State Services Commissioner Peter Hughes has today announced the findings of an inquiry into how Budget-sensitive
material was accessed at the Treasury.
The inquiry, led by Ms Jenn Bestwick, was launched by the Commission at the request of the Treasury after sensitive
Budget information was accessed on the Treasury website two days before the 2019 Budget was to be announced on 30 May.
Budget-sensitive material was accessed via searches on the Treasury website.
Assembling and publishing the Budget is a core responsibility of the Treasury.
The Commissioner said the Treasury’s failure to keep Budget sensitive information secure was not acceptable.
“This should not have happened,” said Mr Hughes. “Some things are so critical that they can never be allowed to fail.
Security of the Budget is one of these.”
The inquiry found:A series of technical decisions led to a design in the Treasury website search function, which allowed access to Budget
2019 information. The design
also existed in the 2018 Budget, though there were no security breaches.Governance and oversight at the Treasury’s executive level fell shortRisk management processes around Budget 2019 were not good enoughConcerns about security risks existed but were not escalated.
Mr Hughes said the Treasury has an excellent reputation as New Zealand's lead advisor to the Government on economic and
fiscal policy, with very good people doing their best.
“But sometimes doing your best is not enough,” said Mr Hughes. “Some things you just need to get right. Each and every
time. For these you need to check, check and check again and that didn’t happen with security around Budget 2019.
“Senior leadership at the Treasury were rightly focused on the big economic and fiscal issues which are important to New
Zealanders and the Government. That is what I expect. But they got the balance wrong. The Treasury’s core business is
also delivering the Budget and I’m disappointed the senior leadership were not hands-on enough in that task.
“I am confident the new Secretary of the Treasury will provide the leadership to deliver the necessary changes to ensure
this doesn't happen again.”
The Treasury, under new Secretary Dr Caralee McLiesh, has already implemented a number of changes that address many of
the issues raised or findings from the inquiry.
Since the incident, Dr McLiesh has:appointed one of her executive leadership team members to personally oversee the security of the Budgetimplemented new quality assurance measures around all aspects of the Budget processimplemented new security and testing policiessteps in place to ensure a replica Budget website will be fully and comprehensively tested prior to Budget day.
Dr McLiesh said the Budget production process for Budget 2020 is robust and secure, and in line with best practice and
the appropriate guidance and standards.
“The Budget is a core priority of the Treasury and what happened should never happen again,” she said.
“The Treasury accepts all of the inquiry’s findings. When I came into the job last September, the Treasury had already
made a number of improvements and we have since initiated a programme of work to improve security processes around the
Budget. A lot of the necessary changes identified in the inquiry report have been implemented or are already underway.”