Victorian Auditor-General’s report
9 November 2011

Public Hospitals: Results of the 2010–11 Audits 
Audit summary
Background
This report covers the results of our financial audits of 112 entities within the public hospital sector, comprising 87 public hospitals and the 25 entities they control. It informs Parliament about significant issues arising from the audits and augments the assurance provided through audit opinions included in the entities’ annual reports.
This report comments on the quality and timeliness of financial reporting, the financial sustainability of public hospitals and the effectiveness of procurement practices and information technology security.
Conclusion
Clear audit opinions were issued on all completed public hospital and associated entities’ financial statements for the financial year ended 30 June 2011. 
The operating result for hospitals improved significantly from a deficit of $156 million in 2009–10 to a deficit of $102 million in 2010–11, mainly due to additional capital grants provided to regional hospitals during the year. 
The overall risk to financial sustainability for each public hospital category was assessed as moderate for 2010–11. However, the risk was assessed as high for 33 per cent of public hospitals (29 of 87) mainly because they generated insufficient cash to adequately fund their operations. It is concerning that 61 per cent of public hospitals, including 25 major metropolitan and regional hospitals, had cash holdings equivalent to less than 30 days operating cash outflows. Some hospitals had cash holdings of less than seven days 
Twenty-nine public hospitals did not meet the going concern test of the Australian Accounting Standards at 30 June 2011. The 29 relied upon a letter of comfort from the Department of Health that stated it would provide adequate cash flows to enable them to meet their financial obligations if required.
The above data demonstrates that while public hospitals have their own boards of management that are responsible for the day-to-day oversight of the entities, the financial sustainability of hospitals is significantly affected by funding decisions made by the department. The current departmental funding model limits the ability of governing bodies and management to make decisions around asset maintenance and replacement. The funding arrangements have implications for governing boards of public hospitals and their ability to fulfil their legislative responsibilities.

Findings
Audit opinions and the quality of reporting
Clear audit opinions were issued on 111 entities, comprising the 87 public hospitals and 24 of the entities they controlled. The audit of one of the controlled entities was still to be finalised. The financial reports were prepared in accordance with the applicable reporting framework. This continued the positive result from 2009–10 when no modified audit opinions were issued.
Quality of reporting 
Overall, the financial report preparation processes of public hospitals and their controlled entities were adequate and produced accurate, complete and reliable information, but there are opportunities for improvement in: 
·	establishing financial report preparation plans outlining the processes, resources, milestones and quality assurance practices required
·	preparing and providing timely shell financial statements to enable issues to be identified and resolved earlier
·	preparing materiality assessments to identify potential errors in the financial statements
·	undertaking periodic compliance reviews to identify non-compliance or changes to legislation that impact the financial report.
The average time taken by public hospitals and their controlled entities to finalise their financial statements increased from 7.9 weeks in 2009–10 to 8 weeks in 2010–11. Although a slight increase, this result maintained the significant improvement on 
2008–09 when it took an average of 10 weeks to finalise financial statements.
Financial sustainability
To be financially sustainable, public hospitals need to be able to meet current and future expenditure as it falls due. They must also be able to absorb foreseeable changes and financial risks as they materialise.
The five financial sustainability indicators, analysed for the five years from 2006–07 to 2010–11 were:
·	the underlying result
·	liquidity
·	average days cash available
·	self-financing
·	capital replacement. 
The results of our analysis of the 87 public hospitals, at the hospital category level, are summarised in Figure A.
Figure A	
Financial sustainability risk assessment by hospital category

Source: Victorian Auditor-General's Office.
An analysis of five financial sustainability indicators over a five-year trend period found that the public hospital sector, on average, has an overall medium-risk financial sustainability assessment consistent with 2009–10. The trends showed a slightly improved capacity for hospitals to meet their short-term commitments. However, they are under continuing pressure to meet their long-term commitments from the proceeds of their own operations, particularly to maintain and replace their assets as and when necessary. 
The overall risk to the financial sustainability for public hospitals is medium. However:
·	Twenty-nine public hospitals were considered high risk at 30 June 2011 (26 in 2009–10), most commonly because they were assessed as generating insufficient cash to adequately fund their operations
·	61 per cent of hospitals, including 25 major metropolitan and regional hospitals, had cash holdings equivalent to less than 30 days operating cash outflows. This included 24 hospitals with less than seven days operating cash flows (17 in 
2009–10), nine of which were metropolitan hospitals.
Individual public hospital boards and the department share responsibility for financial performance and management within the sector. During 2011, the department concluded that 29 public hospitals (30 in 2010) did not technically meet the going concern test in the Australian Accounting Standards. This was consistent with our analysis. Consequently, the department provided the boards of those hospitals with a letter of comfort stating that it would provide adequate cash flows to enable them to meet their current and future obligations up to September 2012, should this be required. 
Over and above the analysis of financial sustainability indicators, trends and risks, the ability of management and the governing body to make decisions necessary to affect an entity’s operations needs to be considered in assessing an entity’s performance. For public hospitals, despite the application of sector neutral Australian Accounting Standards and accrual accounting, the funding model does not progressively fund entities for the depreciation of their assets.
The funding model allocates capital grants strategically across the sector rather than progressively to each entity. Funds for replacing assets are not provided until the government considers replacement is appropriate given its strategic review of the sector’s needs and other spending priorities. Nevertheless, legislatively the governing board of each hospital is required to be accountable for the entity’s financial management and performance.
Our analysis showed that funding arrangements have a direct and significant impact on the financial sustainability of public hospitals. The funding model limits the ability of governing bodies and management to make decisions around asset maintenance and replacement, and some major hospitals consistently experience cash shortages. This has implications for the governing boards of public hospitals and their ability to fulfil their legislative responsibilities.
Common internal control weaknesses
General internal controls
Public hospital internal control structures were adequate for financial reporting purposes, although the strength of these systems varied between public hospitals. We identified instances where important internal control mechanisms commonly needed to be strengthened. 
The following internal control mechanisms require strengthening at public hospitals:
·	30 per cent of public hospitals were not independently reviewing masterfile standing data changes 
·	24 per cent had deficiencies in preparing and reviewing key account reconciliations
·	26 per cent needed to improve their management reporting and governance
·	22 per cent had control weaknesses over the acquisition, maintenance and monitoring of assets
·	22 per cent had control weaknesses relating to payroll authorisation and management
·	17 per cent had control weaknesses over the authorisation of supplier payments.
These matters, together with other audit findings and recommendations, were reported to the relevant hospital boards and their management teams. 
Controls over procurement
For the financial year ended 30 June 2011, public hospitals procured goods and services in excess of $1.6 billion. This was an increase of $74 million from the previous year. 
Given the financial significance of public hospital expenditure on supplies and services, and the importance of hospitals achieving value-for-money using taxpayer funds, we reviewed controls and processes for purchasing, in particular those for procurement, tendering and related governance.
The larger metropolitan and regional hospitals generally had more comprehensive policies and internal controls in place compared to rural hospitals, which was pleasing given the relative proportion of expenditure they incur. However, there are opportunities for improvement across the sector, particularly relating to procurement reporting requirements and benchmarking procurement outcomes. The following was noted:
·	58 per cent of public hospitals did not specify reporting requirements or frequency in their procurement policies
·	55 per cent had not developed a clear definition of high-risk, high-value or complex procurement
·	91 per cent did not benchmark their procurement outcomes and costs against external standards
·	46 per cent were unable to demonstrate that procurement policies, practices and processes had been reviewed since 30 June 2009
·	53 per cent had not commissioned internal audits of their procurement activities or practices
·	37 per cent had not included risks associated with procurement in their risk management register.
Controls over information technology security
Given the highly sensitive nature of information held by public hospitals in relation to patients, as well as the financial and operational aspects of the business, effective security over information systems is critical. To protect information from theft or manipulation, hospitals should have appropriate controls over their information technology systems. 
Information technology (IT) system security at public hospitals was generally adequate for protecting and restricting access to sensitive data. The following positive aspects were noted:
·	84 per cent of public hospitals had a documented IT security policy or were in the process of developing one
·	85 per cent of the policies had been reviewed and updated at least once in the past three years
·	68 per cent of public hospitals, including all major metropolitan and regional hospitals, trained staff in IT security policies and procedures
·	92 per cent had established adequate controls and processes to manage changes to IT systems
·	92 per cent had adequate IT risk management policies
·	100 per cent had adequate backup and recovery procedures.
Despite the positive results there are opportunities for improvement at most public hospitals. The opportunities particularly relate to developing information security classification policies for sensitive data, establishing an IT steering committee and monitoring compliance with policies and procedures. Specifically:
·	88 per cent had not developed an information security classification policy to protect sensitive data
·	55 per cent had not incorporated an IT steering committee into their governance structure
·	74 per cent had not performed an internal audit of their IT security in the past three years
·	61 per cent had not established arrangements to monitor compliance with policies and procedures
·	33 per cent did not provide their boards with updates on the status of IT systems and security arrangements.
Recommendations
Number	Recommendation	Pages	
That public hospitals:		
1.	further refine their financial reporting processes by establishing financial report preparation plans, preparing timely shell financial statements and materiality assessments and performing periodic financial compliance reviews	17	
2.	assess their policies and practices against the identified general internal control weaknesses to determine the adequacy of their controls, and whether they are operating reliably, efficiently and effectively	62	
3.	develop comprehensive policies and procedures for procurement and tendering which are appropriately approved and subject to regular review	62	
4.	develop comprehensive policies and procedures over information technology system security which are approved at board level and subject to regular review	62	
5.	develop an information security classification policy that outlines criteria for assigning security classifications to information and the required security controls for each classification	62	
6.	undertake periodic assessments of the adequacy of, and compliance with, information technology security requirements.	62	
Submissions and comments received
In addition to progressive engagement during the course of the audit, in accordance with section 16(3) of the Audit Act 1994 a copy of this report, or relevant extracts from the report, was provided to the Department of Health with a request for comments or submissions.
Agency views have been considered in reaching our audit conclusions and are represented to the extent relevant and warranted in preparing this report. Their full section 16(3) comments and submissions, however, are included in Appendix D.