Refine search Expand filter

Reports

Published

Actions for Stronger Communities 2019

Stronger Communities 2019

Justice
Community Services
Compliance
Financial reporting
Internal controls and governance
Management and administration
Project management
Service delivery
Shared services and collaboration
Workforce and capability

A report has been released on the NSW Stronger Communities cluster.

From 1 July 2019, the functions of the former Department of Justice, the former Department of Family and Community Services and many of the cluster agencies moved to the new Stronger Communities cluster. The Department of Communities and Justice is the principal agency in the new Stronger Communities cluster.

The report focuses on key observations and findings from the most recent financial audits of agencies in the Stronger Communities cluster.

Unqualified audit opinions were issued on the financial statements for all agencies in the cluster.  

There were 157 audit findings on internal controls. Two of these were high risk and 59 were repeat findings from previous financial audits. ‘Cluster agencies should prioritise actions to address internal control weaknesses promptly with particular focus given to issues that are assessed as high risk’, the Auditor-General said.

The report notes that the NSW Government’s new workers' compensation legislation, which gave eligible firefighters presumptive rights to workers' compensation, cost emergency services agencies $180 million in 2018–19, mostly in increased premiums.

Download the PDF version of report

This report analyses the results of our audits of financial statements of the agencies comprising the Stronger Communities cluster for the year ended 30 June 2019. The table below summarises our key observations.

This report provides parliament and other users of the financial statements of agencies in the Stronger Communities cluster with the results of our audits, our observations, analyses, conclusions and recommendations in the following areas:

  • financial reporting
  • audit observations.

This cluster was significantly impacted by the Machinery of Government (MoG) changes on 1 July 2019. This report focuses on the agencies that from 1 July 2019, comprised the Stronger Communities cluster. The MoG changes moved some agencies from the clusters to which they belonged in 2018–19 to the Stronger Communities cluster. Conversely, the MoG also moved some agencies formerly in the Family and Community Services cluster and Justice cluster elsewhere. Please refer to the section on Machinery of Government changes for more details.

The Department of Communities and Justice is the principal agency of the cluster. The newly created department combines functions of the former Department of Justice and the Department of Family and Community Services.

Machinery of Government (MoG) refers to how the government organises the structures and functions of the public service. MoG changes occur when the government reorganises these structures and functions and those changes are given effect by Administrative Orders.

The MoG changes announced following the NSW State election on 23 March 2019 significantly impacted the Stronger Communities cluster through Administrative Changes Orders issued on 2 April 2019 and 1 May 2019. These orders took effect on 1 July 2019.

Section highlights

The 2019 MoG changes significantly impacted the former Justice and Family and Community Services (FACS) departments and clusters.

  • The Stronger Communities cluster combines most of the functions and agencies of the former Justice and FACS clusters from 1 July 2019.
  • The Department of Communities and Justice is now the principal agency in the new cluster.
  • The MoG changes bring new responsibilities, risks and challenges to the cluster.
  • A temporary office has been established by the Department of Communities and Justice to support the cluster in the planning, delivery and reporting associated with implementing the changes.

Financial reporting is an important element of good governance. Confidence and transparency in public sector decision making are enhanced when financial reporting is accurate and timely.

This chapter outlines our audit observations relating to the financial reporting of agencies in the Stronger Communities cluster for 2019.

Section highlights
  • Unqualified audit opinions were issued for all agencies' 30 June 2019 financial statements. However, further actions can be taken by some cluster agencies to enhance the quality of their financial reporting.
  • In November 2018, the Department of Justice implemented a new Victims Support Services system called VS Connect. Significant data quality issues arising from the VS Connect system implementation impacted the Department's ability to reliably estimate its Victims Support Scheme claims liabilities at 30 June 2019.
    We recommend the Department of Communities and Justice resolves the data quality issues in the new VS Connect System before 30 June 2020 and capture and apply lessons learned from recent project implementations, including LifeLink, Justice SAP and VS Connect, in any relevant future implementations.
  • Our audits found some cluster agencies needed to do more work on their impact assessments and preparedness to implement the new accounting standards, to minimise the risk of errors in their 2019–20 financial statements.
  • Cluster agencies with annual leave balances exceeding the State's target should further review their approach to managing leave balances.

Appropriate financial controls help ensure the efficient and effective use of resources and administration of agency policies. They are essential for quality and timely decision making.

This chapter outlines our observations and insights from our financial statement audits of agencies in the Stronger Communities cluster.

Section highlights

  • Cluster agencies should action recommendations to address internal control weaknesses promptly. Particular focus should be given to prioritising high risk issues. The 2018–19 financial audits of cluster agencies identified 157 internal control issues. Of these, two were high risk and 37.6 per cent were repeat findings from previous audits.
  • Data from the Department of Justice shows the inmate population reached a maximum of 13,798, compared to an operational capacity of 14,626 beds on 31 August 2019. This equates to an operational vacancy rate of 5.7 per cent, which is more than the recommended 5.0 per cent buffer. This is the first time the vacancy rate has exceeded the target over the last five years. Growth in the NSW prison population is being managed through the NSW Government's $3.8 billion Prison Bed Capacity Program.
  • In September 2018, the NSW Government introduced new workers' compensation legislation, which gives eligible firefighters presumptive rights to workers' compensation when diagnosed with one of 12 prescribed cancers. The new legislation cost emergency services agencies $180 million in 2018–19, mainly through additional workers' compensation premiums.

Appendix one – Timeliness of financial reporting by agency

Appendix two – Management letter findings by agency

Appendix three – List of 2019 recommendations 

Appendix four – Status of 2018 recommendations 

Appendix five – Cluster agencies 

Appendix six – Financial data 

 

Copyright notice

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Published

Actions for Internal Controls and Governance 2019

Internal Controls and Governance 2019

Education
Community Services
Finance
Health
Industry
Justice
Planning
Premier and Cabinet
Transport
Treasury
Whole of Government
Compliance
Cyber security
Fraud
Information technology
Internal controls and governance
Management and administration
Procurement
Project management

This report covers the findings and recommendations from the 2018–19 financial audits that relate to internal controls and governance at 40 of the largest agencies in the NSW public sector. The 40 agencies selected for this report constitute around 84 per cent of total expenditure for all NSW public sector agencies.

The report provides insights into the effectiveness of controls and governance processes across the NSW public sector. It evaluates how agencies identify, mitigate and manage risks related to:

  • financial controls
  • information technology controls
  • gifts and benefits
  • internal audit
  • contingent labour
  • sensitive data.

The Auditor-General recommended that agencies do more to prioritise and address vulnerabilities in their internal controls and governance. The Auditor-General also recommended agencies increase the transparency of their management of gifts and benefits by publishing their registers on their websites.

This report analyses the internal controls and governance of 40 of the largest agencies in the NSW public sector for the year ended 30 June 2019.

1. Internal control trends

New, repeat and high risk findings

There was an increase in internal control deficiencies of 12 per cent compared to last year. The increase is predominately due to a 100 per cent increase in repeat financial and IT control deficiencies.

Some agencies attributed the delay in actioning repeat findings to the diversion of staff from their regular activities to implement and operationalise the recent Machinery of Government changes. As a result, actions to address audit recommendations have been deferred or re prioritised, as the changes are implemented.

Agencies need to ensure they are actively managing the risks associated with having these vulnerabilities in internal control systems unaddressed for extended periods of time.

Common findings

A number of findings were common to multiple agencies. These findings often related to areas that are fundamental to good internal control environments and effective organisational governance, such as:

  • out of date policies or an absence of policies to guide appropriate decisions
  • poor record keeping and document retention
  • incomplete or inaccurate centralised registers or gaps in these registers
  • policies, procedures or controls no longer suited to the current organisational structure or business activities.

2. Information technology controls

IT general controls

We examined information security controls over key financial systems that support the preparation of agency financial statements. We found:

  • user access administration deficiencies at 58 per cent of agencies related to granting, review and removal of user access
  • an absence of privileged user activity reviews at 35 per cent of agencies
  • password controls that did not align to password policies at 20 per cent of agencies.

We also found 20 per cent of agencies had deficient IT program change controls, mainly related to segregation of duties in approval and authorisation processes, and user acceptance testing of program changes prior to deployment into production environments. User acceptance testing helps identify potential issues with software incompatibility, operational workflows, absent controls and software issues, as well as areas where training or user support may be required.

3. Gifts and benefits

Gifts and benefits registers

All agencies had a gifts and benefits policy and 90 per cent of agencies maintain a gifts and benefits register. However, 51 per cent of the gifts and benefits registers we examined contained incomplete declarations, such as missing details for the approving officer, value of the gift and/or benefit offered and reasons supporting the decision.

In some cases, gaps in recorded information meant the basis for decisions around gifts and benefits was not always clear, making it difficult to determine whether decisions in those instances were appropriate, compliant with policy and were not direct or indirect inducements to the recipients to favour suppliers or service providers.

Agencies should ensure their gifts and benefits register includes all key fields specified in the Public Service Commission's minimum standards for gifts and benefits. Agencies should also perform regular reviews of the register to ensure completeness and ensure any gift or benefit accepted by a staff member meets the public's expectations for ethical behaviour.

Managing gifts and benefits

We found opportunities to improve gifts and benefits processes and enhance transparency. For example, only three per cent of agencies publish their gifts and benefits registers on their websites.

Agencies can improve management of gifts and benefits by:

  • ensuring agency policies comprehensively cover the elements necessary to make it effective in an operational environment, such as identifying risks specific to the agency and actions that will be taken in the event of a policy breach
  • establishing and publishing a statement of business ethics on the agency's website to clearly communicate expected behaviours to clients, customers, suppliers and contractors
  • providing on-going training, awareness activities and support to employees, not just at induction
  • publishing their gifts and benefits registers on their websites to demonstrate a commitment to a transparently ethical environment.
Reporting and monitoring

Only 35 per cent of agencies reported trends in the number and nature of gifts and benefits recorded in their registers to the agency's senior executive management and/or a governance committee.

Agencies should regularly report to the agency executive or other governance committee on trends in the offer and acceptance of gifts and benefits.

4. Internal audit

Obtaining value from the internal audit function

Agencies have established and maintained internal audit functions to provide assurance on the effectiveness of agency controls and governance systems. However, we identified areas where agencies' internal audit functions could improve their processes to add greater value. For example, only 73 per cent of CAEs regularly attend meetings of the agency board or executive management committee.

Internal audit functions can add greater value by involving the CAE more extensively in executive forums as an observer.

Internal audit functions should also consider producing an annual report on internal audit. An annual report allows the internal audit function to report on their performance and add value by drawing to the attention of audit and risk committees and senior management strategic issues, thematic trends and emerging risks.

Role of the Chief Audit Executive

Forty-five per cent of agencies assigned responsibilities to the Chief Audit Executive (CAE) that were broader than internal audit, but 17 per cent of these had not documented safeguards to protect the independence of the CAE.

The reporting lines and status of the CAE at some agencies also needs review. At two agencies, the CAE reported to the CFO.

Agencies should ensure:

  • the reporting lines for the CAE comply with the NSW Treasury policy, and the CAE does not report functionally or administratively to the finance function or other significant recipients of internal audit services
  • the CAE's duties are compatible with preserving their independence and where threats to independence exist, safeguards are documented and approved.
Quality assurance and improvement program

Thirty-five per cent of agencies did not have a documented quality assurance and improvement program for its internal audit function.

The policy and the International Standards for the Professional Practice of Internal Auditing require agencies to have a documented quality assurance and improvement program. The results of this program should be reported annually.

Agencies should ensure there is a documented and operational Quality Assurance and Improvement Program for the internal audit function that covers both internal and external assessments.

5. Managing contingent labour

Obtaining value for money from contingent labour

According to NSW Procurement data, spend on contingent labour has increased by 75 per cent over the last five years, to $1.5 billion in 2018–19. Improvements in internal processes and a renewed focus on agency monitoring and oversight of contingent labour can help ensure agencies get the best value for money from their contingent workforces.

Agencies can improve their management of contingent labour by:

  • preparing workforce plans to inform their resourcing strategy and ensure that engaging contingent labour aligns with the strategy and best meets business needs
  • involving agency human resources units in decisions about engaging contingent labour
  • regularly reporting on contingent labour use and tenure to agency executive teams
  • strengthening on-boarding and off-boarding processes.

We also found 57 per cent of the 23 agencies we examined with contingent labour spend of more than $5 million in 2018–19 have implemented the government's vendor management system and service provider 'Contractor Central'.

6. Managing sensitive data

Identifying and assessing sensitive data

Sixty-eight per cent of agencies maintain an inventory of their sensitive data and where it resides. However, these inventories are not always complete and risks may be overlooked.

Agencies can improve processes to manage sensitive data by:

  • identifying and maintaining an inventory of sensitive data through a comprehensive and structured process
  • assessing the criticality and sensitivity of the data so that protection of high risk data can be prioritised.
Managing data breaches

Eighty-eight per cent of agencies have established policies to respond to potential data breaches when they are identified and 70 per cent of agencies maintain a register to record key information in relation to identified data breach incidents.

Agencies should maintain a data breach register to effectively manage the actions undertaken to contain, evaluate and remediate each data breach.

 

This report covers the findings and recommendations from our 2018–19 financial audits that relate to internal controls and governance at 40 of the largest agencies (refer to Appendix three) in the NSW public sector. The 40 agencies selected for this volume constitute around 84 per cent of total expenditure for all NSW public sector agencies.

Although the report includes several agencies that have changed as a result of the Machinery of Government changes that were effective from 1 July 2019, its focus on sector wide issues and insights means that its findings remain relevant to NSW public sector agencies, including newly formed agencies that have assumed the functions of abolished agencies.

This report offers insights into internal controls and governance in the NSW public sector

This is the third report dedicated to internal controls and governance at NSW State Government agencies. The report provides insights into the effectiveness of controls and governance processes in the NSW public sector by:

  • highlighting the potential risks posed by weaknesses in controls and governance processes
  • helping agencies benchmark the adequacy of their processes against their peers
  • focusing on new and emerging risks, and the internal controls and governance processes that might address those risks.

Without strong governance systems and internal controls, agencies increase the risks associated with effectively managing their finances and delivering services to citizens. For example, if they do not have strong information technology controls, sensitive information may be at risk of unauthorised access and misuse.

Areas of specific focus of the report have changed since last year

Last year's report topics included transparency and performance reporting, management of purchasing cards and taxi use, and fraud and corruption control. We are reporting on new topics this year and re-visiting agency management of gifts and benefits, which we first covered in our 2017 report. Re-visiting topics from prior years provides a baseline to show the NSW public sectors’ progress implementing appropriate internal controls and governance processes to mitigate existing, new and emerging risks in the public sector.

Our audits do not review all aspects of internal controls and governance every year. We select a range of measures and report on those that present heightened risks for agencies to mitigate. This year the report focusses on:

  • internal control trends
  • information technology controls, including access to agency systems
  • protecting sensitive information held within agencies
  • managing large and diverse workforces (controls around employing and managing contingent workers)
  • maintaining an ethical culture (management of gifts and benefits)
  • effectiveness of internal audit function and its oversight by Audit and Risk Committees.

The findings in this report should not be used to draw conclusions on the effectiveness of individual agency control environments and governance arrangements. Specific financial reporting, internal controls and audit observations are included in the individual 2019 cluster financial audit reports, which will be tabled in parliament from November to December 2019.

Internal controls are processes, policies and procedures that help agencies to:

  • operate effectively and efficiently
  • produce reliable financial reports
  • comply with laws and regulations
  • support ethical government.

This chapter outlines the overall trends for agency controls and governance issues, including the number of audit findings, the degree of risk those deficiencies pose to the agency, and a summary of the most common deficiencies we found across agencies. The rest of this report presents this year’s controls and governance findings in more detail.

Key conclusions and sector wide learnings

We identified four high risk findings, compared to six last year. None of the findings are common with those in the previous year. There was an overall increase of 12 per cent in the number of internal control deficiencies compared to last year. The increase is predominately due to a 100 per cent increase in the number of repeat financial and IT control deficiencies.
 
Some agencies attributed the delay in actioning repeat findings to the diversion of staff from their regular activities to implement and operationalise the recent Machinery of Government changes. As a result, actions to address audit recommendations have been deferred or re-prioritised, as the changes are implemented. Agencies need to ensure they are actively managing the risks associated with having these vulnerabilities in internal control systems unaddressed for extended periods of time.
 
We also identified a number of findings that were common to multiple agencies. These common findings often related to areas that are fundamental to good internal control environments and effective organisational governance. Examples include:
  • out of date policies or an absence of policies to guide appropriate decisions
  • poor record keeping and document retention
  • incomplete or inaccurate centralised registers or gaps in these registers.

Policies, procedures and internal controls should be properly designed, be appropriate for the current organisational structure and its business activities, and work effectively.

This chapter outlines our audit observations, conclusions and recommendations, arising from our review of agency controls to manage key financial systems.

Key conclusions and sector wide learnings
Government agencies’ financial reporting is heavily reliant on information technology (IT). We continue to see a high number of deficiencies related to IT general controls, particularly those related to user access administration. These controls are key in adequately protecting IT systems from inappropriate access and misuse.
IT is also important to the delivery of agency services. These systems often provide the data to help monitor the efficiency and effectiveness of agency processes and services they deliver. Our financial audits do not review all agency IT systems. For example, IT systems used to support agency service delivery are generally outside the scope of our financial audit. However, agencies should also consider the relevance of our findings to these systems.
Agencies need to continue to focus on assessing the risks of inappropriate access and misuse and the implementation of controls to adequately protect their systems, focussing on the processes in place to grant, remove and monitor user access, particularly privileged user access.

This chapter outlines our audit observations, conclusions and recommendations, arising from our review of agency controls to manage gifts and benefits. 

Key conclusions and sector wide learnings

We found most agencies have implemented the Public Service Commission's minimum standards for gifts and benefits. All agencies had a gifts and benefits policy and 90 per cent of agencies maintained a gifts and benefits register and provided some form of training to employees on the treatment of gifts and benefits.

Based on our analysis of agency registers, we found some areas where opportunities existed to make processes more effective. In some cases, gaps in recorded information meant the basis for decisions around gifts and benefits was not always clear, making it difficult to determine whether decisions in those instances were appropriate and compliant with policy. Fifty-one per cent of the gifts and benefits registers reviewed contained declarations where not all fields of information had been completed. Seventy-seven per cent of agencies that maintained a gifts and benefits register did not include all key fields suggested by the minimum standards.

Areas where agencies can improve their management of gifts and benefits include:

  • ensuring agency policies comprehensively cover the elements necessary to make it effective in an operational environment, such as identifying risks specific to the agency and actions that will be taken in the event of a policy breach
  • establishing and publishing a statement of business ethics on the agency's website to clearly communicate expected behaviours to clients, customers,suppliers and contractors
  • updating gifts and benefits registers to include all key fields suggested by the minimum standards, as well as performing regular reviews of the register to ensure completeness
  • providing on-going training, awareness activities and support to employees, not just at induction
  • regularly reporting gifts and benefits to executive management and/or a governance committee such as the audit and risk committee, focussing on trends in the number and types of gifts and benefits offered to and accepted by agency staff
  • publishing their gifts and benefits registers on their websites to demonstrate a commitment to a transparently ethical environment.

This chapter outlines our audit observations, conclusions and recommendations, arising from our review of agency internal audit functions.

Key conclusions and sector wide learnings 

We found agencies have established and maintained internal audit functions to provide assurance on the effectiveness of agency controls and governance systems as required by TPP15-03 'Internal Audit and Risk Management Policy for the NSW Public Sector'. However, we identified areas where agencies' internal audit functions could improve their processes to add greater value, including: 

  • documenting and implementing safeguards to address conflicting roles performed by the Chief Audit Executive (CAE)
  • ensuring the reporting lines for the CAE comply with the NSW Treasury policy, and the CAE reports neither functionally or administratively to the finance function or other significant recipients of internal audit services
  • involving the CAE more extensively in executive forums as an observer
  • documenting a Quality Assurance and Improvement Program for the internal audit function and performing both internal and external performance assessments to identify opportunities for continuous improvement
  • reporting against key performance indicators or a balanced scorecard and producing an annual report on internal audit to bring to the attention of the audit and risk committee and senior management strategic issues, thematic trends and emerging risks that may require further attention or resources.

This chapter outlines our audit observations, conclusions and recommendations, arising from our review of agency controls to on-board, manage and off-board contingent labour.

Key conclusions and sector wide learnings

Agencies have implemented controls to manage contingent labour and most agencies have some level of reporting and oversight of contingent labour at an executive level. However, the increasing trend in spend on contingent labour warrants a renewed focus on agency monitoring and oversight of their use of contingent labour. Over the last five years spend on contingent labour has increased by 75 per cent, to $1.5 billion in 2018–19.

There are also some key gaps that limit the ability of agencies to effectively manage contingent labour. Key areas where agencies can improve their management of contingent labour include: 

  • preparing workforce plans to inform their resourcing strategy, and confirm prior to engaging contingent labour, that this solution aligns with the strategy and best meets business needs
  • involving agency human resources units in decisions about engaging contingent labour
  • regularly reporting on contingent labour use to agency executive teams, particularly in terms of trends in agency spend, tenure and compliance with policies and procedures
  • strengthening on-boarding and off-boarding processes, including establishing checklists to on-board and off-board contingent labour, making provisions for knowledge transfer, and assessing, documenting and capturing performance information.

This chapter outlines our audit observations, conclusions and recommendations, arising from our review of governance and processes in relation to the management of sensitive data.

Key conclusions and sector wide learnings

Information technology risks are rapidly increasing. More interfaces between agencies and greater connectivity means the amounts of data agencies generate, access, store and share continue to increase. Some of this information is sensitive information, which is protected by the Privacy Act 1988.

It is important that agencies understand what sensitive data they hold, the risks associated with the inadvertent release of this information and how they are mitigating those risks. We found that agencies need to continue to identify and record their sensitive data, as well as expand the methods they use to identify sensitive data. This includes data held in unstructured repositories, such as network shared drives and by agency service providers.

Eighty-eight per cent of agencies have established policies to respond to potential data breaches when they are identified and 70 per cent of agencies maintain a register to record key information in relation to identified data breach incidents.

Key areas where agencies can improve their management of sensitive data include:

  • identifying sensitive data, based on a comprehensive and structured process and maintaining an inventory of the data
  • assessing the criticality and sensitivity of the data so that the protection of high risk data can be prioritised
  • developing comprehensive data breach management policies to ensure data breaches are appropriately managed
  • maintaining a data breach incident register to record key information in relation to identified data breaches incidents, including the estimated cost of the breach
  • providing on-going training and awareness activities to employees in relation to sensitive data and managing data breaches.

Appendix one – List of 2019 recommendations 

Appendix two – Status of 2018 recommendations

Appendix three – In-scope agencies

 

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Published

Actions for Development assessment: pre-lodgement and lodgement in Camden Council and Randwick City Council

Development assessment: pre-lodgement and lodgement in Camden Council and Randwick City Council

Local Government
Management and administration
Service delivery

The report found that both councils could do more to monitor and assess the effectiveness of their pre-lodgement and lodgement stages. The audit highlighted that Randwick City Council closely follows guidance designed to encourage good practice in these initial stages of its development assessments. It also demonstrated it was timely when processing lodgements. Camden Council is partially following the guidance and could not demonstrate that its lodgement stage was timely.

A development application is a formal application for development that requires consent under the NSW Environmental Planning and Assessment Act 1979. It is usually lodged with the local council for processing and determination, and consists of standard application forms, supporting technical reports and plans. 

In March 2017, the NSW Department of Planning and Environment (DPE)1 released the ‘Development Assessment Best Practice Guide' designed to help councils assess development applications in a timely manner and provide a better experience for applicants. 

DPE's guide describes the development assessment process in five stages. 

According to the Guidance, councils should systematically measure, monitor and review development assessment outcomes and timeframes against performance targets to ensure the process is transparent, accountable and outcome-focused.

Appendix one – Response from agencies

Appendix two – Council's alignment with the guidance

Appendix three – About the audit

Appendix four – Performance auditing

 

Parliamentary Reference: Report number #322 - released 20 June 2019

Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Published

Actions for Domestic waste management in Campbelltown City Council and Fairfield City Council

Domestic waste management in Campbelltown City Council and Fairfield City Council

Local Government
Management and administration
Service delivery

The Auditor-General for New South Wales, Margaret Crawford, today released a report on Domestic waste management in Campbelltown City Council and Fairfield City Council.The report found that both Councils collect and transport domestic kerbside waste effectively and process it at a low cost. The Councils also effectively process waste placed in green-lid and yellow-lid bins, but neither Council has been able to enforce their contracts for processing red-lid bin waste. As a result, almost all such waste goes straight to landfill. 

Local councils provide waste management services to their residents. They collect domestic waste primarily through kerbside services, but also at council drop off facilities. Waste management is one of the major services local councils deliver. Each year, councils collectively manage an estimated 3.5 million tonnes of waste generated by New South Wales residents.

Waste disposed of in landfills attracts a NSW Government waste levy. Councils’ kerbside services help residents to separate recyclable and non recyclable waste. This reduces the cost of waste disposed to landfill. These services typically provide yellow-lid bins for dry recyclables, green-lid bins for garden organics and red-lid bins for residual waste. To increase the level of recycling, some councils deliver residual waste to alternative waste treatment facilities for processing. This can involve composting and the recovery of resources, including plastics and metals, which can be recycled.

Appendix one - Responses from local councils

Appendix two - About the audit

Appendix three - Performance auditing

 

Parliamentary Reference: Report number #320 - released 5 June 2019

Published

Actions for Managing growth in the NSW prison population

Managing growth in the NSW prison population

Justice
Infrastructure
Management and administration
Project management
Service delivery
Workforce and capability

The Department of Justice has relied heavily on temporary responses to accommodate growing prisoner numbers according to a report released today by the Acting Auditor-General for New South Wales, Ian Goodwin.

At the time of this audit, the NSW Department of Justice (DOJ) was responsible for delivering custodial corrections services in New South Wales through its Corrective Services NSW division (Corrective Services NSW). From 1 July 2019, the Department of Family and Community Services and Justice will be responsible for these functions. 

Within DOJ, Corrective Services NSW is responsible for administering sentences and legal orders through custodial and community-based management of adult offenders. Its key priorities are:

  • providing safe, secure and humane management of prisoners
  • reducing reoffending
  • improving community safety and confidence in the justice system. 

The prison population in New South Wales grew by around 40 per cent between 2012 to 2018, from 9,602 to 13,630 inmates. This rate of growth was higher than experienced prior to 2012. DOJ forecasts growth to continue over the short and longer-term. 

DOJ has responded to inmate population growth by doubling-up and tripling-up the number of prison beds in cells, reactivating previously closed prisons, and a $3.8 billion program of new prison capacity. DOJ has also developed a long-term prison infrastructure strategy that projects long-term needs and recommended investments to meet these needs. 

This audit assessed how efficiently and effectively DOJ is responding to growth in the NSW prison population. In this report, we have not analysed the sources of demand or recommended ways that custody may be avoided. These are largely government policy issues. 

Conclusion
The DOJ has relied heavily on temporary responses to accommodate growth in the NSW prison population. Sustained reliance on these responses is inefficient and creates risks to safety, and timely access to prisoner support services.
DOJ has experienced significant growth in the prison population since 2012. To meet demand, it has relied on temporary responses that are not designed to be sustained, including doubling-up or tripling-up the number of beds in cells, reopening previously closed facilities and using obsolete facilities. DOJ has also regularly moved inmates between its facilities to accommodate the increasing need for beds in metropolitan Sydney. 
Relying on temporary approaches over a long period contributes to prison crowding and has affected DOJ's ability to manage inmates in line with its correctional principles. It has increased risks to staff and prisoner safety, and timely inmate access to prisoner support services and programs. In addition, the cost per prisoner per day increased over the past two years.
DOJ is progressively delivering new capacity to address the growing prison population.
In response to continuing and projected growth in the prison population, the NSW Government announced a one-off $3.8 billion program to deliver around 6,100 beds by May 2021. Under the program, DOJ developed and delivered two rapid build dormitory style prisons within 18 months. DOJ’s capability to deliver the program, including implementation of new beds and new prisons, governance, project management, risk assessment and commissioning has improved over time. Most new capacity will be delivered on existing DOJ sites, mainly in regional New South Wales. 
DOJ has developed a strategy to respond to long-term projected growth in the prison population, but it has yet to be funded. 
The Corrective Services NSW Infrastructure Strategy (CSIS) sets out challenges, strategic priorities, and planned actions to respond to projected growth over the next 20 years and improve overall system efficiency and effectiveness. But, proposed actions are subject to individual business cases and funding decisions. Three versions of the CSIS have been provided to, and endorsed by, the NSW Government. The key challenge identified in the CSIS is to overcome demand for prison beds in the Sydney metropolitan region. DOJ advised that it is developing a final business case to address metropolitan capacity needs, but this is subject to government approval and funding. DOJ should continue to highlight the urgency of this issue until it is addressed, as it prevents planned actions to improve system efficiency and effectiveness.
 

The Productivity Commission’s Report on Government Services outlines the performance indicator framework for corrective services in Australia (Appendix three). We have used measures from this framework to assess the efficiency and effectiveness of DOJ’s responses to prison bed capacity needs. 

In this section, we analyse system-wide indicators as DOJ has not consistently published or reported data for individual correctional centres over the period of review.
 

Published

Actions for Workforce reform in three amalgamated councils

Workforce reform in three amalgamated councils

Local Government
Management and administration
Project management
Workforce and capability

The Inner West Council and the Snowy Monaro and Queanbeyan-Palerang Regional Councils have all made progress towards efficient organisational structures following the amalgamation of their former council areas in 2016, according to a report released today by the Auditor-General of New South Wales.

All three councils are now operating with a single workforce and have largely achieved the milestones they planned for the first stage of their amalgamations. None have finished reviewing and aligning services across their former council areas nor integrated their ICT systems. They need to do this to be in a position to implement an optimal structure. 

 

On 12 May 2016, the NSW Government announced the amalgamation of 42 councils into 19 new councils. This followed a period of 18 months during which the NSW Independent Pricing and Regulatory Tribunal (IPART) had assessed councils' ‘fitness for the future’, and communities were consulted about proposed mergers. A further amalgamated council was created on 9 September 2016.

Upon amalgamation, existing elected councils were abolished, interim General Managers appointed, and Administrators engaged to undertake the role of the previously elected councils until Local Government elections were held 18 months later. During the period of administration, councils were asked to report on the progress of their amalgamations to the Department of Premier and Cabinet (DPC).

Council amalgamations not only require a re-drawing of boundaries, but re-establishment of local representation, decisions about alignment of services across the former council areas, and establishment of an amalgamated workforce.

The objective of this audit was to assess whether three councils, Inner West Council, Queanbeyan-Palerang Regional Council and Snowy Monaro Regional Council, are effectively reforming their organisation structures to realise efficiency benefits from amalgamation and managing the impact on staff.

Conclusion
The three councils we examined have made progress towards an efficient organisation structure.

Following amalgamation, all three councils developed detailed plans to bring their former workforces together, review positions and salaries, amalgamate salary structures and align human resources policies. All three councils have largely achieved the milestones included in these plans.
Benefits realisation plans show that councils did not expect to achieve material savings or efficiencies from workforce reform within the first three years of amalgamation.
Two councils do not clearly report on whether their reform initiatives are achieving benefits.

Administrators at all three councils endorsed lower savings targets than the NSW Government’s early analysis suggested may be possible. All three councils have plans or strategies to progress and achieve benefits from the amalgamation. However, Inner West Council and Snowy Monaro Regional Council could more clearly link their reform initiatives with expected benefits and include this in public reporting.

Amalgamations represent a substantial period of change for affected communities and amalgamated councils should be routinely reporting to their communities about the costs and benefits of amalgamation.

Councils have not yet determined their future service offerings and service levels nor completed integration of ICT systems. These decisions need to be made before an optimal organisation structure can be implemented.

Before amalgamated councils can implement an optimal organisation structure, they need to review and confirm their customer service offerings and service levels in consultation with their communities. This work is underway but is not yet complete in any of the councils.

Progress towards an efficient structure has been slowed by staff protections in the Local Government Act 1993 (the Act) and a range of logistical and administrative issues associated with amalgamation. These include multiple IT systems and databases that need to be integrated and different working conditions, policies and practices in the former councils that are not yet fully
harmonised.

The councils implemented legislated staff protections and focused on the people side of change but cannot reliably measure the impact of their change management efforts.

The Act provides protections that reduce the impact of amalgamations on staff. Beyond implementing these protections, the councils have communicated with staff, sought to prepare them for change, and involved staff in key decisions. All councils have conducted staff surveys over time. However, at this stage these staff surveys have not provided an effective or reliable measure of the impact of change management efforts. 

Published

Actions for Firearms regulation

Firearms regulation

Justice
Management and administration

There are gaps in how the Firearms Registry administers the firearms licencing and registration scheme for existing licence holders, according to a report released today by the Auditor-General for New South Wales, Margaret Crawford. These gaps reduce the Registry’s effectiveness in regulating firearms use and ownership. 

While the Firearms Registry has systems to promptly update details in the firearms register for changes in firearm ownership and for criminal or anti-social behaviour of licence holders, some key information, including addresses, is not accurate or up-to date. 'This exposes a critical gap in the Registry’s data on the location of licence holders and their firearms,' Ms Crawford said. 

The Firearms Registry may also be making unsound or inconsistent administrative decisions due to a lack of clear internal policies and guidance. These decisions include licence suspensions or revocations, assessing reasons for the acquisition of firearms, and initiating enforcement actions for breaches by licence holders. Ms Crawford noted that 'these gaps mean the Registry cannot be confident it conducts aspects of its licencing activities effectively.'

The report’s recommendations aim to improve the integrity of the data in the register and ensure that the Firearms Registry is making sound and consistent decisions in regulating firearms use and ownership.

Firearms used by the general public in NSW are regulated through the Firearms Act 1996 (NSW) (the Act) and the Firearms Regulation 2017 (NSW) (Regulation). In October 2018, there were over 237,500 firearm licence holders and just over one million registered firearms in NSW.

The Act and Regulation reflect the National Firearms Agreement reached by all Australian jurisdictions in 1996 and confirmed in 2017. This Agreement sets out the minimum requirements for regulating firearms. The Act recognises that possessing and using firearms are privileges conditional on the overriding need to ensure public safety.

The NSW Police Force (NSW Police), which includes the Firearms Registry (the Registry), is responsible for administering the Act and Regulation, and for operating the NSW firearms licensing and registration scheme. Relevant third parties such as approved clubs, firearms dealers and shooting ranges also carry some administrative and oversight responsibilities under the Act and Regulation.

The role of the Registry includes administering the following requirements under the Act and Regulation that are relevant to this audit:

  • licence conditions
  • licence suspensions and revocations
  • initiating seizure of firearms
  • assessing permits to acquire firearms
  • administering the good reason test
  • maintaining the register of firearms
  • approving alternative safe storage arrangements.

The Registry's other activities identified in this report support its regulatory responsibilities under the NSW Government framework for better regulation.

This audit assessed how well the Registry administers the requirements of the Act and Regulation for existing firearms licence holders. To effectively administer these requirements, the Registry should have:

  • a reliable database that supports the firearms licensing and registration scheme
  • appropriate risk-based policies and procedures for the Registry’s operation that are consistent with the Act and Regulation.

We did not assess the Registry’s processes in assessing and issuing firearms licences to new applicants or renewing licences of existing licence holders. We also did not examine the administrative actions conducted by police officers who are not part of the Registry.

See Section 1 for details on the role of the Registry. See Appendix six for details of the audit.

Conclusion
There are gaps in how the Registry administers important requirements for existing licence holders which reduce the Registry’s ability to take an effective risk-based approach to regulating firearm ownership.
The Registry has some good processes to monitor and apply changes to the register.
The Registry is promptly advised of the sale of firearms or potential criminal or anti-social behaviour activity of licence holders and it promptly updates relevant information in the register.
Information in the register is not accurate or up-to-date.
Licence holders do not always advise the Registry of their address changes within the time required. The Registry does not have processes to efficiently identify these changes if not advised. This exposes a critical gap in the Registry's data on the location of some firearms. While the Registry has implemented a number of programs for checking the accuracy of data in the register, some of these programs have either ceased or been severely curtailed. For example, the Registry was conducting various checks on the accuracy of the data relating to the description of firearms in the register and correcting errors. These checks ceased after July 2017, with only around 50 per cent of the register checked.

There is an increased risk of the Registry making unsound or inconsistent administrative decisions.
The Registry lacks appropriate policies and guidance for important administrative decisions and sanctions. These include making decisions about licence suspensions and revocations, assessing good reasons for acquiring firearms, and initiating some enforcement actions. There is also limited review of these critical decisions.
Regulatory context
The Commissioner of Police’s response to this report (Appendix one) indicates he disagrees with some of our findings and recommendations based on his view that the firearms licensing and registration scheme is a ‘co-regulatory model’. The conclusion and recommendations of this report are based on the provisions in the Act which indicate that the Commissioner, and through him the NSW Police Force (including the Firearms Registry), is the responsible regulator. We acknowledge that other stakeholders have obligations to undertake certain actions in accordance with the Act and Regulation. This is further discussed below. 

To effectively administer the requirements of the Act and Regulation, the register that supports the firearms licensing and registration scheme should have readily accessible, accurate and up-to-date information regarding the status of licence holders and registered firearms.

Published

Actions for Compliance of expenditure with Section 12A of the Public Finance and Audit Act 1983 - Law Enforcement Conduct Commission

Compliance of expenditure with Section 12A of the Public Finance and Audit Act 1983 - Law Enforcement Conduct Commission

Justice
Compliance
Management and administration

The Hon. Troy Grant MP, Minister for Police and Minister for Emergency Services requested an audit under section 27B(3)(c) of the Public Finance and Audit Act 1983, to determine whether expenditure on overseas travel by the Law Enforcement Conduct Commission (the Commission) complied with section 12A of the Public Finance and Audit Act 1983.

On 9 November 2018, the Hon. Troy Grant MP, Minister for Police and Minister for Emergency Services (the Minister), requested an audit under s. 27B(3)(c) of the Public Finance and Audit Act 1983 (the PF&A Act) to determine whether the expenditure of $8,074.66 on overseas travel by the Law Enforcement Conduct Commission (the LECC) complied with s. 12A of the PF&A Act.

In forming my audit conclusion, I have reviewed documentation provided by the Minister and the LECC, made enquiries of LECC staff, and sought independent legal advice on key aspects of the PF&A Act and the Law Enforcement Conduct Commission Act 2016 (the LECC Act) and their interface.
 

In my opinion, the LECC did not comply with s. 12A of the PF&A Act because the Minister:

  • had not delegated his authority to approve expenditure for overseas travel to an officer in the LECC
  • had specifically declined approving a request from the LECC to incur expenditure on the travel in question.

Despite this, the LECC incurred the expenditure.

In my view, the LECC required the Minister’s approval to incur the overseas travel expenditure before it could legally spend funds for this purpose from its appropriation.

The LECC is an independent investigative body, funded by appropriation, to oversight NSW Police and the Crime Commission 

The Bill to establish the LECC was introduced to parliament following a review of the police oversight system.1 The establishment of the LECC drew together functions previously undertaken by the Police Integrity Commission, the Ombudsman and the Inspector of the Crime Commission. It aimed to ‘remove overlapping responsibilities, inefficiencies and failures’ and ‘create a single civilian law enforcement oversight body’.2 

Part 4 of the LECC Act sets out the functions of the Commission as an independent investigative body. The objects of the LECC Act are summarised in Appendix one. The LECC Act provides that the Minister cannot direct the LECC on how to perform its functions. 

Notably, s. 22 of the LECC Act states:

The Commission and Commissioners are not subject to the control or direction of the Minister in the exercise of their functions.

For the financial year ended 30 June 2018, under s. 22 of the Appropriation Act 2017 (NSW), $21,195,000 was appropriated to the Minister for the LECC’s services. This provided the statutory basis for the sum in question to be drawn from the Consolidated Fund, but only in accordance with the PF&A Act.

The PF&A Act is the legislation that governs the administration of public finances

The PF&A Act determines how expenditure is to occur and sets out the conditions under which such expenditure can occur in NSW public sector agencies.The LECC is an agency within the NSW public sector.

Section 12A of the PF&A Act stipulates that:

A Minister to whom a sum of money is appropriated out of the Consolidated Fund for a use or purpose (whether by an annual Appropriation Act or other Act) may delegate to another Minister or to an officer of any authority, or authorise another Minister to delegate to an officer of any authority, the committing or incurring of expenditure from the sum so appropriated.

Section 12 of the PF&A Act also stipulates that:

Expenditure shall be committed or incurred by an officer of an authority only within the limits of a delegation in writing conferred on the officer by a person entitled to make the delegation.

The relevant ‘authority’ in this case was the Office of the Law Enforcement Conduct Commission (Office of the LECC) - a body which, under the Government Sector Employment Act 2013 (the GSE Act)employs the staff of the LECC.

Prima facie, as the LECC is funded by appropriation and is subject to the PF&A Act, its officers can only commit or incur expenditure with a delegation from the Minister.

The Minister did not delegate his right to approve expenditure on overseas travel

In April 2017, the Minister approved the LECC’s financial delegations under the authority vested in him by s. 12A of the PF&A Act. However, he reserved his right to approve any expenditure on overseas travel. This effectively required the LECC to obtain his approval for each instance of such expenditure.

The Minister declined approval of a LECC request for an officer to travel overseas 

In August 2017, the Chief Commissioner sought the Minister’s approval to incur overseas travel expenditure. The Minister exercised his right under the PF&A Act to decline the request and confirmed this in writing:

Establishment of LECC being in its infancy, travel is not supported at this time. Operating priorities should be the focus at this time.

The LECC paid the overseas travel expenses without a delegation or Ministerial approval

In October 2017, despite the absence of a delegation or approval from the Minister to incur expenditure on overseas travel, the Chief Commissioner approved a total of $8,074.66 for the LECC’s Director of Covert Services to travel to, and attend an international conference.

The LECC booked and paid for the travel in four payments between October and December 2017. Over the same period the Chief Commissioner reimbursed the agency for these expenses from his personal funds. On 13 October 2017, the Chief Commissioner wrote to the Minister asking him to reconsider his decision. On 12 January 2018, in the absence of a response from the Minister, the Chief Commissioner directed the LECC’s finance officer to ‘repay the relevant costs to my account’.5 On 16 January 2018, the LECC’s Chief Executive Officer approved the reimbursement to the Chief Commissioner, which occurred on 17 January 2018. Appendix three provides further detail on the series of payments. 

The Chief Commissioner first disclosed he had been reimbursed for the expenses, without Ministerial approval, in March 2018. In August 2018, the Chief Commissioner made a further disclosure about the expenditure at Budget Estimates.6

The Chief Commissioner argues the overseas travel expenditure was properly incurred

The Chief Commissioner argues the LECC’s overseas travel expenditure was properly incurred because:

  • the travel was undertaken in pursuit of the detective and investigative functions specified in s. 26(b)(i) of Part 4 of the LECC Act7  
  • a specific reservation in public policy cannot be qualified by general rules of public policy.8 The Chief Commissioner argues s. 22 of the LECC Act is a specific provision that conflicts with the general provisions in ss. 12 and 12A of the PF&A Act. In his view, the conflict is resolved by applying the principle that a specific later provision effectively repeals an earlier general provision. In his view, the LECC Act contains a specific provision that the Minister cannot direct the LECC in exercising its functions, whereas the PF&A Act contains general provisions which deal with the spending of public money.

The Chief Commissioner believes the Minister’s decision7:

  • was not made in the bona fide exercise of the power conferred on him by the PF&A Act as it interfered with the management of the LECC’s operating priorities
  • and his failure to enquire into the operational situation of the LECC were not decisions a rational decision maker could have made
  • was made for an improper purpose and was biased, in that the Minister had approved expenditure for a member of NSW Police to travel to the conference, but denied the same to a member of the LECC, which oversights NSW Police
  • breached s. 22 of the LECC Act, because it directed the LECC Commissioners in the exercise of their functions.

The Crown Solicitor and Solicitor General advised the expenditure breached the PF&A Act

On 7 September 2017, the Crown Solicitor advised the Office of Police (part of the Department of Justice) that:

The Minister’s authority to determine whether or not to approve a particular expenditure from the amount appropriated from the Consolidated Fund for the purpose of the Commission under the Constitution Act 1902 and the PF&A Act is not affected by s.22 of the LECC Act. These have different spheres of operation. It is not unusual for otherwise independent bodies to be subject to restrictions with respect to the use of public moneys.9

Subsequently, the Crown Solicitor asked the Solicitor General to review the matter of her previous advice. On 14 December 2017, the Solicitor General concurred with the Crown Solicitor’s advice. He concluded that:

Although LECC has a high degree of independence under its legislation, it is a body operating in the public sector and within the context of the broad policies of the government of the day in relation to public administration... it is not a function of LECC or its Commissioners to deal directly with money appropriated to the Minister out of the Consolidated Fund.10

The Secretary of the Department of Justice forwarded the Crown Solicitor’s and the Solicitor General’s advice to the Chief Commissioner.11 The Chief Commissioner continues to contest the Crown Solicitor’s and the Solicitor General’s advice.12

The Minister referred the matter to the Inspector of the LECC

In August 2018, the Minister referred the Chief Commissioner’s disclosure in Budget Estimates13 that he had been personally reimbursed for an expense concerning overseas travel by an officer of the LECC, to the Inspector of the LECC (the Inspector).14 The Inspector is the person, under s. 122 of the LECC Act, responsible for 'auditing the operation of the Commission for the purpose of monitoring compliance with the law of the State'. On 4 September 2018, the Inspector recused himself from investigating the Minister’s complaint.15 In his letter to the Premier dated 19 September 2018, he wrote ‘I informed the Minister for Police that I had acquired information in my capacity as Inspector of LECC (and in the discharge of my statutory functions) prior to receiving his letter of complaint…’. He further suggested to the Minister and the Premier that an Assistant Inspector be appointed to investigate the complaint under s. 121(1) of the LECC Act to give ‘proper and independent’ consideration to the Minister’s complaint.16 

The Minister asks the Auditor General to audit the transaction’s compliance with the PF&A Act

An Assistant Inspector appointed under section 121 of the LECC Act can exercise any function of the Inspector, including ‘auditing the operations of the Commission’. The reasons why an Assistant Inspector was not appointed to investigate the matter are not apparent. Instead, on 9 November 2018, the Minister requested the Auditor General to conduct an audit of whether the expenditure complied with s. 12A of the PF&A Act.17


1  By the former shadow Attorney General, Mr Andrew Tink AM.
2  Second reading speech of Minister Troy Grant for the LECC Bill.
3  Per the definition of ‘authority’ in s. 4(1) of the PF&A Act and the definition of ‘Public Service agency’ in s. 3 of the GSE Act and Part 3 of Schedule 1 to the GSE Act.
4  A timeline of the key events relevant to this audit is set out in Appendix two.
5  Note from the Chief Commissioner to LECC’s finance officer.
7  Letter from the Chief Commissioner to the Secretary of the Department of Justice 24 November 2017.
8  Letter from the Chief Commissioner to the Auditor‑General 12 December 2018.
9  Crown Solicitor’s advice ‑ NSW Parliamentary website.
10  Solicitor‑General’s advice ‑ NSW Parliamentary website.
11  The Chief Commissioner acknowledged receipt of the Crown Solicitor’s and Solicitor‑General’s advice on 24 November 2017 and 26 February 2018 respectively.
12  Letter from the Chief Commissioner to the Auditor‑General 12 December 2018.
14  Letter from the Minister to the Hon. Terry Buddin SC, Inspector of the LECC.
15  Letter from the Hon. Terry Buddin SC, Inspector of the LECC to the Minister 4 September 2018.
16  Letter from the Hon. Terry Buddin to the Premier 19 September 2018.
17  Ss. 12 and12A of the PF&A Act were repealed by the Government Sector Finance Legislation (Repeal and Amendment) Act 2018 Schedule 2[5] and re‑enacted as s5.2 of the Government Sector Finance Act 2018. However, these provisions were the law at the time of the events.

In forming my adverse conclusion, I considered the Chief Commissioner’s argument that s. 22 of the LECC Act prevailed over those sections of the PF&A Act that deal with spending public money, and:

  • the principles of statutory interpretation that might apply when a potential conflict between a general provision in one Act and specific provisions in another exists
  • whether an apparent conflict exists
  • whether the Chief Commissioner was entitled to incur the expenditure without Ministerial approval
  • whether the Minister was lawfully entitled to withhold approval for the expenditure from the Chief Commissioner.

The principles of statutory interpretation apply where potential conflicts exist between Acts

A basic principle of statutory interpretation is that all legislation be given its full scope and effect. Courts, and thereby other interpreters, are not at liberty to consider any word or meaning as superfluous. The starting point is that all words must be given some meaning and effect.18 If there is an apparent conflict between two Acts, the pieces of legislation should be read in such a way as to avoid that conflict by giving the words the construction that produces the greatest harmony and the least inconsistency.19

One way conflict can be avoided is to apply the approach that a later general provision does not override an earlier specific provision.20 However, this approach is rebuttable, as a later general Act might also be said to qualify an earlier specific Act.21 The reverse can also apply, in that a later specific Act can be claimed to qualify or supersede an earlier general provision. In such a case, it is said that the later Act impliedly repeals the earlier. This is an easier case to make out because it is apparent the parliament has dealt with the specific instance and it would be reasonable to expect that it had considered any contrary general legislation. However, here again, the courts have qualified this approach by suggesting it should be presumed unlikely that a parliament would intend to contradict itself. If the specific Act was intended to qualify an earlier general Act, then the legislation would have spelt this out.

One must therefore always start from the premise that all words are to be given meaning and effect, and that meaning should enable both pieces of legislation to operate. It is only where the point is reached that it is not possible for both pieces of legislation to operate to their full extent that the approaches to resolving conflicts can be usefully invoked. The approaches may then be useful to determine which is the primary provision and which provision must give way to the requirements set out in that primary provision.

Is there an apparent conflict between the LECC Act and the PF&A Act that needs to be resolved?

No. The LECC Act deals specifically with the operational functions of the LECC, while the PF&A Act deals with the specific issue of expenditure by a delegate of the Minister. 

The Chief Commissioner argues that s. 22 of the LECC Act is a specific provision and should take precedence over general delegation provisions in the PF&A Act, namely ss. 12 and 12A. He argues this because s. 22 deals specifically with the operation of the LECC and prohibits the Minister from directing the LECC in the performance of its functions. In his view, this includes the administrative and financial functions impliedly invested in the LECC for it to perform the specific functions referred to in the LECC Act.

However, it can also be readily argued that s. 22 of the LECC Act deals with the general issue of Minister's directions to the LECC and the PF&A deals with the specific issue of expenditure by a delegate of the Minister. While the expenditure of funds may be essential for the LECC to perform its functions, that expenditure is controlled by the PF&A Act, as it controls all expenditure from the Consolidated Fund. The PF&A Act is the specific legislation that relates to expenditure.

The issues that have arisen can be resolved by looking at the effect of the two Acts in their application to the facts. In my view, the PF&A Act and the LECC Act can be applied to the facts under consideration as they deal with different issues and are thereby capable of separate operation. 

Was the LECC able to incur expenditure without Ministerial approval?

No. The PF&A Act applies to the LECC in the same way it applies to all NSW Government agencies. While the Minister had approved the LECC’s financial delegations under the authority vested in him by s. 12A of the PF&A Act, he reserved his right to approve all expenditure on overseas travel. This effectively required the LECC to obtain his approval for each instance of such expenditure. As the Minister did not approve the overseas travel request, the Chief Commissioner was not legally able to authorise the expenditure.

The PF&A Act determines how expenditure is to occur and sets out the conditions under which such expenditure can occur in New South Wales public sector agencies. Expenditure can ‘only be committed or incurred by an officer of an authority within the limits of a delegation in writing conferred on the officer by a person entitled to make the delegation’.22

Was the Minister lawfully entitled to withhold approval of the overseas travel expenditure?

Yes. If one accepts the premise that the PF&A Act determines the basis on which public money can be spent, it follows that the Minister could exercise the discretion reserved to him by financial delegation and withhold approval of the overseas travel expenditure for the LECC officer.

Section 22 of the LECC Act prevents the Minister from directing the LECC to send (or not to send) an officer to a conference. However, the Minister did not direct the LECC as to whether the person should or should not attend the conference. Rather, he exercised the responsibility given to him to determine how public funds were to be spent.

The appropriation to the LECC provided funding to the delegate of the Minister to support the performance of the agency’s functions. However, the expenditure of money for overseas travel was governed by ss. 12 and 12A of the PF&A Act. This gave the Minister discretion to approve or refuse to approve expenditure for overseas travel on a case by case basis. It follows from this that the Chief Commissioner was not entitled to spend money for overseas travel, even though in the Commissioner’s view it was beneficial to the performance of the LECC’s functions.

It may be suggested that the Minister’s refusal to provide funding for a particular function may have the same effect as directing an agency not to perform that function. NSW’s constitutional structure of government establishes that public money can only be spent in accordance with legislation and if expenditure requires a Minister’s approval, that approval establishes the ability of an agency to spend that money. That said, in reserving approval for certain types of expenditures, care should be exercised not to unduly interfere with the legitimate functions of independent agencies.


18  Commonwealth v Baume (1905) 2 CLR 405 per Griffith CJ at 414.
19  Australian Alliance Assurance Co Ltd v Attorney‑General (Qld) [1916] St R Qld 135 at 161.
20  Maybury v Plowman (1913) 16 CLR 468 at 473‑4 the approach is often described within the Latin tag (generalia specialibus non derogant).
21  Associated Minerals Consolidated Ltd v Wyong Shire Council [1974] 2 NSWLR 681 at 686.
22  Section 12(1) of the PF&A Act.
 

This assurance audit is a ‘direct engagement’ whereby the Auditor‑General provides the Minister and parliament with reasonable assurance about whether $8,074.66 spent on overseas travel by the LECC complied, in all material respects with s. 12A of the PF&A Act.

My audit was conducted in accordance with applicable Standards on Assurance Engagements (ASAE 3100 ‘Compliance Engagements’).

In conducting my audit, I have complied with:

  • the independence requirements of Australian Auditing and Assurance Standards
  • ASQC 1 ‘Quality Control for firms that Perform Audits and Reviews of Financial Reports and Other Financial Information, Other Assurance Engagements and Related Service Engagements’
  • relevant ethical pronouncements.

Parliament promotes independence by ensuring the Auditor‑General and the Audit Office of New South Wales are not compromised in their roles by:

  • providing that only parliament, and not the executive government, can remove an Auditor‑General
  • mandating the Auditor‑General as auditor of public sector agencies
  • precluding the Auditor‑General from providing non‑audit services.

I have reviewed documentation provided by the Minister and the LECC, gained an understanding of the LECC’s controls and processes for approving and making expenditure and made enquiries of LECC staff. I have also:

  • gained an understanding of the relevant pieces of legislation and case law
  • reviewed the advice of the Crown Solicitor and the Solicitor‑General
  • sought independent legal advice on key aspects of the PF&A Act and the Law Enforcement Conduct Commission Act 2016 (the LECC Act) from an acknowledged expert in statutory interpretation
  • conducted interviews with key persons
  • reviewed the documentation listed in Appendix four.

Published

Actions for Internal Controls and Governance 2018

Internal Controls and Governance 2018

Education
Community Services
Finance
Health
Industry
Justice
Planning
Premier and Cabinet
Transport
Treasury
Whole of Government
Environment
Compliance
Cyber security
Financial reporting
Fraud
Information technology
Internal controls and governance
Management and administration
Procurement
Project management

The Auditor-General for New South Wales Margaret Crawford found that as NSW state government agencies’ digital footprint increases they need to do more to address new and emerging information technology (IT) risks. This is one of the key findings to emerge from the second stand-alone report on internal controls and governance of the 40 largest NSW state government agencies.

This report analyses the internal controls and governance of the 40 largest agencies in the NSW public sector for the year ended 30 June 2018.

This report covers the findings and recommendations from our 2017–18 financial audits that relate to internal controls and governance at the 40 largest agencies (refer to Appendix three) in the NSW public sector.

This report offers insights into internal controls and governance in the NSW public sector

This is our second report dedicated to internal controls and governance at NSW State Government agencies. The report provides insights into the effectiveness of controls and governance processes in the NSW public sector by:

  • highlighting the potential risks posed by weaknesses in controls and governance processes
  • helping agencies benchmark the adequacy of their processes against their peers
  • focusing on new and emerging risks, and the internal controls and governance processes that might address those risks.

Without strong governance systems and internal controls, agencies increase the risks associated with effectively managing their finances and delivering services to citizens. The way agencies deliver services increasingly relies on contracts and partnerships with the private sector. Many of these arrangements deliver front line services, but others provide less visible back office support. For example, an agency may rely on an IT service provider to manage a key system used to provide services to the community. The contract and service level agreements are only truly effective where they are actively managed to reduce risks to continuous quality service delivery, such as interruptions caused by system outages, cyber security attacks and data security breaches.

Our audits do not review all aspects of internal controls and governance every year. We select a range of measures, and report on those that present heightened risks for agencies to mitigate. This report divides these into the following five areas:

  1. Internal control trends
  2. Information technology (IT), including IT vendor management
  3. Transparency and performance reporting
  4. Management of purchasing cards and taxis
  5. Fraud and corruption control.

The findings in this report should not be used to draw conclusions on the effectiveness of individual agency control environments and governance arrangements. Specific financial reporting, controls and service delivery comments are included in the individual 2018 cluster financial audit reports, which will be tabled in Parliament from November to December 2018.

The focus of the report has changed since last year

Last year's report topics included asset management, ethics and conduct, and risk management. We are reporting on new topics this year. We plan to introduce new topics and re-visit our previous topics in subsequent reports on a cyclical basis. This will provide a baseline against which to measure the NSW public sectors’ progress in implementing appropriate internal controls and governance processes to mitigate existing, new and emerging risks in the public sector.

Agencies selected for the volume account for 95 per cent of the state's expenditure

While we have covered only 40 agencies in this report, those selected are a large enough group to identify common issues and insights. They represent about 95 per cent of total expenditure for all NSW public sector agencies.

Internal controls are processes, policies and procedures that help agencies to:

  • operate effectively and efficiently
  • produce reliable financial reports
  • comply with laws and regulations
  • support ethical government.

This chapter outlines the overall trends for agency controls and governance issues, including the number of findings, level of risk and the most common deficiencies we found across agencies. The rest of this volume presents this year’s controls and governance findings in more detail.

Observation Conclusions and recommendations
2.1 High risk findings
We found six high risk findings (seven in 2016–17), one of which was repeated from both last year and 2015–16. Recommendation: Agencies should reduce risk by addressing high risk internal control deficiencies as a priority.
2.2 Common findings
We found several internal controls and governance findings common to multiple agencies. Conclusion: Central agencies or the lead agency in a cluster can play a lead role in helping ensure agency responses to common findings are consistent, timely, efficient and effective.
2.3 New and repeat findings
Although internal control deficiencies decreased over the last four years, this year has seen a 42 per cent increase in internal control deficiencies. The increase in new IT control deficiencies and repeat IT control deficiencies signifies an emerging risk for agencies.
IT control deficiencies feature in this increase, having risen by 63 per cent since last year. The number of repeat IT control deficiencies has doubled and is driven by the increasing digital footprint left by agencies as government prioritises on-line interfaces with citizens, and the number of transactions conducted through digital channels increases

Recommendation: Agencies should reduce IT risks by:

  • assigning ownership of recommendations to address IT control deficiencies, with timeframes and actions plans for implementation
  • ensuring audit and risk committees and agency management regularly monitor the implementation status of recommendations.

 

Government agencies’ financial reporting is now heavily reliant on information technology (IT). IT is also increasingly important to the delivery of agency services. These systems often provide the data to help monitor the efficiency and effectiveness of agency processes and services they deliver. Our audits reviewed whether agencies have effective controls in place to manage both key financial systems and IT service contracts.

Observation Conclusions and recommendations
3.1 Management of IT vendors
Contract management framework 
Although 87 per cent of agencies have a contract management policy to manage IT vendors, one fifth require review.
 

Conclusion: Agencies can more effectively manage IT vendor contracts by developing policies and procedures to ensure vendor management frameworks are kept up to date, plans are in place to manage vendor performance and risk, and compliance with the framework is monitored by:

  • internal audit focusing on key contracting activities
  • experienced officers who are independent of contract administration performing spot checks or peer reviews
  • targeted analysis of data in contract registers.
Contract risk management
Forty-one per cent of agencies are not using contract management plans and do not assess contract risks. Half of the agencies that did assess contract risks, had not updated the risk assessments since the commencement of the contract.
 
Conclusion: Instead of applying a 'set and forget' approach in relation to management of contract risks, agencies should assess risk regularly and develop a plan to actively manage identified risks throughout the contract lifecycle - from negotiation and commencement, to termination.

Performance management
Eighty-six per cent of agencies meet with vendors to discuss performance. 

Only 24 per cent of agencies sought assurance about the accuracy of vendor reporting against KPIs, yet sixty-seven per cent of the IT contracts allow agencies to determine performance based payments and/or penalise underperformance.

Conclusion: Agencies are monitoring IT vendor performance, but could improve outcomes and more effectively manage under-performance by:

  • a more active, rigorous approach to both risk and performance management
  • checking the accuracy of vendor reporting against those KPIs and where appropriate seeking assurance over their accuracy
  • invoking performance based payments clauses in contracts when performance falls below agreed standards.

Transitioning services
Forty-three per cent of the IT vendor contracts did not contain transitioning-out provisions.

Where IT vendor contracts do make provision for transitioning-out, only 28 per cent of agencies have developed a transitioning-out plan with their IT vendor.

Conclusion: Contract transition/phase out clauses and plans can mitigate risks to service disruption, ensure internal controls remain in place, avoid unnecessary costs and reduce the risk of 'vendor lock-in'.
Contract Registers
Eleven out of forty agencies did not have a contract register, or have registers that are not accurate and/or complete.

Conclusion: A contract register helps to manage an agency’s compliance obligations under the Government Information (Public Access) Act 2009 (the GIPA Act). However, it also helps agencies more effectively manage IT vendors by:

  • monitoring contract end dates and contract extensions, and commence new procurements through their central procurement teams in a timely manner
  • managing their contractual commitments, budgeting and cash flow requirements.

Recommendation: Agencies should ensure their contract registers are complete and accurate so they can more effectively govern contracts and manage compliance obligations.

3.2 IT general controls
Governance
Ninety-five per cent of agencies have established policies to manage key IT processes and functions within the agency, with ten per cent of those due for review.
 
Conclusion: Regular review of IT policies ensures risks are considered and appropriate strategies and procedures are implemented to manage these risks on a consistent basis. An absence of policies can lead to ad-hoc responses to risks, and failure to consider emerging IT risks and changes to agency IT environments. 

User access administration
Seventy-two deficiencies were identified related to user access administration, including:

  • thirty issues related to granting user access across 43 per cent of agencies
  • sixteen issues related to removing user access across 30 per cent of agencies
  • twenty-six issues related to periodic reviews of user access across 50 per cent of agencies.
Recommendation: Agencies should strengthen the administration of user access to prevent inappropriate access to key systems.
Privileged access
Forty per cent of agencies do not periodically review logs of the activities of privileged users to identify suspicious or unauthorised activities.

Recommendation: Agencies should:

  • review the number of, and access granted to privileged users, and assess and document the risks associated with their activities
  • monitor user access to address risks from unauthorised activity.
Password controls
Twenty-three per cent of agencies did not comply with their own policy on password parameters.
Recommendation: Agencies should ensure IT password settings comply with their password policies.
Program changes
Fifteen per cent of agencies had deficient IT program change controls mainly related to segregation of duties and authorisation and testing of IT program changes prior to deployment.
Recommendation: Agencies should maintain appropriate segregation of duties in their IT functions and test system changes before they are deployed.

 

This chapter outlines our audit observations, conclusions and recommendations from our review of how agencies reported their performance in their 2016–17 annual reports. The Annual Reports (Statutory Bodies) Regulation 2015 and Annual Reports (Departments) Regulation 2015 (annual reports regulation) currently prescribes the minimum requirements for agency annual reports.

Observation Conclusion or recommendation
4.1 Reporting on performance

Only 57 per cent of agencies linked reporting on performance to their strategic objectives.

The use of targets and reporting performance over time was limited and applied inconsistently.

Conclusion: There is significant disparity in the quality and consistency of how agencies report on their performance in their annual reports. This limits the reliability and transparency of reported performance information.

Agencies could improve performance reporting by clearly linking strategic objectives to reported outcomes, and reporting on performance against targets over time. NSW Treasury may need to provide more guidance to agencies to support consistent and high-quality performance reporting in annual reports.

There is no independent assurance that the performance metrics agencies report in their annual reports are accurate.

Prior performance audits have noted issues related to the collection of performance information. For example, our 2016 Report on Red Tape Reduction highlighted inaccuracies in how the dollar-value of red tape reduction had been reported.

Conclusion: The ability of Parliament and the public to rely on reported information as a relevant and accurate reflection of an agency's performance is limited.

The relevance and accuracy of performance information is enhanced when:

  • policies and guidance support the consistent and accurate collection of data
  • internal review processes and management oversight are effective
  • independent review processes are established to provide effective challenge to the assumptions, judgements and methodology used to collect the reported performance information.
4.2 Reporting on reports

Agency reporting on major projects does not meet the requirements of the annual reports regulation.

Forty-seven per cent of agencies did not report on costs to date and estimated completion dates for major works in progress. Of the 47 per cent of agencies that reported on major works, only one agency reported detail about significant cost overruns, delays, amendments, deferments or cancellations.

NSW Treasury produce an annual report checklist to help agencies comply with their annual report obligations.

Recommendation: Agencies should comply with the annual reports regulation and report on all mandatory fields, including significant cost overruns and delays, for their major works in progress.

The information the annual reports regulation requires agencies to report deals only with major works in progress. There is no requirement to report on completed works.

Sixteen of 30 agencies reported some information on completed major works.

Conclusion: Agencies could improve their transparency if they reported, or were required to report:

  • on both works in progress and projects completed during the year
  • actual costs and completion dates, and forecast completion dates for major works, against original and revised budgets and original expected completion dates
  • explanations for significant cost overruns, delays and key project performance metrics.

 

This chapter outlines our audit observations, conclusions and recommendations, arising from our review of agency preventative and detective controls over purchasing card and taxi use for 2017–18.

Observation Conclusion or recommendation
5.1 Management of purchasing cards
Volume of credit card spend
Purchasing card expenditure has increased by 76 per cent over the last four years in response to a government review into the cost savings possible from using purchasing cards for low value, high volume procurement.
 
Conclusion: The increasing use of purchasing cards highlights the importance of an effective framework for the use and management of purchasing cards.
Policy framework
We found all agencies that held purchasing cards had a policy in place, but 26 per cent of agencies have not reviewed their purchasing card policy by the scheduled date, or do not have a scheduled revision date stated within their policy.
Recommendation: Agencies should mitigate the risks associated with increased purchasing card use by ensuring policies and purchasing card frameworks remain current and compliant with the core requirements of TPP 17–09 'Use and Management of NSW Government Purchasing Cards'.
Preventative controls
We found that:
  • all agencies maintained purchasing card registers
  • seventy-six per cent provided training to cardholders prior to being issued with a card
  • eighty-nine per cent appointed a program administrator, but only half of these had clearly defined roles and responsibilities
  • thirty-two per cent of agencies place merchant blocks on purchasing cards
  • forty-seven per cent of agencies place geographic restrictions on purchasing cards.

Agencies have designed and implemented preventative controls aimed at deterring the potential misuse of purchasing cards.

Conclusion: Further opportunities exist for agencies to better control the use of purchasing cards, such as:

  • updating purchasing card registers to contain all mandatory fields required by TPP17–09
  • appointing a program administrator for the agency's purchasing card framework and defining their role and responsibility for the function
  • strengthening preventive controls to prevent misuse.

Detective controls
Ninety-two per cent of agencies have designed and implemented at least one control to monitor purchasing card activity.

Major reviews, such as data analytics (29 per cent of agencies) and independent spot checks (49 per cent of agencies) are not widely used.

Agencies have designed and implemented detective controls aimed at identifying potential misuse of purchasing cards.

Conclusion: More effective monitoring using purchasing card data can provide better visibility over spending activity and can be used to:

  • detect misuse and investigate exceptions
  • analyse trends to highlight cost saving opportunities.
5.2 Management of taxis
Policy framework
Thirteen per cent of agencies have not developed and implemented a policy to manage taxi use. In addition:
  • a further 41 per cent of agencies have not reviewed their policies by the scheduled revision date, or do not have a scheduled revision date
  • more than half of all agencies’ policies do not offer alternative travel options. For example, only 36 per cent of policies promoted the use of general Opal cards.
Conclusion: Agencies can promote savings and provide more options to staff where their taxi use policies:
  • limit the circumstances where taxi use is appropriate
  • offer alternate, lower cost options to using taxis, such as general Opal cards and rideshare.
Detective controls
All agencies approve taxi expenditure by expense reimbursement, purchasing card and Cabcharge, and have implemented controls around this approval process. However, beyond this there is minimal monitoring and review activity, such as data monitoring, independent spot checks or internal audit reviews.
Conclusion: Taxi spend at agencies is not significant in terms of its dollar value, but it is significant from a probity perspective. Agencies can better address the probity risk by incorporating taxi use into a broader purchasing card or fraud monitoring program.

 

Fraud and corruption control is one of the 17 key elements of our governance lighthouse. Recent reports from ICAC into state agencies and local government councils highlight the need for effective fraud control and ethical frameworks. Effective frameworks can help protect an agency from events that risk serious reputational damage and financial loss.

Our 2016 Fraud Survey found the NSW Government agencies we surveyed reported 1,077 frauds over the three year period to 30 June 2015. For those frauds where an estimate of losses was made, the reported value exceeded $10.0 million. The report also highlighted that the full extent of fraud in the NSW public sector could be higher than reported because:

  • unreported frauds in organisations can be almost three times the number of reported frauds
  • our 2015 survey did not include all NSW public sector agencies, nor did it include any NSW universities or local councils
  • fraud committed by citizens such as fare evasion and fraudulent state tax self-assessments was not within the scope of our 2015 survey
  • agencies did not estimate a value for 599 of the 1,077 (56 per cent) reported frauds.

Commissioning and outsourcing of services to the private sector and the advancement of digital technology are changing the fraud and corruption risks agencies face. Fraud risk assessments should be updated regularly and in particular where there are changes in agency business models. NSW Treasury Circular TC18-02 NSW Fraud and Corruption Control Policy now requires agencies develop, implement and maintain a fraud and corruption control framework, effective from 1 July 2018. 

Our Fraud Control Improvement Kit provides guidance and practical advice to help organisations implement an effective fraud control framework. The kit is divided into ten attributes. Three key attributes have been assessed below; prevention, detection and notification systems.

This chapter outlines our audit observations, conclusions and recommendations, arising from our review of agency fraud and corruption controls for 2017–18.

Observation Conclusion or recommendation
6.1 Prevention systems

Prevention systems
Ninety-two per cent of agencies have a fraud control plan in place, 81 per cent maintain a fraud database and 79 per cent report fraud and corruption matters as a standing item on audit and risk committee agendas.

Only 54 per cent of agencies have an employment screening policy and all agencies have IT security policies, but gaps in IT security controls could undermine their policies.

Conclusion: Most agencies have implemented fraud prevention systems to reduce the risk of fraud. However poor IT security along with other gaps in agency prevention systems, such as employment screening practices heightens the risk of fraud and inappropriate use of data.

Agencies can improve their fraud prevention systems by:

  • completing regular fraud risk assessments, embedding fraud risk assessment into their enterprise risk management process and reporting the results of the assessment to the audit and risk committee
  • maintaining a fraud database and reviewing it regularly for systemic issues and reporting a redacted version of the database on the agency's website to inform corruption prevention networks
  • developing policies and procedures for employee screening and benchmarking their current processes against ICAC's publication ‘Strengthening Employment Screening Practices in the NSW Public Sector’
  • developing and maintaining up to date IT security policies and monitoring compliance with the policy.
Twenty-three per cent of agencies were not performing fraud risk assessments and some agency fraud risk assessments may not be as robust as they could be.  Conclusion: Agencies' systems of internal controls may be less effective where new and emerging fraud risks have been overlooked, or known weaknesses have not been rectified.
6.2 Detection systems
Detection systems
Several agencies reported they were developing a data monitoring program, but only 38 per cent of agencies had already implemented a program.
 

Studies have shown data monitoring, whereby entire populations of transactional data are analysed for indicators of fraudulent activity, is one of the most effective methods of early detection. Early detection decreases the duration a fraud remains undetected thereby limiting the extent of losses.

Conclusion: Data monitoring is an effective tool for early detection of fraud and is more effective when informed by a comprehensive fraud risk assessment.

6.3 Notification systems
Notification system
All agencies have notification systems for reporting actual or suspected fraud and corruption. Most agencies provide multiple reporting lines, provide training and publicise options for staff to report actual or suspected fraud and corruption.
Conclusion: Training staff about their obligations and the use of fraud notification systems promotes a fraud-aware culture

 

Published

Actions for Fraud controls in local councils

Fraud controls in local councils

Local Government
Fraud
Internal controls and governance
Management and administration
Risk

Many local councils need to improve their fraud control systems, according to a report released today by the Auditor-General for New South Wales, Margaret Crawford. The report highlights that councils often have fraud control procedures and systems in place, but are not ensuring people understand them and how they work. There is also significant variation between councils in the quality of their fraud controls.

Fraud can directly influence councils’ ability to deliver services, and undermine community confidence and trust. ICAC investigations, such as the recent Operation Ricco into the former City of Botany Bay Council, show the financial and reputational damage that major fraud can cause. Good fraud control practices are critical for councils and the community. 

The Audit Office of New South Wales 2015 Fraud Control Improvement Kit (the Kit) aligns with the Fraud and Corruption Control Standard AS8001-2008 and identifies ten attributes of an effective fraud control system. This audit used the Kit to assess how councils manage the risk of fraud. It identifies areas where fraud control can improve. 

Fraud can disrupt the delivery and quality of services and threaten the financial stability of councils.

Recent reviews of local government in Queensland and Victoria identify that councils are at risk of fraud because they purchase large quantities of goods and services using devolved decision making arrangements. The Queensland Audit Office in its 2014–15 report 'Fraud Management in Local Government' found that ‘Councils are exposed to high-risks of fraud and corruption because of the high volume of goods and services they procure, often from local suppliers; and because of the high degree of decision making vested in councils'. They also highlight some common problems faced by councils including the absence of fraud control plans and failure to conduct regular reviews of their internal controls. Also, in 2008 and 2012 the Victorian Auditor-General identified the importance of up-to-date fraud control planning, clearly documented related policies, training staff to identify fraud risks and the importance of controls such as third party management. 

Investigations into councils by the NSW Independent Commission Against Corruption (ICAC), such as the recent Operation Ricco, show the impact that fraud can have on councils. These impacts include significant financial loss, and negative public perceptions about how well councils manage fraud. The findings of these investigations also show the importance of good fraud controls for councils.

Operation Ricco

In its report on Operation Ricco, the ICAC found that the Chief Financial Officer (CFO) of the City of Botany Bay Council and others dishonestly exercised official functions to obtain financial benefits for themselves and others by causing fraudulent payments from the Council for their benefit. It also identified the CFO received inducements for favourable treatment of contractors.

The report noted that there were overwhelming failures in the council’s procedures and governance framework that created significant opportunities for corruption, of which the CFO and others took advantage.

It found weaknesses across a wide variety of governance processes and functions, including those involving the general manager, the internal audit function, external audit, and the operation of the audit committee.

Source: Published reports of ICAC investigations July 2017.

The strength of fraud control systems varies significantly across New South Wales local councils, and many councils we surveyed need to improve significantly. 

Most surveyed councils do not have fraud control plans that direct resources to mitigating the specific fraud risks they face. Few councils reported that they conduct regular risk assessments or health checks to ensure they respond effectively to the risks they identify. 

There are sector wide weaknesses that impact on the strength of councils' fraud control practice. Less than one-third of councils that responded to the survey:

  • communicate their expectations about ethical conduct and responsibility for fraud control to staff 
  • regularly train staff to identify and respond to suspected fraud
  • inform staff or the wider community how to report suspected fraud and how reports made will be investigated.

The audit also identified a pattern of councils developing policies, procedures or systems without ensuring people understand them, or assessing that they work. This reduces the likelihood that staff will actually use them. 

In general, metropolitan and regional councils surveyed have stronger fraud control systems than rural councils. 

Newly amalgamated councils are operating with systems inherited from two or more pre-amalgamated councils. These councils are developing new systems for their changed circumstances.

Five councils surveyed reported that they did not comply with the Public Interest Disclosure Act 1994

Observations for the sector:
Councils should improve their fraud controls by:

  • tailoring fraud control plans to their circumstances and specific risks
  • systematically and regularly reviewing their fraud risks and fraud control systems to keep their plans up to-date
  • effectively communicating fraud risks, and how staff and the community can report suspected fraud 
  • ensuring that they comply with the Public Interest Disclosure Act 1994.

Recommendation:
That the Office of Local Government: 

  • work with councils to ensure they comply with the Public Interest Disclosure Act 1994.
     
Despite several New South Wales state entities collecting data on suspected fraud, the cost, extent, and nature of fraud in local councils is not clear. 
There are weaknesses in data collection and categorisation. Several state entities receive complaints about councils. These entities often do not separate complaints about fraud from other complaint data, do not separate local council data from other public-sector data, and do not separate complaints about council decisions or councillors from complaints about council staff conduct. Complaints about one incidence of suspected fraud can also be reported multiple times. 
Collaboration between state entities and councils to address these weaknesses in data collection could provide a clearer picture to the public and councils on the incidence of suspected fraud. Better information may also help councils decide where to focus fraud control efforts and apply resources more effectively.
Including measures for fraud control strength and maturity in the OLG performance framework may also improve practice in councils. Further, OLG may want to consider how a revised Model Code could better drive fraud control practice in councils.
Recommendations
That the Office of Local Government:
  •  work with state entities and councils to develop a common approach to how fraud complaints and incidences are defined and categorised so that they can:
    • better use data to provide a clearer picture of the level of fraud within councils
    • measure the effectiveness of, and drive improvement in councils' fraud controls systems