Performance Audit Report Released

first_imgAuditor General Michael Pickup issued a special performance audit report today, Jan. 15. The report contains the findings from his audit work at the Department of Internal Services related to the April 2018 privacy breach of the freedom of information access website that resulted in the inappropriate disclosure of personal information. The purpose of this performance audit was to assess the implementation of the province’s new website and supporting system to handle freedom of information requests. The auditor general found significant weaknesses in the risk management and project management processes used to implement and test the new website and supporting software, leading to the eventual privacy breach and inappropriate disclosure of personal information. Risk management processes were inadequate, with many basic steps not completed. Despite many warning signs, including the fact Nova Scotia was to be the first jurisdiction in the world to implement the new website and software together, the department considered the entire project low risk. This helped lead to many relatively obvious and potentially unacceptable risks not being identified or addressed. In addition, the overall project management was poor, with many key steps incomplete and key contract components not documented. “The April privacy breach is a very clear example of what can happen when government does not protect the personal information entrusted to it by the people of Nova Scotia,” said Mr. Pickup. “The inappropriate disclosure of personal information is actually not surprising given the extent of the failures found during our audit.” The report contains five recommendations which have all been accepted by government. The full report, along with a short summary and highlight video containing five questions that Nova Scotians may want to ask government in the days and months ahead to ensure sustainable improvements occur at the Department of Internal Services, is available at The Office of the Information and Privacy Commissioner also released a separate investigation report on this topic today. It can be found at