Victorian Auditor-General's report
14 November 2012
Water Entities: Results of the 2011–12 Audits
Audit summary
This report presents the results of our financial audits of 20 entities, comprising 19 water entities and one controlled entity. It provides a detailed analysis of financial and performance reporting, their internal controls, financial results and sustainability. 
Clear audit opinions were issued on 19 financial reports for the financial year-ended 30 June 2012. At 2 November 2012 the financial report of Watermove was yet to be finalised.
Clear audit opinions were issued on all 16 performance reports for the year.
Conclusion
Notwithstanding some areas for improvement, Parliament can have confidence in the adequacy of financial and performance reporting and the internal controls of the entities audited.
Findings
Financial results and sustainability
The 19 water entities generated a combined net profit before income tax of $605 million for the year-ended 30 June 2012, an increase of $195 million or 48 per cent from the prior year, predominantly due to increased service and usage charges. Dividend payments to the state government increased by $198 million or 278 per cent in 2011–12.
The four metropolitan water entities continue to generate strong profits year-on-year. However, four of the 13 regional urban water entities (31 per cent) reported a lower net profit before tax in 2011–12 relative to the prior year and eight reported a net loss before tax (five in 2010–11). The two rural water entities continue to report losses. 
Most entities are in the low- and medium-risk categories for financial sustainability, however, the data shows a deteriorating trend for the industry as a whole over the five‑year period to 2011–12. The number of entities with a poor underlying result has doubled over the five-year period while the liquidity ratio has shown no sign of improvement in recent years. While the interest cover ratio is strong for many entities, indicating they are able to service their interest payments, the debt service cover for two metropolitan water entities indicates their ability to repay debt is low. Due to the overbilling issue of 2011–12 following delays with commissioning of the desalination plant, the 2012–13 price freeze will impact revenue and operating cash flows of the metropolitan water entities in the short term. In turn this further impacts their ability to repay debt.
Our analysis of capital expenditure for the period 2008–09 to 2011–12 revealed that actual expenditure is likely to differ from the regulatory target as outlined in the Essential Service Commission price determinations. Therefore the prices levied may result in significant under or over recovery of costs by the water entities during the regulatory period.
Performance reporting
The absence of targets continues to reduce the usefulness of performance reports because a comparison of actual performance against targets cannot be made. 
A performance reporting working group was established in 2011–12 to develop a consistent and contemporary performance reporting framework for the water industry. Its intention is that the new performance reporting framework will apply from 1 July 2013. 
Internal controls
The internal controls were adequate for producing reliable, accurate and timely financial reports. Nevertheless, a number of areas for improvement were identified.
Information technology control weaknesses were identified at 53 per cent of entities (10 of 19) which is concerning given the sensitivity of information captured by the entities, and the heavy reliance on information systems.
A number of internal control weaknesses reported to management of 10 entities in 2010–11 or earlier are yet to be resolved by management. The governing bodies need to take more timely action to rectify this situation and to demonstrate a commitment to ensuring sound internal controls are in place and that they are operating effectively.
Risk management practices are considered mature with all entities regularly reporting to their governing bodies on risk management matters. 
Overall, there were adequate internal controls over water tariff revenue. However, poor security controls over point of sale technology and noncompliance with the requirements for processing of credit and debit card payments increases the risk of identity theft and fraud.

Recommendations
Number	Recommendation	Page	
1 & 2.	Water entities should further refine their financial and performance reporting processes by developing plans, preparing shell statements, performing materiality assessments, conducting analytical and compliance reviews, having adequate security to protect and safeguard sensitive information and improving their quality assurance processes.	16, 24	
3.	The performance reporting working group should continue to develop and implement a consistent and contemporary performance reporting framework, in line with its time lines and our proposed expanded opinions from 2013–14.	24	
4.	Water entities should set targets for all indicators in their performance reports to enable meaningful assessment of performance.	24	
5.	The Essential Services Commission should revisit the duration of the water plans and the funding model's flexibility to deal with situations where the actual financial outcomes differ significantly from what was proposed in the approved water plans due to changed circumstances and/or environmental conditions.	36	
	Water entities should:		
6.	assess their policies and procedures against the common general internal control weaknesses and the better practices identified, and act in a timely manner to address shortcomings	72	
7.	take timely action to address identified information technology, fixed assets, payroll, billings system and accounts receivable and general ledger reconciliation control weaknesses	72	
8.	address long outstanding internal control weaknesses immediately, to demonstrate a commitment to management's responsibilities for ensuring sound internal controls are in place and are operating effectively	72	
9.	strengthen their oversight of credit notes by generating reports that detail the number and dollar value, key reason, action taken or planned and a trend analysis	72	
10.	develop and maintain comprehensive credit/debit card policies and procedures which are appropriately approved and subject to regular review	72	
11.	assess compliance against the requirements of the 
Payment Card Industry–Data Security Standard and act quickly to achieve compliance in order to protect the security of customer credit and debit card information and data	72	
12.	change the default security settings on their key information systems and databases, including point of sale systems, immediately.	72	
Submissions and comments received
In addition to progressive engagement during the course of the audit, in accordance with section 16(3) of the Audit Act 1994 a copy of this report, or relevant extracts from the report, was provided to the Department of Treasury and Finance, the Department of Sustainability and Environment, the Essential Services Commission, VicWater and the 20 entities with a request for submissions or comments.
Agency views have been considered in reaching our audit conclusions and are represented to the extent relevant and warranted in preparing this report. Their full section 16(3) submissions and comments however, are included in Appendix H.