Independent assurance report to Parliament

Ordered to be published

VICTORIAN GOVERNMENT PRINTER May 2019

PP No 29, Session 2018–19

We have consulted with DTF, DHHS, DJCS, and DPC and we considered their views when reaching our audit conclusions. As required by section 16(3) of the Audit Act 1994, we gave a draft copy of this report to those agencies and asked for their submissions and comments.

Responsibility for the accuracy, fairness and balance of those comments rests solely with the agency head.

Responses were received as follows:

• DPC
• DTF
• DHHS
• DJCS

RESPONSE provided by the Secretary, DPC

The government implements security measures to manage physical security risks and threats. All staff contribute to the effectiveness of these measures and play a role in security management. Security measures are most effective when staff promote a strong security culture.

Security measures should be commensurate with the level of risk. Common physical security measures implemented in Victorian Government office accommodation include:

Security culture and governance underpin effective security management. Without a strong security culture, security measures and controls are vulnerable to human error. Even the best access control system will fail if staff are careless with their access cards or lend them to others. A consistent security culture across government requires strong leadership, an enforceable accountability framework and a principle-based policy.

Government agencies face a real and credible threat to their physical security and the safety of their client-facing staff. Unauthorised access to government buildings could cause significant disruption to public sector services while antisocial behaviour from government clients puts staff health and safety at risk.

Security threats are an everyday risk to government agencies.

The risk comes from individuals or groups who, for a variety of reasons—some malicious—will seek to threaten staff, attack systems and processes, or damage or steal property. Unauthorised access to government buildings could put staff health and safety at risk and cause significant disruption to public sector services.

Acronyms

Figure D1
AMAF and standing directions requirements for audit committees on reviewing compliance and attestation

Figure C1 provides examples of good practices and weaknesses we observed across departments in the content of their whole-of-department asset management plans.

Figure C1
Good practices and common weaknesses in whole-of-department asset management plans