Summary Report - Queensland Audit Office (Qao) Interim Audit Report

Frank Wilkie38:31

We're back everybody. The meeting's been reopened. It brings us to item 9. There are no Mayoral minutes. We have no notified motions. It brings us to consideration of committee reports. 11.1 Audit and Risk Committee recommendations. 11.1.1 governance and policy update, 11.1.2 risk management and BCP update, 11.1.3 ICT Cyber Risk Report, 11.1.4 internal audit update, 11.1.5, 24, 25. Draft financial statements, NANDA financial year update, 11.1.6 is the Queensland Audit Office KPMG combined interim report, and there's a summary report of this one directed to Council on the subject later in the agenda at item 12.3. And the 11.1.7 is the Audit and Risk Committee recommendations en bloc. I have a move and a seconder for the Audit and Risk Committee recommendations, Councillor Wilson. I have a seconder, Councillor Wegener. All in favour? It's carried unanimously. 11.2 Planning & Environment Committee recommendations. 11.2.1 planning applications decided by delegated authority for August. 11.2.2 it's an MCU development application for other change to develop an approval for Commercial Business Type 1 office, Commercial Business Type 2, medical to healthcare centres, hospital and infusion centre, and RAL19000407 reconfiguration lot at 36.40 Huffington Noosaville, 11.2.3. As it's an MCU development application for Material Change of Use for short-term accommodation, backpackers accommodation at 17 Russell Street, Noosaville. 11.2.4, Planning & Environment Committee recommendations en bloc. Now we have a mover and seconder for planning the and environment committee recommendations to be adopted. Councillor Lorentson, seconded by Councillor Phillips. All in favour? That's unanimous, 11.3, Services & Organisation Committee Recommendations. 11.3.1.1 is Minor Amendments to Fees and Charges Register for Commercial Fees. 11.3.2, Noosa Shire Council's solar specialised supplier lists. Councillor Phillips. Thank you.

Frank Wilkie69:02

Someone can move the recommendation noting the report? So moved. Thank you Councillor Stockwell. We have a seconder for that. Councillor Wegener. Councillor Stockwell wish to speak to it? No. Any Councillors wish to speak to the report for noting? All in favour? That's carried. I come to item 12.3 summary report of the Queensland Audit Office interim audit report and the Director of the corpus services, Margaret Gatt, at the table for this report.

Good morning, Councillors. This report that is before you is a summary of the Queensland Audit Office interim audit report. In December 2024, Council was the victim of a major fraud incident perpetrated by an international crime organisation currently under investigation by the Australian Federal Police and INTERPOL. Due to the sophistication of the tactics employed and despite Council having internal controls and processes in place to mitigate. Such events, they were not effective in this instance. A crisis incident response team was immediately established once Council was alerted to the fraud and engaged an external independent ICT expert company to conduct a forensic investigation. This confirmed there was no breach of Council systems, no personal data was stolen, nor any ratepayer personal information was accessed, and there was no impact on Council services. All relevant processes and operating procedures were with additional internal controls implemented immediately to mitigate and/or minimise the risk of any subsequent fraudulent event. The QAO also recommended further internal controls to mitigate the risk of this type of incident occurring again. Council has substantially. Implemented these recommendations and, in addition, is also in the process of installing a third-party software system to provide an extra layer of security in fraud prevention. Council reported this incident to all relevant authorities, including the Queensland Audit Office, relevant ministers and the department. Of local government, water and volunteers, within the statutory reporting timeframes. Pursuant to underlying regulatory requirements regarding reporting. Council was directed at the time of the incident to publicly disclose this information related to the incident as to not compromise. The ongoing investigation. As a result, Council has been unable to. Disclose this to the community until now. The perpetrators used social. Engineering techniques that were. Sophisticated, strategic and targeted. To avoid revealing the. Tactics of the perpetrators and to ensure we meet our. Legal obligations related to the protection of. Council staff, we're unable to provide any further. Details at this stage. The original amount defrauded from the incident was 2.3 million dollars. Some monies have been recovered. From our bank and our current net financial loss is. Approximately 1.9. That is subject to some additional. Changes whilst we continue to engage with our relevant insurers.

Frank Wilkie87:38

Like to move an amendment following on from comments and discussion around internal controls so part B be added to the request of the CEO to provide regular updates to Councillors on the implementation Queensland Audit Office recommendations including the progress and efficacy of the additional internal controls and third party software system we all take thank you Councillor Stockwell we all take our financial and governance responsibilities very seriously and these vulnerabilities that were identified have been strengthened by measures recommended by the Queensland office additional internal controls and new third party software this just ensures that we're in the loop that we're getting received regular reporting on how these things are being implemented and whether they actually serve the purpose for which they are intended so by efficacy I mean the ability to produce the desired or intended new result software of the new of the new software of the new so controls. Result controllers I think it's very important Councillors receive regular updates on this whether it be monthly or even more frequently so important Councillors receive regular updates on this whether that's to be discussed but this with the CEO this was always intended think it makes it clear that this is what will happen so we can all remain abreast of these important financial and governance changes. Thank you.

Frank Wilkie98:52

I think that's done. Cassie was-- Councillors, those who think this is hoping to gain comfort this have missed the point entirely. This, it's one thing to say oh you will be following up but to support something that's in black and white in front of you shows your commitment to definitely following up, to making sure you keep your finger on the pulse on the progress of the audit and risk, the Queensland Audit Office recommendations. Are they being implemented? Supporting this amendment, you're committing to make sure that happens and to give yourself, avail yourself to every opportunity to attend these sessions and ask the questions that you need to ask on behalf of the community to make sure that these controls are being implemented. It's not a comfort session. If you think you're going to attend these and gain comfort, you've got it in entirely the wrong frame. No one's comfortable about what happened. No amount of comfort can be given about what's happened. But we can commit here and now to say that we will require the CEO to provide these regular updates and we will attend and follow up on understanding, satisfying ourselves whether these Queensland Audit Office recommendations are being implemented. Are these additional controls implemented? Stage of implementation are they up to? What does it involve? And the third party software system, where are we at with that? Has it been installed? Is it working? What is it detecting or not? And what else do we need to do to understand what happened and how we can make sure it never happened again? This is a commitment. This is a demonstration of your commitment here and now to attend regular updates to make sure they happen and to attend, be fully present and ask uncomfortable questions and satisfy yourself on behalf of the community that everything's been done and we can do to minimise the likelihood of this ever happening again. That's why this is here Councillor, not to give you any comfort. This I'll put the amendment. Those in favour of the amendment, Councillor Wegener, Councillor Stockwell, Councillor Wilkie. Those against the amendment, Councillor Phillips, Councillor Finzel, Councillor Lorentson and Councillor Wilson against their amendments lost. We go back to the original motion. Councillor Councillor Finzel, you have a question.

Amelia Lorentson101:42

That Council commits to releasing a publicly accessible follow-up report by the December round of meetings. Subject to legal the and privacy obligations, report will address key questions raised by the community and outline findings from the December 2024 fraud incidents, actions taken, including regular updates on the implementation of the Queensland Audit Office recommendations and lessons learned. I'm happy to email that to you to make it easier. You have questions, taken, lessons learnt, after lessons learnt, or I'll just email it to you. Vicky might be quicker and easier. So including a commitment to providing regular updates. We can just add the words including. A commitment to providing. That's provide regular updates on the implementation of the Queensland Audit Office recommendations and lessons learned. A commitment to provide. Regular updates. To providing regular, providing. Thank you.

Frank Wilkie118:11

Take it back that we're against supporting this amendment as it's worded because it commits you to doing something it over promises and will ultimately under deliver and disappoint you know that you will not be able to reveal certain aspects of this investigation because it will create copycat there's the potential for copycat crimes not in this organisation but other organisations that's the intent of that we know we cannot reveal details this report will not be able to reveal details that will identify the staff who were targeted are deeply and personally impacted by this and we have a legal and moral obligation to their well-being this gives a false impression that it will be full disclosure when you know it will not be by it says December out of meetings addressing key questions raised by the community you know that the answers to those key questions will always be tempered by legal and privacy obligations which is the get out clause at the end of this amendment. This commits us to do this is the easy way out as far as I'm concerned of committing just to a publicly released report that won't be up we've got a publicly released report that won't be up we've will have a deep dive that's been done Councillor um WILSON Councillor Wilson is your representative community's representative on the auditing risk committee which is going to be asking for a deep dive there. Councillors have an open invitation to attend as observers to every auditing risk committee Councillor Phillips referred to an independent process such as a coronial inquiry for the Queensland Council has had the Queensland Audit Office to conduct independent inquiries and that's their recommendation what are in the process of being implemented. Councillors, be very careful about putting out something that gives the impression that it will be full disclosure. Gives the impression, that it will be a transparent report when you know that the same legal obligations to not reveal, legal and moral obligations not to reveal details, specific details of how this crime occurred will be applied when this report comes out. I think that's me. Thank you, time's up.

Frank Wilkie170:44

There's no doubt a significant fraud was committed on Noosa Council by international criminal gangs, an external forensic IT expert has confirmed there's no breach of Council's cyber security, resident detail have not been taken or affected. There's been no impact on the delivery of any of Council's projects or services or in order to impact the rates that were levied. We know the criminals use sophisticated AI, social engineering techniques that were strategic and targeted operational vulnerabilities. The fact that the Australian Federal Police, Queensland police and INTERPOL were involved is an indicator of the seriousness and magnitude of this crime. Please advise not to reveal specific details of the task. Of the tactics used by the criminals to avoid copycat crimes that may occur elsewhere. The Council takes its financial and government responsibilities very seriously. Every Councillor the table does, as do the staff. These vulnerabilities are being strengthened through measures recommended by the Queensland Audit Office. There is additional internal controls and staff. Plus new third-party software. The other thing we're trying to balance alongside of our wish to be fully transparent and disclose as much as we can. Much as we know about this insolent community is tempered with our legal and moral obligations to not reveal details that would identify the staff who have been deeply and personally impacted by this targeted and a strategic crime. The Councillors around this table feel uncomfortable. Or upset by this. Can you imagine how the staff that were targeted feel? And we have obligations to them, psychosocial obligations. Legal obligations. This remains an ongoing investigation by the Queensland police with assistance from the joint policing cybercrime unit. The focus has been and must remain on addressing these operational vulnerabilities with measures to minimise the chances of this ever happening again. And I will say to the community while we're supporting this motion. But please, do not. I hope we have not given the impression by saying we'll do a publicly accessible follow-up report that addresses key questions raised by the community that we'll be able to answer all your questions in that. Because of the get-out clause at the end of that statement which is subject to legal and privacy obligations. It's an unprecedented thing that's happened to Noosa Council. We all feel it deeply. No more than the staff have been impacted. I personally would like to apologise to you. The case but I'm like everyone else around this table and staff, to ensure that all measures are taken to minimise the likelihood of this ever happening again. I'll be supporting the motion. Councillor Finzel, do you wish to close? Um, thank you for the invitation. I'm not going further to contribute. I think that's all I'm going to say. Thank you. I'll put the motioners to favour. That's unanimous. There is no confidential session. The next Ordinary Meeting will be a late catharsis at 24 Boreen Parade, Boreen Point, 5pm on the 20th of November 2025. And I declare the meeting closed at 12:56. Thank you everybody for your patience and attendance.