Reports
Integrity of data in the Births, Deaths and Marriages Register
This report outlines whether the Department of Customer Service (the department) has effective controls in place to ensure the integrity of data in the Births, Deaths and Marriages Register (the register), and to prevent unauthorised access and misuse.
The audit found that the department has processes in place to ensure that the information entered in the register is accurate and that any changes to it are validated. Although there are controls in place to prevent and detect unauthorised access to, and activity in the register, there were significant gaps in these controls. Addressing these gaps is necessary to ensure the integrity of information in the register.
The Auditor-General made nine recommendations to the department, aimed at strengthening controls to prevent and detect unauthorised access to, and activity in the register. These included increased monitoring of individuals who have access to the register and strengthening security controls around the databases that contain the information in the register.
The NSW Registry of Births Deaths and Marriages is responsible for maintaining registers of births, deaths and marriages in New South Wales as well as registering adoptions, changes of names, changes of sex and relationships. Maintaining the integrity of this information is important as it is used to confirm people’s identity and unauthorised access to it can lead to fraud or identity theft.
The NSW Registry of Births Deaths and Marriages (BD&M) is responsible for maintaining registers of births, deaths and marriages in New South Wales. BD&M is also responsible for registering adoptions, changes of name, changes of sex and relationships. These records are collectively referred to as 'the Register'. The Births, Deaths and Marriages Registration Act 1995 (the BD&M Act) makes the Registrar (the head of BD&M) responsible for maintaining the integrity of the Register and preventing fraud associated with the Register. Maintaining the integrity of the information held in the Register is important as it is used to confirm people's identity. Unauthorised access to, or misuse of the information in the Register can lead to fraud or identity theft. For these reasons it is important that there are sufficient controls in place to protect the information.
BD&M staff access, add to and amend the Register through the LifeLink application. While BD&M is part of the Department of Customer Service, the Department of Communities and Justice (DCJ) manages the databases that contain the Register and sit behind LifeLink and is responsible for the security of these databases.
This audit assessed whether BD&M has effective controls in place to ensure the integrity of data in the Births, Deaths and Marriages Register, and to prevent unauthorised access and misuse. It addressed the following:
- Are relevant process and IT controls in place and effective to ensure the integrity of data in the Register and the authenticity of records and documents?
- Are security controls in place and effective to prevent unauthorised access to, and modification of, data in the Register?
ConclusionBD&M has processes and controls in place to ensure that the information entered in the Register is accurate and that amendments to the Register are validated. BD&M also has controls in place to prevent and detect unauthorised access to, and activity in the Register. However, there are significant gaps in these controls. Addressing these gaps is necessary to ensure the integrity of the information in the Register. BD&M has detailed procedures for all registrations and amendments to the Register, which include processes for entering, assessing and checking the validity and adequacy of source documents. Where BD&M staff have directly input all the data and for amendments to the Register, a second person is required to check all information that has been input before an event can be registered or an amendment can be made. BD&M carries out regular internal audits of all registration processes to check whether procedures are being followed and to address non-compliance where required. BD&M authorises access to the Register and carries out regular access reviews to ensure that users are current and have the appropriate level of access. There are audit trails of all user activity, but BD&M does not routinely monitor these. At the time of the audit, BD&M also did not monitor activity by privileged users who could make unauthorised changes to the Register. Not monitoring this activity created a risk that unauthorised activity in the Register would not be detected. BD&M has no direct oversight of the database environment which houses the Register and relies on DCJ's management of a third-party vendor to provide the assurance it needs over database security. The vendor operates an Information Security Management System that complies with international standards, but neither BD&M nor DCJ has undertaken independent assurance of the effectiveness of the vendor's IT controls. |
Appendix one – Response from agency
Appendix two – About the audit
Appendix three – Performance auditing
Copyright notice
© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.
Parliamentary reference - Report number #330 - released 7 April 2020.
Government Advertising 2012-13
The following report assessed the activities of the two agencies in relation to their government advertising campaigns in 2012-13 and tested compliance by tracking a campaign through from development to dissemination.
Parliamentary reference - Report number #236 - released 23 September 2013
Cost of Alcohol Abuse to the NSW Government
The NSW Government does not estimate or report the total cost of alcohol abuse. The Audit Office of New South Wales’ sponsored research estimates it costs the government over $1 billion a year, or around $416 from each NSW household.
Parliamentary reference - Report number #235 - released 6 August 2013
Prequalification Scheme: Performance and Management Services
There have been tangible improvements in the time it takes NSW Government agencies to engage consultants through the Government’s Prequalification Scheme. The Scheme was introduced in February 2008 to improve agencies’ procurement of consultants. More than 300 service providers have been prequalified and over $300 million worth of consultancy services have been provided. Ideally agencies should know what assignments each consultant has won, for what services, what their rates are and how well they have performed. Agencies should then be free to contact other agencies before engaging a consultant.
Parliamentary reference - Report number #216 - released 28 September 2011
Two Ways Together - NSW Aboriginal Affairs Plan
To date the Two Ways Together Plan (the Plan) has not delivered the improvement in overall outcomes for Aboriginal people that was intended. Stronger partnerships between the government and Aboriginal people are only beginning to emerge. The disadvantage still experienced by some of the estimated 160,000 Aboriginal people in NSW is substantial. For example, the unemployment rate for Aboriginal people is at least three times higher than the rate for all NSW residents and hospital admissions for diabetes are also around three times higher.
Parliamentary reference - Report number #213 - released 18 May 2011
The Cross City Tunnel Project
In our opinion the Government’s ‘no net cost to government’ requirement was a legitimate (but not the only possible) basis for the tunnel bid process. The Government was entitled to decide that tunnel users meet the tunnel costs. Structuring the bid process on the basis of an upfront reimbursement of costs incurred (or to be incurred) by the Roads and Traffic Authority (RTA) was therefore appropriate.
In our opinion, however, the Government, Treasury and the RTA did not sufficiently consider the implications of an upfront payment involving more than simple project cost reimbursement (i.e. the ‘Business Consideration Fee’ component). In addition, the RTA was wrong to change the toll escalation factor late in 2002 to compensate the tunnel operator, Cross City Motorway Pty Ltd, for additional costs.
Parliamentary reference - Report number #152 - released 31 May 2006
Agencies working together to improve services
In the cases we examined, we found that agencies working together can improve services or results. However, the changes were not always as great as anticipated or had not reached maximum potential. Establishing the right governance framework and accountability requirements between partners at the start of the project is critical to success. And joint responsibility requires new funding and reporting arrangements to be developed.
Parliamentary reference - Report number #149 - released 22 March 2006
