4 Internal controls at public hospitals

At a glance

Background

This Part presents the results of our assessment of general internal controls, risk management and controls over private patient revenue at public hospitals.

Findings

Some rural hospitals put at risk the accuracy of financial reporting and increase their exposure to fraud because of inadequate controls over key account reconciliations and changes to masterfiles.

3 Financial sustainability

At a glance

Background

To be financially sustainable, entities need to be able to meet current and future expenditure as it falls due. They also need to absorb foreseeable changes and risks without significantly changing their revenue and expenditure policies.

This Part provides an insight into the financial sustainability of the 87 public hospitals based on an analysis of the trends in their key financial indicators over the past five years.

1 Background

1.1 Introduction

Public hospitals provide a range of services across metropolitan, regional and rural areas. Metropolitan and regional public hospitals typically provide acute health services, as well as a mix of mental health, subacute, community health and aged care services. Rural public hospitals generally offer a higher proportion of aged care and community health services.

Audit summary

The Victorian public hospital sector consists of 112 entities—comprising 87 public hospitals and 25 associated entities. The 112 entities provide a range of public health services across metropolitan, regional and rural Victoria.

Appendix A. Audit Act 1994 section 16—submissions and comments

Introduction

In accordance with section 16(3) of the Audit Act 1994, a copy of this report was provided to the named departments and agencies with a request for submissions or comments.

The submissions and comments provided are not subject to audit nor the evidentiary standards required to reach an audit conclusion. Responsibility for the accuracy, fairness and balance of those comments rests solely with the agency head.

Responses were received as follows:

4 Agency compliance with policy, standards and process requirements

At a glance

Background

Each of the 20 inner Whole‑of‑Victorian‑Government (WoVG) agencies is required to develop its own information security management framework (ISMF), providing its agency with appropriate policy direction and guidance. There is no requirement for outer WoVG agencies to conform to any specified standard for their own agency ISMF.

3 Oversight and coordination of information security threats

At a glance

Background

The Department of State Development, Business and Innovation (DSDBI) receives cyber alerts from Australian Government agencies and distributes them to relevant Victorian agencies.

Agencies are responsible for registering their internet protocol (IP) addresses with the regional registrar. The Australian Signals Directorate and other agencies use this registry to identify operators of networks facing a potential cyber threat.