Report snapshot

Objective

Internal controls and governance support operations, compliance with legal obligations and reliable financial statements. This report analyses the internal controls and governance arrangements of 26 of the NSW Government’s largest agencies.

Key findings

Repeat findings continue to increase

Interim audits found weaknesses in internal controls and governance at 15 agencies. More findings now relate to high-risk, high-spend areas such as procurement and grants. Repeat findings increased from 33% to 42% of total findings.

Oversight of grant programs by agencies is weak

Most agencies have limited central oversight and monitoring of grants administration, including how they monitor delivery, reporting and financial management.

Some agencies have deficiencies in frameworks for due diligence checks, acquittal controls, evaluations and reconciliations between program records and grant disbursements. This weakens the level of assurance over financial accountability of public funds and limits agencies’ ability to demonstrate that grants were used for their intended purpose.

Agencies are not effectively engaging and reporting on consultants

Agencies did not always document the justification for hiring consultants, assess their performance or obtain conflict of interest declarations. Thirteen percent of sampled engagements did not include clauses relating to confidentiality to protect government information.

Mandatory annual reporting captures only a small share of payments to firms that provide consulting services, as payments for other professional service types are excluded. Agencies omitted at least $18.3 million in consultancy expenditure from their annual report disclosures since 2023–24.

High-risk purchasing card transactions require more scrutiny

Purchasing card transactions included vendors that sell gift cards, entertainment, alcohol and tobacco products.

Personal, non-compliant and split purchases were made on purchasing cards. This points to weaknesses in acquittal controls. One in 5 transactions were not acquitted and approved within 30 days, limiting oversight.

Significant gaps remain in compliance with Cyber Security Policy requirements limiting effective oversight

Less than half of agencies reported compliance with requirements to protect and govern their risk exposure. Some agencies did not assess risks from legacy systems that cannot be patched, increasing their exposure to cyber-attack.

Strategic use and assurance of AI is limited

Agencies have limited visibility over AI use as they did not consistently register all AI use cases or centrally track costs. Governance is not keeping pace with the speed at which agencies are adopting AI.

Recommendations

The report makes 4 recommendations for stronger internal controls and governance for grants administration, purchasing cards, cyber security and AI oversight.

Further information

Please contact Renee O'Kane, Chief of Staff, on 9275 7347 or by email.

Objective

This audit assessed the effectiveness of the Greyhound Welfare and Integrity Commission’s (GWIC) regulatory actions to promote and protect greyhound welfare.

Key findings

GWIC does not clearly communicate its regulatory approach or welfare outcomes

GWIC has not clearly explained changes to its strategic priorities and does not provide current guidance on how it targets its regulatory activities. GWIC has not established a performance framework that links its regulatory work to intended outcomes. This limits its ability to demonstrate whether its regulatory activities are improving greyhound welfare.

GWIC has improved greyhound monitoring and enforcement activities

GWIC has prioritised greyhound welfare in its strategic planning. It has enhanced its systems, improving the tracking and visibility of the greyhound population. This has supported its regulatory activities, including enforcement action in serious welfare cases.

GWIC responds to individual compliance risks but conducts limited industry–wide activities

GWIC uses a structured risk-based approach to prioritise and respond to individual compliance matters. However, it does not regularly conduct industry-wide compliance activities such as inspection programs. This limits GWIC’s ability to detect emerging risks, encourage voluntary compliance and target regulatory effort across the industry.

Inefficient case management has led to reduced penalties for welfare breaches

GWIC has imposed serious penalties for welfare breaches, including long suspensions, disqualifications and lifetime bans. However, in some cases, inefficient case management caused significant delays, resulting in reduced penalties.

Weaknesses in GWIC’s enforcement processes reduce regulatory effectiveness

There are weaknesses in GWIC’s documented policies and procedures, as well as in staff training and development. This increases the risks of inconsistent inspection and investigation practices and of procedural errors that may affect subsequent enforcement action. Weaknesses in IT controls increase the risk of incomplete or unreliable regulatory information.

Recommendations

The audit made 5 recommendations to GWIC to:

• publish its regulatory intent and evaluate greyhound welfare outcomes through performance measures
• strengthen its use of data and outcome reporting
• improve compliance and enforcement processes
• address weaknesses in IT controls
• improve staff development and safety arrangements.

Further information

Please contact Renee O'Kane, Chief of Staff, on 9275 7347 or by email.

Objective

This audit assessed how effectively the NSW Department of Education (the department) and NSW public schools (schools) protect the security and privacy of student information. 

Key findings

The department has established a range of controls to manage the security and privacy of student information

Over the last 3 years, the department has strengthened its controls by uplifting cyber security capability, centrally contracting key third-party IT vendors, developing specific policy frameworks, and providing professional learning and centralised supports for schools.

Technical responsibilities have been allocated to school principals without sufficient departmental oversight

The department does not clearly define the specific risks to student information that schools must manage, nor provide clear operational guidance or proactive support to monitor how legislative and policy requirements are met in practice at the school level. With principals relying on their own judgement and capacity, practices are inconsistent and in some cases non-compliant.

There are gaps in how schools apply the department’s staff access controls to systems

The department’s controls do not ensure that access to student information is limited to staff who need it for their role. Schools apply access controls inconsistently, and some staff access more information than they need or retain access after they leave a school. The department does not oversee or control staff access to third‑party school administration systems, which hold large amounts of student information.

Some schools use third-party digital products without departmental oversight

The department’s marketplaces give schools a range of approved third-party digital products for school administration and online learning. It centrally manages contracts with third-party vendors, including terms to protect the security and privacy of student information. However, some schools use third-party products outside of these marketplaces and without departmental oversight or controls to protect student information.

The department does not independently assure third-party digital products in its marketplaces

While third-party vendors of digital products in department’s marketplaces are subject to contractual security and privacy controls, the department does not routinely verify vendor compliance.

The department only recently identified key third-party systems as ‘crown jewels’

The department did not classify Compass, SchoolBytes and Sentral – the third-party systems used by more than 98% of schools to manage student information – as ‘crown jewels’ until early 2026. The department is now implementing the higher levels of oversight, assurance and protective controls that apply to crown jewels.

Recommendations

The audit made recommendations for the department to review the allocation of responsibilities to principals, improve the guidance and supports for schools, and strengthen the controls for managing the access to and use of student information.

Further information

Please contact Renee O'Kane, Chief of Staff, on 9275 7347 or by email.

Overview

This audit examined whether the Department of Primary Industries and Regional Development’s (DPIRD) Make the Move 2024–25 advertising campaign was carried out effectively, economically and efficiently, and in compliance with the Government Advertising Act 2011 (the Act), Government Advertising Regulation 2024, and the NSW Government Advertising Guidelines.

Key findings

The campaign largely complied with the mandatory requirements

The campaign largely met legislative requirements, was supported by analysis and research, and was an efficient and cost-effective way to achieve a public purpose. Compliance certificates issued by the Secretary did not address the cost–benefit analysis requirement.

DPIRD did not complete a cost-benefit analysis before commencement of the campaign

DPIRD interpreted the cost–benefit analysis requirement as applying to campaigns with annual budgets exceeding $1 million, consistent with advice it received from the Department of Customer Service (DCS).

The Act requires agencies to consider the total cost of a campaign over its duration. It does not limit this assessment to annual budget allocations.

In the absence of a cost–benefit analysis, DPIRD could not demonstrate that the campaign represented value for money.

The campaign exceeded its relocation target and largely achieved positive outcomes

The campaign increased Make the Move website traffic by 16%, lifted The Welcome Experience registrations by 44% to around 4,700, and exceeded its relocation target, with 1 in 4 registrants moving to regional NSW.

The campaign did not meet targets for key attitudinal measures, including relevance, engagement, believability, and serious consideration of relocating to regional NSW.

Post-campaign evaluation and effectiveness assessment was delayed

DPIRD’s campaign effectiveness reports were submitted late in both years of the campaign due to delays from the media agency, highlighting the need for better management of third‑party dependencies to support timely evaluation and peer review.

Recommendations

The audit makes 2 recommendations:

• DPIRD should complete a cost–benefit analysis before launching future advertising campaigns likely to exceed $1 million over one or more financial years. It should complete compliance certificates after all regulatory requirements are met.
• DCS should ensure its advice and guidance clearly communicate agencies’ obligations under the Act, including the requirement to complete a cost-benefit analysis for campaigns likely to exceed $1 million over one or more financial years.

Further information

Please contact Renee O'Kane, Chief of Staff, on 9275 7347 or by email.

Overview

This audit assessed whether Port Stephens Council and Armidale Regional Council are developing and monitoring their Long-Term Financial Plans (LTFP) to ensure their strategic goals can be achieved sustainably.

Port Stephens Council

The LTFP complies with all requirements except scenario modelling

Port Stephens Council’s LTFP includes most of the essential elements set out by the Office of Local Government (OLG). While the 2024–34 and 2025–35 LTFPs did not include the required scenario modelling, the draft 2026–36 LTFP includes this modelling.

The LTFP is incorporated with other Integrated Planning and Reporting documents

The Council’s LTFP is incorporated with most of the other Integrated Planning and Reporting (IP&R) documents, including the Delivery Program, the Strategic Asset Management Plan and the Workforce Management Strategy. 

The Council uses reliable data and modelling to develop its LTFP

The Council uses relevant data from reliable sources to develop its LTFP. However, there are some inconsistencies between the assumptions documented in the LTFP and the assumptions used for the financial model.

Armidale Regional Council

The LTFP complies with requirements but financial modelling is limited

Armidale Regional Council’s LTFP includes the essential elements set out by the OLG. However, the sensitivity analysis and scenario modelling lack detail.

The LTFP is not incorporated with other Integrated Planning and Reporting documents

The Council’s LTFP is not used to develop its Operational Plan and Delivery Program. The LTFP does not incorporate the full costs of the Council’s infrastructure plans or Workforce Management Strategy. This limits the completeness of the LTFP as it does not fully reflect the Council’s planned expenditure.

There are deficiencies in the asset data used to inform the LTFP

Deficiencies in the Council’s asset data limit the reliability of operational and capital expenditure forecasts in its LTFP. The Council has not taken action to address these deficiencies, such as regular asset inspections and investing in an asset management information system.

Recommendations

The report makes 3 recommendations to Port Stephens Council and 5 recommendations to Armidale Regional Council to improve their long-term financial planning processes.

Further information

Please contact Renee O'Kane, Chief of Staff, on 9275 7347 or by email.

Overview

This audit assessed the effectiveness of the Department of Climate Change, Energy, the Environment and Water (DCCEEW), the Natural Resources Access Regulator (NRAR) and WaterNSW in implementing compliance and enforcement measures for the sustainable and integrated management of non-urban water use in NSW. 

Key findings

There have been significant reforms to address deficiencies in water regulation

Reforms include the establishment of NRAR and the progressive implementation of non-urban water metering and licensing for floodplain harvesting.

The complexity of the reform agenda has posed challenges for effective regulation

The complexity of the reform agenda has reduced clarity about obligations for some water users. This has undermined efforts to promote voluntary compliance and confidence in the regulation of the sector.

DCCEEW has not assessed the outcomes of water regulation reforms 

DCCEEW conducted regulatory impact assessments of some reforms before they were implemented. However, it has not assessed the cumulative impact and the economic, social and environmental outcomes of the reforms.

Significant deficiencies in IT systems limit the oversight of outcomes and risks

Regulation of water management is dependent on IT systems maintained by WaterNSW, including some that were in use before it was established.

These systems were intended to manage water accounts, and were not for regulatory and enforcement purposes. The water agencies have identified significant data quality and access issues with these systems and have taken some steps to address them. 

While the agencies have developed a collaborative plan to address these IT issues, implementation of this plan is subject to governance approval and the availability of funding.

NRAR has developed a policy architecture with supporting technologies

NRAR has comprehensive regulatory policies and procedures, and it has developed capability and advanced operational technology to support its regulatory functions.

NRAR needs to improve how it measures and reports on its regulatory outcomes

The quality and governance of NRAR’s activity data is poor and the regulator lacks adequate performance measurement and reporting. This impacts its ability to demonstrate its effectiveness as a regulator and hinders its use of data as a valuable organisational asset.

Recommendations

The audit makes 4 recommendations. These are intended to ensure a better understanding of the cumulative impact of regulatory changes, resolve deficiencies with core IT systems necessary for effective regulation, and ensure that the regulator has an outcomes-focused approach to demonstrating its performance.

Further information

Please contact Renee O'Kane, Chief of Staff, on 9275 7347 or by email.

Overview

This report presents key findings and recommendations from financial audits of NSW public universities for the year ended 31 December 2025.

Key findings

Clean audit opinions were issued for all 10 universities.

Control deficiencies were most common in IT/cyber security, governance and payroll

There were 94 reported audit findings and most related to poor monitoring of IT/cyber security risks, inadequate governance oversight and deficiencies in payroll management.

Nearly 24% of consultancy engagements reviewed were directly sourced

Direct procurement sourcing minimises the opportunity for competition and value for money. All engagements directly sourced were approved within the university’s procurement policy exemptions except in one instance. Universities spent $139 million on consultant expenses, including $46.2 million collectively on 2 firms.

Lack of oversight for contingent labour hire

Universities collectively spent more than $217 million on contingent labour. However, central oversight is limited. Only 3 universities had formal policies governing contingent workers and 4 maintained a register of all contingent workers.

Domestic student revenue does not cover operating costs

Operating costs per student of $37,868 exceeded the average revenue per domestic student of $25,213, representing a 33% deficit margin. In contrast, average overseas student revenue of $41,381 exceeded cost, representing a 9% surplus margin.

Processes to obtain conflict of interest declarations are inadequate

Four universities did not require annual conflict of interest declarations from all employees and did not update their central conflicts of interest registers annually. Three universities did not require nil returns from senior executives, elevating the risk of undeclared conflicts.

There were undeclared employee interests in companies that are university vendors

We identified over 790 instances of employees with directorships in companies that were university vendors, of which 30% of instances reviewed could not be found on the conflict of interest register.

Weaknesses in managing legacy system risks

One university has no processes to manage IT legacy systems, and 6 universities have not formally assessed legacy system risks.

Universities continue to grapple with the complexities of adopting artificial intelligence

Three universities still do not have a formalised AI policy. Only 2 universities had procurement guidance in place for AI-related procurement.

Recommendations

The report makes 6 recommendations to improve procurement processes, strengthen contingent labour hire management, enhance policies and procedures for managing conflicts of interest and progress AI governance maturity.

Further information

Please contact Renee O'Kane, Chief of Staff, on 9275 7347 or by email.

Objective

This audit assessed whether the NSW Reconstruction Authority (the Reconstruction Authority) is effectively administering the Resilient Homes Program (RHP) and the Resilient Lands Program (RLP) to meet the programs’ objectives.

Key findings

The Resilient Homes and Resilient Lands Programs were not effectively planned

Key elements of planning were not undertaken before the RHP and the RLP were rolled out, including the development of detailed project plans and risk mitigations. This had a significant impact on their ongoing implementation and led to delays. There was no business case or cost-benefit analysis to inform the design and establishment of the programs.

The Reconstruction Authority is prioritising Resilient Homes Program funding based on risk

The approach adopted in June 2023 has ensured that funding is targeted to the RHP properties assessed as having the highest flood risk.

The Reconstruction Authority has reallocated funding from buybacks to increase the number of resilient measures

Following the increase in the RHP budget to $880 million, the Reconstruction Authority estimated that it would be able to support 1,345 buybacks and 420 resilient measures. 

In August 2025, it re-profiled program funding to work towards 1,000 buybacks and 600 resilient measures. This change was informed by community and local council feedback.

There have been persistent delays in the Resilient Homes Program

During early implementation of the RHP, it became clear that additional policy work was required, including the need for procedures on home relocations and the gifting of homes. This additional work, as well as changes to the delivery model for the resilient measures stream, contributed to delays in delivery.

The Reconstruction Authority has not effectively administered the Resilient Lands Program

The RLP was designed to help meet the demand for land and housing as estimated when the program was established. There have been significant delays in program delivery, including in finalising the Resilient Lands Strategy, and the program is yet to deliver any land for housing.

Recommendations

The report makes 5 recommendations for the Reconstruction Authority, including identifying opportunities to accelerate delivery of the RLP, improve planning for future disaster recovery and to ensure the appropriate use of bought-back land. These recommendations are outlined in Chapter 2.

Further information

Please contact Renee O'Kane, Chief of Staff, on 9275 7347 or by email.

Objective

This audit assessed whether NSW Health efficiently and effectively provides access to planned surgery (also known as elective surgery) to public patients.

Key findings

NSW Health has mostly cleared the backlog of patients caused by pauses to planned surgery during COVID-19

Non-urgent planned surgery was paused several times during the COVID-19 pandemic between March 2020 and January 2022. This resulted in a backlog of overdue planned surgery patients, reaching a peak of almost 19,000 patients overdue for planned surgery in April 2022. At the end of the audit period in December 2025, this has dropped to approximately 3,900 overdue patients.

NSW Health is not completing planned surgery for all patients within clinically recommended timeframes

In 2024–25, only 4 of the 17 local health districts and specialty health networks met the goal of zero patients waiting longer than clinically recommended for surgery. There are also considerable variations in performance across districts.

NSW Health has not fully rolled out more efficient models for planned surgery

NSW Health has successfully trialled initiatives like surgery hubs and pooled waitlists to boost planned surgery efficiency but these are yet to be implemented across the state. NSW Health is focused on eliminating low-value surgical procedures that are not supported by strong clinical and patient outcome evidence.

NSW Health’s planned surgery access policy supports effective waitlist management

The planned surgery access policy provides clear directives on waitlist management and scheduling surgery in line with the ‘treat in turn’ principle and clinical urgency categories. Recent updates to the policy strengthen clinical governance review requirements and provide guidance that aligns with NSW Health’s efforts to increase planned surgery efficiency.

Despite local control weaknesses, NSW Health waitlist data can be relied upon

The administration of local planned surgery waitlists is reliant on manual data entry without automatic system checks. However, a system of structured clerical reviews mostly compensates for the control weaknesses. Waitlist data collected by NSW Health is suitable as a record of planned surgery access performance to inform decision-making.

Recommendations

The audit makes 3 recommendations to NSW Health.

• Define additional efficiency performance targets for inclusion in service agreements with local health districts.
• Identify and determine the planned surgery service delivery models that achieve greater efficiencies and surgical throughput, and target policy and investment accordingly.
• Develop additional risk-based guidance for local health districts to conduct regular reviews of waitlist management and compliance.

Further information

Please contact Renee O'Kane, Chief of Staff, on 9275 7347 or by email.

Objective

This audit assessed whether the NSW Police Force efficiently and effectively planned and sourced key components to upgrade core policing technology systems.

Key findings

The NSW Police Force did not effectively plan and has not yet delivered the program

By December 2025, the NSW Police Force had spent over $155 million delivering some essential technology upgrades and replacing only 1 of 5 core systems in full, with most functions still dependent on outdated platforms.

The contract was awarded to a supplier that posed a high delivery risk

The NSW Police Force conducted a structured and competitive procurement that complied with NSW Government requirements. However, despite warnings from advisers and gateway reviews, it proceeded with a supplier whose solution promised operational benefits even though it posed known capability and delivery risks.

Supplier non‑performance caused delays and costs with no ongoing benefit

The selected supplier was unable to deliver key system components. The NSW Police Force terminated the contract in 2022 after significant delays and expenditure.

There was no effective oversight of timelines, budget controls or risks

Following contract termination, the NSW Police Force did not maintain effective governance, capability or appropriate financial controls. This slowed decision making and prolonged reliance on legacy systems.

The NSW Police Force reset the program in mid-2024, reducing program delivery risks

Since mid-2024, there have been significant improvements to governance and program management, and the NSW Police Force has developed an enterprise digital strategy. These have stabilised the program.

The NSW Police Force estimates it needs additional funding to deliver the program

The program delivery date is now June 2031, 4 years later than originally planned. The NSW Police Force estimates that it will need an additional $78 million in capital funding and $415 million in recurrent funding to deliver the program. 

Recommendations

The NSW Police Force should demonstrate effective program governance throughout the remaining life of the program and incorporate lessons learnt to manage risks to ensure program success.

Further information

Please contact Renee O'Kane, Chief of Staff, on 9275 7347 or by email.