Joint Standing Committee on the National Disability Insurance Scheme Inquiry into General Issues - Annual Report No. 2 of the 47th Parliament | External submission

OFFICIAL

Auditor-General for Australia

Australian National Audit Office

24 June 2024

Ms Libby Coker MP Chair Joint Standing Committee on the National Disability Insurance Scheme Parliament House CANBERRA ACT 2600

Email: ndis.joint@aph.gov.au

Dear Ms Croker

Joint Standing Committee on the National Disability Insurance Scheme Inquiry into General Issues - Annual Report No. 2 of the 47th Parliament

The Australian National Audit Office (ANAO) has published three performance audit reports and three reports relating to the financial statements audit of the National Disability Insurance Agency (NDIA) that the Joint Standing Committee the National Disability Insurance Scheme (the Committee) may find relevant to the Committee’s General Issues inquiry for Annual Report No.2 of the 47th Parliament.

Performance audit reports:

Auditor-General Report No. 43 2022–23 Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports;
Auditor-General Report No. 23 2023–24 Management of Complaints by the National Disability Insurance Agency; and
Auditor-General Report No. 33 2023–24 Compliance with corporate credit card requirements in the National Disability Insurance Agency.

Financial statements audit reports:

Auditor-General Report No. 42 2023–24 Interim Report on Key Financial Controls of Major Entities;
Auditor-General Report No. 26 2022-23 Interim Report on Key Financial Controls of Major Entities; and
Auditor-General Report No. 9 2023-24 Audits of financial statements of Australian Government Entities for the Period Ended 30 June 2023.

The audit reports are available online at www.anao.gov.au. Attachment A summarises key themes emerging from these reports. Attachment B lists conclusions and recommendations from the performance audit reports.

GPO Box 707, Canberra ACT 2601 38 Sydney Avenue, Forrest ACT 2603 Phone: +61 2 6203 7300 Email: rona.mellor@anao.gov.au

OFFICIAL

Should the Committee require further information in relation to this matter, my office would be pleased to provide you with a briefing at a time convenient to you or appear as a witness at a hearing.

To arrange a briefing, please contact our External Relations area at external.relations@anao.gov.au.

Yours sincerely

Rona Mellor PSM Acting Auditor-General

OFFICIAL

Attachment A: Summary of key themes emerging from recent ANAO audit reports

Governance

Bilateral relationships

Arrangements for NDIA staff to access Services Australia’s Centrelink system were not appropriately documented (see paragraph 2.13 and Recommendation no.1, Auditor-General Report No. 43 2022–23 Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports).
The NDIA has not delegated authority for Services Australia to enter into financial borrowing arrangements on its behalf to support the use of corporate credit cards by NDIA (as part of the shared services arrangement) (see paragraphs 2.4, 2.9, 2.10 and Recommendations no. 1, Auditor-General Report No. 33 2023–24 Compliance with corporate credit card requirements in the National Disability Insurance Agency).

Risk management

The NDIA has a Risk Management Strategy dated September 2020, a Risk Management Guide dated November 2019, consistent with the requirements of the NDIS Risk Management Rules 2013, and publishes its strategic risks in its corporate plan (see paragraphs 2.25 and 2.26, Auditor-General Report No. 33 2023–24 Compliance with corporate credit card requirements in the National Disability Insurance Agency).
The frequency and rigour of NDIA’s assessment of fraud risks was insufficient given it had assessed the fraud risk associated with the agency’s activities to be high. The risk assessment that informs the overall risk rating assigned to fraud risks was not documented (see paragraph 20, 3.97 to 3.100 and Recommendation no. 7, 8 and 11, Auditor-General Report No. 43 2022–23 Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports).
The NDIA had identified key overclaiming risks for home and living supports, including assistance with daily life support types. The assessment had not identified controls or mitigation strategies for all risks (see paragraph 21, Auditor-General Report No. 43 2022–23 Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports).
The NDIA’s fraud risk register does not list credit cards or travel as a cause of fraud risk (see paragraph 13, Auditor-General Report No. 33 2023–24, Compliance with corporate credit card requirements in the National Disability Insurance Agency). On a monthly basis, the Financial Control Branch provides to the Risk Advisory Branch the details of incidents of non-compliance with the NDIA Finance Policies and remedial action taken (see paragraphs 10, 2.17, 2.30, Auditor-General Report No. 33 2023–24, Compliance with corporate credit card requirements in the National Disability Insurance Agency).
There is no shared risk register in relation to the shared services that NDIA purchases from Services Australia (see paragraph 13, 2.37 and Recommendation no. 4, Auditor-General Report No. 33 2023–24 Compliance with corporate credit card requirements in the National Disability Insurance Agency).

Control frameworks

The NDIA had a partly fit for purpose fraud control framework and had partly effective controls for managing the risk of overclaiming by participants and providers (see paragraphs 3.92 to 3.196 and recommendations no. 8 to 15, Auditor-General Report No. 43 2022–23 Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports).

OFFICIAL

Accountable Authority Instructions (AAIs) and the NDIA Finance Policies are reviewed annually and are largely consistent with Australian Government guidance on managing credit cards (see paragraph 14, Auditor-General Report No. 33 2023–24 Compliance with corporate credit card requirements in the National Disability Insurance Agency).
The NDIA had implemented partly effective controls and processes for the management and control of corporate credit cards. Controls relating to the issue, cancellation and suspension and management of credit cards were established in policy and procedures. (see paragraphs 11, 16, 2.48, 2.50, 3.4 to 3.6 and 3.12 to 3.13 and Recommendations no. 3 and 6, Auditor-General Report No. 33 2023–24 Compliance with corporate credit card requirements in the National Disability Insurance Agency).
NDIA’s policies permit discretion when identifying and recording non-compliance with corporate credit card requirements during quality assurance reviews, leading to under-reporting of non-compliance (paragraph 11, 17, 3.33 and Recommendation no. 8, Auditor-General Report No. 33 2023–24 Compliance with corporate credit card requirements in the National Disability Insurance Agency).
The NDIA has a largely fit-for-purpose complaints management framework. Supporting internal procedural guidance documents were largely clear, complete, and current. NDIA’s quality assurance results for the management of complaints varied significantly in 2022–23, with low results against multiple procedures and no action plan to remedy performance (see paragraphs 8, 11, 2.35 and Recommendation no.1, Auditor-General Report No. 23 2023–24 Management of Complaints by the National Disability Insurance Agency).
Training completion for complaints officers is monitored and as at January 2024, it was 92 per cent for both complaints induction and continuous improvement training (see paragraphs 2.27 to 2.28 and table 2.4, Auditor-General Report No. 23 2023–24 Management of Complaints by the National Disability Insurance Agency).
In the 2021–22 financial statements audit, the ANAO recommended the NDIA review its overall monthly quality review sampling methodology for plan approvals to address the increased risks of error and fraud associated with single delegate approved plans (see paragraph 2.49, Auditor-General Report No. 43 2022–23 Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports).
Results of NDIA’s internal quality reviews of decisions to fund reasonable and necessary supports within participant plans were continually below target (see paragraphs 2.62 to 2.67, Auditor-General Report No. 43 2022–23 Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports).
The NDIA has largely fit-for-purpose policy and procedures and training to support use of credit cards. Positional authority risks for the acquittal of Board members and the Chief Executive Officer’s credit card and travel expenditure are not appropriately managed through NDIA’s policies and procedures (see paragraphs 10, 14, 2.49 and Recommendation no. 5 and 7, Auditor-General Report No. 33 2023–24 Compliance with corporate credit card requirements in the National Disability Insurance Agency).
NDIA’s controls for managing APS staff and contractor providers of support coordination conflicts of interest were partly effective (see paragraphs 10,19, 3.55 to 3.58, and Recommendations no. 6 and 7, Auditor-General Report No. 43 2022–23 Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports). In relation to provider conflicts of interest, the NDIA had not documented a consolidated range of risks or corresponding controls for matters that fell within its responsibility, noting that the NDIS Commission has primary responsibility for NDIS service provider compliance with the NDIS Code of Conduct and NDIS Practice Standards (see paragraphs 3.82 and Recommendation no.7, Auditor-General Report No. 43 2022–23 Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports).

OFFICIAL

NDIA’s weaknesses in segregating conflicting duties in the IT environment reduced the integrity of the change management processes and records (see Case Study 3 and Table 4.15.11 Auditor-General Report No. 9 of 2023-24 Audits of the Financial Statements of Australian Government Entities for the Period Ended 30 June 2023). ANAO also identified weaknesses in the reporting used to detect potentially inappropriate activity in NDIA’s new ICT operating environment and that remediation of a 2022–23 ANAO financial statements audit finding relating to formal processes to review privileged user activity in the PACE system had not been completed (see paragraph 4.15.43, Auditor-General Report No. 9 of 2023-24 Audits of the Financial Statements of Australian Government Entities for the Period Ended 30 June 2023 and paragraphs 3.22.15 – 3.22.19 Auditor-General Report No. 42 of 2023-24 Interim Report on Key Financial Controls of Major Entities). The NDIA rolled out a pilot of their new Customer Relationship Management (CRM) system, known as PACE, during 2022–23. National rollout of PACE began in October 2023 and is expected to take 18 months to complete. The implementation of PACE has been assessed through the financial statements audit as moderate risk.

Monitoring and reporting

NDIA’s Board did not have adequate oversight of fraud risk (see paragraphs 20, and recommendations no.8 and 10, Auditor-General Report No. 43 of 2022–23 Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports).
NDIA’s senior leadership team and the Board have limited oversight of credit card management and use, including for travel. In monthly financial reporting to the Board and Senior Leadership Team there is a line item on travel and hospitality. Credit card and travel non-compliance are aggregated with other instances of non-compliance with finance law, diminishing the NDIA Board’s and Senior Leadership Team’s understanding of fraud, risk and integrity implications arising from non-compliance (paragraphs 10 and 2.13 to 2.18, Auditor-General Report No. 33 2023–24 Compliance with corporate credit card requirements in the National Disability Insurance Agency).
The NDIA surveys Senior Executive Service (SES) officers on a quarterly basis to identify and report non-compliance with the Public Governance, Performance and Accountability Act 2013 within their respective branches. (paragraph 2.14, Auditor-General Report No. 33 2023–24 Compliance with corporate credit card requirements in the National Disability Insurance Agency).

Service Delivery

Accessibility of information for participants

Participant understanding of NDIA communication and published policies and procedures could be improved with further research of the communication needs of specific cohorts (see paragraphs 13, 2.18 to 2.34, Auditor-General Report No. 43 2022–23 Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports).
The NDIA’s complaints processes largely align with the key design elements of the Commonwealth Ombudsman’s better practice principles (paragraph 10, Auditor-General Report No. 23 2023–24 Management of Complaints by the National Disability Insurance Agency).
The NDIA identified that some participant groups make disproportionately low numbers of complaints. For example, internal reporting in December 2022 stated, ‘Participants who have identified as First Nations Peoples or culturally or linguistically diverse are less likely to submit a complaint than other participants.’ The NDIA has not identified the causal drivers for such results, including whether these cohorts may experience barriers to submitting complaints. NDIA published a new complaints policy in February 2024 that included an easy-read version. NDIA’s complaints policy is not available in languages other than English. (see paragraphs 10, 2.11 and 2.24, Auditor-General Report No. 23 2023–24 Management of Complaints by the National Disability Insurance Agency).

OFFICIAL

Development of participant plans

The NDIA had policies, procedures and guidelines that support NDIA staff and Local Area Coordinators (LAC) with the administration of assistance with daily life (ADL) supports (see paragraphs 12, 2.4 to 2.13, Auditor-General Report No. 43 2022–23 Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports).
The NDIA had not assessed the impacts on participant plan outcomes or scheme sustainability from high usage by planners of the World Health Organization Disability Assessment Schedule 2.0 (WHODAS) assessment tool (see paragraphs 14, 2.50 to 2.59, Recommendation no. 2, Auditor-General Report No. 43 2022–23 Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports).

Performance against service standards

From October 2021 to June 2022, the quality of decisions to fund supports considered reasonable and necessary for participants’ needs were below NDIA’s target of 75 per cent. NDIA’s results against its key performance measure of starting planning within 21 days of an access decision were consistently above its 95 per cent target since quarter one, 2021–22 and results against the performance measure of approving a plan within 56 days had improved since 2021–22 and reached the target for the first time in quarter two, 2022–23 (see paragraphs 14, 2.60 to 2.76, Auditor-General Report No. 43 2022–23 Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports).
In 2022–23, the NDIA did not meet its 90 per cent target for resolving complaints within 21 days. Performance against the 21-day standard was 71 per cent for the December 2023 quarter. In 2022–23, NDIA’s reported performance against the service standard of one day to acknowledge the complaint was 87 per cent. The reported performance for the service standard of contacting the complainant within two days was 96.8 per cent in 2022–23. Both results were below the NDIA’s 100 per cent target for these service standards (see paragraphs 8 and 12 Auditor-General Report No. 23 2023–24, Management of Complaints by the National Disability Insurance Agency).

Continuous improvement

The NDIA collected comprehensive data on participant outcomes but did not undertake analysis of trends or outcomes to inform service improvement (see paragraphs 2.109 to 2.126, Auditor-General Report No. 43 2022–23, Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports).
The effectiveness of the NDIA’s suite of internal reporting of complaints management would be enhanced by more timely reporting on complaints outcomes, detailed qualitative analysis and greater use of complaints data alongside other service delivery data to support continuous improvement activities. NDIA does not monitor or report on the effectiveness of improvements introduced to its complaint management processes. The NDIA’s 2023 review of complaints management lacked baseline evidence and a detailed implementation plan (see paragraph 9 and 15 and Recommendation no. 2 Auditor-General Report No. 23 2023–24, Management of Complaints by the National Disability Insurance Agency).

Implementation of ANAO performance audit and external review recommendations

The NDIA had not fully implemented seven of nine recommendations from two prior ANAO performance audit reports: NDIA had partly implemented the three recommendations from Auditor-General Report No. 14 2020–21 Decision-making controls for NDIS Participant Plans; and had not

OFFICIAL

fully implemented four of the recommendations from Auditor-General Report No. 50 2018–19 National Disability Insurance Scheme Fraud Control Program (see Recommendations no. 4, 9, 10, 12, 13 and 14, Auditor-General Report No. 43 2022–23 Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports).

There is no evidence of the NDIA accepting or rejecting the 14 recommended initiatives from a review of its complaint management process undertaken in 2019. There is evidence of implementation of two and partial implementation of a further three recommendations. There were recurring themes in the recommendations from the 2019 review and a 2023 internal review (see paragraph 14 Auditor-General Report No. 23 2023–24, Management of Complaints by the National Disability Insurance Agency).

OFFICIAL

Attachment B: Conclusions and recommendations to the National Disability Insurance Agency from recent ANAO performance audit reports

Auditor-General Report No. 43 2022–23, Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports assessed:

Does the NDIA effectively support NDIS participants who require assistance with daily life?
Does the NDIA effectively manage operational risks to the proper use of resources in administering assistance with daily life supports?

The audit concluded that:

The NDIA’s management of assistance with daily life supports was partly effective. Seven out of nine recommendations made by the Auditor-General in prior audits relating to improved decision-making controls and fraud controls, which relate to the NDIA’s management of risks to proper use of resources, were not fully implemented.

The NDIA has developed largely fit for purpose policies, procedures and guidelines to support the administration of ADL, informed by feedback mechanisms and continuous improvement processes. NDIA communications support staff, partner and provider understanding of ADL however, additional communications could be developed to support participant understanding. The NDIA conducts research to inform its communications approach and assesses its effectiveness.

NDIA’s planning and implementation arrangements are largely fit for purpose. Results of internal quality reviews of decisions to fund reasonable and necessary supports are continually below target. The NDIA publishes guidance material to assist participants to use their allocated funding and implement their plans, and monitors plan usage through regular reports. While the NDIA monitors and assesses participant outcomes through the collection of feedback and data points, greater analysis could be undertaken to inform service improvement.

The NDIA has partly effective processes in place to manage the risks to the proper use of resources for all support categories, including ADL, with deficiencies identified in relation to the quality of its decision-making, staff related conflicts of interest and fraud controls. The NDIA partly implemented recommendations from Auditor-General Report No. 14 2020–21 Decision-Making Controls for NDIS Participant Plans. NDIA has established and follows appropriate arrangements for setting prices for funded supports including ADL. NDIA’s management of conflict of interest risk is largely effective for Board members, SES staff and Partners in the Community (PITC). Controls for managing APS staff and contractor providers of support coordination conflicts of interest are partly effective.

NDIA has a partly fit for purpose fraud control framework and has partly implemented recommendations from Auditor-General Report No. 50 2018–19 National Disability Insurance Scheme Fraud Control Program. The NDIA has partly effective controls for managing the risk of overclaiming by participants and providers.

Recommendations

This report made 13 recommendations to the NDIA relating to governance of systems access, planning, conflict of interest, and implementing prior audit recommendations on controls for planning decisions and fraud. There was one recommendation to NDIA and Services Australia to document arrangements for NDIA staff to access Centrelink information. There was one recommendation to the Australian Government to align fraud control requirements for NDIA with those of non-corporate Commonwealth entities.

OFFICIAL

Recommendation no. 1

The National Disability Insurance Agency (NDIA) and Services Australia document the arrangements for NDIA staff to access information in Services Australia’s Centrelink mainframe system, including setting out the legislative basis, terms and conditions for use, and applicable governance arrangements.

National Disability Insurance Agency response: Agreed. Services Australia response: Not Agreed.

Recommendation no. 2

The National Disability Insurance Agency (NDIA) review:

a. the use of the World Health Organization Disability Assessment Schedule 2.0 (WHODAS) tool by planners in developing participant plans, including analysis of plan outcomes, to assess the impact the use of this assessment tool has on participant plan outcomes and scheme sustainability; and b. guidelines, procedures and web content to ensure it transparently conveys NDIA policy about the use of assessment tools consistent with legislative requirements.

National Disability Insurance Agency response: Agreed.

Recommendation no. 3

The National Disability Insurance Agency reviews the impact of its policy changes relating to approval of plans that vary from Typical Support Packages (TSPs), including:

a. assessing the impact on plan funding outcomes, plan costs and overall scheme costs of no longer requiring higher delegation approval of plans with funding that varies by more than eight per cent from the TSP; and b. undertaking a post-implementation review of its new integrated TSP calculator to ensure variations from the TSP reference point are supported by appropriate evidence of participants’ circumstances and determine whether ongoing monitoring is needed.

National Disability Insurance Agency response: Agreed.

Recommendation no. 4

The National Disability Insurance Agency implement the first recommendation of Auditor-General Report No. 14 2020–21 Decision-making Controls for NDIS Participant Plans by including controls relating to participant planning considerations and approvals within its new PACE ICT system, to align the system processes with internal policy requirements and to better support planning processes for reasonable and necessary decision-making.

National Disability Insurance Agency response: Agreed.

Recommendation no. 5

The National Disability Insurance Agency (NDIA):

a. fully implement the second recommendation of Auditor-General Report No. 14 2020–21 Decision-making Controls for NDIS Participant Plans by using outcomes data from internal reviews and Administrative Appeals Tribunal reviews (and other mechanisms such as Independent Expert Reviews), including early resolution outcomes, to inform continuous improvement in reasonable and necessary decision-making; and b. regularly publish summaries of NDIA review data and analysis to improve transparency of review processes.

OFFICIAL

National Disability Insurance Agency response: Agreed.

Recommendation no. 6

The National Disability Insurance Agency (NDIA) improve its management of conflicts of interest by implementing:

a. procedures for how the Board manages conflicts arising from declared interests of members; b. mandatory requirement for all NDIA staff, contractors engaged by NDIA and Partners in the Community staff to make an annual declaration of any real or apparent conflict of interest; c. mandatory business practices and ICT controls to restrict access to participant records that relate to a real or apparent conflict of interest reported to NDIA; and d. ICT controls to log all access and amendments to participant records in CRM and PACE, by staff, contractors and Partners in the Community and conduct regular audits of access logs for compliance with policies and declared conflicts of interest.

National Disability Insurance Agency response: Agreed.

Recommendation no. 7

The National Disability Insurance Agency assess and quantify the conflict of interest risks posed by providers delivering both support coordination and provision of supports to the same participant, and implement controls to mitigate the risk to participants.

National Disability Insurance Authority response: Agreed.

Recommendation no. 8

The National Disability Insurance Agency fully implement the first recommendation of Auditor-General Report No. 50 2018–19 National Disability Insurance Scheme Fraud Control Program by regularly updating the Risk Register with planned controls, the delivery date and the project or activity under which the control will be developed and implemented.

National Disability Insurance Agency response: Agreed.

Recommendation no. 9

National Disability Insurance Agency response: Agreed.

Recommendation no. 10

The National Disability Insurance Agency fully implement the fifth recommendation of Auditor-General Report No. 50 2018–19 National Disability Insurance Scheme Fraud Control Program and ensure visibility of the fraud control environment by providing regular reports to the Board containing a summary of the status of the Fraud and Corruption Risk Register including:

a. the untreated and treated risk ratings for each of the fraud risk types; b. the controls effectiveness rating for each of the fraud risk types; and c. the actions required on controls, with implementation dates.

National Disability Insurance Agency response: Agreed.

OFFICIAL

Recommendation no. 11 When conducting risk assessments for each risk listed in the Fraud and Corruption Risk Register, the National Disability Insurance Agency document the factors considered, their weighting and the rationale for the overall risk rating. The Board should regularly review the risk assessment, including on each occasion it considers a proposed amendment or update to the Fraud and Corruption Risk Register.

National Disability Insurance Agency response: Agreed.

Recommendation no. 12 The National Disability Insurance Agency fully implement the fourth recommendation of Auditor-General Report No. 50 2018–19 National Disability Insurance Scheme Fraud Control Program by undertaking a review of its project management of fraud control. This review should: a. map all projects and activities with fraud control dimensions, including their status, linkages, relative priority and resourcing; b. determine whether additional projects or activities are required to close any gaps between the fraud risks and the implemented and planned fraud controls within projects; and c. support updating the Fraud and Corruption Risk Register.

National Disability Insurance Agency response: Agreed.

Recommendation no. 13 The National Disability Insurance Agency fully implement the second recommendation of Auditor-General Report No. 50 2018–19 National Disability Insurance Scheme Fraud Control Program to improve its active fraud detection methods by implementing data matching activity as a matter of priority, and on a continuing basis.

National Disability Insurance Agency response: Agreed.

Recommendation no. 14 That the National Disability Insurance Agency fully implement part (b) of the third recommendation of Auditor-General Report No. 50 2018–19 National Disability Insurance Scheme Fraud Control Program by establishing performance measures for its investigative functions that align with organisational goals for fraud investigations.

National Disability Insurance Agency response: Agreed.

Recommendation no. 15 The Australian Government aligns the fraud control requirements for the National Disability Insurance Agency with those of non-corporate Commonwealth entities, including the Commonwealth Fraud Control Policy and the reporting requirements of subsection 17AG(2) of the Public Governance, Performance and Accountability Rule 2014.

National Disability Insurance Agency response: Noted. Attorney-General’s Department response: Noted.

Auditor-General Report No. 23 2023–24, Management of Complaints by the National Disability Insurance Agency assessed:

Does the NDIA have a fit-for-purpose complaints management framework?
Does the NDIA adequately report on complaints, and outcomes, and review its management of complaints?

The audit concluded that:

The National Disability Insurance Agency’s (NDIA’s) management of complaints was partly effective.

The NDIA has a largely fit-for-purpose complaints management framework. Supporting internal procedural guidance documents were largely clear, complete, and current. Complaints management is monitored through a monthly quality assurance process assessing four key areas: right person; right process; right referral; and right resolution. The quality assurance results varied significantly from month to month across all four areas in the last financial year, with low results against multiple procedures and no action plan to remedy performance. In 2022–23, the NDIA did not meet its 90 per cent target for resolving complaints within 21 days.

The NDIA’s reporting and evaluation of complaints management is partly effective. The NDIA reports internally and publishes regular data on complaints statistics and performance against service standards with limitations on data quality clearly identified. The effectiveness of the NDIA’s suite of internal reporting would be enhanced by more timely reporting on complaints outcomes, detailed qualitative analysis and greater use of complaints data alongside other service delivery data to support continuous improvement activities. The NDIA had not fully implemented monitoring and reporting actions identified by the Commonwealth Ombudsman for lifting its complaints approach to a ‘superior’ maturity level. Recommendations from a 2019 review were not fully implemented. The NDIA’s 2023 review of complaints management lacked baseline evidence and a detailed implementation plan.

Recommendations There were two recommendations to the NDIA, relating to improving its complaints quality assurance framework, and using complaints data to identify service improvements.

Recommendation no. 1 The NDIA implement a fit-for-purpose complaints quality assurance framework to support monitoring of quality and continuous improvement.

National Disability Insurance Agency response: Agreed.

Recommendation no. 2 The NDIA plan and undertake a program of quarterly reviews of complaints data, matched with other service delivery performance data, including participant satisfaction surveys, to support identification of areas for continuous improvement.

National Disability Insurance Agency response: Agreed.

Auditor-General Report No. 33 2023–24, Compliance with corporate credit card requirements in the National Disability Insurance Agency assessed:

Whether NDIA has effective arrangements in place to manage the issue, return, and use of corporate credit cards; and
Whether the NDIA has implemented effective controls and processes for corporate credit cards in accordance with their policies and procedures.

The audit concluded that:

The NDIA’s management of the use of corporate credit cards for official purposes in accordance with legislative and entity requirements has been partly effective. NDIA has established controls that were not robustly implemented to provide sufficient assurance to the Board that fraud risks are being managed.

NDIA has partly effective arrangements in place to manage the issue, return and use of corporate credit cards. NDIA’s senior leadership team and the Board have limited oversight of credit card management and use, including for travel. Reporting of use and non-compliance is provided to Financial Control Branch within the Chief Finance Officer Division, and non-compliance incidents are reported to the Risk Advisory Branch. Financial authorisations for Services Australia to enter into borrowing arrangements on NDIA’s behalf were not in place. The NDIA’s fraud risk register does not list credit cards or travel as a cause of fraud risk. There is no shared risk register or approach with Services Australia. NDIA has largely fit-for-purpose policy and procedures and training to support use of credit cards, except for not addressing positional authority risks.

NDIA has implemented partly effective controls and processes for management and control of corporate credit cards. Preventive controls were partly implemented, with cards issued to Senior Executive Service (SES) officers without line manager endorsement, credit limits that were not consistent with NDIA policies and the NDIA not utilising merchant blocking technology. Detective controls were partly effective in supporting detection of credit card misuse, and travel approval and acquittal non-compliance. Travel by Board members, and travel and credit card expenditure by the CEO and SES officers was often approved by a staff member junior to the traveller or credit cardholder and did not address positional authority risk. NDIA’s policies permit discretion when identifying and recording non-compliance during a quality assurance review, leading to under-reporting of non-compliance. NDIA has partly implemented effective controls for managing non-compliance. NDIA does not monitor the timeliness of travel acquittals, use its system to record all instances of travel non-compliance or take action in response to most identified travel non-compliance.

Recommendations

There were eight recommendations to NDIA and one recommendation to both NDIA and to Services Australia.

Recommendation no. 1 The National Disability Insurance Agency establishes a financial authorisation to support the borrowing undertaken by Services Australia on its behalf under the shared services arrangements.

National Disability Insurance Agency response: Agreed.

Recommendation no. 2 The National Disability Insurance Agency’s (NDIA’s) Board receive and consider complete and accurate reporting of non-compliances with finance law and NDIA policies, including for credit card and travel expenditure.

National Disability Insurance Agency response: Agreed. Recommendation no. 3

The National Disability Insurance Agency clearly articulate in approved risk registers the reasons for risk ratings and incorporate effective controls and mitigations so that risk is managed within approved tolerance levels, consistent with the Agency’s Risk Management Guide.

National Disability Insurance Agency response: Agreed.

Recommendation no. 4 Services Australia and the National Disability Insurance Agency approve a shared risk register and implement agreed management plans for identified risks related to the shared services arrangements.

National Disability Insurance Agency response: Agreed. Services Australia response: Agreed.

Recommendation no. 5 The National Disability Insurance Agency (NDIA) address positional authority risk relating to the approval of NDIA Board Chair, NDIA Board members and CEO credit card expenditure and travel, by requiring that: (a) expenditure made by or on behalf of the NDIA Board Chair be approved by a deputy or other NDIA Board member; (b) expenditure made by or on behalf of NDIA Board members (other than the Chair) be approved by the NDIA Board Chair; and (c) expenditure made by or on behalf of the NDIA CEO be approved by the NDIA Board.

National Disability Insurance Agency response: Agreed.

Recommendation no. 6 The National Disability Insurance Agency introduce controls to: (a) prevent the activation or use of new or replacement credit cards until cardholders have acknowledged receipt of the card and confirm they will comply with NDIA policy; and (b) require approval from the supervising Senior Executive Service (SES) officer for all credit card applications by SES officers, consistent with NDIA’s policy requirements.

National Disability Insurance Agency response: Agreed.

Recommendation no. 7 To support accountability and separation of duties, the National Disability Insurance Agency introduce additional assurance processes for cardholder transactions in the Chief Financial Officer Division and Financial Control Branch.

National Disability Insurance Agency response: Agreed.

Recommendation no. 8 The National Disability Insurance Agency (NDIA) develop guidance on steps for identification of all types of credit card non-compliance with NDIA Finance Policies, and a system for reporting all non-compliance, including those that are rectified as part of the quality assurance process.

National Disability Insurance Agency response: Agreed.

Recommendation no. 9 The National Disability Insurance Agency introduce a quality assurance process to cross check reports for completeness and accuracy with other relevant information sources, document identified discrepancies and remedial action taken.

National Disability Insurance Agency response: Agreed.