Implementing the Gifts, Benefits and Hospitality Framework

Victorians trust that public sector employees will perform their duties impartially and use public resources responsibly to pursue government's objectives and benefit the community. The giving and receiving of gifts, benefits and hospitality (GB&H) can be a legitimate and appropriate part of doing government business. However, the inadequate management of these activities risks diminishing public trust and undermining the integrity of decisions made by public sector employees.

Maintaining transparency around public sector activities is essential if the community is to effectively scrutinise public sector performance and hold governments to account. Greater transparency also promotes a culture where the level of trust between employees, agencies and the community is enhanced, and where integrity within the public sector is strengthened.

Managing GB&H is complicated because they can be essential for public sector employees to do their jobs properly. However, they can create conflicts of interest between employees' personal interests and their public duty, and can diminish public trust if spending on GB&H is considered lavish or inappropriate.

Recent investigations, audits and research across Australia have highlighted the risks associated with public sector employees providing or receiving GB&H.

This audit is focused on a sample of Victorian creative industries agencies. The nature of their operational environments creates specific challenges for managing GB&H activities. The provision and receipt of GB&H plays a legitimate and critical role in these agencies achieving their government-endorsed objectives. This could be accepting GB&H to generate revenue from sponsor-attended events or because employees are responsible for overseeing funded events and accepting offers to attend.

In managing GB&H agencies are currently guided by a framework issued by the Victorian Public Sector Commission (VPSC) in conjunction with a Premier's Circular. These both includes a set of minimum requirements and accountabilities. Compliance with the framework requires agencies to include these in their policies, but stops short of mandating their achievement.

Audit objective and scope

This audit goes beyond testing this minimum level of compliance to examine whether selected agencies have effectively managed the risks associated with providing and receiving GB&H. The audit included the following creative industries agencies: Creative Victoria (CV) (a division within the Department of Economic Development, Jobs, Transport & Resources), Museum Victoria, Arts Centre Melbourne (ACM) and the National Gallery of Victoria (NGV).

Conclusions

Agencies cannot show how they are effectively managing GB&H activities or applying the minimum requirements and accountabilities of the current framework.

While they have documented policies that include the minimum requirements and accountabilities, this approach is not sufficient to manage the significant risks to their impartiality and integrity.

Specifically agencies have not:

• effectively managed GB&H activities—they comply with the framework but fall short of effectively managing the risks from receiving and providing GB&H
• monitored, reviewed and reported on GB&H activities to provide assurance about their performance and provide the basis for effective oversight
• systematically identified, analysed and evaluated the risks or the effectiveness of current controls in mitigating the risks these activities pose
• followed a structured, systematic approach to selecting and applying treatments to address these risks
• adequately consulted and communicated with employees and other key stakeholders, such as suppliers and funded organisations, to provide clarity about what is acceptable and what to do if they observe poor practices.

This lack of transparency in how these activities are managed further highlights the risks to agencies' impartiality and integrity.

Our recommendations target two areas:

• how these agencies should improve their practices to better manage GB&H and the associated risks
• the need for the Department of Premier & Cabinet (DPC) and VPSC to update the guidelines to require agencies to effectively manage these risks.

Findings

Agencies' management of GB&H

Agencies cannot show how they are effectively managing GB&H activities or applying the minimum requirements and accountabilities of the current framework. This is because the way agencies currently document and analyse GB&H information lacks rigour which highlights the need for greater scrutiny and transparency in managing these activities.

Our analysis of agencies GB&H activities identified examples of clear risks that had not been flagged and appropriately treated, including potential conflicts of interest, unclear business benefits and gifts of an inappropriate value being accepted.

Agencies have not adequately monitored, reviewed and reported on GB&H activities and associated risks. Oversight has not been sufficiently informed by an adequate analysis of GB&H activities. This means agencies have not generated the information needed to adequately review the management of GB&H activities.

The processes used are not adequate to record and transparently mitigate the risks generated by GB&H activities.

Specifically we found:

• no internal management reporting on GB&H activities or risks, except at NGV where a six-monthly report was introduced in July 2015
• the absence of meaningful review of GB&H activities, for example by internal auditors, except at CV where the former State Services Authority conducted a review following adverse findings by the Victorian Ombudsman in 2011
• ACM introduced reporting on GB&H activities in its quarterly compliance reports to its audit committee commencing in October 2015.

other than NGV's recent reporting, the only form of regular review was through audit committees considering policy updates and annual gift registers and attestations. However, the information supporting these submissions was generally insufficient and we were unable to confirm the rigour and depth of review from the records of these meetings. Agencies need to improve how they monitor and report on GB&H activities and risks to provide the basis for more effective oversight by management and audit committees. In addition CV needs to be more visible and proactive in its oversight role for state-owned creative organisations and cultural facilities. All recommendations applying to CV have been directed to the Department of Economic Development, Jobs, Transport & Resources, because CV is a division within this department.

Understanding GB&H risks

Agencies have documented policies that include the minimum requirements and accountabilities of the current GB&H framework. However, this approach of doing the minimum necessary to comply is not sufficient to effectively manage the risks from receiving and providing GB&H because the way agencies identify, evaluate and treat these risks is inadequate.

Agencies' approaches to consulting and communicating with staff and stakeholders have not been adequate:

• They could not show that they had regularly consulted staff and relevant external stakeholders in any structured way to understand the GB&H risks.
• They relied too heavily on a passive approach to informing and training staff about GB&H policies and risks. Staff were expected to read material or complete e-learning modules when joining the organisation. Only ACM delivered face-to-face training to new staff which included GB&H.
• They had not communicated their GB&H expectations and acceptable practices to suppliers. The one exception to this was an NGV email sent to suppliers advising them of the terms of their GB&H policy.

The results of VSPC's People Matter Survey clearly show areas of potential weakness, including how well staff understand GB&H policies and a lack of confidence and knowledge about the mechanisms they can use to highlight potential misconduct.

Agencies need to improve how they communicate with employees and stakeholders and need to measure their effectiveness in communicating key GB&H requirements and what to do if poor practices are observed.

DPC and VPSC need to revamp the GB&H framework. The creative industries agencies included in this audit should not wait for the revision of the framework but should act to effectively manage the risks associated with GB&H.

Recommendations

1. That the Department of Economic Development, Jobs, Transport & Resources, Museum Victoria, Arts Centre Melbourne and the National Gallery of Victoria review and revise their management of the receipt and provision of gifts, benefits and hospitality to better understand and scrutinise these activities.
2. That the Department of Economic Development, Jobs, Transport & Resources, Museum Victoria, Arts Centre Melbourne and the National Gallery of Victoria review and revise how they monitor and report on gifts, benefits and hospitality activities by:

• introducing regular management and audit and risk committee reports on the receipt and provision of gifts, benefits and hospitality to identify trends and emerging risks, and recommend how to address these
• accompanying the annual tabling of gift registers to audit committees with reports that adequately inform about the risks, the effectiveness of existing controls and any additional required mitigation activities
• using the annual gift register tabling to propose any amendments required to existing gifts, benefits and hospitality policies.

3. That the Department of Economic Development, Jobs, Transport and Resources play a more visible and active oversight role by:

• communicating the importance of this audit's findings and recommendations to all state-owned creative organisations and cultural facilities
• following up on agencies' progress in applying the recommendations and updating the Minister for Creative Industries on their progress in addressing these risks.

4. That the Department of Economic Development, Jobs, Transport & Resources, Museum Victoria, Arts Centre Melbourne and the National Gallery of Victoria review and revise their management of the receipt and provision of gifts, benefits and hospitality to effectively manage the risks by:

• identifying and evaluating the risks to their impartiality, integrity and reputation
• developing and implementing evidence-based treatments to address these risks where existing controls are inadequate
• demonstrating the extent to which they have delivered on the minimum requirements and accountabilities of the government's gifts, benefits and hospitality framework.

5. That the Victorian Public Sector Commission and the Department of Premier & Cabinet review and update the gifts, benefits and hospitality framework to achieve the outcome of agencies demonstrating the effective management of gifts, benefits and hospitality risks including:

• being clear about the intended outcomes that agencies need to achieve
• requiring the collection of sufficient evidence so agencies can demonstrate the achievement of minimum requirements
• requiring agencies to publish gifts, benefits and hospitality registers on their websites.

6. That the Department of Economic Development, Jobs, Transport & Resources, Museum Victoria, Arts Centre Melbourne and the National Gallery of Victoria:

• review and improve the way they consult on and communicate gifts, benefits and hospitality activities and policies
• measure how successful communication and training have been in fully informing staff and stakeholders about intended gifts, benefits and hospitality behaviours and in achieving the desired outcomes.

Submissions and comments received

We have professionally engaged with the Department of Premier & Cabinet, the Victorian Public Sector Commission, the Department of Economic Development, Jobs, Transport & Resources, Arts Centre Melbourne, the National Gallery of Victoria and Museum Victoria throughout the course of the audit. In accordance with section 16(3) of the Audit Act 1994 we provided a copy of this report to those agencies and requested their submissions or comments.

We have considered those views in reaching our audit conclusions and have represented them to the extent relevant and warranted. Their full section 16(3) submissions and comments are included in Appendix A.

1.1 Introduction

Victorians trust that public sector employees will perform their duties impartially and use public resources responsibly to pursue government's objectives and benefit the community. The giving and receiving of gifts, benefits and hospitality (GB&H) can be a legitimate and appropriate part of doing government business. However, the inadequate management of these activities risks diminishing public trust and undermining the integrity of decisions made by public sector employees.

The Code of Conduct for Victorian Public Sector Employees is legally binding and describes how employees should apply core values. This includes demonstrating:

• integrity by avoiding any real or apparent conflicts of interest and striving to earn and sustain a high level of public trust
• impartiality by making decisions and providing advice on merit and without bias, caprice, favouritism or self-interest
• accountability by seeking to achieve the best use of resources and submitting themselves to appropriate scrutiny.

Maintaining transparency around public sector activities is essential if the community is to effectively scrutinise public sector performance and hold governments to account. Greater transparency also promotes a culture where the level of trust between employees, agencies and the community is enhanced, and where integrity within the public sector is strengthened. Figure 1A describes what we mean by GB&H.

Figure 1A

Defining gifts, benefits and hospitality

Source: Victorian Auditor-General's Office based on the Victoria Public Sector Commission's Gifts, Benefits and Hospitality Policy Framework, 2012.

1.2 Challenges in managing GB&H

Managing GB&H is complicated because they can be essential for public sector employees to do their jobs properly. However, they can create actual or perceived conflicts of interest between employees' personal interests and their public duty, and can diminish public trust if spending on GB&H is considered lavish or inappropriate.

The vastly different roles and operating contexts across the public sector mean that a rigid 'one size fits all' approach is not suitable. Banning these activities is an option but may hamper agencies in their legitimate pursuit of government objectives.

For some organisations, these activities are a constant and core component of their operations. For example, where they provide and receive GB&H in order to promote overseas trade or attract sponsorship and support for the creative industries. For other agencies, these activities should be restricted to a level commensurate with recognising employees' service and facilitating normal business-related meetings and training.

1.3 Legislative and policy framework for GB&H

Figure 1B shows the legislative and policy framework for GB&H. The most relevant material is contained in the 2012 Premier's Circular and the related Victoria Public Sector Commission (VPSC) guidance.

Figure 1B
Legislative and policy framework

Source: Victorian Auditor-General's Office.

The Victorian Premier asked the State Services Authority—now VPSC—to update the previous framework in light of reviews of GB&H practices at the former Arts Victoria, now Creative Victoria (CV), and the public criticism that followed an expensive in‑house function at Film Victoria in 2011.

The revised VPSC framework was expanded to include guidance on the provision (as well as the receipt) of GB&H. It was issued in conjunction with a Premier's Circular that included the minimum requirements and accountabilities shown in Figure 1C. The revised framework recognised that different operational environments meant agencies would need to work out how best to apply the requirements to their specific circumstances while managing the risks. It included information to help agencies:

• develop and review policies by understanding the role of GB&H, assessing the risks and deciding how to manage these risks
• apply policies by deciding when to accept, and when and how to provide GB&H to staff and external guests
• adequately record and report on the receipt and provision of GB&H.

While the framework recognises that GB&H risks need to be effectively managed, compliance only requires agencies to incorporate the minimum requirements and accountabilities in their GB&H policies. Putting these requirements into operation critically depends on agencies' internal capability and oversight. External oversight is based on the heads of administrative offices, special bodies and other public entities making an annual attestation to their portfolio department, stating their compliance with the GB&H framework and the adequacy of their communication and review processes. These are then submitted along with a similar departmental attestation to VPSC.

Figure 1C

Summary of the gifts, benefits and hospitality policy framework requirements

Source: Victorian Auditor-General's Office.

1.4 Risks of the inappropriate use of GB&H

Recent investigations, audits and research across Australia have highlighted the risks associated with public sector employees providing or receiving GB&H. These show how the inadequate management of GB&H was a critical catalyst for corrupt behaviour, either as an inducement to corrupt procurement processes or an outlet for the improper use of public funds.

It is therefore critical that sound management processes are established to prevent a poor approach to GB&H from developing into corrupt conduct.

1.4.1 Investigations and audits

Inappropriate practices have been found by investigations and audits conducted in Victoria, New South Wales (NSW) and Western Australia (WA):

• The Victorian Independent Broad-based Anti-Corruption Commission's investigations into the procurement of public transport infrastructure and allegations of corruption in the former Department of Education found evidence that public sector employees had obtained financial advantage by deception and improperly used state funds to purchase GB&H.
• The Victorian Ombudsman in 2011 and 2012 found serious weaknesses in how the former Arts Victoria and the Victorian Building Commission managed GB&H.
• The NSW Independent Commission Against Corruption (ICAC), between 2007 and 2012, investigated multiple cases where public officials had accepted gifts from suppliers to induce orders or award contracts covering local councils, a university and a state utility.
• Performance audits in NSW and WA found weaknesses in sampled agencies' policies in this area and how they had been applied.
• A financial audit review of urban water entities in Victoria in 2015 found weaknesses in the policies of Melbourne Water and three metro water retailers.

The different functions and powers of these organisations meant the anti-corruption commissions' findings focused on corrupt behaviour, while the integrity bodies' findings focused more on gaps and weaknesses in the processes and controls.

1.4.2 Research

The following research sheds light on the risks of providing and receiving GB&H:

• VSPC's annual People Matter Survey shows weaknesses in public sector employees' understanding of the policies relevant to GB&H and uncertainty about what to do if they observe inappropriate behaviour.
• ICAC in NSW surveyed the extent to which suppliers in NSW think public officials are offered gifts by suppliers and the likelihood that officials accept these gifts. It found that:
  • half of those responding thought that gifts and benefits worth more than $20 were frequently offered by suppliers to public officials
  • two-fifths of suppliers thought public officials frequently accept such gifts.

This demonstrates that risks to the public sector's integrity and reputation are significant and are especially relevant where public sector agencies:

• procure goods and services or provide grants and sponsorship
• influence, through statutory or regulatory powers, decisions that are material to organisations outside of the state government sector.

The success of agencies in managing these risks currently depends on their capability to translate mostly high-level requirements and guidance into effective internal processes. External oversight is based on declarations of compliance and is unlikely to detect weaknesses that have not been dealt with by agencies' internal controls.

1.5 Operating context for creative industries agencies

This audit is focused on a sample of Victorian creative industries agencies. The nature of their operational environments creates specific challenges for managing GB&H activities.

1.5.1 Challenges in managing GB&H activities

The provision and receipt of GB&H play a legitimate and critical role in these agencies achieving their government-endorsed objectives. Specifically these agencies:

• need to generate a significant proportion of their revenues from sponsorships and donations from individuals and organisations external to government—this involves providing GB&H and attending events
• are responsible for the oversight and successful delivery of a range of artistic performances and events and in pursuing these objectives require staff to attend events for free, and promote events by providing GB&H.

Keeping GB&H activities to a minimum—such as for agency meetings, training, recognising staff achievements and promoting government policies and programs—would impair the achievement of these agencies' objectives.

This means that effectively managing the risks around GB&H activities is a greater challenge for these agencies. Policies and processes need to clearly identify the risks and the benefits before making transparent and rational decisions about the acceptance or provision of GB&H.

1.5.2 Recent changes at Creative Victoria

CV, previously Arts Victoria, was subject to reviews by the Ombudsman and State Services Authority in 2011. In response to criticism about the acceptance of hospitality, in particular free tickets to events, CV:

• amended staff position descriptions to include the requirement to attend exhibitions, arts functions and performances where this is part of their role
• created an event attendance policy to guide staff acceptance of offers of tickets and an events register to formally record all events attended
• included, in service agreements between the state and creative industries agencies, the requirement to invite relevant CV staff to events so they can attend in an oversight role on behalf of the state.

1.5.3 Creative Victoria's oversight role

CV is a division within the Department of Economic Development, Jobs, Transport & Resources. It is responsible for advising and supporting the Minister for Creative Industries, and providing funding, support and oversight for state-owned creative organisations and cultural facilities.

In this oversight role, CV provides strategic leadership and advice in relation to governance and reporting arrangements, including finance and corporate development functions, business plans and budgeting, board statutory appointments and legislative reforms.

1.6 Audit objective and scope

The existing whole-of-government policy framework requires agencies to have GB&H policies in place that reflect a set of minimum requirements and accountabilities. This audit goes beyond testing strict compliance with the current GB&H framework to examine whether agencies have effectively managed their GB&H risks. This is because having comprehensive policies but not applying them is not an acceptable outcome.

Taking a risk-based approach means applying a systematic framework to identify, analyse and prioritise risks, and then using this information to determine where best to focus resources and risk management activities. A risk-based approach focuses on achieving outcomes and policy objectives, rather than doing the minimum necessary to comply with regulatory or legislative requirements.

The objective of this audit is to examine whether agencies have effectively managed the risks associated with the provision and receipt of GB&H by:

• building a clear understanding of how agencies use GB&H as the basis for identifying, assessing and evaluating these risks
• determining and applying treatments to appropriately address these risks, taking account of legislative requirements and government guidelines
• consulting and communicating with employees and stakeholders to understand the risks and clearly convey how GB&H should be treated
• monitoring and reviewing the risks and the impact of treatments to provide assurance about their management and the basis for improving their performance.

The audit is focused on creative industries agencies and includes:

• CV which oversees nine state-owned creative industries agencies and is responsible for 21 state-owned cultural facilities and assets
• three large creative industries agencies which are set up as state-owned statutory authorities, with their own boards and audit committees:
  • Museum Victoria
  • National Gallery of Victoria
  • Arts Centre Melbourne
• VPSC because of its role in providing guidance and support to agencies regarding the development of GB&H policies
• the Department of Premier & Cabinet because it is the portfolio department for the VPSC and is responsible for advising the Premier on matters relating to the VPSC which is likely to include advice on the content of an amended GB&H framework and updated Premier's Circular.

1.7 Audit method and cost

The audit team reviewed the documents held by the audited agencies along with the legislative requirements, standards and guidelines. The team also met and interviewed personnel responsible for the management and oversight of this area.

The audit was conducted in accordance with section 15 of the Audit Act 1994 and the Australian Auditing and Assurance Standards.

Pursuant to section 20(3) of the Audit Act 1994, any persons named in this report are not the subject of adverse comment or opinion.

The total cost of the audit was $375 000.

1.8 Structure of the report

The report is structured to examine:

• in Part 2—how effectively agencies are managing, monitoring and reporting on GB&H activities
• in Part 3—the reasons for these outcomes by looking at the quality of agencies' approaches to the management of GB&H risks, stakeholder consultation and communication, and performance against the GB&H policy framework.

2.1 Introduction

Agencies should be able to demonstrate how they are effectively managing gifts, benefits and hospitality (GB&H), including monitoring and reporting on activities and applying effective oversight arrangements to show how well they are meeting the minimum requirements and accountabilities of the government's GB&H framework.

This Part of the report examines:

• agencies' approaches to managing GB&H activities and whether they are effectively applying the policy framework requirements
• the quality of agencies' GB&H monitoring, reporting and oversight activities.

2.2 Conclusion

Agencies are not effectively managing GB&H activities. The way they currently document and analyse GB&H information lacks rigour, which highlights the need for greater scrutiny and transparency in managing these activities. Agencies cannot show that they are meeting the minimum requirements and accountabilities of the current policy framework.

Agencies' monitoring and reporting on GB&H activities have not been sufficiently informed by an adequate analysis of these activities and is instead confined to case-by-case assessments. These processes are not adequate to transparently mitigate the risks generated by GB&H activities.

2.3 Agency management of GB&H

This Section assesses whether agencies' approaches to GB&H management have been effective by:

• analysing the gift registers and financial records describing how agencies have managed GB&H activities
• assessing whether agencies have met the policy framework's minimum requirements and responsibilities.

Agency approaches have been ineffective for understanding and treating potentially significant risks to the integrity of agencies' decision-making and their reputation. We found examples of clear risks that had not been flagged and appropriately treated.

We examined the overall scale and composition of offers of GB&H received by agencies and the provision of GB&H to people within and external to these agencies. This involved examining:

• registers of GB&H offers and financial transactions for the GB&H provided
• samples of 10 GB&H offers and 10 GB&H provision transactions for each agency.

Creative Victoria (CV) has taken a different approach to managing GB&H offers, refusing all offers unless they involve attendance at events and performances related to employees' roles within the organisation. These are managed according to CV's event attendance policy and recorded on an events register, as discussed at 2.3.2.

2.3.1 Offers of GB&H—creative industries agencies

Our analysis of gift registers and financial transactions at Museum Victoria (MV), Arts Centre Melbourne (ACM) and the National Gallery of Victoria (NGV) highlighted the following risks:

• potential conflicts of interest—a large number of often multiple GB&H offers from organisations that received payments through contracts or grants
• unclear business benefits—difficulty in identifying the business benefits from often substantial entertainment-related offers of GB&H
• the inappropriate value of accepted gifts—the excessive value of a small number of gifts accepted and retained by agency staff.

Figure 2A shows the number and value of GB&H offers received and accepted for 2013–14 and 2014–15. Of the accepted offers, it also shows the number and value of offers that came from organisations that were contracted or funded by these agencies.

Figure 2A shows that agencies received between 38 and 214 GB&H offers and accepted the vast majority of these. The policy framework does not require agencies to record offers that were received but declined. One agency advised us that they declined many more offers of GB&H then they accepted, but these were not recorded.

The most significant finding is that between 45 to 54 per cent of accepted offers came from organisations that were paid between $2.3 and $9.3 million by these agencies. There are clear potential conflicts of interest in accepting GB&H from organisations that are also contracted or funded by these agencies with the potential distortion or influencing of procurement and funding decisions.

Figure 2A

GB&H offers 2013–14 and 2014–15

Source: Victorian Auditor-General's Office based on data provided by agencies.

Figure 2B highlights examples of accepted GB&H offers that represent clear potential risks that are not being transparently managed by these organisations.

These examples highlight potential conflicts of interest, unclear business benefits and a small number of high value and inappropriate gifts that were accepted. Gift registers have not explained and mitigated these risks and they have not been adequately communicated to management and the relevant audit committee.

We also found several examples of multiple offers from the same organisation without any analysis of these offers beyond recording their individual details.

We note that NGV had a relatively small circle of senior staff accepting offers of GB&H when compared to ACM and MV. This should make it easier for NGV to connect accepted offers to the roles and responsibilities of those accepting these offers. All organisations need to reflect in employees' position descriptions where they are expected to accept GB&H as part of their role.

ACM sent an all staff email in September 2015 to confirm that only the chief executive officer should accept invitations to sporting events that elevated the profile of the organisation and assisted in gaining sponsorship and funding. ACM did this at the suggestion of the audit committee.

Figure 2B

Examples of high-risk accepted gifts, benefits and hospitality

Source: Victorian Auditor-General's Office.

Our detailed examination of 30 accepted GB&H offers—10 each for NGV, MV and ACM—confirmed the need for greater transparency and scrutiny in managing these offers and the risks they give rise to.

The way agencies record these offers does not allow them to:

• identify potential conflicts of interest or how these have been managed
• explain the expected benefits that persuaded employees to accept offers and whether and how these benefits had been realised.

In addition we found examples of incomplete documentation, examples where documents had not been completed within prescribed time frames and inconsistencies within organisations in recording multiple offers from the same source.

MV provided the most detailed reasons for accepting GB&H offers describing these as opportunities to network and build relationships with industry stakeholders. However, the potential conflicts of interest, such as accepting GB&H from contracted businesses, were not identified or transparently managed.

Our analysis of these samples highlights the need for agencies to apply greater scrutiny and transparency in assessing and accepting offers. They need to improve their documentation and accompany this with sufficient training so that affected staff adequately record and justify their acceptance of offers of GB&H. They should also communicate their approach to GB&H with external stakeholders to promote a clear understanding of their expectations, while reducing the risk that inappropriate offers will be made. This is discussed in Part 3 of this report.

Current approaches are insufficient to show that agencies have followed the framework's requirements of refusing all offers:

• that could be reasonably perceived as undermining the integrity and impartiality of their organisation and themselves
• where they are likely to make decisions affecting the donor—we believe individuals have interpreted this requirement too narrowly, for example, agency staff may accept GB&H from a contracted party because they were not personally on the procurement panel which appointed them and therefore consider they did not directly influence decision-making.

2.3.2 Offers of GB&H—Creative Victoria

CV is different to the other audited agencies. It applies an events attendance policy to manage offers to attend events and performances—including the provision of food and drinks—connected to employees' roles within the organisation. CV requires employees to record any offers of GB&H outside of this policy on the Department of Economic Development, Jobs, Transport & Resources' (DEDJTR) GB&H register. CV confirmed that in 2013–14 and 2014–15 employees accepted no GB&H offers outside of attending work-related events.

CV employees are required to attend certain events and record one of six reasons:

• funded service delivery
• sector knowledge/issue awareness
• relationship management
• professional development
• state/official function
• personal attendance.

As most of these events are outside of work hours the policy allows staff to take a guest along on a free ticket and the value of the benefit recorded includes the price a guest would have paid to attend.

In 2013–14 and 2014–15, CV staff attended 1 649 events with the attendance of guests valued at $106 346. Most of these tickets were provided by funded arts organisations. CV demonstrated the link between the individuals' position descriptions and their attendance at events and these included:

• requirements in position descriptions or professional development plans to attend events to discharge oversight duties or to develop sector knowledge
• provisions in agreements stipulating CV staff attendance at funded events.

Through these practices CV has avoided the type of potential conflicts found for the other agencies' GB&H activities.

2.3.3 Providing GB&H—all agencies

The Premier's Circular requires that all public officials ensure that GB&H provided:

• furthers the conduct of official business or other legitimate organisational goals, or promotes and supports government policy objectives and priorities
• incurs costs that are proportionate to the benefits obtained for the state and would be considered reasonable in terms of community expectations.

We estimated GB&H expenditure at the four audited agencies by aggregating accounts that clearly included these activities. We then examined the documentation underpinning a sample of 40 GB&H expenses (10 for each agency).

The two clear findings from this analysis are that:

• the absence of a precise and comprehensive definition of 'hospitality provision' in the current guidelines means we are not confident that agencies have consistently classified hospitality expenses
• documentation supporting expenses is not sufficient to demonstrate that they are meeting the requirements about supporting policy objectives and the reasonableness of the costs in relation to the benefits and community expectations.

The policy framework needs to be enhanced to clarify what expenses should be included as 'hospitality expenses' while specifying what agencies need to do to show they have considered and followed the key requirements. Agencies also need to subject hospitality expenses to regular scrutiny and management reporting.

Hospitality inclusions

Figure 2C shows GB&H expenditures range from $75 912 at CV to $1.1 million at NGV.

Figure 2C

Provision of gifts, benefits and hospitality by agencies from 2013–14 to 2014–15

Source: Victorian Auditor-General's Office.

Analysing these expenses, and particularly the sample chosen for detailed examination, shows there is a lack of clarity about what expenses should be included as provision of GB&H—especially under hospitality.

The guidelines define hospitality as 'the friendly reception and treatment of guests, ranging from offers of light refreshment at a business meeting to restaurant meals and sponsored travel and accommodation. Hospitality may be offered to a public sector employee. It may also be provided by public sector organisations in three situations:

• 'Official State hospitality' is that hosted directly by an elected official
• 'Official hospitality' refers to the hosting of foreign government officials
• 'General hospitality' is usually that provided by public sector organisations and can range from light refreshments to catered functions and restaurant meals.'

We found inconsistencies in what agencies classified as hospitality. NGV classified a wider range of activities as hospitality expenses and this explains, in part, why the cost of its GB&H provision is so large. NGV included:

• providing food and beverages for external participants' professional development programs where the full costs were covered by the participants
• purchase of flowers as table arrangements for launching a major sponsorship
• providing the catering component of an exhibition and meal package sold by NGV with the costs being covered by the ticket price
• delivering photographic services for the opening of a major NGV exhibition and DJ services for a commercial partner event.

These are operational rather than hospitality expenses and we did not see evidence that other agencies had classified these types of expenses in the same way.

Other agencies had the following questionable classifications:

• As part of a lunch held to promote a publication, CV included a hospitality expense 'audio-visual' costs and a 'staff surcharge' in addition to the food costs.
• MV held a workshop for staff at an external venue and included room hire, catering and equipment hire as hospitality costs.

There is a need to clarify what expenses should be classified as GB&H, especially when these expenses are directly related to an agencies' operations.

Supporting documentation and potential policy issues

The documents provided by agencies for the sampled GB&H expenses usually included a short description of the event, a purchase order and an appropriately authorised invoice. However, they rarely included sufficient detail to adequately describe the business need and justify the reasonableness of the expense in terms of the likely benefits and community expectations.

Beyond the clarity and documentation issues explained above, we did not identify further specific issues for CV and NGV.

However, we identified potential breaches of ACM's policy that states that the provision of alcohol should be incidental to the overall level of hospitality provided, and should be of a reasonable amount. Alcohol accounted for:

• 51 per cent of the $18 043 spent on the 2014 staff Christmas party
• 48 per cent of the costs of a meal between an ACM executive and the finance manager of a production company.

In addition, a staff farewell lunch cost ACM $1 413 despite its policy that only token gifts such as cards or flowers may be provided to celebrate length of service or retirement.

For MV, half of the sample of 10 expenses had requisition forms dated after the date on the invoice whereas normal financial practice is to secure a purchase order and implicitly the approval to purchase before being invoiced for a service.

ACM provision of complimentary tickets to staff

ACM currently has a complimentary tickets and house seats process in place whereby staff can access a limited number of available tickets for performances at its venues. This occurs according to an allocation priority at no cost. The allocation of these tickets is aimed at promoting ticket sales and improving industry knowledge. For the period April 2013 to March 2015, staff used 6 127 house seats.

These benefits have not been incorporated into ACM's GB&H policy framework. ACM developed a draft policy to address this and this was approved by the ACM Trust members in late November 2015.

2.4 Management monitoring and reporting

Effective monitoring and reporting is essential for agencies to understand the nature and extent of their GB&H activities, communicate this information to relevant stakeholders and adequately identify, assess and treat the associated risks.

The approach applied by agencies to monitoring and reporting on GB&H activities is not sufficient to identify and report on the risks of these activities. Management monitoring and review is effectively confined to:

• case-by-case assessment of the receipt of GB&H for inclusion on the gift register
• case-by-case application of the financial processes used to control the provision of GB&H.

These processes are not adequate to record and transparently mitigate the risks generated by GB&H activities.

2.4.1 Overall monitoring and reporting

In the past, none of the agencies have provided an overall analysis of GB&H receipt and provision to identify trends, issues and potential risks.

Review of GB&H received

NGV recently committed to a biannual summary report of the GB&H register for the Deputy Director and its audit and risk committee, with its first report being provided in July 2015. This report:

• summarised the GB&H received for the previous six months
• suggested reasons why the number of gifts reported may have fallen including fewer offers being made, more gifts falling below the reportable value of $100 or staff not complying with the policy—the report offers no evidence behind these suggestions
• identified a potential risk with the offer of a gift of artwork of a significant value to a staff member—while the gift was declined it highlighted the need to remind staff of the potential conflict of interest in accepting such gifts
• proposed some reasonable follow-up actions such as following up with staff who previously reported accepted offers to make sure they are still reporting their actions.

This is a positive but overdue development. Up until 2015 NGV's recording of GB&H offers in its gift register, unlike other agencies, did not include the estimated value recorded on its declaration forms and was inadequate. The biannual analysis is a step in the right direction but the depth and rigour of the analysis needs to be improved.

ACM's GB&H policy was amended in August 2015 to require the gift register to be subject to periodic review by the Finance Director and Director of Governance and Strategy. The first of these reviews occurred in October 2015.

We found no evidence at CV or MV of reviews or reporting related to gift registers. None of the agencies report on the effectiveness of controls or risk treatments for managing GB&H activities.

These reviews should comment on overall trends, describe improvements in processes and how these have been applied, and specifically identify significant potential risks and how these have been managed.

Review of GB&H provided

We found no evidence that agencies have reviewed the appropriateness of the provision of GB&H to internal staff or external stakeholders. These expenditures are authorised on a case-by-case basis and are not subject to an overall review of their scale, appropriateness and contribution to organisational objectives.

2.4.2 Application of case-by-case controls

We examined the paperwork for 10 GB&H accepted offers and 10 examples where GB&H was provided at each agency.

When analysing our chosen samples, we found that the paperwork had been completed as required, but the documentation was insufficient to explain how agencies had identified and managed potential conflicts of interest and reputational risks. The documents provided no opportunity to flag potential risks and explain how these had been considered and adequately addressed. For example we found:

• accepted GB&H offers that represented potential conflicts of interest, involved excessive hospitality or expensive gifts or had unclear business benefits but these risks were never identified or transparently managed
• cases where the provision of hospitality appeared lavish or potentially contravened agency policies without any recognition of the risks or how the decision to authorise the expenditure had taken these risks into account.

2.5 Oversight of GB&H activities

The absence of management information on the potential risks of GB&H activities undermines the effectiveness of audit committee reviews of agencies' policies and gift registers.

2.5.1 Internal audit

For the four agencies reviewed we found no internal audit examination of GB&H receipt or provision over the past three years. While in monetary terms these activities may not be large, the reputational risks of inappropriate behaviour raise their significance to a level where we expected to find them included in internal audit work programs.

2.5.2 Audit and risk committee review

Figure 2D summarises audit and risk committees' reviews of GB&H registers and policies. The documentation was sufficient for us to verify that only the ACM audit committee had actively scrutinised GB&H.

The Department of Premier & Cabinet (DPC) audit and risk committee oversaw CV prior to machinery-of-government changes which saw it relocated to DEDJTR on 1 January 2015. The committee has records showing occasional input and engagement with GB&H activities but not in a consistent manner. The remaining agencies provided audit and risk committee meeting minutes which showed the committee noting or endorsing the GB&H policy, gift register and annual attestation, but little evidence of specific input or engagement with the presented material.

All audit and risk committee reviews were affected by the absence of adequate management reporting on the receipt and provision of GB&H including management's views on the risks and how these had been mitigated.

Figure 2D

Findings on audit and risk committees' oversight

Source: Victorian Auditor-General's Office.

Review of GB&H receipt registers

Other than NGV's recent introduction of a biannual summary report, audit and risk committees were not provided with detailed information on the GB&H offered and received by agencies and the associated risks. Without this information, the ability of committees to adequately review these activities is severely constrained.

Without sufficient information from management, audit and risk committees are unaware of the potential conflicts we highlighted. However, we expected to see more evidence of audit and risk committees scrutinising the content of the gift registers and the processes applied to manage risks, especially for DPC, MV and NGV.

In some cases the information in registers should have provoked scrutiny. For example, where staff had accepted expensive gifts, where they had accepted hospitality from firms involved with products and services relevant to their position, or where the business benefits were not clear.

As Figure 2D shows, gift registers were typically tabled, reviewed and accepted without evidence of discussion or detailed scrutiny.

Review of GB&H provision

Audit and risk committees do not play an active role in reviewing the provision of GB&H. These expenditures are not collated in a register and we found no evidence that they were reviewed by the committees covering these four agencies.

Review of GB&H policies

At MV and NGV, GB&H policies are reviewed every three years, most recently in 2014, although NGV has made additional updates since the Victorian Public Sector Commission framework changed in 2012. When CV was a part of DPC, the review occurred annually. For these three agencies, we found audit and risk committees typically endorsed the updated policies presented to committees by management, without significant amendment and with little evidence of active engagement with the policy review process.

In contrast we found that ACM annually and comprehensively reviews its GB&H policy. Audit and risk committee minutes show the committee's active engagement in the review processes with issues raised, which management addressed.

2.5.3 Oversight external to agencies

CV has a clear oversight role for the three other creative industries agencies included in this audit and for other state-owned creative organisations and cultural facilities. We have seen no evidence that CV has raised any issues about how MV, NGV and ACM manage GB&H as part of its oversight role. This is surprising given its past experience of the materiality of these risks.

CV needs to be more active and visible in discharging its oversight role in this area for the creative industries agencies included in this audit and for other state-owned creative organisations and cultural facilities.

Recommendations

1. That the Department of Economic Development, Jobs, Transport & Resources, Museum Victoria, Arts Centre Melbourne and the National Gallery of Victoria review and revise their management of the receipt and provision of gifts, benefits and hospitality to better understand and scrutinise these activities.
2. That the Department of Economic Development, Jobs, Transport & Resources, Museum Victoria, Arts Centre Melbourne and the National Gallery of Victoria review and revise how they monitor and report on gifts, benefits and hospitality activities by:

• introducing regular management and audit and risk committee reports on the receipt and provision of gifts, benefits and hospitality to identify trends and emerging risks, and recommend how to address these
• accompanying the annual tabling of gift registers to audit committees with reports that adequately inform about the risks, the effectiveness of existing controls and any additional required mitigation activities
• using the annual gift register tabling to propose any amendments required to existing gifts, benefits and hospitality policies.

3. That the Department of Economic Development, Jobs, Transport & Resources play a more visible and active oversight role by:

• communicating the importance of this audit's findings and recommendations to all state-owned creative organisations and cultural facilities
• following up on agencies' progress in applying the recommendations and updating the Minister for Creative Industries on their progress in addressing these risks.

3.1 Introduction

Agencies should be able to demonstrate that they comprehensively understand gifts, benefits and hospitality (GB&H) activities, understand the nature and significance of the risks posed by GB&H activities, and have applied appropriate controls to manage these risks.

As discussed in Part 2, the failure to effectively identify, assess, treat and monitor GB&H risks exposes agencies to potential conflict of interest risks and reputational damage.

Agencies need to adequately consult and communicate their approach to the management of GB&H risks to staff and external stakeholders, including the provision of sufficient training. Comprehensive policies and procedures can be rendered ineffective if employees and stakeholders are unaware of an agency's expectations and requirements. This Part of the report examines:

• agencies' approaches to managing GB&H risks
• how well agencies have consulted with staff and other stakeholders to understand the risks and how well they have communicated policies and how to apply them to staff and funded organisations and suppliers
• agencies' performance against the policy framework requirements.

The Part also reviews the responses of employees to the Victorian Public Sector Commission's (VPSC) People Matter Survey. These shed light on employees' perceptions about agencies' integrity and their awareness of agencies' values and policies. It also sets out agencies' performance against the policy framework requirements.

3.2 Conclusion

Agencies have documented policies that include the minimum requirements and accountabilities of the current GB&H framework. However, doing the minimum necessary to comply is not sufficient. Agencies are not effectively managing the risks of receiving and providing GB&H. The way agencies identify, evaluate and treat these risks is inadequate.

Agencies' approaches to consulting and communicating with staff and stakeholders have not been adequate because they:

• could not show that they had regularly consulted staff and relevant external stakeholders in any structured way to understand the GB&H risks
• relied too heavily on a passive approach to informing and training staff about GB&H policies and risks—only Arts Centre Melbourne (ACM) delivered face-to-face training which covered GB&H activities to new staff
• had not communicated their GB&H expectations and acceptable practices to suppliers—the one exception to this was the National Gallery of Victoria (NGV) which sent an email to suppliers advising them of the terms of their GB&H policy.

3.3 Approaches to managing GB&H risks

Current approaches to managing GB&H risks are inadequate because the agencies we examined cannot demonstrate that they have:

• comprehensively understood GB&H activities, with no evidence of regular and rigorous analysis of the receipt and provision of GB&H
• systematically assessed and evaluated the significance of GB&H risks and the effectiveness of existing controls
• applied a structured and evidence-based approach to treating these GB&H risks.

3.3.1 Understanding GB&H activities

None of the agencies examined could demonstrate a comprehensive understanding of their GB&H activities. All agencies record the acceptance of offers of GB&H on a register and record expenditure for the provision of GB&H in their financial systems. However, we found no analysis of these offers and expenditures before June 2015 to inform the management and oversight of these activities.

The exception is NGV which started a six-month report on its GB&H register from July 2015. We commented on the quality of this reporting in Part 2 of this report.

The absence of this type of analysis is a significant gap because the case-by-case review of GB&H offers and provision does not provide an adequate understanding of these activities. At a minimum, an analysis of trends, repeated offers and potential policy breaches is essential.

For example, the first accountability for heads of public sector organisations (see Figure 1C) requires them to establish and review policies and processes to respond to offers of GB&H, 'including multiple offers from the same source'. We found no analysis of multiple offers although these regularly occurred.

3.3.2 Evaluating GB&H risks

The way agencies record the receipt and the provision of GB&H does not show that they are meeting the framework's minimum requirements and accountabilities. Agencies cannot demonstrate that they have understood the threats to their integrity and reputation from these activities nor assessed the effectiveness of current controls in protecting them from these risks.

We expected that agencies would be able to show their assessment of these risks, the effectiveness of existing controls, any required additional treatments, and how the effectiveness of these controls and treatments would be measured and monitored.

Our analysis of agencies' GB&H activities in Section 2.3 shows these risks are potentially significant and require improved and more transparent management.

While all agencies have risk management frameworks, none included the provision and receipt of GB&H within these frameworks and therefore did not assess these risks or develop specific treatment plans to address them.

There is no evidence that agencies considered GB&H risks for inclusion in their risk registers and this is a clear omission that needs to be addressed.

NGV came closest to acknowledging these risks by identifying its GB&H policy as one of several controls to mitigate the strategic risk of failing to demonstrate the public sector principles of integrity, impartiality and transparency. However, its framework did not assess and evaluate the specific risks this policy is meant to address.

ACM advised during the audit that its Senior Leadership Team would be considering the addition of Integrity Risks, including processes around GB&H, to the risk register and whether a risk rating system should be applied to the acceptance of offers. These actions are yet to be confirmed.

3.3.3 Determining and applying risk treatments

We examined whether agencies applied a structured approach to selecting and implementing treatments to appropriately address current and emerging risks in meeting the government's minimum requirements and accountabilities.

To date agencies have done the minimum needed to comply with the government's policy framework rather than following a structured, evidence-based approach to selecting and implementing risk treatments. Current controls include authorising employees to accept and provide GB&H, maintaining registers of GB&H accepted, the audit and risk committee review of GB&H registers and policies, and the agency head attesting that appropriate policies are in place and informing employees about these.

This type of approach is clearly insufficient to assure us that the risks are being effectively managed. Agencies cannot show how they have tested the effectiveness of current controls that have failed to identify and deal with the potential conflict of interest and integrity risks identified in this report (see Section 2.3).

The current framework contributed to this outcome because it only requires that:

• agencies have a policy in place that reflects (rather than achieves) the framework's minimum requirements and accountabilities
• heads of agencies attest annually to the operation, review, promulgation and scrutiny of appropriate GB&H policies and processes.

Agencies have strictly complied but cannot demonstrate that they have achieved the specific, minimum requirements and accountabilities listed in the Premier's Circular.

The clear message from this analysis is that agencies need to move beyond doing the minimum necessary to comply, to focus on understanding and effectively managing the risks from accepting and providing GB&H. Recasting the framework so agencies are required to effectively manage these risks is essential to achieving this.

3.4 Consultation and communication weaknesses

Figure 3A describes agencies' activities in consulting on GB&H risks and communicating policies and practices to employees and external organisations.

Figure 3A

Agencies' approaches to consultation and communication

Source: Victorian Auditor-General's Office based on analysis of agency documentation and interviews.

3.4.1 Consultation on the GB&H risks

Agencies took a reactive approach to consultation with staff and external stakeholders concerning GB&H risks and instead gathered information in an ad hoc way. Without some form of structure to consultation, agencies may potentially fail to identify GB&H risks which could prove problematic for them going forward. Specifically, we found:

• CV, ACM and NGV provided evidence of email exchanges with staff in response to specific queries regarding offers of GB&H, but this occurred on an as needs basis
• MV advised that consultation with staff and other agencies about GB&H issues occurred informally but was unable to provide documentary evidence of these interactions
• none of the agencies consulted with external parties—such as suppliers, service providers or sponsors—in order to identify existing or emerging GB&H risks.

3.4.2 Employee communication and training on GB&H

All agencies undertook communication activities designed to raise awareness among staff of GB&H policies and procedures and the associated risks. However, formal training of staff on how to apply GB&H policies was less prevalent. Training was generally limited to providing new staff with reading material or requiring completion of online training modules which consider GB&H in a limited way, if at all.

Findings include that:

• only ACM delivered face-to-face training on GB&H, which was provided to new staff only
• other than the Branch Director, CV staff have not been provided with specific training focused on GB&H
• at CV and MV training currently consists of providing new staff with an induction kit and core policies to read—both agencies include the VPS code of conduct which is relevant but only provides limited information regarding GB&H
• NGV also offers an online induction process and provides core policies to new employees, including the GB&H policy (unlike CV and MV). NGV advised that it is currently preparing online training for all staff which will include a module focused on GB&H.

3.4.3 External stakeholder communication on GB&H

Agencies did not effectively communicate their approach to GB&H to their key external stakeholders, such as suppliers. Doing so helps promote a clear understanding of the agencies' expectations and reduces the risk and likelihood that inappropriate offers will be made. We found that:

• only NGV could demonstrate this, having sent emails to suppliers in July 2015 advising them of their GB&H policy terms
• CV, MV and ACM have not communicated with external stakeholders concerning their GB&H policies.

3.5 Evidence on policy awareness and integrity

3.5.1 Overview

We reviewed the 2014 VPSC People Matter Survey, for MV, NGV and ACM. As a departmental branch, CV was not separately identified and so we could not report its results. We focused on questions around integrity and the awareness of GB&H policies.

While being a voluntary, anonymous and partial survey of these agencies' workforces, the results still raise legitimate concerns about integrity and policy awareness that agencies need to seriously consider and address:

• Two-thirds of the creative industries agencies' results related to integrity questions were worse than the VPS average, with two out of the three agencies scoring significantly worse than the VPS average across all categories.
• Creative industries agencies performed poorly for the awareness questions when compared to the VPS average. This is especially the case for staff awareness of the processes for reporting improper conduct and for supporting protected disclosures, where all three agencies were worse than average.

These results highlight our earlier findings about the absence of a structured and adequate approach to staff training and communication. Specifically the relatively high proportions of sampled staff who are unaware of, or not confident in, the processes for preventing and reporting misconduct needs to be addressed.

We note that ACM is in the middle of a cultural change program, The Role You Play, which has informed the development of its updated corporate plan. This includes promoting and achieving high standards and better managing the risks that are likely to undermine trust in the agency.

ACM has acknowledged that this audit has identified areas for improvement and these will need to be incorporated in this cultural change program.

3.5.2 Detailed results

Figure 3B compares the responses of staff from three of the four audited agencies to the average responses across all 154 surveyed agencies showing:

• information on the survey metrics such as the number of respondents
• the percentage disagreeing with positive statements about aspects of an agency's integrity
• the percentage unaware of critical agency policies and procedures.

The figures in red show where agency results are worse than the VPS weighted average, and the green figures show where agency results are better than the VPS weighted average.

Figure 3B

Relevant results from the People Matter Survey 2014

Note: Red figures are agency percentages greater than the average, green figures are agencies that are less than or equal to the average. Source: Victorian Auditor-General's Office based on VPSC's 2014 People Matter Survey results.

The area of most concern is around understanding and being confident in the available processes to raise legitimate concerns about improper conduct at these agencies, where between:

• 29 and 49 per cent are not confident they would be protected from reprisal
• 13 and 25 per cent are unclear about how to report improper conduct
• 66 and 74 per cent are unaware of the processes supporting protected disclosures.

A further area of concern is the significant minority raising integrity concerns, where between:

• 13 and 28 per cent do not think people in the workgroup are honest, open and transparent
• 14 and 29 per cent do not think managers encourage them to avoid conflicts of interest
• 9 and 19 per cent do not think systems prevent improper conduct.

Finally there is room to improve employees' awareness of the policy covering the receipt and provision of GB&H. While one agency, NGV, recorded a high level of recognition, the percentage of staff unaware of this policy at ACM (29 per cent) was considerably higher than the VPS average of 18.4 per cent.

3.5.3 Performance against the framework's requirements

The government's framework only requires that agencies' policies reflect the defined minimum requirements and accountabilities. This audit goes beyond that by assessing whether agencies can demonstrate the achievement of these minimum requirements and accountabilities.

Figure 3C rates each agency against these requirements as:

• ✔ effectively meeting the requirement
• ✘ not meeting the requirement
• ~ partially meeting the requirement
• Not covered in this audit, where we cannot conclude on a requirement with the evidence collected in this audit. For example, we are not able to determine whether employees have not solicited GB&H and have refused all offers of money and bribes because this was not documented by agencies.

All agencies have documented policies that include the minimum requirements and accountabilities of the current GB&H framework. However, none of the audited agencies could show that they had achieved these minimum requirements and accountabilities.

CV came closest to meeting the requirements by refusing offers of GB&H except for those covered by its event attendance policy. From our review of other agencies' documentation we concluded they fell considerable short of demonstrating that they had met the policy requirements.

Figure 3C

Performance against the policy framework's requirements

Source: Victorian Auditor-General's Office analysis based on agency documentation.

Figure 3C shows that for the documents we reviewed:

• none of the audited agencies could show they had met the requirements to:
  • ensure the costs of providing GB&H are proportionate to the benefits and reasonable in terms of community expectations
  • reinforce to staff the potential disciplinary consequences of breaching GB&H policies
• only CV could demonstrate that it refused all offers likely to undermine its integrity and impartiality because it accepted no GB&H offers except in relation to its events attendance policy
• the results were mixed for the remaining requirements and accountabilities
• all agencies met the requirements to have a GB&H policy in place and to record hospitality expenditure in line with financial management accountability and reporting requirements.

3.6 Implications

The findings in this part of the report highlight that agencies need to move beyond doing the minimum necessary to comply with the existing framework and build the processes and practices needed to show that they are effectively managing the risks associated with the receipt and provision of GB&H.

To facilitate this, VPSC and DPC need to update the framework to move it from mandating the inclusion of requirements in agencies' policies, to requiring and supporting agencies to effectively manage their GB&H risks.

The agencies that have been examined should review and improve the way they consult on and communicate GB&H activities and the application of policies. They also need to measure how successful these activities have been in fully informing staff and stakeholders, and achieving the intended behaviours. This is likely to include more frequent reminders of employee's obligations, including refresher training for ongoing employees and confirming that staff have a good understanding of the requirements.

What is clear from the review of current practices and the People Matter Survey results is that agencies need to review and upgrade their approaches to consultation, communication and training. In addition they need to consider how to measure the baseline and changes in their employees' understanding of how to apply GB&H policies.

We highlight the need to have processes in place that will allow staff to raise concerns when they observe conduct that seems inappropriate. This is critical to detecting and addressing activities that aim to avoid controls for personal gain. This audit is unlikely to detect this type of behaviour because it occurs outside of the controls and records that agencies use to manage and regulate GB&H activities.

Recommendations

1. That the Department of Economic Development, Jobs, Transport & Resources, Museum Victoria, Arts Centre Melbourne and the National Gallery of Victoria review and revise their management of the receipt and provision of gifts, benefits and hospitality to effectively manage the risks by:

• identifying and evaluating the risks to their impartiality, integrity and reputation
• developing and implementing evidence-based treatments to address these risks where existing controls are inadequate
• demonstrating the extent to which they have delivered on the minimum requirements and accountabilities of the government's gifts, benefits and hospitality framework.

2. That the Victorian Public Sector Commission and the Department of Premier & Cabinet review and update the gifts, benefits and hospitality framework to achieve the outcome of agencies demonstrating the effective management of gifts, benefits and hospitality risks including:

• being clear about the intended outcomes that agencies need to achieve
• requiring the collection of sufficient evidence so agencies can demonstrate the achievement of minimum requirements
• requiring agencies to publish gifts, benefits and hospitality registers on their websites.

3. That the Department of Economic Development, Jobs, Transport & Resources, Museum Victoria, Arts Centre Melbourne and the National Gallery of Victoria:

• review and improve the way they consult on and communicate gifts, benefits and hospitality activities and policies
• measure how successful communication and training have been in fully informing staff and stakeholders about intended gifts, benefits and hospitality behaviours and in achieving the desired outcomes.

RESPONSE provided by the Commissioner, Victorian Public Sector Commission

RESPONSE provided by the Secretary, Department of Economic Development, Jobs, Transport & Resources

RESPONSE provided by the President, Arts Centre Melbourne

RESPONSE provided by the Director, National Gallery of Victoria

RESPONSE provided by the President, Museums Board of Victoria

Further Audit comment in response to the submission from Museum Victoria

I am concerned by Museum Victoria's response to the report in two respects.

First, MV is the only agency that represented the view that we have not given due weight to its operating context in our analysis. VAGO included additional context about Creative Industries agencies' operating contexts in the draft audit report and this has been retained in Section 1.5.1 of the final report. Both National Gallery Victoria and Arts Centre Melbourne have acknowledged the inclusion of this additional context in their responses. I am disappointed by MV's focus on this issue given that no amount of additional context will address the clearly inadequate management of the significant risks posed by gift, benefits and hospitality (GB&H) activities for agencies' integrity and impartiality.

Of equal concern is MV's use, out of context, of a partial quote from VAGO's acquittal of its comments on the draft report to back up this position. VAGO disagrees with MV's assertion and is disappointed by this misrepresentation. MV's response noted 'that in the acquittal documentation, VAGO 'does not disagree with these points [about the context], but has declined to amend the report accordingly'.

The full VAGO acquittal reads:

VAGO's response pointed to the validity of these contextual points but made no change because they had already been specifically acknowledged in Section 1.5.1.

We consider the representation of these comments disingenuous and misleads the reader if the full context was not conveyed to the signatory of this response.

Second, MV's response refers to, ...subsequent correspondence between the Victorian Auditor-General's Office (VAGO) and (the MV contact), regarding the factual errors in the letter and acquittal documentation'. VAGO disagrees that the letter and acquittal contained factual errors.

The MV contact raised with VAGO issues with the following sentence in the proposed report transmittal letter (bold emphasis VAGO).

'A provisional draft of the report has been considered by (the MV contact), your nominated contact officer for the audit. We have gained assurance that the facts are correct and that the context has been represented fairly. We have also reviewed the matters raised in response to the provisional draft and a worksheet acquitting our consideration of these matters is attached'

The MV contact interpreted this as stating that he had gained assurance that the facts were correct and the context fairly represented. We provided verbal assurance to the MV contact that the 'We' in the second and third sentences referred to VAGO's judgement not the judgement of the agency. No other agency had any concern with this sentence.

The Engagement Leader wrote to the MV contact to make this clear on 24 November 2015

The MV contact responded that he could work with this and proceeded with processing the response.

This is not about factual inaccuracy it is about the MV contact's misinterpretation.