Portfolio Departments and Associated Entities: 2015–16 Audit Snapshot

Conclusion

Financial reporting for the 2015–16 year has improved. The significant issues that resulted in unprecedented modifications of some portfolio departments' 30 June 2015 audit opinions have largely been addressed. In particular, the Department of Education & Training (DET) systematically addressed prior-year audit concerns and now has better financial management and governance practices.

Machinery-of-government (MOG) changes announced in 2014 created the Department of Health & Human Services (DHHS) and the Department of Economic Development, Jobs, Transport & Resources (DEDJTR). Both new departments implemented the MOG changes and are working toward achieving further efficiencies.

Findings

Financial reporting outcomes

We issue an unmodified audit opinion when we determine that a financial report fairly presents the transactions and balances for the reporting period, in accordance with the relevant reporting framework.

We issued unmodified audit opinions on 199 financial reports for 2015–16, including the five Victorian alpine resorts, whose financial years ended on 31 October 2015. Thirteen audits were not finished when we finalised this report. Appendix B lists the portfolio departments and associated entities included in this report and illustrates the outcome of their audit opinions.

We included an 'emphasis of matter' paragraph on 33 of the audit opinions issued. An emphasis of matter paragraph draws a reader's attention to matters within the financial report.

We issued a clear opinion on the 30 June 2016 transactions and balances of both DET and the Department of Treasury & Finance (DTF). Our opinions retained the modifications issued in 2014–15 on school transactions at DET, and on the accounting for East West Link project funds at DTF.

When conducting our audits of portfolio departments, we bring any issues identified to the attention of the secretary and the audit committee through interim and final management letters. During our 2015–16 audits, we raised 52 issues rated high and medium risk. Most high-risk issues related to information technology control weaknesses.

We observed a small improvement in the timeliness of portfolio departments addressing management letter issues. Of the 106 issues raised in 2014–15, 60 have been resolved.

In 2013–14, we outlined a number of serious internal control issues at three of the state's alpine resorts. We followed up management's actions during 2014–15 and identified significant improvements at Lake Mountain and Mount Baw Baw. Falls Creek is in the process of resolving its issues in the current year.

Department of Education & Training

We issued our audit opinion on the DET financial report on 29 September 2016. We were able to give a clear opinion on the transactions and balances as at 30 June 2016.

Our opinion was modified because DET had not resolved the audit matters relating to school transactions that formed part of the disclaimer of audit opinion in 2014–15. We were therefore unable to form an opinion on the comparative numbers for the school transaction lines.

In 2015–16, DET took a new approach to assurance about schools transactions and balances, and we support this new approach. However, it was not practical for DET to retrospectively carry out additional assurance work on the 2014–15 school transactions that are used for comparison in the current financial report.

We did get sufficient and appropriate audit evidence that the comparative property, plant and equipment transactions and balances were materially correct. This was because DET conducted significant investigation and resolution of longstanding problems, and addressed all audit matters.

In 2013–14 and 2014–15, we reported to Parliament that the financial reporting processes at DET were poor. These processes were much better in 2015–16 and we no longer consider DET's financial reporting to be poor.

Machinery-of-government changes

In December 2014, the state government initiated MOG changes which impacted the 2014–15 financial year.

The implementation and governance of the MOG changes were guided by a steering committee at both DHHS and DEDJTR, and overseen by a task force established by the Department of Premier & Cabinet. The steering committees had terms of reference and clear reporting lines, set milestones and reported regularly to senior management and the secretaries.

Despite this, there have been implementation delays at both departments.

Neither DHHS nor DEDJTR conducted a true post-implementation review. Both departments have therefore missed the opportunity to learn from what worked well and to identify areas for improvement.

During our review, we identified that there was no MOG implementation framework to guide Victorian public sector entities. Such frameworks exist in other jurisdictions and they formed the better-practice elements for our review. While we were preparing this report, DTF released a Victorian public sector operating manual on machinery-of-government changes which had been collaboratively prepared by the portfolio departments' chief finance officers and finance deputy secretaries. This is a good initiative that should guide the implementation of any future changes.

Recommendations

1. We recommend that portfolio departments address internal control issues in a timely manner, with emphasis on those risks rated medium and above (see Part 2).

2. We recommend that the Department of Education & Training introduce systems and processes that automate transactions to reduce the volume of cash transactions at schools (see Part 3).

Responses to recommendations

We have consulted with named portfolio departments and agencies, and we considered their views when reaching our audit conclusions. As required by section 16(3) of the Audit Act 1994, we gave a draft copy of this report to those agencies and asked for their submissions or comments.

The following is a summary of those responses. The full responses are included in Appendix A.

The Secretary of DET outlined the considerable work the department has done on its property, plant and equipment balances, and also on new assurance approaches for school transactions and balances. She is very pleased with the removal of the property, plant and equipment qualification for 30 June 2015 and the clear opinion on all 30 June 2016 balances. The secretary also commits to continue reviewing and improving DET's financial management and reporting.

The Secretary of DTF noted the findings and accepted the recommendation to address internal control issues on a timely basis.

Our audits

The financial audits of the 214 entities included in this report were undertaken under section 15 of the Audit Act 1994 and Australian Auditing Standards. The cost of these audits is paid for by each entity. The results of these audits were used in preparing this report. The cost of preparing this report was $205 000, which is funded by Parliament.

2.1 Audit opinions on financial reports

Independent audit opinions provide reasonable assurance that the information reported in financial statements is reliable and accurate. An unmodified audit opinion confirms that the financial statements fairly present the transactions and balances for the reporting period, in accordance with the requirements of applicable Australian Accounting Standards and any applicable legislation—such as the Financial Management Act 1994 or the Corporations Act 2001.

We issued unmodified audit opinions on 199 financial reports finalised for 2015–16. At the time we prepared this report, we have yet to finish 13 audits.

2.1.1 Modified audit opinions

We issue modified audit opinions when we conclude that the financial report includes a material misstatement or where we cannot get sufficient audit evidence, or the right audit evidence, to conclude that the financial report has no material misstatements.

We provided a clear audit opinion on the financial performance and position of the Department of Education & Training (DET) and the Department of Treasury & Finance (DTF) at 30 June 2016. However, we included a modified opinion on the 2014–15 comparative disclosures for DET relating to school transactions and for DTF relating to East West Link project funds.

We explain our reasons for modifying the DTF audit opinion in the Auditor‑General's Report on the Annual Financial Report of the State of Victoria, 2015–16.

In Part 3 of this report, we discuss further our reasons for modifying the DET audit opinion.

2.1.2 Emphasis of matter

Without qualifying a financial report, we may include an emphasis of matter (EOM) paragraph that highlights a particular aspect of the report that we consider fundamental to understanding how the report was prepared. For example, we will note when a financial report has been prepared using a special‑purpose framework to meet specific users' information needs rather than general users' needs.

In 2015–16, we issued 26 audit opinions on special-purpose financial reports for entities within the scope of this report. Our EOM paragraphs drew attention to the special-purpose framework adopted in preparing these financial reports.

A further seven audit opinions contained an EOM for other reasons, detailed in Figure 2A.

Figure 2A

Audit opinions issued with an EOM paragraph

Source: VAGO.

2.2 Internal control in portfolio departments

Internal controls at the seven portfolio departments, to the extent that we reviewed them as part of our financial audits, continue to be reasonable for maintaining the reliability of external financial reporting.

Nevertheless, we reported a number of control weaknesses to departmental audit committees and secretaries during the course of our 2015–16 audits.

In 2015–16, we identified and reported 52 internal control issues at portfolio departments rated as high or medium risk. Figure 2B shows these issues by area and risk rating, excluding issues rated as low risk. The definition for each risk rating is detailed in Appendix C.

Figure 2B

Reported issues by area and risk rating in 2015–16

Note: This figure excludes low-risk issues.

Source: VAGO.

2.2.1 Information systems controls

We continue to raise high-risk information technology (IT) issues in the areas of management and oversight of outsourced IT functions, password management, disaster recovery and business continuity planning. Our Financial Systems Controls Report: 2015–16 tabled in parliament in November 2016, discusses in detail a number of these IT issues.

Given that portfolio departments rely on the effective functioning of IT systems, these internal control weaknesses increase the risk of fraud and financial statement errors occurring and not being detected.

2.2.2 Accuracy controls

A number of portfolio departments had deficiencies in both asset management and reconciliations prepared to support the numbers in the financial report. We observed that reconciliations are neither timely nor accurate at some portfolio departments, and the review of general journals processed is not always adequate. Both these issues can mean that inaccurate information or errors are not identified and resolved before the preparation of the financial report.

2.2.3 Status of prior-period control issues

We monitor the status of internal control issues reported in prior years, to track whether the control weaknesses we identify have been addressed. Figure 2C illustrates that management teams within the portfolio departments have resolved 57 per cent of all issues raised. This is a small improvement on last year, which indicates that portfolio departments have paid some attention to addressing the issues we raised.

Resolving these internal control deficiencies in a timely way minimises risks related to erroneous or fraudulent transactions in the financial statements.

Figure 2C

Prior periods internal control deficiencies—resolution status by risk

Note: This figure excludes low-risk issues.

Source: VAGO.

Portfolio departments have resolved all extreme issues reported in prior years or they have taken sufficient action to downgrade the risk at the conclusion of the 30 June 2016 financial audits.

2.3 Alpine resorts

In 2013–14, we identified and reported a number of concerning deficiencies in the monitoring, oversight and accountability of finances at Lake Mountain, Mount Baw Baw and Falls Creek alpine resorts. All three resorts had outsourced their finance function in that year but had failed to implement robust oversight and monitoring of this outsourced function.

Figure 2D summarises the significant issues common to these three alpine resorts.

Figure 2D

Issues reported during the 2013–14 audits of the alpine resorts

Source: VAGO.

Our 2014–15 financial audits identified significant improvements at Lake Mountain and Mount Baw Baw, where issues we raised have now been addressed.

Falls Creek is in the process of resolving the issues we reported. In particular, this resort has decided to take its finance function back from an outsourced provider, and it is putting in place the systems and controls to make this change from 2017.

3.1 Conclusion

DET has worked systematically to address audit concerns and the issues that led to modifications in previous audit opinions. It has improved record-keeping and internal controls. DET has better financial management and governance practices, but it can still make further improvements.

3.2 Audit opinion for 30 June 2016

We issued our audit opinion on 29 September 2016. We were able to give a clear opinion on the transactions and balances as at 30 June 2016.

In this year's opinion, we retained the modification for the 2014–15 comparative balances for schools transactions, but we were satisfied that the comparatives for property, plant and equipment were fairly stated.

During 2015–16, DET strengthened its approach to assurance about schools transactions and balances. However, it was not practical for DET to retrospectively carry out additional assurance work on the 2014–15 school transactions that are used for comparison in the current financial report.

3.2.1 School transactions and balances

DET's financial report consolidates the transactions and balances of 1 544 state government schools which, taken together, are material to DET's financial report.

Schools maintain their own financial records using a common software system from which DET extracts data for the financial report. DET's challenge in this large, devolved system is obtaining sufficient assurance that schools' financial information is complete and accurate.

During 2015–16, DET introduced four assurance activities for school transactions and balances:

• a data analytics tool that compares and contrasts individual school revenue and expense transactions to identify outliers, which DET can then investigate
• audit testing at schools based on a predetermined audit program aimed at assurance gaps that the data analytics tool could not address
• a set of internal audit reviews targeting audit testing at areas and schools considered to be higher risk of not having adequate financial management oversight
• attestations made by all school principals about the compliance, controls, completeness, accuracy and cut-off applied to school transactions and balances.

DET designed its assurance activities, when taken together, to provide it with sufficient and appropriate evidence. We concluded this year that we could rely on most of the components of school's balances, apart from the completeness of school revenue. Evidence that school revenue was complete was neither sufficient nor appropriate.

Schools continue to be paid in cash by some parents for things such as uniforms, before- and after-school care, excursions, camps, supplies, levies and canteens–21 per cent of school receipts are cash.

DET's evidence indicate that schools lack adequate controls over cash-based revenue transactions, and school auditors could not verify that schools recorded all their revenue. The nature of these transactions is such that no audit testing can be done to gain assurance because the lack of controls means that there is no document trail to audit. This inherent risk with cash-based transactions is difficult to overcome.

Despite these problems, we concluded that it is unlikely that any cash-based revenue that is not recorded or is misappropriated would be material to DET's statements.

3.2.2 Property, plant and equipment

Since 2012–13, we have identified and reported to DET significant weaknesses in its records and method of recording property, plant and equipment. The compounding effect of DET not addressing these issues meant that, at 30 June 2015, the asset register was not a reliable record.

During 2015–16, DET has worked to address all matters we raised and has acted on all our recommendations. Specifically, DET has:

• fully revalued all land and buildings, and completely and accurately updated the asset register
• reconciled property, plant and equipment movements and largely substantiated each movement with supporting evidence and schedules
• worked through each component of work-in-progress and cleared out erroneous transactions
• reviewed the transactions expensed as repairs and maintenance to identify those that should be capitalised
• revised asset policies and corrected the accounting treatment of assets held for sale.

As a result of this work, as reported in Note 1U of its financial statements, DET made the following adjustments:

• a decrease of $4.2 million in intangible assets
• a decrease of $99.4 million in property, plant and equipment
• an increase of $61.8 million in accumulated surplus
• a decrease of $165.4 million in the asset revaluation reserve.

DET had a complete and accurate asset register to support the 30 June 2016 financial report. The evidence available in 2015–16 allowed us to conclude that the numbers reported for 30 June 2015 also were not materially misstated. This is a significant achievement and we commend DET on its substantial actions.

In Note 1U of DET's 30 June 2016 financial statements, DET concludes that it was neither practical nor reasonable to restate previous years' financial report amounts because:

• of the large volume of property, plant and equipment transactions
• the problems continued over many years
• of a lack of supporting documents and evidence.

We agree with this assessment and support DET's focus on having the right systems and processes in place so that the register will remain complete and accurate in the future.

3.3 Addressing audit recommendations

After issuing a disclaimer of audit opinion, we wrote a detailed final management letter to DET at the end of the 2014–15 financial audit. That letter listed 17 issues that we rated as being of extreme, high or medium risk. We included recommendations that suggested ways for DET to resolve each problem. Figure 3A includes a summary of these problems in the financial reporting categories.

Figure 3A

Issues in DET's management letter, 2014–15

Source: VAGO.

During the 2015–16 reporting cycle, DET has carried out a project to systematically address all of the 17 management letter points. A steering committee oversaw this project. DET's Portfolio Audit and Risk Committee has monitored the project's progress closely.

Of the 17 issues from 2015–16:

• eight have now been resolved and closed
• two remain open but action has been taken and the issue is expected to be resolved within the next 12 months
• five remain open and require DET's attention.

For a further two, we will assess DET's progress as part of our 2016–17 audit.

This shows that DET is serious in addressing longstanding problems that we raised.

3.4 Financial reporting

We reported to Parliament that the financial reporting processes at DET were poor in 2013–14 and 2014–15. The reporting process for 2015–16 was much better, and we no longer consider DET's financial reporting to be poor.

In 2015–16, we received timely financial statements that were supported by schedules and evidence. DET confirmed the quality of the financial information before giving it to us. This improved the timing and the outcome for the 2015–16 financial audit and financial report.

4.1 Conclusion

Both DHHS and DEDJTR were able to implement MOG changes, and they are working toward achieving further efficiencies.

The changes were implemented without a Victorian government framework in place. Since then, one has been developed and it should guide future change.

4.2 Machinery-of-government change management

Large-scale MOG changes can have widespread impacts. They can impact staff and control frameworks, potentially increasing the risk of erroneous transactions, internal control breakdowns, loss of corporate knowledge and fraud. Therefore, strong controls and change processes should be in place to make sure that agencies can implement MOG changes effectively and efficiently.

In 2014–15, there was no framework to guide MOG changes in Victoria. The Australian Public Service Commission (APSC) had issued a framework—Implementing Machinery of Government Changes—and the Queensland Government and United Kingdom's Cabinet had developed similar documents, including specific checklists and better-practice guides, to assist entities in implementing change.

Figure 4A outlines the key elements of a MOG implementation framework, drawing from the APSC, Queensland and United Kingdom guides. We used these better‑practice elements to assess the implementation of MOG changes at DHHS and DEDJTR.

Figure 4A

Key elements of an effective MOG implementation framework

Source: Australian Public Service Commission, Implementing Machinery of Government Changes(2013); UK Cabinet Office, Machinery of Government Guidance (2015); Queensland Audit Office, Managing Machinery of Government Changes (2015); State Services Authority, 'Appendix: Machinery of Government Changes' in Serving as secretary: a guide for public sector leaders, (2012); VAGO.

In May 2016, a committee made up of eight members of the Parliament of Victoria tabled a report, Inquiry into machinery of government changes. This report looked at the cost and effectiveness of MOG changes, and recommended that guidelines be developed to enable clear and consistent reporting of the costs and benefits of MOG changes. We have not duplicated this work in our report.

The Department of Treasury & Finance released a copy of the Victorian public sector operating manual on machinery‑of-government changes, which was prepared by the portfolio departments' chief finance officers and finance deputy secretaries in collaboration.

4.3 Pre-implementation and governance

As part of the implementation and coordination of the 2014 MOG changes, the Department of Premier & Cabinet established a whole-of-government task force. The task force members were senior representatives from the affected portfolio departments who acted as the central point of contact and coordinated the resolution of issues on behalf of their respective portfolio departments.

The purpose of the task force was to:

• oversee the MOG changes and ensure consistent implementation among the portfolio departments and continuity of business and service delivery
• arbitrate any unresolved issues to an agreed outcome
• communicate a clear and consistent message across the Victorian public sector.

In addition to having representatives on the whole-of-government taskforce, both DHHS and DEDJTR established their own steering committees to oversee and take responsibility for implementing MOG changes.

Both departments established clear reporting lines and decision-making authority and documented these in the steering committee terms of reference.

The steering committees were led by departmental deputy secretaries and supported by various subcommittees which focused on identifying implementation issues and making the changes. All subcommittees kept an action log and produced status reports so that the steering committees could monitor progress.

The steering committees had milestones and key deliverables. They considered the risks of not achieving these milestones and put in place mitigation plans where required.

Figure 4B outlines the structure of the steering committees and subcommittees.

Figure 4B

DHHS and DEDJTR steering and subcommittee structure

Note: IM&T = information management and technology; PMO = project management office.

Source: VAGO.

We reviewed the project status reports of both the Establishment Steering Committee and Transition Steering Group. Neither report demonstrated that the groups had reported progress, milestones and achievements to the relevant ministers.

The subcommittees of DHHS and DEDJTR did not have minutes of all meetings held. This made it difficult for us to see the complete trail of decisions and actions. The absence of minutes for all meetings means the records are not complete and not all information is available for post-implementation evaluations.

Source:

4.4 Implementation

To implement the MOG changes, both DHHS and DEDJTR completed project plans that looked at structure, workforce, governance and accommodation.

DHHS undertook a structural review that assessed divisions, duplicate positions, optimal placement of staff and outcomes. Leading on from this review, each director was responsible for implementing restructures within their teams by mapping full-time equivalent staff numbers with business and divisional requirements. All changes were endorsed by the responsible deputy secretary.

DHHS engaged a consultant to review the former Department of Health and Department of Human Services' financial delegations and DHHS's draft delegations against best-practice principles and the practices used in other Victorian portfolio departments. The review examined the actual expenditure patterns of the two former departments to determine business needs, and the results were used as a basis for the new delegations model.

Similarly, DEDJTR engaged a consultant to review its capabilities and functions, and to develop proposed organisational structures for the new department. The consultant reviewed the existing staffing profile and analysed the organisation and functions. This identified potential to integrate functions such as programs, grants, financial management, information technology and human resources. Recommendations from the report were made to the secretary and presented to the executive board.

4.4.1 Implementation delays

While the plans for the steering committee and subcommittees included review and standardisation of delegations and policies, we found that duplicate financial policies existed at both DHHS and DEDJTR, which may mean that staff are using inconsistent practices, policies and processes.

DEDJTR is currently operating two separate general ledgers, with integration not expected to occur until July 2017. This increases the time, cost, complexity and risk for producing accurate and complete financial information. DEDJTR is also currently operating under a number of separate IT systems and processes.

Amalgamating the systems used by the former Department of Health and Department of Human Services for managing service agreements did not occur until mid-2016. As a consequence, manual amalgamation and reconciliation of information was required, increasing the risk of errors.

DHHS did not complete and endorse a consolidated strategic risk profile until May 2016. As a result, the new department did not have a shared understanding of risk for the first 18 months of operation.

4.5 Communication

Ensuring adequate communication to staff about MOG changes and implementation processes increases staff engagement and confidence. This in turn helps to develop a transparent culture within the new department.

Departmental secretaries and deputy secretaries at DHHS and DEDJTR kept staff informed throughout the MOG implementation process. They also encouraged staff participation and input, by emailing detailed information on governance, structure and procedural progress. Both DHHS and DEDJTR updated staff on MOG changes through staff bulletins, intranet pages, and team and divisional briefings.

DEDJTR created a MOG transition information section on its intranet as a communication tool. This section included organisational change reports, projects for business and strategic transition planning, time lines, frequently asked questions and answers, and impacts of the transition to the new structure.

DHHS established a MOG communication plan that outlined the communication approach, target audiences and key staff messages. As part of this communication plan, it produced a question-and-answer fact sheet and regular establishment updates for staff, outlining key information about the new department and general information about staff impacts and changes to processes and procedures.

Staff at DHHS were invited to be involved in the MOG change process through a focus group called 'Creating our culture together'. The aim of these sessions was to promote staff discussion and involvement in setting the new department values.

4.6 Post-implementation

A post-implementation review should be the final action of a MOG steering committee, to ensure that all required change has been made and to document any key lessons for the next time a significant change program occurs.

DHHS and DEDJTR have not conducted any formal post-implementation evaluations specifically about the MOG change process.

DHHS completed an Establishment Project Closure report that outlined the project governance, including responsibilities, the structure and members of the steering and working groups, the key projects that had been delivered, and any outstanding project activities passed into business units for completion. It also had a final project status report.

DEDJTR undertook an internal audit on its internal control framework in May 2016. The results of the report recommended that DEDJTR adopt a uniform approach for its financial systems, processes and procedures.