The outcomes from the breach of permit investigations according to the

ANAO Report No.3 2015–16 Regulation of Great Barrier Reef Marine Park Permits and Approvals 115

7.17 In relation to investigations into potential non-compliance, the ANAO

examined the: key controls in IT support systems; basis on which the FMCU decides to investigate an incident; planning, conduct and timeliness of the investigations; enforcement decision-making and documentation; and implementation and follow-up of enforcement action. 128 Key controls in IT support systems

7.18 GBRMPA is placing increasing reliance on IT systems to support its

assessment of permit applications the Reef Permits database 129 and management of compliance intelligence and enforcement activities CMIS. An effective control environment, encompassing user and programmer access, change management and data security is, therefore, important for effective decision-making and accurate management reporting.

7.19 The ANAO’s review of the Reef Permits database and CMIS found that,

overall, GBRMPA had an effective control environment. Nevertheless, there is scope to strengthen current arrangements by: increasing the frequency of reviews of user activity logs and access to the Reef Permits database and CMIS programs and data; reinforcing the need for IT staff to retain documentation for all system changes; and undertaking disaster recovery testing on a regular basis. 130 Reporting of incidents and decisions to investigate

7.20 In relation to the permit-related non-compliance incidents reported to the

FMCU, half were reported within 11 days of the incident occurring. 131 However, three non-compliances observed by the EAP Section were only reported as incidents some five to nine months after site inspections were conducted or the expiry of deadlines to install facilities. A further, well-publicised incident involving the death of a tourist was brought to GBRMPA’s attention as a breach of permit conditions more than four years after it occurred. 128 The ANAO examined all 76 reported breaches of permit conditions and 59 permit-related non-compliance investigations conducted during the period July 2012 to June 2014. 129 The current transition from the Reef Permits database to the Reef Management System—an on-line workflow management system to register, assess and issue permits among other things—will further increase GBRMPA’s reliance on its IT systems. 130 In the medium term, it would be beneficial for GBRMPA to consider relocating the server room to a location that is fully compliant with the Australian Government Physical Security Management Protocol and would better mitigate the risks of damage from a major flood or cyclone. 131 Excluding six incidents where the FMCU could not determine when the incident occurred.