Despite a pandemic being an acknowledged, state-wide risk for years, The Victorian Public Service wasn’t adequately prepared for Covid-19 when it hit, an audit has found.

The Victorian Auditor General looked at all eight state departments, as well as the government ICT provider Centrix, before and during covid-19.

It found gaping holes in business continuity planning for the complex, long term disruption the pandemic would cause.

Auditor General Andrew Greaves said the pandemic put many demands on government agencies, including providing effective incident management while maintaining services and transitioning to remote working.

Specifically, government had to provide crisis and emergency management, handle public enquiries, maintain public safety and security, oversee to staff welfare and wages, manage money supply and service disruptions, and keep procurement and ICT going.

The audit found departments managed to respond quickly and effectively under the circumstances, but this wasn’t thanks to good planning.

Out of date plans

Despite the Victorian Public Service having more than 600 business continuity plans, only one out of the state’s eight departments – the education department – had up to date plans covering all prioritised services.

“COVID-19 has caused a disruption of a scale and complexity that most people have not seen before. However, a pandemic was not an unforeseeable event,” the audit of business continuity during Covid-19 said.

We found that most departments’ business continuity arrangements were inadequate and not designed for a complex long-term disruption.

Victorian Auditor General

“We found that most departments’ business continuity arrangements were inadequate and not designed for a complex long-term disruption.

“This meant that their response to restore and maintain their services at the beginning of the pandemic was not as effective and efficient as it could have been.”

Lack of focus on business continuity

The report found government responses focused on the emergency response rather than business continuity, and it identified gaps in business impact analyses, business continuity plans, training, and policies and procedures across the board.

It said while VicRoads had a plan to transition more services to the digital myVicRoads platform, about a quarter of its services were still paper-based or required an in-person interaction in March 2020. This included services such as in-vehicle driving tests, online learner permit tests and online hazard perception tests.

Meanwhile, It took Cenitex at least four weeks after the Victorian Government’s work from home direction to stabilise its services and enable most public servants to work remotely.

The audit also found a lack of whole-of government co-ordination and missed opportunities to improve communication across departments and said weakness in business continuity planning identified in 2018 and 2019 were still unaddressed by the time Covid-19 arrived on the scene.

There is currently no whole-of-government strategy on how departments can re-prioritise VPS resources in response to a large-scale disruption, the audit says.

“Our audit shows that departments can be better prepared for foreseeable major disruptions.

“Departments can be better prepared for foreseeable major disruptions by regularly testing their business continuity plans and treating them as living documents.”

Mr Greaves recommended that DP&C and Treasury develop whole-of-business continuity arrangements and that the health, justice and families departments develop stand-alone pandemic plans.