Report 1: 2020-21

Working with Children Checks – Managing Compliance

Findings

A lack of corporate direction and monitoring has contributed to inconsistent management of obligations

The 3 audited entities did not consistently manage their records to meet their Card obligations. For example, we found 1 entity had not identified the positions that need a Card, some operational areas did not understand what information needed to be recorded, and all entities’ records were incomplete and contained errors. These gaps in controls mean that entities cannot be sure all individuals who need a card have one.

Card recording is inconsistent

All 3 entities recorded Card details. Each took a different approach:

  • a centralised database of all individuals onsite, updated by operational areas, that directly checks the Card status of employees against the Communities database. This provides a good, consistent approach for all individuals
  • a centralised database of employees only that is updated by a dedicated area within the entity. Cards of relevant tertiary student placements, volunteers and contractors are recorded in decentralised spreadsheets maintained by individual operational areas. As a result, approaches for tertiary students, volunteers and contractors can vary
  • decentralised spreadsheets for all individuals on site maintained by individual operational areas. As a result, approaches to recording information can vary.

Without consistent recording of key information, entities cannot be sure their records meet their obligations, which increases the risk of unsuitable individuals working with children. In Case study 1, we found an entity inconsistently recorded Card information for students, contractors and volunteers. This entity did not capture information for these Cards in a central system and had not provided direction to their operational areas on what to record. As a result, while some areas had detailed records, others did not.

Incomplete and incorrect records prevent entities from knowing if all employees have a Card

Not all central records identify employee positions that require a Card. We found 1 entity relied on its operational areas to identify these positions, as it did not have a central listing, while the other 2 entities had flagged positions that needed a Card within their HR systems. Without a central listing of positions, entities cannot be certain everyone who needs a Card has one.

Card record systems all had missing or incorrect information. All entities’ record systems had fields for essential Card information for employees, including:

  • name
  • date of birth
  • Card number
  • Card expiry date.

However, we found 5,783 (6.9%) of the 83,713 records had errors or gaps. These included incorrect Card numbers, alternate spelling of surnames and incorrect expiry dates (Figure 3). In 412 cases, the entities’ records showed Cards as valid for longer than they actually were. These issues would prevent entities from checking if Cards were valid, or in some cases, knowing when a Card has or is about to expire. 

Issues identified in entitie’s records Number of records with issue*
Card number not recorded 80
Card number assigned to multiple individuals in the entity’s records 6
Card number was not a real Card number 238
Surname in entities’ record spelt differently to Communities’ record 2,903
Date of birth different to Communities’ records 8
Expiry date different to Communities’ records 2,549

(* 1 record had multiple errors)

Source: OAG
Figure 3: Missing or incorrect employee information in the 3 entities’ records.

While most employees had valid Cards, we found employees in all 3 entities whose Cards had expired. We did not find any employees working with children with a negative notice or an interim negative notice. We could match 80,486 records to Communities’ database at a point in time and found 80,196 (99%) employees had valid Cards.[1]

For those 290 Cards that had expired, the majority had been expired for more than 5 days and more than half had been expired for more than 90 days (Figure 4). Entities would not have met their obligations under section 22 of the Act if they allowed these individuals to work with children for more than 5 days in a year. We have provided a list of these employees to each relevant entity, for follow-up purposes.

Source: OAG
Figure 4: Expired Cards across all 3 entities, at 4 November 2019.[2]

Executive teams do not adequately monitor how well their entities manage Cards

Entities do not have a good understanding of how well they manage Card obligations. None of the executive teams at the 3 entities received detailed information on how Card obligations were met across their operations. One entity’s executive team did not receive any reports on how well Cards were managed. The other 2 entities only provided their executive team with the total number of expired Cards, without information on how long Cards had been expired or a breakdown by operational areas. Periodic performance monitoring by executive teams is an effective way for entities with diversified and decentralised operations, like the 3 we audited, to identify and address systemic compliance issues.

In the 2 entities with centralised data systems, operational areas receive reports when employee Cards expire or are due to expire. This helps these operational areas proactively manage compliance.

Entities may not know when Cards have expired or been revoked

Automated and manual processes to check Cards are not fully effective and increase the risk that entities could allow unsuitable individuals to work with children. We found:

  • at the entity with automated Card checks against the Communities database, these checks were not always effective. Staff did not add all individuals to the record system and as a result, the automated process could not check all Cards. This automated system could provide the entity with an effective control. However, for it to be fully effective, all individuals need to be entered
  • entities cannot be sure manual checks were done. The 2 entities that relied on manual processes to check Cards against the Communities’ webpage did not capture if these checks were performed, and we found no other evidence that they were.

Entities may not be notified when Cards are revoked by Communities, as they do not always inform Communities of new hires. We checked entities’ Card records against the Communities database for 5 operational areas, across the 3 audited entities. We matched 690 individuals and found the Communities database did not list the entity as an employer in 53 (7.7%) cases. These Cards were still valid, but Communities would not know to notify the entities if it revoked the Card. As a result, entities would not be aware they are placing children at risk if a Card is revoked by Communities.  

We acknowledge, that during the audit, 1 of the operational areas improved its processes and registered existing employees with Communities.

Some policies and procedures do not provide staff with adequate guidance

Not all policies provided staff with clear guidance on how to manage Card obligations. We found 1 entity did not have an up-to-date policy or procedures that align to the entity’s current organisational structure. Instead, operational areas relied on old policies from 2010 that did not provide guidance on which positions in the new structure needed a Card and referred staff to non-functioning hyperlinks. Up-to-date policies and procedures help staff fulfil their duties to manage Card obligations. The entity told us it is reviewing its policies and hopes to complete this work in 2020.

While the other 2 entities had central policies, we found some staff were unaware of existing policies. We interviewed staff who managed Cards and found some were not familiar with their entity’s working with children policy. Entities should actively promote awareness of their policies to reduce the risk of them not meeting their working with children obligations. We note that 1 entity developed an online training package about their policy in February 2019, which only 1.5% of staff had completed in the 10 months up to our audit.

[1] Comparing entity records to a snapshot of the Communities Working With Children database from 4 November 2019

[2] This table excludes employees who were on leave on 4 November 2019, as they were not working with children on that day

Back to Top