2024 Fraud Event Corrective Actions And Status Update

Frank Wilkie273:51

Councillors, it's easy enough to say you support Tourism Noosa, you support Noosa having a future, and then the real test is whether you vote for the plan that addresses those things. Words are nothing unless they're backed up with action when faced with an uncertain future we are going to one into uncharted territory that's why we have a Roadmap to help get us there are uncertainties things are unclear there are is extensive research and benchmarking that may not necessarily support your view but it is sound benchmark it is an excellent standard of work it's easy enough to pick holes if you don't want to support something. Don't support it. But to make out that this piece of work and the direction this Council is going in is somehow in breach of the local government acts, requirements for transparency. And governance is. Absurd. Courage is needed to make decisions when there is uncertainty. We have excellent pieces of work through the DMP, which is reflected, the values of which are reflected in the Tourism Noosa Roadmap, and we have expectation from people in this community, mainly in the tourism industry, who are community members, who have families at schools and sporting clubs, but who rely on a sustainable, long-term, regenerative tourism industry for us. They're putting their trust in us to make the right decision today, and that is that funding for a responsible and effective tourism marketing body. Continue. We've got a Roadmap of how that can take place. For us to say that we support Tourism Noosa, we support giving Noosa a future, if you really mean it, you'll be voting for this motion before us. Otherwise, you'll be looked at as if your words are not worth the breath that they require to push out of your body. I'm supporting this. All in favour? Councillor Wegener, Stockwell, Wilkie. Those against? That's Lawrence and Wilson and Finzel. I use my casting vote. The Tourism Noosa road map is being endorsed. We now move on to the next item on the agenda which is 2024 2020 item 12.3 forward event corrective action and status update. We have Acting Director Corporate Services Marg Gatt here for this report. Please give us a summary of the report.

Thank you through the Chair. Good afternoon Councillors and our community members online. This report provides an update to the 16th of November Ordinary Meeting on the significant forward event of December 2024 by way of high-level analysis, lessons learned and corrective actions implemented and being implemented. All relevant processes and operating procedures were immediately reviewed with additional internal controls implemented post event to mitigate or minimise risk of any subsequent fraudulent events. The perpetrators, as mentioned in the previous report, used social engineering techniques that were sophisticated, strategic and targeted. While Council systems and services were not affected by this fraud, the incident did highlight non-compliance with some of our standard processes. Through our subsequent investigations, we have identified that there were elements of human error that contributed to some failures in our internal controls. I'll just provide a high-level overview of some of the analysis around our control environment. So we do have standard operating procedures designed to prevent fraudulent activity. And these procedures incorporate key internal controls intended to safeguard financial processes and ensure compliance. Some of these include independent verification of supplier such detail changes. Any changes to supplier details such as bank account or contact information must be independently verified against the original request. This step ensures that updates are legitimate and authorised before being processed. Oversight. Changes to bank account details require formal oversight and approval from a designated approver. This provides segregation of duties and an additional layer of scrutiny to mitigate the risk of unauthorised or fraudulent alterations. A review, an audit log is also generated for every payment run and provided to the approver for review. This log serves as a critical control mechanism enabling the approver to confirm the accuracy and integrity of the transactions prior to finalisation. Councillors, you for your question. Our staff have taken very seriously this incident. It weighs heavily on not just individual staff members but the entire finance team and we've had many conversations around the lessons learned from this very serious incident. So any of the following actions may have reduced the risk or prevented the fraud from occurring. Adherence to Council practice whereby requests for changes to supplier contact details are verified with the supplier using the original contact details on file or through search for contact details often referred to as the vendor master file. Verification of the sender's email to the supplier's email address from an independent source such as the supplier's website may have indicated the different syntax used in the email address though this in itself may not have alerted Council to any anomalies with that direct contact with the supplier. Also, requirement for inquiries from our bank regarding payments or questioning of it escalated to a senior officer for action. In summary these lessons highlight the importance of us consistently applying existing controls, enhancing verification processes and fostering a culture of vigilance to protect Council from similar incidents in the future. Following the fraud event, controls and procedures were reviewed and improved. In conjunction with the Queensland Audit Office recommendations, the following additional controls have been implemented or are in the process of being implemented. Implementation of a third party software protection that validates banking details. Regular mandatory cyber security training for all staff. That cyber security, just to clarify, also includes social engineering and other identifying fraudsters. Development of an organisational policy and procedure which articulates Council's commitment to ensuring accuracy, integrity and security of master file data and outlines Council processes in regard to the indoor master file maintenance. Includes this a commitment from staff to compliance with that policy and procedure through the understanding of the impacts of non-compliance both financial and reputational. Of the impacts A Council system control where changes to supplier contact details approval. The requirement for all changes to supplier accounts to be recorded in a register of creditor changes which is reviewed by a senior officer monthly to identify any patterns or anomalies that may indicate fraudulent activity. And Council lastly will establish an independent financial management assurance program as we refer to as an FMAP. This program will provide a system of internal controls reviews and audits designed to ensure the accuracy completeness and proper use of financial information and resources. Additionally this program will evaluate compliance with Council's financial policies and procedures and broader regulatory requirements. The implementation of this FMAP embeds a proactive risk-based approach to the organisation and is consistent with previous recommendations from the auditor-General in reports to parliament for local government. As part of the incident analysis, corrective measures and considering lessons learned, the Audit and Risk Committee and elected members have been fully briefed on the matter and ongoing corrective actions. Key internal and external stakeholders will continue to be briefed as process improvements are implemented. In summary, Council is firmly committed to maintaining the high standards of the integrity and ethical conduct, ensuring the prevention of fraud and corruption throughout all areas of our operations. Council maintains a strict zero tolerance stance on fraud and corruption. These behaviours undermine public trust compromised service delivery and damage to reputation of local government. Fraud and corruption control is a shared responsibility. I will leave the report there, Councillors, and I'm happy to answer any appropriate questions.