No audited agency has a complete and accurate server inventory. 

Automated asset discovery tools used by agencies do not capture all servers, and few agencies use reconciliations to crosscheck their server inventory. All agencies provided us with server inventory information that had either incomplete or duplicate entries.

If agencies are not accurately tracking all their servers, they do not have all the information they need to protect their IT infrastructure.

Covered in this section:

We made 3 recommendations to address our findings. The relevant agencies have accepted the recommendations in full or in principle.

What we examined

Our audit followed 2 lines of enquiry:

1. Do agencies track all their servers and apply foundational security controls to them? 

2. Do agencies monitor their server security and strengthen it in response to threats?

To answer these questions, we examined:

Download a PDF copy of Appendix C: Audit scope and method.

Download a PDF copy of Appendix B: Abbreviations, acronyms and glossary.

Download a PDF copy of Appendix A: Submissions and comments.

The plan had an initiative to increase the number of public surgery admissions in private hospitals. Nearly half of the plan's budget was allocated to this initiative. 

However, fewer private hospitals entered into contracts with public health services than the department expected. The initiative fell short of its target by 19,991 admissions. This represents around two-thirds of the shortfall against the plan's overarching target of 240,000 surgeries in 2023–24.

The plan reduced the waiting list and backlog from the pandemic, but the department did not fully meet its key targets. 

Health services delivered 209,925 planned surgeries in 2023–24. This is an increase of 5 per cent from before the pandemic in 2018–19. But it is around 30,000 fewer than the plan's target of 240,000. 

Under the plan the number of patients on the waiting list decreased by 35 per cent from 88,434 in March 2022 to 57,476 in June 2024. The department was close to reaching its target of 55,400 patients remaining on the list in June 2024. 

We made 2 recommendations to address our findings. The Department of Health has accepted the recommendations in full or in principle. 

What we examined

Our audit followed 2 lines of inquiry: 

1. Did the Department of Health (the department) deliver all elements of the COVID Catch-up Plan (the plan)?

2. Were the plan's outcomes achieved?

To answer these questions, we examined the department and the following health services: