Report of the Auditor-General Report 6 of 2019 Annual report for the year ended 30 June 2019 Part C: Agency audit reports [P.P.4P Report of the Auditor-General Report 6 of 2019 Annual Report for the year ended 30 June 2019 Part C: Agency audit reports Tabled in the House of Assembly and ordered to be published, 15 October 2019 First Session, Fifty-Fourth Parliament By authority: S. Smith, Government Printer, South Australia 2019 www.audit.sa.gov.au Enquiries about this report should be directed to: Auditor-General Auditor-General’s Department Level 9, 200 Victoria Square Adelaide SA 5000 ISSN 0815-9157 Contents Agency audit reports 1 Adelaide Festival Centre Trust 3 Adelaide Oval SMA Limited 11 Adelaide Venue Management Corporation 18 Attorney‐General’s Department 23 Public Trustee 41 Auditor‐General’s Department 52 Department for Child Protection 53 Department for Correctional Services 61 Courts Administration Authority 70 Department for Education 78 Department for Energy and Mining 91 Environment Protection Authority 99 Department for Environment and Water 106 Health sector overview 121 Department for Health and Wellbeing 132 Central Adelaide Local Health Network Incorporated 150 Country Health SA Local Health Network Incorporated 166 Northern Adelaide Local Health Network Incorporated 176 SA Ambulance Service Inc 186 Southern Adelaide Local Health Network Incorporated 194 Women’s and Children’s Health Network Incorporated 207 HomeStart Finance 213 Department of Human Services 225 Independent Commissioner Against Corruption 240 Department for Innovation and Skills 244 Lifetime Support Authority of South Australia 253 Motor Accident Commission 263 Department of Planning, Transport and Infrastructure 273 Department of the Premier and Cabinet 300 Department of Primary Industries and Regions 306 Return to Work Corporation of South Australia 317 South Australia Police 329 South Australian Fire and Emergency Services Commission 339 South Australian Government Financing Authority 349 South Australian Housing Trust 362 South Australian Tourism Commission 383 South Australian Water Corporation 388 Superannuation sector overview 406 South Australian Superannuation Board 410 South Australian Superannuation Scheme 417 Southern State Superannuation Scheme 423 Super SA Retirement Investment Fund 427 Superannuation Funds Management Corporation of South Australia 431 TAFE SA 440 Department of Treasury and Finance 451 University sector overview 467 Flinders University 474 University of Adelaide 480 University of South Australia 487 Urban Renewal Authority 497 Agency audit reports Introduction Part C: Agency audit reports is a summary of the audit outcomes for each agency included in this Report. It features a snapshot of key agency information covering financial statistics, significant events and transactions, and whether the financial report opinion is unmodified or modified (qualified). If modified, the key matters causing the modification are noted. The snapshot is followed by commentary on financial administration matters for each agency that, in my opinion, are important to the Parliament and the SA Government. This commentary also contains selected financial ratios and information for assessing the agency’s financial performance and position, and significant financial transactions. The financial reports of the agencies included in this Report are available on the Auditor‐General’s Department website (www.audit.sa.gov.au). Agencies not included in this Report The Auditor‐General exercises the discretion to exclude agencies from this Report. The decision to exclude an agency is based on many factors including: the materiality of its financial operations its significance to the SA Government’s operations and services the materiality of any impact on the public finances the timeliness of information the materiality of audit issues raised the public interest the timely completion of this Report and meeting the statutory deadline to deliver the Report to the presiding members of Parliament. A list of the public sector agencies not included in this Report is provided at the end of Part A: Executive summary. I will subsequently report to Parliament on them, with particular commentary on agencies where there: is a modified financial report opinion are significant matters raised through the audit are other matters that, in my opinion, need to be brought to the attention of the Parliament and the SA Government. In addition their financial reports will be published on the Auditor‐General’s Department website as the audit of each agency is finalised. 1 Agency audit reports Modified Independent Auditor’s Reports Expressing an opinion on an entity’s financial report by an independent professional auditor adds credibility to it and ensures that appropriate financial disclosures were made. For the agencies that I am required to audit, I issue an Independent Auditor’s Report on the financial report in line with professional requirements and standards. The opinion I give is usually unmodified, but if circumstances warrant it a modified opinion is expressed. In extreme cases it may not be possible to express an opinion. When a modified opinion is given, the Independent Auditor’s Report explains the reasons for the modification. This is also explained in the commentary on those agencies in this Report. Of the agencies included in this Report, a modified opinion was expressed on the financial report of the University of South Australia. In addition, without modifying my opinion on the financial reports of the Lifetime Support Authority and the Return to Work Corporation of South Australia, I drew attention to the inherent uncertainty in certain liabilities reported for those entities at 30 June 2019. Audit of the Auditor-General’s Department The Public Finance and Audit Act 1987 requires the Auditor‐General’s Department’s financial report to be audited by an auditor appointed by the Governor. The audit for the financial year ended 30 June 2019 was conducted by Nexia Edwards Marshall, Chartered Accountants, who issued an unmodified Independent Auditor’s Report on the Department’s financial report. 2 Adelaide Festival Centre Trust (AFCT) Financial statistics Net cost of providing services: $21 million Revenues from SA Government: $24 million Revenues from fees and charges: $28 million Net assets: $21 million Number of FTEs: 345 (including 187 casuals) Ticketed attendances: 537 772 Total attendances: 1 066 086 Significant events During the year work continued on the redevelopment and and transactions expansion of Her Majesty’s Theatre. Work in progress at 30 June 2019 is $36 million and $26 million has been drawn down from the approved $62 million loan facility. Construction works are expected to be completed in early 2020. Financial report Unmodified opinion Audit findings Lack of documented policies for IT general controls. No evidence of the independent review of audit logs. No disaster recovery planning established for the BASS application. User access management issues. No purchase card policy. Financial management compliance program not up to date. No internal audit function as required by the AFCT’s Charter. Terminated employee paid after termination. 3 Adelaide Festival Centre Trust Functional responsibility The AFCT is a body corporate established under the Adelaide Festival Centre Trust Act 1971. It is under the general control and direction of the Minister for the Arts. The AFCT is responsible for encouraging and facilitating artistic, cultural and performing arts activities throughout the State and managing and maintaining Her Majesty’s Theatre (HMT) and the Adelaide Festival Centre and its facilities. Further information on the AFCT’s objectives is provided in note 1.2 of its financial report. The AFCT also operates the BASS ticketing system to sell tickets primarily for artistic performances held at the Adelaide Festival Centre and HMT. Scope of the audit The audit program covered major financial systems to obtain sufficient evidence to form an opinion on the financial report. Specific areas of audit attention in 2018‐19 included: revenues from theatre services and box office BASS ticketing system including review over IT general controls salaries and wages procurement and expenditure on supplies and services fixed assets. Audit findings Communicating our audit findings We communicated our audit findings in management letters to the Chief Executive Officer. The main findings and AFCT’s responses are discussed below. IT general controls review of BASS system Policies and procedures We found that there was a lack of documented policies in the following areas: user access management password management privileged user access audit logging change management patch management backup management. If policies are not in place there is an increased risk of inappropriate processes being followed. 4 Adelaide Festival Centre Trust In response the AFCT advised that it would develop policies for the areas we identified. No evidence of reviewing audit logs We found no evidence that an independent review of the BASS, database and operating system audit logs is being performed. If audit logs are not reviewed there is a risk that inappropriate or unauthorised changes to the AFCT’s financial data could go undetected. In response the AFCT advised that this issue will be considered when it implements the South Australian Protective Security Framework (SAPSF). Disaster recovery management We found that no disaster recovery planning