Public Interest Disclosures Act 2022: Agency self-assessment audit report 2025
Public Interest Disclosures Act 2022 Agency Self assessment Audit Report 2025
PDF - 843KB
Public Interest Disclosures Act 2022 Agency Self assessment Audit Report 2025
PDF - 843KB
Following commencement of the PID Act in 2023, we conducted self-assessment audits in both 2024 and 2025 to test agency compliance with certain key requirements of the PID Act. This report details important findings from these audits, including an increase in the proportion of NSW public sector agencies having a PID policy to test certain key aspects of agency’s PID systems.
The Public Interest Disclosures Act 2022 (the Act) provides a framework for public officials to report serious wrongdoing in the NSW public sector, and to be protected when they do so. The Act commenced in October 2023.
Our office can audit and monitor how agencies perform their functions under the Act. As part of this function, we undertook 2 agency ‘self-assessment’ audits to better understand how well agencies are complying with the Act.
The first audit in July 2024 captured a baseline for compliance with certain requirements in the Act. We waited until July to allow agencies to implement their policy, roll out training and introduce broader awareness activities.
The second audit in April 2025 allowed us to compare the results of both audits. This report provides a broad overview of agencies' self-reported compliance with the Act, and it identifies some key areas for improvement.
For example, some agencies still do not have a PID policy, which is mandatory under the Act, and others do not have a documented process for internal review of decisions.
The audit results are laid out in this report under 6 themes:
The understanding of the Act section looks at how well agencies believe their staff understand the Act, as well as assessing how they rate their PID processes. There have been improvements in both categories from 2024 to 2025.
The PID policy section looks at the progress agencies have made in establishing and documenting PID policies and procedures. The Act requires agencies to have a policy in place that clearly documents the processes for managing voluntary public interest disclosures (PIDs), defining disclosures, reporting mechanisms, and protections for whistleblowers.
Many of the agencies that did not have a PID policy in 2024 have now implemented one, although there are still some agencies that do not have a policy in place. Smaller agencies and those agencies with no staff make up the largest group without a policy in place in both 2024 and 2025.
The PID internal reviews section looks at whether agencies have a documented process for handling internal review requests under the Act. In 2025 most agencies (77%) report having a documented review process, which is a 9 percentage point improvement from 2024. Some agencies (mostly smaller agencies with less than 10 employees) are yet to document their process. We understand that The Cabinet Office is currently considering whether these smaller agencies should be exempted by regulation from being required to have a policy in place along with other requirements under the Act.
The section on people with a role under the PID Act examines the roles, responsibilities and associated obligations outlined in the Act for certain people (known as ‘public officials’). The Act requires these public officials to be informed and trained on the handling of disclosures and their responsibilities and obligations under the Act.
The awareness and training section explores how agencies promote understanding of the Act among their staff. Training and awareness-raising are critical for creating a culture of openness and protection for PID-makers.
More agencies reported that they are incorporating information about the Act into induction training and utilising the PID e‑Learning modules we have developed. Notably, there was also an increased utilisation of staff newsletters and internal training sessions to communicate and promote PID policies.
The data, reporting and notifications section outlines how agencies manage the collection, reporting, and notification processes attached to PIDs.
It is encouraging to see a reported increase in agencies with a documented processes for notifying us about allegations of detrimental action and about certain decisions made by the agencies.[1]
This report sets out the results of 2 self-assessment audits aimed at testing compliance with certain requirements in the Public Interest Disclosures Act 2022 (the Act). The data and insights obtained from the audits will inform our future engagement, audit and monitoring activity. The self-assessment process should also help agencies to identify areas requiring remedial action by agencies.
The Act applies to all NSW public sector agencies. It provides a framework for public officials to report serious wrongdoing in the public sector and to be protected when they do so. The Act facilitates public interest reporting of wrongdoing by:
The functions of the NSW Ombudsman are set out in the Act and include auditing and monitoring how agencies exercise their functions under the Act. [2]
We carried out 2 agency self-assessment audits – the first in July 2024 and the second in April 2025 using a questionnaire sent to agencies. Under the Act, our office can issue agencies with a written notice under the Act requiring them to provide us with information. For the first two self-assessment audits we did not to do this, choosing instead to ask agencies to take part voluntarily in the audits. This was largely in recognition that it was the first 2 years of the Act being in force, many agencies were working to meet their obligations, and a primary purpose of these initial audits under the new Act has been to identify gaps and measures that we can assist agencies with as they implement the Act and move to full compliance.
The primary aims of the audits were to:
The 2024 audit provided a baseline following the commencement of the Act, and the second self-assessment audit enabled a comparative analysis of compliance between the 2 periods.
The audits focused on the following areas:
The response rate for both 2024 (91%, or 542 of 597 agencies) and 2025 (86%, 496 of 579 agencies) was high. The agencies that completed the audit in 2025 are presented by agency type in Figure 1, and 2024 in Figure 2.
Figure 1. 2025 self-assessment audit responses by agency type (n=496)
Figure 2. 2024 self-assessment audit responses by agency type (n=542)
The full time equivalent (FTE) staff numbers of agencies that provided a response to the audits ranged from less than 10 employees to more than 10,000 employees (Figure 3).
Figure 3. Self-assessment audit responses by size of agency in 2024 (n=542) and 2025 (n=496)
In this chapter we compare the self-assessment audit results from 2024 and 2025 and identify some areas where there are opportunities for agencies to improve.
We asked agencies to rate understanding of the PID Act across their agency. Most rated their understanding as ‘good’ (59% in 2024, 62% in 2025), while some rated their understanding as ‘excellent’ (7% in 2024, 8% in 2025).
In 2024, 49 agencies (9%) rated their understanding of the Act as ‘poor’. Of these, 92% were agencies with 10 or fewer employees.
In 2025, 26 agencies (5%) rated their understanding of the Act as ‘poor’ – a reduction of 4 percentage points.
Figure 4. Agency understanding of the Act in 2024 (n=542) and 2025 (n=496)
We also asked agencies to rate their processes for handling PIDs (Figure 5). The 2025 results saw a reduction in agencies rating their processes as ‘developing’ (down 5 percentage points) and ‘progressing’ (down 5 percentage points), with a corresponding increase in ‘established’, which was up 11 percentage points. There was a 1 percentage point drop in the number of agencies who rated their processes as ‘advanced’ from 2024 to 2025.
Figure 5. How agencies viewed their PID processes in 2024 (n=542) and 2025 (n=496)
The Act requires agencies to have a PID policy that details the processes for managing public interest disclosures, including who can receive a report and the protections for those who report serious wrongdoing. The Act requires agencies to publish their PID policy on their website and intranet (where an agency has them).[3]
We asked agencies if they have a current PID policy. Of the 496 agencies that submitted an audit response in 2025, 88% reported that they had a current PID policy in place.
Figure 6. Agencies reporting on having a current PID policy in 2024 (n=542) and 2025 (n=496)
29 of the agencies that said that they did not have a PID policy in 2024 had one in place by the second audit in 2025. 53 agencies that told us they had no PID policy in 2024 again reported that they still don’t have a current PID policy in 2025 (Figure 7). 72% of the agencies with no PID policy in both periods are agencies with no reported employees (Figure 8). Many of the agencies with no employees have a connection to a principal department and could enter into an agreement to ensure the principal department’s policy applied to their agency. This is why the Act allows for agencies to enter into an agreement for another agency to exercise its PID functions on its behalf.[4]
Figure 7. Agencies with no PID policy in 2024 and 2025 by agency type (n=53)
Figure 8. Agencies with no PID policy in both 2024 and 2025 by FTE count (n=53)
Of the 61 agencies that did not have a policy in place in 2025, 34 (56%) were actively developing one. 27 agencies reported that they did not have a PID policy under development.
Table 1. Agencies with no PID policy in 2025 (n=61)
Agencies with no PID policy | Number |
PID policy under development | 34 |
PID policy not under development | 27 |
Total | 61 |
Of the agencies that do not have a PID policy and are not developing one, statutory bodies representing the Crown made up 59% (see Figure 9) and 20 of these agencies told us they had no staff (Figure 10).
It is concerning that 27 agencies do not have a PID policy under development, as they are required to have one under the Act. An agency’s PID policy is where public officials (whether staff of that agency (if any) or another agency) are encouraged to go first when they are thinking about reporting serious wrongdoing. This can help them to understand what to report, who they can report to, and what they can expect when they make a voluntary PID.
Figure 9. Agencies without a PID policy and not developing one – by agency type (n=27)
Figure 10. Agencies without a PID policy and not developing one – by FTE count (n=27)
The Act prescribes certain information that PID policies must include, including 9 key elements:
The 9 key elements Section 43 (1) of the Act requires that: An agency’s public interest disclosure policy must specify the agency’s procedures for the following—
|
In 2025, 93% of agencies with a policy in place told us they have included at least 8 of these 9 key elements in their PID policy, and 36 agencies have updated their policy since 2024 to include all key elements.
The Act also requires agencies to include information about protections available to makers of voluntary PIDs, mandatory or witness PIDs, and a list of the agency’s disclosure officers.
Table 2. Content included in agency’s PID Policy for agencies with a current PID policy
Content included in agency’s PID Policy | Agencies with a PID Policy | ||
2024 (n=433) | 2025 (n=435) | ||
Information about the protections available to makers of voluntary PIDs under the Act | 426 (98%) | 435 (100%) | |
Information about the protections available to makers of mandatory or witness PIDs | 423 (98%) | 432 (99%) | |
List of disclosure officers for the agency | 415 (96%) | 393 (90%) | |
Table 3. Agency compliance with PID policy publication requirements – 2025
PID policy publication | Number |
PID policy published only on agency public website | 52 |
PID policy published only on agency intranet | 28 |
PID policy published on both agency public website and intranet | 297 |
No PID policy published on agency website or intranet | 58 |
Total | 435 |
Figure 11. Agencies with no PID policy published on agency website or intranet – by type (n=58)
The Act recognises that some agencies do not have a website or intranet. While there is no requirement for agencies to have such platforms, section 47(2) does require an agency with no public website or intranet to ensure their PID policy is readily accessible to all public officials associated with the agency. We asked agencies that did not have one or both how they ensured their PID policy was readily accessible to their public officials. Some of these agencies told us their PID policy is available on a shared drive or records management system, some said they provide a copy of their policy to new staff upon commencement or made it available at meetings. Others said that it is included in their operations manual.
Key actions for agencies and our office
|
Public officials who report serious wrongdoing can apply to an agency for a review of certain decisions made by the agency:[5]
We asked agencies if they documented their internal review process and note that most agencies (77%) reportedly did so – an increase of 9 percentage points over 2024.
Figure 12. Agencies with a documented internal review process in 2024 (n=542) and 2025 (n=496)
116 (23%) agencies still do not have a documented process in place. Local government authorities had the highest number of agencies with no documented review process (36), followed by statutory bodies representing the Crown (27). It is important to note this does not necessarily mean that the agencies do not have an approach to handling reviews, it may just be that they have not documented it.
Figure 13. Agency types without documented internal review process in 2025 (n=116)
Small agencies with fewer than 10 employees made up 61% of the agencies that did not have a documented review process in 2025. This group of agencies made up 66% of those without a documented review process in 2024.
Figure 14. Agency sizes without documented internal review process in 2025 (n=116)
We also asked agencies how they make public officials aware of their internal review process (Figure 15). Agencies could choose one or more of the following options:
Figure 15. How public officials are made aware of an internal review process
Given public officials have 28 days to apply for an internal review of certain decisions, including information about the right to review and the review process in the outcome letter helps to highlight the right to review and bring it to the attention of the person who made the report when they may want to exercise that right. We encourage more agencies to include information about a right of internal review of certain decisions in their outcome letters. Some agencies include this information in several resources, increasing public officials’ awareness of their right of internal review of certain agency decisions.
Key actions for agencies
|
The Act requires that disclosure officers are trained to recognise and handle disclosures – ensuring they understand their duties, the procedures for handling disclosures, and the protections available to PID‑makers.[9] When public officials are well informed, disclosures can be managed more effectively, which helps foster trust and build confidence in the system.
What is a disclosure officer? Disclosure officers are one of the key people to whom a report will be made in an agency. If a report is not made to a disclosure officer or referred to a disclosure officer by a manager, it will usually not be a voluntary PID. In addition to those listed in an agency’s PID policy, the following people are also disclosure officers under the Act:
It is important that agencies nominate enough disclosure officers for the size and coverage of the agency. This ensures public officials have sufficient access to report serious wrongdoing. |
The most senior officer at each permanently maintained worksite is automatically a disclosure officer if there is more than one person employed at the site. We asked agencies whether these public officials were aware that they were a disclosure officer for the Act. Most agencies (392, or 79%) reported that their disclosure officers were aware of their role – an increase of 5 percentage points from 2024.
Figure 16. Most senior officer at each permanently maintained worksite is aware they are a disclosure officer
2024 (n=542) and 2025 (n=496)
In 2025, 21% of agencies reported that the most senior ongoing employees at each permanently maintained worksite were not aware they are disclosure officers. Of these, statutory bodies representing the Crown were the sector with the highest representation – 30% in 2024, increasing to 48% in 2025.
If any public official is not aware they are a disclosure officer for the Act, they are also likely to be unaware of their responsibilities and obligations under the Act. Consequently, it is less likely that the agency’s organisational culture, policies and practices will be conducive to the reporting of wrongdoing and the effective handling of PIDs made by public officials.
We asked agencies to outline the process they have in place, and any tools they use, to assess and minimise the risk of detrimental action against PID-makers.
Many agencies reported they use risk management plans and record information in a PID risk register. Agencies also highlighted maintaining confidentiality of the PIDs as best practice for minimising the risk of detrimental action occurring. Many also recognised the importance of reassessing the risk of detrimental action throughout an investigation.
Agencies also reported other approaches to managing the risk of detrimental action, including:
We asked agencies about the processes and safeguards they have in place to ensure confidentiality is maintained when a PID is received and while it is being managed.
Agencies told us about the strategies they used for maintaining the confidentiality of PID-makers, including:
Key actions for agencies
|
One of the objects of the Act is to ‘promote a culture in which public interest disclosures are encouraged’.[10] Agencies also must make sure their staff and those providing services for them are aware of the PID Act.
Agencies also have to make sure that their disclosure officers and managers are provided with training about their responsibilities under the Act.[11]
We asked agencies whether their staff induction training includes information about the Act. 80% of agencies said they included PID information in their induction training, a 9 percentage point increase on 2024.
In response to our question whether the agency has used the eLearning and face to face training modules developed by our office, agencies also reported a 9 percentage point increase, from 58% in 2024 to 67% in 2025.
We asked agencies to tell us how they ensure the head of agency, disclosure officers and managers undertake mandatory PID training. Many agencies mentioned one or more of the following:
405 (82%) heads of agencies received PID training at the time of the 2025 audit, up by 5 percentage points from 2024. The 91 agencies that reported they had not provided training to the head of agency are divided by agency type in Figure 17.
Figure 17. Heads of agency that have not received training on their responsibilities – by agency type (n=91)
In 2025, the number of agencies that reported none of their disclosure officers or managers had completed mandatory PID training decreased by 7 percentage points in respect of disclosure officers (25% to 18%) and 5 percentage points for managers (28% to 23%) from 2024. This shows agencies have made progress in equipping their public officials with the knowledge and necessary skills to navigate the disclosure scheme and their responsibilities and obligations under the Act. It also shows that there is more work to be done to ensure agencies comply with the training requirements in the Act.
Figure 18. PID training completed by disclosure officers and managers
A comparison in reported training undertaken by all disclosure officers and all managers within an agency is presented in Figure 19. Agencies reported an increase in training completed by all disclosure officers in 2025, with 54% of all disclosure officers trained – up by 7 percentage points.
Figure 19. PID training completion by disclosure officers and managers in 2024 and 2025
Agencies have adopted various strategies to ensure public officials are aware of the agency’s PID policies and how to make voluntary disclosures (Figures 20 and 21). It is encouraging that agencies are continuing to use a variety of methods to raise awareness and understand of the PID Act and the importance of speaking up and reporting serious wrongdoing. This should ensure that staff who respond to different forms of information will have exposure to one or more sources of information.
Figure 20. How agencies ensure public officials are aware of their PID policy in 2024 and 2025
Figure 21. Steps taken by agencies to ensure public officials are aware of how to make a voluntary PID in 2024 and 2025
Key actions for agencies
|
The Act requires agencies to record and report annually to our office on certain information relating to disclosures. They also have to notify our office, and in some cases the Independent Commission Against Corruption and the Commissioner of Police, of certain events and decisions.
We asked agencies whether they have:
In 2025, more agencies reported having a documented process to ensure they notify us about allegations of detrimental action offences. This increased by 9 percentage points, up from 67% to 76% in 2025.
The number of agencies who reported having established a process to notify us about certain decisions prescribed in section 55(3) of the Act[12] also increased – up 10 percentage points to 78% of all agencies in 2025.
In 2025, 17 agencies reported they were not aware of mandatory reporting requirements of certain decisions made by the agency. A breakdown of these by sector is provided in Figure 22.
Figure 22. Agencies not aware of notification obligations (n=17)
The Act allows an agency to enter into an arrangement with another agency or entity, pursuant to section 81 of the Act, to exercise some or all its functions on its behalf. When this occurs, agencies are required to notify us of such arrangements[13] as soon as reasonably practicable. They are also required to prominently publish the details of the arrangement the agency’s public website and the agency’s intranet (if the agency has them).[14]
In the self-assessment audits, we asked agencies whether they were aware they must:
94% of agencies reported they were aware of the requirement to notify us about any arrangement they entered. This has increased by 7 percentage points from 2024 (see Figure 23).
Figure 23. Agencies know they must tell the NSW Ombudsman about a section 81 arrangement
2024 (n=542) and 2025 (n=496)
Agencies also reported an increase in their awareness about the requirement to publish details of these arrangements on their website and intranet, if they have them (see Figure 24).
Figure 24. Awareness about publication requirement for section 81 arrangements
2024 (n=542) and 2025 (n=496)
Half of the 50 agencies that reported they were not aware they were required to publish the details of any arrangement entered into were local government authorities (see Figure 25).
Figure 25. Agencies not aware of publication requirement for section 81 arrangement (n=50)
Every agency must submit an annual return to the NSW Ombudsman.[15] The Act specifies the return period as the 12-month period ending 30 June. The annual return must be submitted within 30 days from the end of the return period (unless the Ombudsman provides a later time).[16]
The annual return is to include information about—
In 2025, 92% of agencies reported they have processes in place to meet the reporting requirement – up 6 percentage points from 2024 (Figure 26).
Our office tabled the most recent annual report that includes information from the annual returns.[17] In the first two reporting periods, we have spent a great deal of time contacting agencies to clarify the information they have included. In some cases, this appears to have been because agencies have had to collate the information required to be included in a return at the end of the reporting period. There were also 28 agencies (in addition to Statutory Land Managers and Common Trusts) that did not provide us with returns. Having a process for collating the data and providing it to our office helps agencies to meet their statutory reporting requirement in a timely and accurate manner.
Figure 26. Agencies with a process to provide an annual return to the NSW Ombudsman
2024 (n=542) and 2025 (n=496)
Of the 41 (8%) of agencies that reported no process was in place to meet this annual return reporting obligation, 51% were statutory bodies representing the Crown. 23 of these agencies reported not having any staff.
Figure 27. Agencies with no process to provide an annual return to the NSW Ombudsman (n=41)
Key actions for agencies and our office
|
Footnotes
Decisions outlined in section 55(3) of the Act.
Division 2 of Part 6 of the Act.
Section 47 of the Act.
Section 81 of the Act.
Section 60 of the Act.
Section 49(1) of the Act.
Section 49(2) of the Act.
If the agency makes 1 of the following decisions in relation to the disclosure, the agency must, as soon as reasonably practicable, provide the Ombudsman with written reasons explaining the decision— (a) a decision neither to investigate the relevant serious wrongdoing nor to refer the disclosure, (b) a decision to cease investigating the relevant serious wrongdoing without either completing the investigation or referring the disclosure.
Part 3 of the Act.
Section 3(b) of the Act.
Section 48 of the Act.
Decisions neither to investigate nor refer a disclosure and decisions to cease an investigation without completing the investigation or referring the disclosure.
Section 81(4)(b).
Section 81(4)(a).
Section 78(1).
Section 78(2).
NSW Ombudsman, Oversight of the Public Interest Disclosures Act 2022 Annual Report 2024-25
We acknowledge the traditional custodians of the land on which we work and pay our respects to all Elders past and present, and to the children of today who are the Elders of the future.
Artist: Jasmine Sarin, a proud Kamilaroi and Jerrinja woman.