Reports
Integrity of data in the Births, Deaths and Marriages Register
This report outlines whether the Department of Customer Service (the department) has effective controls in place to ensure the integrity of data in the Births, Deaths and Marriages Register (the register), and to prevent unauthorised access and misuse.
The audit found that the department has processes in place to ensure that the information entered in the register is accurate and that any changes to it are validated. Although there are controls in place to prevent and detect unauthorised access to, and activity in the register, there were significant gaps in these controls. Addressing these gaps is necessary to ensure the integrity of information in the register.
The Auditor-General made nine recommendations to the department, aimed at strengthening controls to prevent and detect unauthorised access to, and activity in the register. These included increased monitoring of individuals who have access to the register and strengthening security controls around the databases that contain the information in the register.
The NSW Registry of Births Deaths and Marriages is responsible for maintaining registers of births, deaths and marriages in New South Wales as well as registering adoptions, changes of names, changes of sex and relationships. Maintaining the integrity of this information is important as it is used to confirm people’s identity and unauthorised access to it can lead to fraud or identity theft.
The NSW Registry of Births Deaths and Marriages (BD&M) is responsible for maintaining registers of births, deaths and marriages in New South Wales. BD&M is also responsible for registering adoptions, changes of name, changes of sex and relationships. These records are collectively referred to as 'the Register'. The Births, Deaths and Marriages Registration Act 1995 (the BD&M Act) makes the Registrar (the head of BD&M) responsible for maintaining the integrity of the Register and preventing fraud associated with the Register. Maintaining the integrity of the information held in the Register is important as it is used to confirm people's identity. Unauthorised access to, or misuse of the information in the Register can lead to fraud or identity theft. For these reasons it is important that there are sufficient controls in place to protect the information.
BD&M staff access, add to and amend the Register through the LifeLink application. While BD&M is part of the Department of Customer Service, the Department of Communities and Justice (DCJ) manages the databases that contain the Register and sit behind LifeLink and is responsible for the security of these databases.
This audit assessed whether BD&M has effective controls in place to ensure the integrity of data in the Births, Deaths and Marriages Register, and to prevent unauthorised access and misuse. It addressed the following:
- Are relevant process and IT controls in place and effective to ensure the integrity of data in the Register and the authenticity of records and documents?
- Are security controls in place and effective to prevent unauthorised access to, and modification of, data in the Register?
ConclusionBD&M has processes and controls in place to ensure that the information entered in the Register is accurate and that amendments to the Register are validated. BD&M also has controls in place to prevent and detect unauthorised access to, and activity in the Register. However, there are significant gaps in these controls. Addressing these gaps is necessary to ensure the integrity of the information in the Register. BD&M has detailed procedures for all registrations and amendments to the Register, which include processes for entering, assessing and checking the validity and adequacy of source documents. Where BD&M staff have directly input all the data and for amendments to the Register, a second person is required to check all information that has been input before an event can be registered or an amendment can be made. BD&M carries out regular internal audits of all registration processes to check whether procedures are being followed and to address non-compliance where required. BD&M authorises access to the Register and carries out regular access reviews to ensure that users are current and have the appropriate level of access. There are audit trails of all user activity, but BD&M does not routinely monitor these. At the time of the audit, BD&M also did not monitor activity by privileged users who could make unauthorised changes to the Register. Not monitoring this activity created a risk that unauthorised activity in the Register would not be detected. BD&M has no direct oversight of the database environment which houses the Register and relies on DCJ's management of a third-party vendor to provide the assurance it needs over database security. The vendor operates an Information Security Management System that complies with international standards, but neither BD&M nor DCJ has undertaken independent assurance of the effectiveness of the vendor's IT controls. |
Appendix one – Response from agency
Appendix two – About the audit
Appendix three – Performance auditing
Copyright notice
© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.
Parliamentary reference - Report number #330 - released 7 April 2020.
Implementing Asset Management Reforms
Hospitals, schools, public housing, roads, bridges, buses and trains are just some of the assets used by government in providing services to citizens.
The NSW Government’s asset base is impressive in size - with a value of around $167 billion and with government plans to spend around $8 billion acquiring or replacing assets in the current year. Another $2 billion is spent each year on maintenance.
Good asset management is very important to government; even a small efficiency gain in this area can provide significant returns. Good practice by those responsible for managing assets can improve reliability, extend asset life, save on maintenance costs and aid in identifying and disposing of unnecessary or non-performing assets.
Improving the NSW public sector’s approach to asset management has been on the reform agenda for at least a decade. Changes in practice have been accelerated more recently by integrating asset management policy with the budget process.
In this audit we examined NSW Treasury’s efforts to improve asset management practices in the public sector and the progress made by 3 agencies - the Department of Corrective Services, NSW Fire Brigades and the Powerhouse Museum - towards better managing their asset portfolios.
This report informs Parliament and the community on progress to date and what more needs to be done to ensure that agencies manage assets effectively and achieve best value.
Parliamentary reference - Report number #143 - released 12 October 2005
In-year Monitoring of the State Budget
The annual Budget is one of the most important and visible statements about a government’s financial intentions.
Once a Budget is released, it is important to monitor variations from the projections it contains. This is done for two reasons -
- first, to ensure that individual agencies are properly managing their budget allocations and that any genuine emerging need for additional funding is met.
- second, to ensure that any changes to the State’s overall financial position are understood and corrective action is undertaken.
This audit dealt primarily with the second of these objectives.
Budget monitoring involves both agencies and Treasury working together to quickly identify factors that might impact the budget, to clearly understand the implications for their budget position and to take any remedial action needed.
Poor monitoring may reduce the confidence that stakeholders have in the government’s financial management. It may mean that government decisions made in- year or for the following budget (for example on tax measures or spending increases/savings) are based on an incorrect understanding of the State’s true financial position.
I hope that this Report provides some useful insights that will assist in better monitoring.
Parliamentary reference - Report number #141 - released 28 July 2005
Fraud Control: Current Progress and Future Directions
Periodically we review the extent to which agencies have implemented the recommendations they accept from our earlier audits. This gives Parliament and the public an update on the extent of progress made.
Given the size of the NSW public sector, the potential for fraud could run into billions of dollars if not properly managed. It is an area of risk that warrants close and ongoing attention. Over the last decade, we have responded by issuing three performance audits and a comprehensive guide to better practice on this topic.
In conducting my financial audits, there is now an Auditing Standard that requires me to seek annual assurances from every agency concerning the adequacy of their arrangements for fraud control. This latest performance audit provides a further report card on the extent to which the NSW public sector is managing its fraud risks.
This Report also provides updated guidance on improving arrangements for fraud control both at a whole-of-government level and at the agency level.
I commend the Report for close and careful attention by every agency.
Parliamentary reference - Report number #130 - released 9 February 2005
