THE CHALLENGE

A large New South Wales state government agency with more than 700 staff providing essential services to over 50,000 customers across NSW recognised the growing importance of building a strong integrity and accountability culture to safeguard public resources, maintain trust, and comply with state government expectations around fraud and corruption control in line with the Independent Commission Against Corruption (ICAC) expectations.

While the agency had many fraud and corruption control measures in place, there was a need to strengthen awareness, consistency, visibility and oversight across all directorates. Leadership sought to refresh staff understanding of fraud and corruption risks, identify key vulnerabilities, and improve internal controls to prevent, detect, and respond to potential incidents more effectively.

OUR APPROACH

InConsult was engaged to deliver a comprehensive fraud and corruption awareness and risk assessment program. The engagement included:

• Delivering introductory fraud and corruption awareness training to nearly 50 staff across multiple directorates.
• Facilitating multiple interactive fraud and corruption risk workshops attended by around 50 participants from all directorates.
• Developing a detailed Fraud and Corruption Risk Register that identified key risks, potential causes, impacts, and existing controls.
• Assessing the effectiveness of current internal controls and identifying opportunities to strengthen the control environment through targeted risk treatments.

The workshops were highly collaborative and generated open discussion among staff about real-world risk scenarios and potential vulnerabilities.

OUTCOMES & IMPACT

The engagement resulted in a strengthened understanding of fraud and corruption risks across the agency, with staff demonstrating a greater sense of ownership and accountability.

The newly developed Fraud and Corruption Risk Register provided a practical tool to guide prevention, detection, and response activities.

The process also contributed to a positive shift in culture, raising awareness, and reinforcing the agency’s commitment to integrity and public trust.

The agency is now implementing additional risk treatments to further strengthen its fraud control framework and internal control environment.

Would you like to know more about our fraud and corruption prevention, risk management, cyber security and internal audit and assurance capabilities for NSW state government agencies? Contact us today.

This case study is drawn from a real-life engagement/project between InConsult and our client. While client details are not disclosed for commercial and confidentiality reasons, this case study is based on a real engagement and reflects genuine results and outcomes. Specific client references and project details can be shared with prospective clients during the proposal process.

THE CHALLENGE

A NSW council recognised the need to strengthen its governance and risk management practices to better align with community expectations, the Office of Local Government (OLG) guidelines, and its strategic objectives. With growing operational complexity, changing regulations, financial sustainability challenges and inherently higher fraud and corruption risks, the council sought to transform its risk management framework and culture across all levels of the organisation.

While the council had an existing risk management framework, many elements had become outdated and inconsistently applied. Risk ownership was fragmented, and the risk culture varied across departments. Leadership recognised the need for a more sustainable, integrated, and proactive approach to managing risks – one that would empower staff, improve reporting to the Audit, Risk & Improvement Committee, and enhance compliance with OLG requirements.

OUR APPROACH

InConsult was engaged to conduct a comprehensive health check of the council’s risk management framework, culture, and practices. Our approach included:

• Reviewing and assessing the current risk management framework, including policy, plan, and procedures.
• Conducting a risk culture assessment through interviews and surveys to understand awareness, accountability, and engagement levels.
• Supporting the communication and rollout of the updated framework across all divisions.
• Delivering risk management training for councillors, executives, managers, and key staff to build capability and consistency.
• Facilitating council-wide risk identification workshops, covering strategic, operational, and fraud and corruption risks.
• Reviewing the risk management function and workforce structure, providing recommendations to establish a more sustainable and embedded model for the future.

OUTCOMES & IMPACT

The engagement delivered a refreshed and practical risk management framework that was clear, compliant, and easy to apply.

The council’s leaders and staff demonstrated greater ownership and understanding of risk, enabling better decision-making and reporting.

The training and workshops significantly improved engagement and consistency across the organisation.

As a result, the council now has a more mature, sustainable, and proactive risk management culture – and is fully compliant with the new OLG guidelines.

Would you like to know more about our risk management, cyber security, resilience and internal audit and assurance capabilities for NSW local government? Contact us today.

This case study is drawn from a real-life engagement/project between InConsult and our client. While client details are not disclosed for commercial and confidentiality reasons, this case study is based on a real engagement and reflects genuine results and outcomes. Specific client references and project details can be shared with prospective clients during the proposal process.

THE CHALLENGE

For many years Hunters Hill Council has recognised the importance of a proactive and enterprise wide (ERM) approach to managing risk. However, as a small Council with a unique risk profile it had to think outside the square to come up with a strategy to adequately resource its ERM program.

Key challenges largely revolved around the size and related resource limitations of Council.  It was not feasible or realistic for Council to justify a full time resource to manage the ERM implementation. Sourcing a part-time resource was also investigated, however this created its own concerns – such a resource would not allow for the flexibility needed to accommodate changing needs of Council,  nor could suitable experience be found in such a capacity. 

THE SOLUTION

In 2010, Council engaged InConsult to provide ongoing risk management support and services. A program of services and activities called “Risk Assist” was developed for Council by InConsult. This program included:

• Regular, facilitated 6-monthly reviews of Council’s risk register; identifying and evaluating key risks and controls using InConsult’s GuardianERM system;
• Reporting and presenting the outcomes of each risk review to Council Executive, internal auditor and Financial & Strategic Planning and Advisory Committee;
• Identification and follow up of risk treatment plans for key risks;
• Targeted risk assessments of higher risk projects and activities and;
• Risk management support, advice and training as required.

Some of the targeted risk assessments have focused on areas including;

• The development assessment process;
• A major infrastructure project;
• New Year’s Eve celebrations and;
• Workplace Health and Safety risks

THE RESULT

As a result of the successful implementation of Hunters Hill’s ERM framework and the ongoing support provided by InConsult, Council recently won the Metropool Risk Management Excellence Award.

According to Council’s General Manager, Barry Smith, the implementation of these key activities has significantly improved the culture of risk thinking and risk management within the organisation. The Senior Management Team has taken responsibility and ownership of the management of key risks across the organisation.

“Risk Assist” has also assisted Council in the implementation of its responsibilities under the new Integrated Planning & Reporting framework.

Mr Smith stated that “the project has provided a financially sustainable and cost effective risk management function for Council that was not previously in place.”

Would you like to know more about our Risk Management services and capabilities? Contact us today.

Already aware of the capabilities  of InConsult through a successful Internal Audit program, MidCoast Council recently had the opportunity to review  and assess  their needs surrounding  their Fraud and Corruption Prevention Framework.

Although MidCoast Council already had policy and draft strategy in place,Council’s Manager Corporate Planning and Governance, was eager for feedback on strengths and weaknesses, as well as direction on where to go next to raise awareness to the level of the current expected standard.

THE SOLUTION

To gain a better understanding of areas potentially exposed to risk and the possible impacts of fraud, MidCoast Council took the proactive approach of engaging InConsult to conduct a Fraud Health Check across the organisation.

“MidCoast Council has a zero tolerance policy for Fraud and Corruption, by training and raising awareness we can equip staff with the tools they need to operate in a culture of trust.” – Phil Brennan,  Manager Corporate Planning and Governance.

An organisation with a strong and well communicated Fraud and Corruption Prevention Framework can have confidence in its staff to perform their duties out in the open with a solid understanding of their roles as risk owners.

THE RESULT

Mr Brennan also commended InConsult on being “professional as always” and noted that the consultants involved had “a great ability to relate to staff and develop good relationships”.  Benefits of the Fraud Health Check and subsequent training by InConsult have been felt across the organisation. Managers and risk owners alike are more focused and aware.

“Whilst building our fraud and corruption prevention framework is still a work in progress, there is a general confidence at a senior level that the right action is being taken to establish a strong backbone throughout the organisation”.

Would you like to know more about our Fraud & Corruption Prevention services and capabilities? Contact us today.

THE CHALLENGE

In 2010, the Office of Local Government, (at that time called the Department of Local Government) issued guidelines for Internal Audit. While the document was referred to as ‘guidelines’ the Office of Local Government had stated that in order for councils to meet best practice standards, all councils should have an internal audit function.

During this time, the Office of Local Government was reviewing local councils’ governance procedures and providing recommendations. For Wollondilly Shire Council, one recommendation was to introduce an internal audit function.

Manager of Governance, John Sproule, and Council’s management team were eager to enhance Wollondilly Shire Council’s risk management framework by adding an internal audit function to meet best practice standards.

But where to start?

For the relatively small but rapidly growing Wollondilly Shire Council, employing a full time auditor was not going to be cost effective and would not have allowed for the specific skills and depth required to audit a council with such a diverse range of functions.

Wollondilly Shire Council wanted high quality, thorough, flexible and skilled internal audit services delivered cost effectively by an organisation with the experience and expertise that would allow it to ‘hit the ground running’. That way audits could be completed on time and on budget to maximise value to ratepayers.

THE SOLUTION

Wollondilly Shire Council selected InConsult to undertake their internal audits because of our ability to deliver a cost effective solution, conducted by experienced consultants with the depth and specialisation Council required. “It came down to finance and resourcing. We wanted the flexibility of a tailored approach that would meet our specific needs while staying within a modest budget.” said Mr Sproule.

InConsult was engaged to support Wollondilly Shire Council with the initial planning and implementation of an internal audit function, developing the strategic audit plan and conducting audits over a three year period.

InConsult started by obtaining a good understanding of the organisation and conducting meetings and discussions with management, staff and key stakeholders, to develop a risk based Strategic Audit Plan.  Once the Strategic Audit Plan was approved by Council, InConsult began conducting a series of internal audits to review and evaluate Council’s key internal controls to test their effectiveness and appropriateness. After each audit, InConsult produces an internal audit report highlighting good work Wollondilly Shire Council is already doing and making recommendations for any improvement required in the internal control framework. Each recommendation is discussed with the auditee and prioritised for attention, based on the level of risk.

THE RESULT

The main benefit to Wollondilly Shire Council from outsourcing the internal audit function has been having an experienced team with specialised skills completing the audits to give Council a value for money services that meets best practice standards.  “Having our audits outsourced means we get the depth and expertise we were looking for within a modest budget so rate payer funds can be channelled into community projects and services.” Mr Sproule explained.

Additionally, Council has benefited from InConsult’s expertise and recommendations for improving policies and procedures, which has further strengthened Wollondilly Shire Council’s strong risk management framework and culture. “The audits have really engaged our staff, councillors and audit committee members. Whilst they were always supportive of creating a strong internal control framework, having an external party review or processes has resulted in more transparency and generated genuine interest in audit reports and recommendations.” said Mr Sproule.

By adding an internal audit function, Wollondilly Shire Council is now operating within best practice standards. The introduction of an internal audit function has added an extra level of assurance to Council’s activities and acts as a monitoring exercise for processes and policies, all of which enhances the already strong risk management culture. Outsourcing the audits to a professional, expert and experienced organisation offered Council an in-depth, targeted and value for money internal audit function.

Shellharbour is a city located approximately 100 kilometres from the centre of Sydney. It is a growing community of around 67,000 residents and key strategic assets include Illawarra Regional Airport and the $1.5 billion dollar Shell Cove Project which is a tourist and residential development encompassing a modern boat harbour, 20 hectares of waterway, 1.5km of harbour front promenade featuring retail outlets, restaurants and residential developments.

Some years ago, Group Manager Finance, Tony Gearon and the Risk Management team began a gradual process of “cultural overhaul” through the introduction of new processes, encouraging both staff and management to enhance Council’s risk management function with the establishment of an internal audit function.

At the time, there was little understanding of the benefits of internal audit and the potential value to Council. Fortunately in 2010, the Department of Local Government introduced guidelines on internal audit and best practice risk management principles that provided the impetus for Council to establish an internal audit function.

As Tony describes, “As the benefits of Enterprise Risk Management were being proven at the same time at Shellharbour, it was felt that establishing an internal audit function would be complimentary, the two functions would fit together hand in glove.”

THE SOLUTION

Shellharbour City Council looked at the options available in setting up an internal audit function.  Council wanted a trusted and independent organisation to comprehensively review and evaluate the Council’s activities and processes in a way that would add value and make staff and management feel comfortable. Council’s preferred option was to outsource internal audit to an external organisation; this was seen as the most cost effective option as well as a way to make internal audit more independent. After a scrupulous tender process, InConsult was chosen based on extensive staff expertise, reasonable pricing, reputation, ability to add value to risk management and strong emphasis on building excellent working relationships with clients.

InConsult started by obtaining a good understanding of the organisation and conducting meetings and discussions with management, staff and key stakeholders, to develop a risk based Strategic Audit Plan.  InConsult also provided guidance to Council as it established its Governance, Risk and Audit Committee. Once the audit plan was approved, InConsult began conducting a series of internal audits to review and evaluate Council activities to test their effectiveness and appropriateness. After each audit, InConsult produces internal audit reports highlighting good work Shellharbour City Council is already doing and making recommendations for any improvement required in the internal control framework. Each recommendation is discussed with the auditee and prioritised for attention, based on the level of risk.

THE RESULT

Today, internal audit is embraced by all levels of management.  InConsult interacts with staff at all levels without being intimidating or making staff feel uncomfortable about having their systems and processes reviewed.

According to Tony, “staff are encouraged to use the audits as a reference for future improvements. The internal audit reports are clear and easy to understand.” As part of the internal audit KPIs adopted by the Governance Risk and Audit Committee, an annual survey of Committee members and senior staff is undertaken. The most recent survey indicated a high level of satisfaction with the internal audit function and agreement that it has improved Council’s internal control framework.

“Internal audit is seen as an important third line of defence for Council.  It has enabled stakeholders such as councillors and Governance, Risk and Audit Committee members to have greater visibility over Council’s risk management and internal control frameworks”.

Aligning the risk management framework with internal audit activities has also helped to improve risk analysis across departments and major projects. “It has improved the risk culture and awareness of risk, which in turn helps people to think about what could go wrong and to be more analytical in their thinking and decision making”.