Department of Internal Affairs

Transcription

1 Financial Review briefing to the Government Administration Committee Department of Internal Affairs /13 Financial Year 11 December 2013

2 Assistance to the Committee The Government Administration Committee is conducting a financial review of the performance in the 2012/13 financial year and the current operations of the Department of Internal Affairs in accordance with Standing Order 340. The Controller and Auditor-General provides Parliament with assurance on the performance and accountability of public entities. The Office of the Auditor-General typically assists select committees with their financial reviews by providing further details on the results of the annual audit in Part A of our written briefings, and by suggesting lines of enquiry and questions relevant to the particular public entity under review in Part B of our written briefings. Our annual audits provide a high, but not absolute level of assurance about whether a public entity s financial statements comply with generally accepted accounting practice (GAAP) in New Zealand and fairly reflect its financial position and its financial and service performance for the period audited. Due to the volume of transactions, audit work is planned and performed to obtain evidence on a sample basis. Auditors use professional judgement to assess the evidence and ensure there is reasonable assurance that there are not material misstatements in the financial statements (that is, differences or omissions that would affect someone s overall understanding of the financial statements). We report, in our audit opinion, only material differences or omissions that we find. To identify lines of enquiry for Part B of this briefing, we: analyse the results of the annual audit and the accountability documents; refer to any relevant performance audit or inquiry work; and use our specific knowledge of the entity gained during the audit process and by ongoing contact with the entity. Where necessary, we checked factual information with the department or other entities to ensure that our advice to the committee is accurate. We did not give the entities any of the contemplated or actual advice that is in this briefing. Contact for further explanation If any member of the Committee would like further explanation or elaboration of any aspect of this briefing document, please do not hesitate to contact Tobias Nischalke, Sector Manager, Parliamentary Group on or Tobias Nischalke@oag.govt.nz at the Office of the Auditor-General.

3 Summary of key issues Part A: Results of the 2012/13 audit 3 We issued an unmodified audit opinion on the financial statements and non-financial performance reporting of the Department of Internal Affairs (DIA). We assessed and graded DIA s management control environment as good. We assessed and graded its financial information systems and controls as good, and its service performance information and associated systems and controls as good. Part B: Advice to the Committee The key points we cover for the Committee, and suggest questions on, are: Contribution to Better Public Services (BPS) programme and ICT functional leadership: DIA has an important role to play supporting the way the public sector delivers services and, through ICT functional leadership, is charged with system-wide assurance, ensuring ICT investment is coordinated and delivers savings of $100 million across government by We suggest questions around how DIA prioritises this significant work programme, and around its approach to managing assurance. We also suggest seeking information on how DIA intends to measure savings and ensure agencies report in a consistent way. With regard to passport and identity services, and the achievement of BPS result 10 around digital service delivery, we suggest questions about the passport renewal system and RealMe. Mergers and organisational health: DIA has in recent years undergone significant structural change, including amalgamation with the National Library and Archives New Zealand. Redundancy costs alone have been at least $5.88 million over the past three years. We suggest questions about DIA s approach to measuring the costs, benefits and value-add of the changes. We also suggest seeking information about how DIA is intending to improve staff engagement, and about DIA s plans to achieve efficiency savings over the next four years. Asset management: DIA manages heritage collections worth $1.3 billion on behalf of the Crown. We suggest the Committee ask about DIA s asset management approach, envisaged changes and their potential fiscal impact. Civil defence and emergency management (CDEM): Within DIA, the Ministry of Civil Defence and Emergency Management (MCDEM) is responsible for a significant work programme that includes implementing recommendations from the review of the response to the Canterbury earthquakes and a revised national CDEM plan. We suggest questions around the progress of this work and around the arrangements in place to ensure MCDEM s upcoming move from DIA to the Department of Prime Minister and Cabinet (DPMC) does not pose risks to delivery and any emergency response required. We also cover financial management (memorandum accounts) in Part B.

4 Overview of the Department of Internal Affairs The Department of Internal Affairs (DIA) has a broad set of functions and responsibilities. DIA s core business includes: Information and knowledge services (Archives New Zealand and the National Library), technology services, identity services, community services, regulatory services, civil defence emergency management and support services to the Executive and advisory bodies. DIA monitors two Crown entities: the New Zealand Fire Service Commission and the Office of Film and Literature Classification. DIA s Statement of Intent for outlines four areas of strategic focus over the medium term: Transforming the way government agencies deliver their services Stronger and more resilient communities; and individuals contributing to and benefitting from the success of their communities Increased trust in how government manages New Zealand s civic information Internal Affairs is a robust, sustainable and fit-for-purpose government agency DIA covers seven ministerial portfolios, reporting to six Ministers: Internal Affairs Local Government Ministerial Services Ethnic Affairs Racing Civil Defence Community and Voluntary Sector DIA administers one Vote - Vote Internal Affairs, following the merger of previously eight separate Votes into Vote Internal Affairs, with effect of 1 July Total appropriations for 2013/14 are $552 million, with Civic Information Services, including identity services (passports, births, deaths, marriages) and knowledge services (Archives New Zealand and National Library) accounting for $242 million. The total number of permanent staff as of 30 April 2013 was 1786.

5 Part A: Results of the 2012/13 audit 5 1 Audit opinion 1.1 We issued an unmodified audit opinion on the financial statements and non-financial performance reporting of the Department of Internal Affairs. 2 Environment, systems and controls for measuring financial and service performance 2.1 Our conclusions on the Department s management control environment, systems, and controls for measuring financial and service performance, for the year ended 30 June 2013, are set out in the table below. 2.2 We made our conclusions in the context of our work in forming an opinion on the financial and service performance statements. The purpose of commenting on the underlying environment, systems, and controls is to highlight areas for improvement identified during the audit. The grades assigned for 2012/13 are based on the accountability documents relating to that year. They are not an assessment of overall management performance, or of the Department s effectiveness in achieving its financial and service performance objectives. (See the Appendix for an explanation of the grading scale and underlying scope.) Management control environment 2012/13 Good Improvements would be beneficial and we recommend that the Department address these. 2011/12 Good Deficiencies we identified in 2011/12 have been partially resolved. Comment Legislative compliance The Department implemented a formal legislative compliance system at the end of 2012/13. We recommended that the Department review its document management and supporting systems to ensure that all employees are aware of what information is required and available on the systems and whether compliance has been achieved in terms of the Public Records Act Risk management External Advisory Committee An External Advisory Committee, fulfilling the role of an external Assurance Committee, was established during 2012/13 and its first meeting was in July We recognise the steps being taken by the Department to ensuring that it has a fully functional Advisory Committee that can provide additional governance and assurance and strengthen the control environment. Contractual commitments We recommended that the Department maintain a central register of contractual commitments that is updated regularly to assist in the budgeting process and cash flow management. This would also assist in identifying and managing procurement risks and processes and is an important tool in strategic procurement management.

6 Information systems We recommended that the Department review all its IT policies. This will ensure that the current status of all policies is updated and that all relevant areas of the IT environment have suitable policies in place to manage performance and risks. While we noted appropriate password settings and configurations in place, we recommended that the Department develop an overarching formal password policy, which should be used within the various applications. Where the application cannot support the password policy, this should be noted and mitigating action taken. Enterprise Portfolio Management Office We recommended that a maturity review be carried out to identify gaps between existing practice and best practice for an Enterprise Portfolio Management Office (EPMO), followed by an improvement plan to assist in providing an effective EPMO. We also recommended that the Department review its approach to portfolio, programme and project level assurance to ensure that it has in place independent quality assurance reviews, peer reviews, probity audits, and internal audits commensurate to the size, complexity, risk, and value of the Department s portfolio, programmes and projects. Other than the matters noted above, no other issues were identified as a result of our review. Financial information systems and controls 2012/13 Good Improvements would be beneficial and we recommend that the Department address these. 2011/12 Good Deficiencies we identified in 2011/12 have been partially resolved. Comment Balance sheet reconciliations We noted improvements in the clearing of aged reconciling items within balance sheet reconciliations, although certain reconciliations were not always prepared and/or reviewed in a timely manner throughout the year. We recommend that the Department continue to strengthen the reconciliation processes in place and apply them consistently throughout the year. Interloan Billing System The Interloan Billing System is a service provided and managed by the National Library of New Zealand for the Te Puna Strategic Advisory Committee. We recommended that the Department review its management of the Interloan Billing System trust account and identify controls and processes, including regular reconciliations, to ensure that this account is managed effectively. This matter will be addressed when the Department moves to its new Financial Management Information System. Other than the issues mentioned above, and based on the areas we reviewed during 2012/13, we found that appropriate policies, systems, and controls were in place and appeared to be operating effectively

7 Service performance information and associated systems and controls 2012/2013 Good Improvements would be beneficial and we recommend that the Department address these /2012 Good Deficiencies we identified in 2011/12 have been partially resolved. Comment The Department has continued to develop and refine its service performance information and associated systems during 2012/13. There are some areas still being progressed: We recommended that targets for output measures should be set at levels that will maintain or develop performance. We recommended that the Department continue to review its systems and processes for recording data that is used to report non-financial performance results. Processes should ensure that adequate supporting documentation is maintained and recorded, in a reliable system, for reference and audit purposes. One of the Department s non-financial performance measures relates to the availability of essential information technology systems in the event of a national emergency. This measure requires that essential information technology systems need to be available and operating at agreed performance levels for when an event occurs. We recommended that the Department define essential information technology systems, formulate appropriate essential technology performance levels, and agree these with the Government Technology Services. Other than the issues mentioned above, and based on the areas we reviewed during 2012/13, we found that appropriate policies, systems, and controls were in place and appeared to be operating effectively. 3 Significant matters of audit interest 3.1 No matters of significant interest arose during our audit. The Department has had a busy year with a number of ongoing areas of focus. These included: The functions of the Charities Commission transferring to the Department on 1 July 2012; Responsibility for Better Public Services Result Area 10 (New Zealanders can complete their transactions with government easily in a digital environment), with the release of an Action Plan in August 2012; The Government Chief Information Officer role of the Department s Chief Executive, with the release of the Government ICT Strategy and Action Plan to 2017 in June 2013; Completion of the New Generation Implementation (National Library) Project; Implementing the new Passport System, including passports online; and Progressing the Financial Applications and Transformation project, which will see the Department move to sharing the IRD SAP finance system.

8 4 Legislative compliance 4.1 We reviewed the systems and procedures that the Department uses to identify and comply with legislative requirements. The Department now has a formal system in place to monitor legislative compliance. Through this, it has identified that more work needs to be done in order to fully comply with the Public Records Act Other than this, we did not note any instances of non-compliance during our audit.

9 Part B: Advice to the Committee 9 5 Financial performance 5.1 DIA s total income in 2012/13 was $ million, against a budgeted $ million (readjusted to $ million as per supplementary estimates). DIA s total income comprised Crown funding of $ million and other revenue of $ million. 1 The main components of other revenue were passport fees ($80.2 million), non-casino gaming licenses and fees ($17.1 million), and citizenship fees ($13.1 million) Total expenditure was $ million. This meant DIA recorded a surplus of $3.144 million, reduced from $ million in Personnel costs accounted for $ million, 49% of total expenditure, an increase of 6.4% from DIA maintains 11 memorandum accounts, the largest of which is passport products. 4 The balance of this account reduced from $ million on 1 July 2012 to $ million on 30 June 2013 (passport fees were reduced in November 2012, see section 6 for context). Memorandum accounts are meant to support a sustainable outcome over the medium term for the area for which fees are charged. They cannot be used to cross-subsidise other work areas. Therefore, fees need to be set at an appropriate level. 5.4 The Committee may wish to ask: We noted that the passport products memorandum account has been reduced by $6.5 million over 2012/13 although a surplus of $20.8 million remains. What are the projections for this account for outyears, on what assumptions are they based, and have the assumptions changed? 6 Contribution to Better Public Services (BPS) programme and ICT functional leadership 6.1 DIA has a significant role to play transforming the way government agencies deliver their services, both through the functional leadership for ICT and its lead role for Better Public Services (BPS) result area 10 ( New Zealanders can complete their transactions with government easily in a digital environment ). Reporting on BPS Result 10 to 30 June 2013 showed that the average uptake of the digital transactions captured had reached 36.9% in the April-June quarter. The target is 70% by DIA put the average digital uptake of the selected bundle of services smoothed-out over the full year at 37.3%. This shows a 6.9% rise in digital uptake measured year-on-year, from an average of 30.4% for the year ending 30 June Annual Report Internal Affairs, page Annual Report Internal Affairs, page Annual Report Internal Affairs, page Annual Report Internal Affairs, page 148 and 149. Measuring agency results,

10 Passport and identification services Managing and accessing identity information (including passports, citizenships, births, deaths, marriages and civil unions), is DIA s largest output appropriation (2012/13 expenses: $127 million 6 ). This work area is central to realising DIA s vision of being the primary department for identity services. Also, increasing the rate of online adult passport renewals is one component of BPS result DIA has been upgrading the Passport Management System. A key phase of the project was completed when the online passport renewal system became operational in November Fees decreased by 19% for adults who renewed their passports online. The Government has stated that over 125,000 New Zealanders have renewed their passports online since. 7 The April-June quarter 2013 BPS update put online uptake at 33.2% of adult passport renewals. DIA expects demand for passports to double by DIA s igovt services are central to digital services as they help citizens verify their identity online. DIA has launched an enhanced identity data service, RealMe, in partnership with NZ Post. This extends login and verification services that people can use to verify their identity to government service providers and the private sector. Funding of $14.5 million is available for the 2013/14 year 8 but we understand decisions have been pending concerning future funding. 6.5 The Committee may wish to ask: We noted that the online passport renewal system was successfully launched and is experiencing good uptake. What are the remaining project phases of the passport redevelopment system and how is DIA measuring the overall costs and benefits of the project? What is DIA doing to further increase digital uptake? DIA s igovt services, now branded as RealMe, play an important role facilitating digital service uptake. What options are being considered for future igovt services and what are the possible implications, in terms of cost and enabling digital service provision? ICT functional leadership 6.6 The DIA Chief Executive is also the Government Chief Information Officer (GCIO). As the functional leader for ICT, the GCIO sets the strategic direction for all-of-government ICT. The objective is for ICT to act as an enabler for business efficiencies and improved government service delivery. The GCIO is also tasked with developing expertise and capability, and with supporting business continuity across the public sector. 6.7 The Government expects the GCIO to generate efficiencies and deliver savings across government of at least $100 million per year by The measurement of costs and future savings will prove challenging. Issues around cost allocation across business functions and decisions around appropriate (cost) reference points in the investment cycle are among the Annual Report Internal Affairs, page 56. Online passports reach 125,000 in first year, 20 November 2013, beehive.govt.nz. Budget 2013: $14.5m boost for online identity verification, beehive.govt.nz, 22 May Government ICT Strategy and Action Plan to 2017, page 6.

11 difficulties. It will be important to understand how DIA intends to measure costs and benefits, ensure departments have a consistent approach, and track progress. 6.8 The GCIO is responsible for implementing the Government ICT Strategy and Action Plan to 2017, which Cabinet endorsed in June The Action Plan outlines a fundamental system change, underpinned by system assurance. Focus areas include a strong shift to digital services (services are digital by default) and getting more benefits from information the government holds (information is managed as an asset). Delivery will be based on a new operating model that provides system-wide coordination of investment, resources and capabilities. The GCIOS is tasked with designing a framework to facilitate prioritisation and asset management of ICT investment across government agencies The Committee may wish to ask: What approach is DIA taking to measure savings, how is progress towards the savings target being monitored, and is DIA confident it is on track? How is DIA ensuring consistency in entities reporting of baselines and future savings? How does DIA intend to implement a coordinated approach to investment decisions and what are the funding implications for DIA? 6.10 In June 2013 Cabinet also directed the GCIO to report on assurance issues to Ministers and mandated the GCIO to provide advice to Ministers on whether ICT projects should proceed. 10 Having the assurance function as part of the role gives the GCIO responsibility for ICT security issues, jointly with relevant department heads. DIA s role should complement the monitoring role of central agencies Taken together, this constitutes a significant work programme for DIA. The Action Plan includes more than 70 action items or sub-items that the GCIO or DIA are meant to lead. 11 DIA has been given additional funding for the GCIO for 2013/14 ($1.5 million, in addition to previously committed $4 million) 12 and we understand that DIA has taken steps to quickly build up capacity and capability, for example through a recent recruitment round. However, given the recent expansion of responsibilities, including around assurance, we suggest seeking information on how DIA is prioritising the work programme, and implications for future capability and funding The Committee may wish to ask: ICT functional leadership constitutes a significant work programme for DIA. What approach is DIA using to provide assurance and how are risks of ICT security breaches being managed jointly with departments? What mechanisms are in place to provide advice and reporting as required? How is DIA prioritising ICT Strategy and Action Plan items and how is it ensuring that key risks and investments are receiving appropriate attention? Stronger oversight of ICT projects and security, beehive.govt.nz, 24 June Government ICT Strategy and Action Plan to 2017, pages Stronger oversight of ICT projects and security, beehive.govt.nz, 24 June 2013.

12 12 7 Impact of mergers and organisational health 7.1 DIA has undergone significant structural change in recent years and has considerably expanded its functions. On 1 February 2011, it integrated with the National Library of New Zealand, Archives New Zealand, the Office of the Community and Voluntary Sector, and the Office of the Government Chief Information Officer (GCIO). The number of total permanent staff increased from 1301 to 1742 between 30 June 2010 and 30 June 2011, an increase of 34%. 13 The Charities Commission was merged into DIA with effect from 1 July Also, since 2012 the GCIO function has significantly expanded (see section 6). 7.2 We note that redundancy costs have been at least $5.88 million over the past three years (2010/ /13). 14 We understand that identifying cost savings and benefits from mergers and business changes is challenging, especially when services or the approach to delivery changes over time, rendering comparisons complicated. DIA s 2013 four-year plan identifies some future efficiency savings 15 but it is not clear what the total estimated costs, efficiency gains and broader benefits from the mergers have been or will be. We suggest seeking further information on what DIA has learnt from restructuring to date and what approach DIA has taken to measure costs and benefits. 7.3 Some business areas have been particularly affected by change. The Committee may wish to ask for an update on the integration of the Charities Commission and about what feedback DIA has received from external partners on support and serviced received since the integration. The transfer of responsibilities to DIA was intended to achieve efficiencies through sharing of back office functions and reducing duplication, while improving services to the charitable sector. 7.4 DIA missed one performance measure ( properly completed applications for registration decided within 30 days of receipt : 14.91% against a target of at least 70%) which DIA stated was because of a backlog inherited at the time of the transfer. 16 We noted that the Charities Commission had reported in its 2011/12 Annual Report that 10.3% of applications received from 1 July 2009 were decided within the 30-days timeframe. 17 DIA has stated that the backlog has since been cleared. 7.5 The Committee may wish to ask: What is DIA s approach to measuring the costs, benefits and value-add of structural changes? What lessons have been learnt from the recent mergers? Please provide an update on the integration of the Charities Commission. 7.6 DIA reported improved staff engagement in 2013, compared to However, the level of engagement remains below the state sector benchmark and turnover remains higher than the public sector average. 18 Particularly in light of DIA s significant work programme, we suggest seeking information on what measures DIA is taking to increase staff engagement, decrease turnover and maintain staff capability in key business areas Vote Internal Affairs, 2013/14 Supplementary Estimates questionnaire, page 21. Vote Internal Affairs, 2013/14 Supplementary Estimates questionnaire, page 28. Under operational efficiency/reprioritisation initiatives, Budget 2013: Four-Year Plan, Department of Internal Affairs, pages Annual Report Internal Affairs, page 89. Charities Commission, Annual Report for the year ended 30 June 2012, page Annual Report Internal Affairs, page 44.

13 7.7 Its four-year plan identifies savings from operational efficiencies and reprioritisation, rising from $15.7 million for 2013/14 to $24.5 million in 2016/17. By 2016/17, at least another $9.9 million in savings will need to be found. 19 DIA has in train a number of initiatives to increase efficiencies. These include Benchmarking Administrative Support Services (BASS) initiatives around human resources ( Optimise HR ), DIA s property strategy and the transfer to a new financial management system run by IRD between November 2013 and April 2014 (the Financial Applications and Transformation project or FAST project). DIA is also transitioning from ownership to leasing options for internal ICT systems The Committee may wish to ask: In what areas of the business is staff engagement particularly low and what measures has DIA taken to ensure improvements? DIA plans to realise $15.7 million efficiency savings in 2013/14 and will need to find further savings in outyears. What are the risks to service delivery and how are they being managed? 8 Asset management 8.1 The Auditor-General in 2013 published a report on Managing public assets, highlighting the importance of having and following asset management plans, understanding the need for maintenance and renewals, and of reporting to decision-makers about these matters. 8.2 As of 30 June 2013, DIA administered non-departmental assets worth $1.351 billion and held departmental property, plant and equipment assets totalling $213.6 million. 20 Buildings accounted for over half of departmental assets. The vast majority ($1.298 billion or 96%) of assets administered on behalf of the Crown are the heritage collections held by Archives and the Alexander Turnbull Library DIA has recognised the importance of enhancing its asset management framework. In 2012/13 DIA assessed itself as being mid-range minimum (33/100) using Treasury s maturity assessment tool and stated a target of reaching the low intermediate (66/100) level of asset management maturity over the next two to three years. 22 We understand that DIA has made it a priority to develop asset management plans for 14 high-risk areas. Governance structures and project management have been put in place to support this work. 8.4 The Committee may wish to ask: What systems and processes are in place to manage maintenance of, and any risks to, DIA s departmental and significant Crown assets? What progress is DIA making in improving its asset management plans and what is the likely financial impact of enhanced future asset management? Budget 2013, Four-year Plan, Department of Internal Affairs, page Annual Report Internal Affairs, pages 142 and Annual Report Internal Affairs, page 174. Budget 013, Four-year Plan, Department of Internal Affairs, page 27.

14 14 9 Civil defence and emergency management 9.1 The Government announced on 19 November that the Ministry of Civil Defence and Emergency Management (MCDEM) will transfer from DIA to DPMC, with the transition set to start on 1 April The Director of Civil Defence Emergency Management will remain the head of MCDEM and retain his statutory powers. The announcement stated that DPMC will support some of the functions previously supported by DIA, such as policy and back office functions. 9.2 MCDEM is responsible for a significant work programme that includes implementing the recommendations from the review into the response to the Canterbury earthquakes. MCDEM is also tasked with the completion of the National Civil Defence Emergency Management (CDEM) Plan review, strengthening support for volunteers, and working with regional Civil Defence Emergency Management Groups to address issues raised during assessments of their capability. 9.3 This constitutes a significant work programme for a small business unit (37 staff as of November 2013). We suggest that the Committee ask for an update on the CDEM Plan review, and how MCDEM is continuing to incorporate lessons from Canterbury and the recent Seddon/Wellington earthquakes. 9.4 The Committee may wish to ask: What arrangements are in place for managing the upcoming transfer of MCDEM to DPMC and how will DIA help ensure that the transition poses no risks to MCDEM s ability to deliver and provide an emergency response? How is the work progressing on the updated National CDEM Plan and on implementing the recommendations from the review into the response to the Canterbury earthquakes? 23 MCDEM shift will strengthen emergency management and resilience, beehive.govt.nz, 19 November 2013.

15 APPENDIX Explanation of scope and grades A. Management control environment B. Financial information systems and controls C. Service performance information and associated systems and controls Indicative areas This is the foundation of the control environment and may include consideration of the following: clarity of strategic planning/the way the entity manages and reports performance; communication and enforcement of integrity and ethical values; commitment to competence; participation by those charged with governance for example, the involvement and influence of the Audit Committee and Board (or equivalent); management philosophy and operating style; organisational structure; assignment of authority and responsibility; human resources policies and practices; risk assessment and risk management; key entity-level control policies and procedures; information systems and communication (including information technology planning and decision-making); monitoring; and legislative compliance arrangements. These are the systems and controls (including application-level computer controls) over financial performance and financial reporting, and include the following: appropriateness of information provided and reported; presentation of financial information; reliability of systems; control activity (including process-level policies and procedures); and monitoring. This concerns the quality of the main measures of outcomes or impacts and service performance measures selected for reporting against, as well as the systems and controls (including application-level computer controls) over service performance reporting, and includes the following: appropriateness of information provided and reported; review of the associated forecast information and Information Supporting the Estimates; the audit of the actual 2012/13 SSP and main measures of outcomes/impacts in the annual report; reliability of systems; control activity (including process-level policies and procedures); and monitoring. Comments and grades are based on conclusions drawn from the 2012/13 SSP and annual report. Further comment on improvements in progress may be included in a subsequent section on significant matters of audit interest. 15

16 16 Grade Explanation of grade Very good Good Needs improvement Poor No improvements are necessary. Improvements would be beneficial and we recommend that the Department address these. Improvements are necessary and we recommend that the Department address these at the earliest reasonable opportunity. Major improvements are required and we recommend that the Department address these urgently. 1. The reporting under Part A of this briefing, Environment, Systems, and Controls for Measuring Financial and Service Performance, is a by-product of the underlying audit work carried out to form an opinion on the financial and service performance statements. Its scope is limited to those areas of the management control environment, information systems, and controls the auditor has given attention to during the course of the audit. 2. Recommendations for improvement are generally limited to those findings that the auditor considers are the more notable weaknesses in the design or operation of the management control environment, information systems, or controls. The recommended improvements determine the grade assigned. A single, serious deficiency drawing a recommendation for improvement may, of itself, determine the grade. Similarly, the most serious deficiency among several will draw a stronger recommendation and affect the grade accordingly. 3. Deficiencies in the management control environment, information systems, or controls are the gaps between what auditors observe and what auditors consider, in their professional judgement, constitutes best practice (see below). Auditors professional judgement is informed by many factors, including national and international standards, knowledge of best practice, and standards and expectations for the public sector in New Zealand. 4. To help ensure the relevance to all entities of the auditor s recommendations and grading, the auditor s recommendations are made with reference to what is considered best practice given the size, nature, and complexity of the entity. Thus, notions of best practice will vary among entities because what is considered necessary, sufficient, or beneficial for some entities may not be so for others. There is therefore not a one size fits all standard across the public sector. Rather, recommendations for improvement are based on the auditor s assessment of how far short the entity is from a standard that is appropriate for the entity s size, nature, and complexity of its business. 5. Further, notions of best practice may vary over time in response to change for example, changes in the operating environment, changes to standards, and changes in general expectations. Grades assigned to entities may therefore fluctuate from year to year according to how entities respond to changes in the environment and in best-practice expectations. Grades may also be affected from year to year because of changes in emphases, in accordance with the auditor s risk-based approach to testing systems and controls. 6. Improvements are recommended only when it is considered, in the auditor s judgement, that the benefits of the improvements would justify the costs. 7. Recommendations for improvement are based on the auditor s conclusions about the state of the entity s management control environment, information systems, and controls as at the end of the financial year.