NDIA Accountability Project

Decision-making Controls for NDIS Participant Plans

‹ PrevPage 1 of 14 · Source p. 1Next ›

23 January 2024

Ms Libby Coker MP
Chair
Joint Standing Committee on the National Disability Insurance Scheme
By email: ndis.joint@aph.gov.au

Dear Ms Coker

ANAO Submission for the Inquiry into the NDIS participant experience in rural, regional and remote Australia

The Australian National Audit Office (ANAO) presented the following performance audits to the Parliament that you may find relevant to the above inquiry:
- Auditor-General Report No.43 (2022-23) Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports; and
- Auditor-General Report No.14 (2020-21) Decision-making Controls for NDIS Participant Plans
Information about what the audits assessed, concluded and recommended is attached. The audit reports are available online at [www.anao.gov.au](https://www.anao.gov.au).
Should the Committee require further information in relation to these matters, my office would be pleased to provide you with a briefing at a time convenient to you or appear as a witness at a hearing. To arrange a briefing, please contact our External Relations team at external.relations@anao.gov.au.

Yours sincerely

Grant Hehir

GPO Box 707, Canberra ACT 2601
38 Sydney Avenue, Forrest ACT 2603
Phone: +61 2 6203 7300

Auditor-General Report No.14 2020–21

Decision-making Controls for NDS Participant Plans

Background

  1. The NaƟonal Disability Insurance Scheme (NDIS or the Scheme) replaced exisƟng Commonwealth, state and territory disability support systems with a naƟonally consistent scheme aimed at providing Australians under the age of 65, who have a permanent and significant disability, with the reasonable and necessary supports they need to live an ordinary life. The NDIS is a naƟonally based scheme with funding and governance shared amongst all governments. The NaƟonal Disability Insurance Agency (NDIA or the Agency) holds and manages Scheme funds, administers access to the Scheme and approves payments of support packages based on individual parƟcipants’ needs.

  2. The NDIS provides funding to eligible parƃipants so they can access disability supports and services. The Scheme commenced in July 2013 with a three year trial phase before being progressively rolled out to each state and territory over a four year transiƟion phase from 1 July 2016. 2020–21 is the Scheme’s first year of full operaƟon, with the NDIA transiƟoning to full scheme on 1 July 2020. When fully implemented, the Scheme is expected to benefit around 500,000 Australians.

  3. The NDIS care model seeks to invest in appropriate supports over the life of each parƇipant. Eligible parƆipants will develop a plan with the NDIA, which idenƓifies their individual goals and aspiraƕons and the ‘reasonable and necessary’ supports$ required to help them achieve these. Plans generally cover a minimum 12 month period. Plans are reviewed with a parƈicipant prior to expiry and a new plan is developed. ParƉicipants with an approved plan may purchase supports from service providers of their choice.%

  4. ParƊparticipants receive funding for supports — assistance or products that help a person in their daily life and help them to paƌicipate in the community and reach their goals — from the NDIA through the provision of a participant plan. The requirements for plans are outlined in secƗion 33 of the National Disability Insurance Scheme Act 2013 (NDIS Act). A key component of a plan, the statement of participant supports, which is prepared with the participant and approved by the NDIA Chief ExecuƔve Officer (CEO) specifies, among other things, any reasonable and necessary supports that will be funded under the NDIS. In making a decision over the funding for reasonable and necessary supports, the CEO must be saƟsfied of six criteria outlined in subsecƘon 34(1) of the NDIS Act. RationaƖe for undertaking the audit

  5. The NDIS represents a significant financial commitment by all Australian governments. The NDIS is expected to grow over the next three years to provide support to approximately 500,000 Australians with permanent and significant disability. In 2019–20, $16.1 billion of supports was funded through parƓicipant plans.

  6. Decisions on the reasonable and necessary supports to be provided to parƕicipants under the Scheme are criƗical to both paȓticipant outcomes and Scheme flinancial sustainability. Financial sustainability is a key objecƚive of the NDIS, and the scope and volume of supports funded through

Participant Plans: Reasonable and Necessary Supports

Participants’ plans is a major cost driver. To manage this cost driver, the supports included in participant plans must be ‘reasonable and necessary’ as defined in the NDIS Act. Decisions about what are reasonable and necessary supports require the exercise of judgement on behalf of delegated decision makers. Failure to implement effective decision-making controls could result in:

  • inconsistency in the application of the law;
  • significantly increased Scheme costs;
  • inadequate provision of support to Scheme participants; and/or
  • cost-shifting between government programs or to participants.
  1. The NDIA’s control framework has been subject to two previous ANAO performance audits. Of particular relevance is the ANAO’s 2017–18 audit that examined the decision-making controls for NDIS access. This audit builds on the work undertaken in the earlier audit to provide assurance of the financial sustainability control framework for the NDIS, by examining decision-making controls for participant plans.

Audit Objective and Criteria

  1. The audit objective was to assess whether the NDIA has appropriate controls to ensure supports in participant plans are ‘reasonable and necessary’.

  2. To form a conclusion against the audit objective, the ANAO adopted the following high level audit criteria:

  • Has the NDIA established and implemented appropriate policies and processes to ensure supports in participant plans are ‘reasonable and necessary’?
  • Is there appropriate oversight to ensure supports in participant plans are ‘reasonable and necessary’?

Conclusion

  1. The NDIA does not yet have appropriate controls to ensure supports in participant plans are ‘reasonable and necessary’. While an appropriate control framework had been established, the effective implementation of the controls will provide the NDIA with greater assurance that the supports approved in participant plans are reasonable and necessary. Effective implementation of controls will further assist the NDIA to manage risks relating to Scheme sustainability, while ensuring participants are receiving adequate supports.

  2. While the NDIA had established largely appropriate policies and processes for participant planning, the implementation of the policies and processes did not provide the NDIA with appropriate assurance that supports in participant plans are reasonable and necessary.

  3. The NDIA does not yet have appropriate oversight mechanisms in place to ensure the supports in participant plans are reasonable and necessary. The NDIA has established some frameworks for

Oversight of Decision-Making

oversight and control of decision-making for participant plans; however, to date, this is not systematically leading to enterprise wide actions for improvement and compliance in decision-making. Supporting Findings

  • The NDIA has established largely appropriate policies and processes for participant planning. The NDIA’s internal guidance and training materials are consistent with the legislation, although oversight of training completion could be improved. Additional support mechanisms are in place to assist delegates in reasonable and necessary decision-making. The NDIA instrument of delegation had not been updated to reflect organisational changes made to plan delegation level four arrangements over a two year period.

  • Implementation of participant planning has not complied with established policies and processes. The NDIA’s quality assurance audits have shown low levels of compliance with internal policy. The NDIA’s Customer Relationship Management system does not fully support recording of participant planning considerations and approvals, or require all mandatory planning requirements to be completed.

  • The NDIA had implemented a largely appropriate quality assurance process for participant plans. There was not enough evidence that quality assurance activities lead to action taken to resolve the issues identified and systemic improvement. As the NDIA had recently commenced continuous improvement processes, it was not evident what impact these processes have had to date.

  • While the NDIA had some mechanisms for review processes to inform continuous improvement in decision-making for reasonable and necessary supports, these are not considered at an enterprise level and their impact is unclear.

  • Since June 2019, the NDIA has been measuring performance of planners in relation to reasonable and necessary decision-making through an internal Key Performance Indicator (KPI) and a separate quality metric. The underlying input to both performance measures is the same, yet the measures have different targets. The NDIA does not report externally specifically in relation to reasonable and necessary supports in participant plans; however, information more broadly around reasonable and necessary supports is included in external reports.

  • (a) using outcomes data from internal reviews and AAT reviews, including early resolution outcomes, to inform continuous improvement in reasonable and necessary decision-making; and

  • (b) implementing metrics for measuring the success of continuous improvement initiatives to enable the Agency to determine whether the initiatives are having the intended impact. National Disability Insurance Agency Response: Agreed

Recommendation No. 3

The National Disability Insurance Agency align Service Delivery KPI and quality metric targets for reasonable and necessary decision-making; and review the target on a regular basis with a view to increasing the target to drive greater quality standards in reasonable and necessary decision- making. National Disability Insurance Agency: Agreed and Complete

Auditor-General Report No.

Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports

Background

  1. The Național Disability Insurance Scheme (NDIS or the Scheme) was established in 2013 under the National Disability Insurance Scheme Act 2013 (NDIS Act) to provide funding for reasonable and necessary supports for eligible people with disability. The NDIS is jointly funded by the Australian, state and territory governments under bilateral agreements. In 2021-22, NDIA made $28.6 billion in payments to 534,655 participants for NDIS supports. FiŌy-five per cent of all participants (295,281) age seven years and over received funding for assistance with daily life (ADL) supports, averaging $96,996 per year. The NDIS is expected to grow to 1,017,522 participants and $89.4 billion for the year eending 30 June 2032.

  2. The Națonal Disability Insurance Agency (NDIA) is the Australian Government entity responsible for delivering the NDIS. The NDIA contracts Partners in the Community (PITC) organisations, including Local Area Coordinators (LACs) and Early Childhood (EC) Partners to assist participants with applying to join the NDIS and then developing and implementing their plan of funded NDIS supports.

  3. Funding for each NDIA participant is determined through the development of a participant plan, which sets out the participant’s goals and aspirations, the reasonable and necessary supports that they require and will be funded, and how that funding will be managed. Plans can be developed by NDIA staff or LACs and are then approved by a NDIA delegate. NDIA assists participants to implement their plan by publishing information and guidance materials and monitoring plan use.

  4. ADL is one of the fiŌeen categories of supports funded by the NDIS and provides funding for self- care activities, such as showering, eating and moving around the house, and household tasks, such as meal preparation, cleaning and yard maintenance. Rationale for undertaking the audit

  5. Prior audits1 and reviews2 have identified issues with NDIS planning, decision-making, communications, service delivery, access to supports and fraud controls. This audit provides assurance to Parliament on the effectiveness of the NDIA’s management of ADL supports and its management of operational risks, including the implementation of recommendations from prior audits. This audit was identified as a Joint Committee of Public Accounts and Audit priority of the Parliament for 2019-20 and 2020-21. Audit objective and criteria

  6. The objective of the audit was to assess the effectiveness of the NDIA’s management of assistance with daily life supports:

  • Does the NDIA effectively support NDIS participants who require assistance with daily life?

  • Does the NDIA effectively manage operational risks to the proper use of resources in administering assistance with daily life supports?

Conclusion

  1. The NDIA’s management of assistance with daily life supports was partly effective. Seven out of nine recommendations made by the Auditor-General in prior audits relating to improved decision-making controls and fraud controls, which relate to the NDIA’s management of risks to proper use of resources, were not fully implemented.

  2. The NDIA has developed largely fit for purpose policies, procedures and guidelines to support the administration of ADL, informed by feedback mechanisms and continuous improvement processes. NDIA communications support staff, partner and provider understanding of ADL however, additional communications could be developed to support participant understanding. The NDIA conducts research to inform its communications approach and assesses its effectiveness.

  3. NDIA’s planning and implementation arrangements are largely fit for purpose. Results of internal quality reviews of decisions to fund reasonable and necessary supports are continually below target. The NDIA publishes guidance material to assist participants to use their allocated funding and implement their plans, and monitors plan usage through regular reports. While the NDIA monitors and assesses participant outcomes through the collection of feedback and data points, greater analysis could be undertaken to inform service improvement.

  4. The NDIA has partly effective processes in place to manage the risks to the proper use of resources for all support categories, including ADL, with deficiencies identified in relation to the quality of its decision-making, staff related conflicts of interest and fraud controls. The NDIA partly implemented recommendations from Auditor-General Report No. 14 2020–21 Decision-Making Controls for NDIS Participant Plans. NDIA has established and follows appropriate arrangements for setting prices for funded supports including ADL. NDIA’s management of conflict of interest risk is largely effective for Board members, SES staff and Partners in the Community (PITC). Controls for managing APS staff and contractor providers of support coordination conflicts of interest are partly effective.

  5. NDIA has a partly fit for purpose fraud control framework and has partly implemented recommendations from Auditor-General Report No. 50 2018–19 National Disability Insurance Scheme Fraud Control Program. The NDIA has partly effective controls for managing the risk of overclaiming by participants and providers.

Supporting Findings

Support for NDIS participants who require assistance with daily life 12. NDIA has policies, procedures and guidelines that support NDIA staff and Local Area Coordinators (LAC) with the administration of assistance with daily life (ADL) supports. The NDIA is currently changing its approach to publishing guidelines on its website to improve how it communicates with

Page 8

parƟcipants. The NDIA has effecƟve processes to update OperaƟonal Guidelines. DocumentaƟon to govern NDIA staff access to Services Australia’s Centrelink system was inadequate.

  1. NDIA communicaƟons include the OperaƟonal Guidelines, ParƟcipant Booklets and web content. Some informaƟon is published in different formats, such as easy read, Braille, Auslan video and languages other than English. Local Area Coordinators support parƟpicpants to understand ADL supports and include these within their plans where relevant. NDIA has Standard OperaƟng Procedures (SOPs) to support staff and partner implementaƟon of the NDIS, including ADL supports. ParƟcipant understanding could be improved with further research of the communicaƟon needs of specific cohorts.

  2. The NDIA has a structured process for developing and approving plans, based on the complexity of parƟcipants’ needs. Plans can be developed by Local Area Coordinators or NDIA planning officers and are then approved by a NDIA delegate. Plans up to the value of $385,000 can be developed and approved by a single delegate. The NDIA uses a typical support package (TSP) calculaƟon to aid consistency in decision making. The NDIA has not assessed the impacts on parƟcipant plan outcomes or scheme sustainability from high usage by planners of the World Health OrganizaƟon Disability Assessment Schedule 2.0 (WHODAS) assessment tool. Since October 2021, the quality of decisions to fund supports considered reasonable and necessary for parƟpicpants’ needs have been below NDIA’s target of 75 per cent. NDIA’s results against its key performance measure of starƟng planning within 21 days of Scheme access decision have consistently been above its 95 per cent target since quarter one, 2021–22 and results against the performance measure of approving a plan within 56 days have improved since 2021–22 and reached the target for the first Ɵme in quarter two, 2022–23.

  3. The NDIA supports parƟpicpants to implement NDIS funding for supports for acƟviƟes of daily life (ADL) through educaƟon and guidance materials and monitoring use of approved funding. NDIA publishes guidance and online resources to assist parƟpicpants to connect with and choose NDIS support providers and spend the funding within their plan. ParƟcipants may receive funding for Ɵered levels of support coordinaƟon to help implement and manage their plan. ParƟcipant survey results indicated the majority understood what happens aŌer the plan is approved and where to seek assistance with implemenƟing their plan. NDIA monitors the implementaƟon phase by tracking the numbers of days it takes for a parƟpicpant to acƟvate their plan from the date of approval. NDIA generates reports to idenƟfy those parƟpicpants who have not acƟvated their plan within 90 days and may require addiƟonal support from NDIA staff or Local Area Coordinators. NDIA has established processes to support monitoring of plan use and connecƟng with parƟpicpants at specified intervals or usage rates but does not monitor or report on compliance with these processes. NDIA policy does not assist staff to idenƥy unexpected, overused or underused expenditure. Plan uƩisaƟon rates averaged 75 per cent naƟonally with a gradually increasing trend.

  4. The NDIA assesses outcomes for parƟpicpants, and their families and carers, including through short form and long form quesƟonnaires. These quesƟonnaires include parƟcipants who receive ADL funded supports but the results are not categorised by reference to ADL specifically. The survey results are reported monthly to the Board and quarterly to the Disability Reform Ministerial Council. NDIA collects comprehensive data but does not undertake analysis of trends or outcomes to inform service improvement. NDIA provided a 2019 data set to ABS for data linkage. The ANAO saw no evidence of plans for ongoing data linkages which could inform assessment of parƟcipant outcomes. The NDIA may improve its ability to measure parƟpicpant outcomes in the future through the implementaƟon of its 2022–27 Research and EvaluaƟon Strategy.

NDIA management of risks to proper use of resources

17.

The NDIA has partly implemented the three recommendations from Auditor-General Report no. 14 2020–21 Decision-making controls for NDIS Participant Plans. ICT controls aligned to policy requirements for planning decisions have not been implemented. The NDIA reports on the effectiveness of its continuous improvement activities developed to address issues identified in quality monthly reviews. The NDIA does not analyse outcomes of internal or external reviews of decisions to inform continuous improvement. The NDIA has aligned service delivery key performance indicators and quality metrics for reasonable and necessary decision-making.

18.

The NDIA has established processes for setting the price limits that providers may charge participants for individual funded supports, which include a regular review of set prices and consideration of benchmarks. NDIA demonstrated compliance with its internal requirement for price limits set for the 2022–23 financial year. NDIA’s Pricing Strategy defines three pricing levels and uses pricing regulation to foster value for money and encourage increased supply in the market. The Pricing Strategy does not specify how NDIA’s performance against the objective or criteria will be measured. NDIA has not set a timeframe for when price deregulation will occur. NDIA has established a reference group with external stakeholder membership to undertake regular pricing reviews. The results of the 2021–22 pricing review were published on 22 June 2022 and took effect on 1 July 2022. The Annual Pricing Reviews are informed by financial benchmarking surveys of providers each year and the NDIS Disability Support Worker Cost Model. NDIA publishes the pricing limits for each support category on its website. The price limits for ADL support items have increased by 18 per cent from 2019–20 to 2022–23.

19.

The NDIA has established controls for identifying and managing conflict of interest risks for its Board and Senior Executive Service (SES) staff, which include annual declarations of material interests. The Board should implement procedures to manage conflict of interest risks arising from declarations of members relating to lived experience of disability. APS level staff are required to declare conflicts of interest but there are limited mechanisms to ensure this occurs. Combined with the lack of ICT controls for accessing participant records, staff controls represent an area of risk, especially for plan delegates. NDIA has largely fit for purpose controls for managing Local Area Coordinator conflict of interest risk, including requirements for these to be declared and reported to NDIA, and provision of compliance assurance statements to NDIA. NDIA was unable to quantify the impact that conflicts relating to support coordinators poses to participants.

20.

The frequency and rigour of NDIA’s assessment of fraud risks is insufficient given it has assessed the fraud risk associated with the agency’s activities to be high. The 2019 Fraud and Corruption Risk Register has been updated in November 2022 but not yet approved by the Board. The risk assessment that informs the overall risk rating assigned to fraud risks is not documented. The NDIA Board does not have adequate oversight of fraud risk. NDIA has not fully implemented four of the recommendations from Auditor-General Report no. 50 of 2018–19 National Disability Insurance Scheme Fraud Control Program.

21.

NDIA utilises prevention and detection controls and compliance activities to manage the risk of overclaiming. NDIA has identified key overclaiming risks for home and living supports, including ADL support types. The assessment has not identified controls or mitigation strategies for all risks. NDIA has inadequate system controls for claims for payment, particularly, from self-managed participants. NDIA is piloting stronger controls for providers claiming the Temporary Transformation Payment.

Recommendations

Recommendation No. 1

The National Disability Insurance Agency (NDIA) and Services Australia document the arrangements for NDIA staff to access information in Services Australia’s Centrelink mainframe system, including setting out the legislative basis, terms and conditions for use, and applicable governance arrangements. National Disability Insurance Agency Response: Agreed Services Australia Response: Not Agreed

Recommendation No. 2

The National Disability Insurance Agency (NDIA) review:

e) the use of the World Health Organization Disability Assessment Schedule 2.0 (WHODAS) tool by planners in developing participant plans, including analysis of plan outcomes, to assess the impact the use of this assessment tool has on participant plan outcomes and scheme sustainability; and

f) guidelines, procedures and web content to ensure it transparently conveys NDIA policy about the use of assessment tools consistent with legislative requirements. National Disability Insurance Agency Response: Agreed

Recommendation No. 3

The National Disability Insurance Agency reviews the impact of its policy changes relating to approval of plans that vary from Typical Support Packages (TSPs), including:

a) assessing the impact on plan funding outcomes, plan costs and overall scheme costs of no longer requiring higher delegation approval of plans with funding that varies by more than eight per cent from the TSP; and

b) undertaking a post-implementation review of its new integrated TSP calculator to ensure variations from the TSP reference point are supported by appropriate evidence of participants’ circumstances and determine whether ongoing monitoring is needed. National Disability Insurance Agency: Agreed.

Recommendation No. 4

The National Disability Insurance Agency implement the first recommendation of Auditor-General Report No. 14 of 2020–21 Decision-making Controls for NDIS Participant Plans by including controls relating to participant planning considerations and approvals within its new PACE ICT system, to align the system processes with internal policy requirements and to beter support planning processes for reasonable and necessary decision-making.

Recommendation No.

5

The National Disability Insurance Agency (NDIA):

  • fully implement the second recommendation of Auditor-General Report No. 14 of 2020–21 Decision-making Controls for NDIS Participant Plans by using outcomes data from internal reviews and Administrative Appeals Tribunal reviews (and other mechanisms such as Independent Expert Reviews), including early resolution outcomes, to inform continuous improvement in reasonable and necessary decision-making;

  • regularly publish summaries of NDIA review data and analysis to improve transparency of review processes.

National Disability Insurance Agency Response: Agreed

Recommendation Nos.

Recommendation No. 9

The National Disability Insurance Agency fully implement the first recommendation of Auditor- General Report No. 50 of 2018–19 National Disability Insurance Scheme Fraud Control Program by regularly updating the Risk Register with planned controls, the delivery date and the project or activity under which the control will be developed and implemented. National Disability Insurance Agency Response: Agreed

Recommendation No. 10

The National Disability Insurance Agency fully implement the fiŌh recommendaƟon of Auditor-General Report No. 50 of 2018–19 National Disability Insurance Scheme Fraud Control Program and ensure visibility of the fraud control environment by providing regular reports to the Board containing a summary of the status of the Fraud and CorrupƟon Risk Register including:

  • a) the untreated and treated risk raƟngs for each of the fraud risk types;

  • b) the controls effecƟveness raƟng for each of the fraud risk types; and

  • c) the acƟons required on controls, with implementaƟon dates. National Disability Insurance Agency Response: Agreed

Recommendation No. 11

When conducƟng risk assessments for each risk listed in the Fraud and CorrupƟon Risk Register, the National Disability Insurance Agency document the factors considered, their weighƟng and the raƟonale for the overall risk raƟng. The Board should regularly review the risk assessment, including on each occasion it considers a proposed amendment or update to the Fraud and CorrupƟon Risk Register. National Disability Insurance Agency Response: Agreed

Recommendation No. 12

The National Disability Insurance Agency fully implement the fourth recommendaƟon of Auditor- General Report No. 50 of 2018–19 National Disability Insurance Scheme Fraud Control Program by undertaking a review of its project management of fraud control. This review should:

(a) map all projects and acƟviƟes with fraud control dimensions, including their status, linkages, relaƟve priority and resourcing;

(b) determine whether addiƟonal projects or acƟviƟes are required to close any gaps between the fraud risks and the implemented and planned fraud controls within projects; and

(c) support updaƟng the Fraud and CorrupƟon Risk Register. National Disability Insurance Agency Response: Agreed

Recommendation No. 13

The National Disability Insurance Agency fully implement the second recommendaƟon of Auditor- General Report No. 50 of 2018–19 National Disability Insurance Scheme Fraud Control Program to

Recommendation No.

Improve Its Active Fraud Detection Methods By Implementing Data Matching Activity As A Matter Of Priority, And On A Continuing Basis.

National Disability Insurance Agency Response: Agreed

Recommendation No. 14

That the National Disability Insurance Agency fully implement part (b) of the third recommendation of Auditor-General Report No. 50 of 2018–19 National Disability Insurance Scheme Fraud Control Program by establishing performance measures for its investigative functions that align with organisational goals for fraud investigations.

National Disability Insurance Agency Response: Agreed

Recommendation No. 15

The Australian Government aligns the fraud control requirements for the National Disability Insurance Agency with those of non-corporate Commonwealth entities, including the Commonwealth Fraud Control Policy and the reporting requirements of subsection 17AG(2) of the Public Governance, Performance and Accountability Rule 2014.

National Disability Insurance Agency Response: Noted Atorney-General’s Response: Noted Summary of entity responses

  1. The proposed audit report was provided to the National Disability Insurance Agency and extracts were provided to Services Australia (relating to Recommendation no. 1) and to the Atorney-General’s Department (relating to Recommendation no. 15). The summary responses, and ANAO rejoinder to Services Australia’s response are reproduced below.

National Disability Insurance Agency

The National Disability Insurance Agency (NDIA) welcomes the ANAO’s performance audit on the Effectiveness of the NDIA’s management of assisting with daily life (ADL) supports.

The NDIA acknowledges the audit findings and agrees with the recommendations. The NDIA is committed to strengthening its ADL support related governance, risk management and control environment to ensure it is effectively managing key service delivery risks that may have adverse impact on the National Disability Insurance Scheme (NDIS) as well as scheme financial sustainability pressures.

The NDIA will roll out its new ICT system (PACE) nationally in Q2 FY2023/24. The new ICT system is expected to beter support key service delivery processes, the control environment, monitoring activities and management reporting for effective decision making. In this regard, ANAO recommendations and improvement opportunities in the report are most welcome.

The creation of the Fraud Fusion Taskforce and recent NDIS funding announcement by the Australian Government as well as transition to the new ICT system will enable NDIA to further improve its Fraud Control Program, management of conflict of interest risks and compliance monitoring.

The NDIA agrees with recommendation no:15, noting this recommendation is to be primarily addressed by the Australian Government. The NDIA welcomes the opportunity to contribute.

Page 14

Services Australia

Services Australia (the agency) notes that the finding of the report that there was no writen protocol or agreement between the two agencies seƫng out the scope, terms or legislaƟve basis on which staff of the NaƟonal Disability Insurance Agency (NDIA) access the agency’s Centrelink mainframe to support verificaƟon of parƟcipant details.

The agency is focused on maintaining the security of customer informaƟon, and on ensuring that customer records are only accessed by appropriately authorised individuals or enƟƟes for a documented business purpose in line with relevant legislaƟve or other Government policy requirements. To that end, the agency has a Statement of Intent with the NDIA that provides the overarching framework under which NDIA is granted access to certain agency systems, and a Protected InformaƟion Disclosure document that provides the legislaƟve basis. The agency provides access to Centrelink informaƟon systems on the basis of specified posiƟon numbers within NDIA. The access is provided as a result of a rule writen into the Centrelink mainframe and does not need to be individually requested by NDIA staff, as it is specifically associated with the requirements of those posiƟons. The posiƟon numbers are within the NDIA human resources organisaƟonal structure. The systems architecture documents provide further evidence of the controls that are in place to manage user access by NDIA staff in accordance with the above control framework.

ANAO comments on Services Australia’s summary response

  1. The ANAO assessed the Statement of Intent between NDIA and Services Australia and other documentaƟon received from Services Australia as not adequately seƫng out the scope, terms, legislaƟve basis and governance for NDIA staff to access Centrelink mainframe systems. The Disclosure of Protected InformaƟon to the NaƟonal Disability Insurance Agency instrument provided by Services Australia is a document recording the delegaƟon of decision-making authority from the Chief ExecuƟve Centrelink to various officers within Services Australia to authorise the disclosure of informaƟon to NDIA staff where it is to assist in the administraƟon of the NDIS or to support the work of the NDIS Fraud Taskforce and the NDIA’s Fraud and Compliance branch. Services Australia did not provide any documentaƟon of decisions made under the instrument, including its consideraƟon of the appropriateness of a request by NDIA to disclose informaƟon or grant access to the Centrelink mainframe. The ANAO notes that the NDIA agreed to work with Services Australia to implement RecommendaƟon no. 1 by documenƟng ‘appropriate arrangements to govern the means of provision, removal, and audit of access to Services Australia’s Centrelink mainframe’.

Atorney-General’s Department

The Atorney-General’s Department notes recommendaƟon 15, which is directed to the Australian Government to align the fraud control requirements of the NaƟonal Disability Insurance Agency (a Commonwealth corporate enƟty) with those of non-corporate Commonwealth enƟƟes. ImplementaƟon of the recommendaƟon is a mater for government and the department will work closely with the Department of Finance, the NaƟonal Disability Insurance Agency and other relevant enƟƟes should it be pursued.