We issued this to all public sector entities on 6 April 2020

We recognise that State and local government entities are spending significant time and effort dealing with the operational ramifications of the COVID-19 public health response. We have prepared consideration points to prevent key control breakdown during this period.

It is vitally important that entities are aware that times of disruption present a heightened risk environment. Those who are dishonestly inclined will be keen to take advantage of any sense of crisis. Good control over finances and key decisions during this period means that entities and senior decision-makers will be better prepared to resume normal operations when the crisis is over. It also means they won’t be left dealing with the ramifications of fraud, error or decisions taken in haste that may be regretted when conditions are calmer. Importantly, public trust will be upheld.

Management should ensure staff maintain good controls, particularly over cash, expenditure and assets. Good controls are also important for any regulatory or non-financial decisions that bind the entity, or the State, into the future, such as for approvals, concessions, operating permits, or conditions.

Some contextual considerations for entities

• Consider if there is an exaggerated sense of urgency that may persuade or permit staff to override important
• Recognise that existing gaps in controls, which in normal times may not be exploited, can become gaping holes when staff are not overseen as closely when working from home or key people are distracted by other
• Have you explicitly promoted a culture encouraging staff to speak if they see something that poses a risk during this period? If staff or stakeholders see something, they should say something, are they aware of fraud control reporting, including public interest
• Are credentials (for example, qualifications, working with children checks and police checks) and references still checked before on-boarding new personnel?
• Are delegations and authorisations valid, and changes to delegations approved (for example, if there are senior management absences due to illness or secondments)?
• Are licenses and/or permits lawfully issued/approved, and with due probity? A sense of urgency or chaos may override due process as well as bring opportunistic requests. Be cautious, weigh risks and benefits with probity to prevent conflicts of interest and good record keeping.
• Are debt waiver/acts of grace authorised in accordance with law?
• Are purchasing/corporate credit cards issued in line with policy? [See our better practice guidance on Purchasing cards (for State government) and our May 2018 report Controls over Corporate Credit Cards (for local government).]
• Are senior management continuing to monitor and scrutinise spending against the budget, with genuine understanding of the reasons for variances? And monitoring cash flow and balances?
• Is there timely cancellation of automatic/periodical payments for services that are no longer being provided?
• Are working from home conditions clearly defined and approved? [See our better practice guidance on Security considerations for remote working arrangements]

Assets – Risk of misappropriation, unauthorised purchases or disposals

Entities should ensure:

• all purchases are in line with their procurement policy and any temporary divergence from the policy is approved by the DG or CEO and recorded in a central registry
• asset acquisitions are approved in line with the delegation of authority
• asset reconciliations between the register and the general ledger are prepared and reviewed on a timely basis
• asset disposals/write-offs are appropriately authorised
• loans of assets to other entities are properly recorded and authorised
• where necessary, key responsibilities continue to be segregated in relation to asset acquisition, recording, custody, disposal and reconciliation
• appropriate records of portable and attractive assets are maintained, particularly those that staff may take home to use when working from

Cash – Risk of misappropriation

Entities should ensure:

• regular bank reconciliations are prepared and reviewed, reconciling items are investigated and resolved
• all bank accounts have at least 2 signatories
• online purchasing policies are reviewed to reflect the current period
• increases in purchasing card limits are appropriately approved
• there are appropriate and timely reviews of credit card

Expenditure – Risk of unauthorised or invalid payments, incorrect or invalid suppliers, and increased risk of fraudulent payments

Entities should ensure:

• all purchases are in line with their procurement policy and any temporary divergence from the policy is approved by the DG or CEO and recorded in a central registry
• changes to vendor master files are documented and approved (see our better practice guidance on Management of supplier master files)
• there is separation between the vendor creation and payment approval functions
• a 3-way match is performed of invoices, receipt of goods and purchase orders
• payment authorisation is made in line with the delegation of authority and requires 2 to sign. Signatories should pay particular attention to the delivery addresses of goods received
• purchase orders are prepared and appropriately authorised
• appropriate security and checks are in place over EFT payment data
• there is segregation of duties between officers performing the functions of ordering, receiving, incurring and certifying (for State government entities, in line with Treasurer’s Instruction 304)

Queries

If you have any queries please contact your OAG financial audit engagement leader or our general enquiries via info@audit.wa.gov.au or phone (08) 6557 7500. For information on making a Public Interest Disclosure (PID), phone (08) 6557 7500 and ask to speak to a PID officer.