Making sure that the financial statements add up is important – but surely there is more value in public auditing than that? We did some poking around and discovered that there has been very little written about the value of public audit. So we thought we should attempt to better understand the relevance and importance of public auditing to those who rely on our work, such as Parliament and the public. Finding the answer would also guide us in shaping the future of public auditing to help meet our Greatest Imaginable Challenge – using our influence to ensure that by 2025, the public sector is operating and accountable in ways that will meet your needs in the second quarter of the 21st century.

We commissioned some researchers at Victoria University of Wellington to help us look at the value of auditing in the public sector. You can read more about how they carried out this research on our website.

So what did they find? Well, their research showed that the value of public auditing depended on the perspective of the user. In other words, the value of public audit is in the eye of the beholder, so to speak. The researchers discovered six main explanations for the value of public audit:

• The agency (or monitoring) explanation – auditing is valuable because it reduces agency costs. In the public sector, citizens have entrusted assets to the government. The cost for an individual to monitor the use of resources by the government would be too high, and the potential gain too low. Therefore, appointing an auditor helps to reduce the monitoring cost for everybody and ensures the proper use of public resources.
• The signalling explanation – auditing is a way for the government to signal that it is a reliable manager of resources. The government has an interest in ensuring that it is credible when it makes statements about public expenditure or public assets, and that when it makes decisions it is using reliable information. Ensuring that there is a credible independent audit body helps it to do so.
• Governance – auditing is an important part of governance. Without auditing, it would be much harder for good governance to take place. Auditing assists governors by providing assurance over the reliability of the financial statements and bringing issues to their attention. The function of external auditing is complementary to other forms of governance, such as internal audits and audit committees.
• The management control explanation – auditing can help managers run large, complex entities. An audit of a public sector entity is not primarily intended to provide information for an entity’s senior management. However, an audit can provide them with some assurance about what is going on in the remote corners of their entity. Auditing also includes recommendations to help with systems and reporting, and could improve management’s reputation.
• The insurance explanation – auditing in the public sector can provide “political insurance” where government can deflect attention on to auditors when there are failings by public sector managers (insurance over financial statements or decisions by managers is not the intended purpose of auditing in the public sector, but auditing may be valued for that reason).
• The confirmation hypothesis – public sector announcements will be initially accepted by the public at face value. However, the announcements will need to be eventually audited to confirm to the public that the information was reliable.

This, of course, is just a short summary of the findings of what is some very thorough research. If you want to take a deeper dive, you can find the four papers produced by the researchers on Victoria University’s website.

We have also been thinking about how we make our work even more useful and relevant to New Zealanders. We’d like to hear any suggestions you might have on how we can do this in the comments section below.

In the afternoon, I would get the savings book back with the deposit amount and account balance handwritten in.

A lot has changed since then. I can now do all my banking without ever visiting a bank branch by using online banking or an app on my cellphone. I can check my balance whenever I want, which also means my wife can see what I’ve put on the credit card as soon as I’ve used it! Technology is changing the way that services are being delivered, and with that comes a change in peoples’ expectations.

Organisations in both central and local government are trying to make it easier for people to access and use their services by making them more customer-centred. For example, there are two Better Public Services targets focused on improving peoples’ interaction with government. In most cases, this involves allowing people to access and use services online.

We’ve previously published some reports about how some public entities improved their services by putting them online, including Immigration New Zealand: Delivering transformational change, Inland Revenue Department: Governance of the Business Transformation programme, and Ministry of Health: Supporting the implementation of patient portals (my colleague Joy has written a blog post about this last report). These reports include some handy information for organisations to consider when planning to invest in information and technology systems to improve how they deliver services. We are also doing some further work on this topic.

Auckland Council is going through a similar transition to make it easier for customers to access and use its services online. The Council is doing this through something called the ‘Customer-centric Transformation Programme’ (now called the Digital and Transformation programme).

As part of our regular reviews of the Council’s service performance, we've published a report titled Auckland Council: Working to provide customer-centred services online. This report looks at the Council's programme and two projects under it: Identity Management, and the Licensing and Compliance Services Smart Forms project. The purpose of the Identity Management project was to make it possible for customers to sign in to all Council services using a single login account. Historically, each service was set up differently so customers had different accounts to carry out different tasks.

The aim of the Smart Forms project was to put 21 of the Council’s Licensing and Compliance Services forms and payments options online, including dog, alcohol, food, and street trading licenses, and health and hygiene certificates. The project also aimed to make the Council’s forms easier to understand and use.

We found that how the Council managed the projects was consistent with the some of the elements of good practice we identified in our report Realising benefits from six public sector technology projects. One of the things that I found interesting about the programme was its use of a co-design methodology. This meant that customers and Council staff were both involved in the design process for each service. For me, the difference is instead of using customers and Council staff to just identify problems, the Council also involved these two groups in creating solutions. The benefit of this approach is that the final service or product is more likely to meet the needs of users and be more user-friendly.

With the projects now delivered, customers can use a single login to access all of the Council’s online services. The process for services has also been simplified – making registering a dog or applying for a licence to run a business quicker and easier. A good example is dog registrations and renewals, of which the Council receives more than 80,000 each year. Before the programme, to register your furry best friend you would have to either visit one of Auckland Council’s service centres or mail in your registration form. Now, these can be completed and paid online.

This is just the start for Auckland Council. It has a whole series of projects that it is planning to complete over the next two years to make its services more customer-friendly for Aucklanders.

Do you have any examples where public entities have made it easier for you to use and access services? We’d like to hear about your experiences in the comments section below.

We also encourage you to provide feedback to your council or other public entities about any problems you have in using and accessing their services. Without your feedback, they might not know that people find it difficult to use and access their services.

As part of its eHealth work programme, the Ministry of Health is looking at emerging technology, such as patient portals, to help people use health services more easily. Patient portals are secure websites that allow people to access their health information and interact with their doctor. Through patient portals, people can send secure messages to their doctor, order repeat prescriptions, and, in some patient portals, view lab results and doctors’ notes. Without the use of technology like this, general practices are at risk of being left behind.

Patient portals increase the options people have for consulting their GP by enabling them to do this online instead of through a traditional face-to-face consultation. This can be more convenient and efficient for them and their GP. Changing to meet modern requirements has the effect of ensuring that general practices remain relevant and sustainable.

Private companies develop and run patient portals, and primary health organisations (PHOs) and general practices buy access to them. To encourage uptake among practices and the public, the Ministry has been working with other organisations to support their implementation and we’ve published a report that looks at how well it’s done this. (Collaboration is something our Office encourages – check out this recent blog post about how local authorities are working with others to address water management challenges.)

Working effectively with the health sector helped the Ministry to identify and address reasons why some general practices were reluctant to implement patient portals. For example, concerns about the cost to implement patient portals or safety and privacy. Some of the Ministry’s initiatives to address doctors’ concerns included:

• providing some funding and financial advice;
• preparing guidelines to support PHOs and general practices;
• appointing eHealth ambassadors to raise awareness and interest among doctors and provide guidance and support to them; and
• running awareness campaigns for general practices and the general public.

This work has helped the number of general practices offering patient portals to people more than double since June 2015.

The number of people signing up for a patient portal at their general practice has also more than doubled since June 2016. There were 233,839 registrations between June 2016 and June this year, taking the total patient portal users to 407,049.

This increased uptake in the use of patient portals is an encouraging sign that people do want to change how they interact with their doctors and access their health information. Since starting our performance audit about patient portals, I’ve joined up. I really appreciate the convenience of ordering my repeat prescription and seeing my tests results online and being able to discuss matters with my doctor in a secure environment before deciding whether I need an appointment.

Through our work, we’re seeing many examples of how public organisations in both local and central government are using technology to deliver services to New Zealanders. We’ll be publishing some reports on this topic in the coming months, so keep an eye out for them.

What are some of the services that you access and use online? We’d like to hear about your experiences in the comments section below.

People often think that auditors are responsible for detecting fraud. But they aren’t – international standards about auditing are clear that finding fraud isn’t the auditor’s responsibility. The job of preventing and detecting fraud rests with the senior leadership team and, if there is one, the governing body:

The primary responsibility for the prevention and detection of fraud rests with both those charged with governance of the entity and management. It is important that management, with the oversight of those charged with governance, place a strong emphasis on fraud prevention, which may reduce opportunities for fraud to take place, and fraud deterrence, which could persuade individuals not to commit fraud because of the likelihood of detection and punishment.

Auditing standard about fraud: ISA (NZ) 240

We’re increasingly seeing indicators that the risks of fraud in the public sector are getting higher.

Fraud causes all sorts of damage – not just financial, and not just on that organisation but on the wider public sector as well. So what do the leaders of an organisation need to do?

Check that the controls are still up to scratch

Every organisation ought to have strong and tested controls in place to manage their business well. We can help a little, here: if we audit the organisation, we’ll do some testing of the key controls during the audit and tell the organisation about any weaknesses that we see. But the vigilance and attention on those controls needs to come clearly from the governing body and leadership team.

What’s an example of a key control? Well, the most basic is that money doesn’t get paid without someone senior first approving the payment – and the person deciding who gets paid is not the person who signs the cheques. That sort of control is called a “separation of duties”.

In New Zealand’s public sector, most of the controls are pretty good, which is why those controls are the usual way that fraud gets picked up.

It’s a rapidly changing world. The controls that worked very well for the last five years might not be quite strong enough now. We expect people in leadership roles to be thinking about these sorts of matters and taking action – controls need to stay relevant and effective, which means reviewing and testing them, and strengthening them where need be.

Get the culture right

Preventing fraud can’t ever be just about the systems and controls, because determined people will always find a way around them. We produced a series of reports in 2011 and 2012 about fraud, based on a big survey we commissioned. Back then, we said that the culture of an organisation is hugely important:

Building a culture where governance, management, and staff are receptive to talking about fraud is important. Our findings suggest that the incidence of fraud is lowest where a public entity's culture is receptive to these discussions, communication is regular, and where incidents are reported to the relevant authorities.

Fraud awareness, prevention, and detection in the public sector, 2012

People are less likely to try to get away with fraud if their co-workers know what to look for and will speak up if they suspect wrong-doing. This is where the “tone at the top” is particularly important – as New Zealanders, we tend to be trusting and our largely clean way of operating means that we aren’t used to fraud. Staff need to be reminded, often, that trusting other staff isn’t a fraud control.

It’s critical that senior managers get the balance right: trusting people to give their best at work while having strong checks and balances in place, and a culture where people feel safe to question and call out behaviour or practices that look a little odd or suspicious.

Take the risk of fraud seriously and respond decisively

We expect public sector organisations to be taking the risk of fraud seriously and have a plan for how to respond to suspected fraud:

The Auditor-General expects that every public entity should formally address the matter of fraud, and formulate an appropriate policy on how to minimise it and, if it occurs, how it will be dealt with.

Auditing standard about fraud: AG ISA (NZ) 240

We generally expect all suspected wrongdoing, including thefts and suspected fraud, to be referred to law enforcement agencies. In 2012, we found that only 39% of suspected fraud incidents had been reported to law enforcement agencies.

You don’t stop fraud by sweeping it under the carpet. Fraudsters need to be caught and stopped. If wrongdoing of any sort isn’t addressed – and not just by firing someone or letting them resign – then the poor behaviour can continue at another organisation in the public sector or elsewhere.

More about audits and fraud

If you want to know more, check out the standard about fraud that all auditors have to comply with and the data on suspected fraud that we get told about. There’s also useful information in the reports we published in 2011 and 2012 on fraud risks for different types of organisations.

If you want the essential stuff, it’s this:

• Trusting staff is not a control to prevent or detect fraud.
• Maintaining a culture of integrity can help to keep fraud at bay.
• A culture of integrity is most effective when supported by strong controls.
• Taking appropriate action where there is suspected fraud acts as a deterrent.
• Organisations need to refer instances of suspected fraud to the appropriate law enforcement agencies.

Given that it’s Fraud Awareness Week, we encourage all leaders in the public sector, no matter how large or small their organisation, to stop and think seriously about whether the key controls, the culture of their organisation, and the plan for responding to suspected fraud are all lined up to make it as difficult as possible for fraud to occur.

We see many examples of local authorities working with others in the sector, with central government, with the private sector, and with their communities. This is expressed in governance arrangements, shared services delivery models, strategic planning, and consistent approaches from regulation right down to project delivery.

The reasons for working together are many and various – for example, to improve the services delivered to communities, to foster economic development, to better align land use and infrastructure delivery, and to address freshwater quality challenges, just to name a few.

I recently attended the Water New Zealand Conference & Expo. One of my take-home messages from the conference was that the really difficult challenges facing the public sector – like how we improve the quality of our water resources – are primarily relationship challenges rather than technical ones.

Project delivery: Improving the resilience of Wellington’s drinking water supply

Wellington Water is responsible for making sure that the water supplied to Lower Hutt, Porirua, Upper Hutt, and Wellington is clean and safe to drink. The Wellington region is vulnerable to the risk of its drinking water supply being interrupted for a prolonged period after a major shock, such as a significant earthquake. The damage to the water network from such an event could leave parts of Wellington without water for up to 100 days.

Wellington Water’s long-term goal is to be able to provide 80% of its customers with at least 80% of their drinking water needs within 30 days of a reasonable size earthquake.

Wellington Water has been working with central government, infrastructure providers (for example, roading and electricity), and critical users, such as Wellington Hospital, to come up with a plan and the funding to improve the overall resilience of Wellington. The parties are working together to take an integrated approach, including how it engages with central government about its contribution to building regional resilience.

Central government recently announced a $6 million contribution to this resilience goal that will be used to encourage people to store 20 litres of water per person per day to last at least the first seven days after a major earthquake. To support this work, Wellington Water is drilling for additional bores and storing bladders in a number of locations in the Wellington region.

Shared services: A council-controlled organisation in the Waikato?

Local authorities are required to deliver services in the most efficient and cost-effective way. Hamilton City Council and Waipa District Council have recognised that this has become more difficult for the delivery of water, wastewater, and stormwater services to their communities for a number of reasons, including growth pressures and increasing environmental standards.

A shared services model for the delivery of water supply, wastewater, and stormwater services in the Waikato has been considered since 2012. The process has been a long one starting with a report commissioned by Waikato Local Authority Shared Services Limited on behalf of the Waikato Mayoral Forum. Drivers for the shared services model included achieving cost savings, building network resilience, better service delivery to communities, and building technical capability.

Hamilton City Council and Waipa District Council are jointly consulting with their communities on forming a Shared Waters Management Company in the lead-up to their 2018-28 long-term plans. The consultation document states that the main purpose of the company would be to deliver more cost-effective services, more expertise, and a stronger and more resilient waters network than Hamilton City and Waipa District Councils could deliver on their own.

At this stage Waikato District Council have decided not to pursue this option.

Co-governance: The Rotorua Lakes, Waikato River, and Te Waihora

In our 2016 report Principles for effectively co-governing natural resources, we looked at a selection of co-governance arrangements established to manage a natural resource, including the Rotorua Lakes, the Waikato River, and Te Waihora (Lake Ellesmere).

We identified some principles that are helpful in setting up and operating co-governance arrangements:

• build and maintain a shared understanding of what everyone is trying to achieve;
• build the structures, processes, and understanding about how people will work together;
• involve people who have the right experience and capacity;
• be accountable and transparent about performance, achievements, and challenges; and
• plan for financial sustainability and adapt as circumstances change.

Our water work programme

We’re looking at water management challenges through our water theme work programme that covers drinking water, freshwater, stormwater, and the marine environment.

We’ve just published a scene-setting report that explains why we have an interest in water management, sets out our view of the key water management challenges facing the public sector, and highlights the themes we’ll explore through our water work.

Effective relationships are crucial to addressing water management challenges. We’re going to look at how public sector organisations are working with each other, Māori, and their communities more generally in carrying out their water management responsibilities. We’re interested in how they set strategic priorities, make investment decisions, deliver programmes of work, their governance arrangements, and what regulatory and non-regulatory approaches they are using.

We look forward to engaging with many of you as we progress our water work. If you have any stories about collaboration you’d like to share with us, please post a comment below or contact the Local Government team at the Office.

I thought of this moment while listening to the speakers at the August Transparency International New Zealand Leaders Integrity Forum. Andrew and Jason of the New Zealand Intelligence Community (NZIC) and Families Commissioner Len Cook discussed how effectively managing personnel could reduce the risk of fraud and corruption. Attendees at the Forum were introduced to personnel security issues by the General Manager of the Aviation Security Service, Mark Wheeler, who reflected on his dad’s advice to ‘trust no bastard’. Times, he said, had changed since his police officer dad was on the beat in the 1950s. Now, for the Aviation Security Service, it’s about managing risk while balancing that with trust.

Our Office’s 2012 fraud survey showed that many in the public sector trust their colleagues and regard their integrity as a protection against fraud and corruption risks. However, it’s important to note that trust is not a fraud control. Andrew and Jason warned that the greatest damage is often done accidentally or unintentionally and by staff and suppliers. Once, the NZIC focused almost exclusively on personnel security to protect our national interests. Nowadays, the expertise of the NZIC is available so anyone can better manage their own organisation’s personnel security risks. The Protective Security Requirements website outlines the Government’s expectations for managing personnel, physical, and information security.

Andrew and Jason reinforced taking a risk-based approach (see the infographic below) that fits your organisational culture and context to:

• recruit the right people;
• set the right expectations;
• ensure their ongoing suitability through active management; and
• manage their departure.

It’s right for us to trust our colleagues, but we need systems and controls to protect each other, our stakeholders, our suppliers, and the public from risk. Andrew and Jason made it clear that, like the referee of my son’s football match, we need to blow the whistle quickly at the first sign of trouble. The longer that issues go without being raised and understood, the more damage they could do to everyone involved.

Len Cook then challenged us to think about our most important personnel. He described families and whānau as the undervalued but most essential partners in cultural, social, and economic progress. The public sector has a strong interest, he said, in the core business of families – that of production and reproduction. Drawing from the Social Policy Research Unit’s analysis, Len emphasised that families are the engine of public services such as health, education, and social services. But as the population ages, fewer and fewer resources will be devoted to families and to generating production.

He expressed concern that science, social policy, and public sector practices are poorly connected and that little is known about how families work. Doing so, he argued, is vital to achieving good results for all children and improving the circumstances of those most vulnerable – for example, grandparents are twice as likely to intervene in child protection situations as child protection agencies.

So we need to support families and to anticipate and understand the effect of changes in their circumstances on their ability to provide good care. In short, to think of them more like our trusted personnel.

Watch this video to hear some of our staff talk about what we did and what we found:

Transcript for this video.

We have published seven reports on the Canterbury earthquake recovery:

• Roles, responsibilities, and funding of public entities after the Canterbury earthquakes;
• Earthquake Commission: Managing the Canterbury Home Repair Programme;
• Effectiveness and efficiency of arrangements to repair pipes and roads in Christchurch;
• Earthquake Commission: Managing the Canterbury Home Repair Programme – follow-up audit;
• Governance and accountability for three Christchurch rebuild projects;
• Effectiveness and efficiency of arrangements to repair pipes and roads in Christchurch – follow-up audit; and
• Canterbury Earthquake Recovery Authority: Assessing its effectiveness and efficiency.