Managing Public Sector Records: Message
Ordered to be published
VICTORIAN GOVERNMENT PRINTER MARCH 2017
PP No 249, Session 2014–17
Managing Public Sector Records
Body
This audit examined whether selected agencies manage public records according to legislative requirements, and whether the Department of Premier and Cabinet and the Public Record Office Victoria are effectively assisting them to do this.
Appendix F. Recent key changes to the public sector
This Appendix provides information about recent major changes within the public sector in relation to information technology (IT).
Appendix E. IT controls maturity by sector
This Appendix shows our maturity assessment scores by information technology (IT) general controls category for the selected 38 entities by sector. The overall maturity assessment score is derived by averaging the aggregated maturity scores of the entities, as listed in Appendix C.
Appendix D. Rating definitions
Ratings for audit findings reflect our assessment of both the likelihood and consequence of each identified issue in terms of its impact on:
- the effectiveness and efficiency of operations, including probity, propriety and compliance with applicable laws
- the reliability, accuracy and timeliness of financial reporting.
The ratings also assist management to prioritise remedial action.
Figure D1
Rating definitions and management action
Appendix C. Scope and coverage
This Appendix contains a list of the entities included in the scope of this report and shows which entities were included in focus area surveys (covering wireless security and the Australian Signals Directorate Top 4 Strategies to Mitigate Targeted Cyber Intrusions) and information technology (IT) control maturity assessments.
Figure C1
Entities selected for this financial systems controls report
Entities |
|---|
Appendix B. Audit method
Why this report is important
This audit aggregates our information technology (IT) audit findings covering policies, procedures and activities put in place by an entity to ensure the confidentiality, integrity and availability of its IT systems and data. This report also provides decision-makers with information and insights to help them address IT audit findings, improve processes and controls, and enhance accountability across the public sector.
Appendix A. Audit Act 1994 section 16—submissions and comments
We consulted the Department of Premier & Cabinet and the members of the Chief Information Officers Leadership Group while preparing this report and we have considered their views when forming our findings and drawing our audit conclusions.
As required by section 16(3) of the Audit Act 1994, we provided a copy of this report, or relevant extracts, to the Department of Premier & Cabinet, portfolio departments, the Commissioner for Privacy and Data Protection, and CenITex, and requested their submissions or comments.
4 ASD Top 4 Strategies
The Australian Signals Directorate (ASD) has developed a list of 35 strategies to mitigate targeted cyber intrusions. The list is based on ASD's experience in operational cyber security, including responding to serious cyber incidents and performing vulnerability assessments and penetration testing for Australian government agencies.
3 Wireless security
Wireless networks use radio waves to transmit data to wireless-enabled devices such as laptops, tablets and phones. This wireless technology enables users and systems to remotely access organisational data and resources without being physically connected to a cable in an office. Wireless security aims to prevent unauthorised access to systems using wireless networks.