Introduction

Government regulators

1.1 The Organisation for Economic Co-operation and Development (OECD) has observed that:

Regulation is a key tool for achieving the social, economic and environmental policy objectives of governments that cannot be effectively addressed through voluntary arrangements and other means. Governments have a broad range of regulatory powers reflecting the complex and diverse needs of their citizens, communities and economy.

Regulators are entities authorised by statute to use legal tools to achieve policy objectives, imposing obligations or burdens through functions such as licencing, permitting, accrediting, approvals, inspection and enforcement. Often they will use other complementary tools, such as information campaigns, to achieve the policy objectives, but it is the exercise of control through legal powers that makes the integrity of their decision-making processes, and thus their governance, very important.⁶

Regulator governance

1.2 The OECD has further observed that:

Strong governance strengthens the legitimacy and integrity of the regulator, supporting the high level policy objectives of the regulatory scheme and will lead to better outcomes.⁷

1.3 The OECD has identified two broad aspects of governance relevant to regulators:

• external governance (looking out from the regulator) — the roles, relationships and distribution of powers and responsibilities between the legislature, the minister, the ministry, the judiciary, the regulator’s governing body and regulated entities; and
• internal governance (looking into the regulator) — the regulator’s organisational structures, standards of behaviour and roles and responsibilities, compliance and accountability measures, oversight of business processes, financial reporting and performance management.⁸

1.4 The OECD has described these components of external and internal governance as the ‘different building blocks that make up the governance architecture of regulators’.⁹

Duties of Australian Government officials

1.5 The Australian Government’s overarching governance framework for public entities, including its regulatory agencies, is established by the Public Governance, Performance and Accountability Act 2013 (PGPA Act) and the supporting Public Governance, Performance and Accountability Rule 2014 (PGPA Rule).

1.6 The PGPA Act contains general duties for entity accountable authorities and officials which are relevant to probity and ethics.¹⁰ These duties are not restricted to resource management functions, as the objects of the PGPA Act (and its overview section) make clear that the Act is concerned with entity governance, performance and accountability more broadly (see Box 1 below).

1.7 The requirements of the PGPA Act and PGPA Rule, including the general duties of entity officials, may extend to persons who are not entity employees (such as contractors) if they are considered to be entity officials under the Act. Contract provisions may also extend PGPA Act and PGPA Rule requirements (and elements of the Public Service Act 1999 (PS Act), discussed below) to persons who are not entity employees.¹¹

1.8 As at 6 March 2023 there were 189 PGPA Act entities and companies.¹² The duties of entity accountable authorities and officials under the PGPA Act are summarised in Box 2 below.

Probity

1.9 Taken together, the general duties establish an overarching framework for probity and ethical behaviour applying to the officials of PGPA Act entities.

1.10 The Australian Government Department of Finance (Finance), which administers the PGPA Act and PGPA Rule and is the framework policy owner, has not included a general definition of probity in its PGPA Glossary.¹³ Finance has, however, adopted the following definition of probity in the procurement context:

Probity is the evidence of ethical behaviour, and can be defined as complete and confirmed integrity, uprightness and honesty in a particular process.¹⁴

1.11 While intended to inform those involved in procurement activity, this definition of probity is sufficiently robust to describe the general expectation applying to Australian Government activity more broadly, including regulatory activity.

1.12 The specific probity and ethical requirements applying to the personnel of an Australian Government entity will depend on what type of entity it is, the legislation applying to it, the government policies and frameworks applying to it, and the internal policies and frameworks it has put in place. In summary.

• Whether the entity is a non-corporate Commonwealth entity or a corporate Commonwealth entity¹⁵ under the PGPA Act, will determine which elements of the framework established by the PGPA Act and PGPA Rule will apply to the entity. In particular, entity type will affect whether certain activity-specific frameworks apply to an entity.
  • Activity-specific frameworks can establish ethical and probity requirements specific to the activity they regulate, and cover grants administration¹⁶, government procurement¹⁷, government advertising¹⁸, protective security¹⁹, appearing before the Parliament²⁰, liaising with lobbyists²¹, caretaker conventions²², risk management²³ and fraud control.²⁴ These frameworks will generally specify which types of entities they cover and may also place specific obligations on the accountable authority, such as to promote an internal culture supportive of the purposes of the framework.18F²⁵196F
• Entities established under legislation are statutory bodies and will also be subject to the requirements of that legislation. The entity’s enabling legislation may include specific ethical obligations applying to the accountable authority and/or entity staff. Individual statutory offices are also established through legislation, which may include ethical requirements.
• Other applicable legislation may place further ethical and probity requirements on the entity. Examples include anti-corruption legislation²⁶ and corporations law requirements. As at 6 March 2023, there were 17 Commonwealth controlled companies subject to the Corporations Act 2001.
• If the entity is subject to the PS Act²⁷, additional ethical and probity requirements apply to Australian Public Service (APS) employees, including the APS Values and APS Code of Conduct.²⁸
  • Section 10 of the PS Act sets out the APS Values. Subsection 10(2), ‘Ethical’, states that ‘The APS demonstrates leadership, is trustworthy, and acts with integrity, in all that it does.’ The APS Commissioner’s Directions (31 January 2022) made under the PS Act elaborate on the APS Values. Section 14 of the Directions sets out requirements to be met to uphold the ‘Ethical’ value, ‘having regard to an individual’s duties and responsibilities’. The requirements include: ‘acting in a way that models and promotes the highest standard of ethical behaviour’, ‘complying with all relevant laws, appropriate professional standards and the APS Code of Conduct’ and ‘acting in a way that is right and proper, as well as technically and legally correct or preferable’. Section 12 of the PS Act provides that an APS Agency Head ‘must uphold and promote the APS Values and APS Employment Principles’.
  • Australian Public Service Commission (APSC) guidance highlights that integrity covers several different and overlapping aspects that relate to conduct and how APS employees work individually and collectively. Integrity includes: compliance with legislative frameworks, policies and practices, and ensures standards for integrity are being met; a values-based approach that promotes ethical decisionmaking; institutional integrity, where organisational systems, policies and practices are purposeful, legitimate and trustworthy; and a pro-integrity culture, in which there is a positive, conscious effort to make integrity a central consideration of all activities.²⁹
  • A number of specific probity requirements apply to APS Senior Executive Service (SES) employees and/or APS agency heads.³⁰ These include the declaration of interests³¹ and the declaration of gifts, benefits and hospitality.³²
• Entity-specific frameworks include an entity’s internal policies and guidance in respect of implementing applicable laws and frameworks. Examples include Accountable Authority Instructions (AAIs) made under the PGPA Act³³, and internal integrity frameworks. Entityspecific frameworks may sometimes establish higher expectations than the minimum standards established by whole-of-government policy owners such as Finance. Professional codes and standards may also apply to entity personnel working in certain sectors or roles. The need for such codes and standards may be specified in legislation applying to the entity.

The accountable authority’s role in promoting probity

1.13 As discussed in paragraph 1.6, the PGPA Act places a number of duties on an entity’s accountable authority. As discussed in paragraph 1.12, other applicable frameworks will also place obligations on entity leaders, such as the promotion of an appropriate culture. The ANAO has previously observed that in order to fulfil its governing role in relation to probity, the accountable authority would be expected to set out roles and reporting within the entity, approve and review probity policies, ensure it is informed about the entity’s activities, act on information promptly, and take an active role when working with management.³⁴

The Australian Securities and Investments Commission

1.14 The Australian Securities and Investments Commission (ASIC) is an independent statutory authority. It was established under and administers the Australian Securities and Investments Commission Act 2001 (ASIC Act), and carries out most of its work under the Corporations Act. In ASIC’s Corporate Plan 2022–26, ASIC describes its role as being ‘Australia’s corporate, markets, financial services and consumer credit regulator.’³⁵

1.15 ASIC is a non-corporate Commonwealth entity for the purposes of the PGPA Act. It is one of three entities that have body corporate status but are prescribed in their enabling legislation as non-corporate Commonwealth entities.³⁶ Unlike most non-corporate Commonwealth entities, ASIC does not engage employees under the PS Act but instead engages employees under section 120 of the ASIC Act.

1.16 ASIC is comprised of Commissioners who are appointed by the Governor-General on the nomination of the Treasurer.³⁷ The ASIC Chair³⁸ is the accountable authority of ASIC and is responsible for determining the ASIC Code of Conduct and the ASIC Values under sections 126B and 126C of the ASIC Act respectively. Under ASIC’s governance framework, there is a separation of decision-making powers relating to regulatory functions and governance matters. ASIC distinguishes between Commission committees that are comprised of the Commissioners (including the ASIC Chair and Deputy Chairs) and management committees that are comprised of the ASIC Chair and senior executives.

Oversight arrangements

1.17 ASIC is subject to a range of oversight arrangements. These include the following.

• The Australian Commission for Law Enforcement Integrity (ACLEI).³⁹ ASIC came under ACLEI’s jurisdiction on 1 January 2021.⁴⁰
• The Financial Regulator Assessment Authority (FRAA). The FRAA was established in 2021 in response to recommendations of the 2019 Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry (the Hayne Royal Commission).⁴¹ The FRAA’s role is to assess and report on the effectiveness and capability of ASIC and the Australian Prudential Regulation Authority.⁴²

1.18 ASIC is also subject to oversight by the Parliamentary Joint Committee on Corporations and Financial Services, which is established under section 243 the ASIC Act. Recent reports by the Joint Committee have included consideration of ASIC’s governance framework⁴³ and integrity risks, including ASIC’s integrity and anti-corruption arrangements, regulatory capture risks and other integrity risks.⁴⁴ Other parliamentary committees that have undertaken inquiries into ASIC and its operations include the House of Representatives Standing Committee on Economics⁴⁵ and the Senate Standing Committee on Economics.⁴⁶

Thom review

1.19 In October 2020 the Department of the Treasury (Treasury) appointed Dr Vivienne Thom AM to undertake a review related to financial statements audit findings made by the ANAO regarding payments to ASIC key management personnel, as well as related governance matters. The final confidential report was provided to Treasury in December 2020 and an abridged report was prepared by Treasury in consultation with Dr Thom and released publicly in January 2021. The abridged version removed legal advice and personal and commercial information.

1.20 The abridged report included eight recommendations relating to corporate governance and accountabilities, internal monitoring and oversight arrangements (including for audit, risk and integrity), and policies relating to the payment of Commissioner expenses and related controls. Five of the recommendations were directed to ASIC and three were directed to the Treasury. ASIC accepted all recommendations directed to it.⁴⁷ In a statement accompanying the release of the abridged report, the Treasurer stated that: ‘Given the nature of the matters raised, the Government expects ASIC to implement as a priority the recommendations made by Dr Thom concerning its internal risk, management and governance arrangements and to report to me regularly on its progress.’⁴⁸

Rationale for undertaking the audit

1.21 It is essential that financial regulators uphold high probity standards, to strengthen the legitimacy and integrity of the regulator and support the objectives of the regulatory scheme.

1.22 This is one of a series of three performance audits which continues the ANAO’s examination of probity management in Commonwealth entities and provides independent assurance to the Parliament. It builds on Auditor-General Report No. 21 2019–20 Probity Management in Rural Research and Development Corporations, which assessed the effectiveness of five rural research and development corporations’ management of probity.

1.23 This series of audits focuses on probity management in entities with a role in financial regulation activities. These are the:

• Australian Competition and Consumer Commission (ACCC);
• Australian Prudential Regulation Authority (APRA); and
• Australian Securities and Investments Commission (ASIC).

Audit approach

Audit objective, criteria and scope

1.24 The audit objective was to assess the effectiveness of ASIC’s probity management.

1.25 To form a conclusion against the objective, the ANAO adopted the following high level criteria:

• Does ASIC have arrangements structured to manage selected probity risks and promote compliance with requirements?
• Has ASIC established monitoring and reporting arrangements to provide assurance on the effectiveness of internal controls and compliance with probity requirements?
• Has ASIC complied with probity requirements?

1.26 The audit scope was the period July 2020–November 2022 and where relevant, included key subsequent events up to and including February 2023. The ANAO did not examine specific investigations into ASIC personnel or review ASIC’s corporate governance arrangements.⁴⁹

Probity risks examined in this audit

1.27 The ANAO reviewed a selection of probity risks requiring management by Australian Government entities, including a number of specific risks requiring management by entities involved in financial regulation activities. The risks selected for review related to:

• the ASIC Code of Conduct;
• the management of conflict of interest;
• the management of key regulatory risks (such as regulatory capture risk and financial trading);
• the management of senior executive remuneration;
• probity in procurement;
• the oversight of corporate credit card expenditure;
• the management of gifts, benefits and hospitality;
• the identification and management of fraud risks; and
• the management of public interest disclosures.

Audit methodology

1.28 The audit methodology included reviewing entity documentation and meeting with entity personnel.

1.29 The audit was conducted in accordance with ANAO Auditing Standards at a cost to the ANAO of approximately $389,000.

1.30 The team members for this audit were Grace Guilfoyle, James Sheeran, Jo Rattray-Wood, Alexandra McFadyen and Michelle Page.

Disclosure

1.31 The ANAO engages ASIC to conduct an annual review of the ANAO Quality Assurance Framework and financial statements audit files, in a similar way to the review work conducted by ASIC on external auditors in the private sector. Safeguards are implemented to mitigate the threats to independence created by that relationship.

2.1 An entity’s accountable authority and management are responsible for establishing and promoting a culture of ethical behaviour within the entity. Identifying key probity risks and establishing, maintaining and promoting policies, procedures and arrangements to manage those risks helps ensure probity risks are being effectively managed in accordance with relevant requirements and consistent with community expectations.

2.2 This chapter examines whether ASIC has:

• identified key probity risks and developed policies, procedures and arrangements to manage the identified risks;
• ensured policies and procedures are maintained; and
• effectively informed relevant people of probity related requirements, to promote compliance.

Has ASIC identified key probity risks and developed policies, procedures and arrangements to manage the identified risks?

ASIC Code of Conduct and values statement

2.3 Changes introduced by the Treasury Laws Amendment (Enhancing ASIC’s Capabilities) Act 2018 meant that from 1 July 2019 ASIC employees were no longer engaged under the Public Service Act 1999 (PS Act) and were now engaged under the Australian Securities and Investments Commission Act 2001 (ASIC Act). This change also meant that ASIC employees were no longer subject to the Australian Public Service (APS) Code of Conduct and APS Values.⁵⁰

2.4 The ASIC Act requires the ASIC Chair to establish an ASIC Code of Conduct and the ASIC Values.⁵¹ The ASIC Chair has established an ASIC Code of Conduct and the ASIC Values as required by the ASIC Act.⁵² The Code of Conduct is available on ASIC’s intranet site.

2.5 The December 2022 ASIC Code of Conduct states that it applies to:

all ASIC employees, ASIC’s Commission, contractors, consultants, secondees and volunteers (team members) regardless of where the work is performed. This is in accordance with s126B(2) of the ASIC Act. [emphasis in original]

2.6 The code sets out the standards of behaviour ASIC expects from all team members and is intended to guide decision making at ASIC. It states that:

ASIC’s reputation for honesty and integrity is essential to our role as a conduct regulator, and our standing in the communities we serve …

Our Code of Conduct sets out expectations about how we interact with you, and how we are accountable for our actions.

It states our commitment to act with professionalism and integrity, and helps guide our people to make the right choices and decisions when performing their role.

2.7 The code identifies expectations in a range of areas, including:

• complying with laws and policies;
• protecting and properly using information and records;
• reporting wrongdoing;
• interacting with people internally and externally;
• acting with integrity;
• disclosing conflicts of interest; and
• acting responsibly with respect to gifts and hospitality.

2.8 The code states that failure to comply with the code may lead to disciplinary action up to and including termination of employment.

2.9 ASIC’s Code of Conduct training documentation states that the code ‘is not just a set of rules. It is the most important document we have for guiding people’s behaviour at ASIC.’⁵³

2.10 ASIC’s Risk Appetite Statements for 2021–22 and 2022–23 state that ‘ASIC has No Tolerance toward unethical, corrupt or illegal conduct, or behaviours that are inconsistent with the standards that are appropriate for ASIC as a regulator and consistent with the expectations of Parliament and the community.’ [emphasis in original]

Conflict of interest

2.11 ASIC has identified conflict of interest as a key probity risk and developed policies, procedures and arrangements to manage the identified risks.

2.12 ASIC has identified activities, actions and decisions that compromise its independence, as a risk to its effectiveness. For example, ASIC’s business unit risk register identifies the following risk relating to conflict of interest:

If conflicts of interest are not declared and appropriately managed, there is a risk of inappropriate decision/s or restricted or sensitive information being unintentionally used (whether actual or perceived) for an improper purpose. This may impact the integrity or effectiveness of regulatory investigations, decisions or outcomes and cause reputational harm.

2.13 As referenced in Box 2 in Chapter 1 of this audit, section 29 of the Public Governance, Performance and Accountability Act 2013 (PGPA Act) establishes a duty to disclose interests and requires officials of Commonwealth entities who have a material personal interest that relates to the affairs of the entity to disclose the details of the interest. The ASIC Act also establishes requirements around disclosure and the management of conflicts of interest.⁵⁴ The ASIC Code of Conduct states that:

Team members must avoid any real, potential or perceived conflict between their personal interests and their duties towards ASIC.

Team members must disclose any real, potential or perceived conflicts of interest including any outside employment or activities which may conflict with their role at ASIC.

2.14 To support the management of risks related to conflict of interest, ASIC has developed the following.

• A disclosure policy applicable to all Commission members, including the ASIC Chair — ‘Disclosure obligations of ASIC Commissioners, November 2021’.
• A conflict of interest policy for staff, secondees and ‘some consultants and contractors’⁵⁵ — ‘ASIC Conflicts of interest policy, March 2021’.⁵⁶

2.15 Together, these policies reference various obligations under the PGPA Act, ASIC Act and ASIC’s Code of Conduct. They address:

• the fundamental importance of integrity to ASIC’s effectiveness as a regulator and in preserving public confidence in its work;
• what constitutes an actual, potential or perceived conflict of interest;
• how to identify or avoid conflicts of interest;
• when and how conflicts are to be disclosed and recorded;
• how declared conflicts of interest are to be managed for different categories of people working for/with ASIC and factors to consider when managing a conflict of interest;
• specific situations such as secondments to and from ASIC, senior executives’ prospective future employment, and dealings with former ASIC senior officers; and
• specific arrangements for high risk operational and regulatory activities, procurement and gifts, benefits and hospitality.⁵⁷

2.16 ASIC has established a number of controls that stem from the Disclosure obligations of ASIC Commissioners and Conflicts of interest policies. ASIC Commissioners are required to submit a private declaration of interests as part of the appointment process. ASIC Commissioners are required to make a written disclosure of interests every six months at a minimum and have a requirement to report any changes as soon as reasonably practicable. Under the Disclosure obligations of ASIC Commissioners policy, a Commissioner who has a conflict of interest with a matter being considered by the Commission must not be present during consideration of, or a vote on, the matter. Exceptions to this requirement can occur when the remaining Commissioners agree.

2.17 Upon commencement at ASIC, everyone covered by the conflict of interest policy must read the policy, acknowledge they understand their obligations and make an initial conflict of interest declaration in writing. Everyone covered by the conflicts of interest policy must notify ASIC ‘as soon as you become aware that your Financial Interest or Other Interest, or a duty you owe to a person other than ASIC, conflicts, or may reasonably be thought to conflict, with the proper performance of your functions or duties at ASIC.’ ASIC’s arrangements for annual attestation of compliance with conflict of interest arrangements are discussed in paragraphs 4.7 to 4.20.

2.18 The staff conflict of interest policy states that once notified of a potential or actual conflict of interest, a staff member’s manager and Senior Executive will consider whether the individual’s interests or non-ASIC duties conflict, or may reasonably be thought to conflict, with the proper performance of their functions or duties at ASIC. The relevant Senior Executive (with the assistance of the staff member’s manager) is to ensure adequate and appropriate steps are taken to avoid or control any real, potential or perceived conflicts of interest.⁵⁸ When it is not possible to manage a conflict of interest, the policy states that ASIC may request an individual to take steps to remove the conflict.⁵⁹ ASIC advised the ANAO that details of any mitigation strategies are recorded in ASIC’s Enterprise Risk Management system.

2.19 Internal compliance with ASIC’s conflict of interest declaration requirements is discussed in Chapter 4 of this audit in paragraphs 4.7 to 4.21.

Key entity-wide risks relating to regulatory activities

2.20 The ANAO examined whether ASIC had identified regulatory capture risk and other key risks relating to its regulatory activities and established policies, procedures and arrangements to effectively manage those risks. The audit focussed on entity-wide policies, procedures and arrangements and not those that only applied to certain specific roles or activities.

2.21 ASIC had explicitly identified regulatory capture risk and established a range of controls to mitigate this risk. ASIC had also identified risks relating to its officials trading in financial instruments and information security.⁶⁰ ASIC has established policies, procedures and arrangements to manage these risks.

Regulatory capture risk

2.22 Maintaining independence is crucial for regulators to effectively perform their function. The 2019 Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry (the Hayne Royal Commission) stated that ‘the risk of regulatory capture is well acknowledged’.⁶¹ The Parliamentary Joint Committee on Corporations and Financial Services, in its 2019 report on Statutory Oversight of the Australian Securities and Investments Commission, the Takeovers Panel and the Corporations Legislation, stated that:

The committee considers that regulatory capture is a significant issue faced by Australian regulators generally, given the size and power of corporations that operate in Australia. ASIC faces particular risks due to the financial benefits to be gained by participants in the financial services sector and the close interaction of ASIC staff and the industry it regulates.⁶²

2.23 The committee defined regulatory capture as:

instances where regulators are excessively influenced or effectively controlled by the industry they are supposed to be regulating. There are three areas in which particular risks arise for regulatory capture:

• staff moving between industry and regulatory jobs;
• secondments; and
• where regulatory staff are embedded in private sector organisations (that is, required to conduct their work within the workplace of industry participants, away from their home base at the regulator).⁶³

2.24 The committee observed that:

embedded staff face increased risks of regulatory capture and corruption because of their proximity to those they regulate. ASIC informed the committee that it was aware of the risks and was taking precautions, including rotation between banks, limiting the amount of time away from ASIC, and ensuring the deployed staff are sufficiently senior. In addition, staff are also undergoing training, including examining case studies, to prevent regulatory capture in Australia.⁶⁴

2.25 In its report, the committee reproduced evidence of the ASIC Chair, who advised that: ‘Regulatory capture is a big issue for us.’⁶⁵

2.26 The need to maintain independence is reflected in ASIC’s Statement of Expectations and Statement of Intent.⁶⁶ No mention is made in either regarding the risk of regulatory capture.

2.27 The Public Governance, Performance and Accountability Rule 2014 (PGPA Rule)⁶⁷ sets out requirements with which entities must comply in relation to their corporate plans. This includes that corporate plans include ‘a summary of the risk oversight and management systems of the entity, and the key risks that the entity will manage and how those risks will be managed’.⁶⁸ ASIC’s Corporate Plan 2022–23 provides a description of ASIC key risks but does not explicitly reference the risk of regulatory capture. It does include references to ensuring ASIC acts with integrity and is impartial in decision making. As noted in paragraph 2.6 of this audit, ASIC’s Code of Conduct sets out the standards of behaviour expected of ASIC team members.⁶⁹ This includes acting with integrity and behaving honestly and impartially when dealing with stakeholders.

2.28 ASIC’s risk appetite statement says that ‘ASIC has a Very Limited Appetite toward activities, actions and decisions that compromise its independence.’ Regulatory capture is also identified as a cause of risks to ASIC’s ‘perceived regulatory effectiveness’ in ASIC’s Enterprise Risk Profile. Controls relating to these risks include training on regulatory capture for staff in certain roles⁷⁰ and regular internal audits on regulatory capture.⁷¹

2.29 ASIC’s Chief Risk Office has identified that regulatory capture risk manifests widely at ASIC through its:

• licensing function (which ASIC considers high risk);
• misconduct and breach reporting function;
• supervisory functions (which ASIC considers high risk); and
• enforcement functions.

2.30 ASIC’s risk register includes three instances where the risk description includes reference to regulatory capture. In two instances the risk register lists ‘On-site supervisory staff are rotated between institutions, amount of time away from ASIC is limited and deployed staff are sufficiently senior to minimise potential for regulatory capture’ as a component of controls in place. ASIC documentation indicates that ASIC has established a range of controls, which are outlined in Figure 2.1.

2.31 The ANAO did not assess whether the identified risks relating to regulatory capture were effectively managed by ASIC.⁷²

2.32 In November 2019 the Commission approved an internal audit considering regulatory capture as part of ASIC’s two-year audit plan for the 2020 and 2021 calendar years. The audit was deferred and was added to the rolling internal audit plan for 2021 and 2022, which was approved by the Commission in March 2021. The 2021 internal audit plan provided for audits or reviews on regulatory capture every two years. During the period subject to this ANAO audit, ASIC engaged a consulting firm to conduct the planned internal audit. The internal audit assessed the effectiveness of selected ASIC arrangements to mitigate the risk of regulatory capture in its Financial Reporting and Audit (FR&A) area.⁷³ The internal audit concluded that ASIC’s FR&A team had a range of embedded controls that mitigated the risk of regulatory capture and a number of positive practices were observed.⁷⁴ Three opportunities for improvement were also identified.⁷⁵

2.33 The Parliamentary Joint Committee on Corporations and Financial Services has identified regulatory capture as a significant issue faced by Australian regulators, and the attendant risks have been acknowledged by ASIC. Given the significance of the risk, there would be benefit in ASIC addressing regulatory capture risk and its management, in the entity corporate plan.

Restrictions on trading in financial instruments

2.35 In addition to general conflict of interest risk (discussed in paragraphs 2.11 to 2.19) and regulatory capture risks, ASIC has identified a specific entity-wide risk relating to ASIC officials (or others due to their work at ASIC) inappropriately gaining financial advantage by trading in financial products. ASIC has established a policy called ‘ASIC’s policy on trading in financial products’ dated July 2022 (the 2022 trading policy)⁷⁶ and established procedures and arrangements designed to manage this identified risk.

2.36 The 2022 trading policy references ASIC’s Code of Conduct, which requires ASIC commissioners and staff to:

(a) not use ASIC Information, including inside information for an improper purpose, or to obtain an improper personal benefit or potential benefit for yourself or others; and

(b) to disclose and avoid situations in which there is an actual or perceived conflict between their personal interests and their duties towards ASIC.

2.37 The 2022 trading policy applies to Commissioners, staff members, secondees, ‘some consultants and contractors’ and ‘connected persons’.⁷⁷ The policy applies to ‘Division 3 financial products’⁷⁸, exchange-related financial products⁷⁹ and involvement in initial public offerings.

2.38 The policy imposes restrictions on trading in order to mitigate the risks of financial gain. Specifically, people subject to the policy may only trade if:

• the trade does not give rise to a perceived or actual conflict with their position and duties at ASIC;
• the trade meets the requirements of the 2022 trading policy;
• approval is obtained prior to trading and the trade is ordered within two business days of the approval; and
• the trader confirms the trade was placed or executed within three days of receiving approval.⁸⁰

2.39 The 2022 trading policy allows for waivers from having to comply with the policy in limited circumstances.⁸¹ The policy also enables the applicable person or their connected person to trade in an exchange related financial product that is on ASIC’s ‘Restricted Entity List’⁸² in exceptional circumstances.⁸³ ASIC’s ‘Guide to ASIC’s policy on trading in financial products’ dated 2021 requires employees to ‘inform Security Services that permission to trade an Exchange Related Financial Product on the Restricted Entity List has been granted and any conditions that apply to that permission’. ASIC advised the ANAO that there were no waiver notifications received by ASIC Security Services during 2021–22. ASIC further advised that as of 12 February 2023 there had been one notification for 2022–23, and that this waiver was granted on the basis that the staff member did not have a material conflict of interest in relation to the financial product.

2.40 ASIC provided the ANAO with details regarding the number of approvals to trade made during 2021–22 and trading by Commissioners and Senior Executives. The summaries are set out in Table 2.1 and Table 2.2.

Table 2.1: Approvals to trade in 2021–22

Note a: The staff figure is based on average full-time equivalent staff from the 2021–22 annual report and does not include contingent workers or contractors.

Source: ASIC documentation.

Table 2.2: Trading by ASIC Commissioners and Senior Executives in 2021–22

Note a: This represents approximately four per cent of the number of ASIC staff who submitted trade requests (360) and less than one per cent of the total number of ASIC Commissioners and staff.

Note b: This represents three per cent of the number of requests for approval to trade in 2021–22 (2816).

Source: ASIC documentation.

2.41 Under the conflict of interest policies, applicable persons must summarise and declare their holdings and any trading of Division 3 Financial Products when commencing at ASIC (see paragraph 2.17). ASIC’s arrangements for annual attestation of compliance with conflict of interest arrangements are discussed in Chapter 4 of this audit in paragraphs 4.7 to 4.20.

Information security

2.42 Collecting, analysing, sharing and storing sensitive and confidential information is necessary for ASIC to exercise its regulatory functions. ASIC’s intranet has ‘Share Everything You Can’ guidance, which outlines key operating principles regarding sharing information required to undertake ASIC’s core regulatory functions while ensuring the ‘need to know’ principle is adhered to.

2.43 ASIC’s security risk profile includes five ‘key risks’, one of which is ‘unauthorised release of sensitive or classified information.’ ASIC’s Executive Risk Committee receives regular security reporting that includes reporting on information security⁸⁴, which includes data on the number of instances of USB-writing⁸⁵, remote printing, and information security incidents reported through ASIC’s Enterprise Risk Management system.⁸⁶

2.44 ASIC’s security policy requires ASIC personnel who are leaving a ‘security sensitive position’ to participate in a security debrief. The debrief covers:

• return of assets and information; and
• ongoing non-disclosure, confidentiality, privacy and reporting obligations.

Senior executive remuneration

Entity policy

2.45 A senior executive remuneration policy contributes to the management of probity within an entity by introducing transparency in the remuneration setting process. Having the accountable authority establish and approve remuneration policies also enables the accountable authority to influence behaviour and can be an important mechanism in communicating the desired culture within the entity.

2.46 At the time this audit commenced (March 2022) ASIC did not have a policy that set out remuneration requirements in relation to its senior executives. The ASIC Commission approved a remuneration policy for senior executives on 9 November 2022.

Government policy

2.47 Probity requirements for the personnel of Australian Government entities include compliance with applicable laws and government policies.⁸⁷

2.48 In recent years the Australian Government has made decisions that impacted remuneration arrangements for senior executives in Australian Government entities. On 26 March 2020, the Australian Government announced that all remuneration increases for APS Senior Executive Service (SES) or equivalent employees (senior executives) would be suspended across the Commonwealth public sector in response to the COVID19 pandemic.⁸⁸ On 25 June 2021, the Australian Public Service Commission (APSC) announced the end of the pause on all remuneration adjustments for senior executives.⁸⁹ ASIC records indicate that it applied the March 2020 remuneration pause to its senior executives and there were no pay increases for the 2019–20 financial year.

2.49 In August 2021 the APSC released Performance Bonus Guidance applicable to all Commonwealth entities and companies. The guidance stated that:

Commonwealth entities and companies should exercise rigour and restraint in the use of performance bonus payments … Performance bonuses may only be used in limited circumstances, justifiable to the Parliament and the public … As a general principle, most positions should not be eligible to earn a performance bonus. For instance, performance bonuses would not be appropriate in most policy, service delivery, regulatory, or corporate roles … Commonwealth entities and companies should avoid the broad use of performance bonuses.⁹⁰

2.50 In August 2021, following the lifting of the pause in June 2021, the Commission approved: a 1.7 per cent across the board remuneration increase to all eligible senior executives⁹¹, backdated to 1 July 2021; and payment of performance bonuses to senior executives as provided for in their employment contracts for the 2020–21 performance cycle.⁹² ASIC documents indicate that ASIC consulted with other regulators (including the ACCC and APRA) and the APSC prior to approving the pay rise. ASIC documentation stated that: ‘We consider the modest remuneration increase and payment of bonuses aligns with government policy. We do not consider that there is risk in making such a payment.’⁹³

2.51 In October 2021 the Chair approved that performance bonuses be rolled into senior executive pay. ASIC documentation outlines the principles ASIC adopted for rolling in bonuses.⁹⁴ There is documentation that the ASIC Chair was provided with details of remuneration arrangements for the eligible cohort. See Chapter 4 of this audit (paragraphs 4.22 to 4.29) for further details.

2.52 In August 2022 the ASIC Chair approved a pause on further pay increases to senior executives. ASIC documentation indicates this was due in part to APSC guidance recommending entities should not implement pay increases for senior executives where those adjustments rely on the Wage Price Index. ASIC documentation indicates that ASIC’s senior executive pay increases do not rely on the Wage Price Index provisions however ASIC considered ‘the APSC advice [was] a useful gauge of the current government sentiment on pay adjustments’ and this was one of the reasons given for not providing pay increases for senior executives.

2.53 On 6 October 2022 the Australian Government released the Public Sector Interim Workplace Arrangements 2022, which replaced the Public Sector Workplace Relations Policy 2020. The interim arrangements operate from 1 September 2022 until 31 August 2023. They apply to APS and nonAPS Australian Government entities and Members of Parliament staff. The arrangements also apply to SES and equivalent employees. The interim arrangements provide for a one-off annual remuneration increase of three per cent for Commonwealth employees.

2.54 On 27 October 2022 the ASIC Chief Operating Officer (COO) advised staff that the ASIC Chair and Commission endorsed a three per cent pay increase across the board effective from 10 November 2022, in line with the Australian Government’s Public Sector Workplace Relations Interim Arrangements 2022. See Chapter 4 of this audit (paragraphs 4.22 to 4.29) for further details.

Procurement

2.55 ASIC has identified key probity risks related to procurement and has developed policies, procedures and arrangements to manage the identified risks.

2.56 Under the PGPA Act, the Finance Minister issues the Commonwealth Procurement Rules (CPRs) for officials to follow when performing duties in relation to procurement. The CPRs govern how entities buy goods and services and state that procurements should:

use public resources in an efficient, effective, economical and ethical manner that is not inconsistent with the policies of the Commonwealth.⁹⁵

2.57 The CPRs define the terms ‘efficient’, ‘effective’, ‘economical’ and ‘ethical’, and state that:

Ethical relates to honesty, integrity, probity, diligence, fairness and consistency. Ethical behaviour identifies and manages conflicts of interests, and does not make improper use of an individual’s position.⁹⁶

2.58 Under the CPRs, ethical behaviour includes:

• recognising and dealing with actual, potential and perceived conflicts of interest;
• dealing with potential suppliers, tenderers and suppliers equitably, including by seeking appropriate internal or external advice when probity issues arise, and not accepting inappropriate gifts or hospitality;
• carefully considering the use of public resources; and
• complying with all directions, including relevant entity requirements, in relation to gifts or hospitality, privacy and security.⁹⁷

2.59 ASIC’s procurement policies identify that ASIC is required to comply with the CPRs. ASIC has policies and guidance specific to probity in procurement, which establish a risk-based approach to determining the level of probity management required for a procurement.⁹⁸ The probity risk assessment includes consideration of the estimated value of the procurement as well as ‘probity risk factors’ including complexity, sensitivities relating to ASIC’s core business⁹⁹, criticality to ASIC achieving its objectives, market competitiveness and supply chain complexity. Where one of the probity risk factors applies, ASIC’s 2021 Probity Guideline requires the probity risk level be increased, depending on the value of the procurement. Procurements assessed as medium risk require a probity plan and an internal procurement advisor, while procurements assessed as high risk require a probity plan and an external probity advisor.

2.60 The ANAO’s assessment of ASIC’s compliance with probity requirements for a sample of procurements is discussed in Chapter 4 of this audit in paragraphs 4.30 to 4.40.

Corporate credit card expenditure

2.61 ASIC has identified the key probity risks related to corporate credit card expenditure and developed policies, procedures and arrangements to manage the identified risks.

2.62 Corporate credit cards (credit cards) offer a transparent, flexible and efficient way for Australian Government officials to obtain cash, goods or services to meet business needs. Australian Government policy requires non-corporate Commonwealth entities to pay expenses via a payment card where the payment is an eligible payment under $10,000.¹⁰⁰ The misuse of credit cards can expose an entity to risks such as waste and fraud. Instances of misuse and weaknesses in relevant entity controls attract considerable parliamentary and public interest and can cause reputational damage to affected entities and the Australian Government.¹⁰¹

2.63 ASIC issues credit cards to Commissioners and staff.¹⁰² The ANAO reviewed ASIC’s credit card policy, procedures and arrangements to assess whether they addressed selected risks associated with the use of credit cards. In particular, the ANAO examined whether ASIC’s policies, procedures and arrangements addressed:

• requirements for the issue of credit cards, including specifying cardholder obligations;
• expenditure approval requirements;
• acquittal requirements (including timing and documentation requirements and reviewer responsibilities); and
• requirements for the return of credit cards.

2.64 ASIC has a credit card policy (‘ASIC Finance Policy Corporate Credit Cards’ dated October 2022¹⁰³) that applies to all ASIC corporate credit cardholders and their delegates. ASIC also provides credit card related guidance on its intranet.

Requirements for the issue of credit cards including specifying cardholder obligations

2.65 ASIC’s credit card policy sets out the application process, which includes a requirement for the applicant to complete a mandatory corporate credit card e-learning module and agree to comply with the requirements of the policy. The policy also outlines the roles and responsibilities of cardholders.¹⁰⁴

Credit card expenditure limits

2.66 ASIC has established transactional and monthly limits on all ASIC credit cards. Different limits apply based on anticipated level of use and the role of the cardholders. For staff below the senior executive level, the limit is nominated by the cardholders’ supervisor as part of the process to obtain a credit card. The limits are listed in Table 2.3.

Table 2.3: ASIC corporate credit card limits

Source: ANAO analysis of ASIC documentation.

2.67 Under ASIC’s corporate credit card policy, Commissioners have a standing approval to use their corporate credit card for domestic travel, taxi fares when needing to work after hours and other miscellaneous expenditure up to a value of $5000. ASIC senior executives¹⁰⁵ have a similar standing approval for miscellaneous expenditure up to $500. On a case by case basis, ASIC Executive Directors can approve similar standing approval arrangements for senior executives who report to them.

Expenditure approval requirements

2.68 ASIC’s credit card policy provides guidance on what corporate cards can be used for. Staff are not able to approve their own credit card expenses. Expenditure approval must be provided by a PGPA financial delegate under section 23 of the PGPA Act and is separate from the acquittal process.

Approval arrangements for ASIC Commissioners

2.69 A corporate credit card holder’s expenditure is typically approved by their supervisor. For the role of the accountable authority there is a power imbalance as they do not have the equivalent of a supervisor. Previous ANAO audits have identified risks in relation to positional authority.¹⁰⁶ In Auditor-General Report No. 33 2015–16 Defence’s Management of Credit and other Transaction Cards, the ANAO observed that for review of credit card transactions to work effectively:

the reviewer must be in a position to exercise independent judgement … this means that they cannot be in a position which would constrain unreasonably their capacity to question transactions that appear inappropriate; for example, this may be difficult for a person junior to the cardholder … (paragraph 2.42).

2.70 The 2020 Thom review also highlighted risks related to positional authority when approving expenses for very senior personnel. The report stated that:

Clearly there are particular challenges that arise when subordinate officials are required to approve expenses for very senior statutory officers, particular for the Accountable Authority. These decisions can still be problematic, even if the approving official is very senior, for example, the CFO or COO … challenges arise for expenses that, while business expenses in nature, have sensitivities and can be subject to public scrutiny and criticism.¹⁰⁷

2.71 Recommendation 8 of the Thom review included the following elements, to manage positional authority issues related to expense approvals.

The review recommends that ASIC should:

• Require the Chair’s approval for the expenses of Commission members; and
• Require a Deputy Chair’s approval for the Chair’s expenses.¹⁰⁸

2.72 The final confidential report of the Thom review was provided to Treasury on 17 December 2020 and an abridged report, prepared for public release, was dated 28 January 2021.¹⁰⁹

2.73 Recommendation 8 of the Thom review was addressed by introducing the following processes involving ‘standing approvals’ in late 2020.

• Prior to November 2020 ASIC Commissioners were authorised to approve their own credit card expenses.
• In November 2020 the process was changed so that the Chair (or acting Chair as the accountable authority) issued a standing approval to Commissioners covering business expenses and domestic travel.
• The longest serving Commissioner then issued a standing approval for business expenses and domestic travel to the Chair.
• In February 2021 the Deputy Chair issued a standing approval for the Chair for certain business expenses.¹¹⁰

2.74 ASIC introduced its ‘Statutory Appointments Governance Framework: Remuneration, Expense and Relocation Policy’ in August 2021. This policy states that:

Expenses incurred by Commissioners that are outside of, or exceed, the thresholds set out in the Expenses Guide or Standing Approval require written pre-approval by the Chair, or in the case of the Chair, a Deputy Chair.

2.75 Elsewhere the policy outlines that one of the roles of the COO is to ‘approve any proposed corporate card expenditure by a Commissioner outside of any Standing Approvals’. This contradicts the approval arrangements introduced in November 2020. In the undated Commissioner Expenses and Benefits Guide, the COO is listed as the role required to approve Commissioner international travel itinerary. ASIC advised the ANAO that it is aware of the inconsistency and will correct it when the policy is next reviewed.

2.76 ASIC advised the ANAO that none of the executive assistants of the accountable authority had an active corporate credit card during the audit period. Executive assistants to other Commissioners had active credit cards during the period.

Acquittal requirements

2.77 ASIC’s credit card policy sets out acquittal requirements including timing, documentation requirements and roles and responsibilities of reviewers. The acquittal process for credit card transactions is undertaken online. Cardholders are required to submit acquittal documentation with sufficient information for the delegate to approve by a specified date — this includes all relevant approvals, tax invoices and receipts. If the cardholder has lost receipts or tax invoices, they must prepare a statutory declaration. Cardholders are not authorised to approve or acquit their own expenses. Reviewers, amongst other things, must sight and ensure that all supporting documentation has been saved on ASIC’s SharePoint site.

2.78 All instances of non-business use of a corporate credit card are a breach of the PGPA Act. An initial instance of personal use will result in a warning, a second instance will result in escalation to the cardholder’s senior executive or Commissioner, and a third instance will result in the cancellation of the card. This does not apply to coincidental private expenditure.¹¹¹

Acquittal arrangements for ASIC Commissioners

2.79 ASIC advised the ANAO that:

Up until October 2020 the ASIC Chair reviewed and approved the credit card acquittal for Commissioners … The CFO reviewed and approved the Chair’s credit card acquittal.

From November 2020 there was a change to the governance practices for credit card acquittals, such that all Commissioners’, including the Chair’s, credit card acquittals [were] reviewed and approved by the COO, while Executive Directors’ credit card acquittals [were] reviewed and approved by the CFO. In August 2022 this was changed to the COO reviewing and approving Executive Directors’ credit card acquittals and the CFO reviewing and approving Commissioners’ credit card acquittals.¹¹²

2.80 ASIC also advised the ANAO that Commissioner executive assistants’ credit card acquittals are reviewed and approved by the CFO.

2.81 The credit card policy includes escalation arrangements for identified non-compliance with acquittal requirements.¹¹³ In October 2022, following the release of ASIC’s revised credit card policy, ASIC’s CFO emailed all staff to advise of its release and details of key changes. The CFO also emailed ASIC executive assistants (EAs), stating that:

Finance recognises there is a power imbalance between the EA and the Senior Staff member. Whilst the EAs are not making any decisions on spending money, Finance do acknowledge that there are potential instances where EAs may need to query transactions or request evidence to appropriately complete the acquittal. It is important that EAs feel supported to undertake these activities. If you feel uncomfortable with any aspect of your duties or responsibilities in relation to approving the acquittals you can contact ASIC’s Integrity Risk Specialist for a confidential discussion and advice or you can make a report using Speak Up platform … In the meantime, EAs can also email the PGPA Finance Team … with any queries they may have in regards to the acquittal process or reach out to me directly.

Requirements for the return of credit cards

2.82 The policy outlines requirements when cardholders leave ASIC or go on extended leave¹¹⁴ and states that an employee’s final pay will not be released until all statements have been acquitted. The policy also states that cardholders who have not used their cards for more than 12 months will be requested to return their cards for cancellation and destruction and (as mentioned in paragraph 2.78) misuse of the card can result in it being cancelled.

Monitoring of credit card use.

2.83 The credit card policy states that:

• all cardholders are required to attest to their compliance with the policy as part of ASIC’s biannual PGPA Credit Card Compliance questionnaires;
• random audits of cardholder supporting documents and acquittals are undertaken on a regular basis;
• cardholders are required to repeat the credit card training module for any noncompliance with the policy within a reasonable time; and
• all breaches of the policy, including failure to complete the biannual PGPA Credit Card Compliance questionnaires, must be reported on ASIC’s Compliance Incident Management System.¹¹⁵

2.84 In September 2022 ASIC’s internal audit function conducted an assurance review of the credit card controls framework. The audit’s overall rating for the framework was ‘Needs Improvement (borderline Unsatisfactory)’ as ‘it identified that some key controls are ineffective at managing the risk within tolerance’. Four observations were made in the audit and management agreed to implement them.¹¹⁶ ASIC advised the ANAO in December 2022 that the ASIC Finance team had completed agreed actions for three of the four observations and detailed work was underway on the remaining observation (number two) which is due for completion from June 2023.

2.85 ASIC advised the ANAO in December 2022 that its PGPA Finance Compliance Team (PFCT) undertakes monthly monitoring and follow up of unacquitted corporate credit card transactions.¹¹⁷ ASIC further advised that:

The process for follow up in relation to Commissioner’s credit cards is … via a conversation with the PFCT and the Commissioner’s executive assistant where the acquittal has not been submitted by the [due date], or the executive assistant of the acquittal delegate (COO/CFO) where the acquittal has been submitted but has not been approved by the delegate by the [due date].

2.86 ASIC also advised the ANAO that:

• since August 2022, when the CFO became the acquittal delegate for Commissioners, the CFO will follow up directly with the Commissioner or the Commissioner’s executive assistant; and
• from December 2022, the PFCT will enhance its process to include a follow up email to the Commissioner’s executive assistant following the conversation.

2.87 ASIC’s compliance with credit card requirements is discussed in Chapter 4 of this audit in paragraphs 4.41 to 4.47.

Gifts, benefits and hospitality

2.88 ASIC has identified risks in relation to gifts, benefits and hospitality and has established policies, procedures and arrangements to manage the identified risks.

2.89 Section 27 of the PGPA Act states that an official must not improperly use their position to gain, or seek to gain, a benefit to themselves or another person. The giving or receiving of gifts, benefits and hospitality can create the perception that an official is subject to inappropriate external influence. Perceptions of this sort can give rise to reputational risks for public entities, including the legitimacy and integrity of regulators (discussed in paragraphs 1.2 and 1.3 of this audit report).

2.90 A policy for giving and receiving gifts, benefits and hospitality is an important element of a robust control environment and supports ethical conduct. The effective implementation of such a policy, which generally requires accurate disclosures by entity personnel, benefits from strong cultural settings within the entity, including the example set by senior leadership (‘tone at the top’).

2.91 ASIC has developed separate policies for Commissioners and staff on the receipt of gifts, benefits and hospitality. ASIC’s policy for Commissioners is contained in a policy titled ‘Disclosure obligations of ASIC Commissioners’ and the policy for staff is contained within ASIC’s Conflicts of interest policy. Both of these policies were discussed in the conflict of interest section of this audit (see paragraphs 2.11 to 2.19).

2.92 ASIC’s conflict of interest policy states that:

ASIC Staff should not accept any gifts, hospitality or benefits that give rise to a real (actual), potential or perceived conflicts of Interest. A conflict may arise because acceptance (either in a particular instance or cumulatively) may influence, the actions or decisions of ASIC Staff Members.

Generally, you must decline any gift, benefit or hospitality offered by a third Party in the course of, or related to, your work with ASIC.

However, ASIC recognises that in limited situations … it may be appropriate and in ASIC’s interest to accept benefits and hospitality, provided acceptance does not conflict with the proper performance of your functions or duties at ASIC, or give rise to any real or potential conflicts of Interest.

You must not improperly use your official position to seek or obtain a gift, benefit or hospitality for you or someone else.

2.93 ASIC’s ‘Disclosure obligations of ASIC Commissioners’ includes the same provisions as those quoted above. Both policies also outline:

• examples of gifts, benefits and hospitality;
• when it is appropriate to accept gifts, benefits and hospitality;
• declaration and approval requirements for accepting gifts, benefits and hospitality; and
• reporting requirements, including thresholds for reporting and what will be reported publicly on ASIC’s website.¹¹⁸

2.94 ASIC’s key requirements for managing gifts, benefits and hospitality are summarised in Table 2.4.

Table 2.4: ASIC’s gifts, benefits and hospitality arrangements

Note a: Cultural gifts are items of cultural or sentimental value for which a monetary value is difficult to assign.

Source: ANAO analysis of ASIC documentation.

2.95 ASIC’s compliance with gifts, benefits and hospitality requirements is discussed in Chapter 4 of this audit in paragraphs 4.48 to 4.64.

Identification and management of fraud risks

2.96 Section 10 of the PGPA Rule requires the accountable authority to take all reasonable measures to prevent, detect and deal with fraud relating to the entity.¹¹⁹ It lists six requirements relating to fraud risk assessments, fraud control plans, and mechanisms for preventing fraud.

2.97 ASIC has a ‘Fraud and Anti-corruption Policy’ dated November 2022 (November 2022 Fraud Policy) and a ‘2022–24 Fraud Control Plan’ released in July 2022. ASIC’s November 2022 Fraud Policy defines fraud as ‘dishonestly obtaining a benefit, or causing a loss, by deception or other means’ and states that: ‘At ASIC … we protect and promote integrity by preventing, detecting and responding to internal fraud and corruption risks’.

2.98 The November 2022 Fraud Policy and the Fraud Control Plan apply to ASIC members and staff.¹²⁰ The Commission Risk Committee (which includes the ASIC Chair as a member) approves the policy and Fraud Control Plan. ASIC’s Audit and Risk Committee is responsible for providing assurance to the Chair and the Commission on ASIC’s systems of internal control including fraud and corruption controls.

2.99 ASIC records indicate that in 2020–21 there was one internal allegation of fraud received or detected and in 2021–22 there was one external allegation of fraud received or detected. ASIC advised the ANAO in April 2023 that the external suspected fraud in 2021–22 was successfully detected (stopped) without financial loss.

2.100 The Fraud Control Plan sets out how ASIC prevents, detects and responds to fraud and corruption risks. The ANAO assessed whether ASIC’s fraud policy, plan and arrangements complied with section 10 of the PGPA Rule. Overall, as outlined in Table 2.5, ASIC has met the requirements of section 10.

Table 2.5: Fraud control requirements and ASIC compliance

Note a: At the highest level, ASIC identifies three primary categories of occupational fraud: asset misappropriation (which involves an employee stealing or misusing the employing organisation’s resources and which ASIC states occurs in the vast majority of fraud incidents); financial statement fraud schemes (in which the perpetrator intentionally causes a material misstatement or omission in ASIC’s financial statements, which ASIC states are the least common but costliest category of occupational fraud); and corruption, which includes offenses such as bribery, conflict of interest, and extortion (which ASIC states falls in the middle in terms of both frequency and financial damage).

Source: ANAO analysis of ASIC documentation.

Public interest disclosures

2.101 ASIC has established a public interest disclosure (PID) policy that is accessible to both ASIC officials and the public; has identified authorised officers; has training relating to PID available to ASIC officials; and provides PID guidance on its intranet and website.

2.102 The Public Interest Disclosure Act 2013 (PID Act) establishes a PID scheme where public officials ‘who suspect wrongdoing within the Commonwealth public sector can raise their concerns.’¹²¹ The PID Act ‘applies to Australian Government agencies, Commonwealth companies, public authorities and Commonwealth contracted service providers.’¹²² The purpose of the PID Act is to:

promote the integrity and accountability of the Commonwealth public sector by:

• encouraging and facilitating the making of disclosures of wrongdoing by public officials
• ensuring that public officials who make protected disclosures are supported and protected from adverse consequences relating to the making of a disclosure
• ensuring that disclosures are properly investigated and dealt with.¹²³

2.103 The kinds of conduct that disclosures can be made about include but are not limited to:

• a contravention of the law
• corruption
• perverting the course of justice
• maladministration
• an abuse of public trust
• falsifying scientific research
• wastage of public money, or
• conduct that is a danger to health, safety or the environment.¹²⁴

2.104 The PID Act sets out a range of obligations including those relating to the principal officer of each agency¹²⁵ and authorised officers.¹²⁶

2.105 The ANAO examined whether ASIC had:

• established a PID policy that was accessible to ASIC officials and the public;
• identified authorised officers;
• PID training available for staff; and
• provided PID related guidance on its intranet and website.

2.106 ASIC has a public interest disclosure policy. The policy is available on ASIC’s intranet and website so is accessible to both ASIC officials and the public. This policy includes information on:

• what is a public interest disclosure;
• what is disclosable conduct;
• who can make a public interest disclosure;
• protections under the PID Act;
• how to make a public interest disclosure;
• roles and responsibilities;
• what happens after a public interest disclosure is made;
• confidentiality requirements; and
• support arrangements.

2.107 A public interest disclosure can be made by current and former public officials including ASIC current or former staff (including temporary and contracted employees), ASIC Commissioners, and service providers contracted to ASIC (including their officers and employees). ASIC’s policy states that:

A person who is not a current or former public official may also be deemed to be a public official by an authorised officer if the authorised officer believes on reasonable grounds that the person has information that concerns disclosable conduct.

2.108 ASIC also provides guidance relating to public interest disclosures on its intranet. ASIC’s website includes a link to its PID policy and the email addresses to be used to make a disclosure to an authorised officer.

2.109 As of 27 March 2023, ASIC had 17 authorised officers. ASIC also has mandatory training related to PID as part of the compulsory modules and annual refresher course for staff (see Table 2.6 for details). There is no additional training related to PID for those appointed as authorised officers, however ASIC has a suite of guidance for authorised officers.

Were relevant policies subject to periodic review?

2.110 Periodic review of entity policies assists in ensuring they remain fit-for-purpose and address current risks. For the period examined as part of this audit, the ANAO examined whether relevant policies were subject to periodic review.¹²⁷

2.111 ASIC has established an Enterprise Policy Framework to provide a consistent approach to the design and review of ASIC’s internal policies. As part of this framework, ASIC maintains a policy register which includes a list of all current policies, the policy owner, the last review and last review approver. The policy owner is responsible for reviewing their policies every two years, in accordance with ASIC’s policy cycle process.

2.112 Over the period examined for this audit, relevant ASIC policies were reviewed and updated under the framework.¹²⁸

Does ASIC effectively inform its personnel of probity requirements and promote compliance?

2.113 The effectiveness of an entity’s arrangements for managing probity risks is dependent on personnel being effectively informed of the requirements with which they are required to comply. This can be done through, for example:

• the provision of training;
• making information on policies, procedures and arrangements addressing probity risks easily accessible to staff; and
• regular messaging from senior officers.

Training related to probity risks

2.114 ASIC has a suite of training relevant to the probity risks examined in this audit. ASIC launched a revised training program called the ‘Essentials Program’, which was rolled out between March and June 2022. This program consolidated 15 mandatory training modules into three.¹²⁹ ASIC staff, including senior executives, must complete all three Essentials modules annually.

2.115 For new starters, mandatory training must be completed within four weeks. In December 2022 ASIC’s Management Committee was provided with seven recommendations aimed at simplifying and improving contingent worker¹³⁰ completion of relevant mandatory training.¹³¹ These included that the completion of Module 1 and Module 2 from the ‘Essentials Program’¹³² would be mandatory for contingent workers, with annual recertification required by contingent workers who are engaged for longer than 12 months.

2.116 ASIC advised the ANAO that training is mandatory for Commissioners.¹³³ ASIC has additional mandatory training for staff with specific responsibilities, such as those undertaking procurement activity and those holding credit cards. Table 2.6 provides details of the training available for the probity risks examined in this audit.

Table 2.6: ASIC probity related training

Source: ANAO analysis of ASIC documentation.

2.117 ASIC tracks the completion of mandatory training for Commissioners, employees and contingent workers, and managers are responsible for ensuring their team members have completed the appropriate modules. Managers have a dashboard that displays the status of team members’ compliance with mandatory training requirements. ASIC advised the ANAO that: ‘Executive Directors receive individual reports on non-compliance (and can access data about their group’s completion of mandatory training via Learnhub).’ Learnhub is ASIC’s training management system.

2.118 The completion of mandatory training is also centrally monitored and included in quarterly people and development reports provided to the Executive Risk Committee, the Commission Risk Committee and the Management Committee.¹³⁴ As at 30 September 2022, ASIC reporting indicated that the Essentials Program Module 1 had a 99.33 per cent completion rate, Module 2 had a 98.50 per cent completion rate and Module 3 had a 96.89 per cent completion rate.

Accessibility of information on probity requirements

2.119 ASIC makes policies, procedures and information regarding arrangements to address probity risks available on its intranet. Often this information contained contact details for specialist staff who can provide assistance.

Messaging from senior officials

2.120 ASIC uses a range of channels for providing its personnel with information on probity requirements, including information on policy updates, reminders regarding obligations and senior officials’ expectations. These channels include:

• the ASIC Direct newsletter;
• the ASIC Daily newsletter;
• Commission updates; and
• email reminders to all staff.

3.1 An entity’s accountable authority is required to establish appropriate controls and maintain sufficient oversight to ensure internal controls operate as intended, to assist in mitigating probity related risks and promote compliance. Well-functioning assurance arrangements, including reporting to senior management, provide confidence that risks are being effectively controlled or identify when controls are ineffective or absent. Entities also need to ensure that instances of noncompliance are treated in a timely and appropriate manner in accordance with specified requirements.

3.2 This chapter examines whether ASIC has established monitoring and reporting arrangements to provide assurance on the effectiveness of internal controls and compliance with probity requirements. Specifically, the ANAO examined if ASIC has established a fit for purpose framework for:

• monitoring the effectiveness of internal controls relating to probity and providing assurance to the accountable authority;
• monitoring compliance with probity requirements, including regular monitoring and reporting; and
• following up on identified instances of non-compliance.

Is there a framework for monitoring the effectiveness of internal controls relating to probity and providing assurance to the accountable authority?

3.3 Information on the effectiveness of internal controls gives the accountable authority assurance regarding compliance with probity policies and the extent to which staff uphold standards of conduct. Section 16 of the Public Governance, Performance and Accountability Act (PGPA Act) requires the accountable authority of a Commonwealth entity to establish an appropriate system of internal control. Section 17 of the Public Governance, Performance and Accountability Rule 2014 (PGPA Rule) requires the accountable authority to establish an audit committee, the functions of which must include reviewing the appropriateness of the system of internal control. This would include coverage of oversight of the management of identified probity risks.

Internal audit

Review activity

3.4 ASIC advised its audit committee that as of February 2022 it was resourced to undertake approximately 15 internal audits and three advisory reviews each year. ASIC’s internal audit plan includes ‘cyclical audits and reviews’, through which ‘areas of key PGPA risk and other areas of very limited appetite’ are subject to audits or reviews on a set frequency. This includes audits and reviews of the following probity risks examined as part of this audit¹³⁵:

• PGPA compliance (credit cards, travel and gifts);
• procurement;
• regulatory capture; and
• conflict of interest.

3.5 Audits on each of these risks were undertaken during the period examined as part of this audit.

3.6 In addition to these cyclical audits and reviews, ASIC undertakes ‘one off’ audits, including on probity related topics. Examples during the period covered by this audit included:

• implementation of the five Thom Review recommendations directed to ASIC¹³⁶;
• payments to part-time statutory office holders;
• Australian Commission for Law Enforcement Integrity (ACLEI) alignment; and
• Commissioner expenses.

3.7 Internal audit reports are included as a standing agenda item at Commission Risk Committee and Executive Risk Committee meetings. The Commission Risk Committee is comprised of all ASIC Commissioners, including the ASIC Chair, who is the ASIC accountable authority. The Commission Risk Committee and Executive Risk Committee also receive updates on the status of audit recommendations at each meeting.

Oversight

3.8 Under the terms of reference of ASIC’s Audit and Risk Committee, the committee’s role is to review and provide advice to ASIC’s accountable authority on ASIC’s systems of risk oversight and management and system of internal control. As part of exercising this function, the Audit and Risk Committee receives updates on ASIC’s internal audit control framework, ASIC’s internal audit forward work program, completed internal audit reports and the status of open internal audit recommendations. ASIC also prepares dashboard reporting on key metrics relating to compliance with PGPA Act requirements that are provided to the Audit Committee each quarter. This includes reporting based on attestations made by senior executives relating to:

• reportable breaches of the PGPA Act;
• completion rates for fraud and corruption mandatory training;
• appropriate escalation of risks identified as outside of tolerance;
• policies and procedures being up-to-date; and
• implementation of high risk audit recommendations.

Compliance management framework control assessments

3.9 In 2022 ASIC commenced undertaking assessments of compliance-related controls under its compliance management framework. ASIC refers to this as the ‘compliance plan evaluation and attestation process’ and it involves ASIC’s Central Compliance function.¹³⁷ ASIC’s compliance management framework is discussed further in paragraphs 3.13 to 3.20.

3.10 The assessments have focused on obligations with an inherent risk rating of ‘severe’ or ‘high’. Controls assessed through this process have included the following probity related topics:

• unauthorised use or disclosure of protected information;
• trading restrictions;
• procurement;
• conflict of interest;
• use of corporate credit cards; and
• Commissioner remuneration, allowances and relocation.

3.11 The results of the assessments were reported to ASIC’s Executive Risk Committee on 2 August 2022 and the Commission Risk Committee on 23 August 2022. The report included ratings on which obligations were assessed as ‘operating within appetite’ or ‘outside of appetite’ or ‘unknown’.¹³⁸ The report also included recommendations for strengthening controls for obligations irrespective of their rating.

3.12 In October 2022, ASIC’s Executive Risk Committee was presented with the proposed approach to testing compliance-related controls for the 2022–23 financial year and beyond. The approach included a risk-based approach with different levels of assurance sought depending on the inherent level of risk. Most compliance obligations with a ‘medium’ inherent risk were to be assessed through analysis of compliance questionnaires and attestations by managers with responsibilities for the controls. In the 2022 assessments, compliance obligations with a ‘high’ or ‘severe’ inherent risk were subject to this process in addition to additional sample testing to verify the effectiveness of controls. All ‘severe’, ‘high’ and selected ‘medium’ risk obligations were to be subject to this process for 2022–23, with control assessments of the remaining ‘medium’ risk obligations planned to commence in 2023–24.

Is there a framework for monitoring compliance with probity requirements, including regular monitoring and reporting?

Compliance management framework

3.13 ASIC’s December 2021 Compliance Policy outlines ASIC’s approach to managing compliance with a range of obligations and how ASIC monitors and reports on compliance with those obligations. The policy defines a ‘compliance obligation’ as:

any statutory or regulatory requirement ASIC must comply with, or directs its staff members and/or Commission members to comply with due to the nature of the risk. For example, the requirements set out in an internal ASIC policy.

3.14 The policy further states that:

Compliance with ASIC’s … obligations is fundamental to the effective performance of our role as a corporate, markets and financial services regulator. Compliance is sustained by embedding it in the culture, behaviour and attitudes of our staff members, Senior Executives and Commission members.

3.15 ASIC’s Central Compliance function is responsible for providing advisory support to business areas within ASIC regarding compliance management, administering ASIC’s ‘obligation library’¹³⁹, preparing reports on compliance with obligations, and overseeing the annual evaluation and attestation processes of the compliance plan. ASIC’s Central Compliance function reports to ASIC’s Chief Risk Officer, who in turn reports to ASIC’s Chief Operating Officer.

Monitoring and reporting non-compliance

3.16 The ASIC Compliance Policy states that:

Where potential non-compliance is identified, a notification must be submitted via the Compliance Incident Management System (CIMS) for specified obligations, or by an alternative method as described in the relevant internal ASIC policy.

3.17 CIMS is a system through which ASIC staff report potential breaches of certain obligations. Probity related obligations that are reported through CIMS include those established under ASIC’s policies relating to:

• executive remuneration and entitlements;
• procurement; and
• use of corporate credit cards.¹⁴⁰

3.18 Potential breaches of obligations relating to conflict of interest, trading breaches, gifts, benefits and hospitality and fraud are recorded in the relevant register not CIMS. Guidance on ASIC’s intranet states that:

only incidents relating to Obligations Notifiable in CIMS … are able to be notified and responded to through the CIMS. Events that are unrelated to Obligations Notifiable in CIMS do not form part of the compliance incident management process at present and instead must be reported via the appropriate escalation channels for consideration.¹⁴¹

3.19 ASIC’s intranet provides a list of policies and details of how someone reports an event relating to each policy.

3.20 The Central Compliance function provides compliance reports three times per year to the Executive Risk Committee and Commission Risk Committee. These reports included details of reported compliance incidents, including incidents reported through CIMS. Compliance with conflict of interest requirements is subject to sample testing by ASIC’s compliance team from time to time. Compliance with trading and gifts, benefits and hospitality requirements are included in enterprise risk reporting as ‘key risk indicators’ for ASIC’s enterprise risk relating to ‘operational quality and discipline’.

Integrity Committee

3.21 ASIC’s Integrity Committee is a sub-committee of the Executive Risk Committee and provides quarterly updates to the Commission Risk Committee.¹⁴² The Integrity Committee meets bi-monthly to oversee: ASIC’s Integrity Framework; activities related to ACLEI¹⁴³; summary information on reports made through the ‘Speak Up’ platform¹⁴⁴; and integrity, fraud and corruption control measures.

3.22 In October 2022 the Integrity Committee was presented with an assessment of ASIC’s Integrity Framework against ACLEI’s Integrity Maturity Model. The assessment resulted in proposed improvements relating to training and awareness raising.

Other compliance reporting

3.23 ASIC’s Commission and management committees receive regular reporting on compliance with probity requirements, in addition to the reporting undertaken under ASIC’s Compliance Management Framework and to the Integrity Committee. This includes reporting on the completion of mandatory training¹⁴⁵ and completion of ASIC’s annual attestation process.¹⁴⁶

Is there a framework for following up on identified instances of noncompliance?

3.24 Having a framework for following up on identified instances of non-compliance assists in providing assurance to the accountable authority regarding the effectiveness of probity management arrangements.

Responding to non-compliance with probity requirements

3.25 ASIC’s Compliance Policy is supported by the Compliance Management Handbook. The Handbook states that:

Where non-compliance is identified, corrective action must be taken to manage non-compliance. Mitigating controls should also be implemented where required to prevent the risk of the event re-occurring and encourage continual improvement in compliance management at ASIC.

3.26 ASIC Commissioners and staff members are required to report an event that could impact compliance with obligations in CIMS. The CIMS procedure requires the team responsible for rectifying the compliance incident to assign a ‘rectification manager’ to resolve the incident and implement mitigating controls. The Central Compliance function has responsibility for oversight of this process and for reporting to the Executive Risk Committee, Commission Risk Committee and Audit Committee on the outcomes of incidents.

3.27 Sensitive incidents can also be reported and escalated through channels other than CIMS, including through the Speak Up platform.

Consequences for non-compliance with probity requirements

3.28 ASIC’s Compliance Policy states that personnel who fail to comply with their obligations ‘may be subject to disciplinary action under ASIC’s Code of Conduct, up to and including termination of employment.’ Responsibility for managing non-compliance of staff members lies with Senior Executives. According to the compliance policy, ASIC’s Central Compliance team monitors progress of compliance actions. ASIC’s process for following up instances of identified noncompliance with code of conduct requirements is outlined in the ASIC Code of Conduct and the ‘Procedures for Investigating Code of Conduct and other Grievances’.

3.29 ASIC’s guideline for probity in procurement, conflict of interest policy¹⁴⁷ and policy on trading in financial products state that failure to comply may result in disciplinary action under ASIC’s Code of Conduct. The policy on trading in financial products also advises that insider trading prohibitions apply to ASIC personnel and that failure to comply could be an offence under the Corporations Act 2001.

3.30 ASIC’s credit card policy states that credit card holders with expenditure not acquitted after four months will have their credit cards cancelled.¹⁴⁸ Three instances of private use of an ASIC credit card will result in the physical card being retained by the ASIC finance area.¹⁴⁹ Further noncompliance will result in the card being cancelled. The policy also states that certain activities will result in disciplinary action or termination of employment.¹⁵⁰

3.31 Identification of probity related non-compliance and the management of identified noncompliance are discussed in Chapter 4 of this audit report.

4.1 Entities cannot effectively manage probity related risks if the policies, procedures and arrangements designed to mitigate those risks are not followed. This chapter assesses whether ASIC can demonstrate compliance with the probity requirements selected for ANAO review and addressed non-compliance in accordance with its stated requirements.

4.2 The requirements reviewed by the ANAO related to:

• the ASIC Code of Conduct;
• conflict of interest and disclosure of financial trading;
• senior executive remuneration;
• selected procurement requirements;
• corporate credit card use; and
• gifts, benefits and hospitality.¹⁵¹

Has ASIC complied with the selected probity requirements?

Compliance with training requirements relating to the ASIC Code of Conduct

4.3 ASIC’s Code of Conduct arrangements are discussed in paragraphs 2.3 to 2.10. Officials subject to ASIC’s Code of Conduct are required to undertake mandatory training in relation to the Code of Conduct.

4.4 The ANAO examined whether there is evidence of people subject to ASIC’s Code of Conduct having completed mandatory training for the most recent period.

4.5 Completion rates for this and other mandatory training are monitored and reported to ASIC’s Executive Committee. Reporting to ASIC’s Executive Committee in July 2022 indicated that the first module of ASIC’s new mandatory training suite (ASIC Essentials) was rolled out on 29 March 2022. This module included training on ASIC’s Code of Conduct. A completion rate of 99.04 per cent was reported for that training. ASIC documentation states that:

Completion rates are higher than the acceptable threshold of 90% and feedback has indicated the modules are easy to navigate and provide good organizational context on regulatory and legislative obligations.

4.6 As discussed in paragraph 2.118, at 30 September 2022, ASIC reported that the completion rate for Module 1 of the Essentials Program was 99.33 per cent.

Compliance with attestation process requirements relating to the code of conduct, conflict of interest and disclosure of financial trading

4.7 ASIC’s arrangements for managing conflict of interest and disclosure of financial trading are discussed in paragraphs 2.11 to 2.19 and 2.35 to 2.41 respectively.

4.8 In addition to the requirement to disclose interests and identify conflicts as they arise (see paragraph 2.17), prior to 2022 ASIC also required its staff and contractors to make an annual declaration of interests every July.¹⁵² ASIC documentation indicates that technical issues with ASIC’s enterprise risk management system resulted in the 2019–20 declaration cycle being postponed until 8 February 2021. The first reporting on compliance with the declaration process to ASIC’s Executive Risk Committee occurred on 22 June 2021, with 39 senior executives and 245 other personnel identified as not having finalised the process as at 15 June 2021.¹⁵³ Further reporting to ASIC’s Executive Risk Committee on 27 July 2021 identified that the attestation process had not been finalised for approximately 15 senior executives (25 per cent of the cohort) and 127 staff (seven per cent of the cohort). There was no annual declaration process conducted in 2020–21.

4.9 The ANAO examined whether there is evidence of ASIC having conducted its attestation process relating to code of conduct, conflict of interest and disclosure of financial trading for the most recent period. The most recent annual attestation period ran from 4 July 2022 to 29 July 2022. ASIC records indicate that 180 people (7.9 per cent) were non-compliant with the attestation process.

4.10 In 2022 ASIC replaced the annual declaration with an annual attestation. This requires all ASIC team members to attest that they have complied with requirements to make declarations relating to ASIC’s policies on:

• disclosure of interests and conflicts;
• trading in exchange-related financial products;
• gifts, benefits and hospitality;
• security responsibilities;
• changes in circumstances; and
• overseas travel.¹⁵⁴

4.11 As part of the disclosure of interests and conflicts, people subject to the process must attest that they have read and understood certain policy documents (including ASIC’s Code of Conduct) in the last 12 months.

4.12 At the end of the 2022 attestation cycle, reporting to the Executive Risk Committee identified that 92.1 per cent of the required personnel had completed the attestation, and that 80.5 per cent of non-compliant personnel were ‘contingent workers’.¹⁵⁵ A list of personnel who were non-compliant with the requirement to make an annual attestation was provided to the Executive Risk Committee.

4.13 The results of ASIC’s 2022 attestation process are presented in Table 4.1.

Table 4.1: Results of ASIC’s 2022 attestation cycle

Note a: ASIC advised the ANAO that it has a target attestation completion rate of 90 per cent to remain within its risk tolerance.

Note b: Contingent workers are not ASIC employees. Some contingent workers have access to ASIC’s information or systems.

Source: ANAO review of ASIC documentation.

4.14 ASIC advised the ANAO that it is currently reviewing compliance requirements for its contingent workers.¹⁵⁶

4.15 Internal reporting to the Executive Risk Committee in October 2022 highlighted a number of areas of improvement:

The Attestation process was designed to increase the up-take and accuracy of point-in-time reporting of compliance related matters. The data … shows the process was successful in driving reporting behaviour as well-above average increases in retrospective reporting of trades, international travel and changes in personal circumstances were observed during the attestation period. … The significant increase in point-in-time reporting suggests that a considerable number of team members failed to disclose reports at the time that they became aware of them. Delayed reporting of conflicts and other obligations present risks to team members in respect to the maintenance of their Australian Government security clearance, in addition to compliance and risks to ASIC.

4.16 ASIC documentation indicates that during the attestation period there were also above average increases in the number of disclosures of interests and the number of gifts declared. The increases are shown in Table 4.2.

Table 4.2: Number of declarations made during July 2022 compared to 2022 — monthly average^a

Note a: The monthly average figure covers the period 1 January 2022 to 17 November 2022 (excluding July 2022 when the attestation process was underway).

Source: ASIC documentation.

4.17 ASIC advised the ANAO in December 2022 that ‘system generated Annual Attestation noncompletion emails were sent to all noncompliant team members 5 days, 2 days and 1 day prior to the conclusion of the cycle.’ ASIC documentation indicates that on 29 July 2022 senior executives were provided with advice as to who in their team had not completed their attestation and the expectation that attestations should be completed by midnight that day.

4.19 ASIC advised the ANAO in December 2022 that ASIC people managers received a noncompliance notification once the attestation closed (1 August 2022). ASIC further advised that:

The attestation process was a point in time exercise for staff to confirm they were compliant with a number of policies, including conflicts of interest. The attestation process opened on 4/7/22 and closed on 29/7/22 and therefore staff who had not completed the attestation could not do so after 29/7/22. However, staff could still update their COI [conflict of interest] disclosures, make trading notifications (or requests etc), so just because they did not complete the attestation does not mean they were non-compliant with the underlying policies.

The myRAD [ASIC’s Enterprise Risk Management system] platform must be accessed from your work laptop — you cannot access it via phone or ipad, which means staff on leave may not have been able to access the attestation (only staff on long term leave (3+ months) were excluded from the attestation process) …

The Chief Legal Office was notified of all people who did not complete the attestation, and the additional disclosures in the request to trade, disclosure of interests, overseas travel, and gifts, benefits and hospitality registers in myRAD would have triggered normal workflows for action (i.e. for declarations of interest the people manager would get a workflow notification to review the disclosure).

4.20 As discussed in paragraph 4.68, ASIC has not documented the consequences for not completing the attestation process. ASIC’s Executive Directors were provided with details of people who had not completed the attestation process. Information about trading policy breaches identified during the attestation process is provided in paragraphs 4.73 to 4.76.

Disclosure of Commissioners’ interests

4.21 Under section 123 of the Australian Securities and Investments Commission Act 2001, ASIC Commissioners have a standing obligation to disclose certain interests to the Minister in writing. ASIC’s practice is for each Commissioner to provide a letter to the Treasurer every six months containing disclosures of interests. All ASIC Commissioners undertook this disclosure process for the period examined in this audit.

Compliance with senior executive remuneration requirements

4.22 ASIC’s arrangements for senior executive remuneration are discussed in paragraphs 2.45 to 2.54. As noted in paragraph 2.46, ASIC did not have a policy for managing senior executive remuneration until 9 November 2022. As a result, the ANAO was unable to test whether ASIC’s process for reviewing senior executive remuneration for its most recent performance period was undertaken in accordance with entity requirements.

4.23 The ANAO reviewed whether ASIC’s accountable authority (the ASIC Chair) was provided with and approved individual remuneration outcomes for members of the senior executive cohort for the most recent performance cycle or review process that resulted in a pay rise (excluding across the board increases applied in accordance with government policy).¹⁵⁷

4.24 As outlined in paragraph 2.50, the Commission approved a 1.7 per cent remuneration increase to all eligible senior executives in August 2021. This rise was consistent with the requirements of the Public Service Workplace Relations Policy 2020. As outlined in paragraph 2.51, in October 2021 the Chair approved that performance bonuses be rolled into senior executive pay. At that time the Chair was provided with a table listing individual members of the senior executive¹⁵⁸, excluding the Chief Operating Officer (COO), outlining:

• how long they had been a senior executive at ASIC;
• their performance rating for the year;
• their average bonus over the previous three years;
• their existing remuneration, average bonus amount and the total of these two amounts when combined;
• the applicable discount factor¹⁵⁹;
• the proposed new total remuneration;
• a ‘compa-ratio’ figure¹⁶⁰; and
• a ‘Notes’ section that provided the Chair with comparative information regarding various senior executives.

4.25 ASIC advised the ANAO that the COO was not included in the table provided to the Chair:

on the basis of conflict of interest. … [the COO] participated in the bonus roll-in discussions for all executives on the memo with the Accountable Authority and the Chief People Officer. To keep the COO at arms’ length from any discussion on his remuneration, his situation was managed outside of this process.

4.26 ASIC documentation indicates that the COO had been appointed to the role in March 2021 for an initial period of 12 months. The employment contract provided for a remuneration review after 12 months. The 1.7 per cent remuneration increase that the Chair approved for eligible senior executives discussed in paragraph 2.50 was not applied to the COO due to the new remuneration agreement entered into in March 2021. The Chair was provided with options regarding the total remuneration package for the COO on 28 October 2021. The Chair was provided with information similar to that provided for the senior executive cohort as part of the bonus roll-in process described in paragraph 2.51. The roll-in of bonuses became effective in December 2021.

4.27 As outlined in paragraph 2.54, ASIC documentation indicates that in October 2022 the ASIC COO advised staff that the ASIC Chair and Commission endorsed a three per cent pay increase across the board effective from 10 November 2022, in line with the Australian Government’s Public Sector Workplace Relations Interim Arrangements 2022 released on 6 October 2022.

4.28 As of March 2023, no further increases in remuneration to members of the senior executive had occurred.

4.29 In summary, for the process examined by the ANAO, there is evidence that the Chair was provided with information on, and approved, individual remuneration outcomes for all members of the senior executive cohort.

Compliance with selected procurement requirements

4.30 ASIC’s policies, procedures and arrangements for probity management in procurement activities are outlined in paragraphs 2.55 to 2.60.

4.31 For a selection of high-value procurements, the ANAO assessed whether ASIC complied with its requirements for probity management in procurement.

4.32 The ANAO selected a sample of ten procurements undertaken by ASIC between July 2021 and October 2022. The procurements were the 10 highest value procurements for the period recorded on AusTender as at 19 October 2022.

4.33 For each procurement, the ANAO assessed whether there was evidence of probity management in accordance with requirements detailed in ASIC’s ‘Procurement guideline — probity’.¹⁶¹ All of the procurements in the ANAO sample were valued over $1 million, meaning they all had a probity risk rating of at least ‘medium’ under ASIC’s ‘Procurement guideline — probity’. The requirements assessed were those relating to:

• probity risk assessment¹⁶²;
• establishment of a probity plan¹⁶³;
• appointment of a probity advisor¹⁶⁴; and
• declaration of conflicts of interests.¹⁶⁵

4.34 The results of the ANAO’s assessment are presented in Table 4.3.

Table 4.3: Consideration of probity in the selected ASIC procurements

Note a: For this procurement the applicable requirements were set out in ASIC’s 2020 ‘Procurement Guideline – Managing Probity’. Key probity requirements for high value or complex procurements were: using a probity advisor from ASIC’s central procurement area; consulting the central procurement area about the need for a probity plan; completion of a ‘general procurement conduct statement’; and declaration of conflicts of interest.

Note b: ASIC Advised that it ‘sought quotations from suppliers via an RFQ approached suppliers on the Digital Marketplace Panel under DTA panel category “Support and Operations”’.

Source: ANAO analysis of ASIC and AusTender documentation.

4.35 As summarised in Table 4.3, for the ten high-value procurements reviewed by the ANAO, ASIC only partly complied with the requirements established in its ‘Procurement guideline — probity’.

• None of the selected requirements were met in four of the procurements (40 per cent non-compliance).
• Only one of the selected requirements was met in four of the procurements (40 per cent partial compliance).
• All four of the selected requirements were met in only two of the procurements (20 per cent compliance).

4.36 There was an absence of a documented risk assessment for eight of the ten procurements. This meant that it was not clear whether any additional probity management requirements for high probity risk procurements were required.¹⁶⁶

4.37 In November 2022 ASIC advised the ANAO that:

The digital workflow requires that any endorser or approver (to establish or vary a contract) to attest that they do not have a conflict of interest … However, this systemic attestation is not included in the final approved form for procurements using the workflow prior to 1/7/22.

4.38 Seven of the procurements involved ASIC approaching a single supplier, including three where doing so is mandatory under whole of Australian Government coordinated procurement arrangements.¹⁶⁷ For four of these seven procurements, ASIC advised the ANAO that the only probity management steps required were conflict of interest attestation by the endorser and/or the final decision-maker.¹⁶⁸ This exemption from ASIC’s policy is not explicitly stated in its ‘Procurement guideline — probity’.

4.39 The results of the ANAO’s testing indicate that there is an opportunity for ASIC to seek to obtain greater consistency in its identification and management of probity risks in procurement, by enhancing its internal guidance.

Compliance with corporate credit card requirements

4.41 ASIC’s arrangements for corporate credit card expenditure were discussed in paragraphs 2.61 to 2.87.

4.42 The ANAO examined the corporate credit use of the following senior ASIC personnel:

• the Accountable Authority;
• the Deputy Chairs; and
• Chief Operating Officer.

4.43 These roles were selected on the basis that setting the ‘tone at the top’ is important when trying to instil an ethical culture in an entity. Further, external review is a means of testing whether there are controls in place to manage positional authority risks within an entity.¹⁶⁹

4.44 The ANAO also examined whether the executive assistants for people in the above roles have credit cards and if so, whether they can make purchases on behalf of their manager.¹⁷⁰

4.45 The ANAO reviewed all credit card transactions for the people in the selected roles for the months of June and July 2022. These months were selected as they are sufficiently recent to reflect current entity practices and, at the time of conducting audit testing, the acquittal process should have been complete. The ANAO examined whether:

• transactions were acquitted within the required timeframe;
• tax invoices or other supporting documentation was provided (where applicable);
• transactions were approved in accordance with requirements¹⁷¹; and
• whether transactions appeared for incidental or other private expenditure.

4.46 In the audit sample there were 197 transactions, with a total expenditure of $40,352. The results for the 197 transactions examined were as follows.

• Twenty four (12.2 per cent) were non-compliant with ASIC’s acquittal requirements, as they were not acquitted by the 20^th day of the following month as required by the credit card policy.
• Tax invoices or other supporting invoices were provided (where applicable).
• Transactions were approved in line with requirements.

4.47 For the 197 transactions reviewed by the ANAO, no instances were observed that appeared to be for private expenditure.

Compliance with gifts, benefits and hospitality requirements

4.48 ASIC’s arrangements for gifts, benefits and hospitality were discussed in paragraphs 2.88 to 2.95.

4.49 The ANAO reviewed ASIC’s gifts, benefits and hospitality register for the period 1 July 2020 to 30 September 2022. The ANAO examined the register for this period because the effective management of probity risks related to gifts, benefits and hospitality is an important element of: supporting an ethical culture; managing the risk of real and perceived conflicts of interest; and managing the risk of regulatory capture.

4.50 The ANAO examined whether:

• declarations were made in line with the ASIC policy;
• gifts, benefits or hospitality to staff were approved in accordance with requirements; and
• where applicable, details of gifts, benefits and hospitality reported on ASIC’s website matched those on ASIC’s internal register.

4.51 There were 259 entries in the register, of which: 228 were recorded as accepted; five were recorded as declined; and 26 were recorded as ‘expired’.¹⁷²

4.52 Table 4.4 provides a summary of the entries in ASIC’s gifts, benefits and hospitality register during the period reviewed by the ANAO.

Table 4.4: Summary of ASIC’s gifts, benefits and hospitality register

Note a: The categories in this table were determined by the ANAO based on analysis of ASIC’s Gifts, Benefits and Hospitality register.

Note b: In this category a person attending a function or event also received a bottle of wine. This has not been included in the total for the gifts category.

Note c: In this category a person receiving a meal also declared a donation that was made to a charity on behalf of ASIC. This has not been included in the total for the gifts category.

Note d: Token gifts are defined as items of low or no monetary value.

Note e: Cultural gifts are items of cultural or sentimental value for which a monetary value is difficult to assign.

Note f: Due to rounding, the ‘Percentage’ column does not add to 100 per cent.

Source: ANAO analysis of ASIC’s gifts, benefits and hospitality register, 1 July 2020 to 30 September 2022.

4.53 In respect to the entries in ASIC’s register for the period reviewed, most gifts, benefits and hospitality were managed in accordance with ASIC requirements.¹⁷³ The ANAO identified the following exceptions.

• There were 21 occasions where the benefit or hospitality was reported after the event.¹⁷⁴
• There were three occasions where a gift received by staff was reported more than 30 days after it was received.¹⁷⁵
• There were seven occasions when non-token gifts were kept by the recipients that were not recorded as being surrendered to ASIC.¹⁷⁶ The acceptance of these non-token gifts was approved by ASIC personnel.
  • Six of these occasions included bottles of wine. Five of the six bottles had a reported value ranging from $30 to $100. The sixth bottle was included as part of a combination of items with a combined reported value of $80.
  • The seventh occasion was a gift with a reported value of $70, which included lollies, a candle and a notebook.
• There were six occasions where the entry in the register was not published online.¹⁷⁷

4.54 According to the ASIC policy, in order to receive a benefit, or hospitality valued at $50 and over, staff must seek approval from their Senior Executive before accepting the offer. As the register ASIC provided to the ANAO did not record when a Senior Executive had approved each entry, the ANAO was not in a position to test if approvals had been made in accordance with ASIC’s policy. There is an opportunity for improvement in ASIC’s internal guidance, by clarifying reporting timeframes for gifts and recording approval timeframes for entries on the register of gifts, benefits and hospitality.

4.56 As noted in paragraph 2.92, ASIC’s conflict of interest policy states that¹⁷⁸:

ASIC Staff should not accept any gifts, hospitality or benefits that give rise to a real (actual), potential or perceived conflicts of Interest.

Generally, you must decline any gift, benefit or hospitality offered by a third Party in the course of, or related to, your work with ASIC.

However, ASIC recognises that in limited situations … it may be appropriate and in ASIC’s interest to accept benefits and hospitality, provided acceptance does not conflict with the proper performance of your functions or duties at ASIC, or give rise to any real or potential conflicts of Interest.

4.57 ASIC’s processes require personnel making a declaration in the gifts, benefits and hospitality register to address the following questions:

• ‘is acceptance of gift/benefit/hospitality a conflict of interest (Yes/No/Unsure?)’;
• ‘reason for gift/benefit/hospitality’; and
• ‘explain how acceptance of the benefit or hospitality further benefits ASIC’.

4.58 The register shows that in some cases, the personnel making a declaration and/or the approvers, have included additional information supporting the assessment of whether acceptance would represent a conflict of interest. ASIC could strengthen its arrangements for gifts, benefits and hospitality by requiring all personnel making a declaration to include the basis for their assessment of whether acceptance results in a conflict of interest.

4.60 On 10 August 2022 the ASIC Chair attended a farewell event for the retiring Chair of the Commonwealth Bank of Australia.¹⁷⁹ The bank is regulated by ASIC. The Chair’s attendance at this event was not recorded in ASIC’s internal gifts, benefits and hospitality register. ASIC advised the ANAO in February 2023 that ‘ASIC’s policy does not require the approval, disclosure or reporting of modest hospitality where there is a genuine benefit to ASIC and acceptance doesn’t give rise to a conflict of interest.’ ASIC’s November 2021 policy, ‘Disclosure obligations of ASIC Commissioners’, provides that:

61. Generally, Commissioners must decline any gift, benefit or hospitality offered in the course of, or related to, their official duties on behalf of ASIC.

62. ASIC recognises that in limited situations … it may be appropriate and in ASIC’s interest for Commissioners to accept benefits and hospitality. This is only the case if acceptance does not give rise to a real conflict and would benefit ASIC in performing its role, duties and functions.¹⁸⁰

…

69. Any hospitality over the value of A$100 must be reported in myRAD [ASIC’s Enterprise Risk Management system].

4.61 The ANAO’s review indicates that there are entries by Commissioners on ASIC’s gifts, benefits and hospitality register for hospitality with an estimated value below $100. The declaration of all hospitality received from regulated entities, particularly by senior personnel, is a transparent approach to disclosure which contributes to the management of reputational risk by regulators.¹⁸¹ ASIC should review whether its financial thresholds for declaring hospitality in its internal register could further contribute to the management of reputational risk, particularly where hospitality is more than incidental to ASIC personnel undertaking their core regulatory functions.

Has non-compliance been addressed in accordance with stated requirements?

4.65 Following up on identified instances of non-compliance assists in providing assurance to the accountable authority on compliance with entity requirements and the effectiveness of probity management arrangements.

4.66 ASIC’s framework for following up on identified instances of non-compliance is discussed in paragraphs 3.24 to 3.31.

4.67 The ANAO examined whether there was evidence of action being taken in relation to noncompliance identified by ASIC and in the context of this audit.

Attestation process relating to ASIC Code of Conduct, conflict of interest and disclosure of financial trading

4.68 ASIC has not documented the consequences for not completing the internal attestation process discussed in paragraphs 4.7 to 4.20. ASIC advised the ANAO that ‘non-compliant individuals and their people manager received an automated email from the myRAD system. The security team provided Executive Directors with the details of the attestation process, including noncompliant individuals.’¹⁸²

4.69 ASIC conducted its attestation process in relation to code of conduct, conflict of interest and disclosure of financial trading in accordance with its requirements. As outlined in paragraph 4.12, 92.1 per cent of the required personnel had completed the attestation, and 80.5 per cent of noncompliant personnel were contingent workers.¹⁸³

4.70 In regards to ASIC staff, as outlined in paragraph 4.19, ASIC advised the ANAO that the Chief Legal Office was notified of all people who did not complete the attestation, and the additional disclosures in the request to trade, disclosure of interests, overseas travel, and gifts, benefits and hospitality registers in myRAD would have triggered normal workflows for action.

4.71 As discussed in paragraph 4.14, ASIC advised the ANAO that it is currently reviewing compliance requirements for contingent workers.

4.72 The attestation process did not identify any noncompliance associated with ASIC’s Code of Conduct and conflict of interest requirements.

4.73 In October 2022, the report to ASIC’s Executive Risk Committee on the results of the attestation process (see paragraphs 4.12 to 4.16) included identification of 51 instances of noncompliance with retrospective reporting of trading activity, which ASIC identified as ‘severity 2 breaches’.¹⁸⁴

4.74 In December 2022 ASIC advised the ANAO that, given the number of trading policy breaches identified as a result of the annual attestation process, ASIC’s Chief Legal Office undertook a process to determine which breaches needed to be dealt with first, and how to deal with less urgent breaches. ASIC further advised that the process involved the following procedures.

• CLO [Chief Legal Office] looked at the breaches and the securities the breaches were for. Those that were found not requiring a trade approval (e.g. ETFs [exchange traded funds], unlisted managed funds, cryptocurrency, connected person’s trade whereby the staff member wasn’t aware of the updated definition of connected person), we ceased processing them (i.e. cancelled).
• For the remaining actual breaches, CLO found that majority of them were for contractors who advised that they weren’t aware of the Trading Policy and the requirements to seek trade approval. They only became aware of the requirement when they were completing the Annual Attestation.
• For these breaches, CLO categorised the breaches as low, medium, or high risk. This ‘risk assessment’ is not a standard procedure. CLO used these categories (only this time) to help them decide whether we needed to conduct a fuller assessment and send out the results of a full assessment to the relevant manager, SEL [Senior Executive Leader], ED [Executive Director], and P&D [People and Development] (as is usually the case), or if the assessment should just be sent to the staff member and their manager. This is because most of these breaches were lodged by contingent workers/contractors who were not aware of the Trading Policy. Please note that these contractors were not required to complete the mandatory online learning in Trading and Conflicts of Interest Policy and that these staff members are mainly located in the IT area.
• When assessing these breaches, CLO still did their usual checks regardless of whether they were a low, medium, or high risk. That is CLO still checked the minimum of e.g. share price movements, any sensitive announcements around the date of the trades, the role of the staff member, if staff member have traded in the past, any prior breaches, any COI [conflict of interest] identified.
• If the staff member had not lodged a trade request in the past, it was their first breach, they are a contingent worker, it’s a severity 2 breach and there was no COI identified, then CLO would categorise it as low risk. CLO would send an email directly to the staff member and their manager, acknowledging the breach and reminding them of their obligations under the Trading Policy.
• A medium risk is one where the staff member is an ordinary ASIC staff member (i.e. not contingent worker), may or may not have lodged trade request/breach in the past, lodged a severity 2 breach this time around, no COI identified. The full assessment email is sent to the manager, SEL, ED, and if necessary, P&D.
• A high risk is a severity 1 breach (for all ASIC staff, contractors or not) and a full assessment email sent out to the manager, SEL, ED, and if necessary, P&D.¹⁸⁵

4.75 ASIC advised the ANAO in December 2022 that there were 52 instances of retrospective reporting in July 2022.¹⁸⁶

4.76 ASIC advised the ANAO in February 2023 that 94 retrospective trades were reported by 22 staff and contingent workers. Of the 94 trades identified, nine were duplicated entries, 23 were assessed as not breaching the policy¹⁸⁷, and five related to a contingent worker who has left ASIC. For the remaining 57 breaches requiring action, ASIC advised the ANAO as follows.

• Actions to respond to 39 staff breaches had been completed as at 13 February 2023, with action taken by the manager or People and Development.¹⁸⁸
• One was assessed as low risk relating to a staff member.¹⁸⁹
• Twelve were determined to be low risk breaches by contingent workers.¹⁹⁰
• Five trades, made by two people, have not had all actions completed as at 13 February 2023. For three, the manager was reviewing the assessment. For two, ASIC was awaiting a response from the manager to confirm action had been taken.

Procurement, use of corporate credit cards and gifts, benefits and hospitality

4.77 There is no evidence of instances of non-compliance identified by the ANAO being addressed in accordance with ASIC’s requirements for: procurement; credit cards; and gifts, benefits and hospitality. There is evidence of ASIC recording details, in its CIMS register, of other instances of non-compliance and actions taken.

Procurement

4.78 ASIC’s ‘Procurement guideline — probity’ states that:

Non-compliance with this Guideline will first be reported to the Compliance Incidence Management System (CIMS) register in the myRAD system detailing the incident, actions taken and future mitigation strategies implemented.

Non-compliance incidents may be a breach of the ASIC Code of Conduct. Potential breaches will be investigated and if a breach is found, may result in disciplinary actions as outlined in the ASIC Code of Conduct.

4.79 Instances of noncompliance with internal procurement requirements, as observed by the ANAO in this audit, are outlined in Table 4.3. ASIC advised the ANAO in February 2023 that:

ASIC is satisfied that these procurements appropriately considered and managed the probityrelated risk, and that the completing a full probity assessment and plan as required under the current framework would not provide a meaningful benefit in the management of the risk. The ANAO’s testing highlighted the need for ASIC to review and update the procurement framework to identify circumstances where a detailed probity assessment and plan are not required, and for these instances, set out what the minimum requirements are. This review is underway with the changes expected to be implemented by the end of March 2023.

Corporate credit cards

4.80 ASIC’s policy on corporate credit cards, applicable at the time of the transactions selected for ANAO review, includes consequences for noncompliance.¹⁹¹ These relate to more significant instances of noncompliance than those identified by the ANAO (see paragraph 4.46).

4.81 ASIC advised the ANAO in February 2023 that:

The PGPA Compliance team followed up verbally in relation to the [corporate credit card] acquittals which were not completed by the 20th of the following month. From December 2022 these verbal follow-ups will be followed up with an email.¹⁹²

4.82 There is evidence of ASIC recording, in its CIMS register, instances of non-compliance in relation to the use of ASIC corporate credit cards for personal expenditure. The register records the name of the incident, steps to contain the incident and remediation steps. Details in the register include advice that personnel have refunded the amount and re-completed mandatory training.

Gifts, benefits and hospitality

4.83 Requirements relating to gifts, benefits and hospitality are set out in ASIC’s ‘Disclosure obligations of ASIC Commissioners’ and ASIC’s ‘Conflicts of interest policy’ for employees.

4.84 The policy for Commissioners does not specify consequences for noncompliance whereas the policy for staff outlines consequences ranging from reprimand to termination of employment.

4.85 For the instances of noncompliance identified by the ANAO (see paragraph 4.53), ASIC advised that as all declarations of gifts, benefits and hospitality are recorded in ASIC’s risk management system, all entries are work flowed to the relevant manager. Managers are then responsible for following up with the staff responsible for the noncompliance.

4.86 ASIC further advised the ANAO that:

Conflicts of interest and gifts, benefits and hospitality are generally principles based and rely on an assessment by the manager/senior executive as to whether the notification is likely to be an actual, potential or perceived conflict, and they will work with the disclosing team member to identify an appropriate course of action/accepting or declining the gift/benefit/hospitality. This involves situationally specific nuance related to the team member’s role, seniority and any other relevant information, and may also include seeking advice from people and development and the chief legal office. Non-compliance with the policy is directly linked to the code of conduct and legislative requirements. Detailing consequences below the code of conduct level in the policy is not practicable.

Appendix 1 Australian Securities and Investments Commission response

Appendix 2 Improvements observed by the ANAO

1. The existence of independent external audit, and the accompanying potential for scrutiny improves performance. Improvements in administrative and management practices usually occur: in anticipation of ANAO audit activity; during an audit engagement; as interim findings are made; and/or after the audit has been completed and formal findings are communicated.

2. The Joint Committee of Public Accounts and Audit (JCPAA) has encouraged the ANAO to consider ways in which the ANAO could capture and describe some of these impacts. The ANAO’s 2022–23 Corporate Plan states that the ANAO’s annual performance statements will provide a narrative that will consider, amongst other matters, analysis of key improvements made by entities during a performance audit process based on information included in tabled performance audit reports.

3. Performance audits involve close engagement between the ANAO and the audited entity as well as other stakeholders involved in the program or activity being audited. Throughout the audit engagement, the ANAO outlines to the entity the preliminary audit findings, conclusions and potential audit recommendations. This ensures that final recommendations are appropriately targeted and encourages entities to take early remedial action on any identified matters during the course of an audit. Remedial actions entities may take during the audit include:

• strengthening governance arrangements;
• introducing or revising policies, strategies, guidelines or administrative processes; and
• initiating reviews or investigations.

4. In this context, the below actions were observed by the ANAO during the course of the audit. It is not clear whether these actions and/or the timing of these actions were planned in response to proposed or actual audit activity. The ANAO has not sought to obtain assurance over the source of these actions or whether they have been appropriately implemented. Changes observed include the following.

• Developed and issued a policy for senior executive remuneration.
• Updates to the following policies:
  • Accountable Authority Instructions;
  • Code of Conduct;
  • Trading;
  • Procurement;
  • Corporate Credit Cards;
  • Fraud and Anti-corruption; and
  • Fraud Control Plan.
• The Essentials Program (training) came into effect from May 2022.

Appendix 3 Department of Finance guidance — Ethics and Probity in Procurement: Principles

1. An extract of the Department of Finance’s guidance on ‘Ethics and Probity in Procurement: Principles’¹⁹³ is reproduced below.

1. The principles underpinning ethics and probity in Australian Government Procurement are:

• Officials must act ethically, in accordance with the APS Values (set out in section 10 of the Public Service Act 1999) and Code of Conduct (set out in section 13 of the Public Service Act 1999), at all times in undertaking procurement.
• Officials must not make improper use of their position.
• Officials should avoid placing themselves in a position where there is the potential for claims of bias.
• Officials must not accept hospitality, gifts or benefits from any potential suppliers.
• Agencies must not seek to benefit from supplier practices that may be dishonest, unethical or unsafe, which may include tax avoidance, fraud, corruption, exploitation, unmanaged conflicts of interest and modern slavery practices.
• All tenderers must be treated equitably. This means that all tenderers must be treated fairly - it does not necessarily mean that they are treated equally.
• Conflicts of interest must be managed appropriately.
• Probity and conflict of interest requirements should be applied with appropriate and proportionate measures informed by sound risk management principles.
• Value for money outcomes are best served by effective probity measures that do not exclude suppliers from consideration for inconsequential reasons.
• Confidential information must be treated appropriately during and after a procurement process.
• External probity specialists should only be appointed where justified by the nature of the procurement.