Browse our range of reports and publications including performance and financial statement audit reports, assurance review reports, information reports and annual reports.
Currently showing reports relevant to the Education and Employment Senate estimates committee. [Remove filter]
Type: Performance statements audit
Report number: 25 of 2024-25
Portfolios: Across entities
Entities: Across entities
Date tabled:
Audit Summary : show
Executive summary
1. Performance information is important for public sector accountability and transparency as it shows how taxpayers’ money has been spent and what this spending has achieved. The development and use of performance information is integral to an entity’s strategic planning, budgeting, monitoring and evaluation processes.
2. Annual performance statements are expected to present a clear, balanced and meaningful account of how well an entity has performed against the expectations it set out in its corporate plan. They are an important way of showing the Parliament and the public how effectively Commonwealth entities have used public resources to achieve desired outcomes.
The needs of the Parliament
3. Section 5 of the Public Governance, Performance and Accountability Act 2013 (PGPA Act) sets out the objects of the Act, which include requiring Commonwealth entities to provide meaningful performance information to the Parliament and the public. The Replacement Explanatory Memorandum to the PGPA Bill 2013 stated that ‘The Parliament needs performance information that shows it how Commonwealth entities are performing.’1 The PGPA Act and the Public Governance, Performance and Accountability Rule 2014 (PGPA Rule) outline requirements for the quality of performance information, and for performance monitoring, evaluation and reporting.
4. The Parliament’s Joint Committee of Public Accounts and Audit (JCPAA) has a particular focus on improving the reporting of performance by entities. In September 2023, the JCPAA tabled its Report 499, Inquiry into the Annual Performance Statements 2021–22, stating:
As the old saying goes, ‘what is measured matters’, and how agencies assess and report on their performance impacts quite directly on what they value and do for the public. Performance reporting is also a key requirement of government entities to provide transparency and accountability to Parliament and the public.2
5. Without effective performance reporting, there is a risk that trust and confidence in government could be lost (see paragraphs 1.3 to 1.6).
Entities need meaningful performance information
6. Having access to performance information enables entities to understand what is working and what needs improvement, to make evidence-based decisions and promote better use of public resources. Meaningful performance information and reporting is essential to good management and the effective stewardship of public resources.
7. It is in the public interest for an entity to provide appropriate and meaningful information on the actual results it achieved and the impact of the programs and services it has delivered. Ultimately, performance information helps a Commonwealth entity to demonstrate accountability and transparency for its performance and achievements against its purposes and intended results (see paragraphs 1.7 to 1.13).
The 2023–24 performance statements audit program
8. In 2023–24, the ANAO conducted audits of annual performance statements of 14 Commonwealth entities. This is an increase from 10 entities audited in 2022–23.
9. Commonwealth entities continue to improve their strategic planning and performance reporting. There was general improvement across each of the five categories the ANAO considers when assessing the performance reporting maturity of entities: leadership and culture; governance; reporting and records; data and systems; and capability.
10. The ANAO’s performance statements audit program demonstrates that mandatory annual performance statements audits encourage entities to invest in the processes, systems and capability needed to develop, monitor and report high quality performance information (see paragraphs 1.18 to 1.27).
Audit conclusions and additional matters
11. Overall, the results from the 2023–24 performance statements audits are mixed. Nine of the 14 auditees received an auditor’s report with an unmodified conclusion.3 Five received a modified audit conclusion identifying material areas where users could not rely on the performance statements, but the effect was not pervasive to the performance statements as a whole.
12. The two broad reasons behind the modified audit conclusions were:
- completeness of performance information — the performance statements were not complete and did not present a full, balanced and accurate picture of the entity’s performance as important information had been omitted; and
- insufficient evidence — the ANAO was unable to obtain enough appropriate evidence to form a reasonable basis for the audit conclusion on the entity’s performance statements.
13. Where appropriate, an auditor’s report may separately include an Emphasis of Matter paragraph. An Emphasis of Matter paragraph draws a reader’s attention to a matter in the performance statements that, in the auditor’s judgement, is important for readers to consider when interpreting the performance statements. Eight of the 14 auditees received an auditor’s report containing an Emphasis of Matter paragraph. An Emphasis of Matter paragraph does not modify the auditor’s conclusion (see Appendix 1).
Audit findings
14. A total of 66 findings were reported to entities at the end of the final phase of the 2023–24 performance statements audits. These comprised 23 significant, 23 moderate and 20 minor findings.
15. The significant and moderate findings fall under five themes:
- Accuracy and reliability — entities could not provide appropriate evidence that the reported information is reliable, accurate and free from bias.
- Usefulness — performance measures were not relevant, clear, reliable or aligned to the entity’s purposes or key activities. Consequently, they may not present meaningful insights into the entity’s performance or form a basis to support entity decision making.
- Preparation — entity preparation processes and practices for performance statements were not effective, including timeliness, record keeping and availability of supporting documentation.
- Completeness — performance statements did not present a full, balanced and accurate picture of the entity’s performance, including all relevant data and contextual information.
- Data — inadequate assurance over the completeness, integrity and accuracy of data, reflecting a lack of controls over how data is managed across the data lifecycle, from data collection through to reporting.
16. These themes are generated from the ANAO’s analysis of the 2023–24 audit findings, and no theme is necessarily more significant than another (see paragraphs 2.12 to 2.17).
Measuring and assessing performance
17. The PGPA Rule requires entities to specify targets for each performance measure where it is reasonably practicable to set a target.4 Clear, measurable targets make it easier to track progress towards expected results and provide a benchmark for measuring and assessing performance.
18. Overall, the 14 entities audited in 2023–24 reported against 385 performance targets in their annual performance statements. Entities reported that 237 targets were achieved/met5, 24 were substantially achieved/met, 24 were partially achieved/met and 82 were not achieved/met.6 Eighteen performance targets had no definitive result.7
19. Assessing entity performance involves more than simply reporting how many performance targets were achieved. An entity’s performance analysis and narrative is important to properly inform stakeholder conclusions about the entity’s performance (see paragraphs 2.37 to 2.44).
Connection to broader government policy initiatives
20. Performance statements audits touch many government policies and frameworks designed to enhance government efficiency, effectiveness and impact, and strengthen accountability and transparency. This is consistent with the drive to improve coherence across the Commonwealth Government’s legislative and policy frameworks that led to the PGPA Act being established.8 The relationship between performance statements audits and existing government policies and frameworks is illustrated in Figure S.1.
Figure S.1. Relationship of performance statements audits to government policies and frameworks
Source: ANAO analysis.
The future direction of annual performance statements audits
21. Public expectations and attitudes about public services are changing.9 Citizens not only want to be informed, but also to have a say between elections about choices affecting their community10 and be involved in the decision-making process, characterised by, among other things, citizen-centric and place-based approaches that involve citizens and communities in policy design and implementation.11 There is increasing pressure on Commonwealth entities from the Parliament and citizens demanding more responsible and accountable spending of public revenues and improved transparency in the reporting of results and outcomes.
22. A specific challenge for the ANAO is to ensure that performance statements audits influence entities to embrace performance reporting and shift away from a compliance approach with a focus on complying with minimum reporting requirements or meeting the minimum standard they think will satisfy the auditor.12 A compliance approach misses the opportunity to use performance information to learn from experience and improve the delivery of government policies, programs and services.
23. Performance statements audits reflect that for many entities there is not a clear link between internal business plans and the entity’s corporate plan. There can be a misalignment between the information used for day-to-day management and governance of an entity and performance information presented in annual performance statements. Periodic monitoring of performance measures is also not an embedded practice in all Commonwealth entities. These observations indicate that some entities are reporting measures in their performance statements that may not represent the highest value metrics for running the business or for measuring and assessing the entity’s performance (see paragraphs 4.32 to 4.35).
Developments in the ANAO’s audit approach
24. Working with audited entities, the ANAO has progressively sought to strengthen sector understanding of the Commonwealth Performance Framework. This includes a focus on helping entities to apply general principles and guidance to their own circumstances and how entities can make incremental improvements to their performance reporting over time. For example:
- in 2021–22, the ANAO gave prominence to ensuring entities understood and complied with the technical requirements of the PGPA Act and the PGPA Rule;
- in 2022–23, there was an increased focus on supporting entities to establish materiality policies that help determine which performance information is significant enough to be reported in performance statements and to develop entity-wide performance frameworks; and
- in 2023–24, there was an increased focus on assessing the completeness of entity purposes, key activities and performance measures and whether the performance statements present fairly the performance of the entity (see paragraphs 4.36 to 4.38).
Appropriate and meaningful
25. For annual performance statements to achieve the objects of the PGPA Act, they must present performance information that is appropriate (accountable, reliable and aligned with an entity’s purposes and key activities) and meaningful (providing useful insights and analysis of results). They also need to be accessible (readily available and understandable).
26. For the 2024–25 audit program and beyond, the ANAO will continue to encourage Commonwealth entities to not only focus on technical matters (like selecting measures of output, efficiency and effectiveness and presenting numbers and data), but on how to best tell their performance story. This could include analysis and narrative in annual performance statements that explains the ‘why’ and ‘how’ behind the reported results and providing future plans and initiatives aligned to meeting expectations set out in the corporate plan.13
27. It is difficult to demonstrate effective stewardship of public resources without good performance information and reporting. Appropriate and meaningful performance information can show that the entity is thinking beyond the short-term. It can show that the entity is committed to long-term responsible use and management of public resources and effectively achieving results to create long lasting impacts for citizens (see paragraphs 4.39 to 4.45).
Linking financial and performance information
28. The ‘Independent Review into the operation of the PGPA Act’14 noted that there would be merit in better linking performance and financial results, so that there is a clear line of sight between an entity’s strategies and performance and its financial results.15
29. Improving links between financial and non-financial performance information is necessary for measuring and assessing public sector productivity. As a minimum, entities need to understand both the efficiency and effectiveness of how taxpayers’ funds are used if they are to deliver sustainable, value-for-money programs and services. There is currently limited reporting by entities of efficiency (inputs over outputs) and even less reporting of both efficiency and effectiveness for individual key activities.
30. Where entities can demonstrate that more is produced to the same or better quality using fewer resources, this reflects improved productivity.
31. The ANAO will seek to work with the Department of Finance and entities to identify opportunities for annual performance statements to better link information on entity strategies and performance to their financial results (see paragraphs 4.46 to 4.51).
Cross entity measures and reporting
32. ANAO audits are yet to see the systemic development of cross-sector performance measures as indicators where it has been recognised that organisational performance is partly reliant on the actions of other agencies. Although there are some emerging better practices16, the ANAO’s findings reveal that integrated reporting on cross-cutting initiatives and linked programs could provide Parliament, government and the public with a clearer, more unified view of performance on key government priorities such as:
- Closing the Gap;
- women’s safety;
- housing;
- whole-of-government national security initiatives; and
- cybersecurity.
33. Noting the interdependence, common objectives and shared responsibility across multiple government programs, there is an opportunity for Commonwealth entities to make appropriate reference to the remit and reporting of outcomes by other entities in annual performance statements. This may enable the Parliament, the government and the public to understand how the work of the reporting entity complements the work done by other parts of government.17
34. As the performance statements audit program continues to broaden in coverage, there will be opportunities for the ANAO to consider the merit of a common approach to measuring performance across entities with broadly similar functions, such as providing policy advice, processing claims or undertaking compliance and regulatory functions. A common basis for assessing these functions may enable the Parliament, the government and the public to compare entities’ results and consider which approaches are working more effectively and why (see paragraphs 4.52 to 4.56).
Type: Financial statement audit
Report number: 22 of 2024-25
Portfolios: Across Entities
Entities: Across Entities
Date tabled:
Audit Summary : show
Executive summary
The Australian National Audit Office (ANAO) publishes an annual audit work program (AAWP) which reflects the audit strategy and deliverables for the forward year. The purpose of the AAWP is to inform the Parliament, the public, and government sector entities of the planned audit coverage for the Australian Government sector by way of financial statements audits, performance audits, performance statements audits and other assurance activities. As set out in the AAWP, the ANAO prepares two reports annually that, drawing on information collected during financial statements audits, provide insights at a point in time of financial statements risks, governance arrangements and internal control frameworks of Commonwealth entities. These reports provide Parliament with an independent examination of the financial accounting and reporting of public sector entities.
These reports explain how entities’ internal control frameworks are critical to executing an efficient and effective audit and underpin an entity’s capacity to transparently discharge its duties and obligations under the Public Governance, Performance and Accountability Act 2013 (PGPA Act). Deficiencies identified during audits that pose either a significant or moderate risk to an entity’s ability to prepare financial statements free from material misstatement are reported.
This report presents the final results of the 2023–24 audits of the Australian Government’s Consolidated Financial Statements (CFS) and 245 Australian Government entities. The Auditor-General Report No. 42 2023–24 Interim Report on Key Financial Controls of Major Entities, focused on the interim results of the audits of 27 of these entities.
Consolidated financial statements
Audit results
1. The CFS presents the whole of government and the General Government Sector financial statements. The 2023–24 CFS were signed by the Minister for Finance on 28 November 2024 and an unmodified auditor’s report was issued on 2 December 2024.
2. There were no significant or moderate audit issues identified in the audit of the CFS in 2023–24 or 2022–23.
Australian Government financial position
3. The Australian Government reported a net operating balance of a surplus of $10.0 billion ($24.9 billion surplus in 2022–23). The Australian Government’s net worth deficiency decreased from $570.3 billion in 2022–23 to $567.5 billion in 2023–24 (see paragraphs 1.8 to 1.26).
Financial audit results and other matters
Quality and timeliness of financial statements preparation
4. The ANAO issued 240 unmodified auditor’s reports as at 9 December 2024. The financial statements were finalised and auditor’s reports issued for 79 per cent (2022–23: 91 per cent) of entities within three months of financial year-end. The decrease in timeliness of auditor’s reports reflects an increase in the number of audit findings and legislative breaches identified by the ANAO, as well as limitations on the available resources within the ANAO in order to undertake additional audit procedures in response to these findings
5. A quality financial statements preparation process will reduce the risk of inaccurate or unreliable reporting. Seventy-one per cent of entities delivered financial statements in line with an agreed timetable (2022–23: 72 per cent). The total number of adjusted and unadjusted audit differences decreased during 2023–24, although 38 per cent of audit differences remained unadjusted. The quantity and value of adjusted and unadjusted audit differences indicate there remains an opportunity for entities to improve quality assurance over financial statements preparation processes (see paragraphs 2.138 to 2.154).
Timeliness of financial reporting
6. Annual reports that are not tabled in a timely manner before budget supplementary estimates hearings decrease the opportunity for the Senate to scrutinise an entity’s performance. Timeliness of tabling of entity annual reports improved. Ninety-three per cent (2022–23: 66 per cent) of entities that are required to table an annual report in Parliament tabled prior to the date that the portfolio’s supplementary budget estimates hearing commenced. Supplementary estimates hearings were held one week later in 2023–24 than in 2022–23. Fifty-seven per cent of entities tabled annual reports one week or more before the hearing (2022–23: 12 per cent). Of the entities required to table an annual report, 4 per cent (2022–23: 6 per cent) had not tabled an annual report as at 9 December 2024 (see paragraphs 2.155 to 2.166).
Official hospitality
7. Eighty-one per cent of entities permit the provision of hospitality and the majority have policies, procedures or guidance in place. Expenditure on the provision of hospitality for the period 2020–21 to 2023–24 was $70.0 million. Official hospitality involves the provision of public resources to persons other than officials of an entity to achieve the entity’s objectives. Entities that provide official hospitality should have policies, and guidance in place which clearly set expectations for officials. There are no mandatory requirements for entities in managing the provision of hospitality, however, the Department of Finance (Finance) does provide some guidance to entities in model accountable authority instructions. Of those entities that permit hospitality 83 per cent have established formal policies, guidelines or processes.
8. Entities with higher levels of exposure to the provision of official hospitality could give further consideration to implementing or enhancing compliance and reporting arrangements. Seventy-four per cent of entities included compliance requirements in their policies, procedures or guidance which support entity’s obtaining assurance over the conduct of official hospitality. Compliance processes included acquittals, formal reporting, attestations from officials and/or periodic internal audits. Thirty-one per cent of entities had established formal reporting on provision of official hospitality within their entities (see paragraphs 2.36 to 2.56).
Artificial intelligence
9. Fifty-six entities used artificial intelligence (AI) in their operations during 2023–24 (2022–23: 27 entities). Most of these entities had adopted AI for research and development activities, IT systems administration and data and reporting.
10. During 2023–24, 64 per cent of entities that used AI had also established internal policies governing the use of AI (2022–23: 44 per cent). Twenty-seven per cent of entities had established internal policies regarding assurance over AI use. An absence of governance frameworks for managing the use of emerging technologies could increase the risk of unintended consequences. In September 2024, the Digital Transformation Agency (DTA) released the Policy for the responsible use of AI in government, which establishes requirements for accountability and transparency on the use of AI within entities (see paragraphs 2.67 to 2.71).
Cloud computing
11. Assurance over effectiveness of cloud computing arrangements (CCA) could be improved. During 2023–24, 89 per cent of entities used CCAs as part of the delivery model for the IT environment, primarily software-as-a-service (SaaS) arrangements. A Service Organisation Controls (SOC) certificate provides assurance over the implementation, design and operating effectiveness of controls included in contracts, including security, privacy, process integrity and availability. Eighty-two per cent of entities did not have in place a formal policy or procedure which would require the formal review and consideration of a SOC certificate.
12. In the absence of a formal process for obtaining and reviewing SOC certificates, there is a risk that deficiencies in controls at a service provider are not identified, mitigated or addressed in a timely manner (see paragraphs 2.57 to 2.66).
Audit committee member rotation
13. Audit committee member rotation considerations could be enhanced. The rotation of audit committee membership is not mandated, though guidance to the sector indicates that rotation of members allows for a flow of new skills and talent through committees, supporting objectivity. Forty-six per cent of entities did not have a policy requirement for audit committee member rotation.
14. Entities could enhance the effectiveness of their audit committees by adopting a formal process for rotation of audit committee membership, which balances the need for continuity and objectivity of membership (see paragraphs 2.16 to 2.21).
Fraud framework requirements
15. The Commonwealth Fraud Control Framework 2017 encourages entities to conduct fraud risk assessments at least every two years and entities responsible for activities with a high fraud risk may assess risk more frequently. All entities had in place a fraud control plan. Ninety-seven per cent of entities had conducted a fraud risk assessment within the last two years. Changes to the framework which occurred on 1 July 2024 requires entities to expand plans to take account of preventing, detecting and dealing with corruption, as well as periodically examining the effectiveness of internal controls (see paragraphs 2.16 to 2.21).
Summary of audit findings
16. Internal controls largely supported the preparation of financial statements free from material misstatement. However, the number of audit findings identified by the ANAO has increased from 2023–24. A total of 214 audit findings and legislative breaches were reported to entities as a result of the 2023–24 financial statements audits. These comprised six significant, 46 moderate, 147 minor audit findings and 15 legislative breaches. The highest number of findings are in the categories of:
- IT control environment, including security, change management and user access;
- compliance and quality assurance frameworks, including legal conformance; and
- accounting and control of non-financial assets.
17. IT controls remain a key issue. Forty-three per cent of all audit findings identified by the ANAO related to the IT control environment, particularly IT security. Weaknesses in controls in this area can expose entities to an increased risk of unauthorised access to systems and data, or data leakage. The number of IT findings identified by the ANAO indicate that there remains room for improvement across the sector to enhance governance processes supporting the design, implementation and operating effectiveness of controls.
18. These audits findings included four significant legislative breaches, one of which was first identified since 2012–13. The majority (53 per cent) of other legislative breaches relate to incorrect payments of remuneration to key management personnel and/or non-compliance with determinations made by the Remuneration Tribunal. Entities could take further steps to enhance governance supporting remuneration to prevent non-compliance or incorrect payments from occurring (see paragraphs 2.72 to 2.137).
Financial sustainability
19. An assessment of an entity’s financial sustainability can provide an indication of financial management issues or signal a risk that the entity will require additional or refocused funding. The ANAO’s analysis concluded that the financial sustainability of the majority of entities was not at risk (see paragraphs 2.167 to 2.196).
Reporting and auditing frameworks
Changes to the Australian public sector reporting framework
20. The development of a climate-related reporting framework and assurance regime in Australia continues to progress. ANAO consultation with Finance to establish an assurance and verification regime for the Commonwealth Climate Disclosure (CCD) reform is ongoing (see paragraphs 3.20 to 3.24).
21. Emerging technologies (including AI) present opportunities for innovation and efficiency in operations by entities. However, rapid developments and associated risks highlight the need for Accountable Authorities to implement effective governance arrangements when adopting these technologies. The ANAO is incorporating consideration of risks relating to the use of emerging technologies, including AI, into audit planning processes to provide Parliament with assurance regarding the use of AI by the Australian Government (see paragraphs 3.25 to 3.33).
22. The ANAO Audit Quality Report 2023–24 was published on 1 November 2024. The report demonstrates the evaluation of the design, implementation and operating effectiveness of the ANAO’s Quality Management Framework and achievement of ANAO quality objectives (see paragraphs 3.34 to 3.39).
23. The ANAO Integrity Report 2023–24 and the ANAO Integrity Framework 2024–25 were also published on 1 November 2024 to provide transparency of the measures undertaken to maintain a high integrity culture within the ANAO (see paragraphs 3.44 to 3.46).
Cost of this report
24. The cost to the ANAO of producing this report is approximately $445,000.
Type: Performance audit
Report number: 10 of 2024-25
Portfolios: Employment and Workplace Relations
Entities: Australian Skills Quality Authority
Date tabled:
Audit Summary : show
Summary and recommendations
Background
1. Fraud against Australian Government entities and corrupt conduct by Australian Government officials are serious matters that can constitute criminal offences. Fraud and corruption undermine the integrity of and public trust in government, including by reducing funds available for government program delivery and causing financial and reputational damage to defrauded entities.1
2. The Australian Government defines fraud as:
Dishonestly obtaining (including attempting to obtain) a gain or benefit, or causing a loss or risk of loss, by deception or other means.2
3. Fraud against the Australian Government can be committed by government officials or contractors (internal fraud) or by parties such as clients of government services, service providers, grant recipients, other members of the public or organised criminal groups (external fraud).3 The Australian Government’s requirements for fraud control apply to both internal and external fraud risks. The 2024 Commonwealth Fraud and Corruption Control Framework states that:
Fraud and corruption are risks that can undermine the objectives of every Australian Government entity in all areas of their business, including delivery of services and programs, policy-making, regulation, taxation, procurement, grants and internal procedures.4
Australian Skills Quality Authority
4. The Australian Skills Quality Authority (ASQA) is the Australian Government agency responsible for the regulation of around 90 per cent of vocational education and training (VET) providers operating in Australia. ASQA’s purpose is ‘to ensure quality VET, so that students, industry, governments and the community can have confidence in the integrity of national qualifications issued by training providers’.5
Rationale for undertaking the audit
5. Fraud against Australian Government entities reduces available funds for public goods and services and causes financial and reputational damage to the Australian Government.6 All Commonwealth entities are required to have fraud control arrangements in place to prevent, detect and respond to fraud. From 1 July 2024, this requirement also extends to corruption.7 This audit is intended to provide assurance to the Parliament regarding the fraud control arrangements in ASQA.
Audit objective and criteria
6. The objective of the audit was to assess the effectiveness of ASQA’s fraud control arrangements as the national regulator of the vocational education and training sector.
7. To form a conclusion against this objective, the following high-level criteria were adopted.
- Have appropriate arrangements been established to oversee and manage fraud risks?
- Have appropriate mechanisms been established to prevent fraud and promote a culture of integrity?
- Have appropriate mechanisms been established to detect and respond to fraud?
- Has the Australian Skills Quality Authority appropriately prepared for the commencement of the revised Commonwealth Fraud and Corruption Control policy in July 2024?
Conclusion
8. ASQA has established partly effective fraud control arrangements. ASQA’s Fraud Control Plan 2022–2024 and Fraud Control Policy focus on internal fraud risks and do not consider the entity’s regulatory fraud environment. ASQA has undertaken minimal steps to align with the Commonwealth’s revised Fraud and Corruption Control Framework which came into effect on 1 July 2024.
9. ASQA has not established appropriate arrangements to manage fraud risk. Fraud control arrangements are based on a fraud control policy that was developed in 2013 and does not reflect current Commonwealth legislative and policy requirements. ASQA’s Fraud Control Plan 2022–2024 does not consider its regulatory fraud control environment, and there is no process to test regulatory fraud controls systematically and regularly. The Fraud Control Plan 2022–2024 contains an overlap of roles and responsibilities of key officials.
10. ASQA has established largely appropriate mechanisms to prevent fraud and promote integrity across its internal and regulatory environments. This includes channels to promote fraud awareness and integrity internally through training, fraud qualifications and professional development, and engagement including social media and sector alerts. Within its regulatory environment, ASQA has established outreach mechanisms to the VET sector that address fraud awareness. ASQA has not appropriately assessed the effectiveness of these mechanisms.
11. ASQA has recently established detection controls, including a tip-off line and information-sharing relationships with external agencies. ASQA has not assessed the effectiveness of these detection controls. ASQA has established an investigatory process for regulatory fraud but does not measure its outcomes or effectiveness.
12. ASQA has taken minimal steps to align with the revised Commonwealth Fraud and Corruption Policy through the development of an updated draft Fraud and Corruption Control Policy and Plan for 2024–2026. ASQA has not prepared an implementation plan and there is no evaluation plan for the new or revised controls. ASQA’s new Fraud and Corruption Control Policy and Plan 2024–2026 has minimal updates from the Fraud Control Policy and Plan 2022–2024 and does not include regulatory fraud or corruption controls.
Supporting findings
Oversight and management of fraud risks
13. ASQA’s fraud control framework is based on a fraud control policy that was developed in 2013 and does not reflect current Commonwealth legislative and policy requirements, or the changes the entity has undergone in the 10 years since the policy was developed. ASQA’s Fraud Control Plan 2022–2024 does not consider the entity’s regulatory fraud control environment, and associated fraud control activities. ASQA has developed a regulatory model which details ASQA’s regulatory and compliance approach. The regulatory model does not specifically address fraud. ASQA’s fraud control plan includes an overlap of responsibilities between key officials. (See paragraphs 2.2 to 2.23)
14. ASQA’s Fraud Control Plan 2022–2024 identified one external fraud risk. The Plan identified seven internal fraud risks, six of which were reviewed during the period covered by the plan. ASQA undertook risk assessments in 2023 and 2024 within its regulatory environment using its environmental scan tool which identified fraud risk relating to visa fraud. The outcomes of risk assessments were not provided to ASQA’s internal audit function. (See paragraphs 2.24 to 2.39)
15. ASQA’s Fraud Control Plan 2022–2024 addresses internal fraud risks and controls and one external fraud risk relating to false or misleading information. The Plan does not address ASQA’s role as the national regulator for the VET sector and its associated regulatory fraud control environment. The Fraud Control Plan 2022–2024 contains controls commensurate with the identified internal fraud risks. Limited testing of controls occurred once in 2023, and mechanisms to test the internal fraud controls on a regular basis have not been established. (See paragraphs 2.40 to 2.48)
Fraud prevention and integrity culture
16. Internal preventative controls align with the risks identified in the entity’s Fraud Control Plan 2022–2024. Regulatory preventative measures include sector alerts and participation in the Fraud Fusion Taskforce. ASQA has not tested the effectiveness of its internal or regulatory fraud prevention controls (including its controls for managing identity fraud), or its documented procedures for preventing, detecting and responding to fraud. (See paragraphs 3.2 to 3.20)
17. ASQA promotes a fraud awareness culture within the entity through annual mandatory fraud awareness training and utilising internal communication channels, including CEO messages emailed to all staff. As at April 2024, the reported completion rate for ASQA’s mandatory fraud awareness training was 84 per cent. ASQA also undertakes outreach programs through mechanisms such as sector alerts and social media alerts to promote fraud awareness. (See paragraphs 3.21 to 3.27)
18. Officials with fraud control responsibilities at ASQA have opportunities for ongoing professional development through training, such as that provided by the Commonwealth Director of Public Prosecutions. ASQA officials engaged in fraud control activities hold relevant qualifications, including the Certificate IV in Government (Investigation) and Diploma in Government (Investigation). (See paragraphs 3.28 to 3.35)
Fraud detection and response
19. ASQA’s detection controls include mechanisms such as a tip-off line and information sharing arrangements with external agencies which provide an appropriate detection framework. There is no documented or consistent process for monitoring and evaluating the effectiveness of these detective controls. (See paragraphs 4.2 to 4.25)
20. ASQA has established mechanisms to investigate and respond to fraud but does not measure its performance, including the effectiveness and efficiency of its fraud response. There were no consistent documented processes and procedures for the operation of ASQA’s investigation capability. ASQA has referred matters to external agencies as part of their information sharing mechanisms. In early August 2024 there were two instances where ASQA referred fraud matters to the Commonwealth Director of Public Prosecutions. One fraud matter was discussed with the Australian Federal Police in 2023–24. (See paragraphs 4.26 to 4.37)
21. ASQA’s Annual Report 2022–23 includes its Accountable Authority’s certification on fraud control confirming that the CEO was satisfied that ASQA has appropriate prevention, detection, investigation, reporting and data collection procedures and processes in place. This certification in the annual report was not supported by evidence. ASQA has established reporting channels with other Commonwealth entities to report fraud and has provided information to the Australian Institute of Criminology as required, and has not kept records of the information provided. (See paragraphs 4.38 to 4.46)
Preparation for the revised Commonwealth Fraud and Corruption Control Framework
22. ASQA does not have an implementation plan for the revised Commonwealth Fraud and Corruption Control Policy. ASQA has an updated Fraud and Corruption Control Policy and Plan 2024–2026. As at July 2024, this document is still in draft and does not address ASQA’s regulatory fraud control environment. (See paragraphs 5.2 to 5.8)
23. ASQA has not established a plan to evaluate the implementation of new or revised fraud and corruption controls. (See paragraphs 5.9 to 5.10)
Recommendations
Recommendation no. 1
Paragraph 2.15
The Australian Skills Quality Authority ensures roles and responsibilities covered in its fraud control arrangements are current and commensurate with existing governance arrangements.
Australian Skills Quality Authority response: Agreed.
Recommendation no. 2
Paragraph 2.47
The Australian Skills Quality Authority updates its Fraud Control Policy and Plan to cover the full extent of its functions including its regulatory activities, supported by risk assessments that clearly address fraud risk and contain robust mitigation strategies.
Australian Skills Quality Authority response: Agreed in-part.
Recommendation no. 3
Paragraph 4.24
The Australian Skills Quality Authority documents its processes for monitoring and evaluating the effectiveness of its fraud controls across prevention and detection.
Australian Skills Quality Authority response: Agreed.
Summary of entity response
24. The proposed audit report was provided to ASQA. ASQA’s summary response is provided below, and its full response is included at Appendix 1. Improvements observed by the ANAO during the course of this audit are listed in Appendix 2.
ASQA places a high value on review and improvement and welcomes the role that ANAO plays in providing independent insights supporting performance improvement. ASQA is already taking action to improve clarity of roles and responsibilities, and document our processes for monitoring and evaluating the effectiveness of fraud controls across prevention and detection to ensure that our internal controls are fit for purpose to protect the entity from these risks. Giving consideration to the audit findings, ASQA will now finalise our Fraud and Corruption Policy and Plan 2024-2026 under the revised Commonwealth Fraud and Corruption Control Framework, which came into effect during this audit in July 2024.
We note that the Commonwealth Fraud and Corruption Control Framework provides a system of governance and accountability across entities for protecting public resources from fraud and corruption. In its role as the National Regulator of VET ASQA is focused on protecting vulnerable students and taking action against non-genuine providers, and to scrutinise those who are in the business of managing or operating RTOs. This has a broader public purpose to prevent harms including those that might arise from external fraud that are not directed at or directly detrimental to the Commonwealth, but to students, employers or industry. This fact has implications for ASQA’s consideration of Recommendation 2 of this report.
Key messages from this audit for all Australian Government entities
25. Below is a summary of key messages, including instances of good practice, which have been identified in this audit and may be relevant for the operations of other Australian Government entities.
Group title
Program design
Key learning reference