Human resources practices can support the development and maintenance of an integrity culture. Certain practices can contribute to preventing and detecting fraud and corruption, including:
- employment screening of potential candidates
- annual processes for declaring private interests
- conflict of interest declaration processes in recruitment panels
- management of offers of gifts, benefits and hospitality.
We assessed whether these controls were effectively implemented for MPV, MMRA and PTV staff. We also assessed the role of the DEDJTR Integrity Services Unit in overseeing gifts, benefits and hospitality processes and maintaining a central register of declarations of private interest.
Policies and processes are in place to conduct employment screening, manage conflicts of interest, and record offers of gifts, benefits and hospitality. However, these controls are not always operating as intended. Noncompliance with human resources policies and poor record keeping are undermining their effectiveness, leaving MMRA and PTV, and previously MPV, vulnerable to fraud and corruption.
In some instances, controls stopped at data collection and did not reflect an active process for using and monitoring information to detect noncompliance and potential fraud and corruption.
Although the DEDJTR Integrity Services Unit collects data on gifts, benefits and hospitality and declarations of private interest, we identified instances in 2016 and early 2017, where the unit knew of noncompliance but did not act in response. DEDJTR has advised that it has strengthened its processes since this time.
3.2 Employment screening
Screening potential employees provides a sense of an individual's personal integrity and highlights past behaviour that could indicate a fraud and corruption risk.
We assessed whether human resources functions consistently screened MPV, MMRA and PTV staff through police checks and reference checks and by confirming that candidates held the mandatory qualifications needed to perform a role.
Employment screening processes
Although employment screening policies and procedures were in place, human resource teams could not demonstrate that they fully implemented them while screening MPV, MMRA and PTV staff. Our testing highlighted deficiencies, including the failure to complete and document police checks, reference checks and qualification checks, or to respond appropriately when checks identified anomalies. Figure 3A describes an example of poor implementation of the employment screening policy.
Case study: Poor implementation of employment screening policy
This entity identifies the falsification of employment history, qualifications and skills as a medium risk. It uses qualification checks to manage this risk.
A1 applied for a position as a technical specialist in April 2016. The position description for the role stated that 'A degree qualification in engineering or related discipline is mandatory.' A1 stated on their resume that they held a completed, relevant qualification from an overseas institution.
The role description required the successful candidate to:
The entity conducted a qualification check that revealed that A1 did not hold the qualification. A1 had undertaken one year of the course and then withdrew without completing. The recruitment panel decided to employ A1 in October 2016 given A1's extensive relevant experience, on the condition that A1 complete the qualification while working. The agency also offered financial assistance to A1 to do so.
A1 did not hold the mandatory qualification, as required by the position description, and provided misleading information to the entity on their resume. Under the DEDJTR employment screening policy in place at the time, the entity should have escalated this matter to a three-person DEDJTR assessment panel, which includes an assistant director from the DEDJTR Integrity Services Unit. This did not occur and the DEDJTR Integrity Services Unit was unaware of the matter. A1 subsequently left the entity after three months, without enrolling to study the required qualification.
In response to this case study, the entity has commenced a review, which will confirm evidence of qualification checks for technical specialists for the past 12 months and is due for completion in March 2018.
Employment screening processes for MPV, MMRA and PTV staff were strengthened in 2016 but these new processes only apply to new external applicants. Longstanding employees can move between roles in MMRA and PTV and are not required to undergo a police or qualifications check, with the exception of employees moving into financial delegate roles in MMRA.
Currently there are no processes that identify existing staff who commit a criminal offence. There are also no processes to identify staff who do not hold a required qualification.
Only a small number of staff commenced at MPV after the 2016 employment screening changes. Therefore, only a small sample of relevant personnel files were available to us. Human resources could not produce records to demonstrate that it had completed police checks for three of the five staff sampled, all three being contractors, and could only provide evidence of reference checks for two of these staff. Record keeping of employment screening documentation was poor. In one case, human resources could produce the application for a police check, but not the record of result.
In 2017 the DEDJTR Integrity Services Unit commissioned an internal audit of its employment screening processes to provide assurance over DEDJTR's recruiting and contracting processes and decisions. This decision followed reports released by IBAC and the Victorian Ombudsman in June 2017. The final internal audit report is consistent with the findings identified by our audit. The DEDJTR internal audit found:
- police checks were not conducted for two contractors
- recruitment and contracting processes do not adequately incorporate integrity requirements
- the process for identifying, declaring and managing conflicts of interest as part of recruitment and contracting was not consistently applied, with no declarations able to be provided for the sample tested.
The internal audit recommended that DEDJTR consider:
- revising its current policy requirements to enable police checks to be conducted prior to internal promotions
- performing an analysis of current contractors holding senior positions to determine the extent to which police checks had not been conducted on these individuals and arrange for these to be completed
- reviewing its contracting and recruiting processes to better align with VPSC requirements
- reviewing its conflict of interest and recruitment policies to include further guidance on how conflicts of interest are to be reported and managed during recruitment processes.
DEDJTR has accepted the recommendations with a view to implementing them by 31 August 2018.
MMRA maintains its own human resources function. MMRA has strong employment screening processes and requires all financial delegates to undergo police checks upon appointment, rather than only new employees. This is not a requirement for PTV or former MPV staff and reflects stronger controls. MMRA provided evidence for all sampled qualification and referee checks. However, poor record keeping meant MMRA could not demonstrate full compliance with the police check requirement. Testing found that nine of 20 sampled financial delegates had either not been subject to the required police checks or that evidence of the checks had not been retained. MMRA has now ensured that all current financial delegates have been subject to required police checks.
PTV has introduced stronger requirements for its employment screening processes over time. However, in many instances PTV Human Resources could not demonstrate compliance, meaning these processes are not working as an effective control. From a sample of 13 employees whose position descriptions required mandatory qualifications, PTV could not provide evidence of qualification checks for 11 of the employees. From a sample of 20 employees requiring a police check, PTV could not provide evidence that it completed a check for five of these employees. For the checks that were completed, PTV conducted some of these after the employee had started work at PTV, undermining the importance of this control. PTV could not provide evidence of an appropriate referee check for one employee from a sample of 10.
3.3 Declarations of private interests
All employees have private interests, but sometimes these interests can conflict with the performance of their public duties. Certain employees must outline their private interests through an annual declaration process. Management must put action plans in place if there is potential for a conflict of interest to occur and both the conflicts and plans must be recorded in a register. Information in this register should be up-to-date and accessible to ensure compliance and to continuously determine whether conflicts exist as employees move from project to project.
The DEDJTR Integrity Services Unit maintains a register of annual declarations of private interests for over 1 100 staff in designated positions, including in MMRA and MPV. PTV maintains its own register. We assessed whether the DEDJTR Integrity Services Unit and PTV were maintaining registers, and where appropriate, effectively managing declarations. Our assessment of the Integrity Services Unit's management of this process was limited to its handling of MPV and MMRA staff declarations.
Data in the registers for PTV, MMRA and MPV staff were in some instances poor, including entries that were incomplete and inaccurate. This could limit the ability of management to monitor declared interests and enforce action plans. There is a risk of the annual declaration of private interests process being reduced to a compliance activity, as opposed to an active and ongoing process of controlling for conflicts of interest in an organisation. Appropriate action needs to be taken to improve the data quality in the registers and ensure ongoing monitoring.
DEDJTR Integrity Services Unit
The DEDJTR Integrity Services Unit requires all employees and contractors in designated positions at MMRA and MPV to complete an annual declaration of private interests for inclusion in its Conflict of Interest Register. This process reinforces the Code of Conduct, which requires staff to avoid conflicts of interest.
In 2016–17, the Integrity Services Unit's work plan identified the need to digitalise a manual declaration of private interests process, which involved approximately 1 200 staff employees and contractors. Designated positions for completion of declaration of private interests include:
- all executive officer positions
- positions with a financial delegation of $50000 and above
- senior technical specialists, including principal scientists and engineers.
The DEDJTR Integrity Services Unit could not produce copies of all required declarations for all financial delegates:
- From a sample of nine staff who were required to complete a form in 2016, DEDJTR was unable to provide declarations for two MPV staff with financial delegations of $50000 and $2 million.
- From a sample of 21, DEDJTR was unable to provide declarations for three MMRA staff.
The DEDJTR Integrity Services Unit is currently completing its review of the 2017–18 register. It is the unit's intention to conclude its review by preparing a report for each division which details reported private interests and associated management plans.
PTV maintains its own conflict of interest register. PTV could produce all the declaration forms for our sample, demonstrating its commitment to the declaration of private interest process. However, we did note some data quality issues in the register. For example, one employee stated that they 'held shares' without providing more information that would help determine whether a conflict existed. While PTV demonstrated that it reviewed and reported on declared conflicts, it could improve the quality of data in the register to better support external scrutiny and ensure action plans are enforced.
Conflict of interest management plans
Management must actively monitor plans to manage declared conflicts to ensure compliance.
The case studies in Figures 3B and 3C demonstrate where a conflict of interest has not been effectively managed.
Case study: Poorly managed conflict in procurement activities
A project director declared to the agency that their spouse worked for a vendor that provided goods and services to the agency. No management plan was in place. Despite this conflict, the project director sat on evaluation panels and approved a contract variation relating to this vendor. See the case study in Figure 4B.
Case study: Failure to comply with management plan
An agency executive was a previous employee of a consulting firm and held $20 000 worth of shares in the company that owned the firm. The agency executive declared this conflict and the agency developed a management plan, requiring the executive to seek probity advice if they were to be involved in any way with the consulting firm. The agency executive failed to comply with this management plan and endorsed a recommendation for approval to proceed with an engagement for a contract worth $3.9 million. See the case study in Figure 4A.
3.4 Conflict of interest in recruitment panels
Hiring based on relationships, rather than merit, is a form of corruption that agencies must actively prevent. DEDJTR's policy is consistent with VPSC conflict of interest guidance, which require staff involved in recruitment activities to complete a conflict of interest declaration to identify any relationships between a recruitment panel member and the candidates they are to assess. Officers must complete these declaration forms, regardless of whether a conflict exists. This process provides a level of transparency to ensure recruitment panel members act with impartiality and integrity when hiring staff.
We assessed a sample of recruitment activities of MPV, MMRA and PTV staff to determine if controls existed for potential conflicts of interest between recruitment staff and candidates.
Poor record keeping meant that we could not identify any conflict of interest considerations in recruitment panels for a sample of MPV staff. The DEDJTR Integrity Services Unit advised that in the absence of conflict of interest declarations for recruitment panel members, it relied on obligations in the Victorian Public Sector Code of Conduct for staff to disclose conflicts voluntarily. However, this practice is inconsistent with VPSC requirements endorsed by VSB that necessitate a declaration be made for every recruitment activity. Without signed declarations, MPV was not considering or actively controlling for conflicts of interest influencing the hiring of MPV staff.
Prior to November 2017, MMRA's conflict of interest policy did not require members of the recruitment panel to sign a conflict of interest declaration when undertaking recruitment activities unless they identified a conflict and volunteered a declaration. This practice was inconsistent with VPSC requirements. Prompted by this audit, in November 2017 MMRA amended its practices and now requires all panel members to complete conflict of interest declarations specific to the candidate they are assessing.
Conflict of interest processes in PTV recruitment activities have varied over time. Currently, panel members are required to sign conflict of interest declarations at the end of their interview notes, which is consistent with VPSC requirements. For this current process, PTV could provide all interview notes sampled, detailing the conflict of interest declaration relating to the recruitment activity.
3.5 Management of gifts, benefits and hospitality
External parties sometimes make offers of gifts, benefits and hospitality to public sector officers. To ensure staff remain impartial when making decisions about how public resources are spent, the VPSC requires agencies to develop policies governing how their staff should respond to these offers.
At a minimum, up-to-date registers of offers of gifts, benefits and hospitality need to be maintained and data analysed to monitor compliance with policies, to identify patterns of behaviour and take action where appropriate.
Current VPSC requirements for the management of gifts, benefits and hospitality, which came into effect in October 2016, require public sector officers to:
- provide written evidence of approval from a manager for acceptance of offers worth more than $50
- decline all offers from current or potential suppliers
- decline offers of money or gift vouchers
- document a clear business reason for attending events.
We assessed whether gifts, benefits and hospitality policies and processes for MPV, MMRA and PTV were consistent with VPSC guidance and were complied with.
Offers of gifts, benefits and hospitality
MPV, MMRA and PTV all maintained gifts, benefits and hospitality registers. The number of offers of gifts, benefits and hospitality recorded in registers varies significantly. MPV reported the highest number of offers, and it had a practice of recording all offers, regardless of the value. Although PTV reported the lowest number of offers, PTV staff accepted all offers made between July 2016 and April 2017, as shown in Figure 3D.
Gifts, benefits and hospitality offers and acceptances by agencies, July 2016 to April 2017
Source: VAGO based on MPV, MMRA and PTV data.
Compliance with policies
Gifts, benefits and hospitality policies were in place, but we found instances of noncompliance, including instances where public sector officers accepted offers from suppliers, creating a perception of compromised integrity.
MPV's gifts, benefits and hospitality register shows that MPV officers accepted 250 offers between 1 January 2015 and 31 March 2017. Five senior MPV staff accepted 50 per cent of these offers.
We found multiple instances of noncompliance with DEDJTR's gifts, benefits and hospitality policy. Examples of offers accepted by MPV staff that did not align with the policy at the time include:
- six offers by a supplier for tickets to the Australian Open in January 2017, including invitation-only President's Reserve seats, which were accepted by MPV staff, with no clear business reason outlined
- acceptances of two $50 gift vouchers
- a golf day organised by a vendor in 2017, which was attended by three MPV staff and approved by either the executive director or a director of MPV.
DEDJTR's November 2015 gifts, benefits and hospitality policy stated that MPV officers could not accept gifts, benefits or hospitality from current or potential suppliers. This requirement was also in MPV's 2016 procurement policy. Between November 2015 and March 2017, MPV officers accepted 74 offers from suppliers, or 46 per cent of all the accepted offers during this time frame.
The acceptance of gifts from suppliers could call into question the integrity of MPV officers, and fails to address perceptions that can arise when others observe this behaviour. Figure 3E shows a sample of suppliers from whom MPV officers accepted offers. We note that offers from legal firms could include professional development events commonly accepted by officers, through the use of the Legal Services Panel SPC.
Sample of accepted gifts, benefits and hospitality at MPV from past and current vendors, January 2015 to March 2017
Source: VAGO based on MPV data.
The high number of gifts, benefits and hospitality offered by suppliers, accepted by MPV staff and approved by management, demonstrates a culture that did not prioritise maintaining a perception of impartiality to sustain public trust.
There is no evidence of action taken by the DEDJTR Integrity Services Unit, despite the unit holding records of these acceptances in the register. DEDJTR has advised that it has strengthened its processes since this time.
MMRA's gifts, benefits and hospitality practices revealed high levels of compliance with policy and VPSC requirements. MMRA has demonstrated its commitment to supporting a transparent culture of reporting on offers and introduced a digitised process in August 2017. This new process has significantly reduced the effort and time required to declare and manage offers. Since MMRA introduced the new process, the number of offers reported has increased.
PTV released its policy for managing gifts, benefits and hospitality in March 2017. It has clear rules and guidelines about responding to offers.
This policy reflects stronger controls than PTV's previous gifts, benefits and hospitality policy from July 2016, which was inconsistent with VPSC requirements. Entries in PTV's register from that time, align with PTV's gifts, benefits and hospitality policy of the time, but not with VPSC requirements. Examples include:
- a dinner worth $450, which was not reported for three months
- tickets to the Australian Open
- tickets to the premiere night of a theatre production
- lunch worth $300, for which the only reason stated was 'mutual interest'.
Under the new policy, PTV officers now record on their declaration forms detailed business reasons for accepting or declining offers, including noting when a perceived conflict of interest may arise from acceptance. In March 2017 PTV communicated these changes in the updated policy to all PTV staff to ensure they were aware of the new requirements. In April 2017 PTV also shared the updated policy with legal firms that provide services to PTV. This communication with suppliers outlined how offers of gifts, benefits and hospitality can raise the risk of a perceived or actual bias or preferential treatment, and that PTV staff must determine whether there is a legitimate business purpose for accepting offers.