Management of Spending in Response to COVID-19

Have agencies used spending in response to coronavirus (COVID-19) for its stated purpose and complied with relevant laws and policies?

Video presentation

Video transcript

Key facts

Source: VAGO, based on information from DTF’s COVID-19 actual expenditure 2019–20 and the Victorian Government Purchasing Board’s Annual Report 2019–20.

What we found and recommend

We consulted with the audited agencies and considered their views when reaching our conclusions. The agencies’ full responses are in Appendix A. 

Critical incident procurement in response to COVID-19

Making critical procurements during coronavirus (COVID-19)

Seven of eight departments used their critical incident procurement (CIP) policy to make purchases related to COVID-19. Although this gave staff the flexibility to respond quickly to the pandemic, it also meant that in some cases, speed, rather than value for money, was the main consideration. The Department of Treasury and Finance (DTF) did not activate its CIP policy, and managed its procurement using normal processes.

During a critical incident, departments can choose to use a flexible and streamlined CIP process. However, the Victorian Government Purchasing Board (VGPB) policy notes that staff should still consider value for money to the extent that they can, given the severity and urgency of a critical incident. The policy does not provide any guidance on how departments should do this.

Staff making decisions in a crisis need clear communication and guidance. Of the departments that chose to use their CIP policies to make purchases related to COVID 19, only the Department of Justice and Community Safety (DJCS), the Department of Education and Training (DET), and the Department of Premier and Cabinet (DPC) made formal announcements invoking and closing their policies. These announcements support staff to make good decisions by clearly outlining expectations and responsibilities. This was particularly important because only the Department of Environment, Land, Water and Planning (DELWP) and DJCS had significant experience using their CIP policies. This meant that staff in other departments were largely unfamiliar with the requirements of the CIP process.

Gaps in departments' procurement processes

Except DJCS, all departments had gaps in their CIP processes, including:

• using CIP policies for non-urgent purchases
• missing and incomplete documentation
• inaccurate reporting of total procurement expenditure.

These gaps reduce transparency around departments’ decision-making for procurement related to COVID-19. They also make it difficult for departments to assure themselves that staff made purchases with proper consideration of value for money and probity.

Despite these gaps there were also some examples of better practice. For example:

• DET, DJCS and the Department of Transport (DoT) had active central procurement teams that monitored the most high-value CIPs related to COVID-19.
• DET minimised the risk of waste when procuring additional cleaning for schools by varying and extending existing contracts rather than engaging new suppliers.
• In November 2020, DJCS reviewed prison cleaning contracts it had entered into early in the pandemic and went out to market to improve value for money.

Conflicts of interest

Only staff at DJCS and DELWP consistently completed conflict of interest declarations for procurements related to COVID-19. At the Department of Health and Human Services (DHHS) and DJPR, staff did not always complete declaration forms until after a procurement had taken place. DJPR staff did not complete declaration forms for some procurements until over six months after they occurred.

Managing conflicts of interest is particularly important during critical incidents when staff do not use a competitive process to select suppliers. This can leave departments exposed to fraud or, at least, perceptions of favouritism. For example, at DHHS, an executive-level staff member did not disclose that they had previously worked with a consultant the department hired.

DHHS’s poor management of conflicts of interest during COVID-19 mirrors known issues. A 2016 internal audit on declarations of private interests also found gaps in how the department managed conflict of interest requirements. DHHS addressed all but one of the recommendations by January 2020. DH and DFFH are due to complete the final recommendation, an online system for declarations of private interests and conflicts of interest, by the end of 2021.

Using professional services and state purchase contracts

All departments engaged professional services firms to prepare advice, deliver projects or provide surge staffing related to COVID-19. However, departments were often uncertain about their obligation to use state purchase contracts (SPCs) when hiring professional services and did not always make full use of the panel available.

DHHS used professional services firms extensively to respond to COVID-19. However, it used several different processes to engage staff from these firms, including engaging some staff as ‘secondees’ rather than consultants. As departments do not need to disclose spending on secondees, it is difficult for the public to get an overall view of the full cost of using professional services to respond to COVID-19.

At DJPR, the Hotel Quarantine Board of Inquiry also found that staff lacked awareness of SPCs and hired a security firm that was not on the security services SPC.

Using single quotes for non-urgent purchases

By treating all procurement related to COVID-19 with the same level of urgency, departments missed opportunities to achieve better value for money by taking the time to go to market. Although the VGPB policy does not require departments to seek quotes from more than one supplier during a critical incident, they must still consider value for money.

DJPR and DPC used a single quote for some purchases that, while related to COVID 19, were not so time sensitive to justify avoiding a standard, competitive process. Examples included:

• engaging a professional services firm to provide executive team coaching (DJPR)
• commissioning a professional services firm to review the department’s corporate structure (DJPR)
• creating a website to advertise government initiatives (DJPR)
• engaging creative services firms to develop entertainment to promote community wellbeing (DPC)
• buying online platforms to host live performance events online (DJPR).

In addition, in August 2020, DJPR engaged a professional services firm to supply a call centre for $4.5 million. The post-incident brief states that DJPR considered value for money because the firm gave a discount on normal SPC rates. However, the brief does not state why DJPR contacted this particular firm over other firms and does not consider that other providers also may have offered a discount.

Maintaining complete procurement records 

All departments that used CIPs, except DJCS, had gaps in their record keeping for CIP transactions. Accurate documentation is especially important in a crisis, as staff often act under pressure and because of the extensive use of non-competitive procurement processes.

Although it is understandable that staff may not always have the time to update their records when making an urgent procurement, they need to ensure that they complete records soon thereafter. We found that some departments’ CIP registers were missing transactions from up to six months prior.

Better-practice procurement approaches

Despite the enormous pressures facing staff, there were examples of better-practice approaches to procurement at DoT, DJCS, DET and DPC. These included:

• strong oversight from central procurement teams to ensure purchases were critical
• seeking quotes from multiple suppliers to test value for money
• researching and conducting due diligence on new suppliers
• using SPCs where possible to buy ICT equipment and office supplies, including masks
• renegotiating contracts as the pandemic progressed to strengthen value for money.

Procuring personal protective equipment

Victoria did not have a personal protective equipment (PPE) stockpile prior to the pandemic. As a result, departments needed to act quickly, rely on unfamiliar suppliers and often paid high prices.

PPE for the health sector 

Although the former DHHS and HealthShare Victoria (HSV) tried to mitigate the risk of using unfamiliar overseas suppliers, they still experienced stock delays. They also received stock that was not fit for purpose, worth more than $172 million. This mostly comprised:

• 33 million N95 respirators costing $110 million
• 14 million surgical face masks costing $9.5 million.

DHHS 'quarantined' this stock from use because over time, the Therapeutic Goods Administration updated its advice on PPE standards. HSV and DH advised us that they are now looking at ways to minimise waste by repurposing PPE items that do not meet the relevant standards.

PPE for the non-health sector

Staff in other departments typically had no familiarity with the PPE products they sourced and did not have access to pre-vetted suppliers or established supply chains. Despite this, there were examples of better practice as departments shared information with each other about suppliers and tried to consider value for money.

Victoria has a single-vendor SPC for stationery and office supplies, which covers masks, sanitiser, wipes and gloves. Several departments used this SPC, but it quickly became overwhelmed with demand and departments needed to find other suppliers. As a result, departments ended up paying widely varying prices for PPE. For example, at different times throughout the pandemic DJCS paid between $6 and $27 per bottle of hand sanitiser.

Despite DJPR coordinating sourcing and distribution of non-health PPE since April 2020, DET, DJPR and Emergency Management Victoria (EMV) separately hold surplus stock. In November 2020, DPC received the report of its external Whole of Victorian Government Personal Protective Equipment Review. The review recommended that EMV and DJPR set up a working party to resolve the surplus stock issue within three months. This has yet to occur. There is a risk of waste because departments are paying to store PPE separately and if they do not coordinate distribution some PPE stock may expire.

DTF and DJPR are working to establish an SPC for PPE.

Recommendations about CIP

Managing COVID-19 grant programs

Departments managed grant programs in response to COVID-19. We audited grant programs run by six departments, including:

• DoT, DPC, DJPR and DHHS’s grant programs for individuals, businesses and community organisations affected by COVID-19
• DELWP, DET and DoT’s business continuity grants for organisations within their sectors, including TAFEs, public transport operators and public entities, such as the Melbourne Zoo.

Managing risks and identifying fraud

Only DoT advised government of the risks associated with its COVID-19 grants program for the commercial passenger vehicle industry. This included the risk that poor data could make it difficult for DoT to quickly check if applicants were eligible. 

In contrast, despite setting up large-scale grant programs in two weeks, DHHS and DJPR did not formally advise government of their risks. DJPR advised us that it had informal discussions with the minister about risk management. DPC also did not advise government of the risks associated with its grant programs for multicultural community organisations, but the programs were lower risk because they involved organisations that it had worked with previously. 

Due to the pressure to pay grants quickly, neither DHHS nor DJPR had time to establish sufficient fraud controls at inception. Although both departments have since strengthened their fraud controls, gaps remain at DJPR, increasing the risk of paying ineligible applicants.

DoT and DPC effectively managed the risk of fraud, corruption and waste of resources for their grants related to COVID-19. They did this by building preventative fraud controls into their grant application process, setting up a consistent assessment process, and requiring grant recipients to report on how they used their grants.

Managing conflicts of interest in grants administration

DoT, DPC and DHHS did not have processes to ensure that staff considered conflicts of interest when assessing grants. This means that departments cannot be as certain as they should be that staff did not pay some grants inappropriately.

Working for Victoria grant program

DJPR used grant funding from the Working for Victoria program to purchase goods and services that should otherwise have been purchased using a procurement process. This included using a grant to procure the ICT platform for the program and paying DoT a grant to purchase cleaning services. By using a grant and not following a formal procurement process, DJPR cannot be confident that these purchases minimised probity risks or achieved value for money.

In addition, DJPR did not effectively manage the perceived conflict of interest of using a non competitive process to hire staff from an organisation which, at the time, was chaired by a former minister who had been responsible for DJPR. DJPR engaged the organisation to administer the then $500 million Working for Victoria program. DJPR paid the organisation $770 000 for 10 staff and associated working costs. 

Business continuity grants

DELWP, DET and DoT administered business continuity grants to support entities within their sectors that had lost income due to COVID-19 to meet urgent costs and retain their staff. All three departments effectively managed the risks of fraud, corruption and waste involved in providing financial viability funding to portfolio entities and associated organisations. 

Departments’ financial viability payments were supported by clear advice to government that identified the risk of not supporting recipients to manage the financial impact of COVID-19. Departments also had strong oversight over how recipients used the funding. This meant that departments could assure themselves that recipients used the funding as intended and, in the case of payments to non government entities, did not profit from public funding.

Recommendations about managing COVID-19 grant programs

Collecting COVID-19-related spend data

Whole-of-government spend

DTF is not using the COVID-19 spend data it has collected from departments to monitor whole-of-government spending. Although DTF is a central agency, it does not consider this its responsibility because the Financial Management Act 1994 requires departments to monitor their own spending. However, this means that there has been no central oversight of cross-departmental COVID-19 initiatives. Without this, the government cannot fully understand how well it is managing its COVID-19 spend at a state level.

DTF experienced difficulties in collating all of the departments' spend related to COVID-19 for 2019–20. This was because the central finance system used by government agencies does not allow departments to report sufficiently granular data for DTF to identify COVID-19 spend. As a result, DTF had to set up a manual reporting process for departments to consistently report COVID-19 spend. However, competing priorities during the pandemic led to a long development process and delayed reporting. 

DTF did not issue the first guideline for departments on reporting COVID-19-related spend until August 2020. This was a month after the 2019–20 financial year ended and five months after the government announced the state of emergency. DTF had to revise its reporting approach in December 2020 after finding data quality issues. For example, departments used different names for the same COVID-19 initiative involving multiple departments. 

In July 2021, DTF published departments' 2019–20 expenditure for COVID-19 initiatives. This data shows that departments spent $3.6 billion in COVID-19 initiatives, with most spending in the Business Support Fund ($784.7 million) and in additional equipment and intensive care unit capacity ($781.8 million). DTF’s subsequent review of its published data identified three initiatives that it did not report. DTF did not republish the corrected 2019–20 expenditure until October 2021, which reported a total spend of $4.4 billion.

DTF collected 2020–21 data on a monthly or quarterly basis depending on the value of each COVID-19 initiative. This should enable DTF to detect data quality issues earlier and to proactively monitor whole-of-government spending on a regular basis.

Departmental spend

All departments record and track their spend related to COVID-19 in their finance system. However, limitations in their finance systems mean that departments need to manually consolidate their expenditure across different initiatives. DJCS and DHHS are the only departments that have addressed this issue by creating a filter in its budgeting tool that automatically identifies all expenditure for COVID-19 initiatives. Although it is separate to their financial systems, DH and DFFH maintain a dashboard that reports on COVID-19 spend.

Although all departments monitor their overall financial position, only three departments have a specific focus on COVID-19 spend. DHHS produces a monthly finance report covering only COVID-19 initiatives, while DJPR and DJCS generate dashboards to distinguish spending related to COVID-19.

Recommendations about financial reporting

Back to top

Departments needed to act quickly to respond to COVID-19, such as by buying essential medical supplies and setting up support programs. To fund these unexpected costs, the Victorian Government announced a range of new funding initiatives. These included extra funding for the health system and grants for businesses affected by public health restrictions.

1.1 Spending in response to COVID-19

The Victorian Government reported spending $4.4 billion on COVID-19 responses in 2019–20. The highest expenditure was:

• $784.7 million in the first round of the Business Support Fund to support businesses and reduce unemployment
• $781.8 million in additional health equipment and capacity for intensive care units
• $673 million in payroll tax relief for small and medium businesses. 

Figure 1A outlines key COVID-19 events and funding announcements in Victoria.

Sources of funding to respond to COVID-19

As part of the annual state Budget process, the government outlines the goods and services it plans to deliver. Parliament then endorses this plan by passing the annual Appropriation Bill, which allows government to use public money. 

As COVID-19 was an unexpected event, the government needed to source additional funding outside the annual budget process to fund its response. Government departments also re-prioritised some of their existing funding to manage their internal costs related to COVID-19, such as extra cleaning and equipment to support staff to work from home.

Treasurer’s Advance

The Treasurer has the discretion to provide agencies with more funding to meet any urgent or unforeseen claims. This is known as the Treasurer’s Advance. The Treasurer approved $2.4 billion from this funding source for COVID-19 initiatives for 2019–20.

Crisis Council of Cabinet

On 3 April 2020, the Victorian Government set up the Crisis Council of Cabinet to oversee its COVID-19 response. The council ran until 10 November 2020. Its responsibilities included considering departments’ requests for additional funding above $20 million. The Treasurer considered requests for less than $20 million in consultation with the premier.

To receive funding via the Crisis Council of Cabinet, departments needed to demonstrate that they had:

• taken steps to minimise their expenditure
• deferred discretionary projects
• managed cost pressures within their portfolio.

Reporting COVID-19 spend

In its 2019–20 Financial Report, the Victorian Government reported a net operating deficit of $6.5 billion for the general government sector. It explained this deficit as largely related to COVID-19 and the government's pandemic response.

Our November 2020 Auditor-General's Report on the Annual Financial Report of the State of Victoria: 2019–20 attributed $4 billion of this net operating deficit to COVID 19. This is a combination of increased expenses and a drop in revenue. To clarify the financial impact of COVID-19, we recommended that DTF publicly report all costs related to COVID-19 for 2019–20 and 2020–21. 

DTF published the 2019–20 data, which as Figure 1B shows, reported that the Victorian Government spent $4.4 billion on COVID-19 initiatives.

1.2 Procurement related to COVID-19

All departments have had unexpected procurement costs related to COVID-19, including PPE and cleaning supplies. Many departments also procured services to support their response to COVID-19, such as advice and surge staffing from professional services firms, call centre staff, website design and advertising. Some departments procured goods and services to support the hotel quarantine program, such as hotel accommodation, transport and security services. In addition, departments purchased ICT equipment to support staff to work from home.

Government procurement policies

Departments must follow several policies when purchasing goods and services. These policies include specific measures designed to streamline purchasing in response to a critical incident, such as COVID-19.

VGPB advises government organisations on how to buy goods and services. The VGPB policy sets out the mandatory requirements for agencies' procurement, including during critical incidents. The policy applies to all departments and some other government agencies.

Procurement during critical incidents

Under the VGPB policy, departments can use a streamlined procurement process when the relevant minister, responsible officer or chief procurement officer declares that there is a critical incident. 

The VGPB policy states that during a critical incident, normal procurement processes do not apply to the extent that the critical incident makes it impractical to apply them. However, departments must still:

• take into account value for money, accountability, information security and probity to the extent that they can be applied given the severity and urgency of the incident
• adopt minimum record keeping processes
• meet contract disclosure requirements.

To be accountable for decision-making during critical incidents, for each procurement the VGPB policy requires departments to record:

• the good/service being procured
• the purpose of the procurement activity
• the total value of the procurement (including GST)
• the name and contact details of the supplier
• a short summary of the procurement process followed
• contact details of the party managing the procurement.

Each year, departments need to report to VGPB the total value of goods and services purchased, and the nature of the critical incident to which the procurement values relate.

State purchase contracts

An SPC is a whole-of-government contract that aims to achieve value for money by harnessing the collective purchasing power of government. The contracts cover commonly used goods and services, such as utilities, professional services, office supplies, ICT equipment and travel services. 

In addition to following the VGPB policy, departments must use an SPC to buy goods and services if it is mandated. When a critical incident is declared under the VGPB policy, departments can choose not to use a mandated SPC if it is impractical. In March 2020, VGPB released guidance to departments advising that they can and should continue to use SPCs during a state of emergency.

Hiring professional services

In October 2019, DPC issued the Administrative Guidelines on Engaging Professional Services in the Victorian Public Service (the DPC guidelines).

The DPC guidelines state that one of the ‘legitimate circumstances’ in which departments can engage professional services is for ‘work requiring capacity due to unpredictable demands that require immediate or time critical action’. This specifically includes ‘surge capacity required due to emergency management, or similarly critical events'. In these situations, staff do not need to seek their secretary’s approval. 

The DPC guidelines apply to all departments. They state that agencies should not engage professional services to undertake 'universal and enduring public service functions’. If a department wants to engage professional services for these functions, staff must get approval from their secretary.

In July 2021, responsibility for maintaining the DPC guidelines moved to the Victorian Public Sector Commission.

Conflicts of interest

A conflict of interest occurs when an employee has private interests that could influence, or be seen to influence, their decisions or actions in the performance of their public duties. A conflict of interest can be actual, potential or perceived. 

The Victorian Secretaries Board has endorsed the Victorian Public Sector Commission's model conflicts of interest policy. The policy states that staff need to ‘regularly consider the relationship between their private interests and public duties in order to identify any conflict of interest’. It states that any staff involved in procurement should sign a conflict of interest declaration regardless of whether they actually have a conflict.

1.3 Purchasing PPE to support the response to COVID-19

In response to COVID-19, the Victorian Government set up separate processes to coordinate the purchasing of PPE for health and non-health sectors.

PPE for the health sector

In early March 2020, the government set up a supply chain to coordinate the sourcing, purchasing and distribution of PPE for the health sector. The supply chain involved DHHS, HSV and Monash Health. Figure 1C shows the supply chain arrangements.

On 4 March 2020, HSV negotiated the first bulk order for PPE on behalf of the state. HSV is not bound by the VGPB policy. It has its own policy that allows for streamlined and flexible procurement for critical incidents.

On 10 March 2020, DHHS released the COVID-19 Pandemic Plan for the Victorian Health Sector, which refers to plans to set up a centralised procurement process for health PPE. In April 2020, DHHS set up a task force to oversee and manage PPE supply and usage. This task force includes DHHS, HSV, DJPR, and EMV.

PPE for non-health government agencies

Victoria did not have a plan for PPE needs outside the health sector before the pandemic. 

EMV's 2015 Victorian action plan for influenza pandemic outlines that its responsibilities for pandemics are coordinating emergency management personnel and recovery efforts. The plan does not mention PPE. 

On 17 March 2020, the government tasked EMV with coordinating PPE procurement for non-health agencies that could not source their own or where their stock was unexpectedly delayed. EMV required agencies to firstly rely on their own processes. 

On 20 April 2020, the Crisis Council of Cabinet transferred responsibility for sourcing non-health PPE to DJPR. DJPR then set up separate task forces for medical equipment and supplies, and for PPE.

1.4 Grants programs related to COVID-19

Departments managed several grants programs in response to COVID-19. They gave grants to a range of individuals and organisations affected by COVID-19, such as local councils, community groups, individuals and businesses. 

Figure 1D outlines the grant programs related to COVID-19 we selected to examine in this audit. All these programs were announced prior to June 2020.

Figure 1D: Grants programs related to COVID-19 we examined

^(a)This funding amount is only for the first round of the Business Support Fund. The second and third rounds were $534 million and $822 million, respectively.
Source: VAGO, based on information from departments.

Government policies and guidance for grants

The Standing Directions 2018 under the Financial Management Act 1994, outline departments’ mandatory requirements in relation to discretionary financial benefits, which include grants. It states that departments must:

• maximise value for money
• establish effective and efficient administrative controls
• apply DTF’s 2016 Investment principles for discretionary grants.

DTF's Investment principles for discretionary grants include nine principles for departments to consider when designing and implementing grants. One of these is to follow Better Grants by Design.

Better Grants by Design

Better Grants by Design states that departments managing grants need to:

• have a clear policy objective
• assess the risks associated with the program
• include an evaluation mechanism
• not create an ongoing need for funding
• minimise administration costs
• have accountability requirements for recipients that are proportionate to risk.

Business continuity grants and financial viability initiatives

Some departments administered business continuity grants or financial viability payments to entities within their sector. These payments aimed to support organisations that had lost income due to COVID-19 to meet urgent costs and retain their staff. 

We examined the following business continuity grants and financial viability initiatives in this audit:

• DELWP’s financial support for portfolio entities
• DET’s funding for TAFE and adult and community education providers
• DoT’s financial support for public transport operators.

Figure C1 in the appendix outlines these in further detail.

1.5 Other spending related to COVID-19

In addition to awarding grants and procuring goods and services, departments’ other expenditure related to COVID-19 included:

• working from home allowances for staff
• tax relief payments
• refunding liquor licences
• revenue loss payments to service providers.

The State Revenue Office, which we did not audit, managed payroll tax relief and liquor licensing waivers.

1.6 Other reviews and inquiries about Victoria's COVID-19 response

There have been several reviews and inquiries into aspects of the government's response to COVID-19. These include:

• Victorian Parliament's Legal and Social Issue Committee's Inquiry into the Victorian Government's COVID-19 contact tracing system and testing regime (December 2020)
• COVID-19 Hotel Quarantine Inquiry Final Report and Recommendations (December 2020)
• Victorian Parliament's PAEC's Inquiry into the Victorian Government's response to the COVID-19 pandemic (February 2021)
• Victorian Ombudsman's Investigation into the Department of Jobs, Precincts and Regions' administration of the Business Support Fund (April 2021).

Key themes across these reviews included:

• departments working under extraordinary pressure to respond to COVID-19
• a lack of probity and transparency in procurement
• poor coordination across departments
• the challenges of implementing support programs quickly.

Back to top

Conclusion

Most departments had weaknesses in their COVID-19 procurements, such as incomplete and missing documentation, frequent use of quotes from single suppliers and inadequate consideration of conflicts of interest. This means these departments cannot be sure that material fraud, corruption and waste did not occur.

The lack of a PPE stockpile meant that departments often paid high prices to secure essential items. Despite this, staff did consider value for money and conducted due diligence on new PPE suppliers. However, the risk of waste remains, as government has yet to centralise the storage and distribution of PPE for non health sectors.

2.1 Using CIP processes

DTF was the only department that chose not to use its CIP policy for procurement related to COVID-19. Although DTF only spent $1.8 million, by continuing to use normal processes it was able to reduce the risk of waste, fraud and corruption. All other departments used their CIP policies. While this allowed them to speed up purchasing to respond to urgent needs, it also exposed them to increased risks such as:

• not achieving value for money by relying on single quotes
• perceptions of favouritism or conflicts of interest when using single quotes 
• focusing on speed over documenting decision-making and approvals
• lack of transparency and poor oversight from central procurement units.

As shown in Figure 2A, departments significantly increased their use of CIP policies in 2019–20.

VGPB's data shows that 91 per cent (519) of all CIPs in 2019–20 were related to COVID-19. The remaining transactions related to the early 2020 bushfires. As shown in Figure 2B, departments reported to VGPB $255.7 million in CIPs related to COVID 19 for 2019–20.

DELWP did not report any CIPs related to COVID-19 to VGPB for 2019–20 even though its records show it had one. We discuss this further in Figure 2I.

Activating the CIP process

The VGPB policy requires departments to formally activate and close off their CIP policies. These announcements support staff to make good decisions during times of crisis by clearly outlining their responsibilities.

CIP policies allow staff to use a more flexible, less-competitive process, so it is vital that departments set clear boundaries around their use. In addition, only DELWP, DJCS and DoT had used their CIP policies between 2015–16 to 2018–19, which means that other departments’ staff were mostly unfamiliar with the CIP process. DPC did, however, have some recent experience using CIPs to respond to the bushfires in early 2020. Despite this, of the departments that chose to use their CIP policies, only DET, DJCS and DPC made formal announcements to start and close them. 

Staff at DJPR and DHHS advised us that they did not believe it was necessary to formally activate their CIP policies because the government had declared a state of emergency. Although this is a trigger for activating a CIP process under the VGPB policy, departments still need to clearly activate their own policy. This is because a state of emergency does not always affect all departments’ procurement activities. For example, the government often declares states of emergency in relation to bushfires. However, this does not mean that all departments need to change their approach to procurement.

Considering value for money

Although departments' approaches to considering value for money when using their CIP policies varied widely, we did find examples of better practice.

As we discuss in Section 2.4, DoT, DJCS and DET all had central procurement teams that monitored whether staff continued to consider value for money when using CIP policies. The following are other examples of good practice at these departments:

• More than 91 per cent of DET's purchases from March to October 2020 were from existing suppliers, including suppliers that are part of SPCs. 
• DET minimised the risk of waste when procuring additional cleaning for schools by varying and extending existing contracts. It also negotiated tiered pricing so it would pay different amounts depending on whether a school had a confirmed COVID-19 case or not. 
• In November 2020, DJCS reviewed prison cleaning contracts it had entered into early in the pandemic and went out to market to improve value for money. 
• DoT required all staff who used its CIP process to work with the central procurement team to approach the market. 

In contrast, some departments prioritised speed over value for money. DHHS and DJPR relied heavily on new suppliers or single quotes, even where an SPC panel existed.

Examples where DHHS did not make use of available SPCs and registers included not using:

• a $100 000 procurement to engage a firm to develop a communications and issues management strategy that did not use the marketing services register 
• a $9 500 placement fee for a customer relationship manager for workforce planning that did not use the staffing services SPC.

In addition, DJPR used its CIP process to procure a consulting firm to provide executive coaching and wellbeing support to staff affected by the COVID-19 response, at a total cost of up to $100 000. DJPR did not approach any other providers for quotes and did not finalise a contract with the firm until several months after it started providing services. 

Although using only one quote is acceptable under the VGPB policy, gaps in DHHS and DJPR's procurement records mean it is not always clear how they considered value for money or chose a particular supplier.

Figure 2C shows an example of a DHHS procurement that used a CIP process to contract a senior executive staff member using a single quote rather than a traditional recruitment process. This contractor received a higher payment than the job description and relevant pay band.

Figure 2C: Contracting a senior executive through a single quote

Source: VAGO, based on information from DHHS.

Figure 2D shows an example at DJPR where it was unclear why a supplier was approached to provide a service.

Figure 2D: Engaging a call centre using a single quote

Source: VAGO, based on information from DJPR.

Using CIP processes for non-urgent purchases

The VGPB policy does not provide guidance on whether departments should use CIP policies for procurements that are part of an economic or recovery response to a critical incident, rather than an immediate health or safety response. This means that departments may use a CIP process even when a procurement does not respond directly to an immediate crisis situation.

By treating all procurement related to COVID-19 with the same level of urgency, some departments missed opportunities to achieve better value for money by taking the time to go to market. DJPR, DHHS and DPC all used a single quote for some purchases that, while related to COVID-19, were not so time sensitive to justify avoiding a standard, competitive process. Examples included:

• engaging a professional services firm to provide executive team coaching (DJPR) 
• commissioning a professional services firm to review the department’s corporate structure (DJPR)
• creating a website to advertise government initiatives (DJPR)
• engaging creative services firms to develop entertainment to promote community wellbeing (DPC)
• buying online platforms to host live performance events online (DJPR).

The VGPB policy notes that staff should still consider value for money to the extent that they can, given the severity and urgency of a critical incident. However, it does not provide any guidance on how departments should do this.

In an example of better practice, the Queensland Government's Office of the Chief Advisor—Procurement issued specific advice to departments in March 2021 on how to procure during the COVID-19 emergency. This included guidance on how staff should differentiate between levels of urgency or stages in the pandemic and tailor their procurement processes accordingly. 

Where there is a risk to life, the guidance states that is appropriate to rely on single quotes and, if necessary, verbal or email approvals. If there is no risk to life but the procurement is still time sensitive, staff should use pre-vetted suppliers and supplier panels, simplified contracts and confirm all purchases and approval in writing. The guidance also notes that procurement that is related to ongoing recovery efforts should use standard competitive processes.

COVID-19 Quarantine Victoria advised us that it is considering the need to develop a 'staged' approach to procurement during critical incidents to maximise value for money. This approach could have different requirements for procurements depending on level of urgency and risk to life. This would ensure that the agency only uses a non-competitive procurement process when necessary.

Using professional services firms

All departments engaged professional services firms to prepare advice, deliver projects or provide surge staffing related to COVID-19. However, departments were often uncertain about their obligations when hiring professional services and did not always make full use of the SPC panel for professional services.

The DPC guidelines consider a critical incident as a valid exemption from the need to have secretary approval to engage professional services. However, they do not state whether departments still need to complete an exemption form in these circumstances. There is no guidance from VGPB or DPC that clarifies the relationship between the DPC guidelines and the VGPB policy. 

Only two departments (DJPR and DET) have used an approval form to record exemptions to the DPC guidelines for hiring professional services. However, even these departments did not use the form for all professional services engagements related to COVID-19. 

Although departments can hire professional services using single quotes under the VGPB policy, there are several examples of firms receiving an ‘incumbency advantage’ from departments after they were engaged this way. 

DHHS and DJPR both have examples where staff explained their decision to engage a firm based on a single quote with reference to the fact that the firm offered a ‘voluntary discount’ due to COVID-19. When extending the engagements, the departments then justified the new contract on the basis that the firm already had essential knowledge of the project. 

Although it is positive that departments were able to secure discounts, there is no evidence that other similar firms on the SPC would not also have offered a discount. There is also no evidence that staff tried to mitigate the incumbency advantage when they extended the engagements. 

As discussed in Figure 2E, DHHS used professional services firms extensively to respond to COVID-19. However, because it has engaged staff using several different processes, which each have different reporting requirements, the public will not be able to know the full costs incurred by using professional services to respond to COVID-19.

Figure 2E: DHHS’s use of professional services to respond to COVID-19

Source: VAGO, based on information from DHHS.

2.2 Identifying and managing conflicts of interest

DJCS and DELWP were the only departments where staff consistently completed conflict of interest declarations for CIPs related to COVID-19. 

Managing conflicts of interest is key to ensuring that government decisions are free from bias. This is particularly important during critical incidents as staff may not be using a competitive process to select suppliers. Typically, staff complete a conflict of interest declaration form to state whether or not they have a conflict in relation to a particular procurement. This is a quick yet critical process and would not delay an urgent procurement. 

The Victorian Public Sector Commission model policy advises that staff on a procurement panel or involved in a complex procurement should complete a declaration form regardless of whether a conflict is identified. 

DET advised us that it did not believe its staff needed to complete a conflict of interest declaration unless there was a conflict to declare. Conversely, DoT advised us that it does require staff undertaking a CIP process to complete declarations. However, this did not occur for three of four procurements that we reviewed. DPC requires its staff to complete a declaration as part of CIPs, but this did not occur for five transactions until after we reviewed them. 

At DHHS and DJPR, staff regularly did not complete declaration forms until after a procurement had taken place. At DJPR, staff did not complete declaration forms for some procurements until over six months after they occurred. This means there is no documented evidence to show that staff considered conflicts of interest specific to each procurement at the time it was undertaken. Figure 2F outlines an example from DHHS of a poorly managed conflict of interest.

Figure 2F: Example of poorly managed conflict of interest

Source: VAGO, based on information from DHHS.

DHHS’s management of conflicts of interest during COVID-19 mirrors known issues. A 2016 internal audit on declarations of private interests found gaps in how the department managed conflict of interest requirements. DHHS addressed all but one of the recommendations by January 2020. DH and DFFH are due to complete the final recommendation, an online system for declarations of private interests and conflicts of interest, by the end of 2021.

In an example of better practice, a staff member at DJCS correctly identified that they had a perceived conflict of interest in relation to a hotel quarantine accommodation site as they lived in an apartment in the same building. The staff member alerted their manager, and they developed a suitable management plan so the staff member would not have contract management responsibilities for the hotel.

Record keeping and accountability

Departments need to keep good records to be transparent about their decisions. Without comprehensive documentation that outlines how and why staff chose a particular supplier, departments cannot be fully accountable for their spending. 

The VGPB policy requires departments to develop a ‘suitable form’ for recording the required minimum information about each procurement. Although all departments except DET have a specific CIP form to record details about each procurement, only DJCS did not have gaps in record keeping.

Figure 2G outlines two examples of departments’ poor record keeping practices for CIPs.

Figure 2G: Examples of poor record keeping for CIPs

Source: VAGO, based on information from DJPR and DHHS.

Aside from their annual reporting obligations to VGPB, there is no mandated timeframe within which departments need to update their internal CIP registers. However, without up-to-date, accurate data it is difficult for departments to progressively monitor whether staff are complying with CIP policies. 

It is particularly important that departments keep up-to-date records, as it can be difficult for staff to remember why they made decisions after the fact. For example, DHHS has an incomplete critical incident report for one $875 000 transaction because it was not completed at the time and the responsible staff member has since left.

Departments’ reporting to VGPB

In addition to records about individual transactions, departments need to report all CIP transactions to VGPB. Departments did not consistently capture all CIPs related to COVID-19 in their reports to VGPB.

As shown in Figure 2H, all departments except DTF and DPC reported different values of CIPs to VGPB compared to the values they reported to us or recorded in their own procurement registers.

Figure 2H: Values of departments’ CIPs related to COVID-19 for 2019–20

^(a)This figure excludes contracts where the total value has not yet been finalised.
Source: VAGO, based on the VGPB Annual Report 2019–20 and information from departments.

Although DJPR reported its CIPs to VGPB, it was the only department that qualified its figures by noting that they did not include any contracts where the final cost has yet to be finalised. 

As mentioned in Section 2.1, DELWP did not report any CIPs related to COVID-19 for 2019–20 to VGPB. Figure 2I discusses weaknesses in DELWP's reporting to VGPB.

Figure 2I: DELWP’s reporting to VGPB

Source: VAGO, based on information from DELWP.

2.3 Monitoring how staff used procurement policies

DoT, DJCS, DET and DPC took a better-practice approach to monitoring how staff used their CIP policies for higher-value procurements. This was important because, as noted in Section 2.1, most staff had never used CIP policies before.

The following are examples of strong oversight:

• DoT required staff to seek the approval of the central procurement team for all CIP procurements. 
• DET, DPC and DJCS procurement staff were involved in transactions that they considered high value.
• DET and DJCS procurement staff conducted 'spot checks' to ensure staff were using CIP processes for legitimate reasons. 
• DPC set up a procurement governance committee to oversee all procurements related to COVID-19 valued at more than $350 000.

In contrast, DHHS and DJPR, which made the highest value procurements related to COVID-19, had limited central oversight over how staff used CIP policies. This means they cannot assure themselves that staff only used CIP processes when appropriate and continued to consider probity and value for money. 

DHHS advised us that staff in business units had to engage its central procurement team for all procurements that would result in a contract, regardless of value. However, there were instances of staff ignoring this practice and other examples of staff disregarding the central team's advice. 

In one example, a business unit sought advice from DHHS's central team about a procurement to support clients with mental health and alcohol and other drug issues during COVID-19. Despite the central unit advising against an up-front payment, the business unit paid approximately $600 000 up-front. It then decided it no longer wanted to engage the supplier and had to negotiate repayment. DHHS has since updated its CIP policy to strengthen the central procurement team’s oversight role.

Figure 2J discusses issues relating to lack of central oversight of the procurement of DHHS's digital contact tracing platform.

Figure 2J: Procuring DHHS's Test, Trace and Isolate contact tracing system

Note: DHHS entered into a second contract with a consortium led by the professional services firm. 
Source: VAGO, based on information from DHHS.

DJPR advised us that its central procurement team provided advice to business units on request, but it did not document this advice or follow up to confirm that staff followed it. In September 2021, our Managing Conflicts of Interest in Procurement report found that DJPR staff responsible for procuring hotel security services engaged a provider that was not on the security services SPC. Although they subsequently received advice from the central procurement team and central agencies to use SPC providers or apply for an exemption from the SPC, DJPR staff continued to use a company not on the SPC without an exemption. 

Our September 2021 report explored this issue further. The DJPR staff who engaged the non-SPC provider did not have training in procurement or previous experience in procuring security services. Not going through the central procurement team meant that staff were not aware of the SPC for security services until after they had engaged the provider. 

In April 2021, DJPR moved to a more centralised procurement model, with staff now required to gain approval from the central procurement unit for any procurement above $100 000. DJPR advised us that this change was not in response to COVID-19 procurement issues. Instead, it was part of broader efforts to create a more cohesive sense of DJPR as ‘one department’ rather than siloed business units. However, our findings and those of the Hotel Quarantine Board of Inquiry demonstrate the need for tighter central control over procurement. 

2.4 Challenges relating to PPE procurement

Victoria did not have a PPE stockpile prior to the pandemic. This meant that departments needed to rely on unfamiliar suppliers and often paid high prices to meet the urgent need for supplies. Despite this, departments responded quickly to the crisis and considered value for money as best they could under the circumstances.

PPE procurement for the health sector

The Victorian health management plan for pandemic influenza 2014 states that in the event of a pandemic, the former DHHS would manage and distribute PPE from the National Medical Stockpile and the Victorian Medical Stockpile. 

However, in December 2020, the Australian National Audit Office’s report Planning and Governance of COVID-19 Procurements to Increase the National Medical Stockpile found that prior to the pandemic, Victoria did not have a PPE stockpile. This is because Victoria’s public health system has a devolved governance model, where individual health services manage their own PPE supplies. Only Victoria and the Northern Territory did not have a PPE stockpile for any type of PPE. 

As discussed in Section 1.3, in March 2020 the government set up a state supply chain involving DHHS, HSV and Monash Health to source, purchase and distribute PPE for the health sector.

In May 2021, HSV noted that 48 per cent of its PPE suppliers were new and it was able to order only about 11 per cent of PPE from Australian manufacturers. Although DHHS and HSV tried to mitigate the risk of using unfamiliar overseas suppliers, they still experienced stock delays.

Also, DHHS could not use more than $172 million worth of stock that was not fit for purpose. Most of this comprised:

• 33 million N95 respirators at a cost of $110 million
• 14 million surgical face masks at a cost of $9.5 million. 

Reasons for ‘quarantining’ this stock included:

• The Therapeutic Goods Administration is the Australian Government body that regulates medical goods and devices.

  health services discovering that some respirators did not meet the relevant standards so they could not be used by health workers
• the Therapeutic Goods Administration updated its advice on PPE standards as the pandemic evolved. This meant that some masks purchased early in the pandemic could not be used for their intended purpose. 

HSV and DH have advised us that they are now looking at ways to minimise waste by repurposing PPE items that do not meet the relevant standards.

In June 2020, DHHS cancelled PPE orders worth $68 million. Reasons for cancellations included delivery delays, stock quality issues and no longer requiring stock. DH advised us that it is considering cancelling a further $53 million in orders. As it has paid $7 million of this up-front, unless it can negotiate with suppliers to agree to the cancellations, it will not be able to recoup the initial payment. 

In addition, there were some gaps in how DHHS and HSV managed the risk of items not being delivered. In September 2020, our review of DHHS and HSV’s financial records identified that neither could supply evidence that they had insured PPE in transit from overseas. 

PPE pricing

Due to the lack of a stockpile and high demand, DHHS paid higher than usual prices for PPE. Early in the pandemic, DHHS’s Equipment and consumables team considered value for money when assessing offers from suppliers. HSV supplied DHHS with price estimates to guide this work. For example, HSV advised that N95 masks typically cost between $1.02 and $2.23. However, demand for PPE was high and countries were competing for limited stock. As a result, HSV often had to pay considerably more than normal prices. For example, HSV paid 16 times the pre-pandemic price for gloves, paying up to $0.14 per unit.

However, HSV did negotiate on prices with suppliers where possible. For example, in April 2021, HSV managed to secure a price reduction of $1.84 million with a supplier of N95 respirators.

As shown in Figure 2K, DHHS also paid varying prices for hand sanitiser, which fluctuated from between $3.27 and $7 per 500 ml bottle during 2020.

PPE procurement for non-health agencies

The lack of a PPE stockpile was a particular issue for non-health services, as staff typically had no familiarity with the PPE products they were sourcing and did not have access to pre-vetted suppliers or established supply chains. However, non-health agencies did use the office supplies SPC where possible and conducted appropriate due diligence over new suppliers.

Victoria has a single-vendor SPC for stationery and office supplies, which covers masks, sanitiser, wipes and gloves. Throughout 2020, DJCS and DET made approximately $2.4 million and $245 000 worth of purchases respectively from this SPC.

However, departments advised us that the SPC quickly became overwhelmed with demand and they needed to find other suppliers. 

When using new suppliers, departments made efforts to consider value for money and probity, including:

• approaching multiple suppliers
• benchmarking prices
• sharing information among agencies about legitimate suppliers
• checking the Australian Securities and Investments Commission register to confirm that suppliers were legitimate businesses
• confirming that suppliers held stock and could meet timeframes before purchasing. 

In April 2020, DJPR established a central list of PPE suppliers. Prior to this, there were informal efforts to coordinate purchasing between the health and non-health sectors to avoid overwhelming suppliers. 

Without a central stockpile or a PPE-specific SPC, departments were often in competition with each other for scarce stock. For example, DET advised us that staff would find a supplier with available stock, but by the time they could arrange payment the stock had already been purchased by another party, including other government agencies. 

Similar to DHHS's experience, DJCS also paid widely varying prices for hand sanitiser, as shown in Figure 2L.

DTF is working with DJPR to develop a PPE SPC for non-health agencies.

DET and DJCS experienced similar issues to HSV and DHHS with PPE that was not fit for purpose. DET and DJCS bought masks and sanitiser that met the relevant standards at the time of purchase, but then could not be used. This was because the Therapeutic Goods Administration updated its advice on masks, and DHHS updated its advice to departments on the required percentage of alcohol for hand sanitiser. DET and DJCS had both purchased hand sanitiser with lower amounts of alcohol. They advised us that they are looking to make use of the sanitiser in lower-risk situations.

DJPR's role in non-health PPE procurement

As discussed in Section 1.3, in late April 2020, the Crisis Council of Cabinet transferred responsibility for sourcing PPE for non-health agencies from EMV to DJPR. Despite this, DJPR has yet to centralise storage and distribution of PPE. There is a risk of waste because departments are duplicating their efforts and paying to store PPE separately. DJPR advised that it was tasked with establishing an emergency stockpile and supporting access to supply for non health agencies when PPE supplies were limited. DJPR also advised that it has not received funding to centrally manage PPE. 

DET, EMV and DJPR are all continuing to store PPE and/or hand sanitiser in separate warehouses. EMV advised us that it expected DJPR to take ownership of its surplus stock once DJPR established its PPE task force. DJPR advised us that government has not funded it to store or purchase stock from other agencies. EMV notes that it has so far paid approximately $75 000 for warehouse costs to store PPE. 

In November 2020, DPC received the report of its external Whole of Victorian Government Personal Protective Equipment Review. The review recommended that EMV and DJPR set up a working party to resolve the surplus stock issue within three months. This has yet to occur.

Back to top

Conclusion

Due to the speed with which they set up their COVID-19 grants programs, DJPR and DHHS did not implement effective fraud controls at the start. Although they made improvements over time, there is a risk that internal reviews have not uncovered all cases of suspected fraud. In contrast, DoT and DPC minimised the risk of fraud and waste by building controls into the grant application process and monitoring how grants were used. However, most departments could improve how they consider conflicts of interest in grants management.

DELWP, DET and DoT also effectively managed their financial viability grants and reasonably assured themselves that recipients used the grants as intended.

3.1 Managing grants in times of crisis

As outlined in Figure 1D, DHHS, DJPR, DoT and DPC gave grants to a range of individuals and organisations affected by COVID-19, such as local councils, community groups, individuals and businesses.

Better Grants by Design requires departments to identify, document and manage the risks associated with administering a grants program. It specifically mentions the risk that a department may experience ‘pressure to implement programs urgently’, such as in times of crisis. 

There are increased risks associated with setting up a grants program quickly, including:

• risk of fraud or overpayment due to prioritising speed over a thorough assessment process or strong controls
• inadequate time to set clear application criteria to ensure consistency
• a lack of focus on training staff administering grants.

Departments need to advise government of risks so that any trade-offs, such as prioritising rapid payment over extensive applicant checks, are clearly understood and managed. 

Only DoT advised government of the risks associated with its COVID-19 grants program for the commercial passenger vehicle industry. This included the risk that poor quality data could make it difficult for DoT to quickly check applicants' eligibility. 

Although DPC did not advise government of the risks associated with its grant programs to multicultural community organisations, the programs were lower risk because they involved organisations that it had worked with previously. 

In contrast, despite setting up large-scale grants programs within two weeks, DHHS and DJPR did not advise government of the risks of setting up their programs. DJPR advised that it had informal discussions with the minister about risk management. Due to the pressure to pay grants quickly, neither had enough time to establish sufficient fraud controls. Although DHHS’s operational guidelines for its grants program did mention the risk of fraud, they did not outline how the department planned to manage the risk.

3.2 Identifying fraud and overpayment

Preventative controls aim to minimise the risk of fraud and are particularly important for large-scale programs that may attract thousands of applicants. Preventative controls can include:

• clear eligibility guidelines 
• checking that the information provided by applicants meets the program eligibility criteria
• validating the information applicants provide by matching the information to ‘external’ data sources (such as information held by other government agencies) 
• segregation of duties between the staff members responsible for assessing an application and those formally approving payment 
• automated controls as part of grants management, such as finance and ICT systems that restrict who can assess and approve payments, to either prevent or detect duplicate payments.

DoT and DPC established effective preventative fraud controls for their grants programs related to COVID-19, including strong assessment processes that confirmed applicants' eligibility.

DHHS and DJPR did not implement effective preventative fraud controls for their grants programs related to COVID-19 until they had identified cases of suspected fraud. Although both departments made some improvements to their programs over time, some of these could have been in place earlier if these departments had conducted a program risk assessment and used basic data validation steps.

Control weaknesses in DJPR's Business Support Fund

For the first two rounds of the Business Support Fund, DJPR could not check applicants' eligibility by verifying that applicants’ self-reported WorkSafe Victoria and JobKeeper information was correct. This was because DJPR did not have access to these datasets from the Australian Taxation Office until July 2020. However, DJPR’s system could have included other basic data validation checks, such as only accepting applications with JobKeeper ID numbers in the correct length and format. As a result, DJPR paid grants to some applicants that were not eligible to receive funds, including:

• 105 grants to businesses that stated they had zero employees on their application form, totalling $1.05 million
• at least 268 grants, totalling $2.68 million, to applicants that provided JobKeeper ID numbers that did not meet the correct length or format
• five applications, totalling $50 000, that submitted business activity statements in the wrong format.

DJPR later found that the 105 businesses that stated they had zero employees had completed the application form incorrectly but were eligible for a grant. 

DJPR could have addressed these issues earlier by using system controls to identify possible errors and checking with applicants to confirm eligibility.

After the Business Support Fund's first round, DJPR commissioned an internal review and, by June 2020, had introduced a strengthened data analytics program. DJPR advised us that this included a process for externally validating the information applicants provided by checking it against information from other agencies, such as the Australian Securities and Investments Commission or WorkSafe Victoria. 

In October 2020, DJPR identified that due to an ICT system error, it made $13.85 million in overpayments to more than 1 000 ineligible businesses. Following this, DJPR commissioned another internal review of the fund. The review was completed in June 2021 and found that even though DJPR needed to process thousands of applications, its assessment process was manual and relied on a small number of individuals checking spreadsheets. This reliance on manual processes increased the risk of fraud and mistakes due to human error. 

The review also found that DJPR does not have a governance framework that clearly defines the assessment and payment processes and has no controls to prevent staff manually altering application data or bank details. DJPR has advised us that it is working to address the review's findings.

DJPR suspects that it paid 306 fraudulent applications across the Business Support Fund's three rounds. This amounts to $3.06 million of the approximately $2.38 billion it distributed, or 0.13 per cent of the fund. DJPR has reported suspected fraud and losses to the Minister for Industry Support and Recovery, as required by the Standing Directions 2018 under the Financial Management Act 1994.

Given that DJPR may continue to manage large-scale grants programs as part of the future COVID-19 recovery process, it is vital that the department improves its grants administration process and fraud controls.

Fraud controls in DHHS's rent relief grants program

DHHS’s rent relief grants program provided grants to renters that were facing financial hardship as a result of the pandemic. The program ended on 31 March 2021. Although DHHS improved its fraud controls for this program over time, many of these were basic preventative controls that could have been set up when the program began. For example:

• until DHHS implemented automated system checks in June and July 2020, DHHS relied on another government agency to find duplicates and check whether a tenant and real estate agent or landlord had the same address
• until January 2021, one DHHS grant assessor could review an application from start to finish to decide eligibility and send it for payment without review by a second person.

In early 2021, DHHS introduced a process to validate the length of real estate agents' Australian business numbers and tenants' bond identification numbers. These are basic preventative controls that should have been in place at the start of the program. Since the introduction of these fraud controls, DHHS estimates it has prevented $842 776 in fraudulent grants. 

As of 15 March 2021, DFFH had detected $294 038 in fraudulent grants for its rent relief grants program. Although DHHS found suspected fraud in September 2020, it only reported it verbally to its audit committee in December 2020. It did not provide the committee with a written report until March 2021. DFFH did not formally advise the Minister for Housing of the fraudulent grants until May 2021, eight months after detecting them.

On 6 September 2021, the government announced a new rent relief package. DFFH advised that it will incorporate learnings from the previous rent relief grants program.

3.3 Managing conflicts of interest in grants administration

DoT, DPC and DHHS did not have effective processes to ensure that staff considered conflicts of interest. This means that departments cannot be certain that staff did not pay some grants inappropriately.

Better Grants by Design states that agencies need to consider conflicts of interest as part of the grant assessment process. This is a particularly important fraud control for programs that receive thousands of applications and rely on high numbers of contracted staff to assist with rapid processing. 

DHHS did not require staff or contractors involved in grants administration to complete a conflict of interest declaration. In addition, in the early stages of the rent relief grants program, the same grant officer could assess, approve and send an application to finance for payment without any review. 

DJPR had an effective process to manage conflict of interests in COVID-19 grants administration. For example, staff involved in processing Business Support Fund applications not only made a declaration prior to starting work, but made ongoing declarations if they discovered they had a personal association with an applicant. This accounted for the fact that a diverse range of businesses could apply for a Business Support Fund grant, making it difficult for staff to consider all possible conflicts prior to starting work. 

However, as discussed in Figure 3A, DJPR did not effectively manage a significant perceived conflict of interest when it engaged staff from a not-for-profit organisation specialising in social procurement to manage the Working for Victoria program.

Figure 3A: Conflict of interest in DJPR's engagement of staff from a social procurement organisation to manage Working for Victoria grants 

Source: VAGO, based on information from DJPR.

DoT’s conflict of interest policy requires staff to complete declarations for any grant activity greater than $25 000. For anything lower than $25 000, DoT staff are expected to voluntarily disclose whether a conflict exists. DoT’s grants for the commercial passenger vehicle sector varied in size from approximately $250 for individuals to more than $2 million for commercial booking agents. However, DoT advised us that staff processing the grants were not required to complete a declaration.

3.4 Risk of waste in the Working for Victoria grant program

DJPR risked wasting grant funding by using the Working for Victoria program to fund the purchase of goods and services that should otherwise have been purchased using a procurement process. By not following a formal procurement process, DJPR cannot be confident that it minimised probity risks or achieved value for money. 

Better Grants by Design outlines that the purchase of goods and services from third parties should be undertaken as a procurement, not a grant. Despite this, as outlined in Figure 3B, DJPR paid a software company a grant to develop the online platform for Working for Victoria, rather than using a procurement process.

Figure 3B: Procuring an online platform for Working for Victoria

Source: VAGO, based on information from DJPR.

DJPR risked wasting grants funding by not using a consistent process to assess Working for Victoria applications. Although DJPR set up Working for Victoria in March 2020, it did not introduce a 'value calculator' until September 2020. This means that DJPR did not consider all Working for Victoria applications in the same way.

DJPR advised us that the value calculator was a tool for the initial assessment of proposals before they were considered by the assessment panel. From our review of the 38 unsuccessful applications that DJPR assessed using the value calculator, it was not always clear what weight the panel gave to the value calculator. 

For example, DJPR provided a $10 million Working for Victoria grant to DoT to fund public transport operators to subcontract private companies to clean public transport. DJPR advised us that even though the grant achieved a low value calculator score compared to other applications, it was paid as a result of a government directive to fund extra cleaning through the Working for Victoria fund. We found that 34 out of 38 unsuccessful applications had a higher score than DoT’s cleaning grant, which scored 49.63 out of 100, but these were not funded. DJPR advised us that funding limitations meant that it could not approve all applications.

3.5 Monitoring grant outcomes

DPC and DoT minimised the risk of waste for their COVID-19 grants programs by ensuring that grant recipients used the payments as intended. Although DJPR had mechanisms to monitor how recipients used Working for Victoria grants, it did not have a similar process for the Business Support Fund. DHHS did not initially build any accountability mechanisms into its rent relief grants Program.

Better Grants by Design states that grants programs should have accountability requirements imposed on grant recipients to ensure they spend funding as intended, which supports the grants program to achieve its intended outcomes. 

Better Grants by Design recommends that accountability requirements are proportionate to a grant program's risks. This means that lower-value, low-risk grants should have less accountability requirements than high-value, high-risk grants. It also means that individuals should be subject to less complex reporting than businesses or organisations.

DJPR had different accountability requirements for recipients depending on whether a grant was for an organisation or an individual/small business. 

For the Working for Victoria grant program, DJPR required recipients to complete fortnightly progress reports and a final report demonstrating the grant’s impact. In contrast, DJPR did not require small business who received Business Support Fund grants to report back. It only stated on the application form that grant recipients:

• needed to spend the grants as intended
•  could be audited in future and may need to provide evidence of how they spent the funds.

DJPR has not confirmed whether it plans to audit recipients of the Business Support Fund. Without this, it cannot be certain that the program achieved its intended outcome. This also limits its ability to learn from implementation mistakes and design more effective programs in the future. 

When the rental relief grants program was set up in April 2020, DHHS did not have any accountability mechanisms requiring recipients to show that funds were being used as intended. There were also no requirements for recipients to return unspent funds. By September 2020, it revised its program guidelines to require recipients to return unspent funds. To date, recipients have so far returned approximately $714 000 to DHHS.

3.6 Business continuity grants

In addition to COVID-19 support grants, some departments administered business continuity grants to entities within their sector. As outlined in Figure C1 in the appendix, we examined DELWP, DET and DoT’s business continuity grants. 

DELWP, DET and DoT effectively managed the risks of fraud, corruption and waste involved in providing business continuity grants to portfolio entities and associated organisations. Departments’ business continuity grants were supported by clear advice to government that identified the risk of not supporting recipients to manage the financial impact of COVID-19. These risks included:

• job losses 
• entities defaulting on payments
• insolvency and organisations closing
• a reduction in the type and quality of some services available to Victorians. 

In their advice to government, departments considered the financial situation of the relevant entities or sector and suggested that financial viability funding should only be provided for entities that:

• minimise non-essential operating expenditure 
• use existing cash balances to offset expenditure.

All the audited departments had documented, evidence-based processes for determining the amount of financial viability funding provided. They also had clear accountability requirements for funding recipients, such as requiring they:

• have funding agreements outlining what the funding was to be used for
• provide financial statements
• regularly report back on how they were using the funding. 

In addition, DELWP set up a task force specifically to oversee financial viability payments to its portfolio entities.

Payments to non-government organisations

Both DoT and DET had effective processes to ensure that private organisations that received financial viability payments did not profit from public funding. 

For its payments to public transport operators, DoT tied the amount and length of time operators received financial viability payments to their revenue to ensure they could not make a profit. In its agreement with operators, DoT is entitled to all of the operators' profit during the support period. DoT advised us that it has not exercised this right because the operators incurred losses during the support period. It also stated that the operators are not able to access any further relief, payment, orc ompensation from the state arising from impacts related to COVID-19.

DET only provided a grant to one non-government organisation that was not a Learn Local organisation. The organisation received approximately $460 000. DET did so based on a risk assessment of private adult education providers that found that only one provided 'system critical' training and was at a significant financial risk. DET required the entity to provide detailed financial reporting to confirm that it spent the grant as intended.

Back to top

Conclusion

Although DTF collects COVID-19 spend data from departments, it is not actively monitoring this. Without central oversight, it is difficult to understand how well the state is managing its overall COVID-19 spend. 

DTF set up a manual reporting process to consolidate departments' COVID-19 spend. However, the process took a long time to develop and had data quality issues that led to delayed and incorrect public reporting of 2019–20 spending. DTF has since improved its data collection process, which means it should be easier to report on whole-of-government COVID-19 expenditure for 2020–21. 

Despite the data collection difficulties DTF faced, all departments track their own spend related to COVID-19. DHHS, DJPR and DJCS have shown better practice by setting up processes to specifically monitor COVID-19 spending.

4.1 Collecting whole-of-government spend data related to COVID-19 

It is important that the government identifies and monitors spending related to COVID-19 so it can understand its full financial impact. The government reported a net operating deficit of $6.5 billion for 2019–20, which it largely attributed to the financial impacts of COVID-19. 

As discussed in Section 1.1, DTF reported that departments spent $4.4 billion in COVID-19 initiatives in 2019–20. DTF did not report budget figures as part the whole of-government data, which limits public transparency around how well departments managed their expenditure within centrally approved budgets. 

Although DTF reported that COVID-19 led to a major net operating deficit for the state, it is not using the data it has collected to monitor whole-of-government spend related to COVID-19. This is because DTF does not view this as its role, as the Financial Management Act 1994 requires departments to monitor their own spend. However, as there were many cross-departmental initiatives, it is necessary for DTF as the central agency to monitor this spend. Without this, the government lacks an understanding of how well it is managing this spend. 

In anticipation of information requests from other agencies, such as the Australian Bureau of Statistics, DTF started collecting COVID-19 spend data from departments. However, it experienced difficulties when it tried to collate all departments' 2019–20 COVID-19 spending. This was due to different reporting practices across departments and data quality issues. As a result, DTF did not finalise and publish COVID-19 spend data for 2019–20 until October 2021.

Finance systems

All departments track their spending related to COVID-19 in their own finance systems (discussed further in Section 4.2). However, as departments operate their finance systems separately, their business practices, including the way they categorise expenditure, are not aligned with each other. This lack of consistency makes it difficult for DTF to directly use data departments report to monitor whole-of-government expenditure.

The central finance system that government agencies use does not allow departments to record data that is granular enough for DTF to identify individual transactions related to COVID 19. DTF therefore set up a separate manual process for departments to report on COVID-19 expenditure outside of the central finance system. It designed the process to increase visibility over COVID-19 expenditure, but it cannot reconcile this data with departments' financial statements. Due to this, the Victorian Government does not have full assurance on the accuracy of the reported data.

Data quality

Competing priorities during the pandemic led to delays in DTF setting up a process for departments to report their COVID-19 expenditure. DTF did not issue the first guidelines for departments on reporting COVID-19 expenditure until August 2020. This was one month after the 2019–20 financial year ended and five months after 
the government announced the state of emergency. 

As DTF was slow to set up the first reporting guidelines, its ability to identify and correct data quality issues early was limited. In December 2020, DTF changed its approach after it found that it could not gather the quality of data it expected. DTF had sought to collect granular data at various levels to meet different reporting purposes, but it was not always possible for departments to collect this. For example, it was difficult for DHHS to identify how much hospitals had spent on PPE in direct response to COVID-19. 

Examples of other data issues included departments:

• having varied interpretations of DTF's guidelines and using the wrong reporting categories
• reporting budgets rather than spend
• using different names for the same initiative, making it difficult to consolidate initiatives involving multiple departments.

Figure 4A highlights how DTF adjusted its reporting approaches.

Figure 4A: DTF’s processes for departments to report spending related to COVID 19

Source: VAGO, based on information from DTF.

DTF's December 2020 reporting process addressed data quality issues but led to most departments needing to revise their data multiple times, and DTF needed to spend considerable time reviewing data accuracy. As DTF cannot reconcile this data to departments’ financial statements to confirm its accuracy, it relies on departments correctly reporting their expenditure according to DTF’s guidelines. 

In July 2021, DTF first published COVID-19 spend data for 2019–20, which reported a total expenditure of $3.6 billion. DTF’s subsequent review of its published data identified three DTF initiatives valued at a total of $757.2 million that it did not report. This means that the actual 2019–20 costs for COVID-19 initiatives was $4.4 billion. DTF did not publish this revised data until October 2021.

As DTF is now collecting 2020–21 data periodically, it should be able to detect data quality issues earlier and proactively monitor whole-of-government spending. DTF planned to publish the Victorian Government's 2020–21 COVID-19 spend data alongside the 2020–21 Financial Report, but published it three days later. DTF's data shows that the Victorian Government spent $13.3 billion in COVID-19 initiatives in 2020–21.

Centralising data

DPC is undertaking a project to streamline whole-of-government data collection and align record keeping practices. This work aims to make it easier to collect consistent whole-of-government data and improve benchmarking between departments. It may also address inconsistencies with departments’ record keeping practices as discussed in Section 2.3. 

Figure 4B outlines the expected benefits of DPC's project.

Figure 4B: DPC’s common platforms project

Source: VAGO, based on information from DPC.

Other COVID-19 spend

As shown in Figure 4A, DTF's whole-of-government data only captures expenditure for centrally endorsed COVID-19 initiatives. This does capture most of the government's spending related to COVID-19, but does not cover departments' other COVID-19 spend. For example, it does not capture equipment to support staff to work remotely or additional cleaning costs. DTF has estimated these costs to be around $103.6 million for 2019–20, which would be 2.4 per cent of total COVID 19 related spend if included. 

As whole-of-government reporting does not capture other COVID-19 spend, it is important that departments monitor this spending.

4.2 How departments monitor spending related to COVID-19

Under the Financial Management Act 1994, departments need to monitor their own budgets and expenditure. This includes maintaining accurate financial information to support decision-making and meet their financial reporting requirements.

Tracking codes

Although all departments set up tracking codes to record their expenditure for COVID-19 initiatives, not all departments regularly consolidated and monitored this expenditure.

Departments advised us that it was not possible to create a tracking code in their existing finance systems to automatically consolidate expenditure for COVID-19 initiatives and other operating expenses. DJCS, DFFH and DH were the only departments that addressed this limitation by creating a filter in their budgeting system that allows them to automatically identify expenditure for all COVID-19 initiatives. Other departments needed to manually consolidate this information for monitoring purposes.

Internal reporting

Departments regularly report on their overall financial position as part of their usual financial reporting processes. This reporting typically records how much the department has spent overall and how much their business units have spent against internal budgets. However, this standard reporting does not specifically monitor and report on significant events like COVID-19 spend because it does not specifically:

• track the budgets and cost of COVID-19 initiatives 
• include information on other COVID-19 spend
• cover the impacts on programs that have had funding re-prioritised for COVID-19 initiatives.

In May 2020, DET started reporting its overall spend for COVID-19 initiatives as part of its regular monthly financial reports. Although it does not include a detailed breakdown of the COVID-19 spend, DET applies a risk rating each month to highlight any concerns around budgetary impacts. 

Only DHHS, DJPR and DJCS could demonstrate that they specifically monitor their COVID-19 expenditure in addition to their usual financial reporting processes. Figure 4C describes two methods these departments used to monitor their total spending related to COVID-19.

Figure 4C: Better-practice examples on monitoring spending related to COVID-19

Source: VAGO, based on information from DFFH, DH, DHHS, DJPR and DJCS.

Back to top

Click the link below to download a PDF copy of Appendix A. Submissions and comments.

 

Click here to download Appendix A. Submissions and comments

Back to top

Back to top

Our methods

As part of the audit we examined:

• financial records and data related to COVID-19 spending
• procurement policies and controls over COVID-19-related procurement
• grants management policies and controls over COVID-19-related grants.
• policies and procedures and the effectiveness of controls for other COVID-19 spending initiatives, such as financial viability payments to portfolio agencies.

We also interviewed relevant departmental staff. 

Figure C1 outlines the business continuity grants and financial viability initiatives we examined in this audit.

FIGURE C1: Business continuity grants and financial viability initiatives we examined

^(a)Figure is for the period between January to October 2020. 
Source: VAGO, based on information from departments.

We conducted our audit in accordance with the Audit Act 1994 and ASAE 3500 Performance Engagements. We complied with the independence and other relevant ethical requirements related to assurance engagements. 

Unless otherwise indicated, any persons referred to in this report by name or position are not the subject of adverse comment or opinion.

Back to top