Our System of Quality Management

Overview

The Auditor-General and the Victorian Auditor-General’s Office (VAGO) are part of Victoria’s integrity system. 

Our purpose is to inform the Parliament and Victorians about the performance of the public sector and how to improve public services. 

Our vision is better lives for Victorians. 

The Audit Act 1994 (Audit Act) provides our mandate for the conduct of direct performance engagements and attestation engagements on financial and non-financial reports of state and local government public sector entities. Our annual plan sets out our work program for each financial year.

The Audit Act provides for the accountability of the Auditor-General for our work.

Legislative requirement for the SQM

The Audit Act requires that we apply the Auditing and Assurance Standards Board’s (AUASB) standards where they are relevant to us. We have developed and maintain our SQM to meet the applicable requirements of the auditing standards:

• ASQM 1 Quality Management for Firms that Perform Audits or Reviews of Financial Reports and Other Financial Information, or Other Assurance Engagements (ASQM 1)
• ASQM 2 Engagement Quality Review (ASQM 2)
• ASA 220 Quality Management for an Audit of a Financial Report and Other Historical Financial Information (ASA 220). 

Our engagements are conducted in accordance with: 

• Australian Auditing Standards for financial audits
• Australian Standards on Review Engagements for our reviews of estimated financial statements 
• Australian Standards on Assurance Engagements for performance audits and assurance reviews.

ASQM requirements

The AUASB's ASQM 1 establishes minimum objectives to manage quality across all aspects of the operation of VAGO, it emphasises the: 

• need to establish quality objectives particular to our operations
• proactive identification and response to quality risks, at both office and engagement levels
• requirements of governance and leadership
• monitoring and remediation procedures and an annual evaluation process
• appropriate alignment of resources.

Breaches and non-compliance

We expect our employees (staff and contractors) to comply with our SQM. Our audit service providers (ASP) must comply with their own SQM and in accordance with our contractual arrangements with them, the relevant aspects of our SQM.

We encourage our employees to report non-compliance and breaches without fear of reprisal.

Compliance breaches may occur through wilful, reckless or negligent misconduct. However, we recognise they may also occur by accident. We promote a zero-tolerance approach to deliberate, reckless or negligent misconduct that breaks the law.

We also carefully consider each breach and instance of non-compliance and take all circumstances into account when determining what action to take. We aim to minimise instances of non-compliance and breaches and to mitigate the impact when they occur.

Document retention policy statement

The retention period for all documentation relating to our SQM is 7 years. This is consistent with the longest engagement file retention periods required by the Corporations Act 2001.

Our SQM framework is published in our knowledge library available to all VAGO staff.

SQM objective

Our SQM supports our fundamental objective of obtaining sufficient and appropriate assurance, in accordance with AUASB standards and applicable regulatory requirements, that assurance reports are appropriate in the circumstances. 

This includes ensuring that:

• identified material deficiencies are addressed by the reporting entity, so their financial report/statement is free from material misstatement
• where deficiencies are not addressed, they are communicated in our assurance report 
• the conclusions in our performance engagement reports are reliable.

Composition of the SQM

Our SQM comprises:

• ASQM 1 prescribed requirements 
• our risk assessment process: component
• our risk responses for our audit quality objectives: components 
• our monitoring and remediation process: component 
• an annual evaluation of our SQM.

Figure 1 shows the components and our annual evaluation of the SQM.

Quality 
objectives

Quality objectives are the desired outcomes for each relevant component of our SQM.

We have adopted ASQM 1's quality objectives and tailored these for our circumstances across the relevant quality management components of our SQM.

Audit quality indicators

Audit quality indicators (AQI) are measures that provide insights into a firm’s audit quality. 

We have several AQIs to help us monitor and improve the quality of our audits. We list these AQIs throughout this framework under the relevant quality management component. We annually assess our performance for each AQI against benchmarks:

• reported in the Australasian Council of Auditors-General’s (ACAG) macro benchmarking (MBM) survey
• reported by public accounting firms
• that we internally derive. 

As our systems and processes evolve, we may amend our AQIs to meet the quality requirements of the office. AQIs as identified in this framework are current as at the time of release.

Responsibilities

• The Victorian Auditor-General has ultimate responsibility for our SQM 
• The Director, Audit Quality has operational responsibility for our SQM, including compliance with independence requirements and the monitoring and remediation process.
• The Director, Audit Quality has a direct line of communication to the Victorian Auditor General

We provide more detail on designated leadership roles, independence, and our monitoring and remediation process in the relevant sections below.

All individuals responsible for our SQM have: 

• an understanding of ASQM 1 and all other relevant legislative requirements for our SQM
• the appropriate experience, knowledge, influence, authority and time to fulfill their assigned roles. More details of how we assure this are in Section 7 of this document. 

Quality risk

A risk qualifies as a quality risk when:

• the risk has a reasonable possibility of occurring and
• the risk has a reasonable possibility of individually, or in combination with other risks, adversely affecting the achievement of one or more quality objectives.

Risk framework

VAGO has a Risk Management Framework and a Risk Management Policy, supported by a Risk Management Procedure, to help identify and effectively manage risks. The strategic management group (SMG) documents its risk assessments in our enterprise risk register, operational risk register and our audit quality risk register. 

Risk assessments consider how, and to what degree, circumstances, actions or inactions may adversely affect our ability to achieve our quality objectives.

Our risk appetite

Our Risk Appetite Statement sets a considered risk-taking approach, accepting that there is a certain level of inherent risk and uncertainty in our activities, and aims to take advantage of opportunities as they arise.

Risk assessment and risk response

We have established the relevant audit quality objectives specified in ASQM 1, tailored for our circumstances and the nature of our engagements. We have not identified any additional audit quality objectives.

We identified audit quality risks through a risk assessment process which included:

• consideration of the work conducted by ACAG for quality risks 
• consultation with SMG to assess our inherent risk factors and quality risks and risk responses. 

We have implemented risk responses to the identified audit quality risks. 

Our annual evaluation process considers:

• the extent to which we have designed and implemented risk responses to address the audit quality risks
• the reasons for the assessments given to each quality risk to determine ongoing relevance. 

The Director, Audit Quality provides a report on the results of the annual evaluation process to the Auditor-General (refer to Section 10).

Associated references

Structure supporting audit quality

At an individual level, all employees and contracted resources are responsible for delivering quality outcomes in the work they perform. Specific responsibilities and accountabilities for quality management in our engagements and our SQM are present within our governance and organisational structure via numerous roles, groups and committees.

Our governance structure underpinning audit quality is outlined in Figure 3. These functions, through their individual responsibilities outlined in this section, have shared responsibilities to establish, promote, support and monitor audit quality and compliance with the AUASB standards and other regulatory requirements.

Composition and responsibilities

SMG comprises the: 

• Auditor-General (as Chair) 
• Deputy Auditor-General
• Assistant Auditors General of Financial Audit and PRS
• Director, Strategy, Governance and Risk.

SMG is collectively responsible for:

• setting and monitoring our strategic plan
• overseeing positive culture governance
• our overall performance from an outcome and sustainability perspective
• ensuring we have strong executive leadership and an appropriate tone at the top.

Further details of the responsibilities of the SMG are outlined in the SMG Terms of Reference.

Role in promoting quality

SMG ensures there is strong alignment between our strategic direction and our vision, values and purpose. It focuses on continuously improving our audit quality through performance management, talent development, governance and oversight.

SMG is committed to creating a culture of quality. It promotes audit quality through:

• embedding quality in our values, culture and strategies
• approving and overseeing a portfolio of continuous improvement projects
• establishing and monitoring a values-led recognition and accountability performance framework
• monitoring audit quality by commissioning internal audit reviews of our quality framework
• approving and monitoring our audit quality assurance program.\

SMG is committed to innovation at VAGO including:

• a focus on data-driven auditing 
• modernisation of our audit technologies and our audit and assurance tools
• modernisation of our corporate tools supporting our SQM.

Composition and responsibilities

The operational management group (OMG) comprises the:

• Auditor-General
• Deputy Auditor-General
• Assistant Auditor-General, Financial Audit 
• Assistant Auditor General, PRS
• Director, Strategy, Governance and Risk
• Director, Audit Quality
• Director, Data, AI, Systems Assurance and Digital Audit
• Chief Information Officer
• Chief Financial Officer
• Chief People Officer.

Additionally, a director from Financial Audit and PRS divisions attends each OMG meeting on a rotational basis.

The purpose of the OMG is to oversee and enhance the efficiency, effectiveness and integrity of VAGO’s operations. The OMG is responsible for:

• monitoring performance and managing risks
• ensuring compliance with policies and regulations 
• driving continuous improvement in operational practices.

The committee supports strategic workforce management, technology and infrastructure development, and crisis response, while fostering a culture of accountability, innovation and collaboration. Further details of the responsibilities of the OMG are outlined in the OMG Terms of Reference.

Role in quality

OMG supports audit quality through:

• developing and maintaining the risk management framework intrinsic to our SQM
• monitoring of our policies
• monitoring of compliance with aspects of our SQM, for example annual mandatory training and independence declarations
• performance monitoring of AQIs.

Composition and responsibilities

The Audit and Risk Committee (ARC) has a minimum of 3 independent members (including the chairperson) who are not employees of VAGO. The Auditor-General appoints the chairperson and the other members to the committee. 

ARC provides independent support and advice to help the Auditor-General discharge their:

• responsibilities to manage VAGO’s risk management framework
• external accountability responsibilities as prescribed in the Financial Management Act 1994 and other relevant legislation and requirements. 

ARC’s responsibilities are prescribed in the Standing Directions 2018 Under the Financial Management Act 1994 and further defined in its charter, which the Auditor-General approves.

Role in quality

ARC monitors our audit quality and compliance by:

• overseeing the internal and external auditor's audit plan and scope 
• reviewing the effectiveness of VAGO's internal audits
• advising and monitoring how we implement recommendations from internal and external audits of VAGO
• overseeing our risk management framework. 

ARC provides an annual report to the Auditor-General that summarises the key matters it examined during the year and their outcomes. Further details of the responsibilities of ARC are outlined in the ARC Charter.

Composition

The key positions that have specific responsibilities and accountabilities for our SQM are the:

• Auditor-General
• Assistant Auditor-General, Financial Audit 
• Assistant Auditor General, PRS
• Director, Audit Quality
• Director, Financial Reporting Advisory

Auditor-General

The Audit Act (and the Public Administration Act 2004 and Financial Management Act 1994 by extension) states that the Auditor-General is accountable for their performance and the performance of VAGO. As such, the Auditor-General is legislatively responsible for our SQM. 

Under ASQM 1 the Auditor-General, assigned ultimate responsibility and accountability for our SQM, will, at least annually, evaluate our SQM and conclude whether the system provides the office with reasonable assurance that:

• the office and its staff fulfil their responsibilities in accordance with AUASB standards and applicable legal and regulatory requirements, and conduct engagements in accordance with such standards and requirements
• reports issued by the office are appropriate in the circumstances.

These procedures are outlined in Section 10.

Assistant Auditors-General

The Assistant Auditors-General, Financial Audit and PRS are responsible for delivering audit and review engagements. They oversee how our employees practically apply our SQM. Our Assistant Auditor-General, Financial Audit also oversees how our ASPs practically apply relevant aspects of our SQM.

Director, Audit Quality

The Director, Audit Quality is the executive officer who is operationally responsible for our SQM and its annual evaluation.

This position is functionally and administratively independent of our Financial Audit and PRS divisions and reports directly to the Auditor-General. 

The Director, Audit Quality is responsible for ensuring our audit and review methodologies, policies and procedures meet the AUASB’s quality management requirements.

The Director, Audit Quality holds relevant auditing qualifications, maintains appropriate professional memberships and has extensive auditing experience.

Director, Financial Reporting Advisory 

The Director, Financial Reporting Advisory is operationally responsible for providing support and advice to financial audit engagement teams about accounting and financial reporting matters. 

The Director, Financial Reporting Advisory:

• reports directly to the Assistant Auditor-General of Financial Audit
• is functionally independent of the financial audit engagement teams
• provides independent advice to the Assistant Auditor-General of Financial Audit and Auditor General on significant accounting matters
• leads the technical panel committee process.

They are responsible for ensuring:

• accounting guidance and advice provided aligns with the Australian Accounting Standards and any other appropriate financial reporting frameworks
• appropriate documentation is maintained when providing guidance and advice, which meets the quality control requirements specified in our policies and procedures.

Panels and groups 

We have 3 key panels that are responsible for operating aspects of our SQM for financial audits:

• our technical panel
• our audit report modification panel
• the Financial Audit data champions group.

Our Financial Audit and PRS divisions both have dedicated staff in representative groups who work directly with the audit quality team to contribute to improvement of our policies, processes and tools by reviewing material and providing feedback. These are the:

• EPIC advisory committee, which aims to improve how we apply our EPIC methodology and SQM in the conduct of our audits
• performance improvement committee, which aims to promote and oversee growth, opportunity and improvement across PRS's professional practice and impact. 

Technical panel

Our technical panel consists of the:

• Auditor-General
• Assistant Auditor-General of Financial Audit 
• Director, Financial Reporting Advisory. 

The panel meets monthly and on an as-needed basis to consider and resolve significant audit and accounting matters identified by signing officers or engagement leaders during their audits.

Audit report modification panel

Our audit report modification panel consists of the:

• Auditor-General
• Assistant Auditor-General of Financial Audit 
• Director, Audit Quality. 

The panel meets on an as-needed basis to consider and approve requests from signing officers to modify an audit report or remove a previously approved modification to an audit report.

Financial Audit data champions group

Our Financial Audit data champions group consists of at least one of the Financial Audit directors as chair and a minimum of 8 Financial Audit senior managers/managers, with the Assistant Auditor-General, Financial Audit and Director, Audit Quality as observers. The group meets monthly (except during peak audit season, July to September) to promote, roll-out and support financial auditors in the use of data analytics tools, provide training needs feedback to the learning and development team and contribute to the Financial Audit technology roadmap. 

EPIC advisory committee

Membership of the EPIC advisory committee consists of a representation of various roles from Financial Audit sector teams. The committee meets 3 times a year or more frequently as required. Membership is reviewed annually or earlier as required. 

Current membership comprises:

• Director, Financial Audit (environment)
• Director, Financial Audit (health and integrity)
• representatives from the following groups: 
  • financial audit managers and senior managers 
  • financial audit assistant managers, seniors and auditors.

Meetings are chaired by either of the 2 Financial Audit directors. The Assistant Auditor-General, Financial Audit is invited to attend as an observer, and may contribute to discussions, key decisions and recommendations.

The committee's aim is to improve how we apply our EPIC methodology and system of quality management in the conduct of our audits. It will actively seek feedback from the Financial Audit team on:

• common application issues or challenges in applying EPIC 
• difficulties encountered in implementing the SQM, as it relates to financial audits.

EPIC advisory committee will work with key VAGO stakeholders to resolve these issues or challenges.

Performance improvement committee

The purpose of our performance improvement committee is to promote and oversee growth, opportunity, improvement and impact across PRS’s professional practice. It is chaired by the Director, Professional Practice Development and includes representatives from the following groups:

• Professional Practice and Development Branch 
• Impact, Planning and Data Branch
• Analyst, Senior Analyst, Manager and Senior Manager cohorts.

The committee regularly invites representatives from across PRS and VAGO to attend as contributors. All committee meetings are open to observers. 

The committee meets regularly, and acts to:

• be a central repository for PRS feedback on professional practice improvements (systems, products and processes that support our engagements and planning)
• prioritise improvements and identify available resources to implement them
• take ownership of the key continuous improvement initiatives, including PRS’s continuous improvement register and debrief process.
• provide regular advocacy to PRS on the achievements of the committee and opportunities to participate and contribute.

Procedure 

For effective management of compliance obligations and good governance, we have specific requirements for the development, review and approval of all corporate policies detailed in our Policy Development and Review – Policy. Policies, as they are applied and reviewed, are intended to be responsive to perceived risks and consideration of observed deficiencies. 

Associated references

Compliance requirements

We are committed to identifying, evaluating and acting on our ethical compliance obligations. We have organisational policies and contractual arrangements to enable our employees, ASPs and experts to understand and comply with our ethical requirements.

Section 9 of this document provides our monitoring procedures relating to ethical requirements.

Ethics training

Our employee onboarding process found in VAGO's internal learning platform, Viva Learning, includes mandatory ethical training modules. All employees must complete this training each year as part of our annual compliance program. Our assessment based ethical modules cover:

• discrimination, harassment and bullying
• privacy, secrecy and confidentiality 
• public interest disclosures
• fraud, corruption and conflict of interest
• gifts, benefits and hospitality training
• independence and obligation.

All employees must complete and submit an employee declaration in SuccessFactors to confirm they have completed the mandatory compliance training modules.

Compliance requirements

Victoria’s Constitution Act 1975 establishes the Auditor-General’s operational independence. The Auditor-General has complete discretion to perform their functions and exercise their powers. They are not subject to direction from anyone regarding how they conduct audits and prioritise certain matters.

We have well-established policies and processes to maintain our objectivity and independence. Our Conflict of Interest Policy and Employee Declaration Procedure are designed to provide reasonable assurance that our employees, consultants and contractors adhere to the behaviour standards outlined in the:

• Code of Conduct for Victorian Public Sector Employees of Special Bodies
• Public Administration Act 2004 
• ASA 102 Compliance with Ethical Requirements when Performing Audits, Reviews and Other Assurance Engagements (note ASAE 3500 Performance Engagements and ASAE 3000 Assurance Engagements Other than Audits or Reviews of Historical Financial Information requires compliance with ASA 102)
• relevant provisions in APES 110 Code of Ethics for Professional Accountants that relate to audit independence to the extent that they do not conflict with the Auditor-General’s legislated mandate and responsibilities. 

When a breach of conflict of interest is identified, HR documents the following information in the conflicts of interest register:

• the details of the breach
• the follow-up actions taken
• the key decisions made.

Fraud and corruption

Our Fraud and Corruption Control System defines our overall framework for fraud and corruption prevention, detection and response.

Prevention is managed through our Fraud and Corruption Risk Assessment, which is managed under our overall Risk Management Framework.

Detection and response are managed through our Fraud and Corruption Reporting Procedure, which sets out the obligations of VAGO staff to report suspected fraud or corruption and provides them with a process to do so. Staff complete a confidential online form which is then managed under our Complaints Management Procedure. 

Gifts, benefits, and hospitality

Our Gifts, Benefits and Hospitality Policy goes beyond the Victorian public sector’s minimum accountabilities by stating that it is not appropriate for our employees to offer or receive gifts, benefits or hospitality that could reasonably be perceived to affect their independent and impartial performance of official duties. All staff are required to declare all offered gifts, benefits and hospitality. We have a range of guides and examples in our Gifts, Benefits and Hospitality Procedure to ensure our employees know when they should reject a gift.

In keeping with our intention for transparency, on a quarterly basis we publish on our website our Register of gifts, benefits and hospitality. This register records the declaration of all instances of gifts, benefits or hospitality valued over $50 offered to employees, regardless of whether they were accepted or declined. 

Employee independence

Our strategy, governance and risk team ensures that employees complete an employee declaration form when they commence their role and on an annual basis. 

Our employees have a continuous disclosure obligation to disclose any changes in their circumstances that may result in a perceived or actual independence issue. Our strategy, governance and risk team keeps details of any independence issues and remediation plans. Remediation plans are approved by the respective business unit heads and shared with the affected staff members.

Engagement independence

For each engagement, our engagement leaders are responsible for our engagement teams meeting the ethical requirements. Each engagement has independence procedures including independence and familiarity assessments. 

For in-house financial audits, these procedures are defined in our EPIC Manual – Audit Policy, Process and Procedures. Independence is assessed and maintained both during the engagement period and the period covered by the financial statements.

For PRS engagements, these procedures are defined in our PRS Manual and supporting forms. Independence is assessed and maintained both during the engagement period and the period covered by the engagement report.

Remediation plans are approved by the respective Assistant Auditors-General and shared with affected engagement leaders.

ASP independence

We require ASPs to provide an attestation on their independence during tendering and upon their appointment as a VAGO ASP. They also provide these attestations at the commencement and completion of each audit engagement as part of their key deliverables stipulated in the ASP Instructions.

Our ASPs have a continuous disclosure obligation to disclose any changes in their circumstances that may result in a perceived or actual independence issue.

We require our ASPs to have an appropriate system to maintain and record independence as required by the applicable accounting, professional and ethical standards.

Experts and specialists

We require auditor's experts and specialists to attest to their independence during the tendering process. Our General Procurement Procedure requires our assessment criteria to include the evaluation of ethical requirements when procuring experts, who are each required to complete a Conflict of Interest Statement. In each engagement file we have specific procedures/templates to assess the objectivity and ethical requirements of the auditor's expert.

Roles and responsibilities 

To avoid actual and perceived threats to our independence caused by our employees’ familiarity with the entities we audit and their employees, we rotate engagement team members.

For Financial Audit, engagement team rotation is prior to the following periods expiring: 

• engagement leader – at least every 7 years 
• EQR – at least every 7 years
• team leader – at least every 5 years.

For PRS, rotation is currently based upon sector familiarity, under which team members are rotated between sectors prior to the following periods expiring:

• director – at least every 7 years 
• EQR – at least every 7 years
• manager – at least every 5 years.

From 2025–26 PRS is changing its rotation policy to move away from the current sector-based allocation and adopt the same rotation policy as Financial Audit. 

The Assistant Auditors-General of Financial Audit and PRS are responsible for rotating senior members of our engagement teams. 

Our ASPs are required to comply with this rotation policy.

Requirements

All VAGO employees, contractors and ASPs are bound by the secrecy and confidentiality requirements of the Audit Act, which apply to all information accessed or disclosed to them during their work with VAGO.  They must not disclose this information unless the disclosure is for the performance of their work or the exercise of the Audit Act or other regulation.  

Each employee, contractor and ASP signs a confidentiality agreement/deed of confidentiality as part of their engagement with VAGO.

The Audit Act specifies that breaches of confidentiality may result in imprisonment and/or fines.

We have a procedure for identifying, assessing and responding to actual or suspected unauthorised disclosure of confidential information, which includes escalation to the Victoria Police and the Independent Broad-based Anti-corruption Commission (IBAC) where appropriate. This is further supported by our information security policy and procedure, which ensure confidentiality of information to Victorian Protective Data Security Standards.

VAGO staff use Microsoft CoPilot generative AI to increase the productivity of their work. Our AI Policy sets out our AI principles and staff obligations regarding confidential information. VAGO staff are not permitted to enter non-public information in any public generative AI applications. Consistent with our AI Policy, AI is not a substitute for human decision-making. VAGO staff must exercise careful judgement and validate inputs and outputs when using AI. 

Associated references

Regulation

The Audit Act sets out the Auditor-General’s role and functions. The Auditor-General’s function is to conduct efficient and effective financial and performance audits and reviews of the Victorian public sector. Pursuant to the requirements of section 73 of the Audit Act, the Auditor-General tables an annual work plan in the Parliament of Victoria. The plan details audits to be undertaken and the basis for selection of performance engagement topics.

We reject requests for VAGO to directly provide non-assurance services to audited entities. Our ASPs may perform non-assurance services for our audited entities, in accordance with our Acceptance of requests for non-audit services policy. The Auditor-General must approve all requests for non-assurance services performed by ASPs.

As acknowledged in Guidance Statement GS 023 Special Considerations – Public Sector Engagements we are not required to consider whether to accept or continue a relationship with our audited entities for our mandated engagements. 

We may conduct audits by arrangement under section 23 of the Audit Act. This section requires public bodies to obtain ministerial approval before requesting us to provide other auditing services. We may provide financial audit services to bodies that are not defined as public bodies under the Audit Act, but only if they exist for a public purpose and it is in the public interest to do so.

For our performance audit mandate, we initiate our performance audits when we meet the initiation requirements provided in ASAE 3500 Performance engagements and other related ASAEs and Part 4 of the Audit Act.

New public bodies

The Auditor-General or their delegate approves the establishment of a new engagement when government establishes a new public body: we complete a new client approval form. Each year our financial auditors assess the continuance of our mandate for each financial audit engagement. 

Auditor-General approval

The Auditor-General or their delegate must approve:

• all audits by arrangement, but only after the audited entity has obtained ministerial approval for the audit engagement 
• all engagements for non-assurance services by ASPs in our audited entities. The criteria for acceptance of these engagements are provided in our acceptance of requests for non-audit services policy.

Policies and procedures

We have applicable initiation and continuance procedures in our engagement methodologies. Our signing officers communicate the terms of our engagements to all entities in our engagement letters. 

Resource policies and procedures in our SQM support a workforce of employees, ASPs and experts with appropriate capability and capacity to perform the engagements in accordance with AUASB standards and applicable legal and regulatory requirements. For each engagement, the engagement leader undertakes an assessment of composition of the engagement team.

As part of our acceptance or continuance procedures, we assess and document engagement risks and other matters – such as the integrity of management, conflicts of interest, our ability to perform the engagement in accordance with the AUASB's standards, and the engagement team’s competency and capability – within planning procedures in our engagements. 

Requirement

Under section 10 of the Audit Act, the Auditor-General may dispense with auditing all or part of a public body’s financial statements in any given year.

Section 25(2) of the Audit Act further allows the Auditor-General to dispense with audit arrangements for public purpose entities if the need arises.

The Auditor-General has the discretion to dispense with, or exempt from being audited, any entity within the mandate (public bodies) and those audits that are entered into via a public purpose arrangement. This decision is made annually. 

Where the Auditor-General dispenses with an entity’s financial audit, there is no legislative power to require the entity to engage an alternative auditor. However, the entity may still be required to comply with its financial reporting obligations, which could include audit requirements under other legislation or regulatory frameworks.

Reporting

The Audit Act allows for the Auditor-General to report to Parliament on any aspect of a financial audit through sections 56 (public bodies) and 26 (public purpose arrangements) if deemed necessary.

Policies and procedures

Where a VAGO signing officer seeks to dispense with an audit, a formal memorandum is prepared for approval by the Assistant Auditor-General, Financial Audit and the Auditor-General. A key consideration for approval is whether the entity’s financial report has been subject to an alternative form of assurance (for example, ACNC audit requirements).

Audit Quality is also engaged in this process and maintains a register of all dispensed audits to ensure appropriate reporting through the annual report and the transparency report.

Associated references

Focus and responsibility

Our engagement methodologies and audit policies clearly define the roles and responsibilities of members of the engagement team and others who support engagement quality. 

Each auditor in an engagement has SQM responsibilities: they are responsible for delivering quality audit outcomes for their assigned audit tasks and complying with our SQM. The engagement leaders are responsible for the quality of each engagement.

Professional judgement and scepticism

Our engagement methodology supports the application of the auditing standards requirements for exercising professional judgement and scepticism. 

Each member of the engagement team exercises professional judgement and professional scepticism in the conduct of their work, approaching the audit with an open questioning mind, free of bias. The auditor must be alert to conditions which may indicate possible misstatement or contradict or confirm evidence obtained.  The auditor must critically assess evidence and document support for their exercise of professional judgements and scepticism.

Review and supervision in the engagement is critical to the exercise of professional judgement. The team leader and engagement leader are responsible for directing and coaching professional judgement and scepticism in their engagement teams.

Review and supervision of staff

Our engagement methodologies, audit policies and procedures include supervision and review responsibilities. These policies and procedures require experienced engagement leaders or team members to review work completed by less experienced team members. These reviews are ongoing and should be completed on or before the date of the auditor's report. 

Engagement leaders are responsible for ensuring that these reviews are performed in accordance with relevant policies and procedures, including the review of critical areas of judgement and significant risk.

Financial audit

The engagement leader determines the composition of the engagement team and documents how team members are managed, directed and supervised. EPIC assigns procedures to certain roles and allocates review responsibilities to relevant roles throughout the audit process.

We appoint EQRs to engagements based on risk. An EQR, who is independent of the audit team, conducts an additional review of the significant matters in each audit.

Performance engagements

The engagement leader determines the composition of the engagement team. Our performance engagement methodology provides a framework for complying with assurance standards and has built-in quality control checkpoints for senior team members to review junior team members’ work. 

We appoint EQRs to engagements based on risk. An EQR, who is independent of the engagement team, conducts an additional review of the significant matters in each engagement.

Overview

Our Audit Quality team and Financial Reporting Advisory team support our engagement teams with tools and guides to apply the standards when conducting engagements. These teams support our engagements to apply the Australian Accounting Standards Board standards or the AUASB standards by responding to their enquiries, through technical consultations and through the technical panel meetings.

Financial reporting advisory

Our Director, Financial Reporting Advisory provides training on applying accounting standards and their requirements. 

The Financial Reporting Advisory team regularly engages with the Australian Accounting Standards Board on applying accounting standards and potential implementation issues in the public sector. This involves:

• providing feedback on various exposure drafts released by Australian Accounting Standards Board via the ACAG network
• representing VAGO on Australian Accounting Standards Board project advisory panels that are relevant to the public sector, such as the Fair Value Project Advisory Panel and the Conceptual Framework Project Advisory Panel.

Audit quality

The Director, Audit Quality provides training on applying auditing standards, our audit methodology and tools, and their requirements. 

Our Audit Quality team engages with the AUASB on applying auditing standards and potential implementation issues in the public sector. This involves providing feedback on various exposure drafts released by AUASB via the ACAG network. The Audit Quality team will also represent VAGO on AUASB project advisory panels that are relevant to the conduct of audit in the public sector.

Purpose

We have policies, procedures and guidelines to provide us with reasonable assurance that:

• appropriate consultations take place on difficult or contentious matters
• differences of opinion are resolved
• sufficient resources are available to enable appropriate consultations.

Consultations

The Director, Financial Reporting Advisory is responsible for our VAGO Consultations Policy and its enablement. It is ultimately each engagement leader’s responsibility to undertake appropriate consultations on difficult or contentious matters.

We require engagement leaders to consult with the financial reporting and advisory team or the Audit Quality team on significant accounting and auditing issues, difficult or contentious matters, or matters involving differences of opinion within an audit team or between an audit team and the EQR. Our VAGO Consultations Policy outlines principles for assessing significant matters. We also maintain a consultation register. 

Our Financial Reporting Advisory team and Audit Quality team include audit and accounting specialists. We encourage our auditors to consult with these specialists where appropriate. Our technical panel meets regularly to consider significant and contentious accounting and auditing-related matters and differences of opinion.

The Financial Reporting Advisory team and Audit Quality team document their consultation advice and conclusions. If the engagement team does not implement the advice, then the audit team must document why and its alternative course of action.

Differences of opinion

If there is a difference of opinion between a subject-matter specialist and the engagement team or between the engagement leader/team and the EQR, the engagement leader must refer the matter to the audit division's Assistant Auditor-General and, if needed, the Auditor-General. 

For financial audits, this is via the technical panel or, if applicable, the audit report modification panel. 

For performance engagements our resolution process for differences of opinion requires engagement leaders to consult with their EQR, the Assistant Auditor-General of PRS and the Auditor-General.

For both audit divisions the resolution and conclusion of differences of opinion are documented in the audit file.

Associated references

Overview

In accordance with ASQM 1 we have established the requirements of ASQM 2 in our EQR policies for financial and performance audits respectively.

Appointment and eligibility of the EQR

We have also established related procedures for:

• the appointment of an EQR (and, where applicable, an expert to assist the EQR) to our engagements
• eligibility of the EQR
• rotation and (if applicable) replacement of the EQR
• conduct and documentation of the engagement quality review.

For Financial Audit, we appoint an EQR to all high-risk engagements and moderate risk engagements at the discretion of the engagement leader (including ASP engagements) and to other engagements in accordance with our policy. 

For PRS, to promote confidence in the engagement process and conclusions reached, VAGO’s approach is to assign an independent EQR to all performance audit engagements. The AAG, PRS has the discretion to determine that the scope of an engagement or level of assurance required does not require an EQR.

EQRs take overall responsibility for performing engagement quality reviews and for determining the nature and timing of the review, and directing, supervising and reviewing the work of individuals assisting. 

Performance of the engagement quality review

The EQR conducts an independent objective review of the significant judgements of the engagement team in the engagement and in forming the audit report. While the extent of the review depends on the risk and complexity of the engagement, it always includes vital areas such as independence, materiality and significant risks and judgements.

An EQR’s involvement in the engagement does not reduce the responsibilities of the signing officer or engagement leader. 

The EQR must document all evidence of the engagement leader's involvement, including any discussions with them on significant matters, in the engagement file. This also includes documentation of the work of any expert assisting with the EQR. The engagement leader must ensure that the EQR is completed prior to the issue of the audit report.

Our engagement leaders are required to undertake mandatory EQR training.

Documenting the engagement quality review

The EQR is responsible for documenting the engagement quality review to a standard which ensures that an experienced practitioner, with no previous connection to the engagement, would understand the procedures and the conclusions reached in performing the review.

For our financial audits and performance engagements, the EQR records all documentation in the respective engagement file.

ASP considerations

Our ASPs consult with us to assess whether an EQR is needed for the moderate risk financial audits they are undertaking. If an EQR is required, the ASP is responsible for allocating a second independent partner as the EQR from the VAGO approved pool of nominated ASP EQRs.

The ASP must adhere to its own firm’s EQR policies and procedures for completing the engagement quality review which must comply with ASQM 2.

Associated references

Assembly of final engagement files

We complete our audits and store documentation in each audit’s engagement file. The engagement leader is responsible for making sure each engagement file is assembled, completed, supports the issued auditor’s report, and is archived within:

• 60 days after the date of the auditor’s report for financial audit reports
• 15 days from the tabling date in Parliament for performance engagement reports
• 30 days from the tabling date in Parliament for results of financial audit reports.

Retention of engagement documentation

We must retain all content of an engagement file for a minimum:

• 7 years for Corporations Act 2001 or the Australian Charities and Not for-profits Commission Act 2012 entities
• 5 years for all other engagement files.

We regularly back up all electronic work papers and our file management systems and maintain them for 7 years. We use Microsoft Azure virtual machines and Office 365 Backup to secure our data against loss and/or corruption.

IT resources for this purpose are outlined in Section 7 and data security considerations in Section 8 of this document.

Our contracts with our ASPs require them to retain engagement documentation for a period of 7 years from the date of the audit report.

Associated references

The value of human resources

Our people drive the achievement of our strategic and business objectives. 

We recognise that how we select, develop and plan for our people is key to building an innovative and quality-driven audit office known for the excellence of its reports and advice.

Our employees developed our organisation’s values, which shape our work and culture. Our values are:

• respect
• innovation
• collaboration
• accountability.

Our Strategic Plan 2025–2029 outlines our commitment to building a diverse, safe and inclusive workplace. We recognise diverse and inclusive workforces have better ability to meet business needs, are adept at providing different ways of looking at work issues and drive higher innovation and productivity. Our Diversity, Inclusion and Belonging Plan 2022–2025 focuses on integration of diversity and inclusion into our business practices, systems and behaviours.

Overview

Divisional capability frameworks have been recently revised and rolled out across the office.

Financial Audit has developed an audit capability framework, learning and development curriculum and succession pathways to assist us to:

• build our employees’ capability in their existing roles
• develop new and emerging capability requirements
• support potential career progression within the organisation. 

PRS completed its capability framework project in February 2024, including a:

• refreshed PRS capability framework that clearly communicates the core knowledge, skills and behaviours needed for PRS roles across Victorian public sector levels
• new self-assessment tool 
• refreshed development plan template. 

Qualifications and capabilities

We recruit high-calibre talent into a culture of continuous improvement and accountability to achieve high-quality audit outcomes. Recruitment and promotion are open, competitive and merit-based processes.

We award salary progressions in accordance with the Victorian public sector Performance Development and Progression within a Value Range.

Pre-employment screening

We recognise a duty of care to ensure all staff meet the highest standards of integrity and suitability, including having the ability to perform the inherent requirements of their role.

Our Pre-Employment Screening Policy applies to all employees employed under either the:

• Victorian Public Service Enterprise Agreement 2024
• Standard Executive Officer Employment Contract. 

Employment with VAGO is conditional on satisfactory completion of: 

• qualification checking
• national police record certificates
• pre-employment statutory declaration and consent
• pre-employment health declarations.

Overview

Our employee performance policies and procedures help us to develop and monitor our employees’ capabilities and competence, which includes self-assessments, manager assessments and career progression. 

Performance plans and appraisal

In their first weeks of employment, and then annually, we require employees, in consultation with their managers, to determine their goals in their performance development plan (PDP) aligned with the strategic objectives of the office. 

These goals and our appraisals are documented in our human resource system, SuccessFactors. Our performance cycle runs from 1 July to 30 June each year. Employees record and monitor their progress against their performance goals throughout the year. Our goal setting and performance evaluation processes also consider audit practice and planning.

Ongoing coaching, supervision and review are processes that feed into the performance cycle. Managers hold regular meetings with employees to discuss their expectations, performance feedback, workloads and upcoming priorities. Each employee has a formal midyear and end-of-year evaluation with their manager. These sessions also involve discussions about career goals. These regular meetings and formal evaluations can help employees identify their learning and development goals. Employees and their managers may refer to their divisional capability framework, learning and development curriculum, and succession pathways (if applicable) for guidance on goal setting.

All new employees are subject to probationary periods of 6 months.  We manage unsatisfactory work performance and misconduct of employees in accordance with the Victorian public sector Probation Policy. 

Executive performance and remuneration

We manage our senior executive employees’ performance in accordance with our executive employment contracts and the Victorian Public Service Executive Employment Handbook. Our process reflects principles outlined in our employee performance policy and associated procedures.

We remunerate our executive employees within the bands set by the Victorian Independent Remuneration Tribunal. Executive employees do not receive performance bonuses or other types of incentive-based remuneration.

Overview

Ongoing employee development is essential to audit quality. We support our employees to harness new and emerging technical, analytical and management capabilities. 

We provide structured learning for all new employees and run a graduate program. We supplement on-the-job training and coaching with face-to-face training sessions, e-learning modules and guidance materials.

Learning and development

As part of our performance development and appraisal cycle our employees establish goals for learning and development. Each employee is responsible for the active management of their learning and development goals.

Our learning philosophy applies the ‘3 Es’ and adult learning principles to ensure initiatives are self-directed, experience-based, work-aligned and practical.

We deliver this through:

• experience: learning primarily through challenging and meaningful on-the-job activities that build skills through real work
• exposure: learning through relationships, networks, coaching, mentoring and collaboration with others
• education: learning through formal training, structured programs and courses that build foundational knowledge and skills.

Learning and development at VAGO is also guided by our capability frameworks (where applicable), which define the skills, behaviours and knowledge required for success across roles. Staff, managers and directors should use these frameworks to identify development priorities, plan targeted learning activities, and assess progress, ensuring individual growth aligns with organisational goals and supports career development.

Structured training

Our current training program includes training on: 

• our audit methodologies and tools
• updates to professional standards
• the regulatory environment and ethical requirements 
• Microsoft products, including Power BI, Word, Excel and Teams, to build our organisation’s efficiency.

We also hold workshops and seminars to increase our employees’ capability and knowledge, such as appropriate behaviour training, management foundations and leadership skills, writing skills, fraud and corruption awareness, and a suite of technical training for performance and financial audit employees. 

To make our training available to our workforce we centralise learning through Microsoft Viva Learning. We monitor completion of ethical programs and other mandatory training.

Professional membership support

Most of our financial auditors have or are progressing towards professional memberships with Chartered Accountants Australia and New Zealand (CA ANZ) or Certified Practising Accountants Australia (CPA Australia), or a similar international equivalent.

These memberships have annual continuing professional development targets. Our technical training modules and most of our other training modules are eligible continuing professional development.

Our employee remuneration includes one professional membership.

Resourcing

We recognise the importance of ensuring that our engagement teams have sufficient capacity and capability to respond to the specific risks and requirements of each engagement.  

We configure engagement teams to ensure we have the technical capability and experience to undertake each engagement. We assign responsibility to an engagement leader with the appropriate competence, capabilities, and authority to perform the role. We consider the need to appoint specialists and experts when responding to identified audit risks. We also have specialist data analytics and systems assurance auditors and data science resources. When needed, we contract a variety of specialists to supplement our engagement teams’ capabilities.

A significant number of our financial audits are contracted to our ASPs. The responsibility for issuing the independent auditor's report remains a VAGO signing officer unless the audit has been delegated.

Subject matter experts who are engaged as consultants are not considered engagement team members.

For financial audit, our Victorian public sector level allocation and rotation requirements document specifies the minimum Victorian public sector employment levels allocated to each engagement team role.

Engagement planning

Our financial audit resourcing strategy considers a mix of in-house and ASP resources to deliver quality deliverables for our financial audit program. We allocate resources to audits based on:

• the budget prepared for each engagement
• ethical requirements: rotation and independence 
• the capabilities needed for the audit risk.

Resourcing and scheduling for our performance audits starts with annual planning. Available tabling dates for our reports, which Parliament determines, is a key factor in how we schedule our performance audits. 

Sector teams determine the scope, timelines, staffing requirements and hours for each planned audit. We reconcile the annual plan against our annual appropriation and available staff hours and adjust the plan as necessary.

For both Financial Audit and PRS, we aggregate our engagement budgets, parliamentary report budgets and transformational project budgets into output plans and people plans. These plans inform our resource sourcing approach and resource scheduling. We continually review our resource scheduling:

• in an audit schedule in Microsoft Teams for PRS
• in Microsoft Shifts for Financial Audit. 

Associated references

Overview

Appropriate use of technological resources is key to achieving audit quality and efficiencies in our work. Underpinning VAGO’s information and technology strategy is the objective to harness innovative technologies and new ways of working that best support our strategic goals.

As technology continuously evolves, how it is utilised by the office is subject to the same evolutionary process. We continue to invest in technology to improve and simplify our internal systems and processes, and to refine service delivery models to support high quality audits.

Technological

All employees are provided with a Microsoft surface laptop with internal hardware specifications suited to their role requirements. As part of our better normal working arrangements, employees and contractors engaged for 12 months or more are supplied a standardised home workstation, 2 external monitors, laptop dock, keyboard and mouse. Within the office, workstations are also equipped with these facilities as well as meeting rooms equipped with Microsoft Surface Hubs for collaboration.

We do not use legacy-based infrastructure in the cloud or on-premises physical infrastructure. This means we only use infrastructure as a service, platform as a service, or software as a service solutions.

Information protection and cybersecurity

Our information protection responsibilities apply to all information we hold.

Information protection is the practice of protecting digital data from unauthorised access, disclosure, alteration and/or destruction. This involves cybersecurity, including technical, administrative, and physical measures to safeguard data and ensure the confidentiality, integrity, and availability of information.

We use the Microsoft cloud security benchmark as a single harmonising standard.

Our approach aligns to the Microsoft 365 Zero Trust security model, the Victorian Protective Data Security Framework, level 2 of the Australian Cyber Security Centre’s Essential Eight Maturity Model, and the Australian Government Secure Cloud Strategy.

Our fact sheet Information Protection and Cybersecurity at VAGO provides more detail on our approach to information protection and management of cloud data security and compliance.

Windows system resources

We use Windows 11 Enterprise as the operating system and Microsoft 365 programs for information production and storage. Microsoft Teams is used as our main internal communications channel, with external written communications performed via Outlook.

Common apps are automatically available to staff across mobile, Teams, Microsoft 365 – Apps – Common web apps and Desktop – Start menu – Common desktop apps. Staff can access other apps from our App catalogue as needed. 

Transition from IPSAM Lotus Notes database to Caseware 

Financial audit engagements are executed and documented in a purpose specific software platform. In 2025–26, all in-house resourced audits of financial reports were documented within Caseware. The IPSAM database was maintained to enable financial auditors to refer to prior year audit files.  

Our auditors use our in-house methodology EPIC to help guide the conduct of their audits.

ASPs

All in-house audits are now using Caseware. 

IPSAM provides us with a tool that enables us to oversee the completion of key deliverables by ASPs. Our ASPs continue to use IPSAM to provide key deliverables to us on an audit, which they access through our contract audit service provider extranet (CASPER) 

Looking forward, we are piloting Caseware with selected ASPs to evaluate its suitability as a replacement for IPSAM/CASPER, before considering a broader rollout. 

Engagement file

Our engagement file is where we document our performance engagements. It consists of: 

• Microsoft Teams sites and associated SharePoint sites
• Microsoft Exchange
• Microsoft Teams app 
• Final published PowerBI dashboards. 

All our workpapers, documentation and analysis are captured within our dedicated Microsoft Teams and associated SharePoint channels. 

Future developments

We are developing a new engagement management system that will utilise our Microsoft 365 environment. This will enable an enhanced user experience and allow us to easily embed our performance engagement methodology throughout our engagement logic.

Technological expertise and support

We have dedicated teams with technological expertise to support our financial and performance audit engagements. Our data and digital audit team primarily focuses on our financial audits, while our data science team works on our performance audit and review engagements. These teams help our auditors to:

• translate audit objectives into questions that can be addressed using data analytics
• acquire, cleanse, check, transform and map source data
• sample data
• perform planning analytics using our data analytics platform Empower
• substantively test tools
• communicate and visualise data analytics results.

Data science and data analytics

We have 2 dedicated data teams to support our audit engagements. Our:

• Data Science team, which supports the Financial Audit and PRS divisions
• Data Analytics team, which supports the Financial Audit division.

Our Data Science team help our auditors to:

• translate audit objectives into questions that can be addressed using data analytics
• process, sample and check publicly available and government agency source data
• use data for evidence during annual planning 
• apply data validation to support audit findings 
• communicate and visualise data analytics results.

Both data teams also support auditors by providing training and other forms of knowledge and skill transfer. For example, they train:

• performance auditors to apply statistical analysis skills and use tools such as Python and Microsoft Power BI
• financial auditors to use our data analytics platform, Empower. 

Empower 2.0

We have internally developed our own data analytics platform for financial audit, which is called Empower. Empower provides auditors with direct access to raw data, interactive visualisations and practical tools to simplify audit planning and execution.

Engagement teams use Empower to:

• access data to do their audits
• undertake risk assessments to:
  • better understand classes of transactions
  • develop an audit approach
• identify higher-risk journal entries that require further testing
• perform audit procedures that involve selecting and evaluating a statistical sample
• re-perform rule-based audit procedures, which auditors previously had to complete manually
• help them match financial records to their audit clients’ financial statements
• present impactful audit findings and offer richer insights.

Our financial audit data champion group is operating to support our financial auditors to apply our data analytics approach through continuous improvement and training.

System assurance

Our systems assurance team supports our engagement teams when they need IT audit subject matter expertise on their audits. Work of our IT audit subject matter expertise include: 

• general IT controls testing 
• automated information processing controls testing
• specialist advice on general IT controls and information processing controls
• assistance with substantive audit procedures, for example, review of Python scripts, testing report configuration, and data migration.

Systems assurance is resourced using a combination of in-house staff and staff from one professional services firm.

Deployment of Generative AI

We rolled out Microsoft 365 Copilot to all staff in October 2025. To ensure safe and responsible used of AI, we have:

• implemented an AI Policy
• delivered AI training for all staff 
• established an AI Council to assist our OMG to oversee governance and ethical use.

We are currently expanding our AI strategy and supporting roadmap to help capitalise on the potential of AI to enhance decision-making, productivity and service delivery. 

Associated references

Auditing standards and methodologies

The AUASB's auditing and assurance standards are the primary source for our audit methodologies, and we encourage our employees to refer to these standards where necessary. 

We have established a set of VAGO-specific policies and guidance to help our employees interpret the AUASB's standards in our public sector context. 

We will undertake regular reviews to update our methodologies to reflect changes to the Australian Auditing Standards and other relevant legislation. 

Financial audit

Since 2019–20 our financial audit engagements apply our EPIC methodology.

Compliant with the Australian Auditing Standards, our EPIC methodology includes integrated audit policies, guidance, processes and procedures designed for the public sector across 4 major processes. Figure 10 describes these processes.

Our methodology is supported with auditing tools and templates. EPIC incorporates information system planning, risk assessments and conclusions for an integrated audit approach. Our auditors use templates to document and demonstrate how they reach conclusions about the design of controls and if such controls adequately mitigate the audit risks identified. 

PRS

Our performance engagement methodology aims to streamline the delivery of our engagements, while demonstrating our alignment with the Audit Act and the AUASB standards. It enables us to: 

• reinforce a risk-based approach to engagement planning, ensuring our reports are targeted and deliver impact
• streamline our products for auditees, enabling clear communication of our findings to stakeholders and a ‘no surprises’ approach. 

Our methodology primarily consists of:

• key guidance documents to support the practical application of the Australian Standards on Assurance Engagements in VAGO’s performance audits
• 4 manuals, and associated tools and procedures to drive effective professional practice across the engagement cycle.

In building our new engagement management system, we are leveraging our Microsoft 356 enterprise environment to fully integrate our methodology and enable a superior user experience for our people. We believe this will support the development of exceptional, high-impact reports for Parliament, and improve the value of our products to our auditees. 

Associated references

ASPs

We supplement our workforce with ASPs and specialists to ensure we have the relevant competency and resources.

An ASP can be any firm we contract to conduct a financial audit or other assurance engagements on our behalf. Our procurement process incorporates an assessment of the capability and ethical requirements of our ASPs and the firm's SQM. 

We also utilise system assurance auditors from our ASP firms on our in-house engagements.

ASP responsibilities

The ASP engagement leader is responsible for audit quality for each audit. Each engagement’s signing officer remains responsible for the audit report issued. 

In completing VAGO engagements, our ASPs:

• utilise their firm’s risk-based audit methodology 
• are contractually required to comply with:
  • applicable AUASB standards 
  • the policies and procedures as included in our ASP Instructions. 

Our ASP Instructions adopt the ethical and independence, engagement acceptance and EQR requirements as detailed in this SQM manual.

ASP oversight

We have contract management processes, oversight procedures and EQIs, and conduct annual performance assessments to monitor the quality of our ASP workforce. 

For each engagement a VAGO ASP review officer is responsible for and/or assists the signing officer to complete their review of the ASP's work under our ASP oversight guidance procedure. 

The level of ASP oversight for each engagement is determined annually. It is influenced by:

• the engagement leader's assessment of the financial report level risks (pervasive risks)
• the signing officer's determination of the ASP engagement leader's risk, which they assess using our ASP oversight risk assessment questionnaire.

Our ASPs submit key deliverables that include attestations and work completed to help us oversee their work. 

The Australian Securities and Investments Commission may inspect our ASPs as part of their audit inspection program. We require our ASPs to notify us of the results of these inspections and how they will remediate any identified audit quality matters relevant to the work they undertake for us.

Associated references

Overview

Information systems within the office consist of the processes which identify, capture, interpret and maintain our information. Our SQM is supported by several information systems, including:

• Teams and SharePoint (for internal communication and collaboration)
• IPSAM Lotus Notes database (financial audit engagement file)
• Caseware (financial audit engagement file)
• Empower and Power BI
• SuccessFactors (our HR system)
• MARS (our time recording system)
• Microsoft Shifts 2.0 (financial audit resourcing system) 
• ASP portal, CASPER, (communication with ASPs)
• Outlook 
• VAGO website
• Other social media channels, for example LinkedIn.

Information system responsibilities

Our policies and methodologies specify responsibilities for the identification and capture of data. Our IT business support team maintain and manage our information systems, this includes:

• managing how we capture, store, and dispose of records
• managing record control and security
• training employees on our security and data retention policies
• maintaining our records management system.

Collaboration and information sharing

We embrace a consultative environment where our auditors share their knowledge. We benefit from our collective experience and technical expertise to improve the quality of our engagement performance. We encourage collaboration and information sharing within the boundaries of the Audit Act and other regulatory requirements. 

We have policies and procedures that maintain the confidentiality, safe custody, integrity, accessibility and retrievability of engagement documentation in accordance with ASQM 1, the Public Records Act 1973 (Vic), the Privacy and Data Protection Act 2014 (Vic) and the Australian and International Standards for Information Management:

• AS ISO 15489: Information and documentation – Records management
• ISO 16175: Information and documentation – Processes and functional requirements for software for managing records
• ISO 23081: Metadata for records 

We undertake regular systems audits against these policies and, where appropriate, provide audit/incident reports or logs that flag incidents or inconsistencies for SMG to action. Our IT team also monitor our data systems to ensure no pertinent data is destroyed without authorisation.

Protective markings

In line with the Privacy and Data Protection Act 2014 (Vic), all Victorian government entities must add protective markings to their documents. We require our employees to apply security classifications, including ‘official’, ‘official-sensitive’ or where necessary, ‘protected’ or 'secret', to all documentation. The level of classification is based on the potential damage that would occur to government operations, organisations or individuals if the information’s confidentiality was compromised.

Microsoft Teams 

Microsoft Teams is our officewide collaboration and communication system. We encourage collaboration between our business units and our financial and performance auditors and engagement teams.

Communicating the importance of quality

In line with ASQM 1, we have a range of initiatives to keep our employees informed about the importance of audit quality. To provide visible leadership, promote our culture and audit quality, and improve communication across VAGO, we:

• require all employees to undertake training on our SQM 
• hold regular stand-up briefings for all employees, which an SMG member hosts. During these meetings employees can also ask SMG members questions 
• post regular announcements on Microsoft Teams to inform our employees about new or revised policies and processes related to our SQM
• hold technical update sessions 
• provide feedback to auditors on the results of our monitoring and remediation processes
• rotate participation of our senior employees in monthly OMG meetings 
• have established representative consultative groups in each audit division – our financial audit practice governance committee and performance audit advisory group meet to discuss and address audit quality matters. Senior representatives from these groups regularly update our financial audit and performance reporting divisions on outcomes from these meetings
• report employee survey results to SMG
• have a staff consultation committee, which staff use to communicate with SMG.

In addition to our monitoring and remediation processes, we have a range of stakeholder and employee surveys to obtain feedback, including feedback about our audit quality. We analyse survey results and implement remedial actions as appropriate. We actively engage with our employees on the results of these surveys and the implementation of agreed actions.

Staff consultation committee 

The office has an official staff consultation committee for the purposes of facilitating a direct channel of communication between staff and the senior executive. This committee incorporates representatives from all VAGO's business units of intended mixed seniority. The objectives, principles, composition and structure of the committee are outlined as per the Staff Consultation Committee Terms of Reference.

Overview

Our communication with external parties includes our audited entities, ASPs, Parliament, and the public.

Communication with audited entities and Parliament

Our auditors engage with key management personnel and applicable governance committees in the execution of our engagements. Entity audit committees are a key point of contact for the exchange of information for us; we attend applicable audit committee meetings sharing key deliverables for our engagements. 

Our audit methodologies include procedures to ensure that we:

• engage with our audited entities on a regular basis to capture feedback during the engagement and as part of client surveys
• allow sufficient time to discuss and acquit auditee feedback
• communicate with our audited entities and Parliament in accordance with the Audit Act and relevant auditing and assurance standards. 
• consult with our audited entities in the preparation of our annual plan and our engagement deliverables
• seek comments from the Public Accounts and Estimates Committee (PAEC) on our draft annual plan and the engagement strategy for each performance engagement.  

We table our annual plan, annual report and audit reports in Parliament. Prior to tabling our reports in Parliament, we invite relevant ministers to a briefing on the engagement.

Communication with ASPs

We communicate with our ASPs through a variety of platforms including our ASP Instructions, the ASP portal, CASPER, ASP forums/online events and email.

Our quality requirements for ASPs are provided in our head agreements with the firm and in our ASP Instructions. We provide all relevant policies, procedures and templates to our ASPs in our ASP portal. We hold regular ASP forums to communicate changes in these requirements.

Communication with the public

In fulfilling our role promoting confidence in the public sector, our communications with the public are of critical importance; we must be transparent and accountable.

The results of our financial audits and performance engagements are contained in reports tabled in Parliament. We make these reports and their related summary videos publicly accessible via our website. We develop and implement a communications plan for each parliamentary report to assist reaching the public through social media.

We are committed to producing and sharing products that can be accessed and used by the public. This means our products are written clearly and in plain English. This promotes greater awareness of our work and ensures it is more easily understood. 

In the interests of transparency and in accordance with our legislative obligations, we annually report on our performance, strategies and plans for the year ahead and beyond. These corporate publications are publicly accessible via our website and cover multiple aspects of information considered to be of public interest. 

These include periodical publications as detailed below.

We additionally communicate to the public the various aspects of oversight, which we are subject to in performing our assurance services and use of public resources – reflecting how we are accountable.

External general enquiries

Responding to general correspondence from Parliamentarians, public sector representatives, councillors and members of the general public is subject to tone, format and timeline guidelines as per our Correspondence Manual.

As per our Media Policy, the office does not pursue media coverage and does not comment on our work outside of that documented in our reports tabled in Parliament or content on our official website and social media channels.

Communications regarding complaints and allegations are considered as per the monitoring and remediation process section of this framework.

Associated references

Overview

Our monitoring and remediation processes: 

• are designed to provide reasonable assurance that our policies and procedures relating to our SQM are relevant, adequate and operating effectively in accordance with ASQM 1
• focus on continuous improvement of our SQM and engagement quality.

Our monitoring activities include our:

• EQIs
• active file appraisals (AFA)
• client feedback
• complaints and allegations 
• work by our internal auditor 
• quadrennial external performance audit of VAGO
• ongoing monitoring by OMG.

Our Director, Audit Quality is responsible for our monitoring activities.

OMG and ARC monitor our progress in implementing agreed remedial actions from all monitoring activities. OMG monitor aspects of our SQM as detailed in this framework.

Overview

We conduct annual EQI programs to provide assurance that our engagements comply with our financial audit and performance engagement methodologies, AUASB’s standards and other relevant professional and legislative requirements.  

These inspections are undertaken by internal and external inspectors (including reciprocal arrangements with other ACAG state audit offices) appointed by the Director, Audit Quality after being assessed against suitability criteria in the respective financial and performance audit EQI procedures and guidelines and approved by the Auditor-General.

For financial audits:

• our AFA complements our EQI program 
• our EQI program also includes ASP engagement leaders.

For our performance audit engagements these inspections may be performed either as part of our annual EQI program or by the auditor appointed by the PAEC.

AFA overview

For financial audit engagements, we additionally undertake an annual AFA program in accordance with an AFA plan approved by the Auditor-General. Our AFA program reviews a selection of engagement files against the key areas of focus in the current AFA plan. The appraisals may be conducted during any phase of an audit and during multiple phases throughout the audit process.

Appointment of appraisers

Appraisers are objective and independent of the engagement they are appraising. The Audit Quality Director and senior officers, along with the Assistant Auditor-General, Financial Audit, are pre-approved to perform AFAs. Other appraisers need to be pre-approved by the Director, Audit Quality as suitably qualified before they can perform an AFA.

Financial Audit client surveys

Financial Audit actively gathers client feedback under its Client survey feedback – Financial Audit approach procedure, which defines roles and responsibilities for collecting and using client feedback on both in-house and ASP engagements.

PRS engagement debriefs

PRS actively gathers client feedback under its PRS Engagement Debriefs procedure, which also defines roles and responsibilities for collecting and using client feedback on performance audit engagements.

Evaluation, communication and remediation

The EQI program inspector prepares the observation report provided to the engagement team. 

The Director, Audit Quality prepares the EQI program thematic report providing it to the Auditor-General and the relevant Assistant Auditor-General. These reports identify deficiencies and propose remedial actions based on the root cause analysis. The thematic report also provides an evaluation of the effect of the identified deficiencies, individually and in aggregate on our SQM.

OMG and ARC monitor the implementation and effectiveness of the agreed remedial actions from the thematic report. If remedial actions are determined to be not appropriately designed, or ineffective, the Director, Audit Quality will take appropriate action to modify the remedial actions.

As outlined in Section 2 of this document, the EPIC advisory committee and the performance improvement committee provide a forum to discuss continuous improvement initiatives and training initiatives. We encourage our auditors to actively identify and raise ongoing thematic issues during their work and share issues and ideas for remediation and training with the EPIC advisory committee and the performance improvement committee.

Overview

All complaints and allegations are taken seriously by VAGO. We do not tolerate fraud or corruption and take all allegations of suspected fraud and/or corruption seriously and respond fully.

Our Complaints Management Policy and Complaints Management Procedure set out our requirements for addressing complaints to provide us with reasonable assurance that we investigate and where appropriate, act on:

• complaints and allegations that our audit work fails to comply with AUASB’s standards, relevant ethical requirements and/or applicable legal and regulatory requirements
• allegations of non-compliance with our SQM. 

In addition to our internal policies and procedures, our activities can be subject to oversight by external bodies. Our employees interact with the public sector and the community. This contact can result in dissatisfaction and complaints about our employees or the conduct or results of our work. 

Complaints and allegations process

The public, our audited entities, employees and ASPs can make complaints and/or allegations about:

• non-compliance with professional, regulatory or legal requirements
• non-compliance with our own SQM
• other matters.  

Complaints can be made via our website, phone or email. We can also receive complaints through direct communication with our audit teams. 

If we receive a complaint, our process is to assess, investigate, respond, and if valid, remedy it in accordance with our complaints policy. If the complainant is dissatisfied with how we handled their concern, they have the right to ask us to reconsider it by contacting the Deputy Auditor-General. If the complainant is still dissatisfied, they may raise their complaint with the Victorian Ombudsman. If the complaint is about the professional conduct of a registered CA ANZ or CPA Australia member, the complainant may refer the matter to them.

Where we identify a deficiency in our SQM, the Director, Audit Quality recommends appropriate remedial action after consultation with relevant stakeholders.

Integrity Oversight Victoria

Integrity Oversight Victoria oversees 14 integrity bodies, including VAGO, and is a key oversight body in Victoria’s integrity system. It reports directly to Parliament. The Integrity Oversight Victoria Act 2011 gives the Victorian Inspectorate the power to scrutinise our activities. It can receive and assess complaints made about us, investigate our conduct and examine our use of coercive powers. It can also monitor our compliance with procedural fairness and certain sections of the Audit Act.

Overview

Every 4 years the PAEC appoints an independent auditor to conduct a performance audit of our office as required by the Audit Act. The purpose of this audit is to determine if the Auditor-General and VAGO are achieving their objectives effectively, economically, efficiently and in compliance with all relevant Acts. The most recent performance audit – Performance Audit of the Victorian Auditor-General and the Victorian Auditor-General’s Office – was tabled on 4 August 2020 with an overall positive result.

Overview

In accordance with the Standing Directions 2018 under the Financial Management Act 1994, we have an internal audit function that reports to ARC. Our Internal Audit Charter outlines our internal auditors’ authority, independence, role, responsibilities, performance expectations and relationships. The objective of our internal audit program is to provide innovative, responsive, effective and value-added internal audits that assist us and ARC to control risks, monitor our compliance with policies and procedures, and improve the efficiency and effectiveness of our internal control system.

Our internal auditors work with ARC to develop an annual internal audit plan. These audits assess the quality and performance of specific functions in our office. Audit quality is a feature of topics listed in the plan. We use information from our surveys, reviews and internal audit processes to address issues that arise from individual financial and performance audits, identify trends and common themes, develop improvement projects and strategies, and monitor the effectiveness of our current improvement projects.

Compliance

We monitor our ethical and independence requirements through:

• EQI programs
• OMG's monitoring of the status of annual employee independence declarations. Members of these groups also declare their own interests as a standing agenda item
• our annual resourcing plans which consider rotation of senior team members. 

We also maintain a Financial Audit rotation register and PRS rotation register to track how long our auditors have worked in each sector or on each audited entity and assess the amount of time senior team members have spent on each engagement. We have the same rotation requirements for our ASPs as provided in our ASP Panel Master Agreement.

Associated references

Roles and responsibilities

In accordance with ASQM 1 requirements, the roles and responsibilities for our evaluation process are:

• Auditor-General: oversees our evaluation of the SQM and concludes whether our SQM provides reasonable assurance that our quality objectives are being achieved, based on advice and recommendations from the Director, Audit Quality 
• Director, Audit Quality: assigned operational responsibility, with a direct reporting role to the Auditor-General 
• other individuals: as assigned specific roles for the purposes of the SQM evaluation.

The individuals performing the evaluation have the required authority, competencies and capabilities and are given sufficient time to perform the evaluation effectively. 

The performance of the Auditor-General and the Director, Audit Quality is assessed annually through our Performance Cycle Procedure.

Evaluation process 

The evaluation and conclusion are made on an annual basis, and the conclusion is reported in our Transparency Report. 

The evaluation is informed by the results of our monitoring and remediation process and the information obtained from earlier monitoring activities. 

VAGO's SQM operates in a continual and iterative way. It is responsive to changes in the nature and circumstances of our engagements. Figure 13 illustrates this process.  

Figure 13: Evaluation of VAGO’s SQM

Source: VAGO.

We collate, summarise and communicate the deficiencies identified by the monitoring activities, their severity and pervasiveness, and remedial actions taken to address them. 

We have adapted the evaluation questionnaire from CA ANZ's pro-forma toolkit considering the nature and circumstances of our engagements for use as the basis for our evaluation conclusion. 

The results of our evaluation will support the conclusion reached as to whether:

• our SQM provides reasonable assurance that its objectives are being achieved, or
• except for matters related to identified deficiencies that have a severe but not pervasive effect on the design, implementation and operation of our SQM, our SQM provides reasonable assurance that its objectives are being achieved, or 
• our SQM does not provide reasonable assurance that its objectives are being achieved.

We take prompt and appropriate actions to respond to deficiencies identified in the evaluation so that deficiencies are remediated on a timely basis. 

Remedial actions to address identified deficiencies include communication of the matter to the relevant engagement teams for consideration and remediation, other individuals assigned activities within our SQM, and those in VAGO charged with governance in accordance with our policies and procedures. 

Associated references