1. Auditing framework for the Victorian water industry Workshop 16 May 2005

2. 2 Overview  Background  Regulatory framework  Why audit?  Audit approach  Audit scope  Nominating and appointing the auditor  Audit methodology  Audit grading  Reporting arrangements  2005-06 audit  Next steps

3. 3 Background  Audited metropolitan water businesses since 1995 also audits energy businesses also audits energy businesses  Commission’s expanded economic regulatory role in water to include all 22 water businesses all 22 water businesses performance monitoring, regulatory compliance, pricing performance monitoring, regulatory compliance, pricing  In releasing Decision on performance reporting requirements the Commission proposed the audit framework would be based on metropolitan approach proposed the audit framework would be based on metropolitan approach identified would consult further in 2005 identified would consult further in 2005

4. 4 Regulatory framework  Under the WIRO audits are a function of the Commission audits are a function of the Commission the Commission may decide the scope and frequency of audits the Commission may decide the scope and frequency of audits audits are not to be conducted more than once in any given financial year audits are not to be conducted more than once in any given financial year  Under the SoO water businesses must arrange for an audit when requested to do so by the Commission water businesses must arrange for an audit when requested to do so by the Commission  The Water Industry Act provides that the Commission must ensure that the costs of regulation do not exceed the benefits

5. 5 Why Audit?  Purpose of audits verify reliability and accuracy of data verify reliability and accuracy of data ensure compliance with regulatory codes ensure compliance with regulatory codes Ensure compliance with SoO Ensure compliance with SoO  Benefits of audits water businesses – provide a basis for measuring and comparing performance across businesses water businesses – provide a basis for measuring and comparing performance across businesses customers – assurance that service obligations are being met customers – assurance that service obligations are being met Commission – assurance businesses are complying with regulatory framework, identifying aspects of regulatory framework that can be clarified or refined Commission – assurance businesses are complying with regulatory framework, identifying aspects of regulatory framework that can be clarified or refined

6. 6 August - November Commission establishes minimum audit scope Decides which obligations will be audited having regard to risk based assessment Consult with Minister and other relevant agencies to cover other requirements and minimise duplication Businesses nominate auditor either from certified panel or own nomination must comply with approval criteria Commission approves auditor Tripartite contract signed Audits conducted Business provides written response to the audit If required, Commission considers compliance action June July August End November December Auditor submits audit report to Commission Yes No

7. 7 Stage 1: Establishing the audit scope - coverage  Audit coverage can be of: reliability and quality of information reliability and quality of information compliance with Codes compliance with Codes price determinations price determinations  On request of Minister, audits may cover asset management asset management any other SoO obligation any other SoO obligation currently consulting with Minister on scope of auditcurrently consulting with Minister on scope of audit  Audit frequency no more frequently than every financial year no more frequently than every financial year tradeoff between cost, frequency and scope tradeoff between cost, frequency and scope

8. 8 Stage 1: Establishing the audit scope - assessing risk  Risk based approach to defining the audit scope, taking account of the likelihood likelihood consequences of non-compliance consequences of non-compliance  Factors given consideration the consequences of not achieving the Commission’s objectives the consequences of not achieving the Commission’s objectives risk to public health, safety or the environment risk to public health, safety or the environment the impact or cost to customers or the general public the impact or cost to customers or the general public damage to property damage to property loss or a reduction in the reliability and/or service quality of water and sewerage as essential services loss or a reduction in the reliability and/or service quality of water and sewerage as essential services effective commercial and regulatory decision making effective commercial and regulatory decision making  Consult with other regulators to minimise overlap

9. 9 Stage 1: Establishing the audit scope - issues Are there any additional risk factors that should be considered when developing the minimum audit scope? Are there any other approaches or considerations that would ensure that the audits are well targeted? How might the Commission appropriately balance the frequency of audits with the need to ensure compliance with the regulatory framework?

10. 10 Stage 2: Nominating, approving the auditor  Water business must provide details of: proposed audit firm, audit team, and lead auditor proposed audit firm, audit team, and lead auditor work history and skills of audit team work history and skills of audit team the auditor’s field of work, expertise, experience and business structure the auditor’s field of work, expertise, experience and business structure work undertaken by the auditor for the water business in the last two years, including current or prospective work work undertaken by the auditor for the water business in the last two years, including current or prospective work any potential or perceived conflict of interest and the manner in which it is proposed to be managed any potential or perceived conflict of interest and the manner in which it is proposed to be managed the term of the approval requested the term of the approval requested  Nominations assessed according to: independence independence experience experience expertise and expertise and resource capacity to undertake the audits resource capacity to undertake the audits

11. 11 Stage 2: Assessing the auditor  Independence is a key aspect of ensuring the objectivity of audits primary duty of care is to the Commission primary duty of care is to the Commission tripartite deed tripartite deed  In assessing independence, the Commission will have regard to the amount of work that a firm has performed for a water business have regard to the amount of work that a firm has performed for a water business ensure that a firm and/or team member that has conducted advisory or consulting services ensure that a firm and/or team member that has conducted advisory or consulting services ensure that an audit team member(s) has not recently been an employee of the water business being audited ensure that an audit team member(s) has not recently been an employee of the water business being audited  The audit team will be required to have: detailed knowledge of the water industry detailed knowledge of the water industry demonstrated skill, experience in, and detailed knowledge of quality assurance, including operational or compliance auditing and where relevant, science or engineering, asset management, information systems and customer service demonstrated skill, experience in, and detailed knowledge of quality assurance, including operational or compliance auditing and where relevant, science or engineering, asset management, information systems and customer service resource capacity to undertake the audits resource capacity to undertake the audits an absence of conflicts of interest an absence of conflicts of interest

12. 12 Stage 2: Nominating, approving the auditor - issues Are there other issues that the Commission should consider in assessing: the auditor’s independence? the auditor’s independence? the auditor’s ability to undertake the audits? the auditor’s ability to undertake the audits? Are the proposed safeguards for maintaining independence and managing conflicts of interest sufficient?

13. 13 Stage 2: Audit panel  New initiative  Establishing a panel of auditors is aimed at: reducing administration costs in identifying suitable auditorsreducing administration costs in identifying suitable auditors reducing costs of nominating, assessing and approving businesses’ nominationsreducing costs of nominating, assessing and approving businesses’ nominations improving the timelines of the processimproving the timelines of the process  Prospective panel members will need to: demonstrate suitable experience, expertise and independencedemonstrate suitable experience, expertise and independence identify proposed audit team leaders and team membersidentify proposed audit team leaders and team members agree in principle to the terms of the tripartite deedagree in principle to the terms of the tripartite deed agree to ensure that staff maintain the necessary skill level and familiarity with the Commission’s audit requirementsagree to ensure that staff maintain the necessary skill level and familiarity with the Commission’s audit requirements demonstrate the resource capacity to undertake more than one audit during an audit cycledemonstrate the resource capacity to undertake more than one audit during an audit cycle

14. 14 Stage 2: Audit panel issues Are there other issues or approaches that would provide greater certainty to businesses about the appropriateness of audit firms and team members? How could the effectiveness of the panel arrangement be maximised?

15. 15 Stage 3: Conducting the audit  Prior to each audit, the Commission will brief the auditors to ensure that the audit requirements are clearly understood  Auditors required to: analyse documented procedures analyse documented procedures interview responsible staff interview responsible staff analyse information systems analyse information systems analyse quality controls analyse quality controls identify changes in systems and documented procedures identify changes in systems and documented procedures analyse relevant data analyse relevant data analyse a sample of cases or data analyse a sample of cases or data in cases of significant non-compliance, assess the water business’s plan to ensure compliance in cases of significant non-compliance, assess the water business’s plan to ensure compliance  Auditor should have regard to relevant Australian Standards for Assurance Sampling, Compliance and/or Risk Management

16. 16 Stage 4: Assessing and reporting on compliance  To ensure comparability, auditors must assess compliance using standard compliance grades  Regulatory data is assessed using two part confidence grades the grades measure first reliability and then accuracy of the data the grades measure first reliability and then accuracy of the data continuation of the approach currently used continuation of the approach currently used

17. 17 Stage 4: Grading regulatory obligations  Compliance with regulatory obligations is measured in two steps Harvey balls indicate the quality and presence associated with policies, practices, procedures, systems and training/skillsHarvey balls indicate the quality and presence associated with policies, practices, procedures, systems and training/skills A traffic lights system is used to indicate overall complianceA traffic lights system is used to indicate overall compliance  Stage 1  Stage 2

18. 18 Stage 4: Assessing and reporting on compliance - issues Is the proposed approach to grading audit findings clear and appropriate? Are there other approaches to grading compliance that the Commission should consider?

19. 19 Stage 4: Assessing and reporting on compliance  Reporting the audits not proposed to make the audit reports available publicly not proposed to make the audit reports available publicly will identify in its annual performance report will identify in its annual performance report the extent to which a business’s data is of a lesser quality than othersthe extent to which a business’s data is of a lesser quality than others the extent to which any non-compliance has been identified and actions proposed to rectify non-compliancethe extent to which any non-compliance has been identified and actions proposed to rectify non-compliance  Reporting procedures the Commission proposes that auditors will be required to provide a copy of their final audit reports directly to the Commission the Commission proposes that auditors will be required to provide a copy of their final audit reports directly to the Commission Commission may meet with auditors and have them explain findings Commission may meet with auditors and have them explain findings

20. 20 Stage 5: Responding to the audits  In responding to an audit report, the Commission may review regulatory obligations that appear to be unclear, inadequate, excessive or trivial review regulatory obligations that appear to be unclear, inadequate, excessive or trivial publish and/or comment on audit results either in its annual performance report or another format publish and/or comment on audit results either in its annual performance report or another format require action to be taken by a water business to comply with a particular obligation require action to be taken by a water business to comply with a particular obligation exercise the enforcement powers available to it under relevant legislation exercise the enforcement powers available to it under relevant legislation  Businesses will be required to provide, within 20 business days of receiving the audit report, a response outlining the actions it intends to take in response to the audit

21. 21 2005-06 Proposed Audit timeline  June 2005 – Commission specifies audit scope  Late July 2005 – businesses nominate auditors  Mid August 2005 – Commission approval of auditors  Late August 2005 – tripartite deeds signed and auditors briefed  September – November 2005 – audits conducted  November 2005 – audit report provided to Commission and businesses  December 2005 – businesses to consider audit report and provide statement to Commission in response  December 2005 – auditors provide briefing to Commission (if required)  February / March 2006 – Commission publishes annual performance report

22. 22 Audit timeline - issues Do the indicative timelines provide sufficient time for: - Businesses to choose and nominate an appropriate auditor, and to respond to the audit report? - Auditors to undertake audits? - Other relevant government and regulatory agencies to comment on the audit requirements?

23. 23 Next steps  Post summary of comments received today on website by Wednesday 18 March  Additional comments/submissions due Monday 23 May 2005  Final audit framework to apply to all Victorian water businesses released June 2005  Once the audit framework and guideline have been finalised, the Commission will commence the process and confirm the timelines for the 2005-06 audits