Introduction

1.1 The Department of Home Affairs⁵ (the department) is a non-corporate Commonwealth entity that coordinates policy and operations for Australia’s national and transport security, federal law enforcement, criminal justice, cyber security, border, immigration, multicultural affairs, emergency management and trade-related functions.

1.2 As a department of state, the department regularly receives recommendations as part of parliamentary committee inquiries and external audit activity by the Australian National Audit Office (ANAO).

1.3 Parliamentary committee and Auditor-General reports identify risks to the successful delivery of outcomes and generally provide recommendations to address them. Successful implementation of agreed recommendations requires effective governance arrangements, with timely implementation approaches, that set clear responsibilities and timelines for addressing the required actions.

1.4 Committees of the Australian Parliament, including the Joint Committee of Public Accounts and Audit (JCPAA), consist of members from one or both Houses of Parliament. Parliamentary committee inquiries are used to ‘investigate specific matters of policy or government administration or performance’.⁶

1.5 The Auditor-General scrutinises and provides independent assurance as to whether the Executive arm of the Australian Government is operating and accounting for its performance in accordance with the Parliament’s intent.

Previous audits

1.6 This is the fourth in a series of performance audits that examine the effectiveness of Australian Government entities’ implementation of agreed recommendations from parliamentary committee and Auditor-General reports.⁷

1.7 Auditor-General Report No. 6 2019–20, tabled in August 2019, examined entities in the Agriculture and Infrastructure portfolios. It found that the four selected entities had not effectively demonstrated implementation of all agreed recommendations examined by the audit. The report made four recommendations to improve governance and executive oversight of the implementation of recommendations. Three were directed to entities in the audit, and one to the Department of the Prime Minister and Cabinet to reinforce the responsibility of accountable authorities to monitor and implement agreed parliamentary committee recommendations.

1.8 In response to the first report, on 7 August 2019, the Secretary of the Department of the Prime Minister and Cabinet wrote to departmental secretaries strongly encouraging all departments and agencies to:

… finalise government responses to parliamentary committee reports in a timely manner so that the Government can table its response to a committee report within the timeframes established through the respective resolutions of the House of Representatives and the Senate … [and] have processes in place to monitor the implementation of recommendations accepted by the Government.

1.9 Auditor-General Report No. 46 2019–20, tabled in June 2020, examined entities in the Health and Education portfolios. This report concluded that nothing came to the ANAO’s attention that the entities had not implemented applicable parliamentary committee and Auditor-General performance audit recommendations. Entities implemented all parliamentary committee recommendations agreed to in the period 1 July 2016 to 30 June 2017. General arrangements to respond to, monitor and manage parliamentary committee recommendations required improvement.

1.10 Auditor-General Report No. 34 2020–21, tabled in April 2021, examined the Department of Defence. Of the 32 agreed recommendations examined in the audit, the ANAO found 15 (46.9 per cent) were implemented, six (18.8 per cent) were largely implemented, four (12.5 per cent) were partly implemented and seven (21.9 per cent) were not implemented. The report concluded that the Department of Defence had appropriate governance arrangements to respond to, monitor and implement Auditor-General performance audit recommendations, and partially appropriate governance arrangements for parliamentary committee recommendations.

Timeliness of responses to parliamentary committees

1.11 Parliamentary committee reports usually recommend government action. For example, the introduction of legislation, a change in administrative procedures or review of policy. Such action is the responsibility of the Executive Government rather than the Parliament.

1.12 The President of the Australian Senate (Senate) and the Speaker of the House of Representatives (House) present a report to the Senate and House, respectively, on the status of government responses twice a year.⁸ Reports remain on this schedule until:

• a response is received;
• the relevant committee agrees that a response is no longer expected; or
• a request to remove an inquiry from the list is received and agreed.

1.13 Table 1.1 outlines the key results from the President of the Senate report as at 30 June 2021 and 31 December 2021. Report responses are required within three months of the report being presented to the Senate.

Table 1.1: Senate — outstanding government responses as at 30 June 2021^a and 31 December 2021^a

Note a: The timeframe covered in each reporting period includes the oldest report where a government response is outstanding.

Note b: Total numbers include seven partial responses. Partial responses occur where responses have been received for some but not all recommendations. This typically occurs where recommendations are directed at multiple entities.

Note c: The time allowed for responding had not yet expired for 25 of the 249 reports with no response.

Note d: Five responses in this report schedule referred to 13 JCPAA reports. All responses were late.

Note e: Total numbers include eight partial responses. Partial responses occur where responses have been received for some but not all recommendations. This typically occurs where recommendations are directed at multiple entities.

Note f: The time allowed for responding had not yet expired for 36 of the 288 reports with no response.

Note g: Ten responses in this report schedule referred to 14 JCPAA reports. All responses were late.

Source: ANAO analysis of Senate reporting.

1.14 Table 1.2 outlines the key results from the Speaker of the House report as at 23 June 2021 and 1 December 2021. Report responses are required within six months from the report being presented to the House.

Table 1.2: House — outstanding government responses as at 23 June 2021 and 1 December 2021^a

Note a: The timeframe covered in each reporting period includes the oldest report where a government response is outstanding.

Note b: Total numbers include ten partial responses. Partial responses occur where responses have been received for some but not all recommendations. This typically occurs where recommendations are directed at multiple entities.

Note c: This includes two responses that were submitted within the time period and not reflected in the Speaker’s Schedule.

Note d: The time allowed for responding had not yet expired for 13 of the 102 reports with no response.

Note e: This includes two responses that were submitted within the time period and not reflected in the Speaker’s Schedule. Nine responses in this report schedule referred to 12 JCPAA reports. All responses were late. This excludes one report to avoid double counting as it was accurately reported on in a previous Speaker’s Schedule.

Note f: Total numbers include nine partial responses. Partial responses occur where responses have been received for some but not all recommendations. This typically occurs where recommendations are directed at multiple entities.

Note g: The time allowed for responding had not yet expired for 33 of the 113 reports with no response.

Note h: Ten responses (including eight partial) in this report schedule referred to 13 JCPAA reports. All responses were late. This excludes one report to avoid double counting as it was accurately reported on in a previous Speaker’s Schedule.

Source: ANAO analysis of House reporting.

1.15 Very few responses were received in the required timeframe. Within the most recent reporting period:

• three of the 326 (one per cent) Senate and joint committee reports received a response within the three-month timeframe; and
• four of the 142 (three per cent) House and joint committee reports received a response within the six-month timeframe.

1.16 The timeliness of government responses has remained consistently low across all four performance audits in this series.

Rationale for undertaking the audit

1.17 Parliamentary committee and Auditor-General reports, in addition to providing assurance to the Parliament, identify risks to the successful delivery of outcomes and areas where administrative or other improvements can be made by Australian Government entities. The appropriate and timely implementation of agreed recommendations is an important part of realising the full benefit of a parliamentary committee or Auditor-General report and demonstrating accountability to the Parliament.

1.18 This is the fourth in a series of audits that highlight whether entities have implemented recommendations in line with commitments made to the Parliament.

Audit approach

Audit objective, criteria and scope

1.19 The audit examined whether the department implemented all agreed recommendations from parliamentary committee and Auditor-General reports within the scoped timeframe.

1.20 To form a conclusion against the audit objective, the ANAO adopted the following high-level criteria.

• Does the department have fit-for-purpose arrangements to respond to, monitor and implement agreed recommendations?
• Were agreed recommendations effectively implemented?

1.21 The ANAO reviewed the department’s implementation of 25 agreed recommendations, comprised of eight parliamentary committee recommendations and 17 Auditor-General recommendations.⁹

Audit methodology

1.22 To allow sufficient time for their implementation, the recommendations examined in this audit were limited to the following two categories.

• Parliamentary committee reports tabled between January 2019 and June 2020, where a government response was received prior to 31 September 2020, including:
  • those agreed¹⁰ to, with an action item allocated to the department; and
  • those noted, with an action item allocated to the department.
• Auditor-General reports tabled between January 2019 and September 2020.

1.23 This audit did not examine:

• parliamentary committee reports where the subject of the report was either a review of annual reports, or an inquiry or review into proposed Bills or delegated legislation¹¹;
• any recommendations that were agreed to by other entities that sit within the Home Affairs portfolio; or
• recommendations if they were likely to be examined by the ANAO in a separate performance audit, or as part of a parliamentary inquiry.

1.24 The audit involved:

• review of entity documentation, such as guidelines, procedures, management reports, audit committee papers, meeting minutes, briefing materials, implementation plans, closure packs and other supporting evidence relating to monitoring progress and reporting against agreed recommendations;
• examining IT system controls and supporting documentation for those systems used by the department to manage recommendations; and
• meetings with relevant entity staff.

1.25 The audit was conducted in accordance with ANAO Auditing Standards at a cost to the ANAO of approximately $184,000.

1.26 The team members for this audit were Zoe Pilipczyk, Olivia Robbins, Benjamin Harwood, Glen Ewers and Alex Wilkinson.

2.1 An agreed response to a parliamentary committee or Auditor-General recommendation is a formal commitment to implement the recommended action. Entities with effective governance arrangements, processes and systems in place to respond to, and monitor agreed recommendations, are better positioned to successfully implement recommendations.

Does the department have effective governance arrangements to respond to, monitor and implement agreed recommendations?

Accountabilities and delegated decision making

2.2 Successful implementation of agreed recommendations requires effective senior management oversight and monitoring to set clear responsibilities and timeframes for addressing the required action.

Parliamentary committee reports

2.3 The Department of the Prime Minister and Cabinet is responsible for notifying the lead entity for the government response to a parliamentary committee report. An entity may be required to provide input to a response when it is not the lead. The Department of Home Affairs (the department or Home Affairs) requires at least Deputy Secretary clearance of government response input before it is submitted for approval by the relevant Minister. ‘Government responses must be approved by either the Cabinet or the Prime Minister, or a Minister on behalf of the Prime Minister, depending on the subject matter’.¹²

2.4 The Secretary of the Department of the Prime Minister and Cabinet’s letter to departmental secretaries referred to in paragraph 1.8 stated that:

[i]t is critical for responsible agencies to monitor and implement the parliamentary committee’s recommendations agreed to by the Government.

2.5 On 8 August 2019, Home Affairs’ Secretary requested action be taken to address the letter’s content. The department considered tracking parliamentary committee recommendations, but did not progress any action. On 23 September 2021, the department commenced monitoring agreed parliamentary committee recommendations to ‘improve the governance and oversight of the implementation of recommendations from parliamentary inquiries’.

2.6 The Chief Audit Executive is responsible for closure of implemented parliamentary committee recommendations.

Auditor-General reports

2.7 The Secretary of the department has delegated responsibility for designing and delivering assurance frameworks and activities, including alignment with the department’s risk profile, to the Chief Audit Executive. This includes:

• endorsing the department’s response to Auditor-General performance audit reports; and
• the closure of all internal and external audit recommendations, except for agreed financial statements audit recommendations.¹³

2.8 The Chief Financial Officer is responsible for:

• endorsing the department’s response to Auditor-General financial statements audit reports; and
• monitoring implementation of agreed financial statements audit recommendations.¹⁴

Roles and responsibilities

2.9 Figure 2.1 maps responsibility within the department to respond to, monitor, implement, oversee and close agreed recommendations.

Figure 2.1: The department’s processes to respond to, monitor, implement, oversee and close agreed recommendations

Key:  ➔ flow of information; (a) parliamentary committee and performance audit.

Source: ANAO analysis of departmental information.

Respond to recommendations

2.10 Responsibility for receiving and coordinating responses within the department, and allocating parliamentary committee and Auditor-General recommendations is delegated to:

• the Ministerial and Parliamentary Branch for parliamentary committee recommendations;
• the Audit and Assurance Branch for Auditor-General performance audit recommendations; and
• the Financial Operations Branch for Auditor-General financial statements audit recommendations.

2.11 Each branch devolves responsibility for responding to recommendations to relevant business areas.

Monitor and implement

Monitor

2.12 Monitoring of agreed parliamentary committee and Auditor-General recommendations is conducted by two branches.

• Audit and Assurance monitors parliamentary committee and Auditor-General performance audit recommendations.
• Financial Operations monitors Auditor-General financial statements audit recommendations.

Implement

2.13 The relevant First Assistant Secretary, Assistant Commissioner or Group Manager, is responsible for implementing parliamentary committee and Auditor-General recommendations. As at 28 February 2022, all (165) open parliamentary committee recommendations and all (14) open Auditor-General recommendations had been assigned an appropriate officer responsible for the recommendation’s implementation.

Oversight

2.14 The Public Governance, Performance and Accountability Rule 2014 requires that entity audit committees review the appropriateness of the accountable authority’s financial and performance reporting, and systems of risk oversight and management and internal controls.

2.15 The Audit and Risk Committee is the main oversight body for agreed recommendations. The Audit and Risk Committee has delegated oversight of Auditor-General financial statements audit recommendations to the Financial Statements Sub-Committee.

• The Audit and Risk Committee Charter requires the Committee to provide the Secretary with written advice ‘about significant issues identified [in internal and external audit reports] and monitoring the implementation of agreed actions’. On 15 October 2021, the Audit and Risk Committee Charter was amended to also require written advice on significant issues identified and monitoring the implementation of agreed actions from ‘relevant parliamentary committee reports’.
• The Financial Statements Sub-Committee provides advice to the Audit and Risk Committee on a range of matters, including ‘[m]onitoring of progress towards management’s remediation of existing audit findings from previous ANAO financial statement audit reports’.

2.16 The Financial Statements Sub-Committee provides regular updates to the Audit and Risk Committee, including updates on the status of financial statements audit recommendations. The Audit and Risk Committee agreed it would monitor implementation of the agreed Auditor-General financial statements audit recommendation reviewed in this audit.¹⁵

Closure

2.17 As mentioned in paragraphs 2.6 to 2.8, the Chief Audit Executive and Chief Financial Officer are responsible for closing agreed parliamentary committee and Auditor-General recommendations.

Risk management

2.18 Entities have a responsibility to establish effective internal checks and controls and an effective risk and assurance framework to monitor and manage risk at the enterprise level. Under section 16 of the Public Governance, Performance and Accountability Act 2013, ‘[t]he accountable authority of a Commonwealth entity must establish and maintain: an appropriate system of risk oversight and management for the entity’.

2.19 The department’s current Risk Management Framework was approved on 21 December 2021. The Risk Management Framework outlines the department’s arrangements for designing, implementing, monitoring, reviewing and continually improving risk management. It also includes the controls management approach and reporting requirements.

2.20 The department’s current Assurance Framework was approved on 2 September 2020. The Assurance Framework informs departmental staff of the overarching principles of assurance, the interaction between assurance and risk management and the role of governance controls. This framework is intended to be read and applied in conjunction with the Risk Management Framework.

2.21 The Assurance Framework is based on the Institute of Internal Auditors Position Paper: Three Lines of Defense in Effective Risk Management and Control.¹⁶ The three lines of assurance include:

• first line — management assurance: managers across the department own and manage risk;
• second line — risk oversight and compliance functions: program level controls or stewardship oversight measures for managing risk and non-compliance; and
• third line — independent assurance: external entities to the department, such as the ANAO, provide assurance on the effectiveness of risk management and internal controls.

2.22 Parliamentary committee and Auditor-General reports fall within the department’s third line of assurance.

Has the department established effective processes to respond to, monitor and implement agreed recommendations?

2.23 Processes for managing the implementation of recommendations should begin with a clear arrangement for responding to recommendations.¹⁷ Agreeing to a recommendation acknowledges that things can be improved. The Parliament’s expectation is that the entity then makes those improvements that address the deficiency identified.

Respond to recommendations

2.24 When responding to parliamentary committee and Auditor-General recommendations, entities should clearly state their intentions on whether they will implement the recommendation in full. By clearly indicating what actions will or will not be done in response to recommendations, entities minimise the risk of ambiguity.

2.25 The department has three separate documented procedures for receiving and coordinating responses and allocating parliamentary committee and Auditor-General recommendations. For the sample of recommendations reviewed in this audit, the department:

• supported or noted the parliamentary committee recommendations; and
• agreed or agreed in principle to the Auditor-General recommendations.

Monitor and implement

2.26 Effective monitoring requires an approach that accurately tracks progress and records the actions of the business area or individual responsible for implementation. The goal is that those with accountability can have a clear line of sight to the implementation of agreed recommendations. This section considers whether there is clear guidance to:

• establish roles and responsibilities;
• establish timeframes; and
• assess risk for agreed parliamentary committee and Auditor-General recommendations.

Roles and responsibilities

2.27 Successful implementation of recommendations requires senior management oversight, and implementation planning to set clear responsibilities and timeframes for delivering the agreed action.

Monitor

2.28 The department has guidance to monitor agreed parliamentary committee and Auditor-General performance audit recommendations. Audit and Assurance seeks status updates from the recommendation owner every two months.

2.29 Financial Operations use draft guidance for the end-to-end process of engaging with Auditor-General financial statements audit, including monitoring implementation of agreed recommendations. The department advised that:

Given the limited number of financial statement[s] audit recommendations over the last few years there is no need to formalise a procedure noting the strong conventions and precedents in place for monitoring recommendations with the ANAO and Financial Statements Sub-Committee.

Implement

2.30 For Auditor-General recommendations made in financial statements audits, recommendation owners are made aware of their reporting requirements to the Financial Statements Sub-Committee.¹⁸ Reporting to the Audit and Risk Committee is on request.

2.31 In relation to financial statements audit recommendations, the department advised:

The implementation plan for financial statement[s] audit findings depends on the nature of the finding and the ANAO regularly monitors progress of these findings in their interim and final audit reports as part of the financial statements audit process. Therefore, general guidance on the implementation of findings would not be relevant as it would change depending on the rating and nature of the finding.

2.32 From February 2022, the department requires parliamentary committee and Auditor-General performance audit recommendation owners to document a Management Action Plan. This requires recommendation owners to set out:

• the actions that will be taken to achieve the intent of the recommendation;
• responsibilities and timeframes for each action; and
• how established actions will achieve the intent of the recommendation.

Implementation timeframes

2.33 Establishing and meeting timeframes for implementing recommendations is important to ensure recommendations are implemented, and that any risks or issues which led to the recommendations being made are addressed in a timely fashion.

2.34 Prior to February 2022, departmental guidance did not require timeframes to be established for parliamentary committee or Auditor-General recommendations.¹⁹ The department is currently establishing timeframes for all open recommendations being tracked by Audit and Assurance. As at 28 February 2022:

• three of 165 (two per cent) open parliamentary committee recommendations had an implementation timeframe; and
• one of 14 (seven per cent) open Auditor-General recommendations had an implementation timeframe.

Risk

2.35 Clear and consistent processes for understanding risk will position entities to design risk-based implementation plans. An effective risk assessment process should include clear linkages between risk ratings and agreed action items.

2.36 Prior to February 2022, departmental guidance did not require a risk rating to be assigned for agreed parliamentary committee or Auditor-General performance audit recommendations. The department is in the process of assigning risk ratings to all open recommendations being tracked by Audit and Assurance. As at 28 February 2022:

• three of 165 (two per cent) open parliamentary committee recommendations had been assigned a risk rating; and
• one of 14 (seven per cent) open Auditor-General performance audit recommendations had been assigned a risk rating.

2.37 The department advised that it adopts the risk rating the ANAO assigns financial statements audit recommendations. Financial Operations also considers and reports (to the Financial Statements Sub-Committee) the risk of the recommendation being implemented within the expected completion date.

Oversight

2.38 The Audit and Risk Committee and Financial Statements Sub-Committee are responsible for overseeing the implementation of recommendations (see paragraph 2.15). Recommendation tracking and implementation is a standing agenda item for both committees.

• Audit and Assurance provide an update at each Audit and Risk Committee meeting on relevant open and closed recommendations.
• Financial Operations provide an update at each Financial Statements Sub-Committee on relevant open and closed recommendations.

2.39 Paragraphs 2.53 to 2.55 discuss oversight of recommendations in more detail.

Closure

2.40 Recommendation owners prepare a business case and closure pack to demonstrate the implementation of the recommendation. Audit and Assurance or Financial Operations review the business case to assess whether closure is supported. If supported, a closure minute is prepared for the Chief Audit Executive’s or Chief Financial Officer’s endorsement (see paragraphs 2.6 to 2.8). Once a closure decision has been made, the recommendation owner is notified.

Does the department have effective systems in place to monitor the implementation of agreed recommendations?

2.43 Systems to monitor the implementation of agreed recommendations should be fit-for-purpose, reflecting the size of the entity, the nature of its business and its governance structure. Entities should ensure there are sufficient system controls to maintain complete and accurate data.

Systems

2.44 The department has three separate systems to monitor parliamentary committee and Auditor-General recommendations.

• Ministerial and Parliamentary use the Parliamentary Document Management System (PDMS)²⁰ to capture agreed parliamentary committee recommendations.
• Audit and Assurance uses a Microsoft Access database (the Recommendation Monitoring and Assurance (RMA) database) to monitor parliamentary committee and Auditor-General performance audit recommendations.
• Financial Operations maintain a spreadsheet to track Auditor-General financial statements audit recommendations.

System controls

2.45 A manual process is used to enter, track and close parliamentary committee and Auditor-General recommendations. There are sufficient manual controls, provided regular monitoring of user groups is maintained. Limited system enforced controls (IT controls)²¹ are in place to maintain the completeness and accuracy of data in PDMS and the RMA database.

Parliamentary Document Management System

2.46 The department uses PDMS to manage its interactions with parliamentary committee inquiries, between an inquiry commencing and a government response being submitted.²²

2.47 Appropriate staff are granted PDMS access that only allows users to perform specific tasks during a ministerial or parliamentary workflow process. In November 2021, Ministerial and Parliamentary reviewed high-level PDMS user access. All users who held the Parliamentary Coordinator role in PDMS were checked to ensure their level of access aligned with their role. As a result:

• Parliamentary Coordinator access was removed from 69 users;
• forty Ministerial and Parliamentary staff retained full Parliamentary Coordinator access; and
• ninety departmental officers retained partial Parliamentary Coordinator access.

2.48 There would be merit in the department establishing a regular review process for high-level PDMS access.

Completeness and accuracy

2.49 ANAO analysis in October 2021 identified that PDMS did not contain all agreed parliamentary committee recommendations. Ministerial and Parliamentary emailed relevant staff during this audit to address this. As at 23 February 2022, the department advised that PDMS contained all agreed parliamentary committee recommendations.

Recommendation Monitoring and Assurance database

2.50 The department uses the RMA database to manage status reporting of parliamentary committee and Auditor-General performance audit recommendation implementation. Key documents, such as status updates to the Audit and Risk Committee and closure minutes are retained in the department’s electronic document and records management system.

2.51 The RMA database is stored in a shared drive. Drive access is restricted to branch level. Database backups are manual and are completed daily with weekly backups saved to the department’s electronic document and records management system.²³ Draft guidance on the RMA database is available, and training is provided on an as needed basis.

Completeness and accuracy

2.52 As at March 2022, the RMA database contained all Auditor-General recommendations.²⁴ The RMA database does not contain a complete record of implementation tracking. For example, Audit and Assurance has not recorded when a closure minute was received for all implemented Auditor-General recommendations.

Reporting

Internal reporting

2.53 The Audit and Risk Committee and Financial Statements Sub-Committee are the oversight bodies for agreed recommendations. The Audit and Risk Committee provides advice to the Secretary on the status of agreed recommendations (see paragraph 2.15).

2.54 The ANAO reviewed the minutes for both committees’ meetings conducted between January 2019 and December 2021, to determine the percentage of meetings where a recommendation update was provided to the committees and the Secretary. The Audit and Risk Committee met 20 times and the Financial Statements Sub-Committee met 14 times in this period.

Table 2.1: Percentage of meetings between January 2019 and December 2021 where a recommendation update was provided

Note a: An update was not provided in May 2020, two meetings in September 2020 and one meeting in September 2021.

Note b: These updates included unique information on the total number of open and closed recommendations.

Source: ANAO analysis of departmental information.

2.55 Table 2.1 shows that within the audit timeframe, the department consistently reported to the relevant oversight bodies on the implementation of agreed recommendations. Auditor-General recommendation reporting at the team and recommendation owner level is discussed in paragraphs 3.10 to 3.17.

External reporting

2.56 Entities are required to provide updates to the Department of the Prime Minister and Cabinet on outstanding government responses to parliamentary committee reports (see paragraphs 1.11 to 1.16). The department’s current processes meet this requirement. Entities are not required to report on the implementation status or closure of agreed recommendations, unless requested.²⁵

2.57 When requested, the department provides advice to the ANAO:

• on the implementation status of performance audit recommendations²⁶; and
• to inform reviews and reports on the status of financial statements audit recommendations as part of ANAO’s biannual reporting.

3.1 Recommendations from parliamentary committee and Auditor-General reports focus on what needs to happen, not how to do it. Successful implementation of recommendations requires fit-for-purpose implementation plans, and strong senior management oversight and monitoring to ensure delivery of the agreed action.

3.2 Prior to September 2021, the Department of Home Affairs (the department) did not have a process to monitor agreed parliamentary committee recommendations (see paragraph 2.5). As a result, this limited the ANAO’s examination on whether selected parliamentary committee recommendations were implemented in full and closed in accordance with requirements.

3.3 Table 3.1 outlines the number of agreed parliamentary committee and Auditor-General recommendations that were within the scope of this audit. For details of the selected recommendations see Appendix 3, Appendix 4 and Appendix 5.

Table 3.1: Parliamentary committee and Auditor-General reports and recommendations within the audit scope

Source: ANAO analysis of information in the public domain.

Did the department develop a fit-for-purpose implementation plan for each of the selected recommendations?

3.4 In the absence of procedures or guidance on how to implement agreed recommendations, the ANAO examined whether the department assigned roles and responsibilities, timeframes, and a risk rating for selected Auditor-General recommendations.

Roles and responsibilities

3.5 Auditor-General recommendation owners are at the level of First Assistant Secretary, Assistant Commissioner or Group Manager (see paragraph 2.13). All selected Auditor-General recommendations were assigned an appropriate recommendation owner.

Implementation timeframes

3.6 Prior to February 2022, the department did not require timeframes be established for agreed Auditor-General recommendations (see paragraph 2.34). One Auditor-General recommendation was assigned a timeframe.²⁷

Risk

3.7 Prior to February 2022, the department did not require risk to be assessed for agreed Auditor-General performance audit recommendations (see paragraph 2.36). None of the (16) selected performance audit recommendations were assigned a risk rating.

3.8 The department advised it adopts the ANAO’s risk ratings for financial statements audit recommendations (see paragraph 2.37). The financial statements audit recommendation reviewed in this audit resulted from a ‘significant non-adherence’ to the department’s Visa and Citizenship Quality Management Framework. The department agreed to the recommendation but disagreed that the finding was ‘significant’.²⁸ In November 2019, the department’s recommendation owner for the financial statements audit recommendation submitted a paper to the Audit and Risk Committee stating:

The Department disagrees with the Category A finding as set out in the management response …

The Department’s view is that the audit shifted scope throughout and that the final scope of the audit was too broad and well beyond the time and resources committed to truly understand the complexity of the business continuum and of the broader risk, quality and assurance frameworks, systems and processes as to inform a Category A finding.

In particular the ANAO’s focus on a subcomponent of tactical level quality assurance activity fails to consider the Department’s end to end business design and program outcomes and raises questions regarding the linkage between tactical level quality assurance and its impact on the identified high level strategic risk.

In addition, the audit was conducted as part of the Department’s annual financial statement audit, although this issue is a performance related one, not financial and the audit did not involve the same methodology or level of preparation that should be applied to a performance audit.

3.9 The department did not assign a risk rating to this recommendation when it was a significant (Category A) finding. The department adopted ANAO’s risk rating when this finding was downgraded to Category B and Category C.²⁹ Financial Operations reported to the Financial Statements Sub-Committee on the risk of this recommendation being implemented within the expected completion date in the May and June 2021.

Did the department effectively monitor the implementation of each selected recommendation?

3.10 Effective monitoring requires an approach that accurately tracks progress and records the actions of the business area or individual responsible for implementation. The goal is that those with entity accountability can have a clear line of sight to the implementation of agreed recommendations.

3.11 As depicted in Figure 2.1, the recommendation owner is responsible for implementing recommendations and providing updates to:

• Audit and Assurance or Financial Operations; and
• Audit and Risk Committee or Financial Statements Sub-Committee.

3.12 The recommendation owner for the reviewed financial statements audit recommendation provided updates to the Audit and Risk Committee (see paragraph 2.16).

Auditor-General performance audit recommendations

3.13 As discussed in paragraph 2.44, the Recommendation Monitoring and Assurance (RMA) database is used to monitor the implementation of agreed Auditor-General performance audit recommendations. The department does not have a process to obtain assurance over the information retained within the RMA database. Using the available information, the ANAO found that:

• all recommendation owners provided at least one update to Audit and Assurance;
• the frequency and number of updates varied between recommendations, ranging from one to 12 updates³⁰;
• the lapsed time between a recommendation being tabled and the first update ranged from 22³¹ to 380 days³²;
• the median and average lapsed time between a recommendation being tabled and the first update from the recommendation owner was 239 days (7.9 months);
• fifty per cent of the recorded status updates from recommendation owners were in response to a request from Audit and Assurance; and
• once Audit and Assurance initiated contact, most recommendation owners provided an update at least once every three months.³³

3.14 The department advised that:

to manage the database size, the recommendations monitoring system only records substantive updates to progress in the comments field/audit history for each audit. This … result[s] in differences in the total number of updates recorded against each recommendation.

3.15 There would be merit in the department establishing a process to gain assurance over the data retained within the RMA database. This would support Audit and Assurance provide accurate reporting to the Audit and Risk Committee (see paragraph 2.38).

Auditor-General financial statements audit recommendations

3.16 The Auditor-General financial statements audit recommendation was managed through the Audit and Risk Committee (see paragraph 2.16). In December 2020, the Financial Statements Sub-Committee requested that updates be provided for visibility. Financial Operations sought and provided updates to the Financial Statements Sub-Committee in March, May and July 2021.

Audit and Risk Committee

3.17 The Audit and Risk Committee was provided with inconsistent and irregular implementation status updates for Auditor-General recommendations.

• Ten (59 per cent) recommendations did not provide any updates.
• Three (18 per cent) recommendations provided one update.³⁴
• Three (18 per cent) recommendations provided two updates.³⁵ One word changed in the second update, which was provided four months after the first update.
• One (six per cent) recommendation provided five updates.³⁶

Were the selected recommendations implemented in full and closed in accordance with requirements?

3.18 Entities that are effective at implementing recommendations have processes to provide assurance that this has occurred. Entities will often undertake a quality assurance process prior to determining that a recommendation has been implemented and closed.

3.19 The approach used by the ANAO to assess the implementation status of the 25 selected recommendations is set out in Table 3.2 below.

Table 3.2: Implementation status assessment categories

Source: ANAO.

3.20 The ANAO reviewed agreed and noted³⁷ parliamentary committee and Auditor-General recommendations between January 2019 and September 2020 (see paragraphs 1.22 and 1.23). This included:

• three agreed parliamentary committee recommendations;
• five noted parliamentary committee recommendations; and
• seventeen agreed Auditor-General recommendations (see Table 3.1).

Agreed parliamentary committee recommendations

3.21 Table 3.3 contains the department’s and ANAO’s assessment regarding the implementation of selected agreed parliamentary committee recommendations. Additional commentary is provided where the department and ANAO assessment differed. Appendix 3 provides the full text of each agreed recommendation.

Table 3.3: Summary assessment of agreed parliamentary committee recommendations implementation

Source: ANAO analysis of departmental information.

3.22 There were no instances where the department’s and ANAO’s assessment in Table 3.3 differed.

Noted parliamentary committee recommendations

3.23 Table 3.4 contains the department’s and ANAO’s assessment regarding the implementation of selected noted parliamentary committee recommendations. The ANAO assessed the department against its responsibilities outlined in the government’s response. Appendix 4 provides the full text of each agreed recommendation.

Table 3.4: Summary assessment of noted parliamentary committee recommendations implementation

Note a: As these recommendations were noted, the department did not provide an assessment on implementation status.

Source: ANAO analysis of departmental information.

Joint Committee of Public Accounts and Audit, Report 479: Australian Government Security Arrangements — recommendation 2

3.24 The ANAO assessed this recommendation as implemented.

3.25 The government response to recommendation 2 included that:

As per the Recommendation two, of Report 479: Australian Government Security Arrangements, please find enclosed the Department of Home Affairs’ progress report on the implementation of the recommendations from the ANAO Audit Report 38, and the status of the Department’s compliance with the Protective Security Policy Framework.

3.26 The department provided a progress report to the Joint Committee of Public Accounts and Audit within three months. The government response gave no commitment to annual reporting.

Joint Committee on Law Enforcement, Theft and export of motor vehicles and parts — recommendations 1 and 2

Recommendation 1

3.27 The ANAO assessed this recommendation as not implemented.

3.28 The government response to recommendation 1 included that:

[It] intends to give effect to the intent of this recommendation through administrative changes within the scope of the provisions of the Customs Act relating to false and misleading statements. The Government will direct the ABF to consider appropriate amendments to Australia’s export declaration process, to require an exporter to confirm the legitimacy of their goods at the point of export. If an exporter’s declaration regarding those goods were found to be false or misleading, this would trigger offences under both the Customs Act and the Criminal Code Act 1995 (Criminal Code) for providing false or misleading statements.

3.29 The department advised the ANAO that:

Since the Inquiry’s recommendation, there have been no instances of stolen vehicles or vehicle parts raised as being seized or detained. As such, there have been no compliance actions to review. Once an instance of the exportation of stolen vehicles or vehicle parts is detected at the border, the treatment of those goods will be examined and advice will be generated, as required.

3.30 The department has not made administrative changes within the scope of the provisions of the Customs Act 1901 relating to false and misleading statements.

Recommendation 2

3.31 The ANAO assessed this recommendation as implemented.

3.32 The government response to recommendation 2 included that:

[The department] collaborates regularly with domestic law enforcement agencies to address unlawful and illicit activities that cut across areas of Commonwealth and State and Territory responsibilities.

3.33 The department provided three examples of where it collaborates with domestic law enforcement agencies.

• The Black Economy Standing Taskforce: the Taskforce’s objective is to protect the public finances of Australia.³⁸
• The Australian Transnational, Serious and Organised Crime Committee: the Committee’s objective is to contribute to the protection of Australia, its people, and its interests from the harms of transnational, serious and organised crime.³⁹
• The Criminal Justice and Law Enforcement Forum: the Forum’s objective is to provide strategic oversight and guidance for the development of whole-of-government strategies and policies, and coordinated activities to respond to the threat of transnational, serious and organised crime.⁴⁰

Joint Standing Committee on Foreign Affairs, Defence and Trade, From little things big things grow: Supporting Australian SMEs go global — recommendation 6

3.34 The ANAO assessed this recommendation as implemented.

3.35 The government response to recommendation 6 included that:

The Department of Home Affairs is leading a whole-of-government agenda to transform and modernise international trade that flows across Australia’s border.

3.36 In June 2021, the government established a whole-of-government Simplified Trade System Implementation Taskforce. Responsibility for this taskforce now sits within the Foreign Affairs and Trade portfolio.⁴¹

Senate Standing Committees on Rural and Regional Affairs and Transport, The operation, regulation and funding of air route service delivery to rural, regional and remote communities — recommendation 5

3.37 The ANAO assessed this recommendation as implemented.

3.38 The government response to recommendation 5 included that:

The Department of Infrastructure, Transport, Cities and Regional Development is working with industry and the Department of Home Affairs to undertake up to six case studies to assess the financial impact of the new aviation security requirements on regional airports and, where possible, the flow on impact to the local communities.

3.39 In September 2021, the department worked with the Department of Infrastructure, Transport, Regional Development and Communications to finalise this analysis.

Agreed Auditor-General recommendations

3.40 Table 3.5 contains the department’s and ANAO’s assessment regarding the implementation of selected agreed Auditor-General recommendations. Additional commentary is provided where the ANAO and department assessment differed. Appendix 5 provides the full text of each agreed recommendation.

Table 3.5: Summary assessment of agreed Auditor-General recommendations implementation

Note a: This recommendation was ‘Agreed in principle’. The ANAO assessed whether the department implemented what it agreed to in its response.

Source: ANAO analysis of departmental information.

3.41 There were five instances where the two assessments in Table 3.5 differed.

Auditor-General Report No. 4 2020–21 Establishment and Use of ICT Related Procurement Panels and Arrangements — recommendation 3

3.42 The ANAO assessed this recommendation as partly implemented.

3.43 Recommendation 3 was that the department ‘give greater consideration to competition when selecting suppliers from a panel, particularly in the case of high value procurements or where there is likely to be a substantial increase in the value of a procurement, to drive value for money’.

3.44 In response to this recommendation, the department updated ICT-related procurement guidance. The department does not monitor or report on whether greater competition (and value for money) has been considered (and achieved).

3.45 The department has completed seven high value procurements since this recommendation was closed in March 2021. One supplier was approached for five (71 per cent) of these procurements.

Auditor-General Report No. 25 2019–20 Aboriginal and Torres Strait Islander Participation Targets in Major Procurements — recommendations 4 and 5

Recommendation 4

3.46 The ANAO assessed this recommendation as largely implemented.

3.47 Recommendation 4 was that the department ‘review and update their procurement protocols to ensure procuring officers undertaking major procurements that trigger the [Mandatory Minimum Requirements] comply with required steps in the procurement process’.

3.48 The department has updated procurement-related guidance to include reference and hyperlinks to the Indigenous Procurement Policy and Mandatory Minimum Requirements. The department is currently drafting an Indigenous Procurement Strategy.

Recommendation 5

3.49 The ANAO assessed this recommendation as largely implemented.

3.50 Recommendation 5 was that the department ‘establish processes, or update existing processes, to ensure contract managers and contractors regularly use the [Indigenous Procurement Policy] Reporting Solution for [Mandatory Minimum Requirements] reporting’.

3.51 The department has developed a procedure on reporting for the Mandatory Minimum Requirements. Six procurements that triggered the Mandatory Minimum Requirements have been completed since this recommendation was closed in October 2020. The Indigenous Procurement Policy Reporting Solution has been used for one (17 per cent) of these procurements.

Auditor-General Report No. 17 2019–20 Delivery of the Humanitarian Settlement Program — recommendation 1

3.52 The ANAO assessed this recommendation as partly implemented.

3.53 Recommendation 1 was that the department ‘finalise changes to contract management arrangements for the [Humanitarian Settlement Program] to ensure full alignment with the Australian Government Contract Management Guide’.

3.54 The finalised contracts do not fully align with the Australian Government Contract Management Guide. For example, the contract management plans do not:

• provide the contact details for the contract manager/s;
• contain details of risks that have been identified and how and by whom they will be managed; or
• include details of stakeholder engagement, including a schedule of meetings.

Auditor-General Report No. 8 2019–20 Management of the Tourist Refund Scheme — recommendation 3

3.55 The ANAO assessed this recommendation as partly implemented.

3.56 Recommendation 3 was that the department ‘implement and embed into business practices the data analysis tools that they have already developed’.

3.57 The department has developed a procedure on how to generate various reports based on available Tourist Refund Scheme data. This procedure does not include information as to how the department uses the data analysis tools to undertake data analytics on aspects of the Tourist Refund Scheme, such as non-compliance and fraud.

Closure

3.58 Recommendation owners prepare a business case and closure pack to demonstrate the implementation of the recommendation. Audit and Assurance or Financial Operations review the business case to assess whether closure is supported. If supported, a closure minute is prepared for the Chief Audit Executive’s or Chief Financial Officer’s endorsement (see paragraph 2.40). Selected Auditor-General recommendations that had been closed were administered in accordance with these requirements.

Appendix 1 Department of Home Affairs response

Appendix 2 Performance improvements observed by the ANAO

1. The fact that independent external audit exists, and the accompanying potential for scrutiny, improves performance. Program-level improvements usually occur: in anticipation of ANAO audit activity; during an audit engagement as interim findings are made; and/or after the audit has been completed and formal findings are communicated.

2. The Joint Committee of Public Accounts and Audit (JCPAA) has encouraged the ANAO to consider ways in which the ANAO could capture and describe some of these impacts.

3. Performance audits involve close engagement between the ANAO and the audited entity as well as other stakeholders involved in the program or activity being audited. Throughout the audit engagement, the ANAO outlines to the entity the preliminary audit findings, conclusions and potential audit recommendations. This ensures that final recommendations are appropriately targeted and encourages entities to take early remedial action on any identified matters during the course of an audit. Remedial actions entities may take during the audit include:

• strengthening governance arrangements;
• initiating reviews or investigations; and
• introducing or revising policies or guidelines.

4. In this context, the below improvements were observed by the ANAO during the course of the audit. It is not clear if these actions and/or the timing of these actions were already planned before this audit commenced. The ANAO has not sought to obtain reasonable assurance over the source of these improvements or whether they have been appropriately implemented.

5. Performance improvements observed by the ANAO during the course of this audit were that the department:

• established a process to monitor the implementation of agreed parliamentary committee recommendations (see paragraph 2.5);
• amended the Audit and Risk Committee Charter to include reporting to the Secretary on parliamentary committee reports and agreed recommendations (paragraph 2.15);
• commenced a process that set timeframes and assigned risk ratings to open agreed parliamentary committee and Auditor-General performance audit recommendations (see paragraphs 2.34 and 2.36, respectively);
• undertook a review of high-level Parliamentary Document Management System user access (see paragraph 2.47); and
• improved the completeness of data in the Parliamentary Document Management System and the Recommendation Monitoring and Assurance database (see paragraph 2.49 and 2.52, respectively).

Appendix 3 Agreed parliamentary committee recommendations examined in this audit

Table A.1: Parliamentary Joint Committee on Intelligence and Security, Review of the Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018

Source: Parliamentary Joint Committee on Intelligence and Security, Review of the Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018, p. xi, and Government Response, pp. 2–3.

Appendix 4 Noted parliamentary committee recommendations examined in this audit

Table A.2: Joint Committee of Public Accounts and Audit, Report 479: Australian Government Security Arrangements

Source: Joint Committee of Public Accounts and Audit, Report 479 Australian Government Security Arrangements, p. vii, and Government Response, p. 1.

Table A.3: Joint Committee on Law Enforcement, Theft and export of motor vehicles and parts

Source: Source: Joint Committee on Law Enforcement, Theft and export of motor vehicles and parts, p. ix, and Government Response, pp. 2–3.

Table A.4: Joint Standing Committee on Foreign Affairs, Defence and Trade, From little things big things grow: Supporting Australian SMEs go global

Source: Joint Standing Committee on Foreign Affairs, Defence and Trade, From little things big things grow: Supporting Australian SMEs go global, p. xxxi, and Government Response, pp. 9–10.

Table A.5: Senate Standing Committees on Rural and Regional Affairs and Transport, The operation, regulation and funding of air route service delivery to rural, regional and remote communities

Source: Senate Standing Committees on Rural and Regional Affairs and Transport, The operation, regulation and funding of air route service delivery to rural, regional and remote communities, p. xiii, and Government Response, p. 6.

Appendix 5 Agreed Auditor-General recommendations examined in this audit

Table A.6: Auditor-General Report No. 4 2020–21 Establishment and Use of ICT Related Procurement Panels and Arrangements

Source: Auditor-General Report No. 4 2020–21 Establishment and Use of ICT Related Procurement Panels and Arrangements, p. 85.

Table A.7: Auditor-General Report No. 42 2019–20 Fraud Control Arrangements in the Department of Home Affairs

Source: Auditor-General Report No. 42 2019–20 Fraud Control Arrangements in the Department of Home Affairs, p. 49.

Table A.8: Auditor-General Report No. 37 2019–20 Procurement of Garrison Support and Welfare Services

Source: Auditor-General Report No. 37 2019–20 Procurement of Garrison Support and Welfare Services, pp. 33 and 51.

Table A.9: Auditor-General Report No. 25 2019–20 Aboriginal and Torres Strait Islander Participation Targets in Major Procurements

Source: Auditor-General Report No. 25 2019–20 Aboriginal and Torres Strait Islander Participation Targets in Major Procurements, pp. 52, 57 and 59.

Table A.10: Auditor-General Report No. 20 2019–20 Audits of the Financial Statements of Australian Government Entities for the Period Ended 30 June 2019

Source: Auditor-General Report No. 20 2019–20 Audits of the Financial Statements of Australian Government Entities for the Period Ended 30 June 2019, pp. 199–200.

Table A.11: Auditor-General Report No. 17 2019–20 Delivery of the Humanitarian Settlement Program

Source: Auditor-General Report No. 17 2019–20 Delivery of the Humanitarian Settlement Program, pp. 26, 37 and 55.

Table A.12: Auditor-General Report No. 8 2019–20 Management of the Tourist Refund Scheme

Source: Auditor-General Report No. 8 2019–20 Management of the Tourist Refund Scheme, pp. 39, 48 and 53.

Table A.13: Auditor-General Report No. 41 2018–19 Coordination Arrangements of Australian Government Entities Operating in Torres Strait

Source: Auditor-General Report No. 41 2018–19 Coordination Arrangements of Australian Government Entities Operating in Torres Strait, pp. 28–29.

Table A.14: Auditor-General Report No. 25 2018–19 Efficiency of the Processing of Applications for Citizenship by Conferral

Source: Auditor-General Report No. 25 2018–19 Efficiency of the Processing of Applications for Citizenship by Conferral, pp. 44 and 58.