Skip Ribbon Commands
Skip Navigation LinksHome > For media > Press releases > Important public building and data systems are not sufficiently secure

Important public building and data systems are not sufficiently secure

​The collaboration between the Ministry of Justice and Public Security and the Ministry of Defence to protect key national institutions using security forces and physical measures is inadequate. “Both this and the poor protection of information systems result in a risk of important societal functions being rendered inoperable,” said Auditor General Per-Kristian Foss.

Published 10/18/2016 1:00 PM

​Document 1 (2016–2017) The Office of the Auditor General's report on the annual audit and control for the 2015 budget year was submitted to the Storting on 18 October 2016. Out of a total of 240 audited accounts for 2015 prepared by ministries and establishments, 10 were the subject of remarks concerning material errors and 18 were the subject of material remarks concerning budget appropriations. Twelve of the 15 ministries are the subject of material remarks concerning the implementation of budgets and the management of agencies.
The Office of the Auditor General emphasises the following main findings in its report to the Storting:

  • Key public buildings and societal functions are not being adequately protected by security forces and permanent physical measures
  • A number of central government data systems do not adequately protect sensitive information and are not sufficiently resilient with regard to being rendered inoperable
  • Domestic helicopter security is not being adequately monitored by the Norwegian Civil Aviation Authority
  • The Norwegian Public Roads Administration carries out variable controls concerning the quality of the road network, which could compromise road safety
  • Important government funds are being lost because NAV (the Norwegian Labour and Welfare Administration) is not identifying and reclaiming erroneous social security benefit payments until cases have expired
  • The Norwegian Veterinary Institute’s accounts contain major errors and deficiencies for the third year in a row
  • NAV is not adequately following up cases to ensure that children receive the child support payments to which they are entitled, and the Norwegian Directorate for Children, Youth and Family Affairs is not providing foster parents with sufficient training and support to enable them to care for children with special needs.

Inadequate safeguarding of key societal functions

The Police and the Norwegian Armed Forces have a responsibility to provide important public properties with permanent protection through the use of physical measures or security forces as necessary.
“Important measures in this area have not been implemented. We consider it very serious that the Ministry of Justice and Public Security and the Ministry of Defence have failed to strengthen and improve their collaboration. There is a risk that the Police and the Norwegian Armed Forces, either collectively or individually, will be unable to give important objects the protection and security they need in a threat situation”, said Foss.
The Office of the Auditor General also notes that the two ministries have not ensured the permanent protection of their own buildings, as required under the Security Act and the Regulation on object security, and that the Ministry of Local Government and Modernisation’s measures concerning the ministries’ premises have been delayed and have still not been completed. “This was also brought up in Document 1 last year”, said Foss.
The Office of the Auditor General has submitted a separate classified report to the Storting concerning the work of the Police and the Norwegian Armed Forces relating to object security.

Deficiencies in management systems for data/information security

For a number of years, the Office of the Auditor General has noted that the data/information systems of many central government establishments do not have adequate security. “This also applies to many large and data-intensive government establishments, and we believe that the situation for the Norwegian Labour and Welfare Administration and the Brønnøysund Register Centre is now serious”, said Foss.
Other government agencies given special mention following the review of the situation in 2015 are the Directorate for Children, Youth and Family Affairs, the Norwegian Government Security and Service Organisation, the Norwegian Polar Institute, Norwegian Institute of Marine Research and the Norwegian Veterinary Institute, but weaknesses in information security have also been identified in a number of other establishments.
The Ministry of Local Government and Modernisation has overall responsibility for information security within the government administration, and is responsible for ensuring that central government establishments have internal control and management systems which enable the management to ensure, through monitoring, that security is adequate.
“Some establishments have not set up systems that provide adequate control and management relating to security. In some cases this area is not being adequately monitored by the management, and inadequate risk management systems, access control, computer programs and computers are in use”, said Foss. “This leads to a risk that important and personally sensitive information could fall into the wrong hands, and that important services could be rendered inoperable”, he added.

Domestic helicopter security is not being monitored adequately

In 2015, funding was awarded to boost security improvement work on domestic helicopter traffic. Despite this, the number of operational inspections still fell compared with the previous year.
“Strengthened supervision is one of the most effective measures available to prevent accidents and incidents in the aviation sector. It is a serious matter that the Ministry of Transport and Communications has not followed this up better in its management of the Norwegian Civil Aviation Authority”, said Foss.
The Office of the Auditor General also notes that the Civil Aviation Authority does not have a holistic solution for the documentation and follow-up of non-conformities.

Variable controls concerning road network quality

In order to maintain high and safe standards on the roads, the operation and maintenance of the road network must also be satisfactory. The Office of the Auditor General believes that the Norwegian Public Roads Administration’s supervision of private contractors operating the road network is variable in nature.
“It is reprehensible that the Norwegian Public Roads Administration has so little systematic and consistent follow-up of contractual non-conformities on the part of private contractors and imposes financial penalties in the event of repeated failings to varying degrees. Variable supervision concerning the quality of the road network could compromise road safety”, said Foss.
There are also no cost estimates for variation works, which increases the risk of contractors over-invoicing. Inadequate cost estimates also make it difficult to ensure that the appropriation is allocated in line with the Storting’s intentions.

Funds are being lost because claims following erroneous social security benefit payments are allowed to expire

Substantial government funds are being lost because erroneous payments are not being identified and reclaimed before the claims expire. This concerns at least NOK 676 million during the past three years.
The Office of the Auditor General believes that the Norwegian Labour and Welfare Administration carries out insufficient follow-up checks on substantial amounts of income-dependent benefits. For example, the administration itself estimates that a review of disability pensions paid out in 2013 would have identified errors amounting to approximately NOK 190 million.
“Follow-up checks are important in order to identify erroneous payments made by NAV, and this probably concerns considerably larger amounts of money”, said Foss. The Office of the Auditor General believes that it is strongly reprehensible that substantial funds are being lost as a result of erroneous payments not being identified and reclaimed until the case has expired.

Child support payments and the care needs of foster children are not being adequately followed up

NAV is not doing enough to ensure that children receive the child support payments to which they are entitled. The Directorate for Children, Youth and Family Affairs is not providing foster parents with adequate training and support to enable them to care for children with special needs.
In December 2015, over 16,000 children did not receive the support payments they were entitled to. Of these, almost 10,000 received less than half, and 4622 did not receive any support payments at all. “It is reprehensible that so many children do not receive the financial support they are entitled to. This can deprive the children concerned of important opportunities”, said Auditor General Foss.
There are over 10,000 children in Norwegian foster homes. The reasons for this include violence, substance abuse in the home or the fact that the children have arrived in Norway alone as refugees or asylum seekers. “Our review shows that foster parents do not receive enough training, guidance or follow-up in caring for vulnerable children with special needs”, said Foss.

The Norwegian Veterinary Institute’s accounts contain major errors and deficiencies for the third year in a row

The Office of the Auditor General is again unable to issue a statement concerning the Norwegian Veterinary Institute’s accounts in 2015.
“The Ministry of Agriculture and Food is responsible for ensuring that its underlying establishments prepare accurate accounts. We believe it is strongly reprehensible that the ministry’s management and follow-up of the establishment has not brought about the necessary improvements”, said Foss.
The audit identified material weaknesses in the Institute's financial management and internal controls, and indicated that the accounts are unsuitable for use as a source of reliable management information. This increases the risk of decisions being taken on an erroneous basis. The Standing Committee on Scrutiny and Constitutional Affairs has previously asked the Ministry of Agriculture and Food to ensure that the Institute establishes routines and control measures which ensure that the accounts can be approved.

Few accounts are being compiled in accordance with the new standards – mandatory from 2016

From this year onwards, all public accounts must be compiled according to the accrual principle in compliance with revised government accounting standards. This will lead to greater transparency concerning the use of public sector funds and improve the quality of management information.
Just 64 of the 240 accounts audited by the Office of the Auditor General were compiled in line with the new standards.
“Despite adjustments being made to the standards and a recommendation that the new standards be applied as soon as possible, relatively few establishments have started using them. This may be a sign that managers are finding that compiling accounts in accordance with the new government accounting standards is still not providing relevant or better management information”, said Auditor General Foss.
The Office of the Auditor General is concerned that the inadequate use of accounts as a management tool could impact on the quality of financial reporting.

Riksrevisjonen, Storgata 16, P.O. Box 8130 Dep, 0032 Oslo, Norway

Phone: +47 22 24 10 00

Org.nr: 974 760 843