Introduction

1.1 The governing board of a corporate Commonwealth entity (CCE) is often the accountable authority for the entity under the Public Governance, Performance and Accountability Act 2013 (PGPA Act), with responsibility for ‘leading, governing and setting the strategic direction’ for the entity.

1.2 As at February 2025, 74 Australian Government entities have a body corporate status. CCEs and companies with governance boards vary significantly by function, and governance boards may also vary in their composition, operating arrangements, independence and subject-matter focus, depending on the specific requirements of their enabling legislation and other applicable laws.

Duties and roles

1.3 As the accountable authority, members of CCE governing boards are officials under the PGPA Act and subject to the general duties of officials in sections 25–29 of the PGPA Act (see Box 1). Sections 15 to 19 of the PGPA Act impose additional duties on accountable authorities in relation to governing the Australian Government entity for which they are responsible (see Box 1). Guidance issued to accountable authorities by the Department of Finance (Finance) aims to support accountable authorities ‘to fulfil the important role of governing your entity and contributing to the priorities and objectives of the government.’⁴

1.4 Board governance involves two dimensions:

Performance — monitoring the performance of the organisation and CEO. This also includes strategy — setting organisational goals and developing strategies for achieving them, and being responsive to changing environmental demands, including the prediction and management of risk. The objective is to enhance organisational performance;

Conformance — compliance with legal requirements and corporate governance and industry standards, and accountability to relevant stakeholders.

… it is important to understand that governing is not the same as managing. Broadly, governance involves the systems and processes in place that shape, enable and oversee management of an organisation. Management is concerned with doing–with co-ordinating and managing the day-to-day operations of the business.⁵ [emphasis in original]

The National Disability Insurance Agency

1.5 The National Disability Insurance Scheme (NDIS), established in 2013 under the National Disability Insurance Scheme Act 2013 (NDIS Act), provides funding for supports for people with permanent and significant disability. Commonwealth, state and territory governments jointly fund the NDIS under bilateral arrangements. The National Disability Insurance Agency (NDIA) is responsible for delivering the NDIS under the NDIS Act and is a CCE under the PGPA Act.

1.6 The key functions of the NDIA are set out in section 118 of the NDIS Act. As well as its core function of delivering the NDIS to support the independence, and social and economic participation, of people with disability⁶, the NDIA is also to:

• manage, advise and report on, the financial sustainability of the NDIS; and
• prevent, detect, investigate and respond to misuse of, abuse of, or criminal activity involving, the NDIS.

1.7 The NDIA also has functions relating to developing and enhancing the disability sector, building community awareness of disabilities, data on disabilities and supports, and disability research. In performing all its functions, the NDIA must, under subsection 118(2) of the NDIS Act, use its best endeavours to:

• act in accordance with any relevant intergovernmental agreements;
• act in a proper, efficient and effective manner; and
• ensure the financial sustainability of the NDIS.

1.8 Following completion, in July 2021, of the five-year transition period from state and territory-based supports to national NDIS operation, NDIS costs continued to rise. In October 2021, the 2021 NDIS Annual Financial Sustainability Report (AFSR) was published, showing total projected participant costs were expected to almost double from $29.2 billion in 2021–22 to $59.3 billion in 2029–30. The 2022 AFSR included a baseline forecast of NDIS expenses for 2031–32 of $89.4 billion. This forecast growth was greater than previously expected — in the first year of transition (2016–17) the baseline forecast for total participant costs in 2030 was $41.8 billion.

1.9 The NDIA’s operating environment has been subject to review and change since 2021 including the Independent Review into the National Disability Insurance Scheme⁷ (NDIS Review), the Royal Commission into Violence, Abuse, Neglect and Exploitation of People with Disability⁸, and legislative reform.⁹ In April 2023, the Minister for the NDIS announced that National Cabinet¹⁰ had agreed to an NDIS Financial Sustainability Framework which sets an annual NDIS growth target of 8 per cent by July 2026. The minister also announced Budget funding for 10 supporting initiatives.¹¹

1.10 In March 2024, the Australian Government introduced the National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024 (the Bill) to Parliament. In May 2024, the 2024–25 Federal Budget Strategy and Outlook stated that the Bill and subsequent amendments to NDIS rules and other legislative instruments:

will moderate growth in NDIS expenditure, by determining NDIS participant plan budgets more consistently based on participant need and supporting participants to spend in accordance with their plans. The realisation of the financial projections for the NDIS is dependent on the successful implementation of the Financial Sustainability Framework, including the passage of the Bill and subsequent changes to NDIS rules and other legislative instruments.¹²

The Bill was passed in August 2024 and took effect in October 2024.

The Board of the National Disability Insurance Agency

1.11 The Board is the accountable authority of the NDIA. The Board must comply with its enabling legislation — the NDIS Act, the PGPA Act and the Public Governance, Performance and Accountability Rule 2014 (PGPA Rule). Under section 124 of the NDIS Act, the Board is responsible for ensuring the proper, efficient and effective performance of the NDIA’s functions and determining the objectives, strategies and policies of the NDIA.

1.12 Figure 1.1 sets out the governance structure of the NDIA.

Figure 1.1: NDIA governance

Source: National Disability Insurance Agency, National Disability Insurance Agency Annual Report 2023–24, NDIA, n.d., p. 100, available from https://www.ndis.gov.au/publications/annual-report#annual-report-2023-24 [accessed November 2024].

1.13 The NDIS Act provides that the minister, with agreement of states and territories, has the power to make delegated legislation in the form of NDIS Rules, to direct the NDIA and to appoint Board members. The Department of Social Services (DSS), as the portfolio department responsible for the NDIS, manages the process that supports the minister to make appointments to the Board.¹³

1.14 The NDIS Act establishes a Ministerial Council, that meets as the Disability Reform Ministerial Council, to consider policy matters and advise the minister and report to National Cabinet.

1.15 The Independent Advisory Council provides independent advice, on its own initiative or at the Board’s request, on matters prescribed in section 144 of the NDIS Act including about how the NDIA performs its functions relating to the NDIS.

1.16 Changes in Board membership and senior NDIA executives between 2022 and January 2025 include the appointment of a new Board Chair in October 2022, new CEO in October 2022, four new deputy CEOs in early 2023, three new Board members in 2023, one further member in 2024, and one in January 2025.

Rationale for undertaking the audit

1.17 The NDIS is a demand-driven program. In 2023–24, the NDIA’s participant plan expenses were $41.85 billion, 19 per cent higher than in 2022–23, making this the largest area of Australian Government expenditure managed by the board of a CCE and also the fastest growing Australian Government payment. In May 2024, Budget Paper No. 1 for the 2024–25 Budget stated, ‘NDIS Commonwealth funded participant payments growth is expected to average 9.2 per cent per year over the projections period’ (to 2034–35).¹⁴ With over 692,000 Australians registered as NDIS participants as at 31 December 2024, the NDIA is also an organisation with a direct impact on the lives of a major cohort of vulnerable Australians.

1.18 This audit provides independent assurance to Parliament on the effectiveness of the governance of the Board of the NDIA.

Audit approach

Audit objective, criteria and scope

1.19 The objective of the audit was to assess the effectiveness of the governance of the Board of the NDIA.

1.20 To form a conclusion against the objective, the following high-level criteria were adopted:

• Are the Board’s arrangements consistent with relevant legislative requirements for effective governance?
• Does the Board have fit-for-purpose arrangements to support sufficient oversight of the entity’s operations?

1.21 The ANAO’s analysis of the effectiveness of the Board of the NDIA related to the period 1 July 2021 to 30 June 2024, with fieldwork conducted between March 2024 and September 2024.

Audit methodology

1.22 The audit methodology involved:

• examining NDIA records;
• meetings with Board members;
• meetings with officials of the NDIA and the Department of Social Services;
• observing Board and committee meetings; and
• reviewing the four citizens’ contributions received.

1.23 The ANAO has co-operative evidence gathering arrangements with entities. On 20 May 2024 the NDIA advised the ANAO that it was unable to voluntarily provide certain information requested by the ANAO due to legislative restrictions on the disclosure of requested information.

1.24 On 28 May 2024 the acting Auditor-General issued the NDIA a notice requiring it to provide information and produce documents pursuant to section 32 of the Auditor General Act 1997, to enable the NDIA to provide the requested information taking account of legislative requirements. The NDIA provided the information requested within the specified time.

1.25 The audit was conducted in accordance with ANAO Auditing Standards at a cost to the ANAO of approximately $697,606.

1.26 The team members for this audit were Barbara Das, Sophie Capel, Rory Tredinnick, Alexandra Collins, and Corinne Horton.

2.1 Board governance and administration encompasses how a board is established and managed in accordance with its legislated duties and responsibilities — including the board’s enabling legislation, the Public Governance, Performance and Accountability Act 2013 (PGPA Act) and the Public Governance, Performance and Accountability Rule 2014 (PGPA Rule). The Board is established under the National Disability Insurance Scheme Act 2013 (the NDIS Act) and is the NDIA’s accountable authority.

Are the Board’s governance and administrative arrangements consistent with relevant legislative requirements?

Board appointments

2.2 Section 126 of the NDIS Act requires the Board to consist of a chair and up to 11 members, with no minimum specified. The number of members, including the Chair, concurrently serving on the Board did not exceed nine in 2021–22, 12 in 2022–23, 11 in 2023–24 and 2024–25 (as at January 2025). Board appointments, as at 1 January 2025, are listed at Appendix 3.

2.3 Section 127 of the NDIS Act prescribes how a Board member may be appointed. The legislative requirements include¹⁵ that:

• Board members are to be appointed by the minister, by written instrument, on a part-time basis (subsection 127(1));
• the minister must be satisfied that they are a person with disability, have lived experience with disability, or have skills, experience or knowledge in the provision or use of disability services, the operation of insurance schemes (or compensation schemes or schemes with long-term liabilities), financial management, or corporate governance (subsection 127(2));
• state and territory disability ministers must be consulted over appointments (subsection 127(3));
• non-Chair appointments must be supported by the Commonwealth and a majority of the Commonwealth and the host jurisdictions (subsections 127(4)–(4D)); and
• a Board member cannot hold certain positions, such as being a member of a state or Commonwealth parliament, to be eligible for appointment (subsection 127(5)).

2.4 The Cabinet Handbook¹⁶ also requires, where a significant full time or part-time appointment to a board (such as a board chair or members) is proposed, that:

the responsible minister must write to the Prime Minister seeking approval of the appointment before any action is finalised. While significant appointments will require Cabinet approval, the Prime Minister may determine that Cabinet consideration is not required and authorise the appointment.¹⁷

2.5 DSS, as the portfolio department responsible for the NDIS, manages the process for appointments to the Board.

2.6 Between 1 July 2021 and 30 June 2024, 15 people were appointed to serve on the Board. Following audit fieldwork, as at 1 January 2025, a further two people were appointed, bringing the total to 17, including 18 re-appointments and 11 new appointments.¹⁸ All members were appointed by the minister, by written instrument and on a part-time basis in compliance with subsection 127(1) of the NDIS Act. All appointment terms were for three years or less as required by section 128 of the NDIS Act.

2.7 The ANAO examined five new appointments and assessed their compliance with additional legislative requirements. All five appointments:

• were supported by evidence that the minister was satisfied the person had the characteristics required by subsection 127(2) of the NDIS Act, such as lived experience with disability, and advice from DSS that the proposed candidates were not ineligible for appointment based on other positions held, under subsection 127(5) of the NDIS Act; and
• were consulted with, and supported by, the state and territory disability ministers and the Commonwealth, in compliance with subsections 127(3)–(4D) of the NDIS Act.

2.8 All five of the above appointments were agreed to by the Australian Government as required by the Cabinet Handbook.

2.9 Subsection 127(6) of the NDIS Act requires the minister to ensure that the Board collectively holds an appropriate balance of the characteristics set out in paragraph 2.3. DSS advised the minister on the balance of skills and attributes of current Board members.

2.10 Remuneration for members of the Board is set in determinations under the Remuneration Tribunal Act 1973. Controls for key management personnel remuneration were found to be effective during 2021–22. In 2022–23 there were instances of inaccurate payments made to one Board member. In 2023–24 there were further instances of inaccurate payments made to five Board members. The incorrect payments related to NDIA delays and errors in updating payroll arrangements following changes in Board committee membership. The NDIA advised the ANAO in June and December 2024 that it was rectifying the errors, had since updated relevant procedures, and that overpaid amounts were being repaid and underpayments resolved.

Acting arrangements and resignations

2.11 Where a board position becomes vacant, or where a member will be absent, or unable to perform their duties for a time, the NDIS Act allows the minister to appoint an acting Board Chair or member by written instrument.

2.12 Section 129 of the NDIS Act prescribes how a person may be appointed, including that:

• an acting Chair may be appointed, for a period of not more than 12 months;
• an acting Board member may be appointed for a period up to 150 days during a vacancy, after consultation with the states and territories;
• an acting Board member may be appointed during any periods where a member is absent from, or unable to perform, their duties; and
• the person meets the same eligibility requirements as substantive Board members in that they possess certain characteristics and do not hold certain positions.

2.13 Between 1 July 2021 and 30 June 2024, the minister made three acting appointments, including one acting member and two acting chair appointments. All of these appointments complied with section 129 of the NDIS Act. The acting appointments all related to existing Board members.

2.14 Between 1 July 2021 and 30 June 2024, two Board members resigned their appointment by giving the minister a written resignation, in accordance with section 133 of the NDIS Act.

2.15 Under section 134 of the NDIS Act, the minister may terminate the appointment of a Board member for various reasons including misbehaviour, bankruptcy, unsatisfactory performance, or absence (except for a leave of absence) from more than three consecutive Board meetings. Between 1 July 2021 and 30 June 2024, the minister did not terminate any Board member appointments.

Board positions

Department of Social Services advice

2.16 Between 1 January 2023 and 30 June 2024, DSS monitored and provided advice to the minister on current and upcoming Board member departures.

• DSS complied with Standing Senate Order 15 reporting.¹⁹
• Available Board positions were included in talking points for regular meetings between the DSS Secretary and the minister.
• DSS advised the minister of available Board positions on seven occasions, providing more than six months’ advance notice of upcoming term expiry dates. On four occasions, advice also related to a skills matrix of the current Board members.²⁰
• DSS did not propose potential candidates to fill available Board positions.

2.17 As discussed at paragraph 2.2, the NDIS Act does not specify a minimum number of Board members. Table 2.1 sets out the number of Board members from 1 July 2021 to 1 January 2025.

Table 2.1: Number of Board members from 1 July 2021 to 1 January 2025

Source: ANAO analysis of DSS and NDIA documentation.

2.18 Since 1 July 2021, five appointments were made within a week and four within a day of existing appointments ending and nine reappointments of existing members occurred before the end of an appointment term.

2.19 In the 18 months prior to 30 June 2024, DSS conducted assessments of Board composition using skills matrices to advise the minister on Board positions soon to become available and to support the minister in ensuring that the Board collectively held an appropriate balance of characteristics, as required by subsection 127(6) of the NDIS Act.

2.20 The skills matrices outlined the requirements of Board member appointments set out at subsection 127(2) of the NDIS Act as well as appointment information including term expiry dates and vacancies, gender, location, identification with Aboriginal and Torres Strait Islander peoples, and leadership experience. DSS advised the ANAO that, in drafting the matrices, it uses publicly sourced information as well as information provided by Board members as part of their appointment process, including information contained in curricula vitae and Private Interests Declarations.

National Disability Insurance Agency advice

2.21 The Board’s Charters²¹ for 2021–22 and 2022–23 stated that:

Six months prior to a director’s term of appointment ending the Board will undertake a board skills and competencies analysis and provide advice to the Commonwealth Minister on the mix of skills and competencies of the Board.

2.22 Between July 2021 and June 2024, the Board conducted skills and competencies reviews using skills matrices in November 2022 and March 2024. In May 2024, the Board Chair advised the minister of the Board’s skills and ‘need for financial accounting and management experience among the Board membership’. The Board Chair’s May 2024 advice to the minister was issued more than six months ahead of three members’ terms expiring in December 2024. The Board did not give advice to the minister six months prior to other members’ terms expiring in December 2022, March 2023 and June 2023, as required by the Board’s charter.

Board meetings

2.23 Section 136 of the NDIS Act provides that the Board should hold the meetings that are necessary for the efficient performance of its functions and the Chair must convene at least four meetings each calendar year. Between 1 July 2021 and 30 June 2024, the minimum annual meeting frequency requirements were met: the Board held 30 scheduled meetings, 16 out of session meetings, and made 10 decisions without meetings. The ANAO examined 16 of the 30 scheduled Board meetings to assess whether they were properly constituted in accordance with NDIS Act requirements.

• Approved minutes were recorded for all 16 meetings in accordance with section 141 of the NDIS Act.
• Minutes recorded Board approval of the previous meeting minutes, which included decisions made, actions to be taken, and the Board’s deliberations or considerations of agenda items.
• The Chair presided at all 16 meetings in accordance with section 137 of the NDIS Act.
• Quorum requirements (a majority of the Board members) of section 138 of the NDIS Act were met.

2.24 For 15 of the 16 meetings, all agenda items presented to the Board by NDIA management were accompanied by supporting papers.²² For the one significant item that was presented to the Board verbally without a paper, the Board requested that management present a paper in future, noting the quantity of information being presented and the accessibility needs of the Board.

2.25 As required at section 139 of the NDIS Act, Board resolutions are to be passed with a majority of the votes of the members present and voting. The voting requirements were met for the two meetings the ANAO observed in person.

2.26 Agenda items across the Board’s eight scheduled meetings during 2023–24 related to essential board functions, met broader administrative requirements or provided environmental or progress updates. The Board has a structured agenda with: standing items (declaration of material interests, CEO Report, review of prior minutes, matters arising, updates from the Independent Advisory Council (IAC)); cyclical items (such as quarterly risk and actuarial updates, annual reporting); and a variety of matters reported as needed relating to NDIA operations and board functions.

2.27 Agenda items often covered multiple board functions or sought multiple outcomes, for example, to seek Board discussion as well as a decision. Across the eight meetings reviewed, the Board considered 156 agenda items, including 50 that sought a decision, 69 that sought discussion, and 40 that asked the Board to note an action or advice.

2.28 Of the 50 agenda items in 2023–24 that sought a Board decision:

• 21 items involved consideration of aspects of the NDIA’s strategic direction, for example its approach to remote service delivery, consideration of strategic risks, or IT reform;
• 17 items related to NDIA performance, for example, considering NDIS projections, approving release of the Quarterly Report to Disability Ministers, or management responses to service delivery performance topics in ‘matters arising’ reports;
• 19 items related to risk management, or involved consideration of risk, for example, the quarterly Chief Risk Officer Report, the NDIS Annual Financial Sustainability Report (AFSR), or the Board’s Risk Management Declaration (see paragraph 3.44);
• 33 items directly related to compliance or had a compliance element, for example, approving minutes of prior meetings, the Board’s charter and annual review, or an update to Accountable Authority Instructions;
• 15 items related to resources, for example, procurement, the AFSR or NDIS projections; and
• eight items related to accountability, for example, financial and performance statements for the annual report, the AFSR and the Quarterly Report to Disability Ministers.

2.29 A written CEO Report was provided to the Board at all eight scheduled meetings in 2023–24 with updates on: significant management resource decisions or actions (such as organisation structure, senior staffing changes, procurement update); performance matters (such as service delivery issues and reform implementation progress); risks (such as updates on actions to address fraud and serious non-compliance); and follow up to matters queried by Board members in prior meetings. The CEO Report also provided the Board with key strategic information on the priorities of the minister, Ministerial Council direction, Budget process outcomes, as well as providing broader updates such as on recent parliamentary activity.

2.30 Australian Institute of Company Directors (AICD) guidance is that the purpose of ‘in camera’ meetings is for members to meet confidentially without management. Of the 16 Board meetings from July 2021 to June 2024 that the ANAO reviewed, minutes record that the Board held an ‘in camera’ session with Board members and the CEO on all occasions. A Board member-only ‘in camera’ session was held on five occasions.²³ Seven ‘in camera’ sessions were held with non-Board members including NDIA senior management (other than the CEO), the minister, the NDIS Quality and Safeguards Commissioner, the DSS Secretary and co-chairs of the NDIS Independent Review Panel. Agendas scheduled between 30 and 90 minutes for ‘in camera’ sessions. Meeting minutes did not state the duration of these sessions.

2.31 The Board does not have a policy on the use of, or the records for, ‘in camera’ sessions. AICD guidance is that minutes of ‘in camera’ meetings are not mandatory, and that it is advisable to record formal actions that are agreed in such sessions. Of the 16 meetings examined, three sets of minutes record details of the discussion of ‘in camera’ sessions including CEO appointment, remuneration and recruitment, Scheme Actuary appointment, and issues raised by the Board’s committees. Nine sets of minutes recorded action items or resolutions passed during ‘in camera’ sessions.

2.32 Minutes record that the CEO Report was presented at ‘in camera’ sessions at all of the 16 meetings examined, although some reports included matters also in separate Board papers and discussions were not recorded. The CEO report was in meeting papers and included matters such as fraud, provider and participant risks, NDIA and NDIS expenditure, and NDIS Reform. These matters related to the Board’s duties as an accountable authority under the PGPA Act (discussed further at 3.63). The NDIA advised the ANAO that the Board has a practice of advising the secretariat of any actions or resolutions following ‘in camera’ sessions. The ANAO was not present for ‘in camera’ sessions during field work to assess the communications to the secretariat. The Board had a practice of recording in its minutes a summary of other agenda items discussed.

Out of session meetings

2.34 The ANAO examined six of the 16 out of session (OOS) meetings to assess whether they were properly constituted.

• The Chair presided at, and quorum requirements were met for, all six OOS meetings.
• All six OOS meetings were recorded in approved minutes, with the minutes recording decisions and actions to be taken. Minutes recorded Board agreement to all resolutions. On one occasion a Board member did not vote in favour of a resolution.
• For all OOS meetings, minutes recorded the Board’s deliberations or considerations of the items presented to it.
• Board papers were prepared for all six OOS meetings and there were supporting papers for all agenda items.

2.35 In September 2023, for one of the six OOS meetings, a Board member had not been provided meeting papers due to a conflict of interest. The same Board member was excluded from two decisions without meetings on the basis of the same conflict. In 2023–24 the Board considered OOS papers relating to annual reporting, a fraud update, Quarterly Report to Disability Ministers, Board nomination of the reviewing actuary, advice on managing conflicts of interest, indemnity for the CEO in relation to a participant matter and an update on indicative results against corporate plan performance measures.

Decisions without meetings

2.36 The charters that the Board operated under between 1 July 2021 and 30 June 2024 outlined a procedure for making decisions without meetings:

Members are to indicate agreement to a decision by providing written advice to the Board Chair and Board Secretariat of their agreement to the proposed decision. This can be done by electronic signature or by email.

2.37 Between 1 July 2021 and 30 June 2024, the Board made 10 decisions without meetings. The ANAO examined five of the 10 decisions to assess whether the Board had followed its procedure for handling decisions without meetings and complied with notice and voting requirements of section 142 of the NDIS Act. For all five decisions without meetings:

• there was a record that the majority of members entitled to vote on proposed decisions indicated agreement;
• Board members indicated agreement by providing advice to the Chair and Board secretariat via email or electronic signature; and
• there was a record of the decision.

2.38 Paragraph 142(1)(c) of the NDIS Act requires all Board members be informed of the proposed decision or reasonable efforts made to inform them. On one of the five occasions, there was no evidence that one Board member had been informed of the proposed decision, or that reasonable efforts had been made to inform that member. On a further two occasions, one member was not notified of a proposed decision to be made without a meeting due to a conflict of interest.

Record keeping

2.39 Between 1 July 2023 and 30 June 2024, papers and approved minutes for Board meetings and decisions without meetings were not saved in the approved system required by NDIA policy and were instead saved in SharePoint.²⁴ The NDIA advised the ANAO in May 2025 that it is in the process of transitioning to a new record management system.

Conflicts of interest

Policies and procedures

2.40 The Board’s current conflict of interest policy, set out in its 2023–24 Board Charter, was largely consistent with the PGPA Act, PGPA Rule and NDIS Act.

2.41 Table 2.2 sets out the ANAO’s assessment of the extent to which the Board’s conflict of interest policy, contained in charters the Board operated under from July 2021 to June 2024, was consistent with the legislative requirements.

Table 2.2: ANAO assessment of the Board’s conflict of interest policy

Key: ◆ Fully addresses requirements ▲ Partly addresses requirements ■ Does not address requirements.

Note a: Section 132 of the NDIS Act prohibits Board members from paid employment that, in the minister’s opinion, conflicts or may conflict with the proper performance of the member’s duties.

Note b: In June 2024 the Board endorsed an interim Board Charter that addressed section 132 of the NDIS Act. The interim charter was not in effect in 2023–24.

Source: ANAO analysis of the Board’s charters.

2.42 Auditor-General Report No. 43 2022–23 Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports²⁵, tabled in June 2023, concluded that Board member conflicts of interest were largely effectively managed, noting:

The ANAO observed that members who declared personal interests as NDIS participants (or family members of participants) and/or members of disability organisations receive all Board papers and are present for discussion of all agenda items. The Board has not documented how it manages conflicts arising from such interests.

2.43 The NDIA agreed to recommendation no.6(a) in that report: ‘The National Disability Insurance Agency (NDIA) improve its management of conflicts of interest by implementing: (a) procedures for how the Board manages conflicts arising from declared interests of members’.²⁶

2.44 The Board has made changes to its policies and procedures for managing conflicts of interest.

• In July 2023, October 2023 and February 2024, the Board obtained legal advice relating to declarations of material interest, conflicts of interest, gifts, benefits, hospitality, invitations and outside employment. The Board incorporated guidance on material personal interests into new member induction information.
• The Board adopted a new declaration template prompting identification of the nature and extent of material personal interests, how these relate to NDIA affairs, and how these could give rise to real or apparent conflicts of interest and impact the performance of Board member duties. In February 2024, the Board directed the secretariat to schedule a conflict of interest refresher at the start of each year.
• In May 2024, the Board directed the secretariat to seek updated declarations from members three weeks prior to Board meetings.
• In June 2024, the Board endorsed an interim Board Charter that addressed section 132 of the NDIS Act, established a mechanism for managing member disagreement on conflict-of-interest matters, and gave direction on managing conflicts in meetings. In September 2024, the NDIA advised the ANAO that the interim charter was undergoing further development and was not yet in operation.
• In July 2024, the secretariat finalised an internal procedure for supporting Board members to identify, record, manage and mitigate any real or perceived conflicts of interest.

2.45 The changes to the Board’s policies and procedures do not include how the Board manages declared real or apparent conflicts of interest arising from members declaring personal interests as NDIS participants (or family members of participants) or members of disability organisations in accordance with the agreed ANAO recommendation.

Board management of conflicts of interest

2.46 The Board maintains a ‘Register of Board Members Interests’ (the Register) to record members’ declared material interests and conflicts of interest. Board charters required members to disclose material personal interests upon commencement, as changes occur, and annually after commencement. Between July 2021 and June 2024 the Register was updated on 22 occasions (and each update may have consisted of multiple changes to member interests).

2.47 Between July 2021 and June 2024, seven real or apparent conflicts of interest were declared by Board members and recorded in the Register. During Board meetings, the standing agenda item for discussions of declared interests is allocated for Board members to collectively consider what, if any, actions are required to manage declared interests. An agreed management strategy was documented for one of the seven declared conflicts. There were 22 other personal interests recorded in the register that may have represented, and were not declared as, real or apparent conflicts. These included declared interests as NDIS participants, family members of participants, members of disability organisations and employment with NDIS providers or consultancies providing services to the NDIA.

2.48 In considering how to manage any Board members’ declared conflicts, the Board Chair may write to the minister if the Board decides a member’s paid employment potentially conflicts with their member duties. Between July 2021 and June 2024, the NDIA advised there was no correspondence between the Board and the minister, under section 132 of the NDIS Act, regarding matters of paid employment that may conflict with Board member duties.

2.49 Of the 16 Board meetings the ANAO examined between July 2021 and June 2024, meeting minutes showed that declarations of material interest were called for at each meeting, and minutes recorded declarations that were made. In half of those meetings, minutes showed this occurred before the ‘in camera’ sessions. At four meetings, Board members recused themselves from discussions and voting that related to disclosed interests.

2.50 At both meetings observed in person by the ANAO, a member recused themself from discussions and voting on an agenda item that related to their disclosed interests. The minutes for these meetings recorded that the member was not present and the minutes did not state this was due to a conflict of interest. As a result, there was no record of how the conflict of interest was managed in these meetings.

2.51 On four occasions, one member recused themself from discussions and voting on a certain matter due to a potential conflict of interest arising from a past employment relationship. The potential conflict was registered in previous versions of the Board’s Register and was removed in January 2024. The member subsequently recused themself from related agenda items in February and June 2024. The Register did not identify the basis for the member’s continued recusal.

2.52 Of the six OOS meetings the ANAO examined between July 2021 and June 2024, the minutes of five meetings did not record whether declarations of material interest were called for or whether Board members recused themselves from discussions and voting that related to disclosed interests. For the five decisions without meetings the ANAO examined between July 2021 and June 2024, there was no record of the Board having considered conflicts of interest.

2.53 In September 2024, the NDIA advised the ANAO that a Board member was not provided meeting papers for one OOS meeting and had been excluded from two decisions without meetings due to an employment-related conflict of interest. The NDIA advised the ANAO that these Board decisions related to the NDIS Annual Financial Sustainability Report and the corporate plan which presented a material conflict of interest for the member.

2.54 The relevant interest had not been documented as a conflict, there was no documented strategy for managing that conflict, and there was no evidence of Board Chair or member agreement to exclude the member on the basis of the conflict on these occasions. There was no correspondence between the Board and the minister under section 132 of the NDIS Act addressing the member’s employment that gave rise to the potential conflict of interest.

2.55 The Board’s 2021–22 and 2022–23 charters stated that members would not receive Board papers for agenda items where a conflict of interest exists. The Board’s 2023–24 charter is silent as to Board member access to meeting papers that relate to a declared conflict of interest.²⁷ The secretariat restricts Board member access to papers in the online portal²⁸ where they relate to a declared conflict of interest. In August 2024 the NDIA advised the ANAO this practice started in May 2023. The decision to restrict access is made by the secretariat and not documented in any management strategies approved by the Chair.

Has the Board structured its own operations in a manner that supports effective governance?

Board Charter

2.58 AICD guidance states that:

A board charter is defined as a written policy document that clearly sets out the respective roles, responsibilities and authorities of the board of directors (both individually and collectively) and management in setting the direction, the management and the control of the organisation.²⁹

2.59 The Board had a charter in place between July 2021 and June 2024; the Board reviewed and approved updated versions of its charters in 2021–22, 2022–23 and 2023–24. The charters identified the legislation under which the NDIA was established and that the Board has responsibilities under the NDIS Act and the PGPA Act.

2.60 The Board’s charters were consistent with the key governance elements of the NDIS Act³⁰ and set out requirements for the Board’s composition, operation (including meeting requirements and record keeping) and functions. The charters set out: the distinct roles of the Board and the CEO under the NDIS Act; the Board’s ability to direct the CEO on the performance of their duties; and the Board’s ability to instruct NDIA officials in relation to finance law. The 2021–22 and 2022–23 Board charters stated that ‘the Board will establish clear delegations for management, including indicating which powers it reserves to itself. Such delegations will be in written form.’ This was not in the 2023–24 charter.

2.61 The 2023–24 Board Charter required the CEO and relevant members of the NDIA’s Strategic Leadership Team³¹ (SLT) to attend all Board meetings (except where a conflict of interest arose). Prior to this, SLT members attended on an invitation-only basis.

2.62 The Board did not record in charters, or elsewhere, its expectations for NDIA management on the quality or content of meeting papers or protocols. At the end of scheduled Board meetings, a nominated Board member provides feedback on the quality and timeliness of papers as part of a standing agenda item.

2.63 The charters set out expectations for the secretariat including recording meeting minutes, developing agendas, distributing agendas, papers and minutes, and updating the Register of Board Member Interests. The 2023–24 Board Charter required the secretariat to ensure meeting papers were in a format accessible to those with a disability and ‘maintain a work plan for the Board and its committees.’

2.64 A board workplan should set out a board’s forward schedule and priorities for the coming year for member planning purposes as well as providing assurance that board responsibilities will be met in the coming year.³² Between July 2021 and June 2024, the secretariat maintained various workplans that scheduled Board and committee meeting dates, agenda items and periodic reports. The workplans did not map Board priorities or legislative requirements to agendas or meetings and were not approved by the Board. In September 2024, the Board agreed to a forward workplan for 2025.

Committee charters

2.65 Between July 2021 and June 2024, the Board had seven committees, including the:

• People and Remuneration committee — assisted the Board ‘in managing people and remuneration matters’;
• Information and Communications Technology and Digital (ICTD) committee — assisted the Board ‘in the management and oversight of the Agency’s ICT solution, including providing input to the Board on the design, development, delivery and performance of the ICT strategy and systems’;
• Audit committee — assisted the Board ‘in the management and oversight of the quality and integrity of the accounting, auditing and financial reporting of the NDIA’;
• Risk committee — assisted the Board ‘in the management and oversight of the NDIA’s approach to risk management’;
• Sustainability committee — ‘provides advice on assessing, monitoring, reporting on and managing the financial sustainability of the Scheme’;
• Strategic Direction and Participant Outcomes (SDPO) committee — assisted the Board ‘to determine the objectives, strategies and policies to be followed by the Agency, with a dedicated focus on participant outcomes’; and
• Audit and Risk committee (ARC) — provided ‘independent advice and assurance to the Board, as the Agency’s accountable authority, in accordance with the [PGPA Act, PGPA Rule, NDIS Act], and National Disability Insurance Scheme—Risk Management Rules 2013’.

2.66 In March 2023, the Board ceased the People and Remuneration Committee, created the SDPO Committee and incorporated the ICTD Committee into the Risk Committee. In March 2024, the Board consolidated its separate Audit and Risk committees into a single Audit and Risk Committee (ARC). The Board’s committee structure is set out in Figure 2.1.

Figure 2.1: NDIA Board committee structure, as at 30 June 2024

Source: ANAO analysis of the Board committee structure.

2.67 Between July 2021 and June 2024 each of the Board’s committees listed at paragraph 2.65 had charters in place. Committee charters included a requirement to be reviewed annually. The Board reviewed all committee charters each financial year, with the exception in 2022–23 of the People and Remuneration and ICTD committees, which ceased in March 2023.

2.68 Committee charters set out member composition requirements, including a maximum number of members, and membership was largely consistent with these requirements. On three occasions committees exceeded the membership limit.

• In January 2023, the People and Remuneration and ICTD committees exceeded the number of members allowed by one member each. Only the ICTD committee met in 2023 before ceasing and while membership was oversubscribed.³³
• In January 2023, the Sustainability Committee exceeded the number of members allowed under its charter by one member. Between January 2023 and July 2023, the Sustainability Committee met twice and all its members were remunerated for this role. In July 2023, the Board updated the Sustainability Committee’s charter to increase the membership by one Board member.

2.69 Subsection 17(3) of the PGPA Rule requires that audit committees consist of at least three persons who have appropriate qualifications, knowledge, skills or experience to assist the committee to perform its functions. Minutes and papers for Board appointments to the Audit Committee in 2021–22 and 2022–23 did not record the Board’s consideration of whether members had these attributes. Committee charters largely set out other key elements of committee operation including whether any authority had been delegated by the board. The charters did not include all relevant content.

• The 2023–24 charters for the Audit, Risk, Sustainability, SDPO committees and ARC were silent on voting requirements.
• The 2023–24 ARC and former Audit Committee charters did not establish a method for making decisions without meetings. Decisions without meetings were made.
• The charters did not set expectations around the content or scope of committee reporting to the Board.

2.70 Section 17 of the PGPA Rule prescribes minimum requirements for audit committees of Commonwealth entities to help ensure the committee provides independent advice and assurance to its entity’s accountable authority. The Board’s Audit Committee and ARC charters were largely consistent with section 17 of the PGPA Rule, except they did not fully reflect the requirements of subsections 17(4A) and 17(5) relating to membership exclusions.

2.71 The Department of Finance’s ‘A guide for corporate Commonwealth entities on the role of audit committees’ also provides guidance on audit committee charters.³⁴ The Audit committee and ARC charters largely incorporated this guidance.

Board oversight of key policies and expectations of management

2.73 The NDIA advised the ANAO in June 2024 that:

The Board oversights Agency-level policies that link directly to its responsibilities … In addition the Board approves policies that it has recommended the Agency to develop (such as the Recovery Framework or where a policy responds to IAC advice (such as the Participant Safeguarding Policy).

2.74 Between July 2021 and December 2024, the Board reviewed:

• Psychosocial Disability Recovery Oriented Framework — approved September 2021;
• Modern Slavery Statement — approved November 2021, October 2022, November 2023 and December 2024;
• Risk Management Strategy — endorsed June 2022, November 2023, and December 2024;
• Accountable Authority Instructions and Financial Authorisations — new versions approved June 2022, July 2023 and October 2024;
• Supported Decision Making Policy — approved January 2023;
• Participant Safeguarding Policy — approved March 2023;
• Fraud and Corruption Control Plan — approved September 2023³⁵;
• NDIS Participant Employment Strategy Refresh 2024–2026 — endorsed November 2023;
• NDIA Innovate Reconciliation Action Plan — endorsed September 2024;
• the NDIA’s strategic risk settings, including its Risk Appetite Statement — approved May 2022, November 2023, and September 2024; and
• Agency Disability Action Plan — endorsed October 2024.

2.75 Board approval of key policies and frameworks, such as those relating to financial delegations, risk management, work health and safety, and fraud, can assist board members to gain assurance that they are effectively discharging their duties as the accountable authority by setting the framework for compliance with relevant legislation. The Board did not document, in its charters or elsewhere, expectations for its oversight of NDIA policies, including identifying the key policies that require Board approval.

Board member induction

2.77 The NDIA has a draft Board member induction policy.

The Board Secretariat is responsible for supporting the Chairman and CEO to co-ordinate the induction of newly appointed board members. The Chairman ensures that new board members receive a comprehensive, structured and tailored induction on joining the board.

2.78 Between 1 July 2021 and 30 June 2024, 10 new members were appointed to the Board. The ANAO reviewed the inductions of two members who joined in 2023 — these were partly consistent with the draft induction policy.

• Both Board members met with the Board Chair prior to their first Board meeting and received an induction pack containing a Board operational overview, Board and committee charters, and key NDIA policies.
• Neither Board member received other background information on the NDIA including organisation charts, relevant legislation or recent corporate, annual or performance reports.
• Neither Board member was allocated a mentor or provided briefings from senior NDIA executives at the commencement of their appointment.³⁶

Board performance assessment

2.80 The AICD states:

A board’s effectiveness can only be gauged if it regularly evaluates its performance. A good evaluation provides objective performance measures, indicates performance gaps, and agrees strategies for improving board effectiveness.

2.81 The Board’s 2021–22 and 2022–23 charters set out performance evaluation requirements: ‘The Board will conduct a board review on an annual basis. This review will be conducted by an external party at least once every three years.’ Committee charters in 2021–22 and 2022–23 also included committee performance evaluation requirements. The 2023–24 Board and committee charters did not include performance evaluation requirements.

2.82 The NDIA’s Annual Reports for 2021–22 and 2022–23 both reported Board performance as having been reviewed annually in accordance with the charter.

2.83 Between July 2021 and June 2023, the Board discussed performance on two occasions.

• The Board’s November 2022 meeting agenda included a relevant item, but no accompanying paper. Minutes referred to the Board’s discussion of the need to improve the accessibility of Board papers for members with disabilities. The minutes do not refer to an assessment of skills, competencies or performance.
• In February 2023, the Board discussed the effectiveness and purpose of its committees and agreed to a committee restructure.

2.84 Board and committee charters for 2023–24 did not include performance evaluation requirements and the 2023–24 Annual Report did not report on the Board’s performance. In February 2024, the Board resolved to ‘undertake a substantive review of committee structures and performance in 2025.’ The NDIA contracted a service provider³⁷ in October 2024 to assess and evaluate the Board’s and its committees’ performance.

Sustainability and Strategic Direction and Participant Outcomes committees

2.85 As discussed at paragraph 2.65, the Board established committees to help it fulfil its duties. As at September 2024, the Board was supported by three committees, its: Sustainability Committee; Strategic Direction and Participant Outcomes (SDPO) committee; and ARC (separately discussed from paragraph 2.95).

2.86 The Board’s Sustainability and SDPO committees’ charters’ outline their roles.

• The Sustainability committee is to support the Board to monitor and report on the financial sustainability of the NDIS; and
• The SDPO committee is to assist the Board ‘to determine the objectives, strategies and policies to be followed by the NDIA, with a dedicated focus on participant outcomes.’

Sustainability Committee

2.87 The Sustainability Committee’s 2023–24 charter sets out its functions, which are to:

• monitor the financial sustainability of the NDIS;
• provide advice to the Board on actuarial advice and reports from the Scheme Actuary; and
• review and provide advice to the Board regarding financial sustainability reporting obligations.³⁸

2.88 The ANAO reviewed reporting to and by the Sustainability Committee to assess if it provided support for the Board as expected in its charter. The ANAO’s assessment is in Table 2.3 below.

Table 2.3: ANAO assessment of the Board’s Sustainability Committee operation

Note a: An update was not required for the Board’s 24 October 2023 meeting as all Board members present had attended the committee meeting the day before.

Note b: Subsequently, in 2024–25, as at 5 December 2024, Board meeting packs included the Sustainability Committee’s minutes on a further three occasions.

Source: ANAO analysis of NDIA documentation.

2.89 The Sustainability Committee’s August 2023 charter required it to develop a forward workplan. While committee papers and minutes did not address this topic, the committee has operated since the NDIA was established and has an established cycle of actuarial reporting.

2.90 Between July 2021 and August 2023, the Substantiality Committee’s prior charters also required it to:

• provide advice to the Board on actions to be taken arising from analysis of the reports of the Scheme Actuary;
• provide advice to the Board on potential changes to the legislation or other regulation; and
• review or advise the Board on the definition of the sustainability concept, the prudential governance framework, and insurance principles.

2.91 Between July 2021 and August 2023, the Sustainability Committee considered reporting on NDIA reform activity and its expected impact on sustainability. The committee provided feedback and direction to management but did not provide the Board separate written advice on actions.

2.92 At one meeting the Sustainability Committee reviewed the NDIA definition of the sustainability concept, as required by its charter. The committee did not review or advise the Board on the prudential governance framework, or insurance principles. These concepts were drafted in the NDIA’s 2016 Insurance Principles and Financial Sustainability Manual, and the committee removed these requirements from its 2023 charter.

Strategic Direction and Participant Outcomes committee

2.93 The SDPO committee first met in July 2023 — its charter sets out its functions:

The Committee provides advice and recommendation to the Board to support it to:

• determine the strategic direction and vision for the Agency
• ensure the Agency is delivering against the committed vision, values and direction
• set the policies and strategic priorities to be followed by the Agency
• consider and respond to advice provided by the Independent Advisory Council (IAC)
• respond to recommendations for reform, including those arising from Government Inquiries, Reviews and Royal Commissions
• monitor participant experience and outcomes, including for participants from culturally and linguistically diverse groups, and ensure that participants are at the centre of Board deliberations
• promote and embed the objects and general principles of the NDIS, per sections 3 and 4 of the NDIS Act.

2.94 The ANAO reviewed reporting to and by the SDPO Committee to assess if it provided support for the Board as expected in its charter. The ANAO’s assessment is in Table 2.4 below.

Table 2.4: ANAO assessment of the operation of the Board’s Strategic Direction and Participant Outcomes Committee

Note a: The Chair advised that the committee had nominated best-practice Early Childhood, navigation, budget setting, Home & Living, and enablers such as Artificial Intelligence and values-based commissioning as areas of specific interest.

Source: ANAO analysis of NDIA documentation.

Audit committee

2.95 All Australian Government entities are required under the PGPA Act to have an audit committee. As the NDIA’s accountable authority, the Board must, under section 45 of the PGPA Act, ensure the NDIA has an audit committee that is constituted, and performs functions, in accordance with the requirements of the PGPA Rule. An audit committee’s minimum functions, under subsection 17(2) of the PGPA Rule, include reviewing the appropriateness of the accountable authority’s financial and performance reporting, system of risk oversight and management, and system of internal control. Section 17 of the PGPA Rule also requires audit committee members be independent of management, to support the provision of independent advice to the accountable authority. The head of the accountable authority — for the NDIA, the Board Chair — may not be an audit committee member.

2.96 Between July 2021 and February 2024, the Board had an Audit Committee and a separate Risk Committee. As noted at paragraph 2.66, the Board merged these committees in March 2024 into the ARC. Both the former committees and the ARC had charters in place that included the minimum functions required under the PGPA Rule. Member composition of the ARC, and the former Audit Committee and Risk Committee, satisfied the independence requirements of section 17 of the PGPA Rule.

2.97 In addition to reviewing the NDIA’s financial and performance reporting, the former Audit Committee was responsible for overseeing the NDIA’s system of risk oversight and management, and system of internal control. There was overlap in the risk functions listed in the charters for the former Audit Committee and former Risk Committee. The former Risk Committee was separately also responsible for recommending to the Board, for its approval, the annual risk management declarations required by the NDIS Risk Management Rules.³⁹ The relationship between the former Audit Committee and the former Risk Committee and how the Risk Committee supported the Audit Committee’s functions, were not documented. Methods of sharing information and reports across the two committees were not documented.

2.98 In its paper to the Board recommending combining the Audit Committee and the Risk Committee, the NDIA stated:

Combining these two committees will consolidate and streamline advice provided to the Board about the appropriateness of the Agency’s systems for audit and risk, particularly in relation to prevention activities, supporting frameworks and controls regimes, compliance, assurance and monitoring.

Meetings

2.99 The ARC and the former Audit Committee charters required a minimum of four committee meetings to be held per year. This requirement was met or exceeded in 2021–22, 2022–23 and 2023–24.

2.100 The ARC and former Audit Committee held 15 scheduled meetings and three out of session meetings between 1 July 2021 and 31 December 2024. The ARC and former Audit Committee took two decisions without a meeting, one to agree to engage an external special advisor to support the Committee and the other to endorse proposed strategic risk and mitigation strategies to the Board for inclusion in the NDIA’s Corporate Plan.

2.101 For the eight meetings from July 2023 to December 2024, there was a quorum at each meeting and declarations of material interest were considered at seven meetings.

Reporting to audit committee

2.102 The number of scheduled meetings between July 2021 and December 2024 at which the ARC and former Audit Committee received management reporting relevant to each of their minimum functions under the PGPA Rule (see paragraph 2.95) is set out in Table 2.5 below.

Table 2.5: Management reporting to the ARC and former audit committee — July 2021 to December 2024

Note: Includes both scheduled and out of session (OOS) meetings, but not decisions made or other correspondence shared OOS.

Source: ANAO analysis of NDIA documentation.

2.103 Between July 2021 and March 2024, the former Audit Committee routinely received and considered financial reporting, including drafts of annual financial statements, proposed approaches to participant plan provisions, and updates on potential audit findings and resolutions. During the same period, the Audit Committee also received performance reporting, including drafts of annual performance statements, and internal audit reviews of performance statements and methods. The committee did not receive management proposals for what performance measures to include in the NDIA’s Portfolio Budget Statements or corporate plans — these proposals were instead put directly to the Board.

2.104 The former Audit Committee received reporting relating to systems of risk oversight and management at three of its 12 meetings. The reporting that supported risk oversight and management related to internal audit findings on the NDIA’s Risk Management Declaration and operational risks in the Chief Finance Officer Group. While the Board’s Risk Committee received additional management reporting relevant to the NDIA’s systems of risk oversight and management, the Audit Committee did not receive reports from the Risk Committee enabling it to fully consider risk against its other functions.

2.105 Prior to the formation of the ARC, the Risk Committee received the quarterly Chief Risk Officer (CRO) Report. The CRO provided summary reporting on matters of risk management to the Audit Committee until May 2023. From that date, the summary reporting from the CRO was provided by the Deputy Chief Executive Officer, Governance, Risk and Legal. In August 2024, the ARC Chair and the CRO advised the ANAO they met regularly outside of ARC meetings to discuss emerging risk. Records of these discussions were not kept. In August 2024, the former chairs of the Audit Committee and Risk Committee advised the ANAO that they shared information relevant to the committees through regular informal discussions. Between January 2022 and February 2024 there was overlap in the membership of the Audit Committee and Risk Committee, with at least two Board members appointed to both committees, including the chair of at least one of the committees.⁴⁰

2.106 The former Audit Committee received reporting related to systems of internal control at 11 of its 12 meetings between July 2021 and February 2024. Reporting included proposed Accountable Authority Instructions (AAIs), internal audit reports and potential ANAO audit findings.

2.107 As set out in Table 2.5, the ARC received reporting against all functions required by the PGPA Rule at five of its six meetings between March 2024 and December 2024, including the quarterly CRO Report.⁴¹ One OOS meeting during this period was focused solely on the annual financial and performance statements.

2.108 Minutes reflect the ARC and former Audit Committee discussed agenda items at all eight meetings between 1 July 2023 and December 2024, sought further information at seven of these meetings, and specific action at five meetings.

2.109 In August 2023 the Institute of Internal Auditors (IIA) finalised an external quality assessment of the NDIA’s internal audit function. The assessment concluded that internal audit generally conformed with the International Standards for the Professional Practice of Internal Auditing. The IIA made eight recommendations for improvement⁴², including one high-priority recommendation that the organisational independence of internal audit be reviewed, noting:

Standard 1110 requires that the internal audit function must report functionally to the Board and are free to determine the scope of internal auditing, performing work and communicating results.

2.110 The Audit Committee received advice in November 2023 that corrective action in response to this recommendation was ‘on track’. In December 2024, the NDIA appointed a new Branch Manager, Audit, with invitations to attend ARC meetings and meet separately with the ARC Chair ahead of scheduled ARC meetings.

Advice to the Board

2.111 The Department of Finance’s, ‘A guide for corporate Commonwealth entities on the role of audit committees’⁴³ sets out audit committee deliverables, which include providing documented advice to boards on the appropriateness of reviewed financial and performance reporting, systems of risk oversight and management, and systems of internal control.

2.112 From October 2022 to June 2024, verbal Audit Committee or ARC updates were provided to the Board meetings that followed six of the eight committee meetings held during the period. Risk Committee updates were reflected in minutes of Board meetings that followed four of the six committee meetings from October 2022, until the ARC replaced it in March 2024. Committee meeting minutes were included in Board meeting packs for two meetings — May 2024 and June 2024. In March 2024 the Board resolved that draft ARC minutes would be included in future Board papers. In 2024–25 (as of 5 December 2024), the ARC held a further three meetings and for each it provided verbal updates and a copy of minutes to the subsequent Board meetings. Verbal updates in 2024 observed by the ANAO at two Board meetings, and as documented in Board minutes, focused on a recapitulation of matters considered in recent meetings or other actions underway and did not include advice on the appropriateness of NDIA systems.

2.113 From October 2022 to December 2024, Board papers did not include separate written advice from the Audit Committee or ARC. The Audit Committee and ARC minutes reflected that the committee had recommended the NDIA’s annual financial and performance statements (and from March 2024, risk and control reporting) to the Board for approval. NDIA management then provided the statements to the Board for approval. Recent board papers include a statement to this effect.

2.114 While minutes reflect wider Board member attendance at committee meetings than committee members, and the committee minutes are shared with all Board members, these practices do not constitute considered independent advice to the Board.

2.115 In 2022–23 and 2023–24, prior to the formation of the ARC, neither the former Audit Committee nor Risk Committee annually confirmed to the Board that all their functions had been carried out, as required by their charters.

Internal audit

2.117 Under their charters, the ARC and former Audit Committee had responsibility for oversight of the NDIA’s internal audit function, including by approving the internal audit work plan. The committee was presented with the NDIA’s proposed Internal Audit Plan (IAP) six times between July 2021 and June 2024 and approved the IAP on three of the six occasions. On the remaining occasions: in August 2022, no committee decision was recorded; in February 2023, the committee noted the IAP; and in September 2023, the committee did not approve the IAP and directed management to review and resubmit it at the next meeting. The IAP was approved in the subsequent meeting.

2.118 A rationale was included for each proposed audit in all IAPs except the IAP proposed in November 2023. The external quality assessment of the NDIA internal audit function, reported to the Audit Committee in September 2023 (see paragraph 2.109), suggested improvements to planning, including clarifying how proposed audit topics linked to either strategy or organisational risks. The IAP has moved to a three-year rolling plan with proposed topics linked to the NDIA’s strategic risks, first approved in September 2024.

2.119 Table 2.6 sets out the number of internal audits planned between July 2021 and June 2024 that were completed, and whether the completed report was provided to the former Audit Committee or the Audit and Risk Committee.

Table 2.6: Status of internal audits planned: 2021–22 to 2023–24

Note a: Status is as reported to the ARC on or before its 4 March 2025 meeting.

Note b: The NDIA’s Performance Statements 2020–21 internal audit was not presented to the Audit Committee.

Source: ANAO analysis of NDIA documentation.

2.120 The Audit Committee did not approve the closure of recommendations or receive closure packs with evidence of the actions completed. The committee received reporting on internal audit, ANAO, and Commonwealth Ombudsman recommendations that remained open or were overdue. In March 2024, the ARC discussed management’s plan to introduce a separate report on the status of recommendations from internal and ANAO audits and reviews. The new report was provided for the ARC’s September 2024 meeting. The updated report format provides greater clarity over the status of deliverables in the NDIA’s internal audit plan.

3.1 Under sections 15 and 16 of the Public Governance, Performance and Accountability Act 2013 (PGPA Act), the accountable authority of an entity has a duty to govern and to establish and maintain an appropriate system of internal control for the entity, including by implementing measures directed at ensuring officials of the entity comply with the Commonwealth finance law.⁴⁴

3.2 The Board, as the accountable authority for the NDIA, is required to comply with its enabling legislation, the National Disability Insurance Scheme Act 2013 (NDIS Act) and related rules. As a Corporate Commonwealth Entity (CCE), the NDIA must also comply with the PGPA Act and Public Governance, Performance and Accountability Rule 2014 (PGPA Rule).

Has the Board established fit-for-purpose arrangements to oversee compliance with key legislative and other requirements?

Ministerial directions

3.3 Under section 121 of the NDIS Act, the minister may, by legislative instrument, give directions to the NDIA about the performance of its functions. The minister may also give the Board, under section 125 of the NDIS Act, ‘a written statement setting out strategic guidance for the Agency.’⁴⁵ Subsection 172(2) of the NDIS Act requires the NDIA to include in annual reports details of directions given under section 121 and statements given under section 125.

3.4 The NDIA reported in its 2021–22, 2022–23 and 2023–24 annual reports that it had not received ‘any government policy orders or ministerial directions from the Minister for the NDIS’.

3.5 Between July 2021 and June 2024, the minister wrote to the Board Chair on two occasions, expressing priorities for the NDIA. The NDIA advised the ANAO in May 2024 that the letters did not form a statement of strategic guidance as state and territory disability ministers had not been consulted on the contents, as required by section 125.

• In June 2022, the minister wrote to the Board Chair regarding the briefing from the NDIA on the outcome of its Annual Pricing Review. The minister supported the Board making one-off COVID-related payments to providers, and for a specific approach to increasing disability support worker price limits. The Board Chair responded to the minister’s correspondence, agreeing to the proposed COVID-related payment and not agreeing to disability support worker price limit changes.
• In August 2023, the minister wrote to the Board Chair noting 2023–24 federal Budget initiatives and the NDIS Financial Sustainability Framework⁴⁶, and the Board’s legislative financial sustainability obligations. The minister referred to the Board’s obligations under section 15 of the PGPA Act and sections 118 and 124 of the NDIS Act to govern the NDIA in a way that promotes financial sustainability, to report on financial sustainability, and identify and manage related risks.
• The Board Chair responded, acknowledging the minister’s references to the Board’s legislative obligations and noting the demand-driven NDIS settings did not give it ‘effective levers to manage and mitigate to the appropriate threshold financial risks to the Scheme.’ The Chair also noted the Board was working with the NDIS Review and stated it would welcome the opportunity to work with the minister, states and territories and people with disability in various areas, including legislative change.

3.6 The Board’s oversight of financial sustainability is discussed between paragraphs 3.48 and 3.62.

Board consideration of actuarial and committee advice

3.7 Section 125A of the NDIS Act requires the Board to have regard to:

• actuarial analysis and advice; and
• advice and reports provided by its audit committee.

3.8 The Board must also have regard to Independent Advisory Council (IAC)⁴⁷ advice provided under subsection 144(1) of the NDIS Act. Under subsection 145(b) of the NDIS Act, the Board is required to ‘give the Ministerial Council a copy of the advice and a statement setting out what has been done, or is to be done, in response to the advice.’

• Between July 2021 and June 2024, the Board and the Sustainability Committee considered quarterly actuarial reports, NDIS Monthly Pulse (Pulse) reports⁴⁸ and Annual Financial Sustainability Reports. In addition, the Board considered actuarial participant plan provision analyses and reports from the reviewing and scheme actuaries.
• As outlined at Table 2.3, the Sustainability Committee received reporting on management’s response (planned and underway initiatives) to the sustainability challenges reflected in actuarial reporting until August 2022. In February 2023, the Board was advised of, and considered, new sustainability initiatives proposed by management, with updated NDIS projections, to form the basis of advice to government (discussed from paragraph 3.51).
• The frequency and scope of the ARC’s and former Audit Committee’s advice to the Board is discussed from paragraph 2.111. The Board approved Accountable Authority Instructions and annual financial and performance statements, which had been submitted to the Board for approval following review and endorsement by the ARC and former Audit Committee.
• Between July 2021 and June 2024, the Board received and responded to all five instances of IAC advice issued and the NDIA provided all advice, and Board responses, to the Ministerial Council. The Board received an IAC update at 27 of the 30 scheduled Board meetings between July 2021 and June 2024.

Appointments

NDIA Chief Executive Officer

3.9 Sections 160 and 161 of the NDIS Act set out how the Chief Executive Officer (CEO) or acting CEO are appointed by the Board. The NDIS Act specifies that the CEO appointment cannot be a Board member, must be ‘made by written instrument’, is on a full-time basis, and for a specified term not exceeding three years. Acting CEO appointments must also be by written instrument and for a person who is not a Board member. The Cabinet Handbook requires NDIA CEO appointments, and acting CEO appointments greater than three months, to be approved by the Prime Minister, or at their discretion, Cabinet.⁴⁹

3.10 Between July 2021 and June 2024, there was one substantive appointment to the CEO position, in October 2022, and six acting appointments where each term was no more than three months. These appointments complied with legislative requirements and were approved by the Prime Minister in accordance with the Cabinet Handbook.

Scheme Actuary and Reviewing Actuary

3.11 The NDIS Act establishes the roles of the Scheme Actuary and Reviewing Actuary and specifies their responsibilities.⁵⁰ The Scheme Actuary’s responsibilities include:

• assessing the financial sustainability of the NDIS;
• estimating future expenditure of the NDIS at least quarterly;
• providing advice or actuarial information, at the Board’s request; and
• reporting significant concerns related to financial sustainability or risk management to the Board.

3.12 On request by the Board, the reviewing actuary must review actuarial reports, the Annual Financial Sustainability Report, and its summary included in NDIA annual reports. Both the scheme and reviewing actuaries are required to report to the Board on significant concerns related to the financial sustainability of the NDIS.

3.13 Sections 180A and 180D of the NDIS Act contain mandatory requirements for the Board’s nomination of the Scheme Actuary and Reviewing Actuary respectively.⁵¹

3.14 Between July 2021 and June 2024, the Board made one interim nomination in November 2022 and one permanent nomination in March 2023 to the position of Scheme Actuary. Both nominations were for the same person.

3.15 The minutes of the Board’s nomination of the Scheme Actuary in March 2023 do not record how, in the opinion of the Board, the nominee had the required skills, experience and fitness for the position demonstrating the Board’s consideration of relevant legislative requirements for this nomination.

3.16 Between July 2021 and June 2024, the Board made two nominations to the position of the reviewing actuary. In September 2022 the Board nominated the incumbent reviewing actuary for a further 12 months from February 2023. In January 2024 the Board nominated the same person for a further three-year period, commencing February 2024.

3.17 The minutes of the September 2022 Board meeting where the reviewing actuary was nominated do not record the Board’s consideration of legislative requirements. The accompanying Board paper did not discuss legislative requirements for the nomination of the reviewing actuary or how the Board could be satisfied that the proposed nominee met these requirements.

3.18 The paper for the Board’s January 2024 meeting where the reviewing actuary was nominated included a statement that the nominee ‘satisfied the requirements of section 180D(1)’ without recording supporting evidence or explanation of how the nominee met each legislative requirement. Meeting minutes did not reflect the Board’s consideration of whether the nominee was a fit and proper person, had skills, experience or knowledge for the role.

Oversight and monitoring of ongoing compliance with relevant legislation

3.20 The NDIA Regulatory Compliance Framework dated March 2021 sets out the NDIA’s approach to monitoring and reporting regulatory compliance, including regulatory incident reporting, PGPA compliance surveys, regulatory attestations, and quarterly compliance updates.

Incident reporting

3.21 NDIA business areas are required to escalate any relevant incidents under the NDIA Issues and Incident Management Framework. To support incident and compliance reporting, in November 2022 the Risk Committee endorsed a matrix to guide categorisation of incidents and issues as ‘Red’, ‘Amber’ or ‘Green’.⁵² Red-rated incidents, the most serious, are reported to both the NDIA’s Senior Leadership Team (SLT) and the ARC (previously to the Board’s former Risk Committee). The matrix, and therefore the level of reporting the Board receives, was not considered by the Board.

3.22 Breaches of compliance obligations are reported in the quarterly Chief Risk Officer (CRO) Report as incidents.⁵³ This report has been provided to the Board since July 2023. Until July 2023, the Board received a paper summarising the NDIA’s management of risks over the prior quarter and the Risk Committee received the CRO Report.

3.23 The number of incidents occurring, and their severity, are included in the CRO Report. Further ‘incident summaries’ are included for red-rated incidents and those with a ‘compliance impact’. Incidents that are compliance breaches are required to be accompanied by a description of the compliance impact. Incidents that were breaches of compliance obligations were not consistently reported as having a compliance impact. In August 2024, the NDIA advised the ANAO there is no entity-wide guidance on what incidents should be reported as having a compliance impact. In the CRO Report for quarter two of 2022–23, provided to the Risk Committee, 17 red-rated incidents were reported. In the CRO summary paper to the Board for the same period, no red-rated incidents were reported. This was not updated in subsequent Board reports.

PGPA compliance survey reporting

3.24 The NDIA surveys Senior Executive Service (SES) officers on a quarterly basis to identify and report on PGPA Act non-compliance within their respective areas of responsibility. Four of the 10 quarterly reports from the CRO to the Board, between July 2021 and June 2024, included summary results of PGPA compliance surveys. Reporting to the Board did not include the nature of non-compliance identified in survey results, including for credit cards and travel non-compliance. Reporting to the Board did not use the same categories as the PGPA compliance surveys, such as ‘travel’, and results were aggregated across categories. The aggregated reports reduce the Board’s visibility of non-compliance and internal control effectiveness.⁵⁴

Compliance attestations

3.25 The CRO Report includes compliance attestations from relevant SES officers (the accountable executive) as to whether they:

• were familiar with their obligations;
• communicated obligations to relevant staff;
• have effective controls in place for their obligations;
• have a program to gain assurance over control effectiveness for their obligations;
• reported incidents in line with tolerances;
• have anything else to report; and
• if applicable, accept their general managers’ responses to inform their attestations.

3.26 Between July 2021 and June 2024, four accountable executives’ attestations over consecutive reporting periods were negative, qualified, or included comments relating to a deficiency in controls or controls assurance programs. For example, in four attestations, the Chief Operating Officer indicated there was no control effectiveness program for key regulatory obligations.

3.27 For the period January 2022 to March 2023, the CRO provided a negative attestation in relation to the NDIA’s controls assurance program for key controls. The attestation stated: ‘controls assurance work was paused in December 2021 to focus on the 3P program.⁵⁵ Some control testing is undertaken through the internal audit program.’

3.28 Attestations from accountable executives with negative or qualified responses largely included details of remedial actions planned or underway. Minutes of the former Risk Committee’s meetings, and ARC meetings, do not reflect discussions of negative or qualified attestations. Risk Committee minutes do not reflect a discussion of the sufficiency of the internal audit program or correspondence with the former Audit Committee relating to the CRO’s negative attestations for controls assurance work.

Quarterly compliance updates

3.29 The Board received quarterly compliance updates required by its Regulatory Compliance Framework in the quarterly summary paper on risk management and the CRO Report. The Board also received other general reporting on the NDIA’s regulatory compliance.

Board responsibilities under the NDIS Risk Management Rules 2013

3.30 The PGPA Act (section 16) and PGPA Rule (section 10) include requirements for all accountable authorities of Commonwealth entities to effectively manage risk, with appropriate systems of risk oversight and management and set minimum standards for managing the risk of fraud.⁵⁶ In addition to its PGPA obligations, the Board has specific responsibilities for risk management under the National Disability Insurance Scheme — Risk Management Rules 2013 (RMRs).⁵⁷ Under the RMRs, the Board must ensure there is a risk management framework, strategy, culture, structure, and practices in place to monitor and manage material risks for the NDIA.

Risk Management Strategy

3.31 The NDIA’s Risk Management Strategy was approved by the Disability Reform Ministerial Council (DRMC) in 2018. A 2020 Risk Management Strategy was endorsed by the Risk Committee in June 2020, although it was not approved by the Board. The 2024 Risk Management Strategy was approved by the Board in November 2023 and by the DRMC in February 2024.

Risk Management Framework

3.32 The RMRs set requirements for the NDIA’s Risk Management Framework, including its purpose, content and the Board’s responsibilities.⁵⁸ The Risk Management Framework was set out in the 2020 Risk Management Strategy. The 2020 strategy set out the risk management documents (‘framework elements’), and document contents (‘components’) that comprised the Risk Management Framework.

3.33 The 2024 Risk Management Strategy does not set out what documents form the Risk Management Framework. The Board was given a diagram of the NDIA’s risk management architecture, and included a risk management architecture diagram in the 2021–22 corporate plan. Both diagrams identify different framework elements to those in the 2020 Risk Management Strategy. Of the documents which appear in the NDIA’s risk management architecture diagram, the Board approved the:

• Risk Management Strategy;
• Risk Appetite Statement; and
• Fraud and Corruption Control Plan.

3.34 The description of the Risk Management Framework in the 2024 Risk Management Strategy reduces the Board’s visibility of the framework’s components and their appropriateness. The Board has not specified which of the components require Board approval.

3.35 Under subsection 7 (1)(a) of the RMRs, the Board is required to ensure that reviews of the Risk Management Framework are ‘effective and comprehensive’ and are conducted by ‘operationally independent and appropriately trained and competent’ people. Subsection 7(1)(b) of the RMRs requires the review frequency to be ‘appropriate having regard to the size and complexity of the Agency’s operations.’

3.36 The 2020 Risk Management Strategy stated an ‘independent external review’ on the Risk Management Framework would occur every three years. The 2024 Risk Management Strategy states that the framework will be independently reviewed ‘as appropriate.’ Between July 2021 and June 2024, the Risk Management Framework was not reviewed by the Board and no external review took place. In July 2024 the NDIA advised the ANAO that a review of the framework is a priority for the ARC in 2024–25.

3.39 Both the 2020 and the 2024 Risk Management Strategy require the Board to approve the NDIA’s risk appetite statement, with the 2024 Risk Management Strategy requiring it be reviewed annually. The NDIA reported in its 2021–22, 2022–23, and 2023–24 annual reports that the risk appetite statement was determined by the Board annually. The Board approved a ‘conservative’ risk appetite statement in June 2022. In November 2023 the Board approved a risk appetite statement with a ‘conservative’ rating for each strategic risk (except for ‘participant experience’ which was ‘neutral’). In September 2024, the Board approved the NDIA Risk Appetite Statement for 2024–25, with ‘conservative’ individual ratings for risk elements (except for ‘stakeholder confidence and trust’ and ‘legislative obligations’ which were ‘neutral’).⁵⁹

Review of Risk Management Strategy

3.40 The RMRs (section 8) require that the Risk Management Strategy be reviewed annually, that ‘any material amendment to the strategy’ be approved by the DRMC and that:

The Board must submit the strategy or amendments to the Ministerial Council as soon as reasonably practicable after the strategy or amendments have been approved by the Board.

3.41 The NDIA began a review of the Risk Management Strategy in November 2021 and the Board approved amendments to it in June 2022. The NDIA provided the Board-approved Risk Management Strategy to the minister in November 2022. On 25 November 2022 the minister endorsed the strategy, agreed for it to be submitted to the DRMC for approval and included the following comment in the ministerial brief: ‘[t]his should be redeveloped under the new CEO in early 2023.’

3.42 Meeting papers for the Board’s January 2023 meeting stated that the Risk Management Strategy was an anticipated agenda item for the DRMC’s February 2023 meeting. Papers for the May 2023 Risk committee meeting note:

At the request of the Chief Executive Officer, the agenda item [approval of the Risk Management Strategy endorsed by the Minister for the NDIS in November 2022] was removed from the February 2023 DRMC meeting agenda to accommodate review by the Chief Risk Officer.

The Board was not notified of this action.

3.43 The Risk Management Strategy was subject to another review. The Board approved the revised strategy in November 2023, and in December 2023 the minister, as DRMC chair, approved the strategy and agreed to its submission to the DRMC. The DRMC approved the revised Risk Management Strategy in February 2024.

Annual risk management declaration

3.44 Under subsection 10(1) of the RMRs, the Board is required to provide an annual risk management declaration at the end of each financial year, signed by two Board members on behalf of the Board. The annual declaration includes statements that:

• the NDIA has systems to ensure compliance with the NDIS Act and PGPA Act;
• the Board and the NDIA are satisfied with the process and systems for preparing financial information; and
• the Board has a Risk Management Strategy that complies with the RMRs, is operating effectively, has been complied with throughout the financial year, and that the present strategy was provided to the DRMC.

3.45 The Board provided the minister, as chair of the DRMC, risk management declarations in 2020–21, 2021–22, 2022–23 and 2023–24. The declarations met the requirements for when they were produced, who signed them and their content.

Reporting for risk management oversight

3.46 The 2021–22 and 2022–23 Risk Committee charters, and the 2023–24 ARC charter, require each committee to ‘annually confirm to the Board that all its functions have been carried out and comply with any other reporting requirements.’ The former Risk Committee did not provide this annual confirmation to the Board.

3.47 Table 3.1 sets out seven key Board responsibilities under the RMRs and the ANAO’s assessment of whether reporting to the Board gives it sufficient oversight of these.

Table 3.1: Board oversight of its responsibilities under the NDIS Risk Management Rules 2013

Key: ◆ Largely has oversight of responsibilities ▲ Partly has oversight of responsibilities ■ Does not have oversight of responsibilities.

Note a: The ANAO examined a selection of general responsibilities in section 4 of the Risk Management Rules.

Note b: The ANAO examined Board oversight and did not assess the effectiveness of NDIA senior management monitoring and management of likely material risks.

Source: ANAO analysis of NDIA documentation.

Scheme financial sustainability

3.48 As well as promoting the financial sustainability of the entity (the NDIA), the Board is responsible for ensuring the NDIA manages the financial sustainability of the NDIS, as outlined at paragraph 3.5. While the Board considered NDIS sustainability, it did not provide direction on the NDIA’s response to the growth in NDIS expenses.

3.49 The NDIA defines NDIS financial sustainability as the state where:

• The Scheme is successful on the balance of objective measures and projections of economic and social participation and independence, and on participants’ views that they are getting enough money to buy enough goods and services to allow them reasonable access to life opportunities – that is, reasonable and necessary support.
• Contributors think that the cost is and will continue to be affordable, under control, represents value for money and, therefore, remain willing to contribute.

3.50 The NDIS Annual Financial Sustainability Report (AFSR) identifies NDIS cost projections, pressures and reforms affecting projected NDIS costs and refers to measures of participant outcomes but does not include an explicit statement as to whether the NDIS is sustainable. The NDIA’s Annual Report 2023–24 stated: ‘The assumption is made that, if contributors to the NDIS agree to the budget and the forecast, the ‘state of financial sustainability’ has been met for the reporting period.’

3.51 Between February and March 2023, the Board was presented with, and considered, sustainability initiative options for the NDIS. Papers to the Board included information about cost drivers, including an increase in participants (not offset by an increase in exits), pricing impacts and inflation, and detail to support consideration of NDIS sustainability initiatives. Draft initiatives for inclusion in advice to government were also outlined in the papers, reflecting preliminary ideas from the NDIS Review co-chairs, following discussions with the Board Chair, CEO and DSS Secretary earlier in February. The Board’s records do not document the Board’s view or direction on the specifics of initiatives proposed.

3.52 Figure 3.1, below, provided to the Board in February 2023, shows the increasing cost projections over time.

Figure 3.1: NDIA presentation of projected NDIS cost increases — 2018 to 2032

Source: NDIA.

3.53 On 17 February 2023 the CEO emailed an ‘updated pack on draft financial sustainability options’ to the minister, copying in the Board Chair. At an OOS meeting on 6 March 2023, the Board discussed revised NDIS projections and the possible sustainability actions presented, noting implementation timing would impact NDIS projections. The paper included a draft resolution that the Board ‘note that a final set of agreed initiatives will be provided to the Board for approval at a subsequent Board meeting.’

3.54 The CEO Report provided to the next Board’s meeting on 31 March 2023, stated that the NDIA was developing a Scheme Effectiveness and Sustainability Strategy with DSS and the NDIS Review for consideration by the Australian Government. The report provided a summary of the key initiatives proposed, legal risks, implementation costs and stakeholder engagement. Board records do not reflect it having agreed to the proposed initiatives or the extent of its support for them or an alternative direction ahead of advice on draft initiatives being presented to the Australian Government.

3.55 In April 2023 the minister announced that National Cabinet had agreed to an NDIS Financial Sustainability Framework and the minister announced funding for 10 supporting reform initiatives. The framework provides an annual growth target of 8 per cent in the total costs of the NDIS by 1 July 2026, with further moderation of growth as the NDIS matures. As the NDIA advised the Board in April 2023, the initiatives proposed in the Scheme Effectiveness and Sustainability Strategy generally aligned with those presented to the Board in March 2023 and announced by the minister earlier in April 2023.

3.56 In the nine Board meetings between May 2023 and June 2024, the CEO Report to the Board included a progress update on the activities titled ‘Reform for Outcomes’, encompassing the implementation of the budget measures to support improved financial sustainability and participant outcomes.⁶⁰ Reporting included a summary of key activities undertaken against the areas of focus for program work streams in the reporting period. Reporting did not identify clear milestones for delivery or if progress was being achieved as planned. As the CEO report is discussed in camera there is no record of the Board’s discussion of the paper. Board meeting records reflect the Board did not request further detail in the reporting on the program.

3.57 In addition to the information included in the CEO Reports, from May 2023, the Board received reports relating to monitoring financial sustainability against projections at eight meetings, and on activities supporting or relating to reform activities at seven meetings.⁶¹ Minutes reflect the Board having discussed these reports at seven meetings, and requesting a further briefing or action in four meetings. Board papers also included specific updates on the progress of legislative changes⁶² after the Board requested it be a standing agenda item in May 2024. As discussed from paragraph 2.87, the Board’s Sustainability Committee regularly reviewed reports on financial sustainability, including monitoring updates to NDIS projections in light of the annual growth target (see paragraph 3.55).

3.58 The reporting to the Board on various reform actions lacked details on overall progress against milestones or timeframes set by the Board that are necessary to support achievement of the growth target in the NDIS Financial Sustainability Framework. The Board has not sought to define the scope or pace of reporting or data it requires on reform progress to ensure it has oversight of the outcomes of the specific reform initiatives, relying on management-led updates.

3.59 Since September 2024, the quarterly CRO Report presented to the ARC and the Board has included information on progress implementing NDIS reforms in reporting on strategic risk 4 — scheme sustainability. Although as at March 2025, the measures did not yet have a defined target, results were reported as delayed, and not available for December 2024. In December 2024, the NDIA advised the Board it had started work on a ‘Scheme Reform Program’ risk profile.

3.60 The NDIA’s June 2024 projections, in AFSR 2024, released in December 2024, incorporated recognition of reform impact. Figure 3.2 shows the NDIA’s actual participant plan expenses from 2020–21 to 2023–24 and expected expenses for 2024–25 and 2025–26.

Figure 3.2: Actual and projected participant plan expenses, 2020–21 to 2025–26

Source: ANAO, based on NDIA annual reports and AFSR 2024.

3.61 The AFSR includes projections that in 2033–34 expenses will grow to $92.72 billion, lower than the $100.47 billion for 2033–34 projected in the previous AFSR. The AFSR recognises the uncertain impact of current and planned reforms on projections.

3.62 In relation to projected expenses, the Reviewing Actuary reported to the Board Chair in September 2024 that:

Financial sustainability pressures persist in the Scheme. National Cabinet committed to a Financial Sustainability Framework in April 2023. Some may misinterpret the focus as solely on total costs. This is a key element of ensuring the Scheme is sustainable. However, the NDIS Rules require that the FSR also reports on participant outcomes. The sustainability of the Scheme is supported by both the quantity and quality of the Scheme expenditure. I expect the FSR will increase its focus on participant outcomes over time.

Oversight and compliance with PGPA Act requirements

Duty to govern the Commonwealth entity

3.63 The Board has a duty to govern the NDIA under section 15 of the PGPA Act. Table 3.2 shows relevant Board actions taken between July 2021 and December 2024 to govern the NDIA.

Table 3.2: Actions undertaken by the Board since June 2021 to govern the NDIA in accordance with section 15 of the PGPA Act

Note a: Key actuarial reports included the Quarterly Monitoring Paper (formerly titled the Quarterly Actuarial Report) and the NDIS Annual Financial Sustainability Report.

Note b: For the NDIA’s performance measure, ’NDIA spend (Program 1.2) as proportion of NDIS spend’, the targets, of 7 per cent in 2021–22 and 6 per cent in both 2022–23 and 2023–24, were exceeded. The NDIA stated in its 2022 AFSR that ‘operating expenses, as a percentage of Scheme expense, are projected to reduce over time’, although it reported the need for operational funding to be sufficient to enable the NDIA to manage risks associated with an increase in NDIS expenses.

Note c: For the NDIA’s performance measure, ‘NDIS annual spend (Program 1.1) compared to estimates,’ the target of 100 per cent was exceeded each year from 2021–22 to 2023–24.

Source: ANAO analysis of NDIA documentation.

Duty to establish and maintain systems relating to risk and control

3.64 The NDIA’s AAIs identify the elements of the Commonwealth Procurement Rules and the Commonwealth Grant Rules and Guidelines that its staff must comply with.⁶³

3.65 From July 2023 the Board received reporting on the status of strategic risks and critical operational risks through the quarterly CRO Report. The former Risk Committee previously received this report. This reporting set out current and target risk ratings and the applicable risk appetite for each strategic risk from November 2023.⁶⁴

3.66 As discussed in paragraphs 2.95 to 2.110, the former Audit Committee did not receive sufficient risk reporting to fulfil its functions relating to risk oversight and management. The ARC receives relevant reporting and reviews systems of risk oversight and management. The former Audit Committee approved an Internal Audit Plan each year and received reporting on the completed audits (including audits to support the NDIA’s Risk Management Declaration), and NDIA management’s response to audit findings. As discussed in paragraph 2.118, in September 2024, the ARC approved the NDIA’s first three-year rolling Internal Audit Plan.

3.67 In August 2021, the Risk Committee was advised that the NDIA received an ‘embedded’ risk maturity rating from Comcover based on NDIA self-assessment responses to the biennial Comcover Risk Management Benchmarking survey.⁶⁵ The next survey was carried out in November 2023 and the Board was subsequently advised that the NDIA had again received an embedded rating.

Fraud risk

3.68 In addition to its duty under section 15 of the PGPA Act, the Board has specific requirements to manage the risk of fraud, under section 10 of the PGPA Rule.⁶⁶ The Board set a ‘conservative’ risk appetite in relation to strategic risk 6, scheme integrity, which includes fraud. Between July 2021 and June 2024, strategic risk 6 was rated high.⁶⁷ Table 3.3 sets out the Board’s oversight of fraud risk assessment and reporting.

Table 3.3: Board oversight of fraud risk assessment and reporting

Note a: Auditor-General Report No. 33 2023–24, Compliance with Corporate Credit Card Requirements in the National Disability Insurance Agency, ANAO, Canberra, 2024, paragraph 12, available from https://www.anao.gov.au/work/performance-audit/compliance-corporate-credit-card-requirements-the-national-disability-insurance-agency [accessed November 2024].

Source: ANAO analysis of NDIA documentation.

3.69 Board and committee oversight of NDIA reform activity to address fraud risk has included the following.

• In October 2021 the NDIA engaged a contractor to review the NDIA’s fraud intelligence and investigations functions. The report was considered by the Risk Committee in February 2022. The Fraud and Compliance Improvement Program (FCIP) was developed to implement the recommendations.
• Most of the recommendations were included in the Non-Compliant Payments and Fraud Pilot, for which the NDIA received over $25 million⁶⁸ in funding. Work on the pilot started in 2021 with results planned to inform a business case for further funding for the NDIA’s fraud and non-compliance processes, to be finalised in August 2022. Agency-level governance structures were in place for the initiatives.
• The Risk Committee received regular reports on the progress of the work streams within the FCIP between May 2022 and March 2023, including internal costings and risks for the NDIA if it did not receive additional funding to implement some initiatives.
• In November 2022, the Fraud Fusion Taskforce (FFT) was created as a joint initiative between the NDIA and Services Australia and 17 other Australian Government entities to target fraud and serious non-compliance. The FFT replaced the NDIS Fraud Taskforce⁶⁹ and received funding of $126 million over four years in the 2022–23 Budget. The Risk Committee was first briefed in August 2022 on the NDIA’s consultations with various Australian Government agencies on the development of such a taskforce. Reporting on the activities of the FFT is included within the Risk Committee’s fraud related papers.
• The NDIA reported to the Board that while it had prepared a business case for the prior Non-Compliant Payments and Fraud Pilot, due to a change in government, a ‘come-back’ was no longer available and that it was working with the FFT to develop further options to achieve improved controls for payment compliance.
• In the 2023–24 Budget, $48.3 million over two years was allocated for NDIA to ‘Crack Down on Fraud’ (CDoF) — to detect, respond to, and reduce fraud and non-compliant payments, and to develop a business case for new IT systems to detect and prevent fraud and non-compliant payments.’ The Board and its Risk Committee received updates on progress in the CDoF business case development. The Board did not receive a copy of the draft Combined Pass Business Case⁷⁰ ahead of it being provided to the Digital Transformation Authority in September 2023 for approval.
• In February 2024, $83.9 million in funding was announced over two years from 2023–24 to ‘boost fraud detecting information technology systems’ at the NDIA. In November 2024, the minster announced a further $110 million for the CDoF program.

3.70 In September 2024 the risk rating for strategic risk 6 was increased to ‘critical’ due to ‘new qualitative and quantitative fraud data provided by Integrity Transformation and Fraud Fusion Taskforce Group’. The ARC Chair requested that the minister be informed of the increased risk rating. The Board subsequently discussed the increased risk rating, including the impact of the CDoF initiative. The NDIA reported the increased fraud risk rating to the minister in October 2024, advising that the primary treatment strategies were linked to the CDoF program. The NDIA reported to the December 2024 Board meeting that it ‘has introduced several controls, and is in the process of implementing further treatments, to manage fraud risk exposure’ and planned further reporting from quarter two of 2024–25.

Procurement and probity

3.71 In December 2022, the minister announced the Independent Review of Services Australia and NDIA Procurement and Contracting (the Watt review). The final report of the Watt Review was issued in March 2023⁷¹ and included 13 recommendations — 12 with actions for the NDIA to improve its future procurement activity. In May 2023, the Joint Committee of Public Audit and Accounts (JCPAA) commenced an inquiry into issues arising from the Watt review. The JCPAA’s final report was tabled in June 2024.⁷² The JCPAA identified that between March 2019 and December 2023, 26 NDIA officials involved in a major ICT procurement project had received hospitality and gifts from Salesforce (the successful tenderer) and failed to declare these in accordance with the NDIA’s gifts and benefits policy.

3.72 In March 2024, the Board was advised that internal investigations were underway relating to prior procurements with Salesforce. The Board created an action item for the ARC to be advised once the investigation report was finalised. In May 2024 the Board held a ‘closed discussion’ on the investigation and was advised that ‘almost all actions in the Independent Review of Services Australia and NDIA Procurement and Contracting Report that are within the Agency’s control have been taken.’

3.73 In May 2024, the Board was also advised:

• of the proportion and value of the NDIA’s procurement in 2023 through open and limited tender, and the value of grants; and
• of actions the NDIA had taken to address identified issues. Actions included: a probity protocol and associated training and materials; changes to the NDIA’s published contract list⁷³ to include procurement and contract management details⁷⁴; increased controls through external reporting and internal audit on the use of limited tender; and changed quality assurance processes relating to procurement non-compliance reporting to the Risk Committee.

3.74 At its July 2024 meeting the CEO advised the Board that internal investigations into the matters were due to be completed by October 2024. The NDIA advised the Board in September 2024 that it had actioned all recommendations from the Watt review. In the NDIA’s 24 December 2024 Executive Minute, part of the Australian Government response to the JCPAA review, the NDIA agreed to the three relevant recommendations. The NDIA reported that it had commissioned an investigation to further consider the matters raised by Dr Watt and had referred certain matters from the investigation to relevant independent law enforcement bodies and regulators. The NDIA also reported:

Following the Watt review, the Agency has increased transparency of its procurement activities with the ongoing publication of additional data (procurement methodology, the number of suppliers approached, the number of variations and original contract value) alongside our Senate Order 13 contract listing.

The 13 recommendations from the Watt review have been acquitted, with only one action remaining outstanding. The sole outstanding action relates to the implementation of a new records management solution, which is currently being rolled out across the Agency.

Duty to encourage cooperation with others and duty in relation to requirements imposed on others

3.75 The NDIA’s corporate plans reflected the Board’s expectation for NDIA officials to work with others to support delivery of NDIS and key NDIA activities, including:

• disability ministers and state and territory governments — to administer the funding and governance arrangements for the NDIS, in relation to Australia’s Disability Strategy 2021–2031, and other policies;
• the other 18 entity members of the Fraud Fusion Taskforce — to identify and stop fraud in the NDIS and government programs⁷⁵; and
• the NDIS Quality and Safeguards Commission (the Commission) — to assess providers to support the safety of participants and people with disability.

Duty to keep responsible minister and Finance Minister informed

3.76 Between July 2021 and March 2024, the NDIA prepared 366 submissions for the minister. Across the submissions, 17 related to fraud matters and five to provision of the AFSR.⁷⁶ A further eight related to advice to the minister on managing sustainability.

3.77 The NDIA’s 2021–22, 2022–23 and 2023–24 annual reports state that, ‘no instances of significant noncompliance with finance law were reported to the responsible minister under paragraph 19(1)(e) of the PGPA Act in 2021–22.’ In May 2024, the NDIA made an initial notification to the Finance Secretary, pending finalisation of its own investigation into the Salesforce matter and in July 2024, briefed the minister on the matter.⁷⁷

3.78 Throughout the audit period, the Board provided the minister, as chair of the DRMC, quarterly reports on the NDIA’s operations and other specified data relating to participants, in compliance with section 174 of the NDIS Act. The reports included updates on NDIA activities to address fraud and fraud investigations outcomes. The Board also provided the minister, as Chair of the DRMC, copies of advice it received from the IAC and a statement of the NDIA’s response (see paragraph 3.8).

3.79 In addition to the Board’s written communications with the minister, the minister attended the Board’s November 2022 meeting and was invited to its May 2024 meeting.

3.80 In 2023–24, in its audit of the NDIA’s financial statements, the ANAO recommended the NDIA consider reporting incorrect payments to Board members (see paragraph 2.10) as instances of significant non-compliance with finance law to the minister and the Minister for Finance.

General duties of officials

3.81 In addition to the general duties of an accountable authority, the PGPA Act specifies the following duties applicable to all officials (which include the accountable authority) — a duty⁷⁸:

• of care and diligence (section 25);
• to act honestly, in good faith and for a proper purpose (section 26);
• not to misuse position (section 27);
• not to misuse information (section 28); and
• to disclose material personal interests (section 29).

3.82 Officials who breach their duties or responsibilities under the PGPA Act can be subject to employment sanctions (including termination of appointment for Board members) or criminal sanctions for intentional or serious misuse of public resources.

3.83 The NDIA has policies and procedures that describe and reinforce the general duties of officials. The NDIA’s key guidance includes: AAIs and Financial Authorisations with a supplementary ‘AAI Quick Guide’; NDIA Probity Protocol; and the Fraud and Corruption Control Plan.

Has the Board established fit-for-purpose monitoring and reporting arrangements?

3.84 Performance measurement involves collecting, analysing and reporting information about the performance of an entity against its purposes. Having effective performance reporting and monitoring arrangements is an integral feature of good corporate governance.

3.85 As a corporate Commonwealth entity, the NDIA must comply with the Commonwealth Performance Framework, established by the PGPA Act and PGPA Rule. This framework requires accountable authorities to:

• report in their corporate plans and portfolio budget statements (PBS) how the entity’s performance, in achieving its purposes, will be measured and assessed; and
• report in their annual performance statements on actual results achieved against the performance measures published in their corporate plans and PBS.

NDIA corporate plans and performance measures

3.86 Under the PGPA Rule the NDIA’s corporate plan must be published by 31 August each year, and the performance measures must meet specific requirements in section 16EA.⁷⁹ Section 177 of the NDIS Act also requires the Board, in preparing the corporate plan, to:

• have regard to a statement of strategic guidance given by the minister under section 125 of the NDIS Act;
• include details of the NDIS’ financial sustainability; risks and issues relevant to financial sustainability and management of these; and
• give a copy of the plan to the DRMC before the start of the period covered by the plan (and notify the DRMC of any variations made to the plan).

3.87 Between July 2021 and June 2024, the Board published four corporate plans for the NDIA within required timeframes.⁸⁰ A copy was provided to the minister and the DRMC before 1 July each year.

3.88 Between July 2021 and June 2024, the Board approved NDIA performance measures and targets in each year’s corporate plan prior to publication. The rationale for the measures was included in corporate plans alongside measure descriptions for 2023–24 and 2024–25.

3.89 Table 3.4 sets out the ANAO’s assessment of compliance of the NDIA’s Corporate Plan 2023–24 with the corporate planning requirements in subsection 16E(2) of the PGPA Rule.

Table 3.4: NDIA Corporate Plan 2023–24 compliance with PGPA Rule 16E(2)

Key: ◆ Met ▲ Partly met ■ Not met.

Note a: The statement did not identify 2023–24 as the reporting period.

Note b: Performance measures specified did not fully comply with section 16EA. The ANAO’s assessment is discussed at paragraphs 3.95 to 3.97.

Source: ANAO analysis of the NDIA’s 2023–24 corporate plan.

Advice to the Board on NDIA’s corporate plans

3.90 Between July 2022 and June 2024, the Board received advice on proposed changes to the NDIA’s performance measures for its corporate plans ahead of its June deadline for approving and sending plans to the DRMC. Advice on proposed changes to measures included rationale for the change. There was no rationale provided for the proposed changes to targets.

3.91 In February 2023, the Board identified priority areas of focus for the NDIA including co-design, sustainability, workforce, participant funds (including fraud), advocacy, employment and accessibility and showcasing best practice. In April 2023, the Board endorsed a proposal for a new NDIA strategy to be developed by November 2023 to replace the NDIA’s strategic statement from 2013 which was still in effect. The NDIA consulted over the draft strategy with staff, participants, employee networks and the IAC. The draft strategy was also reviewed by the SDPO Committee. In March 2024, the Board endorsed the new strategy, which encompassed changes to the NDIA’s outcome statement and the descriptions of its two programs.⁸¹

3.92 In May 2024, the Board agreed to make the following changes to the performance measures from the 2023–24 corporate plan to:

• improve consistency with the new outcome statement agreed to in March 2024;
• address interim feedback from the ANAO audit of the NDIA’s 2023–24 Performance Statements;
• better align with NDIA functions set out in the NDIS Act; and
• reduce the number of performance measures, to align with other agencies.

Reporting on performance

3.93 Across its performance measures, from 2021–22 to 2023–24, the NDIA reported in its annual performance statements (APS), published within its annual reports⁸², that:

• in 2021–22, it achieved its targets for 12 of the 23 measures (52 per cent) and did not achieve targets for 11 measures (48 per cent);
• in 2022–23, it achieved its targets for 14 of the 27 measures (52 per cent), partially achieved seven measures (26 per cent), did not achieve five measures (19 per cent) — the NDIA did not report one result (four per cent)⁸³; and
• in 2023–24, it achieved nine of its 19 measures (47 per cent)⁸⁴, partially achieved four measures (21 per cent), did not achieve five measures (26 per cent), and did not report one result (five per cent).

3.94 Across 2021–22, 2022–23 and 2023–24, the NDIA reported consistently positive results against targets for its performance measures of staff wellbeing, the proportion of staff with a disability and NDIA expenditure as a proportion of NDIS expenditure. During the same period, the NDIA’s reported results were consistently below targets for measures relating to participant outcomes, meeting service delivery timeframes and NDIS expenditure compared to the Portfolio Budget Statements. The NDIA did not have a measure for financial sustainability over time⁸⁵ during the period of audit review, although managing, advising and reporting on the financial sustainability of the NDIS is an NDIA function under section 118 of the NDIS Act. The NDIA has since introduced in its 2024–25 corporate plan two new measures relevant to financial sustainability: average payments per participant and the annualised scheme growth rate.

3.95 In October 2024, the ANAO completed its first audit of an APS by the NDIA, an audit of its 2023–24 APS. The ANAO found that 11 of the NDIA’s 19 measures (58 per cent) satisfied the requirements of section 16EA of the PGPA Rule. The audit conclusion was qualified as there were two material omissions of performance information and a material limitation of scope. The material omissions related to:

• the lack of reporting of performance information on payment compliance and fraud activities, given these activities are a key component of financial sustainability; and
• the lack of a result for the measure ‘Children who have benefitted from the scheme and no longer need supports’.

3.96 The material limitation of scope related to the measure ‘Participant perception of choice and control over their life (independence)’, as there was insufficient evidence to conclude if this measure was materially misstated.

3.97 The ANAO issued five findings in relation to the performance statements, including two high risk findings: one relating to completeness and clear read of performance information; and the other relating to the appropriateness of performance measures. The ANAO also recommended that the NDIA improve its performance reporting framework and documentation of performance measure methodologies, and strengthen its preparation plan for performance reporting processes.

3.98 The Board approved the NDIA’s APS each year prior to tabling the annual report in Parliament and publication on the NDIS website. The NDIA provided a copy of its annual report, including the APS, to the minister before the 15 October due date in 2021, 2022, 2023 and 2024.

3.99 The former Audit Committee was responsible for supporting the Board with oversight of preparation of the APS. Each year the Audit Committee, now the ARC, reviewed the draft statement and endorsed it to the Board for approval.

3.100 For the 2020–21 and 2021–22 APS, the former Audit Committee was advised that a supporting performance metric validation exercise was completed by the NDIA’s internal audit function. Written details of how the exercise was undertaken were not provided. Meeting minutes reflect the Chief Internal Auditor gave a verbal explanation of the 2021–22 validation work carried out following an Audit Committee discussion of presented results.

3.101 For the 2022–23 APS, two internal audits were conducted.

• The ‘phase 1’ audit was reported to the former Audit Committee in September 2023 and concluded that:

Overall, the Agency’s Performance Measurement approach has adequate systems and procedures around management self-assessment for establishing, measuring and reporting on the achievement of the Agency’s performance in compliance with the relevant RMGs.

• The ‘phase 2’ audit, to validate the accuracy and consistency in the approach for preparing the APS, was reported to the former Audit Committee in November 2023, after the 2022–23 APS had been approved and tabled in parliament. The audit concluded, ’With exception of [the ‘provider sentiment and confidence’ measure that was not reported], Internal Audit is satisfied with the evidence provided by the management for the Annual Performance Statements 2022/23.’

Both reports identified aspects of insufficient ongoing monitoring of performance measures during the year.

3.102 For the APS 2023–24, the Acting Branch Manager, Audit, provided the ARC a written ‘limited assurance’ opinion on the annual performance statements in September 2024. The opinion advised that the Audit Branch had reviewed the calculation of a sample of four performance measures and made no findings in relation to the documentation, implementation of the calculation methodology or the accuracy of the results. The ARC did not provide advice to the Board in relation to any data quality issues that impacted the reported results for the Participant Service Guarantee (PSG) measures.

3.103 The former Audit Committee questioned or sought correction to measures or results in the draft APS on four occasions between July 2021 and June 2024, including in relation to:

• the aggregated nature of one metric and the need for more detailed commentary on what it reflected;
• currency and accuracy of data presented and relevance of prior year data for comparative purposes;
• decline in results and the need for additional explanation within the statements; and
• definitions used and the need for additional explanation to accompany the results.

3.104 The former Audit Committee and Board did not seek further information from management in relation to:

• how the internal audit performance metric validation exercise was undertaken for 2020–21 APS reporting; and
• observations reported in the phase 1 and 2 internal audits for the 2022–23 APS (for example, requests for detail of the identified gaps in the NDIA’s performance measurement systems and procedures, or requests for alternative assurance on the APS 2022–23 validation given the delay in the phase 2 audit reporting).

Regular performance reporting

3.105 The Board received Pulse reports, the NDIA’s key management report with performance data for the prior month. Pulse reports contained reporting on NDIA operations including results against corporate plan performance targets⁸⁶, results against supplementary measures and individual Participant Service Guarantee (PSG)⁸⁷ timeframe measures that support the aggregated corporate plan PSG performance measure. These reports also included brief analytical commentary on selected measures. Pulse reports did not consistently provide insights into causes or planned remedial actions for PSG results that were below performance targets.

3.106 The Pulse report was included in the Board’s meeting papers for 23 of the 25 meetings between July 2021 and November 2023. From December 2023 to June 2024, Pulse reports were not included in Board meeting papers. While the reports were separately provided to Board members through its Diligent distribution platform, during this period they were delayed⁸⁸, not provided regularly, and not noted or referenced in relevant Board minutes.

3.107 In February 2024 the Board was advised of delays in processing tasks (such as responding to participant enquiries or requests for plan reassessments) caused by the progression of the PACE national rollout.⁸⁹ In February and March 2024 the Board was advised of remedial action underway and in May 2024 that these delays would significantly impact performance targets.

3.108 The Board listed PACE as a standing agenda item at its subsequent meetings and received further reports on remedial action at its June, July and September 2024 meetings. Additional reporting on PSG measures is in the NDIS quarterly reports to disability ministers, which include trend comparisons over prior quarters.

3.109 In the quarter four 2023–24 report for disability ministers, provided to the Board in August 2024, the NDIA stated that, since late 2023, it received almost double the volume of requests from participants asking for a change to their NDIS plan, took longer to make access and plan decisions, and was not meeting PSG timeframes. This report also noted the NDIA’s inability to report against all PSG timeframes since the rollout of PACE started nationally in October 2023. The report included details of the NDIA’s approach to clearing the NDIS plan backlog as well as scheduled system enhancements and that the NDIA expected to have ‘remediated’ backlogs by 30 September 2024 and to report improved PSG results by 31 December 2024.

Board behaviours

3.110 The ANAO audit team observed two Board meetings in May and June 2024, and one ARC meeting in June 2024. The audit team also met with the Chair and six members of the Board. The ANAO also attends NDIA ARC meetings (and meetings of the NDIA’s former Audit Committee). In those meetings, and through a review of Board and committee papers and minutes, the ANAO observed that members collectively displayed a range of behaviours supportive of a positive governance culture at the board level, including:

• sufficient preparation to enable meetings to be conducted in a productive manner;
• engagement with management on key areas requiring further discussion;
• a desire to act in the interest of participant outcomes;
• advocacy for accessibility to support participation by all Board members; and
• conducting meetings in a professional, collegiate and respectful manner.

3.111 The ANAO observed a consensus-based approach to decision-making within the Board’s meetings and was advised that members regularly communicate between meetings to discuss items of concern and to support their meeting preparation.

3.112 Effective board governance includes balancing collegiate operations with constructive challenge, where appropriate. The ANAO observed occurrences of Board members constructively challenging management in relation to reporting on entity performance results that did not meet targets, issues and risks. These occurrences were inconsistent and did not reflect an established practice.

Appendix 1 Entity responses

National Disability Insurance Agency

Department of Social Services

Appendix 2 Improvements observed by the ANAO

1. The existence of independent external audit, and the accompanying potential for scrutiny improves performance. Improvements in administrative and management practices usually occur: in anticipation of ANAO audit activity; during an audit engagement; as interim findings are made; and/or after the audit has been completed and formal findings are communicated.

2. The Joint Committee of Public Accounts and Audit (JCPAA) has encouraged the ANAO to consider ways in which the ANAO could capture and describe some of these impacts. The ANAO’s corporate plan states that the ANAO’s annual performance statements will provide a narrative that will consider, amongst other matters, analysis of key improvements made by entities during a performance audit process based on information included in tabled performance audit reports.

3. Performance audits involve close engagement between the ANAO and the audited entity as well as other stakeholders involved in the program or activity being audited. Throughout the audit engagement, the ANAO outlines to the entity the preliminary audit findings, conclusions and potential audit recommendations. This ensures that final recommendations are appropriately targeted and encourages entities to take early remedial action on any identified matters during the course of an audit. Remedial actions entities may take during the audit include:

• strengthening governance arrangements;
• introducing or revising policies, strategies, guidelines or administrative processes; and
• initiating reviews or investigations.

4. In this context, the below actions were observed by the ANAO during the course of the audit. It is not clear whether these actions and/or the timing of these actions were planned in response to proposed or actual audit activity. The ANAO has not sought to obtain assurance over the source of these actions or whether they have been appropriately implemented.

• In March 2024, the Board of the National Disability Insurance Agency (the Board) instructed draft committee minutes to be included in Board papers.
• In May 2024, the Board directed that the Board paper template include a section to advise if a paper has been to a Board committee.
• In June 2024, the Board endorsed an interim Board Charter that addressed section 132 of the National Disability Insurance Scheme Act 2013 (relating to outside employment), established a mechanism for managing member disagreement on conflict of interest matters, and gave direction on managing conflicts in meetings (see paragraph 2.44).
• In July 2024, the secretariat finalised an internal procedure for supporting Board members to identify, record, manage and mitigate any real or perceived conflicts of interest in relation to their official duties and National Disability Insurance Agency (NDIA) affairs (see paragraph 2.44).
• In September 2024, the Board agreed to a forward workplan for 2025 (see paragraph 2.64).
• Since the Audit and Risk Committee (ARC) formed in March 2024, it has received reporting against all its functions to enable it to support the Board (see paragraph 2.107).
• In November 2024, the NDIA introduced a new ‘Finance Incident Summary’ section into its quarterly Chief Risk Officer Report.
• In December 2024, the NDIA appointed a new Branch Manager, Audit, as an ARC meeting invitee. They were also invited to separately meet directly with the ARC Chair (paragraph 2.110).

Appendix 3 Appointments to the Board of the National Disability Insurance Agency as at 1 January 2025

Note a: Dr Galbally was previously a member of the Board from July 2013 to April 2019.

Source: ANAO analysis of NDIA documentation.