Portfolio Departments and Associated Entities: Results of the 2010–11 Audits

Background

The Victorian public sector includes 11 portfolio departments and 201 associated entities through which the government delivers its policy objectives, services and public infrastructure. This report covers the outcomes and observations from the external financial audit of these 212 entities.

Each portfolio department and associated entity is required to prepare a financial report to inform Parliament and the community about the level of public resources and assets it holds and manages.

Financial reports should be a reliable and timely source of information for assessing the financial management and health of entities at a point in time. Financial reports should also be underpinned by systems, processes and internal controls that assure an entity of the completeness, accuracy and appropriateness of its transactions and balances.

The external audit of portfolio departments and their associated entities provides an opportunity to compare and analyse the quality of preparation of their financial reports. Our financial audits also include cyclical reviews over areas of internal controls. The common findings from these reviews are included in this report.

Conclusion

At the date of preparation of this report, audit opinions had been issued for all 11 portfolio departments and 183 of the 201 associated entities. All opinions issued were clear.

For the 46 self-funded entities, the most significant challenge facing their financial sustainability is self‑financing. Twenty-three generated insufficient cash from operations to fund new assets and asset renewals, and a further 13 were at risk.

Most of the self-funded entities are governed by a board or trustees accountable for managing and operating significant public sector assets. However, the community nature of these assets can restrict the ability of the entities’ boards and trustees to increase revenue, limiting their oversight to controlling expenditure. Notwithstanding this, the accountability of the boards and trustees is not limited.

Findings

Recommendations

1. That the Department of Treasury and Finance work with agencies to address accountability obligations when statutory responsibilities for governance and the funding models are not aligned.
2. That portfolio departments prepare and approve leave management plans for all staff with excess annual leave, and actively manage compliance with those plans.
3. That portfolio departments report to senior management periodically on sick leave data, including patterns and trends against internal and public sector benchmarks to enable the timely identification of problems, and development of action plans to mitigate risks to staff wellbeing, or underlying issues in the workplace escalating.
4. That portfolio departments reinforce the importance of conflicts of interests declarations by all staff undertaking grants assessments.
5. That the Departments of Justice, Primary Industries, and Sustainability and Environment leverage the experience and expertise of other portfolio departments to examine the costs and benefits of a consolidated grants management system.
6. That CenITex have its change management policy, and process and procedures guide approved and adopted by senior management.
7. That portfolio departments develop, approve and implement change management policies and procedures for all financial applications.
8. That portfolio departments develop comprehensive policies and procedures over information technology system security which are approved by the secretary and subject to regular review.
9. That portfolio departments develop an information security classification policy that outlines criteria for assigning security classifications to information and the required security controls for each classification.
10. That portfolio departments develop, approve and implement disaster recovery policies and procedures for all financial applications.

Submissions and comments received

In addition to progressive engagement during the course of the audit, in accordance with section 16(3) of the Audit Act 1994 a copy of this report, or relevant extracts from the report, was provided to all portfolio departments and named agencies with a request for submissions or comments.

The agency views have been considered in reaching our audit conclusions and are represented to the extent relevant and warranted in preparing this report. Their full section 16(3) submissions and comments, however, are included in Appendix E.

1.1 Scope

This report covers 11 portfolio departments and 201 associated entities with 30 June 2011 balance dates. These entities report under a range of legislation, the most common being, the Financial Management Act 1994 (FMA) and the Corporations Act 2001. Figure 1A shows the number of entities per portfolio and related legislative reporting framework.

Figure 1A

Entities by portfolio and legislative reporting framework

Source: Victorian Auditor-General's Office.

Figure 1A shows the total number of entities subject to audit grew by a net three in 2010–11. A list of all changes is provided in Figure 1B.

Figure 1B

Changes to audited entities

Source: Victorian Auditor-General's Office.

1.2 Reporting framework

Financial statements are required to be prepared in accordance with Australian Accounting Standards, including the Australian Accounting Interpretations, and legislated reporting frameworks. Under the FMA, the Minister for Finance has the authority to issue directions in relation to finance administration and reporting issues.

The FMA requires annual reports to be submitted to the relevant minister, and tabled in Parliament within four months of the end of the financial year. These reports should include financial reports for the entity and any controlled entities, and are required to be prepared and audited within 12 weeks of the end of the financial year.

The entities reporting under the Corporations Act 2001 are required to report to their members within four months of the end of the financial year.

A summary of the FMA and Corporations Act 2001 reporting time frames is provided in Figure 1C.

Figure 1C

Legislated financial reporting time frames

The Premier issued a circular on 18 May 2011 that required all public sector entities to table their annual reports in Parliament on or before 15 September 2011. This shortened the timeframe available for preparing and auditing financial statements.

1.3 Internal controls

Effective internal controls help portfolio departments and associated entities reliably and cost-effectively meet their objectives. Internal controls underpin the reliable, accurate and timely delivery of external and internal reports.

Senior management of an entity is responsible for developing and maintaining adequate systems of internal control to enable:

• preparation of accurate financial records and other information
• timely and reliable external and internal reporting
• appropriate safeguarding of assets
• prevention or detection of errors and other irregularities.

The FMA requires management to implement an effective internal control structure. In establishing effective controls, it should adopt a control framework that has:

• comprehensive policies
• effective management practices
• sound governance and oversight.

In our annual financial audits, we focus on the internal controls relating to financial reporting and assess whether portfolio departments and associated entities have managed the risk that their financial statements will not be complete and accurate. Poor controls diminish management's ability to achieve strategic objectives and to comply with relevant legislation. They also increase the risk of fraud. Any internal control weaknesses identified during our audits are reported to an entity's management and audit committee.

In addition to reviewing general internal controls, a cyclical approach to reviewing internal controls relating to significant annual financial report balances and disclosures, consistent with Australian Auditing Standards, is adopted at portfolio departments.

This report includes the results of cyclical reviews of management of employment leave, grants administration, information technology change management and security.

1.4 Audit conduct

The audits were undertaken in accordance with Australian Auditing Standards.

The total cost of preparing and printing this report was $185 000.

1.5 Structure of this report

This report provides an overview of the results from the 2010–11 financial report audits and the review of targeted internal control areas in portfolio departments and associated entities. The structure of this report is set out in Figure 1D.

Figure 1D

Report structure

Source: Victorian Auditor-General's Office.

2.1 Introduction

This Part covers the results from the audits of the 11 portfolio departments and 183 associated entities that had finalised their financial reports at the date this report was prepared, for the 2010–11 reporting period.

Quality financial reporting is achieved when reports are reliable, timely and accurate.

2.2 Conclusion

Portfolio departments are commended on the quality of financial reporting achieved in 2010–11. The financial reports were generally prepared earlier than in 2009–10 with improved reliability and accuracy reflected in minimal material adjustments required by audit and no qualified audit opinions issued.

2.3 Reliability

2.3.1 Audit opinions

At the date of preparation of this report, 194 audit opinions on financial reports had been issued, all with clear opinions. Audit opinions for 18 entities had not been issued.

Independent audit opinions add credibility to financial reports by providing assurance that the information is reliable. A clear audit opinion confirms that the financial report has been prepared according to the requirements of relevant accounting standards and legislation.

A qualified audit opinion means that the financial report is materially different to the requirements of the relevant reporting framework, and therefore, is less reliable and useful as an accountability document.

No qualified audit opinions were issued in the 2010–11 financial year (one in 2009–10).

Emphasis of matter

Sometimes an auditor draws a reader's attention to a matter or disclosure in the financial statements that provides important context. This is not a qualification and is known as an emphasis of matter.

Figure 2A lists the five entities where the 2010–11 auditor's report contained an emphasis of matter.

Figure 2A

Opinions with emphasis of matter paragraphs for 2010–11

Source: Victorian Auditor-General's Office.

2.4 Timeliness

Recognising the important role that financial reports play in the accountability of the use of public monies, entities should prepare and publish timely financial information. The later the reports are produced and published after year end, the less useful they are for timely decision-making.

The legislated time frame for a portfolio department to finalise its audited financial report is within 12 weeks of the end of the financial year. All portfolio departments except the Department of Treasury and Finance achieved the legislative time frame in 2010–11.

Figure 2B presents, in percentile bands, the time taken for portfolio departments to finalise their audited financial reports after year end.

Figure 2B

Time taken by portfolio departments to finalise financial reports

Source: Victorian Auditor-General's Office.

On average, the time taken by portfolio departments to finalise their financial reports was consistent from 2009–10 to 2010–11. There was improvement in reporting time frames with 50 per cent of portfolio departments reporting one week earlier, finalising their financial reports within seven weeks of year end.

2.5 Accuracy

The frequency and size of errors in the draft financial statements presented to audit that require adjustment are direct measures of accuracy. Ideally, there should be no errors or adjustments required by the auditors.

Overall there are two types of adjustments:

• financial balance adjustments—changes to the balances being reported
• disclosure adjustments—changes to the commentary of financial note disclosure within the financial statements.

The small number of adjustments to both financial balances and disclosures required in 2010–11 indicates that portfolio departments are improving their financial report preparation processes. The stability of the reporting environment, with no significant new accounting standards being introduced during the 2010–11 financial year, assisted this result.

In 2010–11, there was one material financial balance adjustment to the net result reported in the draft financial statements of portfolio departments. The material adjustment was for the Department of Treasury and Finance and related to the recognition of a grant received from the Commonwealth as revenue in 2010–11.

There were three significant disclosure errors that required adjustment in the 2010–11 draft financial statements of portfolio departments. These related to the disclosure of commitments in the financial statements of the Departments of Primary Industry and Sustainability and the Environment.

3.1 Introduction

In this Part we provide insight into the financial sustainability of the 46 self-funded entities that primarily generate their own revenue, rather than relying on government funding. This assessment excludes entities where an audit opinion had not been issued on their financial statements at the date of the preparation of this report.

The 11 portfolio departments and 152 associated entities are excluded from the assessment of financial sustainability as they are predominantly Budget-funded or have developed, and already separately report on, sustainability indicators.

The objective of self-funded entities should be to generate a sufficient surplus from operations to meet financial obligations, fund asset replacement and new asset acquisitions. The ability of self-funded entities to do this depends largely on their expenditure management and revenue maximisation practices. This is reflected in the composition and rate of change of their operating revenue and expenses.

3.2 Financial sustainability

By analysing four core financial sustainability indicators over a five-year period, we provide insight into the financial sustainability of self-funded entities. The indicators are: underlying result, liquidity, self-financing and capital replacement, and they reflect each entity's funding and expenditure policies, and indicate whether the policies are sustainable.

Financial sustainability should be viewed from both a short- and long-term perspective. The short-term indicators, in this case, the underlying result and liquidity indicators, measure the entity's ability to maintain a positive operating cash flow and adequate cash holdings, and to generate an operating surplus over time.

The long-term indicators, that is, the self-financing and capital replacement indicators, signify whether adequate funding is available for spending on asset replacement to maintain the quality of service delivery, and to help meet community expectations and the demand for services.

Appendix C describes the sustainability indicators and risk assessment criteria we use in this report.

3.3 Financial sustainability risk assessment results

The five-year average financial sustainability results for the 46 entities that are self‑funded are shown by portfolio in Figure 3A.

Figure 3A

Five-year average financial sustainability risk assessments—self-funded entities at 30 June 2011

Legend: Red = high risk; Amber = medium risk; Green = low risk.

Source: Victorian Auditor-General's Office.

The results indicate that self-financing was the most significant challenge facing the entities. Self-financing measures an entity's ability to replace its assets using cash generated from operations. Twenty-three entities had generated insufficient cash from operations to fund new assets and asset renewal. A further 13 were at risk of this.

The nature and purpose of the self-funded entities is to deliver services to the public and communities. However, the assets they control do not always produce a revenue stream large enough to cover both the cost of the entity's operations and the maintenance of the assets. Where no funds are available for major asset maintenance, the condition of the assets may deteriorate and effect the entity's ability to continue operating or to generate revenue. This increases reliance on the state to provide funding for maintenance and new assets.

3.4 Accountability for financial management

Most of the 36 entities rated high or medium risk for self-financing are governed by a board or trustees responsible and accountable for managing and operating the business. The community purpose of the entities can restrict the ability of the boards and trustees to increase revenue, and limit their oversight to controlling expenditure. Notwithstanding this, the accountability of the boards and trustees is not limited.

To demonstrate the self-financing challenges and associated financial risks a case study on the State Sports Centre Trust (SSCT) is presented in Figure 3B.

Figure 3B

Case study: State Sports Centre Trust

Source: Victorian Auditor-General's Office.

Recommendation

1. That the Department of Treasury and Finance work with agencies to address accountability obligations when statutory responsibilities for governance and the funding models are not aligned.

4.1 Introduction

Salaries and related costs are the biggest recurrent expenditure items for portfolio departments, totalling $12 389 million and representing 32 per cent of spending in 2010–11 (32 per cent in 2009–10).

At 30 June 2011, portfolio departments employed 24 730 full time equivalent (FTE) staff and had employee leave liabilities of $1 790.5 million ($1 768.6 million in 2009–10). This represented 26 per cent of total liabilities of portfolio departments.

Under the Victorian Public Service Agreement 2006 (VPS agreement) employees, other than casual employees, are entitled to four weeks recreation leave each year. Unless otherwise agreed, the maximum balance an employee may carry forward is 40 days.

Employees, other than casual employees, are also entitled to three weeks paid sick leave each year. Unused sick leave can be accumulated for use in subsequent years, however, the entitlements lapse on resignation or retirement.

Given the quantum of employee costs and related liabilities, portfolio departments need to monitor and effectively manage the financial impacts of these costs, the contributing factors, and the health and wellbeing of their employees.

Effectively managing leave at operational and strategic levels requires policies designed to reduce the accumulation of excess leave and practices that operate to mitigate the risks, thereby avoiding:

• adverse occupational health and safety outcomes
• adverse impacts on employee productivity and opportunities to take leave
• additional financial costs of accumulating excess recreation leave to be paid at higher rates
• the risk that fraud may remain undetected if employees work extended periods without leave.

4.2 Conclusion

Overall, leave management policies and practices were found to be adequate. Notwithstanding, a range of deficiencies in leave reporting systems, management and oversight arrangements remain to be addressed at portfolio departments.

4.3 Leave balances at 30 June

4.3.1 Recreation leave

Figure 4A shows the total number of employees with recreation leave balances in excess of 40 days at 30 June for each of the past four years, and the average days in excess of that amount per FTE for each portfolio department.

Figure 4A

Excess recreation leave balances at 30 June

(a) The Human Services portfolio was split in August 2009 when the Health portfolio was created. Data for the Health portfolio for 2007–08 and 2008–09 is included in the data for the Human Services portfolio.

Source: Victorian Auditor-General's Office.

The number of employees with excess recreation leave increased from 2007–08 to 2010–11. However, the increase was relative to the increase in FTEs across the portfolio departments in the same period. When the number of staff with excessive recreation leave is taken as a percentage of FTEs, there was little movement over the period with 5 per cent of staff with excessive balances in 2010–11 compared to 4.9 per cent in 2007–08.

The Departments of Human Services (DHS) and Primary Industries (DPI) had higher numbers of staff with excessive recreation leave relative to total FTE employees at 30 June 2011. DHS had 298 staff with excessive recreation leave, 8.2 per cent of its total FTEs of 3 633. DPI had 162 staff with excessive recreation leave, 6.8 per cent of its total FTEs of 2 395. Both departments were above the average for portfolio departments of 5 per cent.

Conversely, the Departments of Planning and Community Development and Premier and Cabinet had relatively small percentages of staff with excessive recreation leave compared to FTEs, being 2 per cent and 3.2 per cent respectfully as at 30 June 2011.

The increasing number of Department of Justice (DOJ) staff with excess leave is an unfavourable trend. Over the past four financial years its number of staff with excessive leave has grown, in particular between 2009–10 and 2010–11 when there was a 56 per cent increase.

4.3.2 Sick leave

Figure 4B shows the average sick leave days taken per FTE portfolio department employee in the past four years.

Figure 4B

Average sick leave days taken per full-time equivalent employee

(a) The Human Services portfolio was split in August 2009 when the Health portfolio was created. Data for the Health portfolio for 2007–08 and 2008–09 is included in the data for the Human Services portfolio.

Source: Victorian Auditor-General's Office.

The average number of sick leave days taken increased over the past four years. Notwithstanding, an average of 7.89 sick leave days taken (7.31 in 2009–10) was comparable to public service sick leave in New South Wales (8.1 in 2009–10) and Queensland (7.3 in 2009–10).

Staff at DOJ and the Department of Transport (DOT) took more sick leave than the average in 2010–11, with DOJ staff taking 1.5 days (18.5 per cent) and DOT staff taking 2.4 days (30 per cent) more than the average. By our calculations, the higher incidence of sick leave costs DOJ and DOT an extra $4.2 million and $1.1 million per year, respectively.

There was a trend of increasing sick leave taken at the Departments of Planning and Community Development, Sustainability and Environment, and Transport across the four years. The trend needs to be investigated and an approach adopted to manage the leave and the contributing factors.

4.4 Leave management framework

An effective leave management framework enables entities to identify workplace absences and their possible causes, and improve their capacity to implement better practice strategies to address problems. Drawing on the Australian Public Service Commission's 2006 better practice guidelines Fostering an Attendance Culture: A guide for APS agencies, Figure 4C outlines the key elements of an effective leave management framework.

Figure 4C

Key elements of an effective leave management framework

Source: Victorian Auditor-General's Office based on Fostering an Attendance Culture: A guide for APS agencies.

We assessed the leave management framework of the 11 portfolio departments against the elements outlined in Figure 4C.

4.5 Policies

Comprehensive leave management policies assist management to communicate responsibilities, entitlements, and their expectations regarding leave to staff. An effective leave management policy clearly articulates the principles, processes and procedures that apply to all leave, and aligns operations with the strategic activities of portfolio departments.

All 11 portfolio departments had leave management policies approved by their secretary or delegate. The content was generally based on the principles outlined in Figure 4C. However, policies could be strengthened by including:

• details of those specifically accountable for leave management
• requirements for reporting on leave to the secretary.

Leave management policies detailed the responsibility of employees and direct supervisors. However, they consistently did not address:

• the responsibility of senior management to oversight systemic excess recreation leave balances or sick leave absences
• the content and frequency of reporting to senior management.

4.6 Management practices

Practices that encourage compliance with leave management provisions of the VPS agreement include:

• clearly communicating leave entitlements and associated expectations to staff
• direct line managers monitoring and authorising individual employee leave
• training for staff processing leave applications.

Recreation leave

Management at portfolio departments should regularly monitor and assess whether target recreation leave balances are achieved, and review the need for remedial action in light of actual outcomes and trends identified. This enables unfavourable leave outcomes or deficiencies in policies and practices to be addressed in a timely manner.

Business unit managers and/or senior management at all portfolio departments received monthly or quarterly reports monitoring recreation leave balances.

Across the 11 portfolio departments, we reviewed the documented and approved leave management plans for 55 employees with excess recreation leave. Only 21 of the 55 had approved leave management plans.

Instances of excess recreation leave could be further reduced with widespread development of leave plans for employees with excess leave balances, and active management of compliance with them.

Sick leave

Effectively managing sick leave reduces departmental costs associated with avoidable absences, including reduced productivity and the need to engage temporary staff. Senior management should review the adequacy of leave management procedures, assess compliance with relevant internal policies, and monitor leave trends.

Regular leave reports assist senior management in identifying areas of concern, and enable the implementation of appropriate remedial action. Sick leave can be reduced if management:

• monitors sick leave and is responsive to changing trends across the entity
• demonstrates a commitment to staff health and wellbeing
• deals with difficult issues relating to sick leave as they arise, to mitigate the risks that issues escalate to more significant problems.

All portfolio departments use electronic leave management systems to record and process leave applications and approvals, however, there were notable differences in the processes to analyse and report to management. Four portfolio departments did not regularly report to management on sick leave absenteeism, trends or patterns.

Benchmarking sick leave information against reliable and comparable statistics provides an objective reference point for management to establish targets and monitor performance and trends. Benchmarking can also be used to assess whether trends are within 'normal' parameters.

The State Services Authority produces an annual analysis of the public sector workforce, including leave information, which can be used by portfolio departments as an external reference point. The current average for sick days taken is 8.1 days per FTE employee across the whole public sector, compared to 7.89 days at portfolio departments.

Internal benchmarks can also assist management to identify changing patterns and the need for timely intervention strategies.

Of the seven portfolio departments that report sick leave information to management, five reported against a relevant benchmark. Better practice was observed at the Departments of Health and Human Services, where quarterly management reports provided sick leave data by business unit, benchmarked against internally established targets and prior year information.

4.7 Governance and oversight

Senior management should periodically review leave management policies and procedures to determine whether they accurately reflect the operational direction and strategic position of the entity, and to enable areas of emerging concern to be proactively addressed. Reviews should confirm whether policies and procedures are up-to-date following changes in legislative or operational requirements. They also enable business improvements to be identified, for example, more effective reporting procedures or enhanced use of computer software.

All portfolio departments had current leave management policies, reviewed periodically, and updated when required. Management practices and processes were also reviewed in conjunction with policies, however, there was no documentary evidence confirming this.

Recommendations

2. That portfolio departments prepare and approve leave management plans for all staff with excess annual leave, and actively manage compliance with those plans.
3. That portfolio departments report to senior management periodically on sick leave data, including patterns and trends against internal and public sector benchmarks to enable the timely identification of problems, and development of action plans to mitigate risks to staff wellbeing, or underlying issues in the workplace escalating.

5.1 Introduction

Government grants are provided to organisations or individuals to support or contribute to the achievement of government policy outcomes.

In 2010–11, the general government sector made grant payments totalling $8 547 million ($9 175 million in 2009–10) to entities not included within the Victorian state government.

Given the financial significance of grants expenditure, and as part of a cyclical review of controls, we reviewed the management controls and processes over grants administration at portfolio departments. The focus was on grant funding allocated to applicants through a competitive process, and where the final allocation of money was at the discretion of the portfolio department.

The Departments of Health, Human Services, Transport, Treasury and Finance did not distribute discretionary funding during 2010–11 and were therefore not included in the review.

5.2 Conclusion

Overall, grants administration policies and practices were adequate. However, there are opportunities to improve grants program planning, reporting, management and oversight across the portfolio departments.

5.3 Grants management framework

Comprehensive grants management frameworks support the delivery of effective grants programs, conducted in an ethical and transparent manner, that provide value‑for-money. Figure 5A outlines the key elements of an effective grants management framework.

Figure 5A

Key elements of an effective grants management framework

Source: Victorian Auditor-General's Office.

5.4 Policies

The Financial Management Act 1994 (FMA) requires portfolio departments to have a policy for the management of discretionary benefits (grants). The elements expected to be in a grants management policy are outlined in Figure 5A.

The policies of the seven portfolio departments that provided discretionary funding were assessed against the criteria outlined in Figure 5A.

Four had comprehensive policies consistent with good practice. Three did not have an overarching grants management policy but had documented general principles and procedures that referred to better practice guidelines.

5.5 Management practices

We reviewed management practices for 14 programs across the seven portfolio departments to determine if they were sufficiently rigorous and transparent, and whether the basis of decisions to award grants was sound. Our assessments were made against the good practice criteria outlined in Figure 5A.

One successful and one unsuccessful applicant from each of the 14 programs were reviewed.

For nine of the 14 programs examined, good practice was evident at all stages of the grant approval process. In particular:

• uniform selection criteria were developed and evaluation processes specified
• conflict of interests declarations were completed by those involved in the selection process
• uniform selection criteria were used to assess both applicants and decisions were adequately documented
• financial viability of the submissions was assessed
• funding agreements were established and signed by both parties
• individuals involved in the selection process were segregated from those approving funding agreements
• performance measures to assess the effectiveness of the funded activity were documented, and communicated to the successful applicant.

However, deficiencies were noted in the assessment and approval processes in five of the 14 programs reviewed, including:

• conflict of interests disclosures were not made by members of the evaluation panel of four programs
• the financial viability of one applicant was not assessed.

The management of risks associated with conflict of interests is fundamental to the integrity of the grants management process. Failure to manage actual, potential or perceived conflicts of interests gives rise to risks of:

• non-compliance with legal requirements
• misconduct, abuse of office or corruption, which can result in inaccurate financial information being disclosed in financial reports
• reputational damage.

A grant applicant's financial viability should be assessed to provide assurance that project outcomes are likely to be delivered, the project will be sustainable and value‑for‑money achieved.

5.6 Governance and oversight

A sound and well implemented governance and accountability framework for grants management is important for assuring programs meet government needs. Throughout the life cycle of a grants program, the outcomes achieved should be evaluated against project-specific and program-related objectives. Performance measures to assess effectiveness should be determined during program planning.

Performance measures were established for most grants programs examined. However, they were not documented for two of the 14 programs.

Four of the seven portfolio departments maintained systems which consolidated details of their grants programs. These portfolio departments provided periodic reports to their secretary or senior management to enable monitoring of key deliverables and grants program outcomes.

The Departments of Justice, Primary Industries, and Sustainability and Environment did not have consolidated grants management systems. They operate stand-alone databases, limiting timely access to consolidated information. As a result, these portfolio departments may have limited access to timely and comprehensive reporting.

Integral to the successful delivery of a grants program, is the routine monitoring of individual grants to make sure agreed milestones or other key requirements of funding agreements are met.

Payment processes at the seven portfolio departments were reviewed to determine if milestones or other key requirements of funding agreements had been satisfied before payments were made. For all of the grant programs reviewed, there was evidence that milestones or other key requirements had been met before all payments were made.

Recommendations

4. That portfolio departments reinforce the importance of conflicts of interests declarations by all staff undertaking grants assessments.
5. That the Departments of Justice, Primary Industries, and Sustainability and Environment leverage the experience and expertise of other portfolio departments to examine the costs and benefits of a consolidated grants management system.

6.1 Introduction

Information technology (IT) hardware and software are critical to the effective operation of portfolio departments and underpin the delivery of government services and policy outcomes. IT also plays a pivotal role in the production of reliable, accurate and timely external and internal financial reports.

All portfolio departments except the Department of Education and Early Childhood Development have outsourced their IT hardware and operating environments, that is, the people, policies and procedures that support the management of their IT hardware, to CenITex. CenITex is the government's IT shared services agency.

Shared Business Systems (SBS), a division of the Department of Primary Industries, provides business services to the Departments of Planning and Community Development, Primary Industries, and Sustainability and Environment. SBS manages and maintains the Oracle financial applications supporting the preparation of financial reports for these portfolio departments.

The remaining eight portfolio departments operate and manage their own financial applications.

To gain comfort over the effectiveness of IT controls relied upon in the preparation of departmental financial statements, we assessed hardware and software controls at CenITex, SBS and the 11 portfolio departments during our financial statement audits.

We also reviewed controls relating to IT change management and IT security. The results of our review of controls in the two areas of focus are provided in this Part.

6.2 Information technology change management

IT hardware and software require periodic maintenance, upgrade and replacement to enable continued achievement of service levels, to address emerging risks, or to drive continuous improvement.

Every change to IT needs to be managed in a systematic and controlled manner to mitigate the risk of unauthorised change, damage to systems and data resulting from insufficient user testing of proposed changes before implementation, and incorrect change implementation. Change management is the process by which changes are planned, applied, tested, accepted, dispersed, and tracked.

The Financial Management Act 1994 (FMA) requires portfolio departments to implement IT change management controls for their financial systems. IT change management controls should provide comfort over the integrity and reliability of financial systems and data during any change process.

Given the adverse impact which unauthorised or incorrectly implemented changes can have on the functionality, usability and security of financial systems, we reviewed the management controls and processes supporting IT changes at CenITex, SBS and portfolio departments.

6.2.1 Conclusion

Overall, we identified weaknesses in IT change management at portfolio departments. Written IT change management policies did not exist or were not up-to-date at five portfolio departments, and were in draft at CenITex. Despite the lack of written and approved change management policies, we found that CenITex, SBS and the portfolio departments, had sound management practices in place to process changes to their IT systems.

6.2.2 Information technology change management framework

The key elements of an effective IT change management framework are detailed in Figure 6A.

Figure 6A

Key elements of an effective IT change management framework

Source: Victorian Auditor-General's Office.

We assessed the information technology change management framework of CenITex, SBS and the 11 portfolio departments against the elements outlined in Figure 6A.

6.2.3 Policies

IT change management policies assist agencies to reliably plan, authorise and test changes to their IT software and hardware, before implementation. Policies also provide criteria for assessing the success of introduced changes.

Policies should set out the procedures to be followed for any changes to software or hardware, and be approved by senior management.

The findings from our assessments of policies are provided in Figure 6B.

Figure 6B

Assessment of IT change management policies at CenITex, Shared Business Systems and portfolio departments

Source: Victorian Auditor-General's Office.

6.2.4 Management practices

Changes to IT software and hardware need to be managed throughout their life cycle and integrated into the production environment in a rational, systematic and controlled manner.

The findings from our assessments of management practices over IT change management are presented in Figure 6C.

Figure 6C

Assessment of IT change management practices at CenITex, Shared Business Systems and portfolio departments

Source: Victorian Auditor-General's Office.

6.2.5 Governance and oversight

Policies and procedures should be regularly reviewed and updated to remain relevant. Consistent processes should be followed for each change, and compliance against policies and procedures should be continually monitored throughout the lifecycle of the change. Strong governance and oversight controls were observed at CenITex, SBS and portfolio departments. The results of our examinations are presented in Figure 6D.

Figure 6D

IT change management governance and oversight controls at CenITex, Shared Business Systems and portfolio departments

Source: Victorian Auditor-General's Office.

6.3 Information technology security

Effective IT system security protects computer applications and infrastructure from threats, in order to promote business continuity, minimise business risk, and reduce the risk of fraud and error.

The information held by portfolio departments can be highly sensitive, and therefore needs to be protected from unauthorised access, theft or manipulation. Inadequate IT security can result in:

• unauthorised access to systems and the information they store
• privacy breaches
• loss of critical business information
• an increase in the risk of material misstatement of financial statements
• disruptions to the delivery of portfolio department outputs
• increased potential for fraud
• damage to reputation.

Given the adverse impact unauthorised access to sensitive information may have, we reviewed the management controls and processes supporting IT security at CenITex, SBS and portfolio departments.

6.3.1 Conclusion

There is adequate management, governance and oversight of IT security at most portfolio departments in relation to financial statement systems. IT security policies need to be tailored for, and consider the risks unique to, each portfolio department.

6.3.2 Information technology security framework

IT security controls are classified into two categories:

• general controls—controls surrounding the environment in which the computer systems operate
• application controls—fully automated controls within the IT system designed to assure completeness and accuracy of processed information.

The key elements of an effective IT security framework are detailed in Figure 6E. The framework draws on the:

• Department of Treasury and Finance's Whole of Victorian Government Information Security Management Framework
• Standing Directions of the Minister for Finance under the Financial Management Act 1994
• International Standard Organisation's ISO27001:2006 Specifications for Information Security Management
• Information Systems and Control Association's best practice guidelines.

Figure 6E

Key elements of an effective information technology security framework

Source: Victorian Auditor-General's Office.

We assessed the information technology security framework of CenITex, SBS and the 11 portfolio departments against the key elements.

6.3.3 Policies

Portfolio departments process, store and communicate huge volumes of information in electronic format. Effective IT security controls mitigate the risks that information will be inappropriately released and that information will be incomplete, unreliable or inaccurate. IT systems should be supported by security policies and procedures that control user access, and monitor and report compliance with these policies and procedures.

The findings from our assessments of policies are provided in Figure 6F.

Figure 6F

IT Assessment of IT security policies at CenITex, Shared Business Systems and portfolio departments

Source: Victorian Auditor-General's Office.

6.3.4 Management practices

Training

For IT security policies and procedures to be effective, it is essential that employees receive adequate training in them. This allows policies and procedures to be applied correctly and consistently and can assist management to highlight to staff areas of greatest concern.

Eight portfolio departments recognised the importance of IT security, and the need for regular awareness training. Procedures at these portfolio departments included:

• IT security awareness training provided as part of the induction program for new employees, contractors and third parties
• the existence of a staff awareness strategy
• documented policies, procedures and guidance available to all staff on the intranet
• periodic training reinforcing the importance of IT security.

The remaining three portfolio departments did not have an effective IT security training program to communicate requirements to employees, contractors and third parties.

Monitoring of physical and logical access controls

Physical controls such as physical security barriers at entrances, locking an office at night, storing servers in data centres, and keeping laptop computers in locked cupboards when not being used protect against unauthorised access to IT hardware and operating environments. Physical access controls at CenITex and portfolio departments were adequate.

Logical access controls restrict access to electronic information through methods of identification, authorisation and accountability in computer systems, such as through the use of passwords. They limit access to operating systems to employees with the appropriate authorisation.

Overall, logical access controls at SBS and portfolio departments were adequate. Nevertheless, logical access controls could be strengthened. The commonly identified areas that required improvement were:

• password length, expiry and complexity were not enforced and passwords were not locked out after a specified number of unsuccessful logon attempts
• security activities not adequately logged and monitored
• user access rights not periodically reviewed to determine if rights were commensurate with employee responsibilities
• generic user identification accounts that did not have individual employees assigned to them were being used.

We reported the control weaknesses observed to departmental secretaries and audit committees.

Backup and recovery procedures

To protect important and sensitive information, entities should have appropriate backup and recovery procedures. The procedures should be tested regularly to confirm they are working as intended. It is a requirement of the FMA that portfolio departments maintain up-to-date backups for all financial management systems and data being used.

CenITex, SBS and portfolio departments operated adequate controls to backup information. However, CenITex and five portfolio departments did not have documented plans and procedures detailing how financial information would be recovered in the event that a disaster critically interrupted financial systems.

Management of IT risks

The FMA requires portfolio departments to conduct an assessment of information technology risks and their impact on financial management, and to have this reviewed at least annually. In addition, all public sector agencies are required to identify and manage their risks within the Victorian Government Risk Management Framework.

A risk assessment should identify possible security threats to key information, and enable the development of mitigating controls based on the probability of the risk occurring, the likely impact, and the risk appetite of the entity.

Nine portfolio departments identified, documented and monitored IT risks, including security risks, in a risk register. The remaining two portfolio departments had not identified, and were not monitoring, IT related risks.

6.3.5 Governance and oversight

Portfolio departments should have a sound governance framework over IT security. The establishment of an IT steering committee and IT security committee assists portfolio departments to identify, monitor and manage IT security risks.

The IT steering committee should provide advice to senior management on the IT strategic direction and initiatives of the portfolio department, and guidance on the provision of IT services.

The IT security committee should assist the IT steering committee and senior management to enforce information security governance of departmental information assets. It should set security policies, evaluate and communicate new threats and reduce the risk of intrusion, loss of data integrity and compliance violations.

Ten portfolio departments had established IT steering and IT security committees. Their IT security committees generally monitored and managed compliance with departmental IT security policies and procedures. One portfolio department had also established a specific IT compliance team that perform annual security compliance reviews of IT applications and services.

The Department of Transport's IT steering and IT security committees are currently inactive, leaving a gap in the governance and oversight of security in that department. These committees are scheduled to be reformed in November 2011.

Recommendations

1. That CenITex have its change management policy, and process and procedures guide approved and adopted by senior management.
2. That portfolio departments develop, approve and implement change management policies and procedures for all financial applications.
3. That portfolio departments develop comprehensive policies and procedures over information technology system security which are approved by the secretary and subject to regular review.
4. That portfolio departments develop an information security classification policy that outlines criteria for assigning security classifications to information and the required security controls for each classification.
5. That portfolio departments develop, approve and implement disaster recovery policies and procedures for all financial applications.