Customer

NSW
GOVERNMENT Service

Strategic investigations Unit

Future State Operating Model Options

October 2020

www.customerservice.nsw.gov.au
Executive Summary

DCS, Governance Risk and Performance(GRP)established the Strategic Investigations Unit(SlU)in June 2020 to assist SNSW respond
to inbound NSW Police requests and report suspected cases of fraud concerning grants administered by SNSW.

With current funding for the SlU almost exhausted, this options paper considers alternatives for the future state operating model for the
function moving forward.

3 options have been identified and assessed for consideration:

1. SNSW Fraud Management Team (Slide 5)
2. SNSW Strategic Investigations Unit (Slide 10)
3. Priority Case Investigations Team (Slide 11)

A summary of all options is provided on slide 4.

Recommendation is that Service NSW proceed with Option 1. This operating model satisfies Service NSW's legislative obligations
and requirements and will ensure that inbound NSW Police referrals are actioned, and suspected fraud is reported to NSW Police for their
action.

Decisions
1. Agree on future state operating model - A decision on the ongoing operations of investigations is required prior to the exhaustion of
the current funding to allow for approval by the Secretary and to agree next steps with the supplier resources(Core Integrity).
2. Partner Agency (Treasury)to provide guidance on their risk tolerance/appetite for investigations
Legislative Requirements

Review of the Crimes Act In relation to grant fraud Investigations (s316)

Service NSW to report suspected matters of fraud to NSW Police

o Service NSW should look to produce a report about transactions identified as potentially fraudulent, and to
provide a copy of that report to the NSW Police, inviting them to investigate those matters.

Further, Service NSW will be required to provide NSW Police with information they have requested to support their own
investigations.

At present the SlU is not just responding to inbound NSW Police enquiries, they are preparing briefs of evidence to a
standard that is admissible in court.
 Summary of Future State Options

Options Service Delivery Profile Focus Resourcing/Cost Benefits Reporting Transition RFP/ Go
Line to SNSW to Market

1)SNSW Fraud Low Investigate Inbound DCS: Merge current SlU and Level 2 Security Risk Team SNSW. Executive 1 March 2021
Management Team Police enquiries only • Dec 20-Feb 2021 sS200k Focus on priority investigations as advised by NSW Director, Strategy,
RECOMMENDED SNSW meets minimum legislative Report suspected fraud Police Risk and
SNSW:
obligations and continues to triage and cases to NSW Police(PI SNSW complies vmth legislation In meeting its Performance
analyse internally identified fraud for and P2- highest priority. • March-June $190k
requirements and obligations to report fraud
reporting to NSW Police(PI and P2) P3 and P4 to t>e • FY 2021/22 = $560k Team can scale to take on additional Investigations:
managed t>y the SRT) this can t>e through appointing an additional Clerk
To scale the team to take on 7/8 or use inhouse(SRT)resources
additional Investigations the
operating costs for FY 2021/22
will t>e $6d2k.

2)SNSW Strategic High Investigate all (PI to P4) DCS: SlU ur>der full control of SNSW and could potentially SNSW,Executive 1 July 2021 Yes- Full
Investigations Unit Cases/applications • Dec 20• Feb 2021 = S700k Include non^rant programs within Its scope over Director, Strategy, RFP required
SNSW exceeds legislative obligations and Refer matters to NSW time Risk and to continue
SNSW:
(refer to Appendix provides a full service offering in reviewing Pdice for Investigation Ail inbound and outbound Police/Law Enforcement Performance with expert
Slide 10) and investigating all matters of suspected • March - June $d60k
(including briefs of enquiries will be actioned^nvestigated supplier
fraud evidence) • FY 2021/22 = $2.9m
SNSW is demonstrating due diligence and meeting resources

public expectations in attempt to prosecute and

recovery fraudulent activities and payments

Case Medium Investigate P1 and P2 DCS Effort focussed on major/high profile investigations SNSW.Executive 1 July 2021 Yes-Full
'estigations Team Cases/applications only; • Dec 20 to Feb 2021 = $700k only Director, Strategy, RFP required
SNSW exceeds legislative obligations and includes Inlraund and SNSW: Actioning inbound ar>d outbound Police rask ai>d to continue
'to Appendix investigates suspected fraud prioritised as outbound Police enquiries • March to June 2021 = $630k enquiries/referrals Performance with expert
SUdell) P1 or P2 regardless of how it was referred • FY 2021/22 = $2.5m supplier
Positive impact media attention related to high
resources
profile cases
 Option 1 - SNSW Fraud Management Team
Recommended
Operational Focus
Investigate inbound Police enquiries only
Meets minimum iegisiative requirements through
reporting of suspected fraud to NSW Pdice for P1
and P2. P3 and P4 to be managed by the SRT)
Coordination of briefs of evidence including business
record affidavits and victim statements in reiation to
Police investigations only
Report suspected fraud to NSW Police
Triage applications to determine whether cases
outside of P1 and P2 are required to be reported to
NSW Police
Fraud management sits within one team in SNSW -
allowing for greater collaboration, seamless
transition of referrals and ongoing management of
investigations and reporting to NSW Police. SRT
resources can also be leverage when Ute team
needs to scale quickly to manage demand and
increased referrals.
Reduced cost associated to a lean team only
focusing on cases referred to Sen/ice NSW by NSW
Police
Resourcing Costs
• OCS/GRP
• December 2020 to February 2021 - $200k
SNSW:
March to June 2021 - $190k
FY 2021/22 » $560,480(+ additional Investigator FY cost = $692k)
Notes
1)exdudes any contingency or disoetionary spending,2)Salaries and labour costs included
Indicative Resource Profile
Program Manager(GRP funded until March 2021)
Manager, Investigations (11/12)
Senior investigations Officer(9/10)
Triage and Reporting Officer(7/8)
Business Support Officer(3/4)
Investigator (7/8)- if required
Reporting to NSW Police does not equal action
Additional grant programs could increase resource
profile and requirements
Applications prioritised as P3 and P4 will not be
actioned - meaning that investigations and potential
criminal action will not tre taken against these
suspected fraudulent payments
No predictive proactive intelligence and data analysis
would be performed which could result in continued
systemic fraud and ineffective controls
Inaction of P3 and P4 cases could result in negative
Public and Partner Agency perception
This recommended option has a LOW service delivery profile.
This operating model will meet the minimum legislative requirements with
the addition of reporting suspected fraud to NSW Police for their
consideration and action. The team will be able to scale quickly leveraging
inhouse(SRT)available resources to manage additional P1
(major/significant fraud)cases or through appointment of an additional Clerk
7/8 investigator.
Proposed actions:
Transition operations of the SlU to SNSW as at 1 March 2021.
Commence recruitment for specialist investigation resources in December
2020.
The current engagement with Core Integrity will be extended through a
contract variation until February 2021. Core Integrity to fulfill their
contractual obligations and commence handover of process documentation,
briefs of evidence, and case files.
A Briefing Note will be prepared for ttie DCS Secretary to approve the
contract variation and additional hjnds allocation to the Core Integrity
contract. Additional funds will be $200k - Core Integrity to scale back
resources from 1 December 2020 until 1 March 2021, with the primary focus
on closing out cases and transitioning to SNSW.
SNSW will be responsible for new NSW Police referrals. Core Integrity case
allocation to remain to the current NSW Police investigations only. If new
referrals are required to be investigated by Core Integrity, this will need
endorsement by the Executive Director, Strategy, Risk and Performance
before work will commence. 5
High Level Transition Plan - Option 1
Phase 1: Phase 2: Establishing
Understanding the foundations
problem
Service NSW and DCS Strategic Investigations
undertake analysis to Unit established to
determine extent of grants prioritise, action and refer
fraud. suspected fraudulent
applications to NSW
Police.
March - June 2020 June - December 2020
Our current position
Phase 3: implement Phase 4: Transitioning
an Investigations to Business As Usual
function
Active management of
NSW Police referred Investigations and Level 2
investigations and Security Review Team
reporting of suspected merge. Relationship with
fraud to NSW Police. Law Enforcement
SlU to transition to SNSW Agencies is coordinated
as at 1 March 2021 through this function
O^O
January - February 2021 March - December 2021
Appendix
Considerations in implementing Option 1

1. A part of the transition and implementation of the operating model as described in Option 1, further discussion with
NSW Police is required. The reporting of suspected fraud and how NSW Police may wish to receive this information
will need to agreed and formalised.

2. SNSW should evaluate whether there are existing internal skill sets to undertake investigations of this nature
o Resources conducting investigations that may proceed criminal action require specialist skills with previous
experience dealing with Law Enforcement Agencies and the preparation of briefs of evidence

3. Core Integrity Agreement with DCS considers future need to engage, should evidence or statements need to be
provided in court on investigations. Supplier resources in the case that resources are ordered by way of subpoena
to attend court and provide evidence related to grant fraud cases and investigations.
o These investigations are 'long-tailed', and cases may not proceed to court for some time and/or that cases
before the court are lengthy. Any resource (inhouse or supplier related) can be summoned to court to provide
evidence.
o As Core Integrity has been crucial in active inbound NSW Police investigations, it would be prudent for
DCS/SNSW to establish an agreement with Core Integrity in the case they may be subpoenaed to attend to
court or provide assistance to Service NSW on an 'as needs basis'. The agreement should include that the
resources will be paid in accordance with the terms of agreement in which Core Integrity was engaged.
Option 1 - Proposed Fraud Management Unit Organisational
Reporting structure as at 1 March 2021

Service NSW

Executive
Director,
Strategy. Risk and
Performance

Fraud
Security Review u Management
Team
Team
Option 2- SNSW Strategic Investigations Unit
Investigate all(P1 to P4)Cases/applications
All Inbound and Outbound Police Enquiries
Coordination of briefs of evidence including business record
afTidavits and victim statements
Conducting case network mapping analysis and predictive
assessment/analysis based on fraud indicators using
intelligence gathered through Law Enforcement enquiries and
collaboration
Proactive coordination with Law Enforcement Agencies(NSW
Police, AUSTRAC)and other stakeholders(ATO, Services
Australia)
Provide expert investigative services to assist other business
activities such as GlPA requests, Intemai Audit investigations
associated to grant fraud
Responsive, proactive and preventive fraud investigative
services
SlU under fuil control of Service NSW and could potentially
include non-grant programs within its scope over time
SNSW will be able to flex team to accommodate operational
changes and to meet strategic priorities as set by Government
All inbound and outttound Police/Law Enforcement enquiries
will t>e actioned/investigated
SNSW is demonstrating due diligence and meeting public
expectations in attempt to prosecute and recovery fraudulent
activities and payments
Predictive analysis and intelligence would improve control
effectiveness targeting systemic and uncovered fraudulent
activity
Intervention and disruptive methodologies would be used to
prevent fraud loss and improve control effectiveness
Inhouse resources
• Program Manager(GRP funded until March 2021)
• Business Support Officer/Project Officer (3/4)
Supplier (third party) resources
• Director, SlU
• Manager, Investigations
• Senior Investigations Officer x 2
• Investigator x 3
• Manager, Law Enforcement and Agency Liaison
• Data, Intelligence, and Analytics Officer
• Triage and Assessment Officer
Partner Agencies may view this model as'over
servicing'
Additional grant programs could increase
resource profiie and requirements
NSW Police/Law Enforcement investigations
may force the redirection of resources
Under full control of SNSW at 1 July 2021,this option is deemed a
HIGH level service offering. This operating model will exceed the
minimum legislative requirements with the addition of reporting suspected
fraud to NSW Police for their consideration and action.
This option will require SNSW/DCS to undertake an open market(RFP)
tender to engage a third-party supplier with specialist investigation and
intelligence expertise, along with proven relationships with Law Enforcement
Agencies to reach a successful conclusion to the investigation/case with
criminal action.
To support the RFP and to ensure that it is fair and transparent, it is
advisable that the current Core Integrity engagement is extended through
direct negotiation to March 2021. This will require additional funds of
approximately $700k, maintaining current resource profile.
The RFP will need to be open to the market before 1 December and closing
late January 21, allowing suppliers time to complete their submission over
the Christmas shutdown period. The SlU will commence transition to SNSW
from 1 March with completion in June 2021.
Resourcing Costs
• DCS/GRP
• December 2020 to February 2021 = $700k
• SNSW:
• March to June 2021 = $960k
• FY 2021/22 = $2.9m
Notes
1)excludes any contingency or discretionary spending
2)calculated at $60k per week for supplier resources
3) Includes 3/4 Salary + labour costs, and minus6 weeks related to leave and public 10
holidays related to Supplier services
Option 3- Priority Case Investigation Team
Investigate PI and P2 Cases/applications only; int)ound and
outbound Police enquiries
Report suspected fraud to NSW Police for their action
Coordination of briefs of evidence including business record
affidavits and victim statements
Conducting case network mapping analysis on P1 and P2
cases only
Respond to enquiries from NSW Police
Focus on major investigations only
Deterrent element that SNSW is focusing on higher profile
cases
Positive impact associated increased media attention related
to high profiie cases
Only actioning priority int>ound and outbound Police enquiries
Inhouse resources
• Program Manager(GRP funded until March 2021)
• Business Support Officer/Project Officer
Supplier (third party) resources
• Director, SlU
• Manager, Investigations
• Senior investigations Officer x 1
• Investigator x 3
• Manager, Law Enforcement and Agency Liaison
Additional grant programs could increase
resource profiie and requirements
NSW Police/Law Enforcement investigations
may force the redirection of resources
Applications prioritised as P3 and P4 will not t>e
actioned - meaning that investigations and
potential criminal action will not be taken
against these suspected fraudulent payments
No predictive proactive intelligence and data
analysis would be performed which could result
in continued systemic fraud and ineffective
controls
Inaction of P3 and P4 cases could result in
negative Public and Partner Agency perception
Under full control of SNSW at 1 July 2021,this option is deemed
a MEDiUM ievei service offering. This operating model will exceed the
minimum legislative requirements with the referral of outbound PI and P2
cases to NSW Police for further investigation and criminal action.
This option will require SNSW/DCS to undertake an open market(RFP)
tender to engage a third-party supplier with specialist investigation and
intelligence expertise, along with proven relationships with Law
Enforcement Agencies to reach a successful conclusion to the
investigation/case with criminal action.
To support the RFP and to ensure that it is fair and transparent, it is
advisable that the current Core Integrity engagement is extended through
direct negotiation to March 2021. This will require additional funds of
approximately $700k, maintaining current resource profile.
The RFP will need to be open to the market before 1 December and closing
late January, allowing suppliers time to complete their submission over the
Christmas shutdown period. The SlU will commence transition to SNSW
from 1 March with completion in June 2021.
Resourcing Costs*
• DCS/GRP
• December 2020 to Febmary 2021 = $700k
• SNSW:
• March to June 2021 = $830k
• FY 2021/22 = $2.5m
Notes
1)excludes any contingency or discretionary spending
2)calculated at $52k per week for supplier resources(DCS/GRP costs are
calculated separately) ..
3)Includes 3/4 Salary + latx)ur costs, and minus 6 weeks related to leave 11
and public holidays related to Supplier services
Option 2 and 3 - Proposed Organisational Reporting Structure

Service NSW DCS

Executive Executive
Director, Director,
Strategy, Risk and Governance, Risk
Performance and Performance

DCS Chief Audit

'rogram
Executive,
Manager Director Audit and
r (DCS/GRP) investigations

Strategic
Security Review
Investigations
Team
Unit

12
 Current State - Strategic Investigations Unit(SlU)

In June 2020, DCS established the Strategic Investigations Unit(SlU)and engaged expert fraud and investigative consultants(Core
Integrity Solutions)to assist Service NSW in quantifying the potential fraud loss exposure of grants paid to customers, and to establish an
investigations function to escalate suspected cases of fraud to the NSW Police and to respond to inbound requests for information from the
Police.

• The Core Integrity Solutions(SlU)consists of 7 staff with oversight by the Managing Director.
GRP engaged a Program Manager in August 2020, to assist in establishment and oversight of SlU. This includes the transition of the SlU to
a BAU capacity.

A significant focus of the SlU to date has been on Priorityl ("P1")cases as inbound referrals for information from the NSW Police. The SlU
has received enquiries from the NSW Police in relation to approximately 23 cases nd intelligence supplied by the unit has contributed to the
arrest of two Persons Of Interest("POI's).SW Police have also established wo joint agency taskforces in the Hunter Valley and central
NSW,omprising ocal Area Commands and state and federal agencies. Advice from NSW Police has indicated that additional task forces will
be established imminently to target known POI's).

• The SlU has commenced discussions with AUSTRAC to further support investigations and to assist NSW Police with enhanced evidence
and data. USTRAC have identified a further 30 POIs that they believe warrant further investigation by the SlU. This collaborative
relationship will ensure that applicants actively attempting to defraud the grant programs will potentially be stopped before grant funding is
paid.

• In addition to providing expert investigative services, the SlU has been involved in investigations related to an internal staff member, a case
where a customer had referred a matter to NCAT for review, and suspected customer identity theft.
13
Service NSW Grant Administration

Assumptions
• Service NSW will remain the main government vehicle to disperse disaster and economic stimulus Grant payments.
This line of business is evolving with significant focus on improving current controls for existing grant programs
• The Service NSW Fraud Control Framework is currently under way to identify key processes, policies and structures
to deter, detect, and respond to fraudulent or incorrectly issued funding or financial support.
• Significant interest from the NSW Audit Office and the Auditor General on the control measures and frameworks in
place to administer the ongoing grant programs with two Performance Audits to be delivered over the next 12
months
• Service NSW remain committed to providing as much support and assistance to NSW Police in their pursuit of
customers who are suspected of fraud
Service NSW has a low appetite for grant fraud.
Service NSW Grant Administration

Learnings
SNSW does not have any compliance or enforcement authority under its enabling act
Agreements with partner agencies to allow SNSW to investigate matters of fraud and provide delegated enforceable
powers to demand return of grant payments deemed fraudulent
Delegated enforceable powers should be conveyed to grant applicants (at the time of submission) as set by the
grant application eligibility criteria
Grant application Terms and Conditions should include the intent/will of SNSW to refer suspected fraudulent
applications to NSW Police for criminal action
The Service NSW Finance Reconciliation Team has successfully recovered approx. $1m in incorrectly paid grants.
This is from a total recovery value of $1.7m
Some further consideration may be required as to whether partner agencies should contribute funding to the
ongoing operations of the investigations function
Early indication from icare is that Service NSW insurance policies under the Treasury Managed Fund do not
cover claims related to customer grant fraud.(NB official advice from icare/TMF is pending - recent update from
icare has noted this will be provided by early November)
SlU Successes

Established case management function in place

Prioritisation and triage of applications is in place
Management dashboards established to report case load and investigation updates, including improved data
intelligence to better inform case and application management (i.e. aging cases, connectedness, indicators,
geographic spread)
2 criminal convictions, 1 charge pending further court appearance
Established partnership with NSW Police Local Area Commands in Hunter and Mid North Coast
SlU continue to work intimately with multiple Strike Forces within NSW Police. This includes holding recurring
meetings with members of the Strike Forces to discuss information required and next steps in the respective police
investigation
o SlU has established relationships with 24 police officers as a result of 21 inbound NSW Police referrals, 9 NSW
Police queries and 1 outbound referral to NSW Police
Completion of detailed briefs of evidence including SNSW Victim Statement and business records affidavits which
these can be used as templates and proformas for further NSW Police engagement
Customer negotiation that resulted in a return of funds and avoidance of an NCAT investigation in the agency and
grant program
Established a collaborative relationship with AUSTRAC to share and support ongoing investigations
SlU - Current Case Load and Management

SlU case load as at the 20th October 2020:

138 active cases
• consisting of 1689 suspected fraudulent applications
associated value = $17,752,859
o P1 and P2 associated value = $9,082,298
• $7.1 m in grants already paid
o P1 and P2 paid = $4,280,249

A further 336 applications have failed the SNSW Level 2 Security Risk Team (SRI)security assessment and will be
referred to SlU in coming weeks. SRI continue to address a backlog of-1,200 applications, with further referrals to SlU
anticipated.

SlU Investigators(2 FIE)are fully utilised working with 3 active NSW Police on Strikeforces.

SlU currently have a total of 23 police cases relating to:

62 suspects(some supplied by NSW Police)
• 314 applications
21 Inbound referrals from NSW Police and 1 outbound to referral
Current SID Organisational Structure

Executive Director, DCS A/Chief Audit h

Managing
Governance, Risk and Risk Officer, i
Service NSW Chief
Director, Core
and Performance
Audit Executive .^Integrity Solutions
Catherine Ellis
Anthony Lane Darren Murphy

SiU Director
ian Misfeld

friage and Assessmeni Snr Manager, Data Snr Consultant, Law

Analytics and Enforcement and
Manager,
Analyst investigations
Reporting Agency Liaison
Craig Grant Dylan Bohnen
Chris Davitt Holly Cogle

investigator
Paolo Cantareila

Investigator
Josh Rawciiffe
SlU Applications by Program - as at 20/10/2020

Program Invesbgations: # transactions # of cases referred to Police

Data source (Strategic investigations unit) (Stiategk:Tnv^gafi^un9) ''

Information Applications

Small Business COVID-19 Support Grant 369 applications

Smal Business Bushfire Support 10K Grant 969 applications

Small Business Bushfire Recovery 50K Grant 149 applications

VFF Payment 108 applications

1 c^e(comprising of 40 applicaticms)
COVID Recovery 3K Grant 91 applications

Southern Border Small Business Support

Grant
2 applications

Export Assistance Grant 1 application

19