Senate Finance and Public Administration Legislation Committee (part 3 of 3)
26 October 2026
Speaker dots
- Speakers in the chapter
- Colour: political group
- Grey: no group
Tap or click a chapter's dots to see names and groups.
Contents updated at 03:05
Legend
Transcript markers
- text Sentence being played
- text Search result
- text Intervention cited by the link you opened
Click a sentence to play the video from that moment. Select text to quote it with the speaker, timestamp and link.
More options
Official source
Offset
Transcript offset
0s
Text size
Export
Replay
Versions of this video
Transcripts may differ slightly from one version to another.
Senate Finance and Public Administration Legislation Committee Australian Parliament
00:00 - 00:42
Speaker 2
Thank you, Chair, and thank you, Dr. McPhee, and to your team for doing what you do. I would like to discuss two reports that the ANAO conducted related to, no surprises here, Services Australia and their preparedness for cybersecurity systems and the handling of data privacy in particular. So they are reports number 38, 23-24, and report number 12 of 25-26. I want to understand when these audits were completed, whether Services Australia, whether the Services Australia CEO received the findings and the separate detailed technical materials, and on what dates that CEO received them.
00:42 - 02:06
Speaker 8
Right, thank you for the questions. I think the first audit that you referred to was an ANAO performance audit that was tabled in June 2024, which found that Services Australia's management of critical cyber incidents was partly effective. Key deficiencies at that time included a lack of a detailed comprehensive cybersecurity incident management policy, a lack of clear escalation paths or timeframes for reporting major infiltrations to bodies like ASD, and also an absence of structured approaches for threat and vulnerability assessments during incidents. At that time, Services Australia accepted all 10 recommendations that the ANAO made. The accountable authority would have received the report as part of our standard process of sending a proposed report before publication, and as I said, they accepted all 10 recommendations.
The audit was a point in time, and we've not audited implementation, but the recommendations would appear to have relevance to the management of the recent incident in relation to OpenAI bots accessing the website. On the privacy audit, I will hand to my colleagues to speak to that.
02:06 - 02:40
Speaker 4
Uh, yeah, thank you. So the report number 12 on the data privacy within Services Australia was tabled on the 9th of December 2025, and it would have gone through the normal processes similar to the other report that the Auditor-General outlined. We would issue a section 19 report ahead of time, and so that would have been in the last quarter, last quarter of calendar 2025.
The rest of the transcript is for Pro customers
Unlock the full transcript, chat, and every analysis feature with Polyfact Pro.
Start a free trial