Letter to chief executives

5 May 2016

Dear [chief executive]

“JOINING THE DOTS” – INSIGHTS FROM THE 2014/15 ANNUAL AUDITS

I am writing to you and all other chief executives of government departments and Crown entities to draw your attention to some strategic insights and common internal control and reporting practices that we found during our annual audits in 2014/15.

In sharing these insights, I encourage you to consider which ones apply to your own entity and where you could strengthen your approach. I encourage you to seek input from your senior management team and staff, and independent comment and advice from your audit committee.

In most of the areas covered by our audits, I judge the fundamentals to be working well. We made few recommendations on significant matters because most entities have sound management and financial control environments. The challenge is how to build on these foundations to create a more sophisticated organisational environment – joining the dots internally and between public sector agencies – to deliver high-quality services to New Zealanders.

On the face of it, many of the issues found during our audits relate to processes and controls. However, deficiencies in systems and processes for managing and monitoring day-to-day operations tend to affect strategic leadership, organisational capacity, and, ultimately, effectiveness. For example, without governance and management practices to ensure that you get the right information about how your entity is performing, you may have to spend time on operational issues rather than exercising leadership towards strategic objectives.

Many of you are implementing changes to business models, driven by fiscal constraint and a desire to innovate to keep improving public services. Changes bring challenges, and reinforce the importance of taking care of people – including through training and building their capability. I’m sure you’ll agree that it’s people who make the difference between an acceptable service and an exceptional one.

I note that:

• Many entities could better integrate corporate functions and expertise (such as financial and investment planning, monitoring, risk management, and performance reporting) into their core policy and operational work. Joining the dots internally and mainstreaming the responsibility for these functions throughout the entity improves the quality of planning and operations, and also gives the specialists time to focus more on their areas of expertise. 
• Although individual entities are, overall, managed well, systems could be lifted to a level of maturity where they support strategic leadership throughout the public sector, and support the stewardship of the whole system that chief executives of departments are collectively charged with. Entities’ planning and reporting is still largely entity-centric, rather than focused on meeting the needs of citizens in a more joined up way.

Governance and accountability

Governance and accountability arrangements need to support effective delegations, make management and reporting responsibilities clear, and provide avenues for considering risks and managing their mitigation. This leaves chief executives in a position to consider the medium- and long-term direction, rather than managing operational details.

Many entities have sought or are seeking to improve governance in their efforts to improve their management control environment, and good use is being made of audit committees.

Project and programme management

Appropriate governance and accountability arrangements are also important for successful project and programme management.

Management and financial control environments

In an environment of significant change, it is even more important that you maintain strong foundations for managing your entity and its finances, and take care of your people. Maintaining the right tone at the top, in integrity and strategic intent, is critical.

Knowing that the right systems and controls are in place provides important assurance. Based on what we have seen, management and financial control environments are generally sound. However, there is still room for improvement, including a need for wider thinking by chief executives about how to give effect to strategic leadership and their role as stewards of the public sector, not just of their own entities.

Financial oversight

Some entities could not provide timely records for audit – those entities urgently need to catch up on the basics.

Some entities had no independent review of financial transactions. This increases the risk of fraud or error. I encourage you to think about systems that could provide transparent and reliable reporting, with expert staff focused on checking for exceptions.

Some entities, particularly district health boards, did not calculate accruals correctly. This has affected how accurately surpluses and deficits were reported.

Some entities had payroll issues. Given that personnel costs account for 60% or more of many entities’ total expenses, it is important for managers and governors to obtain assurance over this expenditure.

Controls for information and communications technology

Some entities are still struggling with basic controls, such as ensuring that users’ access is appropriate to their roles and terminated when they leave the entity. Lapses in these controls could have serious consequences, such as fraud, identity theft, cyber-crime, or information leaks. As chief executive, you need to have assigned responsibility clearly and ensure that you or your internal audit team and the audit committee receive appropriate information.

In my view, chief executives need to be alert to the risks of cyber fraud, such as email scams, ransom-ware, and spear-phishing.

Service performance reporting

Generally, central government organisations reported their performance adequately. Given how important accountability is, I encourage chief executives to look at reporting as more than a compliance exercise.

Also, smart entities (and those with smart management teams) use performance information effectively for management purposes, to identify high-performing areas, to drive improvement, and to build feedback loops that help with setting targets and monitoring and reviewing progress against strategic objectives.

During the 2014/15 audits, we found some deficiencies affecting the accuracy and quality of information. We saw:

• “legacy” IT systems that did not properly provide the information needed to report;
• lack of clarity about the strategic intentions of the entity, resulting in the entity not articulating appropriate performance indicators properly;
• the absence of performance measures to provide information on the quality of the services provided; and
• inconsistencies between the performance information used internally to make strategic and operational decisions and the information used for external reporting.

Procurement and contracting

Government entities spend a lot of money on contracted goods and services each year, especially on health and social services. Generally, entities follow the right processes for procurement and work to safeguard the prudent use of public money. However, entities could benefit from closer links between strategic direction and procurement, enabling more strategic purchasing, monitoring, and risk management.

The mix of delivery models is changing. Commercial expertise is becoming more important, and entities need to ensure that they have the capability to interact with private sector and non-governmental organisation partners, and to co-ordinate effectively with other government organisations.

We expect to see procurement expertise embedded throughout entities as part of a core skill set, leaving specialists to focus on intractable or highly technical cases. It is also becoming more and more important to have commercial and technical expertise on decision-making panels for large projects, especially for ICT infrastructure. Most entities are following appropriate procurement and contracting practices and have adequate processes for doing so. However, we saw a procurement decision that was challenged in court after an alleged lapse in due process. Procurement processes must be fit for purpose and procurement costs need to match the size of the task and the risk it entails.

We are not seeing enough evidence of value-for-money assessments, nor enough account taken of service delivery from a citizen’s perspective.

Investment and asset management

For many chief executives, managing assets is a core stewardship responsibility. In the past, investment and asset management have been treated as a specialist or niche function.

We have seen some improvements in overall practice but the quality of asset management planning still varies, and the collection and use of data could be enhanced.

I would like to see a shift from reactive responses when there is an asset failure or the risk of failure to proactive long-term planning and investment to maintain and enhance service delivery. This approach needs to feed into business planning and performance reporting.

Avoiding appropriation breaches

Chief executives are responsible for making sure that their spending is within appropriations. In 2014/15, several entities recorded breaches of appropriations, spending beyond or out of scope of their appropriation without authority. Some breaches that result from unforeseen demand can be difficult to avoid – others could and should have been avoided with better anticipation of events and their financial consequences.

Financial reporting and new accounting standards

Entities have a responsibility to understand new reporting requirements and to plan effectively to implement them. For some entities, the new Public Benefit Entity (PBE) accounting standards posed challenges. Crown entities in some sectors did not all understand the new reporting requirements. Some organisations responsible for sector leadership or oversight did not exercise leadership and communicate adequately with their sector.

Also, entities need to take advantage of the flexibility available within the new accounting standards by focusing on users' information needs and what matters most. The way is open for public entities to change the focus of their reporting from complying with specific accounting standard requirements to communicating better through their financial reports. During the last six years, I have strongly supported the "de-cluttering" of financial statements. Those who prepare financial statements need to think about and include only the information that is necessary for users' understanding.

I commend to you our report Improving financial reporting in the public sector, which is available at www.oag.govt.nz. I also enclose a copy of our report Reflections from our audits: Governance and accountability. If you would like extra hard copies for the chairperson of your Board and/or audit committee, please contact [email protected].

Deputy Controller and Auditor-General Greg Schollum and I are very happy to discuss the information in this letter and the governance and accountability report at our next meeting with you. Likewise, I encourage you to talk with your Sector Manager from the Office of the Auditor-General and your Appointed Auditor about the matters raised in these documents.

Yours sincerely

Lyn Provost
Controller and Auditor-General