About this report

Internal controls are key to the accuracy and reliability of agencies’ financial reporting processes. This report analyses the internal controls and governance of 26 of the NSW public sector’s largest agencies for the 2023–24 financial year.

Findings

There are gaps in key business processes, which expose agencies to risks. These gaps are identified in 121 findings across the 26 agencies—including 4 high risk, 73 moderate risk and 44 low risk findings. All four high-risk issues related to IT controls and 19% of control deficiencies were repeat issues. Thirty-five per cent of agencies had deficiencies in control over privileged access.

Shared IT services

Six agencies provide IT shared services to 120 other customer agencies. All six had control deficiencies—three of these were high risk. Four agencies provide no independent assurance to their customers about the effectiveness of their own IT controls.

Cyber security

Eighteen agencies assessed cyber risk as being above their risk appetite. Fourteen of these agencies had not set a timeframe to resolve these risks and two agencies have not funded plans to improve cyber security.

Fraud and corruption control

Agencies need to improve fraud and corruption control. Instances of non-compliance with TC18-02 NSW Fraud and Corruption Policy were identified, including gaps such as a lack of comprehensive employment screening policies and not reporting matters to the audit and risk committee.

Gifts and benefits

Management of gifts and benefits requires better governance and transparency. All agencies had policy and guidance but all had gaps in management and implementation—such as not publishing registers nor providing ongoing training.

Information Technology

Nine agencies did not effectively restrict or monitor user access to privileged accounts.

Recommendations

The report makes recommendations to agencies to implement proper controls and improve processes in relation to:

• organisational processes
• information technology
• cyber security
• fraud and corruption, and
• gifts and benefits.

Read the PDF report

About this report

Over 1,100 native animals, plants and ecological communities are listed as threatened in New South Wales. The Department of Climate Change, Energy, the Environment and Water (DCCEEW) delivers programs and activities aiming to reduce the risk of extinction for threatened species and ecological communities. 

This audit assessed whether DCCEEW has effectively delivered outcomes to support threatened species and ecological communities across New South Wales including delivery of the statutory Biodiversity Conservation Program (Saving our Species). 

Findings

DCCEEW uses a risk‑based approach to guide and deliver a range of programs aiming to improve the outcomes for threatened species and ecological communities.

However, DCCEEW has not effectively determined departmental priorities, coordinated programs to align efforts, or reported on the overall outcomes it is delivering for threatened species and ecological communities. 

Further, DCCEEW does not capture sufficient data to monitor species that it is not actively managing, creating a risk that it cannot readily identify or respond to further decline.

Under the Saving our Species program, DCCEEW is delivering conservation actions for less than one‑third of all threatened species and ecological communities. This number has reduced over time, in line with reduced program funding. 

Gaps in core program planning and risk management frameworks create program delivery risks. 

Recommendations

The report made several recommendations to DCCEEW, focusing on:

• Strengthening Saving our Species program compliance, governance, planning and risk management frameworks.
• Developing a long‑term framework to coordinate and align efforts across DCCEEW for the delivery of threatened species outcomes.
• Expanding activities to improve coordination with other parts of government delivering activities that impact on outcomes for threatened species.

This chapter assesses the effectiveness of DCCEEW’s ability to report on threatened species outcomes across its various programs and activities, and its strategic planning for the delivery of these outcomes at a departmental level.

Under Part 4, Division 6 of the BC Act, DCCEEW is required to deliver a Biodiversity Conservation Program. The program’s statutory objectives are to:

• maximise the long-term security of threatened species and ecological communities in nature
• minimise the impacts of key threatening processes on biodiversity and ecological integrity.

Under Section 4.36 of the BC Act, the program must have:

• strategies to achieve the objectives of the program in relation to each threatened species and threatened ecological community
• a framework to guide the setting of priorities for implementing the strategies
• a process for monitoring and reporting on the overall outcomes and effectiveness of the program.

Appendix one – Response from agency

Appendix two – Legislative and regulatory provisions relevant to threatened species

Appendix three – Programs and activities relevant to threatened species

Appendix four – Comparison of statutory provisions for the conservation of threatened species

Appendix five – About the audit

Appendix six – Performance auditing

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

 Parliamentary reference - Report number #399 released 15 August 2024.

About this report

The Regional Digital Connectivity program (RDCP) is intended to improve mobile coverage and internet connectivity in regional NSW.

The RDCP includes two funding programs, one for improving mobile coverage and the other for improving internet connectivity. Both programs provide grant funding to commercial telecommunications providers for eligible mobile and internet projects.

This audit assessed whether the Department of Regional NSW (the department) is effectively administering the RDCP to meet program objectives.

Findings

The department's approach to identifying priority areas for RDCP funding was comprehensive and it largely distributed funding in line with these priorities.

The department has not specifically defined the overall objectives of the RDCP. The department has developed business cases that set out each program’s respective objectives, but these do not consistently describe the objectives of the RDCP.

The department also has not developed an overarching investment strategy, which would assist it in addressing potentially conflicting priorities.

Deficiencies in project and risk management have contributed to delays in the department’s implementation of the program.

The department is not monitoring progress against outcomes, which limits its ability to demonstrate that the program is achieving its intended purpose.

The department did not meet its original mobile coverage performance target but met its internet connectivity target.

Recommendations

To improve RDCP administration, the report recommends that by June 2025, the department should:

1. develop an overarching investment strategy for the RDCP
2. outline the expected timelines for RDCP projects and ensure that these timelines are updated regularly
3. develop and report on RDCP outcome indicators
4. update the RDCP evaluation plan
5. update the expected benefits of the program to reflect changes in the RDCP.

The Regional Digital Connectivity program (RDCP) is funded through the Snowy Hydro Legacy Fund (SHLF). Under the Snowy Hydro Legacy Fund Act 2018 (SHLF Act), the purpose of the SHLF is to improve economic development in regional New South Wales and to fund infrastructure projects that primarily benefit regional New South Wales. A priority area for SHLF investment is delivering improved mobile coverage and internet connectivity in underserved and remote communities.

The RDCP has been implemented by the Department of Regional NSW (the department) since 2019. The RDCP is broadly split into two funding programs. The larger funding program is for improving mobile coverage and the other funding program is for improving internet connectivity and is referred to as the Gig State program. Both programs provide grant funding to commercial telecommunications providers for eligible mobile and internet projects.

Over $300 million from the RDCP was allocated to improve mobile phone coverage and increase the number of mobile service providers across regional NSW. The mobile coverage program is being delivered through the following sub-programs:

• Snowy Mountains Highway Safety project – co-funding with Snowy Hydro Limited to build five mobile towers along the Snowy Mountains Highway to improve mobile coverage.
• Active Sharing Partnership (ASP) pilot – co-funding with private providers to deliver active sharing mobile technology in regional areas.
• ASP main program – This is the main round of the mobile coverage program. A business case has been developed, but no funding has been distributed through this sub-program.
• Mobile Black Spot Program Round 5A – co-funding with the Australian Government’s Mobile Black Spot Program to deliver new or upgraded mobile towers in regional and remote locations.
• Mobile Black Spot Program Round 7 (MBSP7) – co-funding with the Australian Government’s Mobile Black Spot Program to deliver new mobile infrastructure.

Over $100 million from the RDCP was allocated to the Gig State program to improve regional internet connectivity through partnering with multiple providers and using a range of technologies suitable for rural and regional locations. The Gig State program was launched in 2019 and underwent significant changes in 2021 following an Infrastructure NSW deep dive review into the project. These changes to the program are referred to as the Gig State addendum. The Gig State program is being delivered through the following sub-programs:

• Cobar corridor connectivity – providing fixed wireless internet access to five locations between Narromine and Cobar.
• nbn regional NSW fixed wireless – co-funding with nbn to deliver new or co-located fixed wireless broadband towers in 56 locations.
• Wamboin, Bywong and Sutton connectivity – improving internet connectivity in these three towns as part of a NSW Government commitment.
• Regional Connectivity Program Round 3 (RCP3) – co-funding with the Australian Government’s Regional Connectivity Program to provide additional internet infrastructure.

The objective of this audit was to assess whether the Department of Regional NSW is effectively administering the Regional Digital Connectivity program to meet program objectives. The audit examined:

• how effectively the department identifies priority areas to target RDCP funding
• how effectively the department distributes RDCP funding in line with program objectives
• how effectively the department measures the performance of the RDCP.

The department has not specifically defined the overall objectives of the RDCP

The RDCP is delivered as part of the SHLF. Under the SHLF Act, the purpose of the SHLF is to improve economic development in regional New South Wales and, for that purpose, to fund infrastructure projects that primarily benefit regional New South Wales. One of the priority areas for SHLF investment is digital connectivity, which is being delivered through the RDCP.

While the purpose of the SHLF is set out in the SHLF Act, the department has not specifically set out the overall purpose and objectives of the RDCP and how it will focus the RDCP on achieving the SHLF’s purpose. Such a document would support future business case development, and support the coordination and prioritisation of objectives across the business cases that have already been developed.

While the overall objectives of the RDCP are yet to be defined, there are objectives set out in the business cases for the separate programs but these are not consistently described. The Gig State business case advises that the RDCP’s goal is to enable transformative long-term benefits for regional areas through investment in digital connectivity. This goal aligns with the purpose of the SHLF Act. However, this objective is not set out in the mobile coverage business case, or any other document, and it is not clear how the RDCP is intended to fulfil this objective.

The Gig State business case sets out three objectives for the RDCP that provide further definition to the SHLF Act’s purpose, though it is unclear how these were determined and whether these are intended to cover the entire RDCP:

• address the digital divide between regional and metro NSW
• resolve market failures in the regional NSW telecommunications market
• leverage Government assets and capabilities wherever possible.

The mobile coverage ASP pilot business case sets out a similar set of objectives, though there are some differences, such as the third objective being to ‘leverage Government assets and capabilities to achieve transformative results.’ It is important for the department to clarify the RDCP’s objectives to ensure a unified approach to investment decisions. At the time of the audit, the department’s website had a different set of objectives for the RDCP. They are:

• build digital infrastructure to increase capacity
• expand mobile coverage and provider choice
• improve internet service, speed and quality
• bridge the digital divide between regions and cities.

The department also provided a 2022–23 ‘division plan’, with goals for the mobile coverage and Gig State programs. These include:

•  extend and improve internet coverage to deserving locations in regional NSW
• investigate emerging digital technologies to improve connectivity
• deliver new and improved mobile coverage to regional NSW communities
• encourage competition in the regional telecommunications market.

While these different sets of objectives broadly align, there is no consistency across these business cases in describing the objectives of the RDCP. This indicates that there is a lack of clarity about the intended objectives of the RDCP. Further, the origin of the list of objectives in the ‘division plan’ is unclear. This reinforces the need to clearly define objectives for the overall RDCP.

Each business case the department has developed for RDCP programs has defined objectives that align with the SHLF’s purpose

The Gig state and mobile coverage business cases also define objectives for each program. These objectives align with the SHLF’s purpose, set out above. The Gig State business case advises that the purpose of the Gig State program is to:

• address the digital divide between metro and regional NSW so that the price, quality, and choice of digital connectivity options in metro areas are made available in regional areas of NSW
• resolve market failures in regional NSW telecommunications
• leverage Government assets or investment where appropriate to achieve transformative long-term benefits for regional areas.

The ASP pilot business case states similar objectives, though it does not mention the ‘price, quality, and choice’ stated in the Gig State business case. The ASP pilot business case also lists another three objectives:

• address mobile black spots where people live and work
• investigate new and emerging technologies to future proof mobile coverage in regional NSW
• promote consumer choice in the delivery of mobile services.

The ASP main program has a different set of objectives to the ASP pilot and include:

• reduce the digital divide and enhance social inclusion by improving mobile coverage in regional locations not covered by existing programs
• encourage competition in the regional telecommunications market to provide consumers greater choice, lower prices and improved services
• address commercial viability and technical constraints to providing mobile coverage in regional areas
• improve community resilience to emergency events through improved regional mobile service.

The RDCP program objectives align with relevant whole-of-government strategic objectives

There are several whole-of-government strategies that seek to guide government investment in digital infrastructure. While there is no document setting out the overarching objectives of the RDCP, the objectives set out for the mobile coverage program and the Gig State program align with these whole-of-government objectives.

The objectives align with the 2018 and 2021 ‘20 Year Economic Vision for Regional NSW’. For example, the 2018 ‘20 Year Economic Vision for Regional NSW’ sets out principles for regional NSW investment, including ‘Affordable, reliable and fast internet to support people and businesses.’

The RDCP sub-programs also align with the 2018 and 2022 State Infrastructure Strategies. In particular, the 2018 strategy has a set of recommendations around improving connectivity across NSW and another set of recommendations around investing in technology that improves productivity and social outcomes. One of the roles of the Gig State program is to help to implement the 2018 strategy’s recommendation to support statewide access to 50Mbps download and 10Mbps upload capacity by 2025. These speeds are specifically stated in the Gig State grant guidelines as an eligibility requirement for funded programs.

Both sub-programs of the RDCP also align with the NSW Connectivity Strategy. The NSW Connectivity Strategy has two directions of particular relevance: ‘All customers have metropolitan equivalent digital capacity’ and ‘Connectivity blackspots continually decrease across the State’. The first of these objectives has three strategic directions which are directly relevant to both the Gig State program and the mobile coverage program:

• remote, rural and peri-urban citizens can access and effectively use digital systems and services for employment, justice, education, health, social, personal and entertainment use
• Aboriginal and Torres Strait Islander communities have equitable access to connectivity that meets their local community needs
• connectivity services are affordable for citizens no matter where they live, with access to a choice of providers.

Elements of both the Gig State and mobile coverage programs align with these, including the focus on expanding access and affordability.

In regard to regional Aboriginal communities, the RDCP may also contribute to the NSW Closing the Gap Implementation Plan, as the merit criteria in the grant guidelines for mobile coverage and Gig State grants include the extent to which the project will contribute to sustainable procurement and employment outcomes, including supporting Aboriginal businesses and employment. The criteria for prioritising locations for mobile coverage also includes extending coverage to discrete Aboriginal communities as something which could improve the score given to an application. However, this is not set out as an explicit objective of the program.

The department has not set out an overarching investment strategy for the RDCP to address potentially conflicting priorities or identify situations where funding may not align with program objectives

As noted above, the overall objectives of the RDCP have not been defined. The department does not have an overarching strategy setting out program objectives, how funding will be aligned with these objectives, and how the objectives will be prioritised. It is important to set out funding principles to establish how the elements of the stated objectives will be delivered and prioritised. Not setting these out risks funding decisions that do not align with program objectives.

As noted above, the mobile coverage ASP pilot business case lists two objectives around addressing mobile black spots and promoting consumer choice in the delivery of mobile services. These objectives may be potentially in conflict as expanding coverage can be done by funding one carrier to expand their own network, while promoting consumer choice could conceivably be done by funding a carrier to expand their network into areas already covered by only one existing carrier, thus increasing competition in those areas.

The department has not set out the relative weighting of its objectives across the RDCP funding packages and how it will prioritise funding in accordance with them. An overarching strategy would assist the department with prioritising funding in accordance with the objectives of the program, including determining the relative weight of each objective.

In addition, the department has not described the extent to which price reductions in the cost of internet will be prioritised as an objective of the Gig State program. The Gig State business case sets out that one of the objectives of the program will be to provide metropolitan equivalent or better service, quality and pricing for internet services in regional areas. It is unclear how internet pricing fits into the overarching objectives of the RDCP given that it is not mentioned as an objective of the SHLF. There would be value in setting out strategic investment principles and objectives to guide this decision-making and clarify the extent to which internet investment is intended to fulfil this purpose.

A lack of clarity about program objectives may also have impacted decisions about funding priorities. For example, the Gig State program business case sets out a plan to invest in Low Earth Orbit (LEO) satellites through a subsidy program. As noted above, the Gig State business case sets out some objectives for the RDCP, including leveraging government assets. While an investment in LEO satellites through subsidies may assist with bridging the digital divide, it is not clear how this aligns with the objective of leveraging government assets. More clarity over program objectives and a clear investment strategy may assist with clarifying this and similar investment decisions in future. As discussed below, the investment in LEO satellites did not proceed.

The department comprehensively identified priority areas that require improved mobile coverage for the mobile coverage program

As outlined above, the final business case for the mobile coverage ASP pilot program identifies three objectives for the mobile coverage program, including addressing the digital divide between metropolitan and regional NSW, and resolving market failures in regional NSW telecommunications. The department identified priority areas for improved mobile coverage in line with these objectives. The department refined its approach to prioritising locations for the mobile coverage ASP main program which resulted in a more comprehensive analysis of potential sites.

The department developed and implemented a structured process using a range of criteria to identify and prioritise suitable locations for funding. Before allocating funding to its mobile coverage program, it was necessary for the department to determine areas that required additional mobile coverage. The department undertook this work for both its mobile coverage ASP pilot program and the ASP main program as part of designing the grant programs. A key source of information it relied on for identifying priority areas for the pilot program was the Australian Government’s National Mobile Black Spot Database. The database identified around 4,000 mobile black spot locations across NSW. This database is no longer in use as it relied on community reports of mobile black spots which were unverified.

For its mobile coverage ASP pilot program, the department applied a series of filters to the mobile black spots identified in the database. It removed metropolitan areas, areas within a 10km radius of an existing mobile tower site, and areas that had already been selected for funding under either Commonwealth or State funded programs, such as the Connecting Country Communities Fund. This left the department with a list of around 1,200 potential sites.

The department then mapped the 1,200 identified black spot sites to their respective 383 unique locations and assessed and prioritised the mobile black spots and locations against a range of economic, community and feasibility criteria. Under the economic criteria, the department prioritised areas that had higher numbers of employed persons and higher proportions of land being used for agriculture or farming. Under the community criteria, the department prioritised areas based on the increase in the population that would benefit from expanded coverage, the increase in Aboriginal and Torres Strait Islander people that would benefit from the coverage, the increase in the kilometres of highway and main roads that would benefit that were within five kilometres of a mobile black spot, and areas with more square kilometres prone to bushfires or flooding that would benefit. Under feasibility criteria, the department prioritised areas that were closer to government and nbn infrastructure. This process resulted in 50 prioritised locations containing 307 black spot sites across 34 Local Government Areas in NSW.

For its mobile coverage ASP main program, the department undertook a detailed coverage analysis to identify locations with no and limited mobile coverage. It identified these using the latest publicly available coverage maps from the three mobile network operators and the distance of locations from existing sites/towers as published by the Australian Communications and Media Authority and the Radio Frequency National Site Archive databases. Using this data as the key source of information in determining mobile coverage resulted in a more comprehensive outcome than relying on the National Mobile Black Spot Database. The department did not use the National Mobile Black Spot Database, as this information was considered unreliable and had not been updated since 2018, and the coverage maps were more reliable.

The analysis focused on locations with small populations, road corridors, and tourism locations. It identified 257 locations with no or poor coverage consisting of 68 small population locations, 117 road corridors and 72 tourism locations. The department then analysed these possible locations against a range of criteria. These included maximising the number of people and businesses that would be supported, increasing the extent of existing coverage, determining whether coverage would support government strategies or Premier’s Priorities, other positive social impacts, focusing on the greatest length of road and most heavily used roads, and maximising the number of tourism businesses and points of interest impacted.

The department conducted analysis based on these criteria and shortlisted 24 small population locations, 24 road corridor locations and 12 visitor economy locations. These locations were taken forward for concept design, cost estimation, and economic and financial appraisal as part of the final business case.

The department’s initial approach to prioritising Gig State funding was based around larger regional centres

The department undertook a two-stage process for identifying priority areas for Gig State program investment. The first involved the identification of larger NSW towns that would benefit from additional internet coverage and where data centres could be located, and the second involved a selection of more remote locations to receive additional funding.

The department did not undertake an initial detailed analysis of internet coverage across NSW to prioritise funding for the Gig State program. Undertaking this work would have been in line with the Gig State program objectives of addressing the digital divide between metropolitan and regional NSW and resolving market failures in regional NSW telecommunications. In order to meet these objectives, it was important to first establish the extent of the digital divide and market failure before seeking to resolve it.

Instead, it categorised NSW towns according to their relative size and importance from a connectivity perspective. It prioritised towns with larger populations and more business users to maximise the potential benefit of the infrastructure. The department also prioritised locations that were closer to other telecommunications infrastructure, and it also considered proximity to other potential elements of the Gig State network for greater connectivity and to ensure that it was taking a whole-of-State approach to investment decisions. This process identified 14 major regional towns.

The department then prioritised two of these regional towns, Dubbo and Wagga Wagga, due to the higher prices paid by NSW Government agencies in the two locations for average internet bandwidth usage when compared to other regional and metropolitan population centres across NSW. The costs to government were considered a proxy for how much business users are likely to be charged for connectivity services in regional NSW towns. The department conducted surveys in both towns indicating that business users were paying higher prices than their metropolitan counterparts for higher-grade connectivity. This aligned with the department’s Gig State program objectives which related to providing price, quality and choice.

The department also included five satellite towns along the road from Dubbo to Cobar (Cobar corridor) in the Gig State final business case as well as the towns of Wamboin, Bywong and Sutton. The department’s prioritisation of funding for these locations was not based on any detailed analysis of need. The department identified that as part of its initial plan to expand the internet connectivity from Dubbo to Cobar, it would be able to connect a number of towns between those two at a reduced cost. There was no analysis of alternative options for expending this money, such as expanding coverage to other areas, or to determine the extent of coverage required in each town. The Wamboin, Bywong and Sutton project was prioritised as a result of a $5 million NSW Government commitment. This project is discussed further below.

The department strengthened its approach to targeting Gig State funding in 2021

The department reviewed and updated its approach to the Gig State program in September 2021. As part of this, it revised its approach to targeting funding, including the use of additional data and identifying areas with greater digital connectivity issues. This represented an improved approach compared to the original business case and aligned more closely with the changes that were made to the Gig State program in 2021, outlined in the Gig State addendum, which focussed more on the delivery of fixed wireless services rather than data centres.

The department carried out an analysis of areas that only have satellite internet coverage (i.e., no fibre or fixed wireless internet availability) to identify areas suitable for different types of technology such as fibre optic cables, fixed wireless and LEO satellites. This was more in line with the Gig State program objectives of addressing the digital divide and resolving market failures. It identified that these locations had challenging digital connectivity issues that were not likely to be resolved without government intervention. This process identified around 1,000 locations. This list was then refined by looking to maximise the number of premises and businesses, maximising the density of premises, prioritising locations with other Government assets, mobile sites and other technology available in the area, and locations close to an existing exchange to leverage existing infrastructure.

The location list was then prioritised based on scoring criteria for economic drivers, feasibility, risk and stakeholders. The economic criteria included the number of residential and business premises, the number of businesses, and the estimated construction costs for the infrastructure. The feasibility criteria included availability of existing and planned infrastructure. Stakeholder related criteria included identifying synergies with other government led programs, as well as sites that scored low on Australian Digital Inclusion Index (ADII) scores and the Socio-Economic Indexes for Areas. These criteria are appropriate and align with the objectives of the Gig State program.

The department’s process resulted in a list of 23 prioritised areas. These were generally areas with a higher density of premises and affordable access to infrastructure for power supply and data transmission.

The department considered socio-economic data when planning for Gig State and mobile coverage programs but did not use this to inform its pilot mobile coverage program

NSW Government Business Case Guidelines (TPP18-06) state that one of the main reasons for government action is promotion of equity where the distribution of economic costs and benefits is considered inequitable. It is therefore important for the department to consider socio-economic data in the planning of the RDCP.

The department has included some socio-economic data and ADII scores in the profiles it developed for each Local Government Area. It applied socio-economic data to identify additional priority areas for new and improved internet coverage through the Gig State program. However, it did not apply this data to identify priority areas across the pilot mobile coverage program of the RDCP. It improved its approach when developing the ASP main program by including socio-economic data as a component of its scoring for prioritising locations.

The department considered socio-economic data when selecting locations for grant funding. The mobile coverage grant guidelines and the Gig State grant guidelines both include merit criteria that consider whether the proposed solution would address disadvantage within a community. Both guidelines ask the grant applicants to consider the Index of Relative Socio-economic Advantage and Disadvantage.

The department engaged with key stakeholders when developing the RDCP

Under TPP18-06, NSW Government departments are required to identify and consult with key stakeholders as they can contribute to the development of the investment proposal by providing their expert opinions, research, and evidence.

The department identified key stakeholders, developed stakeholder engagement plans, and used feedback gained through consultations to design and adjust the RDCP. Key stakeholders have been involved on the RDC Steering Committee and the RDC Project Control Group ensuring that they have an avenue to provide input into the overall RDCP. This includes the Commonwealth department responsible for telecommunications infrastructure and telecommunication providers.

The department engaged with stakeholders when developing the ASP pilot program. As discussed below, the department transitioned the program from a one-stage pilot program, where telecommunication providers would be procured to provide the solution, to a two-stage program where the department would first work with telecommunication providers to identify technical solutions and then carry out the procurement. This involved significant engagement with stakeholders to identify the technical solution and procurement model.

The department has assessed the suppliers of internet and mobile connectivity to determine their capacity and willingness to participate in RDCP sub-programs

As part of procurement planning, when building a business case, NSW Government agencies are required to analyse and engage with the market. This involves developing a profile of the market, the capabilities of suppliers, innovative and emerging technology, and factors that influence the market such as customer preferences and competition.

The department considered the capacity of telecommunications suppliers, their level of interest, and willingness to participate in the program when developing the business cases for its mobile and internet coverage programs. In addition to doing this when constructing initial business cases, the department adjusted its approach when market factors changed, as evidenced by the changes it made to its Gig State program in 2021. In September 2020, the nbn announced an expansion of its fibre network nationally, with a focus on regional improvements. This meant that internet coverage for some of the locations included in the Gig State business case would be addressed by nbn and continued investment was not needed in those areas. The initial Gig State business case also planned an initial investment in data centres in regional NSW. Following this, a private market operator also announced plans to construct 14 regional data centres across NSW. This meant that the planned Gig State data centres were no longer required. The department changed it approach to avoid duplication by ceasing its planned internet coverage expansion into regional centres, including the data centres, and prioritising a range of new sites for coverage.

Conflicts of interest and probity procedures have largely been followed, although there were some gaps in declarations

Maintaining a record of conflict of interest declarations is important to provide a higher level of transparency, and therefore control, over officials in high-risk roles. Disclosing an interest before it becomes a conflict of interest also reduces the likelihood that an official will be tempted to conceal or favour the interest.

Conflict of Interest declaration forms have been completed for staff involved in the mobile coverage program, Gig State program and the Australian Government co-funded Regional Connectivity Program Round 3 (RCP3) and Mobile Black Spot Program Round 7 (MBSP7). Whilst the list of declarations is extensive, it is unclear whether it includes all relevant staff from the department, the NSW Telco Authority and consultants involved with the program.

In relation to the mobile coverage and Gig State programs, there was no declaration recorded for one consultant and three staff from the department, including the program sponsor. These omissions have the potential to create risks that conflicts of interest go unmanaged. The department advises that the register is now complete for all those working directly on the program. It also advises that, due to the breadth of programs senior staff oversee, conflicts of interest are managed by the department's Governance team centrally through a Declarations App.

Four declarations of a ‘real, potential or perceived conflict of interest’ were made under the RCP3 and MBSP7 grant programs, which were co-funded with the Australian Government. No declared conflicts were made for the other programs. The identified conflicts of interest have documented actions to manage them, and there is evidence to indicate that these were implemented. For example, a senior staff member and a consultant excluded themselves from parts of a grant process due to declared conflicts.

The NSW Grants Administration Guide states that officials must seek probity advice for all grant opportunities that are complex, high-risk or high-value, to support the design, application, assessment and decision-making phases. The department followed appropriate probity processes throughout and these probity reports did not find any material breaches of probity in the grant processes.

There have been delays in all streams of the RDCP which may have been reduced through proactive project and risk management

The business cases set out expected timelines for each program of the RDCP. The department has not met any of these expected timelines, with some projects delayed by over a year compared to their initial planned timelines. Some of these delays have been caused by changes to the department’s approach to the mobile coverage and Gig State business cases. While some of these changes were outside of the department’s control, others could have been anticipated and better managed by a stronger approach to project management and risk management.

Exhibits 1 and 2 set out the status of each Gig State and mobile coverage project reviewed as part of this audit as at April 2024 and the planned completion date for that project at the outset of the program. Note that this does not include projects co-funded by the Australian Government due to the department’s limited ability to influence the process. This also excludes projects which have not yet distributed funding, such as the mobile coverage ASP main program.

Source: Audit Office analysis.

Source: Audit Office analysis.

As can be seen from Exhibits 1 and 2, each project in the RDCP has been delayed past its initially planned completion date, and the Wamboin, Bywong and Sutton project has been delayed past both its original planned completion date and also the revised completion date in the Gig State addendum.

Some of these delays can be accounted for by the fact that the department revised its approach to both the mobile coverage ASP pilot and the Gig State programs. While some of these changes were outside of the department’s control, others could have been anticipated and managed by more proactive risk management. In the case of the mobile coverage program, some of this change in approach may have been foreseeable. The March 2021 mobile coverage ASP pilot business case set out a one-stage tendering process with construction planned for completion in June 2022. The department revised this approach in July 2021, when it changed to a two-stage process involving a technical stage and then a grant process. This was the result of additional research by the department that identified that the market may not have sufficient interest in the initial proposed approach. Undertaking this additional research earlier may have allowed for this alternative approach to be identified sooner.

In addition, the department only allowed two months in the business case for contract negotiations with providers for the mobile coverage ASP pilot program, however this has taken a significantly longer time and in one case has been ongoing for over twelve months. Given the complexities of the funding deed negotiations, this may also have been foreseeable. The department advised that some delays in the mobile coverage program can be attributed to the proposed merger of major mobile network operators which delayed funding deed negotiations.

As with the mobile coverage program, the Gig State program was also delayed by a change in approach, though this was driven by market changes. As part of the original Gig State business case, the department intended to deliver data centres in regional NSW, as well as expanding internet coverage. The business case was approved in December 2019 and the department intended to complete the Gig State program in June 2022. Little progress had been made by the time that the Gig State program underwent a significant change in scope following a review in September 2021. The department removed some aspects of the original business case, such as the construction of data centres in regional NSW, and changed the approach to other parts of the business case. The revised business case, called the Gig State addendum, delayed the planned delivery date of some projects into 2022.

The most significantly delayed sub-program has been the expansion of internet access to the towns of Wamboin, Bywong and Sutton as part of the Gig State program. In January 2019, the NSW Government announced $5 million of funding to provide internet access to these towns. The department ran a tender for this work in mid-2021 with a plan to start construction in late 2021. However, this tender resulted in no contract being awarded due to no providers being willing to provide the project within the proposed $5 million budget. The department started working on technical solutions with providers in late 2021 and gave them until May 2022 to identify solutions and potential budgets. The contract for Wamboin, Bywong and Sutton was executed in June 2022, with an expected completion date of June 2024, though given delays with construction this date will not be met. As discussed below, if the department had provided better advice to Government on the expected costs at the planning stage, it may have reduced the delays in this sub-program.

The department has not effectively managed RDCP timelines

The department has provided limited evidence of effective project management in place to monitor overall progress against program timelines, such as regularly updating a detailed project plan. The department may have identified and managed the above delays sooner through a stronger project management approach.

The department set out timelines at the outset of each of the sub-programs. This was not always done in detail but for all the sub-programs at least key milestones were mapped. While this was done at the outset, there is no evidence that the department regularly updated timelines across the various sub-programs to ensure that these projects were on track and to monitor expected completion dates.

The department provided regular updates on project status to relevant governance committees. This included providing information on upcoming milestones and associated delays. However, holistic monitoring of program completion dates and the impact of delays on subsequent milestones was not presented to the governance committees. As a result, there has been little monitoring and oversight of how projects are tracking against their target end dates.

Gaps in the governance framework have limited the oversight of the implementation of the RDCP

There are three key committees that oversee the implementation of the RDCP: the SHLF Steering Committee, the RDC Steering Committee, and the RDC Program Control Group. These three committees are intended to provide oversight of the implementation of the RDCP, however there are deficiencies that limit the effectiveness of their oversight.

The SHLF Steering Committee is intended to provide oversight of all programs funded through the SHLF, including the RDCP. Despite an intended meeting schedule of quarterly, the committee only met once in 2023 and three times in each of 2021 and 2022. While the Committee did receive reports on each of the programs funded through the SHLF at these meetings, this reporting did not identify any key risks for these projects that might affect achieving the objectives of the SHLF. This reduces the level of oversight that the SHLF Steering Committee can provide for these projects.

The RDC Steering Committee provides oversight of the RDCP and is intended to act as an escalation point for key issues in the program. While the committee receives regular reports on the components of the RDCP, including on program risks, there are some gaps that limit the oversight it can provide. The committee operated throughout 2021, 2022 and 2023 without finalised terms of reference, which were finalised in February 2024. Prior to this, it was unclear how often the RDC Steering Committee was intended to meet, but it met only four times in 2023 compared to six in 2022.

The RDC Steering Committee terms of reference include a role for the committee in making key decisions around program strategy and implementation. Prior to 2023, the committee was involved in many key decisions. For example, in 2022 it endorsed decisions around the ASP pilot grant guidelines. By contrast, a review of meeting minutes since the start of 2023 shows that the RDC Steering Committee has not made decisions or provided endorsements for any key decisions. The committee was not involved in endorsing the MBSP7 and RCP3 grant guidelines in 2023 and was not involved in strategic decision-making about the budget reprofiling in 2023 and the decision to remove the LEO satellite pilot from the Gig State program scope.

The RDC Program Control Group did not have terms of reference until February 2024. The purpose of the RDC Program Control Group is to oversee and support the strategic direction and implementation of the RDCP. This should be carried out through regular meetings and reporting, however the control group only met six times in 2023 despite an intention that they would meet monthly. The expected meeting frequency has since changed to every six weeks.

The RDC governance committees routinely discuss risks, but the department did not identify or mitigate all key risks at the outset of the program

The department has a structured approach to risk management for the RDCP, though this risk management approach has not always succeeded at mitigating key risks. The RDCP program team identified a number of key risks at the outset of each program and designed mitigations for them. In addition, the RDC Steering Committee and RDC Project Control Group both receive risk reports and discuss risks at meetings where appropriate. This reporting indicates a proactive approach to risk management throughout the program.

However, not all key risks were successfully mitigated or identified at the outset of the program. For example, one of the key causes of delays with the mobile coverage program has been protracted contract negotiations. Despite the fact that the program team understood the complexities of the mobile contract negotiations that would be required, this was not identified as a risk at the outset of the program. Later in the program this was identified by the RDC Program Control Group and Steering Committee as a key risk. While the risk was identified, it was not sufficiently mitigated, as demonstrated by the delays that resulted from the contract negotiations.

Other risks were not identified at the outset of the program. For example, the Snowy Mountains Highway Safety program was delayed due to the need to get development approval from the National Parks and Wildlife Service. There is no separate risk register for the Snowy Mountains Highway Safety program, and the potential for delays due to approval processes is not mentioned in any of the overall mobile business cases. Stronger initial project management may have allowed for this to be identified.

The Wamboin, Bywong and Sutton internet coverage program has been delayed numerous times throughout the course of its delivery. One of the key delays in 2023 was that, after the contract was signed and building works had commenced, it was discovered that challenging ground conditions with a higher than anticipated rock concentration around the towns was delaying construction. Potential delays from construction issues were not foreseen in the Gig State program risk register. While the specific issues relating to ground conditions may not have been easily foreseeable at the outset of the program, the department’s evaluation of potential providers in 2021 noted that rock was present and could have an impact on the cost of the program. It is reasonable to expect that this would have led to additional risk mitigation at the time, detailing the potential impact of the rock concentration on both cost and timelines. When the issue was eventually discussed in the RDC Project Control Group in 2023, the only mitigation for the risk was to review and monitor the existing and future schedule. This was not sufficient to mitigate the risk.

The department conducted cost-benefit analyses for all RDCP sub-programs, but did not implement the element with the highest return on investment

The ‘NSW Government Guide to Cost-Benefit Analysis’ requires that a cost-benefit analysis (CBA) be undertaken for capital, recurrent or ICT projects valued at more than $10 million. Undertaking a CBA provides a benefit-cost ratio (BCR) which helps to determine if a program will provide a net benefit to the people of New South Wales. A BCR greater than one indicates that the benefits will exceed the costs. For programs funded through the SHLF, such as the RDCP, there is no requirement for a program to achieve a BCR of greater than one.

The department conducted a CBA for the Gig State and mobile coverage programs, as well as all the sub-programs under both programs, including revising the CBA for the Gig State program after it was reviewed in late 2021. The BCR for the mobile coverage and Gig State programs are shown in Exhibit 3. Only the Gig State initial business case achieved a BCR of one, meaning that it delivers benefits equivalent to its costs. However, when this program was amended in 2021, this BCR reduced to 0.62. When combined, the RDCP does not have a BCR greater than one, meaning that it represents a net cost to New South Wales. However, as noted above, there is no requirement for the RDCP to reach a BCR of one.

Source: Department of Regional NSW.

The highest BCR was calculated for the planned investment in Low-Earth Orbit (LEO) satellites which is an element of the Gig State addendum, but this investment did not go ahead. LEO satellites can be used to provide digital connectivity to isolated properties. They sit closer to the Earth’s surface than a geostationary satellite and can transmit data with lower delay and improved connectivity. This LEO satellite pilot was identified to deliver a BCR of 2.62, including approximately 40% of the benefits attributable to the Gig State addendum. The Gig State addendum anticipated that the pilot would commence in 2022, however the department did not proceed with this. The 2023 budget reduced the funding for the Gig State program, and the department decided to discontinue the proposed pilot. The department advises it plans to revisit the LEO satellite project in mid 2025.

The RDCP’s grant guidelines largely comply with mandatory NSW Government requirements

In September 2022, the NSW Government released the revised ‘Grants Administration Guide’ (the guide) which, among other things, sets out mandatory requirements for NSW Government grant guidelines. Premier’s Memorandum ‘M2022-07 Grants Administration Guide’ makes it mandatory for agencies to follow the requirements of the guide for all grants released from 19 September 2022.

The guide states that clear and consistent grant guidelines must be prepared that contain the purpose and objectives of the grant, selection criteria (comprising eligibility and assessment criteria) and assessment process, grant value, opening and closing dates, application outcome date, the source agency, and the decision-maker.

The department developed grant guidelines for grant schemes funded by the RDCP. The guidelines explain the application and selection process, eligibility criteria and assessment criteria, and key dates. These include:

• Mobile Coverage Project – Active Sharing Partnership Grant Guidelines (September 2022)
• Gig State Grant Guidelines (October 2022)
• NSW Government Co-Investment in RCP3 and MBSP7 Program Guidelines (July 2023).

The guidelines for these three grant programs largely align with the requirements of the guide, but there were some gaps. The ASP pilot and Gig State program guidelines both note the contact person for complaints, but the RCP3 and MBSP7 guidelines do not state this. While the RCP3 and MBSP7 guidelines set out the relevant decision-maker and the role of key individuals in the assessment process, the guidelines for the ASP pilot did not identify the decision-maker and the Gig State Grant Guidelines did not provide the membership of the assessment panel making the recommendations.

The department’s grant programs were designed to target identified priority locations

Across the RDCP sub-programs, the department designed grant programs in a way that targeted funding towards its priority locations and other locations that met its eligibility criteria. The department has not been prescriptive about locations that would be funded through grant programs, but designed the programs in a way that encouraged providers to co-fund either the target locations or those that fit the criteria that the department was interested in funding.

For the Gig State grant program, the department released a list of preferred locations to potential applicants. The grant guidelines make clear that any proposals to build infrastructure to provide coverage to these areas would be given preferential treatment. The merit criteria are also aligned with this as the department awarded additional points for providing coverage to the target areas. Locations outside the preferred list were also eligible, provided they met the grant program’s objectives and eligibility criteria.

Similarly, for the mobile coverage ASP pilot program, the department released a list of preferred locations to potential applicants. The grant guidelines similarly encouraged potential applicants to follow this target list, both in terms of eligibility and also in terms of the way that the grants program provided additional points for providing coverage to the target areas. In addition, applicants could consider locations outside of the preferred list provided they met the grant program’s objectives and eligibility criteria set out in the grant guidelines.

For the co-funding opportunity with the Australian Government’s RCP3 and MBSP7 programs, a list of target locations was again provided. Applicants could consider locations outside of the target locations provided they were still eligible under Australian Government requirements for the RCP3 and MBSP7. Alternative solutions that provide mobile coverage on road corridors and mobile solutions for First Nations communities in other remote and very remote NSW locations could also be considered, however, funding was to be allocated to target locations and target transport corridors as a priority.

The department was not able to demonstrate a similar approach for the co-investment in the Mobile Black Spot Program Round 5A. The Australian Government developed eligibility criteria for the program, which align with the department’s mobile program objectives.

The department has selected grant recipients in line with its funding priorities

The department developed grant guidelines and an assessment methodology for the Gig State program and the ASP pilot program to guide its assessment panel, and applicants, through the process. The department assessed the applications for the Gig State and the ASP pilot grant programs against the eligibility and merit criteria contained in its guidelines, and in accordance with its assessment methodology. This resulted in the department funding locations that aligned with its target locations or areas that were in line with the purpose of each grant opportunity.

For the Gig State grant program, the department determined that projects were to be located in one of the 93 regional NSW Local Government Areas (LGA) identified in the grant guidelines. Eligible locations were in areas where internet access was via satellite services only and there were no committed or planned projects for fixed services in the area. The assessment panel for the Gig State grants recommended projects in 34 eligible locations from four applicants, for funding totalling $58.3 million (excl. GST), intended to bring improved connectivity to around 13,900 premises.

For the ASP pilot program, eligible locations were areas of regional NSW, where there was no existing handheld coverage provided by any Mobile Network Operators (MNO) or existing handheld coverage was provided by only one MNO. The assessment panel for the ASP pilot grants recommended 32 projects for funding totalling $30.4 million (excl. GST), intended to improve mobile coverage across ten regional LGAs. All other projects were considered not suitable for funding or ineligible.

The department provided a list of preferred locations for both grant programs. Applicants received a marginally higher score against assessment criteria if they put forward a preferred location but the location they identified could still be accepted if it was not in a preferred location but met the eligibility criteria. Funding was allocated to the majority of the Gig State program preferred locations identified in the Gig State business case addendum, but funding was allocated to only two of the 23 preferred locations identified in the business case for the ASP main program.

For the grants co-funded by the Australian Government (RCP3 and MBSP7), the department prioritised and selected grant recipients based on whether they met the eligibility criteria. It developed an assessment methodology to guide the assessment panel through this process. A probity advisor was present at both assessment panel meetings.

The department intends to further verify the RCP3 and MBSP7 application’s compliance with the RDCP objectives and eligibility criteria, following the assessment of applications by the Australian Government. Once verified, deeds will be negotiated and issued.

The department did not advise Government on the full cost of the Wamboin, Bywong and Sutton project, leading to a protracted and difficult process

The department’s process for awarding the grant to construct a fibre network for internet connectivity in the Wamboin, Bywong and Sutton regions was complex. The department appears to have estimated the initial costs of this program to be significantly higher than the funds allocated to the project. The department did not advise Government of this, and conducted the tender process based on the budget of $5 million committed by the Government. This budget proved insufficient, and the department had to request additional funds to contract the project. Not providing this advice to Government at an earlier stage means that the process which followed was more complex and protracted than it may have been if the department had provided this advice.

In January 2019, the NSW Government announced that it would provide $5 million to upgrade internet in the Wamboin, Bywong and Sutton region based on costings undertaken by a local community organisation. The department included this cost in the Gig State business case in December 2019 and also the Gig State addendum in September 2021. Documentation from late 2020 indicates that the department conducted an initial estimate that the full cost of the Wamboin, Bywong and Sutton project would be up to $16.3 million. It is unclear whether this was conducted before the Gig State business case was completed. The department was unable to provide the analysis that led to this initial cost estimate to the audit team. However, this indicates that the department was aware that the cost of the project would be greater than $5 million but did not provide this advice to Government. The additional cost was to be funded from the remainder of the Gig State business case.

In mid-2021, the department commenced a tender process with a budget of $5 million in January 2021. Only two applicants responded to this initial request for tender, and only one was evaluated as meeting the technical and construction requirements of the project. The cost estimates provided in the complying tender response were significantly higher than $5 million. As a result, the department did not award a contract following this tender.

The department then planned to undertake an in-depth analysis into alternative technology options. It noted the most promising option in terms of speed of delivery, quality of service, and value for money was LEO satellites. The department was unable to provide a copy of this analysis and so it is unclear the extent of the work undertaken to find alternative solutions for Wamboin, Bywong and Sutton rather than the construction of a fibre network to the premises.

After the initial market approach resulted in no contract being awarded, the department altered its procurement approach. A closed Expression of Interest (EOI) was sent to both respondents to the request for tender in November 2021 seeking a recommended technical solution, a proposed delivery method and timeframes. Both respondents achieved satisfactory scores for the EOI and were invited to submit a detailed design. As the department had determined through the tender process that the budget of $5 million was insufficient to ensure that it could provide internet services across the Wamboin, Bywong and Sutton region, the budget limit for the procurement was increased.

Both respondents submitted a detailed design and in May 2022 the department received approval to negotiate. The unsuccessful respondent scored marginally higher against the selection criteria. However, the assessment team considered that their proposal contained too much unmitigated risk. In May 2022, the department received approval to proceed to the negotiation phase with the successful proponent. Following this negotiation, a $9.5 million grant was awarded to the successful respondent to connect 1,352 premises. Around 140 premises were not included in the scope due to the significantly higher costs in connecting these premises.

The project cost has since increased to over $12 million, in part due to challenging terrain and ground conditions. Additional funding of around $1.7 million was also approved to connect an additional 134 properties that were identified during the detailed design phase. The department advises that these were initially missed due to boundary changes, incorrect council records and quality issues in the geospatial databases. It indicated that this is a separate group of properties to the 140 premises that were excluded due to higher connection costs.

The fact that the Wamboin, Bywong and Sutton project has a total cost of over $12 million, more closely aligned with the department’s internal cost estimate, indicates that fully advising Government of the costs may have saved significant time in the delivery of the project.

The department monitors the progress of its grant agreements but has not formalised its acquittal process

The department receives progress reports and milestone reports from grant recipients to assist in monitoring the progress of RDCP projects and assess if works provided match the requirements listed in the grant funding agreements. It also advises it has regular meetings with grant recipients, although no minutes are kept of these meetings.

The projects that have progressed to the construction phase are:

• Mobile coverage to Brewarrina and Wilcannia through the mobile coverage ASP pilot
• Improved internet to Wamboin, Bywong and Sutton.

The department receives regular progress reports for both projects, including some photographs and technical drawings. The reports provide information on progress against milestones and any changes to expected completion dates.

The department receives quarterly progress reports on improved internet for the Cobar corridor and the 56 other sites scheduled for fixed wireless internet, which are yet to progress to construction. The current scheduled completion date is March 2025. It also receives monthly reports on progress with mobile towers it is co-funding with the Australian Government as part of the Mobile Black Spot Program Round 5A.

The department provided few acquittal process documents or milestone acquittal documents, apart from the site qualification report for the Cobar corridor and its evaluation of the detailed design for the Wamboin, Bywong and Sutton project. The department advises it has an acquittal process in place for processing milestone reports, however it is yet to formalise this process. The three projects which have progressed enough to require acquittal are Wamboin, Bywong and Sutton, Wilcannia and Brewarrina, and the Cobar corridor.

The department has provided funding deeds for each project it has funded. Whilst the deeds include milestones, they do not include the dates for each milestone making it more difficult for the department to track the progress of each project.

The department’s approach to reporting its expenditure on consultants is inconsistent and does not always meet reporting requirements

Under the Annual Reports (Departments) Regulation 2015 agencies are required to report any consultancy engagements over $50,000 in their annual reports. The NSW Procurement Board Direction PBD-2023-05 Engagement of professional services suppliers defines a consultancy agreement as a type of professional services agreement where a person or organisation is engaged to provide recommendations or professional advice to assist decision-making by management.

The department has several professional services agreements as part of the RDCP, some of which are consultancy engagements within this definition and some of which contain elements of the contract that would be considered a consultancy agreement. For example, one of the major consultancy agreements involves providing strategic advice across the Gig State program, as well as providing advice on market engagement, and reviewing technical advice. This aligns with the definition of a consultancy agreement as the contracted organisation is providing professional advice to assist decision-making by management.

The department has not reported any of its agreements used as part of the RDCP in its annual reports, despite having several agreements that exceeded the $50,000 threshold which may fall into this definition.

The department advises that the agreements are categorised in the General Ledger as contractors and as such, are not required to be reported in the Department’s Annual Report. This interpretation is not in accordance with NSW Treasury and NSW Procurement Board requirements. It also identifies one contracted consultant as a ‘consultancy’ in its contract variation documentation but has not reported this expenditure in its annual reports.

Further, the department has not applied its interpretation consistently. For example, it has reported the preparation of some strategic and business planning documents as consultancies in its annual reports and not others.

The department is not monitoring the outcomes of the RDCP

Measuring outcomes of a program is important to determine whether that program is fulfilling its intended purpose. While many elements of the RDCP are still at an early stage, there is value in monitoring the outcomes of those elements which have completed construction to inform project implementation. There are no outcome measures for the effectiveness of the RDCP as a whole, and only limited measures for the mobile and Gig State programs. The department has the following outcome that it has set out for the Gig State program:

• Improve the digital connectivity (accessibility) in rural and remote NSW communities.

When developing the final business case for the Gig State program, the department utilised the ADII scores to identify the digital divide between Metropolitan Sydney and rural NSW. The ADII uses data from the Australian Internet Usage Survey to measure digital inclusion across three dimensions of access, affordability and digital ability. While the department utilised the ADII to determine the baseline for accessibility of digital connectivity in regional and remote NSW communities, the department is not using the ADII to measure whether the program has led to improvements in these communities. This limits the department’s ability to determine whether the RDCP has met its objectives.

At the time of the Gig State business case being developed, rural NSW ADII scores were reported, allowing the department to utilise the figures as a baseline, but since 2020 these are not publicly reported. The department is in the process of determining how it can use ADII scores to measure the performance of the program over time.

In addition to the Gig State program outcome measure, the department has one outcome measure for its mobile coverage program:

• Square kilometres with improved mobile coverage in regional NSW.

This outcome measure will not allow the department to understand the impact of the RDCP’s mobile coverage program. While measuring the number of square kilometres of coverage will allow the department to determine whether the mobile towers it is funding are achieving the intended extent of new mobile coverage, it will not allow the department to measure the quality of service, price of coverage, and other key information that could measure the impact of the new coverage.

In December 2023, the NSW Telco Authority released the NSW Digital Connectivity Index (DCI), which provides an overview of connectivity in each LGA and suburb across NSW. Each LGA and suburb is given a score out of 100 for access, affordability and demographics (as a proxy for the ability to use technology). The DCI includes several data points, including coverage from telecommunications providers, mobile signal strength, and internet speed. Given that the DCI includes useful data points and can allow for data to be inspected at the suburb level, there is an opportunity for the department to use this to identify the impact of its program both at a statewide level and in regions targeted for funding. However, the department has no plans to utilise the DCI to measure program performance.

In addition to not collecting data to measure the overall effectiveness of the RDCP, the department is also not collecting data to measure whether a number of the objectives of the Gig State and mobile coverage programs are being achieved. For example, both programs aim to reduce the price of digital services in regional areas, however there is no measurement of price in place to determine whether this is being achieved. Similarly, there is no plan in place to measure the speed of internet services or signal strength for mobile services, despite improvements in these things being part of the objectives of both programs as set out in their business cases.

The department is also not measuring whether there are improvements in competition in the mobile market through the mobile coverage program, despite one of the objectives of that program being to encourage competition in the regional telecommunications market. The department also has no plans to measure its contribution to the Closing the Gap target to understand the impact of the RDCP on Aboriginal communities. This is despite it identifying that seven locations with current or pending funding will support discrete Aboriginal communities. Four of these locations are part of the ASP project for Wilcannia and Brewarrina, and the other three are funded through the MBSP7 project.

The department has some output performance measures in place for the RDCP, but these focus on contracted outputs rather than outcomes

The department has identified performance measures for the program in reporting templates, in its final business cases for the Gig State and mobile coverage programs, and in its evaluation plan for the RDCP. These performance indicators measure the outputs of the program rather than the outcomes that would demonstrate whether program objectives have been met.

The measures that the department uses to report to NSW Treasury as part of its budgeting process have changed over time. Until June 2023, the department used two key output measures to determine the progress of the RDCP:

• Number of premises covered by signed contracts to deliver upgraded internet connectivity.
• Number of sites with signed contracts for new mobile coverage.

As noted, these are output measures and will not enable the department to determine whether the project is delivering its intended purpose. Since July 2023, the department has used two output measures:

• Number of premises covered by signed contracts to deliver upgraded internet connectivity.
• Contracted square kilometres for new and improved mobile coverage.

These four measures relate only to contracted coverage and do not provide a clear picture of ongoing progress with the construction and connection of new mobile and internet projects. Projects can have long lead times for a variety of reasons such as acquiring access to land, designing a solution and the time required to construct the solution. In addition, only measuring contracted coverage will not enable the department to determine whether these outputs are being delivered and will not reflect delays in those stages, nor will it enable the department to determine whether the towers are achieving their intended purpose. While there is value in measuring contracted coverage as an early lead indicator of performance, there is also value in reflecting the current state more accurately through measuring the progress of the construction of each project.

The department did not meet its original mobile coverage performance targets but met its Gig State program target

As noted above, the department had three metrics that it was using to measure the RDCP until June 2023. The department successfully achieved its Gig State program target but did not achieve its mobile coverage program targets. Exhibit 4 shows the results against targets for the RDCP measures. As can be seen, the result for square kilometres of improved mobile coverage delivered was significantly below the target.

* This comprises two towers funded through the ASP project and 22 towers co-funded through the Australian Government’s Mobile Black Spot Round 5A. This does not include five small towers for the Snowy Mountains Highway Safety project as the department has identified these as a temporary service.

Source: Audit Office analysis.

The department revised its performance measures after June 2023. This included revising output targets for the mobile and Gig state programs. The updated performance targets can be seen in Exhibit 5. The mobile coverage program performance measure was changed to measure the contracted square kilometres of new coverage rather than the actual square kilometres of new coverage. At the same time, the target value increased from 36,000 square kilometres to 60,000 square kilometres. The target value for the Gig State program was also updated compared to the 2023–24 target.

Source: Department of Regional NSW.

The department had nearly achieved its December 2025 target for contracted upgrades to internet connectivity by June 2023. As can be seen in Exhibit 4, 13,330 premises were covered by signed contracts to deliver upgraded internet connectivity as at June 2023.

In early 2023, the department estimated that it would have 12,279 square kilometres of new or improved mobile coverage delivered by December 2025. The department advised that it is likely to deliver on this forecast as early as December 2024, through its co-funding of two ASP locations and 22 locations under the Commonwealth’s Mobile Back Spot Program 5A.

There is uncertainty around whether the data the department is using is reliable to measure its performance

The department is collecting or planning to collect data from grant recipients to determine whether they are delivering the intended projects to the required quality. The funding deeds contain obligations on the quality and extent of the services to be provided by grant recipients and require that the contracted organisations report to the department on the construction and the extent of coverage (new ground covered for the mobile towers and number of premises connected for internet coverage). This aligns with the output measures set out above. The department is not collecting information that it could use to inform outcome measurement as part of its grant funding deeds with each grant recipient.

Grant recipients provide the department with the data that it has requested in line with the terms of the funding deeds. This information is collected through a regular schedule of status reporting. These status reports include information on progress with internet or mobile coverage, including the number of premises that will be able to connect to a service.

Information on the availability of fixed fibre connections to premises should be reliable, as with the Wamboin, Bywong and Sutton project. However, data on the availability and quality of fixed wireless internet connectivity and mobile coverage is likely to vary with terrain. While the department is collecting this information, it currently has no plans or a formal process to undertake validation testing following each project completion. This means that the department will not be able to provide assurance that the information collected is accurate.

The department has not updated the expected benefits of the program despite significant changes in scope

In September 2021, following a review of the Gig State program, the department prepared an addendum to the original Gig State business case to change the program from capital expenditure to operational expenditure, and set out a range of other changes. The department’s addendum to the business case noted that the approach to delivering benefits would remain the same, and it did not revisit the benefits realisation register nor attempt to recalculate expected benefits. Given the significant scope changes in the business case addendum, it is likely that there would have been an impact on expected benefits that would justify recalculating the program benefits.

This was not the only time where significant changes in the Gig State program’s operations did not result in an updated benefits realisation register. As noted in the introduction, the RDCP budget was reduced in the 2023 budget, and the remaining budget was extended out to 2028. As discussed above, the change in budget coincided with the department’s decision to discontinue the LEO satellite pilot, which was anticipated to deliver 40% of the financial benefits of the program. The change in budget profile for the program has likely led to a change in the benefits profile of the program, however the department has not updated its program assumptions in line with this change.

The department has documented key lessons learned from its funding rounds to date

Documenting lessons learned from early delivery of any given program is important, particularly pilot programs, to ensure that these can be incorporated into future program development. The department has documented lessons learned across the two programs of the RDCP, including the early grant rounds.

For its Gig State program, the department documented lessons learned in relation to the management of grants, industry engagement, the grant guidelines, the assessment of grants, and the time that the grants went to market. These lessons include reinforcing positive experiences, such as releasing a list of preferred locations to applicants, which the department believes served to encourage funds to be directed to those areas. The department also identified potential improvements, including how it communicated with industry and the data that it would request from future applicants. There have been no grant programs run through the Gig State program since these lessons were documented so it is not yet clear whether the department will implement changes as a result of these lessons learned.

As noted above, the mobile coverage ASP pilot program was delivered across two phases: the first phase involved working with industry to determine potential technical solutions, and the second phase was a grant program to deliver the preferred solutions. The department commissioned a lessons learned report of the first phase of the ASP pilot program with the intention of using this to inform the mobile coverage ASP main program business case development. The lessons learned report and the mobile coverage ASP main program business case were both completed in the same month, however, meaning that lessons could not be fully incorporated into that business case. The department has also identified additional lessons learned specifically in relation to the grant process. There have been no grant programs run through the mobile coverage ASP main program since these lessons were documented so it is not yet clear whether the department will implement changes as a result of these lessons learned.

In addition, the department has conducted an internal audit on the governance of the RDCP. The internal audit had largely positive findings about the governance structures and the grant guidelines. The internal audit did not make findings on the governance issues outlined above, such as not having finalised terms of reference. However, the internal audit did note that not all probity advice had been documented and some had been provided verbally, which increased the risk of grant processes not being undertaken with integrity.

The department has planned evaluations for all grant programs within the RDCP

The department has a draft evaluation plan for the RDCP that includes evaluations for each program to validate whether they have achieved their objectives, as well as finalised evaluation plans for each of the programs. Both process and outcome evaluations are planned. Process evaluations ensure that planned processes were followed and that lessons are learned for future grant programs. The department is planning process evaluations for when all funding deeds have been signed and outcome evaluations are planned for after project delivery is largely complete.

The sub-programs have not yet reached the point where the department will undertake outcome evaluations. The department has indicated that the outcome evaluations will be undertaken when each project has been delivered, which means that while it will determine whether the project has achieved its objectives, it will not be measuring outcomes on an ongoing basis to determine whether changes are needed for the program to meet its objectives. The funding deeds with grant recipients make it clear that the department will undertake an evaluation and may collect relevant information for this purpose. While the department should be able to collect information, the limitations in data collection noted above may need to be resolved to ensure that required data is available.

Appendix one – Response from agency

Appendix two – About the audit

Appendix three – Performance auditing

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Parliamentary reference - Report number #397 released 27 June 2024.

About this report

Financial audit results of the NSW public universities’ financial statements for the year ended 31 December 2023.

Audit findings

Unmodified audit opinions were issued for all ten universities.

Eight universities reported net deficits. Three of these improved on their 2022 results.

Total fees and charges returned to pre-pandemic levels, with 40.5% earned from overseas students from three countries.

Employee related expenses increased 10.2% in 2023 mainly due to an additional 2,830 full time equivalent staff, in response to increased teaching and research activities.

Key issues

The number of findings reported to management has increased to 111 matters in 2023 up from 88 in 2022.

These included one high risk finding and 62 moderate risk findings, a 72% increase from last year.

Gaps identified in universities governance processes included delays in responding to findings and recommendations; staff not attesting compliance with codes of conduct annually; and not capturing and recording staff conflicts of interests within central registers.

Seven of the ten universities have cyber security risks above what they determine as an acceptable risk. Four universities did not have a cyber security uplift program.

Recommendations

Universities should address all recommendations made in the report (see Appendix one for a summary of these).

In particular, there should be a focus on prioritising remediation of wage underpayments to affected employees; ensuring a centralised conflict of interest register is maintained for all staff; considering emerging risks in university risk registers; ensuring controlled entities are considered when determining internal audit plans; and focusing efforts to improve cyber security risk management and cyber resilience capability.

This report provides NSW Parliament with the results of our 2023 financial audits of universities in New South Wales and their controlled entities, including analysis, observations and recommendations in the following areas:

• financial reporting
• internal controls and governance
• teaching and enrolments
• cyber security.

Financial reporting is an important element of good governance. Confidence and transparency in university sector decision-making are enhanced when financial reporting is accurate and timely.

This chapter outlines audit observations related to the financial reporting of universities in NSW for 2023.

Appropriate financial controls help to ensure the efficient and effective use of resources and administration of policies. They are essential for quality and timely decision-making. Effective governance is essential for the stability, sustainability and ethical operation of universities. It ensures accountability, transparency and promotes responsible decision making.

This chapter outlines our observations and insights from our financial statement audits of NSW universities.

Our audits do not review all aspects of internal controls and governance every year. The more significant issues and risks are included in this chapter. These, along with the less significant matters, are reported to universities for management to address.

Universities' primary objectives are the functions of teaching and research. They invest most of their resources aiming to achieve quality outcomes in academia and student experience. Universities have committed to achieving certain government targets and compete to advance their reputation and their standing in international and Australian rankings.

This chapter outlines teaching and enrolment outcomes for universities in NSW for 2023.

This chapter of the report focuses on the cyber risk environment for universities, how universities have assessed that risk, what frameworks they use to strategically identify controls that respond to those risks, and the extent to which they have implemented or have plans to implement those controls. We also address some specific controls in respect of cyber resilience.

Appendix one – List of 2023 recommendations

Appendix two – Status of 2022 recommendations

Appendix three – Universities' controlled entities

Copyright notice

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Schools collect and maintain detailed student data, including sensitive personal information. Schools can also require or encourage students, parents and carers to use third party software applications for learning and other school related activities. This audit will consider how effectively schools ensure student data is secure within their own systems and when provided to third or fourth parties.

What this report is about

NSW local councils provide a wide range of essential services and infrastructure to their communities and are increasingly reliant on digital technologies.

Councils need to manage cyber security risks to ensure their information, data and systems are appropriately safeguarded. Councils also need to be prepared to detect, respond and recover when a cyber security incident occurs.

The audit assessed how effectively three selected councils identified and managed cyber security risks.

The audit also included the Department of Planning, Housing and Infrastructure (Office of Local Government) and Department of Customer Service (Cyber Security NSW), due to their roles in providing guidance and support to local councils.

Audit findings

The audit found that the selected councils are not effectively identifying and managing cyber security risks. Each of the councils undertook activities to improve their cyber security during the audit period, but this audit found significant gaps in their cyber security risk management and cyber security processes.

Such gaps result in unmitigated risks to the security of information and assets which, if compromised, could impact their local communities, service delivery and public infrastructure.

Cyber Security NSW and the Office of Local Government recommend that councils adopt requirements in the Cyber Security Guidelines for Local Government, but could do more to monitor whether the Guidelines are enabling better cyber security risk management in the sector.

Audit recommendations

In summary, the councils should:

• integrate assessment and monitoring of cyber security risks into corporate governance processes
• self-assess their performance against Cyber Security NSW's guidelines for local government
• develop and implement a risk-based cyber security improvement plan and program of activities
• develop, implement and test a cyber incident response plan.

Cyber Security NSW and the Office of Local Government should regularly consult on cyber security risks facing local government, and review the effectiveness of guidelines and related resources for the sector.

While this report focuses on the performance of the selected councils, the findings and recommendations should be considered by all councils to better understand their risks and challenges relevant to managing cyber security risks.

Local councils in New South Wales (NSW) provide a wide range of essential services and infrastructure to their communities and are increasingly reliant on digital technologies for this.

Councils use various information systems and software to manage significant amounts of information and data relevant to their corporate functions, infrastructure and service delivery. This may include sensitive information about residents, customers and staff.

Audit Office of New South Wales reports to Parliament have highlighted gaps in councils' cyber security risk management approaches since 2020. The Local Government 2023 report, tabled in March 2024, found that 50 councils were yet to implement cyber security governance frameworks and related internal controls.

The threat from cyber security incidents continues to rise. Such incidents can harm local government service delivery and may include the theft of information, denial of access to critical technology, or even the hijacking of systems for profit or malicious intent.

It is important that councils are effectively identifying and managing cyber security risks to:

• protect their information, data and systems
• be prepared to detect, respond to and recover from cyber security incidents 
• ensure confidence in the services they are providing for their communities.

This report outlines important findings and recommendations from a performance audit of three councils: City of Parramatta Council, Singleton Council and Warrumbungle Shire Council. This audit report has deidentified findings for each council, but the specific findings have been directly shared with each council to enable them to remediate and improve cyber safeguards. The findings and recommendations in this report are likely to be relevant to most local councils in NSW and councils are encouraged to ensure they have sufficient cyber safeguards.

This audit assessed how effectively the selected councils identified and managed cyber security risks. The audit considered whether the councils:

• effectively identify and plan for cyber security risks
• have controls in place to effectively manage identified cyber security risks
• have processes in place to detect, respond to, and recover from cyber security incidents.

This audit also included the Department of Customer Service and the Office of Local Government (OLG) within the Department of Planning and Environment (DPE) due to their roles in providing guidance and support to local government.¹

Cyber Security NSW, part of the Department of Customer Service, supports local councils to improve their cyber resilience through a range of services and guidance, including the Cyber Security Guidelines – Local Government issued in December 2022.

The OLG is responsible for strengthening the sustainability, performance, integrity, transparency and accountability of the local government sector.

¹ The OLG was part of DPE up to 1 January 2024, when DPE was abolished and the OLG became part of the Department of Planning, Housing and Infrastructure (DPHI).

Local councils in New South Wales (NSW) provide a wide range of essential services and infrastructure to their communities. In doing so, councils use a range of information technology (IT) systems, assets, and digital services.

This audit follows several audit reports by the Audit Office of New South Wales that have considered how effectively NSW Government entities, including local councils have managed cyber security risks (see Appendix three).

The Audit Office of New South Wales has reported on how councils have managed cyber security risks since 2020. In the Local Government 2023 report, tabled in March 2024, gaps in cyber security frameworks and related internal controls were reported in 50 councils.

This chapter includes a summary of thematic key findings for the selected councils.

Cyber Security NSW is responsible for supporting local councils to improve their cyber resilience through a range of services and guidance and published its Local Government Engagement Plan in 2023 (discussed below).

The Office of Local Government (OLG) is responsible for strengthening the sustainability, performance, integrity, transparency and accountability of the local government sector. It does this through a range of activities including monitoring sector-wide and council-specific risks, issuing guidance, engaging with councils to build capacity and supporting the Minister for Local Government’s discretionary intervention powers.

Appendix one - Response from entities Cyber security in LG

Appendix two - Glossary-  Cyber security in local government

Appendix three – Overview of Audit Office of New South Wales reports that consider cyber security - Cyber security in local government

Appendix four – Cyber Security Guidelines – Local Government foundational requirements- Cyber security in local government

Appendix five – About the audit- Cyber security in local government

Appendix six – Performance auditing -Cyber security in local government

Copyright notice

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

Parliamentary reference - Report number #392- released 26 March 2024

What this report is about

Results of the local government sector financial statement audits for the year ended 30 June 2023.

Findings

Unqualified audit opinions were issued for 85 councils, eight county councils and 12 joint organisations.

Qualified audit opinions were issued for 36 councils due to non-recognition of rural firefighting equipment vested under section 119(2) of the Rural Fires Act 1997.

The audits of seven councils, one county council and one joint organisation remain in progress at the date of this report due to significant accounting issues.

Fifty councils, county councils and joint organisations missed the statutory deadline of submitting their financial statements to the Office of Local Government, within the Department of Planning, Housing and Infrastructure, by 31 October.

Audit management letters included 1,131 findings with 40% being repeat findings and 91 findings being high-risk. Governance, asset management and information technology continue to represent 65% of the key areas for improvement.

Fifty councils do not have basic governance and internal controls to manage cyber security.

Recommendations

To improve quality and timeliness of financial reporting, councils should:

• adopt early financial reporting procedures, including asset valuations
• ensure integrity and completeness of asset source records
• perform procedures to confirm completeness, accuracy and condition of vested rural firefighting equipment.

To improve internal controls, councils should:

• track progress of implementing audit recommendations, and prioritise high-risk repeat issues
• continue to focus on cyber security governance and controls.

Pursuant to the Local Government Act 1993 I am pleased to present my Auditor-General’s report on Local Government 2023. My report provides the results of the 2022–23 financial audits of 121 councils, eight county councils and 12 joint organisations. It also includes the results of the 2021–22 audits for two councils and two joint organisations which were completed after tabling of the Auditor-General’s report on Local Government 2022. The 2022–23 audits for eight councils, one county council and one joint organisation remain in progress due to significant accounting issues.

This will be my last consolidated report on local councils in NSW as my term as Auditor-General ends in April. Without a doubt, the change in mandate to make me the auditor of the local government sector has been the biggest challenge in my term. Challenging for councils as they adjust to consistent audit arrangements and for the staff of the Audit Office of NSW as they learn about the issues facing NSW councils.

The change in mandate aimed to improve the quality of financial management and reporting across the sector. This will take time. But this report does show some ‘green shoots’ with more councils submitting financial reports to the Office of Local Government by 31 October and more councils having Audit, Risk and Improvement Committees. 

I also want to acknowledge that councils face significant challenges responding to and recovering from emergency events whilst cost and resourcing pressures have been persistent.

The findings from our audits identify opportunities to further improve timeliness and quality of financial reporting and integrity of systems and processes. The recommendations in this report are also intended to improve financial management and reporting capability, encourage sound governance, and boost cyber resilience.

Margaret Crawford PSM
Auditor-General for New South Wales

Financial reporting is an important element of good governance. Confidence in and transparency of public sector decision-making are enhanced when financial reporting is accurate and timely.

This chapter outlines audit observations related to the financial reporting audit results of councils, county councils and joint organisations.

A strong system of internal controls enables councils to operate effectively and efficiently, produce reliable financial reports, comply with laws and regulations, and support ethical government.

This chapter outlines the overall trends in governance and internal controls across councils, county councils and joint organisations in 2022–23.

Financial audits focus on key governance matters and internal controls supporting the preparation of councils’ financial statements. Breakdowns and weaknesses in internal controls increase the risk of fraud and error. Deficiencies in internal controls, matters of governance interest and unresolved issues are reported to management and those charged with governance through audit management letters. These letters include our observations with risk ratings, related implications, and recommendations.

Appendix one – Response from the Office of Local Government within the Department of Planning, Housing and Infrastructure

Appendix two – NSW Crown Solicitor’s advice

Appendix three – Status of previous recommendations

Appendix four – Status of audits

Appendix five – Councils received qualified audit opinions for non-recognition of rural firefighting equipment

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.

What this report is about

Transport for NSW (TfNSW) uses the Driver vehicle System (DRIVES) to support its regulatory functions. The system covers over 6.2 million driver licences and over seven million vehicle registrations.

DRIVES first went live in 1991 and has been significantly extended and updated since, though is still based around the same core system. The system is at end of life but has become an important service for Service NSW and the NSW Police Force.

DRIVES now includes some services to other parts of government and non-government entities which have little or no connection to transport. There are 141 users of DRIVES in total, including commercial insurers, national regulators, and individual citizens.

This audit assessed whether TfNSW is effectively managing DRIVES and planning to transition it to a modernised system.

Audit findings

TfNSW has not effectively planned the replacement of DRIVES.

It is now working on its third business case for a replacement system but has failed to learn lessons from its past attempts.

In the meantime, TfNSW has not taken a strategic approach to managing DRIVES’ growth.

TfNSW has been slow to reduce the risk of misuse of personal information held in DRIVES. With its delivery partner Service NSW, TfNSW has also been slow to develop and implement automatic monitoring of access.

TfNSW uses recognised processes for managing most aspects of DRIVES, but has not kept the system consistently available for users. TfNSW has lacked accurate service availability information since June 2022, when it changed its technology support provider.

TfNSW needs to significantly prioritise cyber security improvements to DRIVES. TfNSW is seeking to lift DRIVES’ cyber defences, but it will not achieve its stated target safeguard level until December 2025.

Even then, one of the target safeguards will not be achieved in full until DRIVES is modernised.

Audit recommendations

TfNSW should:

• implement a service management framework including insight into the views of DRIVES users, and ensuring users can influence the service
• ensure it can accurately and cost effectively calculate when DRIVES is unavailable due to unplanned downtime
• ensure implementation of a capability to automatically detect anomalous patterns of access to DRIVES
• ensure that DRIVES has appropriate cyber security and resilience safeguards in place as a matter of priority
• develop a clear statement of the future role in whole of government service delivery for the system
• resolve key issues currently faced by the DRIVES replacement program including by:
  • clearly setting out a strategy and design for the replacement
  • preparing a specific business case for replacement.

The DRIver VEhicle System_¹ (often known as DRIVES) is the Transport for NSW (TfNSW) system which is used to manage over 6.2 million driver licences and over seven million vehicle registrations in New South Wales.

DRIVES first went live in 1991 and has been significantly extended and enhanced over the past 33 years. DRIVES is a significant NSW Government information system — containing personal information such as home addresses for most of the NSW adult population, sensitive health information such as medical conditions, and biometric data in photographs.

Service NSW, part of the Department of Customer Service, is the NSW Government's 'one stop shop' for services to NSW citizens and businesses. It uses DRIVES when it delivers many transport-related services to NSW citizens such as licence renewals and checks the identity information stored in DRIVES as part of other services delivered to NSW citizens, such as a 'working with children check'.

DRIVES supports TfNSW's regulatory functions and the collection of more than $5 billion in revenue annually for the NSW Government. The system is also used by many organisations outside of the NSW Government including commercial insurers and national regulators, as well as individual citizens who access DRIVES for services such as 'Renew my registration' or 'Book a driver knowledge test'.

TfNSW owns and manages DRIVES. It intends to replace DRIVES with a modernised system to improve its cost, performance, and security.

The objective of this performance audit was to assess whether TfNSW is effectively:

• managing the current system, and 
• planning to transition DRIVES to a modernised system.

The auditee is TfNSW. We have consulted with the Department of Customer Service as a key stakeholder during the audit process.

This part of the report considers whether Transport for NSW (TfNSW) is effectively managing the current system. It considers DRIVES’:

• role in NSW Government service delivery
• ease of use and appropriateness for a modern system
• mechanisms to ensure the service is available for users.

This part of the report considers whether Transport for NSW (TfNSW) is effectively planning to transition DRIVES to a modernised system. It makes findings on the:

•  effort to develop a business case to fund the replacement of DRIVES
• issues which have contributed to the slow progress of the replacement program.

Appendix one – Response from entity 

Appendix two – Statutory and regulatory framework related to DRIVES 

Appendix three – About the audit 

Appendix four – Performance auditing 

Parliamentary reference - Report number #388 - released 20 February 2024.

What this report is about

This report analyses the internal controls and governance of the 25 largest agencies in the NSW public sector, excluding state owned corporations and public financial corporations, for the year ended 30 June 2023.

Findings

Internal control trends

The proportion of control deficiencies identified as high-risk this year decreased to 4.5% (8.2% in 2022).

Repeat findings of control deficiencies represent 38% of all findings (48% in 2022). 

Information technology

Over half of the agencies reviewed have deficiencies in managing user access to their information systems. Over a third of agencies had deficiencies in their controls over privileged user accounts within their information technology environments. 

Cyber security

Over 80% of assessments for maturity levels against the NSW Cyber Security Policy have reported one or more self-assessed Mandatory Requirements are not practiced on a consistent and regular basis.

Essential Eight cyber controls have not improved, and they need to. 

Governance framework

Deficiencies were noted in agencies' governance and risk management frameworks, namely: outdated risk management policies, lack of risk appetite statements, and internal audit functions not being externally evaluated.  

Payroll and work health and safety (WHS)

Overtime expenses increased by 40% between 2020 and 2023, compared to salaries and wages which increased by 16% over the same period.

Five agencies have WHS policies that do not reflect current WHS regulations.

Recommendations

Several important recommendations were made for agencies to prioritise efforts to improve cyber security controls and cyber resilience measures.

It was also recommended that agencies periodically review their risk management maturity and implement action plans, and ensure their WHS policies and procedures reflect current legislation requirements including the need to manage psychosocial risks.

Internal controls are processes, policies and procedures that help agencies to:

• operate effectively and efficiently
• produce reliable financial reports
• comply with laws and regulations
• support ethical government.

This chapter outlines the overall trends for agency controls and governance issues, including the number of audit findings, the degree of risk those deficiencies pose to the agency, and a summary of the most common deficiencies found across agencies.

For consistency and comparability, we have adjusted the 2022 results to incorporate additional audit findings that were reported after the date of the Internal controls and governance 2022 report. Therefore, the 2022 figures will not necessarily align with those reported in our 2022 report.

This chapter outlines our audit observations, conclusions and recommendations arising from our review of agency controls to manage key financial systems.

This chapter outlines our audit observations, conclusions and recommendations arising from our review of agencies' cyber security.

Governance in the context of the NSW public service refers to the structures, processes, and mechanisms by which government departments and agencies are held to account when they make decisions and implement policies and programs in the service of the public interest. It also includes the principles and practices that guide how these agencies work together.

This chapter outlines our audit observations, conclusions and recommendations from our review of agencies' governance frameworks and practices, with consideration of NSW Treasury issued policies and best practices. It focuses on two key areas: governance arrangements and risk management.

This chapter outlines our audit observations, conclusions and recommendations arising from our review of agencies' payroll controls and management of work health and safety (WHS).

What this report is about

Result of the Treasury portfolio of agencies’ financial statement audits for the year ended 30 June 2023.

The results of the audit of the NSW Government’s consolidated Total State Sector Accounts (TSSA), which are prepared by NSW Treasury, will be reported separately in our report on ‘State Finances 2023’.

The audit found

Unqualified audit opinions were issued on all general purpose financial statement audits.

Qualified audit opinions were issued on two of the 24 other engagements prepared by portfolio agencies. These related to payments made from Special Deposit Accounts that did not comply with the relevant legislation.

The number of monetary misstatements identified in our audits increased from 29 in 2021–22 to 39 in 2022–23.

The new parental leave policy impacted agencies across all portfolios. NSW Treasury should perform annual assessments to identify changes in legislation and regulation and provide timely guidance to the sector.

Transport for NSW and Sydney Metro have capitalised over $300 million of tender bid costs paid to unsuccessful tender bidders relating to significant infrastructure projects. Whilst NSW Treasury policy provides clarity on the reimbursement of unsuccessful bidders’ costs, clearer guidance on how to account for these costs in agencies’ financial statements is required.

The key audit issues were

Five high-risk issues were reported in 2022–23. Three were new findings on contract management, accounting treatments for workers compensation renewal premium adjustments and the management and oversight of a Special Deposit Account. Two repeat issues referred to the need to improve quality review processes over financial reporting and the timely approval of administration costs.

Portfolio agencies should prioritise and action recommendations to address internal control deficiencies.

This report provides Parliament and other users of the Treasury portfolio of agencies’ financial statements with the results of our audits, analysis, conclusions and recommendations in the following areas:

• financial reporting
• audit observations.

Financial reporting is an important element of good governance. Confidence and transparency in public sector decision-making are enhanced when financial reporting is accurate and timely.

This chapter outlines our audit observations related to the financial reporting of agencies in the Treasury portfolio of agencies (the portfolio) for 2023.

Appropriate financial controls help ensure the efficient and effective use of resources and administration of agency policies. They are essential for quality and timely decision-making.

This chapter outlines our observations and insights from our financial statement audits of agencies in the Treasury portfolio.

Appendix one – Misstatements in financial statements submitted for audit

Appendix two – Early close procedures

Appendix three – Timeliness of financial reporting

Appendix four – Financial data

Appendix five – Acquittals and other opinions

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.