Report snapshot

Objective

This audit assessed how effectively the NSW Department of Education (the department) and NSW public schools (schools) protect the security and privacy of student information. 

Key findings

The department has established a range of controls to manage the security and privacy of student information

Over the last 3 years, the department has strengthened its controls by uplifting cyber security capability, centrally contracting key third-party IT vendors, developing specific policy frameworks, and providing professional learning and centralised supports for schools.

Technical responsibilities have been allocated to school principals without sufficient departmental oversight

The department does not clearly define the specific risks to student information that schools must manage, nor provide clear operational guidance or proactive support to monitor how legislative and policy requirements are met in practice at the school level. With principals relying on their own judgement and capacity, practices are inconsistent and in some cases non-compliant.

There are gaps in how schools apply the department’s staff access controls to systems

The department’s controls do not ensure that access to student information is limited to staff who need it for their role. Schools apply access controls inconsistently, and some staff access more information than they need or retain access after they leave a school. The department does not oversee or control staff access to third‑party school administration systems, which hold large amounts of student information.

Some schools use third-party digital products without departmental oversight

The department’s marketplaces give schools a range of approved third-party digital products for school administration and online learning. It centrally manages contracts with third-party vendors, including terms to protect the security and privacy of student information. However, some schools use third-party products outside of these marketplaces and without departmental oversight or controls to protect student information.

The department does not independently assure third-party digital products in its marketplaces

While third-party vendors of digital products in department’s marketplaces are subject to contractual security and privacy controls, the department does not routinely verify vendor compliance.

The department only recently identified key third-party systems as ‘crown jewels’

The department did not classify Compass, SchoolBytes and Sentral – the third-party systems used by more than 98% of schools to manage student information – as ‘crown jewels’ until early 2026. The department is now implementing the higher levels of oversight, assurance and protective controls that apply to crown jewels.

Recommendations

The audit made recommendations for the department to review the allocation of responsibilities to principals, improve the guidance and supports for schools, and strengthen the controls for managing the access to and use of student information.

Further information

Please contact Renee O'Kane, Chief of Staff, on 9275 7347 or by email.

Overview

This audit examined whether the Department of Primary Industries and Regional Development’s (DPIRD) Make the Move 2024–25 advertising campaign was carried out effectively, economically and efficiently, and in compliance with the Government Advertising Act 2011 (the Act), Government Advertising Regulation 2024, and the NSW Government Advertising Guidelines.

Key findings

The campaign largely complied with the mandatory requirements

The campaign largely met legislative requirements, was supported by analysis and research, and was an efficient and cost-effective way to achieve a public purpose. Compliance certificates issued by the Secretary did not address the cost–benefit analysis requirement.

DPIRD did not complete a cost-benefit analysis before commencement of the campaign

DPIRD interpreted the cost–benefit analysis requirement as applying to campaigns with annual budgets exceeding $1 million, consistent with advice it received from the Department of Customer Service (DCS).

The Act requires agencies to consider the total cost of a campaign over its duration. It does not limit this assessment to annual budget allocations.

In the absence of a cost–benefit analysis, DPIRD could not demonstrate that the campaign represented value for money.

The campaign exceeded its relocation target and largely achieved positive outcomes

The campaign increased Make the Move website traffic by 16%, lifted The Welcome Experience registrations by 44% to around 4,700, and exceeded its relocation target, with 1 in 4 registrants moving to regional NSW.

The campaign did not meet targets for key attitudinal measures, including relevance, engagement, believability, and serious consideration of relocating to regional NSW.

Post-campaign evaluation and effectiveness assessment was delayed

DPIRD’s campaign effectiveness reports were submitted late in both years of the campaign due to delays from the media agency, highlighting the need for better management of third‑party dependencies to support timely evaluation and peer review.

Recommendations

The audit makes 2 recommendations:

• DPIRD should complete a cost–benefit analysis before launching future advertising campaigns likely to exceed $1 million over one or more financial years. It should complete compliance certificates after all regulatory requirements are met.
• DCS should ensure its advice and guidance clearly communicate agencies’ obligations under the Act, including the requirement to complete a cost-benefit analysis for campaigns likely to exceed $1 million over one or more financial years.

Further information

Please contact Renee O'Kane, Chief of Staff, on 9275 7347 or by email.

Overview

This audit assessed whether Port Stephens Council and Armidale Regional Council are developing and monitoring their Long-Term Financial Plans (LTFP) to ensure their strategic goals can be achieved sustainably.

Port Stephens Council

The LTFP complies with all requirements except scenario modelling

Port Stephens Council’s LTFP includes most of the essential elements set out by the Office of Local Government (OLG). While the 2024–34 and 2025–35 LTFPs did not include the required scenario modelling, the draft 2026–36 LTFP includes this modelling.

The LTFP is incorporated with other Integrated Planning and Reporting documents

The Council’s LTFP is incorporated with most of the other Integrated Planning and Reporting (IP&R) documents, including the Delivery Program, the Strategic Asset Management Plan and the Workforce Management Strategy. 

The Council uses reliable data and modelling to develop its LTFP

The Council uses relevant data from reliable sources to develop its LTFP. However, there are some inconsistencies between the assumptions documented in the LTFP and the assumptions used for the financial model.

Armidale Regional Council

The LTFP complies with requirements but financial modelling is limited

Armidale Regional Council’s LTFP includes the essential elements set out by the OLG. However, the sensitivity analysis and scenario modelling lack detail.

The LTFP is not incorporated with other Integrated Planning and Reporting documents

The Council’s LTFP is not used to develop its Operational Plan and Delivery Program. The LTFP does not incorporate the full costs of the Council’s infrastructure plans or Workforce Management Strategy. This limits the completeness of the LTFP as it does not fully reflect the Council’s planned expenditure.

There are deficiencies in the asset data used to inform the LTFP

Deficiencies in the Council’s asset data limit the reliability of operational and capital expenditure forecasts in its LTFP. The Council has not taken action to address these deficiencies, such as regular asset inspections and investing in an asset management information system.

Recommendations

The report makes 3 recommendations to Port Stephens Council and 5 recommendations to Armidale Regional Council to improve their long-term financial planning processes.

Further information

Please contact Renee O'Kane, Chief of Staff, on 9275 7347 or by email.

Overview

This audit assessed the effectiveness of the Department of Climate Change, Energy, the Environment and Water (DCCEEW), the Natural Resources Access Regulator (NRAR) and WaterNSW in implementing compliance and enforcement measures for the sustainable and integrated management of non-urban water use in NSW. 

Key findings

There have been significant reforms to address deficiencies in water regulation

Reforms include the establishment of NRAR and the progressive implementation of non-urban water metering and licensing for floodplain harvesting.

The complexity of the reform agenda has posed challenges for effective regulation

The complexity of the reform agenda has reduced clarity about obligations for some water users. This has undermined efforts to promote voluntary compliance and confidence in the regulation of the sector.

DCCEEW has not assessed the outcomes of water regulation reforms 

DCCEEW conducted regulatory impact assessments of some reforms before they were implemented. However, it has not assessed the cumulative impact and the economic, social and environmental outcomes of the reforms.

Significant deficiencies in IT systems limit the oversight of outcomes and risks

Regulation of water management is dependent on IT systems maintained by WaterNSW, including some that were in use before it was established.

These systems were intended to manage water accounts, and were not for regulatory and enforcement purposes. The water agencies have identified significant data quality and access issues with these systems and have taken some steps to address them. 

While the agencies have developed a collaborative plan to address these IT issues, implementation of this plan is subject to governance approval and the availability of funding.

NRAR has developed a policy architecture with supporting technologies

NRAR has comprehensive regulatory policies and procedures, and it has developed capability and advanced operational technology to support its regulatory functions.

NRAR needs to improve how it measures and reports on its regulatory outcomes

The quality and governance of NRAR’s activity data is poor and the regulator lacks adequate performance measurement and reporting. This impacts its ability to demonstrate its effectiveness as a regulator and hinders its use of data as a valuable organisational asset.

Recommendations

The audit makes 4 recommendations. These are intended to ensure a better understanding of the cumulative impact of regulatory changes, resolve deficiencies with core IT systems necessary for effective regulation, and ensure that the regulator has an outcomes-focused approach to demonstrating its performance.

Further information

Please contact Renee O'Kane, Chief of Staff, on 9275 7347 or by email.

Overview

This report presents key findings and recommendations from financial audits of NSW public universities for the year ended 31 December 2025.

Key findings

Clean audit opinions were issued for all 10 universities.

Control deficiencies were most common in IT/cyber security, governance and payroll

There were 94 reported audit findings and most related to poor monitoring of IT/cyber security risks, inadequate governance oversight and deficiencies in payroll management.

Nearly 24% of consultancy engagements reviewed were directly sourced

Direct procurement sourcing minimises the opportunity for competition and value for money. All engagements directly sourced were approved within the university’s procurement policy exemptions except in one instance. Universities spent $139 million on consultant expenses, including $46.2 million collectively on 2 firms.

Lack of oversight for contingent labour hire

Universities collectively spent more than $217 million on contingent labour. However, central oversight is limited. Only 3 universities had formal policies governing contingent workers and 4 maintained a register of all contingent workers.

Domestic student revenue does not cover operating costs

Operating costs per student of $37,868 exceeded the average revenue per domestic student of $25,213, representing a 33% deficit margin. In contrast, average overseas student revenue of $41,381 exceeded cost, representing a 9% surplus margin.

Processes to obtain conflict of interest declarations are inadequate

Four universities did not require annual conflict of interest declarations from all employees and did not update their central conflicts of interest registers annually. Three universities did not require nil returns from senior executives, elevating the risk of undeclared conflicts.

There were undeclared employee interests in companies that are university vendors

We identified over 790 instances of employees with directorships in companies that were university vendors, of which 30% of instances reviewed could not be found on the conflict of interest register.

Weaknesses in managing legacy system risks

One university has no processes to manage IT legacy systems, and 6 universities have not formally assessed legacy system risks.

Universities continue to grapple with the complexities of adopting artificial intelligence

Three universities still do not have a formalised AI policy. Only 2 universities had procurement guidance in place for AI-related procurement.

Recommendations

The report makes 6 recommendations to improve procurement processes, strengthen contingent labour hire management, enhance policies and procedures for managing conflicts of interest and progress AI governance maturity.

Further information

Please contact Renee O'Kane, Chief of Staff, on 9275 7347 or by email.

Objective

This audit assessed whether the NSW Reconstruction Authority (the Reconstruction Authority) is effectively administering the Resilient Homes Program (RHP) and the Resilient Lands Program (RLP) to meet the programs’ objectives.

Key findings

The Resilient Homes and Resilient Lands Programs were not effectively planned

Key elements of planning were not undertaken before the RHP and the RLP were rolled out, including the development of detailed project plans and risk mitigations. This had a significant impact on their ongoing implementation and led to delays. There was no business case or cost-benefit analysis to inform the design and establishment of the programs.

The Reconstruction Authority is prioritising Resilient Homes Program funding based on risk

The approach adopted in June 2023 has ensured that funding is targeted to the RHP properties assessed as having the highest flood risk.

The Reconstruction Authority has reallocated funding from buybacks to increase the number of resilient measures

Following the increase in the RHP budget to $880 million, the Reconstruction Authority estimated that it would be able to support 1,345 buybacks and 420 resilient measures. 

In August 2025, it re-profiled program funding to work towards 1,000 buybacks and 600 resilient measures. This change was informed by community and local council feedback.

There have been persistent delays in the Resilient Homes Program

During early implementation of the RHP, it became clear that additional policy work was required, including the need for procedures on home relocations and the gifting of homes. This additional work, as well as changes to the delivery model for the resilient measures stream, contributed to delays in delivery.

The Reconstruction Authority has not effectively administered the Resilient Lands Program

The RLP was designed to help meet the demand for land and housing as estimated when the program was established. There have been significant delays in program delivery, including in finalising the Resilient Lands Strategy, and the program is yet to deliver any land for housing.

Recommendations

The report makes 5 recommendations for the Reconstruction Authority, including identifying opportunities to accelerate delivery of the RLP, improve planning for future disaster recovery and to ensure the appropriate use of bought-back land. These recommendations are outlined in Chapter 2.

Further information

Please contact Renee O'Kane, Chief of Staff, on 9275 7347 or by email.

Objective

This audit assessed whether NSW Health efficiently and effectively provides access to planned surgery (also known as elective surgery) to public patients.

Key findings

NSW Health has mostly cleared the backlog of patients caused by pauses to planned surgery during COVID-19

Non-urgent planned surgery was paused several times during the COVID-19 pandemic between March 2020 and January 2022. This resulted in a backlog of overdue planned surgery patients, reaching a peak of almost 19,000 patients overdue for planned surgery in April 2022. At the end of the audit period in December 2025, this has dropped to approximately 3,900 overdue patients.

NSW Health is not completing planned surgery for all patients within clinically recommended timeframes

In 2024–25, only 4 of the 17 local health districts and specialty health networks met the goal of zero patients waiting longer than clinically recommended for surgery. There are also considerable variations in performance across districts.

NSW Health has not fully rolled out more efficient models for planned surgery

NSW Health has successfully trialled initiatives like surgery hubs and pooled waitlists to boost planned surgery efficiency but these are yet to be implemented across the state. NSW Health is focused on eliminating low-value surgical procedures that are not supported by strong clinical and patient outcome evidence.

NSW Health’s planned surgery access policy supports effective waitlist management

The planned surgery access policy provides clear directives on waitlist management and scheduling surgery in line with the ‘treat in turn’ principle and clinical urgency categories. Recent updates to the policy strengthen clinical governance review requirements and provide guidance that aligns with NSW Health’s efforts to increase planned surgery efficiency.

Despite local control weaknesses, NSW Health waitlist data can be relied upon

The administration of local planned surgery waitlists is reliant on manual data entry without automatic system checks. However, a system of structured clerical reviews mostly compensates for the control weaknesses. Waitlist data collected by NSW Health is suitable as a record of planned surgery access performance to inform decision-making.

Recommendations

The audit makes 3 recommendations to NSW Health.

• Define additional efficiency performance targets for inclusion in service agreements with local health districts.
• Identify and determine the planned surgery service delivery models that achieve greater efficiencies and surgical throughput, and target policy and investment accordingly.
• Develop additional risk-based guidance for local health districts to conduct regular reviews of waitlist management and compliance.

Further information

Please contact Renee O'Kane, Chief of Staff, on 9275 7347 or by email.

Objective

This audit assessed whether the NSW Police Force efficiently and effectively planned and sourced key components to upgrade core policing technology systems.

Key findings

The NSW Police Force did not effectively plan and has not yet delivered the program

By December 2025, the NSW Police Force had spent over $155 million delivering some essential technology upgrades and replacing only 1 of 5 core systems in full, with most functions still dependent on outdated platforms.

The contract was awarded to a supplier that posed a high delivery risk

The NSW Police Force conducted a structured and competitive procurement that complied with NSW Government requirements. However, despite warnings from advisers and gateway reviews, it proceeded with a supplier whose solution promised operational benefits even though it posed known capability and delivery risks.

Supplier non‑performance caused delays and costs with no ongoing benefit

The selected supplier was unable to deliver key system components. The NSW Police Force terminated the contract in 2022 after significant delays and expenditure.

There was no effective oversight of timelines, budget controls or risks

Following contract termination, the NSW Police Force did not maintain effective governance, capability or appropriate financial controls. This slowed decision making and prolonged reliance on legacy systems.

The NSW Police Force reset the program in mid-2024, reducing program delivery risks

Since mid-2024, there have been significant improvements to governance and program management, and the NSW Police Force has developed an enterprise digital strategy. These have stabilised the program.

The NSW Police Force estimates it needs additional funding to deliver the program

The program delivery date is now June 2031, 4 years later than originally planned. The NSW Police Force estimates that it will need an additional $78 million in capital funding and $415 million in recurrent funding to deliver the program. 

Recommendations

The NSW Police Force should demonstrate effective program governance throughout the remaining life of the program and incorporate lessons learnt to manage risks to ensure program success.

Further information

Please contact Renee O'Kane, Chief of Staff, on 9275 7347 or by email.

Objective

This audit assessed the efficiency and effectiveness of NSW Health’s oversight and assurance of arrangements to engage and accurately remunerate Visiting Medical Officers (VMOs).

Key findings

NSW Health does not provide coordinated statewide governance of VMO engagement and remuneration

While there are established policies for VMO engagement and remuneration, these do not operate as an integrated governance framework across each stage. System stewardship elements including statewide oversight, monitoring, reporting and assurance are not in place.

NSW Health does not assess the long-term financial or workforce impacts of VMO use

There is an absence of statewide workforce planning or value for money criteria to guide Local Health Districts (LHDs) on when and how VMOs should be used. District decisions on VMO engagement are largely driven by short-term service needs.

LHDs do not have effective internal controls over VMO payments

There are significant and persistent weaknesses in NSW Health’s payment controls. These include failures to segregate claims checking from claims payment duties, limited oversight of higher-risk arrangements and insufficient monitoring of excessive hours or potential double billing. These weaknesses increase the risk of error, inappropriate payments and fraud.

Weaknesses in IT systems and data controls undermine compliance with policy

NSW Health practices for processing VMO claims undermine the accuracy and integrity of payments, including extensive use of ‘miscellaneous’ claim categories, lack of validation against Medicare item codes and inconsistent application of aged-claim discounting.

NSW Health does not monitor or report on VMO arrangements 

There is a lack of routine, system-wide monitoring of VMO arrangements, including expenditure, compliance and emerging risks. NSW Health has limited visibility over the effectiveness of controls operating within LHDs. Decision making is not informed by consistent, reliable or comprehensive information.

Assurance methods are reactive and fail to quickly identify and address system-wide risks

NSW Health relies on LHDs to undertake assurance activities at the district level and has not routinely analysed or aggregated results across the state. This limits the timely identification and resolution of system-wide risks. Governance reforms are at an early stage of implementation and have not yet delivered effective system-wide assurance.

NSW Health is strengthening its system-wide oversight of the use of VMOs

NSW Health has recently undertaken work to improve assurance, monitoring and reporting for VMO engagement and remuneration. This includes an internal audit and legal review which are in the early stages of completion.

Recommendations

The report makes 3 recommendations targeted at strengthening system-wide governance, assurance, value for money consideration and controls for VMO engagement and remuneration.

Further information

Please contact Renee O'Kane, Chief of Staff, on 9275 7347 or by email.

Objective

This audit assessed whether Transport for NSW (TfNSW) is effectively administering the $334 million Regional Roads Fund (RRF). 

To date, $320.4 million has been allocated from the fund, comprising: 

• $215 million for 10 projects led by TfNSW 
• $105.4 million to 11 local councils to deliver 19 projects. 

Most of the RRF projects are election commitments.

Key findings

Projects led by TfNSW are being managed within the existing TfNSW governance framework

TfNSW manages RRF projects using established delegations and governance processes. Internal budget approvals and reporting are consistent with these delegations, and they are overseen and monitored by internal committees. 

TfNSW has also responded to government expectations to accelerate the delivery of its RRF projects.

TfNSW did not provide detailed evidence to support the allocation of additional project funding

At the time additional funding was approved, TfNSW had not completed project business cases or short form assessments to inform project assumptions, expected benefits and estimated project costs.

TfNSW projects are not following typical assurance lifecycles, increasing risk

TfNSW sought and released funding for some TfNSW-led projects earlier than is typical in its project development and delivery lifecycle, and approved contingency funding amounts above indicated levels in its policies. This increases project and budget risks.

TfNSW did not comply with some aspects of the Grants Administration Guide

TfNSW did not put in place practices and procedures to comply with the Grants Administration Guide when developing and issuing funding agreements to local councils. It also did not comply with other mandatory requirements of the Guide.

TfNSW has not defined outcomes to guide the administration of the RRF

TfNSW has not documented the expected outcomes of the expenditure to guide administration of the fund. This includes prioritisation of funding for project variations and new projects. 

Recommendations

The audit recommends that TfNSW: 

• strengthen documentation to support funding decisions 
• clearly define RRF outcomes 
• design and implement a process for one-off and ad hoc grants to ensure compliance with the Grants Administration Guide.

Further information

Please contact Renee O'Kane, Chief of Staff, on 9275 7347 or by email.