Background

The Department of Family and Community Services (FaCS) has responsibility for implementing three Internet portals created in accordance with the Government's November 2000 commitment to make access to government services available through Internet portals. The main entry point for Australian Government portals is www.australia.gov.au . The site currently lists 19 websites identified as being for individuals and seven identified as being for business. FaCS is the lead agency for three of these portals, www.youth.gov.au, www.community.gov.au, and www.families.gov.au.

The Family and Community Services portfolio is responsible for a broad range of social policy issues affecting Australian society and the living standards of Australian families, communities and individuals. FaCS is the principal policy formulating and advising body in the portfolio and is responsible for around one third of total government outlays. FaCS is responsible for:¹

• putting to work the Government's social support policies for families, working-age people and retirees; and
• managing the delivery of a wide range of support services through thousands of provider organisations located across Australia.

The primary objective of the audit was to assess FaCS' management of the Internet portals for which it had responsibility. The ANAO also included in the audit a website directed towards youth, The source,² which provided many of the services expected of a portal. The audit considered: governance structures for the portals; measurement and/or assessment of efficiency and effectiveness; and control factors, such as change management, security, and legal issues.

Key audit findings

FaCS governance of portals (Chapter 2)

The ANAO found that responsibility for departmental structures and budgets relating to the FaCS portals and The source website were at an appropriate level. FaCS has developed its three portals to meet the basic level of functionality as required by the Government. However, FaCS' business case for the development of the portals identified costs but did not identify any benefits accruing to FaCS from providing the portals. The lack of a robust business case for the FaCS portals means there is no basis for a business driver for further developments.

The implementation of the Government's portal policy did not include funding to agencies to develop and maintain the portals. At the commencement of the audit, the Families portal had no staffing resources allocated. As well, the department's Business Planning and Resource Allocation Committee (BARAC) had not approved funding bids for further development of all portals on the basis that other departmental priorities were more important. The ANAO considers it would be appropriate for FaCS to develop a sound business case for further portal developments, which would also be useful for performance management.

The ANAO found that, following allocation of responsibility for oversight of portal development to the Ministerial and Communications Branch (MCB) in November 2002, the Branch had commenced developing a framework for the operation of the portals. MCB was also developing a broader framework, the eCommunications Strategic Framework, which was intended to cover electronic and traditional communications, together with online marketing. At the time of the audit, both frameworks were still under development.

The absence of a completed eCommunications Strategic Framework meant that FaCS did not have agreed development plans for the portals. As well, allocation of responsibilities between MCB and other branches with responsibility for portal content was unclear.

The ANAO noted that potential audits of FaCS portals and Internet use were included in FaCS Internal Audit program. However, as the potential audit of FaCS portals was one of a group of several possible information technology audits, and the group was 37th on the priority list of audits, it was unlikely to be an early item for action.

Measuring efficiency and effectiveness of FaCS portals (Chapter 3)

The ANAO found limited measures of effectiveness, (that is, whether the portals were achieving their objectives) or efficiency (that is, comparison of benefits achieved compared with resources utilised in developing and maintaining the portals). Basically, the only measure used by FaCS is the numbers of users accessing the websites. FaCS has not identified any targets or measures of success for the portals. Surveys of users are not undertaken. However, entries by users in the ‘Talk It Up'³ feature of The source provided some indication of the popularity of the site.

Creating a website on the Internet does not automatically guarantee its discovery by the target audience. The site must be discoverable by search engines and marketed to relevant customers. The ANAO found that FaCS' portals and The source were appropriately discoverable by various search engines.

The ANAO also found that marketing had taken place for all these websites. However, the Families and the Community portals had limited funding and hence limited marketing. Both produced offline media and advertising products (for example mouse mats and bookmarks) for distribution at relevant events and to libraries. The Youth portal and The source had significantly greater funding, albeit that funding is now being reduced. The greater funding allowed The source to be advertised in youth magazines and on buses, as well as to pay for search engine optimisation. However, FaCS has no measures in place to determine the success, or otherwise, of its marketing strategies.

FaCS Management and control of Internet portals (Chapter 4)

Quality and currency of information

The ANAO found that there was no formal quality assurance process for content placed on FaCS portals or on The source website. The ANAO identified a number of FaCS guidelines for operational processes relating to management and control of content and structure of websites and the portals. However, while the FaCS portal managers normally obtained agreement from more senior officers for links or information of a contentious nature, each portal manager, while working within an approved linking policy framework, was solely responsible for updating the content of the sites with no independent check on the quality of the work.

The ANAO noted that the Youth portal was not updated for several months before being withdrawn in August 2003. The Families portal had limited updates for several months. In contrast, the Community portal and The source remained current throughout the audit.

Security

While a security threat and risk analysis of FaCS portals was undertaken using consultants in March 2002, specific action to address the risks identified took some time and was incomplete in November 2003, some 20 months after the initial threat and risk analysis report.

The ANAO also found it was unclear who had responsibility for action on the consultant's recommendations, or, more generally, for the enforcement of security policies and practices relating to the portals. In November 2003, FaCS advised the ANAO that the Information and Communications Technology Committee (ICTC) was the responsible body for overall ICT security, and that the ICT security section is able to enforce security policies and practices. FaCS also advised the ANAO that the role of the Director of that section was being reviewed.

Electronic records

The ANAO found that FaCS lacked documented policies and procedures for retaining records of changes to portals and The source. While FaCS does keep records of changes to its portals and The source, FaCS' retention of records in electronic form does not fully meet the legislative requirements of the Archives Act 1983.

The ANAO has recently completed an audit of record– keeping in several agencies, including FaCS.⁴  FaCS' response to this report was that it was seeking to improve its record-keeping policies, systems and procedures in line with the recommendations in the report. Those recommendations are applicable to the electronic records of the portals and The source. Therefore, the ANAO has not repeated them in this audit report.

Privacy and legal

FaCS has developed a compliance checklist for its website ‘owners'⁵ to complete. The checklist addresses privacy, security, accessibility and legal approvals, amongst other issues. At the time of the audit fieldwork, the checklist had only been completed for the Community portal. Following the ANAO's request, checklists were subsequently completed for the Families portal and The source.

FaCS' internal Administrative Law Unit has conducted a review of the portals and The source against the Federal Privacy Commissioner's guidelines to check compliance with the guidelines.

However, the ANAO found that a legal threat and risk analysis of FaCS' portals and The source had not been completed at the time of audit fi eldwork. The ANAO considers the ‘Talk It Up' feature of The source to be a particular risk. FaCS advised the ANAO that a legal threat and risk analysis of The source was subsequently conducted late in 2003.

FaCS use of Metadata and the NOIE repository

The ANAO found that FaCS was using metadata⁶ appropriately on its own portals.

The National Office for the Information Economy (NOIE) is responsible for the Federal Metadata Repository. Each week NOIE harvests metadata information from over 700 Australian Government sites. The information is then placed in the repository so that it is available for agencies to download. The intention is that agencies will be able to extract from the repository links to government agencies relevant to the client or customer group being targeted. The ANAO found that, of the three FaCS portals and The source, only the Families portal was using the NOIE repository to extract information. However, in extracting this information, a high level of manual input was required before the metadata created by site owners could be used on the portal.

Overall audit conclusions

The ANAO concluded that, in response to the Government's directive, FaCS had developed basic portals. However, at the time of the audit, the portals were in a static phase with no further development planned and no funding was available to undertake any such development.

The ANAO concluded that FaCS should consider developing a robust business case or business drivers to take the portals beyond the basic requirements identified by the Government. In the absence of identified business drivers, FaCS has placed low priority on the further development of the portals. Whilst funding and other resources for basic maintenance were made available (with the exception of the Youth portal which was discontinued during the audit), provision of further funds and resources is not currently considered to rank highly against competing departmental priorities.

Recommendations

The ANAO made five recommendations for improvements to FaCS' management of its Internet portals. At the conclusion of the audit, FaCS advised that it had begun to address all of these recommendations. However, FaCS also advised the ANAO that full implementation of the recommendations is dependent on the allocation of additional funding, and that decisions on funding of the portals must take place against FaCS' overall priorities. The latter is FaCS' management prerogative but must be fully informed by appropriate information and analysis.

Agency response

FaCS welcomes the audit and its recommendations. A governance framework is currently being developed that will improve decision-making about resources and development, incorporate strategies for measuring the efficiency and effectiveness of the portals and provide Portal Owners with the tools to manage the portals effectively.

FaCS notes that all work associated with the portals, including the development and implementation of the governance framework, must be funded from existing agency resources. Improvement to the portals will therefore take place within the context of FaCS overall strategic direction and priorities.

FaCS also notes that the Portals are treated by FaCS as a referral service rather than one which would invite any substantial level of interaction with users. This is an important distinction between the FaCS portals and The source (which the report uses as a comparison site for the portals) and perhaps other government portals.

Footnotes

1 FaCS Annual Report 2002–03, Volume 1, p.20.

2 www.thesource.gov.au

3 ‘Talk It Up' is a forum where registered persons are allowed to put their views on the website and discuss topics with other registered users.

4 The ANAO has recently completed an audit of record– keeping in several agencies, including FaCS.4 FaCS'

6 Metadata is sometimes defined literally as ‘data about data,' but the term is normally understood to mean structured data about resources that can be used to help support a wide range of operations. These might include, for example, resource description and discovery, the management of information resources and their long-term preservation. [Source Michael Day, UKOLN, Available: http://www.ukoln.ac.uk/metadata/publications/nutshell.