This audit assessed information and communications technology (ICT) Controls in the Victorian public sector.

This inaugural report summarises the results of the audits of public sector entities' ICT general controls as part of the 2013–14 financial audits. It aims to provide extra insight and visibility of ICT-related audit findings, and also identify wider trends that may not be covered in the reports given to an entity's management.

Most of ICT audit findings were medium risk, with none ranked as an extreme risk. High-risk ICT audit findings are concentrated in a few ICT general controls categories.

The five themes identified through the ICT audits were:

1. ICT security controls need improvement
2. management of service organisation assurance activities requires attention
3. prior-period audit findings are not being addressed in a timely manner
4. patch management processes need improvement
5. ICT disaster recovery planning is weak.