicant has fulfilled the responsibilities of their current role. The procedure specifies that inspectors and principal inspectors are accountable to:

It is unclear why inspectors and principal inspectors have this responsibility, but not the intermediate level of senior inspectors. It is also unclear whether people managers, such as team managers, directors, and executive directors, also have similar formal obligations to proactively identify emerging issues.

Moreover, as senior inspectors are not accountable for identifying trends and emerging issues, inspectors are not assessed against this accountability when seeking progression to the senior inspector level. In contrast, when seeking progression from senior inspector to principal inspector, the applicant is required to provide evidence of how they meet this accountability, even though it is not an accountability specified for senior inspectors.

The accuracy of SafeWork NSW’s workforce planning is uncertain

Workload capacity is managed at the directorate level, with a forecasting report on the capacity across all teams discussed quarterly at the SafeWork NSW Leadership Group. Inspectors do not fill out timesheets, instead, this is based on time estimates for specific activities undertaken by inspectors. Directorates are also responsible for leading or supporting work against specific regulatory priorities, requiring directorates to discuss workforce capacity as part of planning proactive work.

SafeWork NSW has a 'workload management treatment model' that provides operation guidance once certain thresholds are reached within this forecasting report. These mechanisms include the reallocation of resources within the directorate at 125% of capacity reached, sharing and reallocation of work between equivalent portfolios at 150% of capacity reached, and cross directorate sharing of work and resources as well as the cessation or deference of work at 175% of capacity reached.

The actual allocation of inspectors to individual directorates is determined at the executive level when vacancies arise, with SafeWork NSW noting that 'consideration is given to the demand for regulatory services (current and expected future) across all teams to determine which directorate and office location a replacement position should be allocated'.

Audit interviews identified some concern that the calculations the forecasting reports are based on were not accurate, overestimated time, and that the data was used inconsistently and as a method to 'grab for resources'. While this audit did not examine SafeWork NSW's forecasting methodology in detail, a sample of the workforce forecasting report for April to June 2023 showed average capacity ranging from 9% to 390%, which may indicate under-utilised or over-utilised teams, or under or overweighted activities.

While there are mechanisms in place to review operational capacity, longer-term strategic workforce planning does not seem to form part of these review processes.

As part of developing its regulatory priorities, SafeWork NSW released a discussion paper that noted broader trends affecting workplaces and communities that it regulates, for example the rise in mental health issues in the workplace, automation, and the return of regional on-shore manufacturing. SafeWork NSW has a SafeWork Inspectorate and Manager Continuing Professional Development Program Policy, however this policy was only finalised in July 2023.

³ This study, conducted by a third-party, stemmed from a recommendation made by the NSW Parliament’s 2019 Dust Disease Review to amend the WHS Act to require SafeWork NSW to ensure that a case finding study was carried out:

• to investigate respirable crystalline silica exposure in the manufactured stone industry, and

• to gather information to improve the identification and assessment of workers at risk of exposure.

The purpose of this recommendation was to ‘to improve the identification and assessment of workers at risk of exposure.

⁴ The authors of this case finding study identified significant data limitations, which meant that it was not possible to estimate with confidence the complete number of workers potentially affected by silicosis.

⁵ Because of the lag period between when a worker is exposed to risky work practices and when they may develop silicosis, complaint data is not necessarily a useful tool to identify the emerging risk, especially where awareness of the risk is low. Unlike with risks that pose a more immediate and direct harm – such as falling off an insecure elevated platform - individuals may be less conscious to complain about a risk where the potential injury is not immediately visible.

⁶ A person conducting a business or undertaking has the primary duty of care for work health and safety.

This chapter considers how effectively SafeWork NSW measures and reports its performance in monitoring and enforcing compliance with the WHS Act. This includes whether it has meaningful performance measures, whether its performance is transparent to all stakeholders, and whether it uses performance information to support continuous improvement and quality assurance.

Performance measurement and reporting are essential to demonstrating a regulator's effectiveness

The Audit Office’s 2022 Audit Insights 2018–22 report noted that:

The same report also observed that government activity should:

Relatedly, the Organisation for Economic Co-Operation and Development has said that it is important for regulators to be aware of the impacts of their regulatory actions and decisions, and that this:

SafeWork NSW reports its activities and performance against certain KPIs, along with equivalent regulators in other Australian jurisdictions

Safe Work Australia, the national policy body for work health and safety, collects, analyses and publishes data across jurisdictions. SafeWork NSW provides data on regulatory activities such as the volume of proactive and reactive regulatory work, and performance measures such as injuries and fatalities. This is contained in the Safe Work Australia Comparative Performance Monitoring – Work Health and Safety Performance, and Work Health and Safety Compliance and Enforcement Activities reports.

The data published by Safe Work Australia provides comparative and longitudinal performance data relating to workplace injuries, fatalities, and compliance activities. This is ‘lag’ data, often 12 months or more in arrears. SafeWork NSW notes that due to the currency of data, it is not useful for planning purposes.

The ability to directly compare jurisdictional activities to form a view on the effectiveness of each regulator is limited, due to differences in how each work health and safety regulator works and the scope of their powers and responsibilities. For example, unlike in other states and territories, SafeWork NSW is not responsible for claims management or return to work matters.

Data reported by SafeWork NSW to Safe Work Australia indicates that, while fatalities have decreased, SafeWork NSW may not have had meaningful impact on the rates of serious injuries and disease claims since 2016–17

The data provided to Safe Work Australia shows that SafeWork NSW has presided over a period where there has been an increase in the incident rate of serious injury and disease claims in New South Wales. While SafeWork NSW is not responsible for workers compensation, the payment of workers compensation necessitates that a workplace injury has occurred.

The audit team has not seen evidence that SafeWork NSW has interrogated the root cause data trends since 2016–17 (discussed below). While the causes of workplace injury are often complex and multifaceted, the data suggests that SafeWork NSW may not be having a meaningful impact on reducing rates of serious injuries, but the poor data quality means that we cannot be sure. It was beyond the scope of this audit to specifically examine serious injuries and disease claims, or the root cause(s) for the upward trend.

An extract of one performance indicator is shown in Exhibit 2 below. It shows serious injury and disease claim data from 2012–13 through to 2020–21 (where 2020–21p stands for preliminary data). The 2015–16 financial year is highlighted to indicate the establishment phase of SafeWork NSW.

This chapter considers selected policies and procedures that SafeWork NSW has implemented to ensure that it performs its compliance functions in a manner that is consistent with regulatory good practice. This includes that regulatory decisions are fair, consistent, predictable, transparent and in accordance with any laws or government policy. This extends to how complaints and incidents are initially triaged, the decisions inspectors make in response to complaints or incidents, and decisions made about whether a matter is referred to investigation for possible prosecution.

SafeWork NSW has made significant efforts to promote consistency in regulatory decision-making

A core element of an effective compliance regime is that the regulator’s behaviour and decision-making should be consistent and predictable. This encourages trust and confidence in the regulator, while promoting clarity and certainty among regulated entities.

SafeWork NSW faces particular challenges to achieving consistency in regulatory outcomes without fettering the legislative decision-making authority of individual inspectors. The audit was made aware of cases where stakeholders could not understand the rationale by which decisions were made, including in matters raised in Parliamentary Budget Estimates Committee hearings.

The reasons for the lack of consistency, whether perceived or actual, includes such matters as:

• the unique circumstances that may apply to individual risks, hazards, or incidents
• the wide variation in characteristics of PCBUs, including in regard to matters that might affect their culpability for non-compliance, such as their size or compliance history
• varying levels of experience across inspectors
• potential differences between individual inspectors in risk appetite, regulatory posture and attitudes to varying regulatory interventions.

These complexities have received heightened attention by SafeWork NSW since the 2020 findings of the NSW Ombudsman’s inquiry into SafeWork NSW and the Blue Mountains City Council. Among other things, in this inquiry the Ombudsman found that:

• only inspectors had the authority to form a ‘reasonable belief’ that non-compliance with the WHS Act or regulation had occurred
• where an inspector forms a ‘reasonable belief’ of non-compliance, then they must issue a regulatory notice
• instances had occurred where inspectors had issued notices without forming the necessary ‘reasonable belief’ that valid grounds existed for those notices
• inspectors had issued notices without forming their own requisite ‘reasonable belief’ because they had been directed to issue notices by management.

Notwithstanding these challenges, SafeWork NSW was able to demonstrate that it has implemented measures aimed at promoting consistency in regulatory decision-making. These measures include:

• extensive guidance in exercising discretionary decision-making
• inspector practice notes
• directorate and team level discussions intended to promote consistency in decision-making.

These measures are primarily focused at encouraging consistency in the application of the law prospectively. There was less evidence that decisions were consistently, formally, and robustly reviewed retrospectively, such as by:

• peer review
• internal audit or quality assurance of decisions
• managerial coaching and mentoring.

The audit found varying practices and processes across SafeWork NSW teams and directorates for these sorts of retrospective and reflexive learning processes. Some managers and directors were able to describe regular review activities, either through one-on-one case reviews with individual inspectors, or through team meetings, though the evidence was that these activities were not consistent across regulatory decision-making areas of SafeWork NSW.

Such retrospective mechanisms would not be aimed at varying decisions already made, but at contributing to standardising how inspectors make future decisions by promoting consistency through setting precedents for responding to substantively similar matters.

Staff performance management is inconsistent across SafeWork NSW, which may hinder consistent practices, behaviours and outcomes

The use of organisational performance management and planning systems can be an important tool for promoting consistent behaviours, understandings and outcomes.
This audit included a survey of all members of the inspectorate, excluding team managers. Approximately 60% the inspectorate responded to the survey. The survey of found that:

• 36% said that they did not have an annual performance agreement – almost one in every two inspectors (46%) in the two metropolitan focused directorates said they did not have performance agreements that set out what was required of them
• the Investigation and Emergency Response directorate had a comparatively higher rate of reported performance agreements in place (80%) than all the other directorates that comprised SafeWork NSW (57%) – the reasons for this were not examined by the survey.

Findings from a survey of the inspectorate highlight the role of discretion in decision-making, and how these factors can be inconsistently applied

The survey conducted by the audit also asked inspectors about how different factors might affect their decision to issue a penalty notice for a breach of the WHS Act (excluding the most serious categories of matters that would ordinarily be immediately referred to full investigation and possible prosecution).

The discretionary factors that were included in the survey included:

• a sample taken from SafeWork NSW's written procedure for issuing penalty notices (shown in Exhibit 5 below)
• a small number that had been raised with the audit team by SafeWork NSW staff during interviews, namely: current regulatory priorities, media or political interest, and the size of the PCBU (specifically, whether or not a hypothetical PCBU was a small, family-owned business).

Source: SafeWork NSW, Penalty Notice Procedure.

Inspectors were asked whether a range of selected factors were in general more, less, or not at all likely to influence their decision to issue a penalty notice.

As shown in Exhibit 6 below, the survey found that the most common response to most of the factors was that they made it neither more nor less likely that an inspector would issue a penalty notice in response to non-compliance. In some cases, this is probably to be expected.

For example, whether or not a non-compliant PCBU is a NSW government agency should probably not affect whether it is issued with a penalty notice. This was the case for 80% of respondents (though notably, 20% of inspectors responded that it would affect their decision, including 3% who responded that they would be much more likely to issue a penalty notice).

Other variations seem less intuitive to explain. This is particularly the case when a factor is written in policy or procedures. For example, 44% of inspectors responded that their decision would not be affected by whether or not the PCBU had prior notice of the risk, even though prior notice is prescribed in the SafeWork NSW procedure as a factor that should be taken into account (see item 7 of Exhibit 5).

The role played by SafeWork NSW regulatory priorities is also uncertain. On the one hand, 62% of inspectors said that they would be more (39%) or much more (23%) likely to issue a penalty if the non-compliance related to a regulatory priority, while 38% said it would have no impact.

The survey also found noticeable variations in responses between directorates regarding when penalty notices would be more or less likely to be issued. This included in regard to:

• whether a non-compliant PCBU was a small business or not
• the role of PCBU culpability
• whether non-compliance related to a matter of media or political interest.

This chapter presents a case study that arose during the course of this audit. The case study demonstrates issues discussed in earlier chapters of this report, particularly in relation to the management of risk and the proper application of policies and procedures to ensure SafeWork NSW’s effectiveness as a regulator.

About the case study

The case study concerns the activities of the Department of Customer Service and SafeWork NSW, the latter of which is located within the department. Neither the case study nor this performance audit generally examined the activities of the commercial partner (including any related companies) referenced in the case study, including Trolex Ltd (UK), Trolex Nome Australia Pty Ltd., or Trolex Sensors Pty Ltd. No findings have been made, either express or implied, in relation to the commercial partner.

The case study was based on a review of evidentiary documents, primarily in the form of emails sourced from SafeWork NSW. To avoid compromising other processes, interviews were not held.

SafeWork NSW’s respirable crystalline silica real-time detection project

As discussed earlier, silicosis is a progressive, occupational lung disease resulting from inhalation of respirable crystalline silica. In recent years, there has been high profile attention to respirable crystalline silica exposure from manufactured stone products (such as kitchen benchtops), though these risks had been published in international research since at least 2010. Unlike asbestos, respirable crystalline silica from manufactured stone can lead to the development of silicosis and other lung diseases after relatively short exposure and latency periods, resulting in relatively young workers developing serious diseases.

From 2016 to 2022, SafeWork NSW’s Work Health and Safety Roadmap included a target to reduce workplace exposure to priority hazardous chemicals and materials by 30%. This focus was retained in SafeWork NSW's regulatory priorities for 2023, which included the aim of reducing the incidence of worker exposure to harmful substances such as silica.

In 2018, SafeWork NSW commenced a project to fund a ‘research partner’ to develop a device that would detect in real-time the presence of respirable crystalline silica in workplaces. This project was led by the Centre for Work Health and Safety within SafeWork NSW.

Following a selection process, Trolex, a private company from the United Kingdom, was selected as the research partner. Trolex developed a device intended to meet the objective of the project. This device is called the Air XS and sells for approximately $18,500 AUD. The Air XS device was launched on 7 April 2022. The first-generation of the Air XS devices are no longer on the market, however up to 60 second-generation devices are currently in use across Australia.

In December 2022, this research project won the DCS Secretary’s Award for Excellence in Digital Innovation and was also one of the department’s nominees for a Premier’s Award in 2022.

As part of understanding SafeWork NSW’s response to the work health and safety risks of respirable crystalline silica from manufactured stone products, the audit examined this research project to procure a 'research partner' to develop a respirable crystalline silica real-time detection device. The findings of this examination are set out below.

SafeWork NSW’s processes were ineffective in responding to and mitigating risk and in ensuring compliance

As detailed below, our examination of this project found significant governance failings in SafeWork NSW, including the absence of key documentation, which created risks relating to whether the project would deliver its objective and whether it complied with procurement requirements. Concerns about whether the Air XS device would satisfy project objectives were not properly addressed.

We also found non-compliance with mandatory procurement policies. The failure to ensure compliance with procurement requirements leaves open the risk that value for money was not achieved, or that the procurement was not fair, transparent, consistent with promoting competition, or free from corruption or maladministration.

As a result of the Audit Office raising these issues with the Head of SafeWork NSW, the regulator undertook to enter into discussions with the CSIRO to conduct further testing of the real-time RCS detection device.

Concerns were raised by staff about the accuracy of the Air XS devices, though these concerns were not escalated beyond Director-level staff

Both before and after the launch of the Air XS device, concerns were raised by technical staff within SafeWork NSW about the accuracy of the devices and the rigour with which they had been tested during development.

It should be noted that the manufacturer, in correspondence with SafeWork NSW, defended the accuracy of the Air XS devices. It was beyond the scope of the audit to reconcile apparently conflicting technical assessments. Rather, the audit examined how SafeWork NSW managed the potential project delivery risk when these material concerns were raised.

Toward the end of 2021, concerns first emerged about the accuracy of the Air XS devices in emails between staff in the Regulatory Engagement business area of SafeWork NSW. These emails outlined concerns that the Air XS devices were not sufficiently accurate in detecting respirable crystalline silica. These views were derived from testing performed outside of any technical assurance process. At the time, these concerns were not shared with executive-level staff, including with any relevant Directors.

By the end of March 2022, the Centre for Work Health and Safety had requested and received from Trolex testing reports on the Air XS device. Two technical staff in the Testing Services directorate of SafeWork NSW were asked to review the testing reports. They were given five days to conduct these reviews.

On 5 April 2022, two days before the product was launched, one of the technical staff emailed the Director, Testing Services, advising that each of the two technical staff had independently prepared assessments and that their conclusions were ‘…not what DCS will want to hear’.

The internal assessment reports were subsequently provided to the Director, Testing Services, and to the Centre for Work Health and Safety. One of the reports stated that the product was not ‘market ready’ and that further testing was required. The audit did not find evidence that these conclusions were escalated to the Executive Director, Regulatory Engagement.

On 6 April 2022, the research project manager was advised by a staff member in the Centre for Work Health and Safety that an independent expert’s report (commissioned by the Centre for Work Health and Safety) concluded that ‘…there isn’t enough data to assess the validity of the device’.

Despite these concerns, the product launch occurred on 7 April 2022.

The audit found that concerns were again documented on at least two occasions after the product was launched. First, in September 2022, a senior technical staff member in the Centre for Work Health and Safety expressed concerns to colleagues, including the Director, Testing Services, that the staff member was uncomfortable promoting the Air XS without further testing being conducted.

Secondly, in May 2023, an internal test report prepared within the Testing Services business unit highlighted specific concerns about the accuracy of a first-generation Air XS device. This internal test report was provided to the Director, Testing Services, and was conducted with at least the knowledge of the Director, Research and Evaluation.

In both cases (September 2022 and May 2023), there are gaps in the evidence concerning how widely these internal concerns were shared. The audit found no evidence of:

• any material response by SafeWork NSW management to address the concerns that had been raised
• any assessment of risks posed to SafeWork NSW and other stakeholders
• any escalation of the concerns to the relevant Executive Director or to the Head of SafeWork NSW.

This apparent lack of management action was despite the potential risks to the work health and safety of workers who may have relied on the Air XS, and to the reputation of the regulator.

Some SafeWork NSW staff were hesitant to raise concerns about the Air XS device

Some staff reported to us that they did not raise these risks with their managers due to concerns that to do so might affect their employment. In the Auditor-General’s 2018 audit report Managing risks in the NSW public sector: risk culture and capability, it was noted that:

The report also observed that it is now widely accepted that organisational culture is a key element of risk management because it influences how people recognise and engage with risk. This includes ensuring that agencies have a culture of open communication so that all employees feel comfortable speaking openly about risks.

In this case, SafeWork NSW lacked the risk processes and culture to encourage all staff to identify, raise, escalate, and respond to risk appropriately. While the department does have a mechanism (via dedicated phone and email contacts) for staff to report integrity concerns, this mechanism was not used.

Concerns about the Air XS device were also raised by an external user of the device, though there is no evidence that these concerns were substantively addressed

On 21 August 2023, a senior manager from an external user emailed staff in SafeWork NSW’s Testing Services Directorate to advise that they had told the local distributor that they no longer wished to conduct further testing, nor purchase any Air XS devices. The senior manager stated that:

The senior manager further stated that they were:

The audit found no evidence that these concerns were meaningfully addressed by SafeWork NSW.

The process of procuring a ‘research partner’ to develop the Air XS device was flawed, in that there was non-compliance with procurement obligations and inadequate record keeping

The cost of procuring the Air XS research partner increased from an initial estimated cost of $200,000 when the request for tender was issued in May 2019 to $1.34 million when the final contract was executed in August 2019.

The audit found non-compliance in the process undertaken by the CWHS to procure the research partner. This non-compliance related to the requirements of the applicable departmental procurement manual, as well as with DCS financial delegations, and with the tender evaluation plan prepared for the process.

Examples of non-compliance and other poor practices are outlined below.

• The Director, Research and Evaluation, was a voting member of the evaluation committee and also signed the acceptance letter for the successful proposal. This contravened the department’s procurement requirement that an approving delegate may not also evaluate tender responses. At the time, the estimated cost of the engagement was $200,000 and was therefore within the Director’s financial delegation.
• The evaluation of the submitted tenders included an assessment provided by a designated non-voting member of the tender evaluation committee who had a declared conflict of interest.
• One member of the tender evaluation committee lodged a strong objection to the preferred provider. SafeWork NSW could not provide documentation about how this objection was addressed.
• When the final cost of the engagement increased to $1.34 million by August 2019, the Director, Research and Evaluation, no longer had the necessary delegation to approve the engagement of Trolex. Under the delegations issued by the DCS Secretary on 29 August 2019, the approval of an Executive Director was required for contracts valued between $500,000 and $2 million.
• The scoring in the tender evaluation committee’s (unsigned) evaluation report did not comply with the approach set out in the tender evaluation plan. This was material as, had the tender evaluation plan been followed, two tenders would have been assessed as having the same successful score.
• SafeWork NSW was unable to provide:
  • a signed and dated copy of an approval to issue the initial request for tender
  • a signed and dated copy of an approval for SafeWork NSW to enter into a formal agreement with Trolex
  • a final tender evaluation report signed by all members of the tender evaluation panel
  • evidence of any approval to increase the value of the contract from the $200,000 anticipated in the initial request for tender up to the $1.34 million final value of the contract.

Such non-compliance can contribute to the risk of maladministration in procurement activities, including by undermining probity and challenging whether value for money is achieved.

Appendix one – Response from agency

Appendix two – About the audit

Appendix Three – Performance auditing

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Parliamentary reference - Report number #390 - released 27 February 2024

What this report is about

Results of the Planning and Environment portfolio financial statement audits for the year ended 30 June 2023.

The audit found

Unqualified audit opinions were issued for all completed Planning and Environment portfolio agencies. Seven audits are ongoing.

The Catholic Metropolitan Cemeteries Trust (CMCT) did not comply with its obligations under the Government Sector Finance Act 2018 (GSF Act) to prepare and submit financial statements for audit.

The Department of Planning and Environment (the department) has not yet provided their assessment of the financial reporting requirements for the 579 Category 2 Statutory Land Managers (SLMs) for 2022–23.

One-hundred-and-nineteen Commons Trusts are non-compliant with the GSF Act as they have not submitted their financial statements for audit.

We issued unqualified opinions on the Water Administration Ministerial Corporation's 2020–21, 2021–22 and 2022–23 financial statements.

The number of monetary misstatements identified in our audits decreased from 59 in 2021–22 to 51 in 2022–23, however the gross value of misstatements increased.

The key audit issues were

The former Resilience NSW and NSW Reconstruction Authority (the Authority) re-assessed the accounting implications arising from contractual agreements relating to temporary housing assets associated with the Northern Rivers Temporary Homes Program. This resulted in adjustments to recognise the associated assets and liabilities.

We continue to identify significant deficiencies in NSW Crown land information records.

The department has not been effective in addressing the differing practices for the financial reporting of rural firefighting equipment vested to councils under section 119 (2) of the Rural Fires Act 1997.

The number of findings across the portfolio reported to management increased from 132 in 2021–22 to 140 in 2022–23. Thirty per cent of issues were repeated from the prior year.

Seven high-risk issues were identified. These related to the findings outlined above, deficiencies in quality reviews of asset valuations, internal control processes and IT general controls.

The audit recommended

Recommendations were made to the department and portfolio agencies to address these deficiencies.

This report provides Parliament and other users of the Planning and Environment portfolio of agencies’ financial statements with the results of our audits, analysis, conclusions and recommendations in the following areas:

• financial reporting
• audit observations.

Financial reporting is an important element of good governance. Confidence and transparency in public sector decision-making are enhanced when financial reporting is accurate and timely.

This chapter outlines our audit observations related to the financial reporting of agencies in the Planning and Environment portfolio of agencies (the portfolio) for 2023.

Appropriate financial controls help ensure the efficient and effective use of resources and administration of agency policies. They are essential for quality and timely decision-making.

This chapter outlines our observations and insights from our financial statement audits of agencies in the portfolio.

Appendix one – Misstatements in financial statements submitted for audit

Appendix two – Early close procedures 

Appendix three – Timeliness of financial reporting 

Appendix four – Financial data

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.