Victorian Auditor-General’s report
28 July 2010

Portfolio Departments: Interim Results of the 2009–10 Audits 

Audit summary
Background
This report informs Parliament about internal control issues arising from our interim financial audit of the 11 portfolio departments and recommends improvement in their internal controls. 
All portfolio departments operate adequate internal controls to assure the reliability of their financial reporting, the efficiency and effectiveness of their operations and their compliance with all relevant laws and regulations. In our annual financial audit however, we focus on the internal controls that relate to financial reporting. While it is not our responsibility to form an opinion on internal controls, we nevertheless raise with management any control weaknesses or breakdowns we identify.
Overall conclusion 
Weaknesses identified in the information technology (IT) controls at portfolio departments should be addressed, particularly the oversight of outsourced IT providers, system wide security and aspects around the protection of personal information.
Controls over the identification, declaration and management of conflicts of interest should also be strengthened.
While overall we found that portfolio departments have adequate procurement policies, improvements to contract recording and controls over payments are required.
Findings
Common internal control weaknesses
The audit evaluation of the design and effectiveness of the control environment at portfolio departments includes a review of IT controls over those financial systems that provide information for the annual financial statements. Three common IT control weaknesses were identified in portfolio departments.
We found that three portfolio departments were not adequately monitoring the performance of outsourced IT providers and service level agreements were not in place for the outsourced IT functions in a further two portfolio departments.
IT system security had weaknesses including poor controls over password and remote system access, with limited monitoring of the integrity of the operation of security systems. This situation increases the risk of unauthorised access to departmental information. 
The confidentiality of personal information is not adequately recognised as a risk in the risk register of three portfolio departments. Also, in one shared services environment affecting three portfolio departments, actual personal information was used when conducting systems development and testing. This situation heightens the risk of misuse of personal information, identity theft and fraud.
Controls over declarations of interest  
A cyclical approach to reviewing internal controls relating to significant annual financial report balances and disclosures consistent with Australian Auditing Standards is used. This year we reviewed key management controls over declarations of interest in all 11 portfolio departments.
Conflicts of interest are important issues for portfolio departments as the ‘business of government’ relies on employees acting and being seen to act honestly and impartially at all times. Portfolio departments are required to operate in a manner which either avoids any conflict of interest or, when they arise or can be perceived to arise, manages them with integrity.
We found that management controls should be improved as:
·	Seven portfolio departments did not take a systematic approach to gathering, recording and managing declarations of interest. This makes conflicts more difficult to manage and less transparent.
·	Five portfolio departments did not have a consolidated conflicts of interest policy. Therefore, departmental officers do not have a central source of information outlining their responsibilities and procedures to follow if they have, or might have, a conflict.
·	Six portfolio departments had separate conflicts of interest policies. However, these could be improved by including the actions required to manage conflicts, consequences for non compliance with the policy, and procedures for maintaining the privacy of information.
There is a pervasive lack of training on conflict identification and management. No portfolio department is conducting regular staff training. This issue was also raised by the Ombudsman in his June 2010 report, Ombudsman investigation into the probity of the Kew Residential Services and St Kilda Triangle developments. 
Controls over procurement
In 2009–10 the general government sector was expected to procure goods and services of $13 885 million and spend $5 228 million on fixed assets. The Minister for Finance’s standing directions require portfolio departments to implement and maintain an effective internal control framework for procurement. Such a framework should assure procurement satisfies business needs and occurs in line with documented policies and procedures.
We examined a selection of 22 contracts across the 11 portfolio departments. Contracts were selected from departmental records covering goods, services and construction projects. We found that good practice was followed for 20 of them but there are areas for improvement.
·	Officers need written guidance about exactly what is ‘high risk’, ‘high value’ or ‘complex’ so that there is consistency within and between portfolio departments as to when a strategic procurement plan is required.
·	The functions of probity advisor and probity auditor should be performed by different parties.
·	Contract details should be recorded on registers by portfolio departments.
·	Penetration testing of critical IT networks should be conducted annually to evaluate the risk of unauthorised access and fraud. 
Financial reporting framework
For 2009–10 there were three significant changes to the financial reporting framework.
·	The presentation of financial statements has changed with a new format for the operating statement and more disclosure required when the comparative information from prior periods is restated.
·	A staggered approach to adopting fair value for infrastructure assets means that ports and metropolitan water entities will report infrastructure assets at fair value in 2009–10, while rail and regional water agencies will do so in 2010–11. This is notwithstanding the fair value requirement in AASB 1049, at the whole of government level, was first foreshadowed in May 2007.
·	All land under roads will be recognised as an asset and reported at fair value by VicRoads for the first time in 2009–10.
A key feature of the Public Finance and Accountability Bill (the bill) is the proposed classification of public sector entities into four categories with different reporting and auditing requirements. The Australian Accounting Standards Board has also mandated a differential reporting framework, however, this has only two categories. It is important that these two differential reporting frameworks reconcile so that the accountability for, and transparency of, the use of taxpayer funds is maintained.
As the bill was not passed before 1 July 2010, the shortened annual reporting time frames proposed in the bill may not be mandatory for the year ending 30 June 2011. However, the timeliness of annual reporting by public sector agencies would be improved if the shortened time frames proposed in the bill, and which are consistent with those adopted for 2009–10, were adopted for the year ending 30 June 2011.
The International Public Sector Accounting Standards Board has issued a consultation paper recommending governments report on the long-term sustainability of public finances. Although this is a preliminary view, it would be opportune for the Department of Treasury and Finance to consider these proposals when developing the proposed Ministerial directions to underpin the bill.
Recommendations
Number	Recommendation	Page	
1.	Portfolio departments should assess their policies and procedures against the commonly identified internal control weaknesses to assure they are operating in a reliable and cost effective manner.	10	
2.	Portfolio departments should establish a consolidated conflicts of interest policy.	14	
3.	Portfolio departments should provide regular refresher training to all staff about their responsibilities to identify and declare conflicts, and the consequence for failing to do so.	15	
4.	Portfolio departments should take a systematic approach to gathering, recording and managing declarations of interest.	15	
5.	The Victorian Government Purchasing Board should develop guidance on the criteria for identifying ‘high risk’, ‘high value’ and ‘complex’ procurement.	22	
6.	The procurement policies of all portfolio departments should define ‘high risk’, ‘high value’ and ‘complex’ procurement.	22	
7.	The probity advisor and probity auditor functions should be conducted by different parties.	22	
8.	Portfolio departments should record all contract data in a register.	23	
9.	Portfolio departments should undertake penetration testing of their critical IT networks at least annually.	24	
10.	The Department of Treasury and Finance should require all public sector entities to adopt the shortened annual reporting time frames proposed in the Public Finance and Accountability Bill for the year ending 30 June 2011.	30