Local Government Briefingfor Audit, Risk and Improvement Committee Chairs

20 April 2018

AgendaWelcome by the Deputy Auditor-General

Financial Audit report to Parliament

Discussion and comment

BREAK 11.15am

ICAC focus on Local Government

Information Technology risks and focus areas

Performance Audit reports to Parliament

Closing by the Auditor-General

LUNCH 12.30pm

DeputyAuditor-GeneralIan Goodwin

Welcome

Financial Audit Report to ParliamentSteven Martin, Assistant Auditor-General

Council data visualisation

Context for our insights

• Each council has unique characteristics such as size, location, range of services

• A ‘one size fits all approach’ may not be appropriate• Audits process may not detect everything • Internal control environment, risk management procedures

and governance structures may need to differ.

Council spending on services by function

Quality of financial reporting• Modified audit opinions in 2016-17 for three councils• Modified audit opinions in 2015-16 for one council and one

water authority• One emphasis of matter in the unmodified audit opinion • Unmodified opinions for the remaining councils, however• 33 material prior period errors across 22 councils• 39 significant matters in 29 councils.

Quality of financial reporting

0 2 4 6 8 10 12 14 16

Other

Accounting for assets notcontrolled by councils

First time recognition of assets

Valuation methodology for communityland and land under roads did not consider

restrictions on the use of these assets

Number of prior period errors

Material prior period errors identified across the 2016–17 financial audits

Quality of financial reporting

0 2 4 6 8 10 12

Other

Incorrect revenue recognition

Internal control deficiencies

Asset accounting issues

Valuation of communityland and land under roads

Valuation of infrastructure,property, plant and equipment

Number of significant matters

Significant matters reported across the 2016–17 financial audits

Quality of financial reporting

• The financial statements close process can improve• Our report includes better practice guidance• ARIC’s role in reviewing financial statements• OLG needs to release key guidance earlier in the year.

Timeliness of financial reporting

01020304050607080

Num

ber o

f cou

ncils

Week ending

Timeliness of financial reports lodgement with OLG

Number of councils

Early close proceduresComplete infrastructure, property plant and equipment valuations

Prepare proforma financial statements and associated disclosures

Prepare variance analysis and meaningful explanations for movements in financial balances

Perform key account reconciliations

Assess the impact of material, complex and one-off significant transactions

Resolved prior year audit issues

Assess the impact of new and revised accounting standards

Review of financial statements and processes

Financial performance and sustainability

Operating revenue measures

0

10

20

30

40

50

60

Metropolitan Regional Rural County

Num

ber o

f cou

ncils

Operating performance

Councils did not meet benchmark Councils met benchmark

0

10

20

30

40

50

60

Metropolitan Regional Rural County

Num

ber o

f cou

ncils

Own source operating revenue

Councils did not meet benchmark Councils met benchmark

Revenue and expenses

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

Metropolitan Regional Rural County

% o

f rev

enue

Sources of council revenue

Rates and annual charges User charges and fees

Grants and contributions Other revenue

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

Metropolitan Regional Rural County

% o

f exp

ense

s

Categories of council expenses

Employee benefits Materials and contractsDepreciation and amortisation Other expensesBorrowing costs

Liquidity and working capital measures

Liquidity and working capital measures• All but three councils met the unrestricted current ratio• All but two councils met the debt service cover ratio.

Asset management measures• Asset indicators question whether councils’ spend enough on

renewing and maintaining infrastructure assets• Seventy councils do not meet OLG’s buildings and infrastructure

renewals ratio benchmark• Eighty-four councils do not meet OLG’s infrastructure backlog

ratio benchmark• Seventy-one councils do not meet OLG’s asset maintenance

ratio benchmark• Councils may need to review their asset management plans.

Asset management

Asset management findings

High-risk issues related to:• accuracy of asset registers• restricted assets• asset valuations.

Land assets overstated by $12.1 billion

Councils with no asset management strategy, policy and plan

Asset useful lives

Unrecorded assets

Governance and internal controls

7

1

4

5

10

9

89

70

100

97

153

201

58

55

23

28

55

42

0 50 100 150 200 250

Financial accounting

Payroll

Governance

Purchases and payables

Asset practices

Information technology

Governance and internal control deficiencies reported in management letters

High risk (36) Moderate risk (710) Low risk (261)

Audit committees and internal audit

Other governance matters • Missing or out of date policies and procedures • No legislative compliance framework, policy or register• Opportunities to improve risk management• Council entities.

Discussion, comment,questions

BREAK

Independent Commission Against Corruption (ICAC)

Information Technology –risks and focus areas

IT findings

• Nine high risk issues reported• Findings in two broad areas:

• access to IT systems• IT governance

• Increased risk of fraud and error.

User access controls Effective user access control involves the

following good practice:

Clear policies and procedures.

Formal approval to establish and modify user accounts.

Removal of access when no longer required

Regular review of user access

Password parameters in line with good practice

Clear records of user access

Audits found 107 issues across 56 councils

Staff with access beyond their role requirements

Privileged access controls• Ability to change key system configurations• Wide access to system data, files and accounts• Audits found 86 issues across 64 councils:

• staff and third-party contractors with unmonitored access • no logging and/or review of highly privileged access• sharing of highly privileged user accounts.

User developed applications• Computing applications, tools and processes developed or

managed outside IT administration• There are reasons why these tools are used• Mitigating controls• Audits found:

• councils using spreadsheets without appropriate controls• councils where non-IT staff could modify financial

databases.

IT governance• Audits found:

• councils without an IT strategy and IT operational plan

• councils without an adequate IT security policy

• councils without adequate back up, disaster recovery and business continuity arrangements.

Performance Audit

Our first three performance audits in local governmentThree Topics

• Fraud controlDue for public release in May 2018

• Shared services

Due for public release in June 2018

Reporting on service delivery

Key Findings• Need greater emphasis on reporting

efficiency and effectiveness of services • Report performance over time• Use targets related to service objectives • IP&R Framework could be improved to

support better reporting• Consolidating council reporting to state

agencies would support better reporting.

Reporting on service delivery

Recommendations

OLG should, by mid-2018:• issue additional guidance on good practice in reporting• clearer integration of all reports required by the IP&R Framework• consolidate reporting by councils to state agencies• work with rural councils to develop their reporting capability• define reporting terms to encourage consistency• develop a Performance Management Framework to deliver sector

wide reporting.

Performance audits recently releasedof interest to councils

Performance audit program 2018-19Performance audits underway• Risk management culture and capability• Grants to non-government schools• Regional Assistance Programs• Property asset utilisation • Ausgrid: Unsolicited proposal to acquire 50.4% interest in Ausgrid• Health Roster Benefits Realisation

Performance audit program 2018-19Performance audits underway• Regulation of Waste and Water• Assessing Progress of Premier’s and State Priorities (including

Premier’s Implementation Unit)• Newcastle Urban Transformation and Transport Program• Antisocial behaviour in social housing

Performance audit program 2018-19Performance audits underway• Matching Skills training with market need• Planning for New and Revitalised Communities• Mobile Speed Cameras.

Currently developing our audit program for 2019-20 and 2020-21.

Auditor-GeneralMargaret Crawford

Closing

Better practice and other resourcesAudit Office Better Practice Guides- covering procurement , contract management, governance, fraud control and risk management.https://www.audit.nsw.gov.au/publications/better-practice-guides

Treasury Policies and guidance• TC18-02 NSW Fraud and Corruption Control Policy• TPP17-06 Certifying the effectiveness of internal controls over financial information• TPP 15-03 Internal Audit and Risk Management Policy for NSW Public Sector• TPP 12-03 variance toolkits for risk management

https://www.treasury.nsw.gov.au/documents-resources/documents-library

Better practice and other resourcesLocal Government Victoria Audit Committee Good Practice Guidehttps://www.localgovernment.vic.gov.au/__data/assets/pdf_file/0021/84081/Audit_Committees_Guidelines-A-guide-to-good-practive-for-local-government.pdf