Victorian Auditor-General's report
24 October 2012

Effectiveness of Compliance Activities: Departments of Primary Industries and Sustainability and Environment
Audit summary
The overall prosperity of the state relies on a healthy environment and effectively managing natural resources and primary industries to keep them sustainable. This entails controlling or regulating high-risk aspects of their use, preserving economically important industries, meeting community expectations and protecting the environment. 
Compliance with legislation means the actions of those being regulated conform to the conditions imposed by the law. Regulators use a range of activities to encourage compliance and deter noncompliance. These usually include three core elements:
·	encouraging compliance—through education, information, support and incentives, and controls such as licence and permit conditions
·	monitoring compliance—through regular and random inspections, audits, patrols, information and intelligence gathering 
·	responding to noncompliance—by investigating suspected breaches of the law and enforcing the law, for example, through warnings and prosecution.
Noncompliance can contribute to the loss of high-value species, ecosystems and industries. For other species and systems, the cumulative impacts of environmental crime are incremental and less obvious. 
The departments of Primary Industries (DPI) and Sustainability and Environment (DSE) are responsible for sustainably managing the state’s environment, primary industries and natural resources. This includes managing compliance for such diverse sectors as fisheries, agriculture, mining, parks, forests and biodiversity protection. 
DPI has compliance responsibilities and powers under 45 Acts. Sixteen of these are Acts that it administers directly and 29 are administered by other state and Australian government agencies. DSE has compliance responsibilities and powers under 16 Acts—11 that it administers directly and five that are administered by other agencies.
This audit examined the effectiveness and efficiency of DPI’s and DSE’s compliance activities under environment, natural resources and primary industries legislation. This included assessing the risk-base for their compliance approaches and examining how well they promote and monitor compliance, and respond to noncompliance.
Conclusion
Neither DPI nor DSE has a comprehensive whole-of-organisation, risk-based approach to managing their compliance responsibilities. They have not clearly identified how compliance activities contribute to achieving legislative objectives and corporate outcomes, how they measure success, or how they monitor and report compliance performance.
This limits their ability to monitor high compliance risks across the departments and to provide assurance about how well they perform their compliance role and the outcomes achieved. 
As a consequence, DPI and DSE cannot be sure that their compliance activities contribute to protecting natural resources, primary industries and the environment as the legislation intended. 
DPI is addressing a range of issues identified in this audit, having restructured to bring its regulators under the one group to improve central oversight, coordination and alignment, while retaining the individual focus of each. 
DSE's deficiencies are substantial and require a concerted effort to address them. It has known about its poor compliance approach since at least its 2009–10 compliance review, but many of the fundamental problems with DSE’s approach to compliance remain. These include the lack of accountability, oversight and risk-based compliance planning needed to drive a robust and consistent approach across the department. DSE is now starting to make the changes needed to achieve this, including strengthening the role of its compliance steering committee and committing to improved planning.
Findings
Departmental compliance frameworks
An organisation-wide compliance framework provides a common platform of policy, principles and processes to align and guide different regulatory groups in planning and delivering risk-based, fit-for-purpose compliance work.
DPI has some of the elements of a whole-of-organisation approach to compliance but these are not sufficiently developed or applied consistently across its regulators to provide assurance that its compliance efforts are effective. Its three regulators each have many effective compliance processes and practices, but the degree to which their overall approaches are risk-based, well informed, targeted, and reviewed varies. 
A lack of alignment and coordination between regulators has also reduced DPI’s efficiency and transparency in delivering its compliance function. DPI recognises the need for a more cohesive and coordinated approach and has introduced a central regulation and compliance group to strengthen its oversight and assurance.
DSE has a department-wide framework, but it is neither strategic nor comprehensive and is not being used to guide its compliance activities. This is largely because accountability for delivering the approach has not been assigned and senior management’s oversight has been inadequate. 
DSE’s regulatory responsibilities lie mainly with its five regional offices, which share responsibility for a common set of Acts and regulations, including compliance responsibilities. However, there are only isolated examples of strategic, risk-based, consistent, and transparent compliance work across the regions. So while it has some good practices, DSE is not fulfilling its compliance responsibilities consistently or effectively.
Policies, responsibilities and risks 
A compliance policy guides the regulator to perform its responsibilities, and communicates the regulators’ principles and approach to securing compliance to the community and staff.
Despite their considerable powers, neither department has an organisation-wide compliance policy that meets better practice principles for guiding compliance activities. DPI and DSE have not adequately communicated their objectives, principles, responsibilities or approaches in undertaking their compliance roles, including how they will use a risk-based approach to target their work. This increases the risks that their staff will not work effectively and that the community is not as well informed as it needs to be.
DSE has committed to developing and implementing a compliance policy by December 2012. DPI recently reviewed its enforcement policy, but the revised draft still does not incorporate the principles of a good compliance policy.
DSE and DPI need to effectively communicate their compliance obligations and powers to those they have authorised to undertake compliance activities. Each has delegated its responsibilities within the department, however, neither communicates what it expects of its delegates in discharging their responsibilities. Nor do they adequately review how well staff understand and use their delegations. This compromises their ability to effectively act on the delegations and make informed decisions. 
Regulators also need to assess the risks that affect their ability to effectively administer their legislation, and the regulated community’s ability or willingness to comply. They should be targeting their resources and activities at high or unmanaged risks. 
While both departments have corporate risk management systems in place, these are yet to adequately identify and monitor the high compliance risks across all legislation. DSE has a department-wide approach for identifying and managing compliance risks but does not use it. Only DPI’s Fisheries Victoria has a robust and transparent process for identifying its high compliance risks.
Oversight and accountability
Departments need to establish and maintain an effective framework of accountability, oversight and internal control. For regulators, this includes systems designed to assess whether they are achieving legislated objectives, and whether regulations are complied with.
DPI and DSE do not have effective whole-of-organisation oversight of, and assurance about, delivery of their compliance objectives. DPI’s poor central oversight of its compliance functions and DSE’s broader lack of good governance over its functions reduce their control and assurance over how they exercise their powers and meet their responsibilities.
DPI’s regulators have clear accountability for their compliance role. However, it has had no specific central oversight across regulators to provide assurance about the extent to which its compliance activities are being effectively and efficiently delivered. 
DSE has central governance arrangements. However, its active oversight of how the compliance functions are delivered has been minimal. It is now in the process of strengthening this. DSE has not assigned accountability for achieving compliance objectives and this is limiting its ability to drive a strong and consistent compliance effort across the department, monitor its activities and improve performance.
DPI, and to a lesser extent DSE, are introducing stronger central governance and oversight to align and oversee their regulation and compliance work more efficiently, and to provide assurance about their effectiveness to secretaries and their deputies.
Although measuring compliance performance can be challenging, both departments need to be able to monitor the quality and effectiveness of their activities and report publicly on how well they have met their responsibilities.
DPI and DSE are not adequately measuring, monitoring, reporting or reviewing their compliance performance and lack appropriate performance measures, targets and benchmarks. Their departmental performance management systems do not specifically measure compliance performance, or how this contributes to achieving legislative objectives and corporate outcomes.  
DPI has been improving its measures but they are not yet comprehensive or clearly linked to corporate outcomes. DSE has not defined how it will measure its compliance objectives. Inadequate data capture and information management continue to compound these difficulties, particularly in DSE.
Each department has some public compliance reporting, particularly in their annual reports. This is usually activity focused and rarely indicates the extent to which objectives were achieved, and so is not conducive to transparency or accountability.   
Compliance activities 
Regulators prioritise and plan their compliance work, targeting their activities and resources at the highest risks, and selecting the right mix of compliance tools to manage them. Better practice compliance programs use a mix of activities—matched to the type and significance of the compliance issue or risk being addressed—to promote and monitor compliance, and address and deter noncompliance.
Both DPI and DSE are using a range of compliance tools to actively pursue compliance. However, neither has the level of good planning, information management, quality assurance and review needed to effectively target their efforts and to deliver high standards of work. This is particularly important given the wide range of powers the departments exercise across a large number of Acts, and in diverse settings across the state.
DPI’s regulators each deliver a comprehensive program of compliance activities across their responsibilities but the quality of the risk assessment and information used to develop these programs varies across regulators. 
DSE’s regions rarely use a transparent, risk-based approach or any other clear rationale to inform the decisions they make about which compliance issues they will address, and how they will do it—even though its statewide compliance strategies have included a risk-based process for doing this since 2008. Instead, it conducts a series of largely reactive, one-off investigations and operations rather than adopting a targeted approach.
DSE has committed to developing risk-based regional compliance plans, with the first due in December 2012.
Managing the quality of compliance work 
Regulators need to support controlled, consistent and transparent compliance work, and the appropriate use of powers by authorised officers. This involves recruitment, training and authorisation strategies to match staff skills and experience to compliance requirements. Standards, procedures and review processes are used to support these officers in conducting their work.
DPI has comprehensive work standards, which it generally follows, to support the quality of its compliance work—such as conducting inspections and managing seized property. DSE does not have comprehensive work standards and does not consistently use those it has. Its work is poorly documented, is not reviewed in any systematic way to support continuous improvement, and does not balance planned and reactive efforts as intended.
Neither department has an agency-wide approach for recruiting compliance staff or has centrally planned, controlled and consistent training and professional development for all authorised officers. Both lack a transparent complaints management policy and central register to support good practice and to accurately monitor complaints.
Recommendations
Number	Recommendations	Page	
1.	The departments of Primary Industries and Sustainability and Environment should strengthen their whole‑of‑department compliance frameworks by:
·	developing whole-of-department compliance policies and specific regulator policies, as appropriate, that meet better practice criteria—including describing education and enforcement approaches, and making relevant information publicly available 
·	improving how they manage delegations—including maintaining current registers of delegations and Acts with compliance responsibilities, communicating expectations for managing delegations, and regularly assessing how well the delegations are used
·	transparently identifying and monitoring high compliance risks across all Acts and regulations, and reporting these to senior management
·	improving oversight and assurance of their compliance functions by better monitoring how they manage their compliance responsibilities—including through regular external review, and, for the Department of Sustainability and Environment, by also assigning clear accountability for its compliance functions and the statewide compliance strategy.	20	
2.	The departments of Primary Industries and Sustainability and Environment should establish department-wide compliance performance management systems that identify:
·	a core set of compliance outcomes 
·	relevant, appropriate and representative compliance performance measures of effectiveness against the outcomes and compliance objectives
·	transparent internal reporting and balanced public reporting on compliance
·	targeted and reliable compliance data and information sets relevant to the performance measures, based on a data and information gap analysis.	20	
3.	The regulators within the departments of Primary Industries and Sustainability and Environment should:
·	rigorously and transparently prioritise and plan their compliance work under all relevant Acts 
·	regularly and systematically review how consistently and objectively they conduct all types of enforcement actions.	33	
4.	The Department of Sustainability and Environment should: 
·	develop and implement regional compliance plans that are risk-based, soundly targeted, consistent and aligned with corporate priorities and the statewide compliance strategy
·	develop an achievable, detailed plan for delivering its statewide compliance strategy, and implement it.	33	
5.	The Department of Sustainability and Environment should strengthen its management of wildlife and plant licences and permits by:
·	upgrading the wildlife and plant licence and permit systems without further delay
·	requiring staff to record all relevant information in the systems, such as licensee inspections and interviews, and periodically reviewing how they use the systems
·	accurately recording the number of licences, permits and authorisations it issues, and making this information publicly available 
·	reviewing its policy on using licence conditions and sanctions as a response to noncompliance.	33	
6.	The departments of Primary Industries and Sustainability and Environment should identify and centrally document core processes for managing the work standards, recruitment, training and authorisation of compliance officers and central systems for coordinating and reviewing these activities	33	
7.	The departments of Primary Industries and Sustainability and Environment should each: 
·	develop and implement a whole-of-department, better practice complaints management policy and training 
·	publish the policy on its website
·	record all complaints in a central register(s), monitor complaints data and use this information to improve regulatory policies and processes. 	33	

Submissions and comments received
In addition to progressive engagement during the course of the audit, in accordance with section 16(3) of the Audit Act 1994, a copy of this report was provided to the departments of Primary Industries and Sustainability and Environment with a request for submissions or comments.
Agency views have been considered in reaching our audit conclusions and are represented to the extent relevant and warranted in preparing this report. Their full section 16(3) submissions and comments are included in Appendix B.