Results of 2017–18 Audits: Local Government

Tabled: 19 December 2018

3 Internal control

Entities require well‐designed and efficient internal controls to help them meet their objectives reliably and cost‐effectively, including delivering accurate and timely external and internal financial reports.

In our annual financial audits, we consider the internal controls relevant to financial reporting and assess whether entities have managed the risk that their financial reports will not be complete and accurate. Poorly designed or inefficient internal controls make it more difficult for an entity's management to comply with relevant legislation and can also increase the risk of fraud and error.

3.1 Internal control observations

Council's internal controls for financial reporting were adequate for ensuring the reliability of their financial reporting. However, councils need to strengthen some important internal controls to mitigate the risk of fraud and error.

Those charged with governance includes elected councillors of each council, and their advisory audit committee.

During our 2017–18 audits, we identified 121 new medium- and high-risk internal control weaknesses and financial reporting issues (110 newly identified issues in 2016–17). We reported these issues to those charged with governance at each council. We also provided an update on the 359 issues identified through previous years' financial audits, and those that were still unresolved.

Figure 3A shows the number of issues identified by risk rating, and the internal control areas they relate to. This table excludes issues we rated as low risk, as these matters are minor or may be just an opportunity to improve existing processes. Appendix D provides additional information on our risk ratings and our expected time lines for councils to resolve the issues raised.

Figure 3A
New internal control issues identified in 2017–18 audits, by area and risk rating

Area of issue

Risk rating

Total

High

Medium

Infrastructure, property, plant and equipment

8

24

32

Expenditure / accounts payable

30

30

Payroll

22

22

IT controls

1

12

13

Governance

15

15

Financial / performance reporting

3

3

Revenue / receivables

5

5

Other

1

1

Total

9

112

121

Note: In 2017–18 we changed our risk ratings for issues, and no longer use an 'extreme' rating. See Appendix D for details of the risk ratings used in these audits.

Source: VAGO.

High-risk issues

We identified nine high-risk issues in six councils in 2017–18:

  • Campaspe Shire Council
  • Casey City Council
  • Central Goldfields Shire Council
  • Gannawarra Shire Council
  • Maribyrnong City Council
  • Warrnambool City Council.

Figure 3B summarises these issues, which relate primarily to infrastructure asset management.

Figure 3B
High‐risk issues identified across six councils 2017–18

Council

Description of finding

Campaspe Shire Council

Campaspe Shire Council had three high‐risk issues relating to the infrastructure, property, plant and equipment revaluation process, specifically:

  • incorrect use of indices for formal revaluation purposes
  • poor asset management—including the inclusion of non-council assets and the omission of council assets from the revaluation process, the incorrect classification and disposal of assets, and inconsistent record keeping
  • untimely recognition of capital projects with completed projects still recorded as work in progress.

Management has committed to forming a working group to resolve these asset related audit findings.

Casey City Council

We identified one high‐risk issue relating to the infrastructure, property, plant and equipment revaluation process at Casey City Council—the absence of a quality assurance check over the valuation process, resulting in the inconsistent valuation and classification of land.

Central Goldfields Shire Council

Central Goldfields Shire Council did not perform a managerial valuation for its land and building assets at 30 June 2018 even though a fair value assessment indicated a movement of more than 10 per cent since the last revaluation in 2014.

Gannawarra Shire Council

Gannawarra Shire Council had two high‐risk rated issues relating to the infrastructure, property, plant and equipment revaluation process, specifically:

  • a lack of a formal valuation report, asset condition assessment and adequate review over the methodology, assumptions and judgements applied by management in respect to the revaluation process
  • no fair value assessment was completed over the remaining asset classes not revalued at 30 June 2018.

Maribyrnong City Council

Maribyrnong City Council had not previously recorded three land assets gifted in 2014. This lead to a correction of error processed in the 2017–18 financial year, amending prior period balances.

Warrnambool City Council

Warrnambool City Council did not have in place a complete, approved and up to date disaster recovery plan.

Management subsequently introduced an appropriate disaster recovery plan and this issue is closed at the date of this report.

Source: VAGO.

Correction of errors are applied retrospectively except where impractical.

Medium-risk issues

During 2017–18, we reported 112 new medium-risk internal control weaknesses and financial reporting issues (94 newly identified issues in 2016–17).

Of these risks, 68 per cent related to infrastructure, property, plant and equipment, payroll, and expenditure and accounts payable systems, including:

  • inconsistent and inadequate processes for valuing assets
  • control deficiencies over key payroll processes such as master file changes and employee termination procedures
  • inappropriate delegations of authority limits and authorisation of expenditure, poor oversight and control deficiencies relating to master file changes and procurement processes.

The untimely and inadequate rectification of these issues exposes councils to:

  • incorrect valuation and presentation of infrastructure, property, plant and equipment balances in financial statements and also non-compliance with Australian Accounting Standards
  • potential unauthorised procurement of goods and services from non‑approved suppliers
  • incorrect and unauthorised payments to existing and terminated employees
  • risk of fraudulent payments and difficulties in detection.

A further 11 per cent of medium-risk issues related to the IT systems environment, namely inappropriate user access and password controls, and a lack of adequate disaster recovery and business continuity plan and testing. These issues increase the risk that data held in councils' IT systems may be compromised or lost. Figure 3C shows the number of issues by area and status.

Figure 3C
Status of current year medium-risk rated issues, by area

Graph showing the status of current year medium-risk rated issues, by area

Note: PPE=property, plant and equipment.

Source: VAGO.

3.2 Status of internal control issues raised in prior audits

As part of our audit process, we track the resolution of internal control matters that we have reported in our management letters for previous audits. We expect all these matters to be resolved in accordance with the timetable shown in Appendix D. Where issues remain outstanding, we factor this into our risk assessment for the following year's audit.

At the start of 2017–18, there were 359 unresolved extreme-, high- and medium‑risk audit issues that we had raised with management in earlier years. During the year, councils resolved 81 per cent of these matters compared to 61 per cent in 2016–17, as shown in Figure 3D.

Figure 3D
Status of prior year issues, by risk rating

Status of issue

Risk rating

Total

Extreme

High

Medium

Resolved

4

45

243

292

Unresolved

1

4

62

67

Total

5

49

305

359

Note: Low-risk rated issues have been excluded from this analysis.

Source: VAGO.

Unresolved issues

Types of unresolved issues

We found that councils showed significant improvement in resolving extreme and high-risk internal control issues during the 2017–18 financial year.

Figure 3E shows the types and risk rating of the issues raised in prior years that are still unresolved. Most of the unresolved prior year issues primarily relate to infrastructure, property, plant and equipment, and IT control issues that councils are addressing.

Figure 3E
Unresolved prior year issues, by risk rating

Graph showing the number of unresolved prior year issues, by risk rating

Note: PPE=property, plant and equipment.

Note: Low-risk rated issues have been excluded from this analysis.

Source: VAGO.

Impairment loss is the amount by which the value of an entity's asset exceeds its recoverable value.

Figure 3F provides additional information on the unresolved extreme- and high‑risk issues.

Figure 3F
Status of unresolved extreme- and high-risk rated prior year issues

Council

Description of finding

Extreme-risk issues

West Wimmera Shire Council

West Wimmera Shire Council did not have a detailed fixed asset register at 30 June 2017 that identified individual assets such as bridges, road segments and drainage assets.

Management has previously accepted this finding and committed to completing a revaluation at asset level, which will provide a new detailed and individualised asset register.

We reclassified this to high risk in 2017–18 as we changed our risk ratings and no longer use 'extreme'.

High-risk issues

Bass Coast Shire Council

Bass Coast Shire Council does not currently have documented policies and procedures relating to development contributions—that is, payments made on behalf of developers.

Management has deferred addressing this issue until they implement a new enterprise reporting suite, expected in March 2020.

We also recommended shell financial statements be prepared and provided to VAGO prior to our final year-end visit to ensure we can undertake a timely review.

Management has committed to promptly preparing and providing shell financial statements to us next year.

Towong Shire Council

Towong Shire Council did not perform a fair value assessment of their infrastructure, property, plant and equipment assets. Further, the council did not have a documented policy or assess their assets for annual impairment.

Management has accepted these findings and committed to resolving these issues in 2018–19.

Wellington Shire Council

Wellington Shire Council previously did not prepare and provide shell financial statements to us prior to our final year-end visit. Management undertook corrective action in 2017–18 to address this finding and provided shell financial statements to us in April 2018.

Management has committed to continue to focus on improvement opportunities relating to the presentation of the shell financial statements in 2018–19. As a result, this issue is no longer rated as high.

Source: VAGO.

Back to Top