Audit Act 1994

In ForceVIC

Jurisdiction

Victoria

Collection

act

Plain English Summary

8/10 complexity

What this law does (mechanics)

Establishes the role, powers and administration of the Auditor‑General and the Victorian Auditor‑General's Office (VAGO). Key appointment, acting and delegation rules are set out (ss 4–9). The State indemnifies the Auditor‑General and certain VAGO staff for acts done in good faith (s 9).
Requires regular financial audits of public bodies and the State, and sets timing and opinion requirements (ss 10–12). Public bodies and certain Ministers must meet audit fees determined by the Auditor‑General, payable into the Consolidated Fund; disputes on fees go to arbitration (s 13).
Authorises performance audits and assurance reviews to check whether public bodies and Victorian public sector activities are effective, economical and efficient, and whether specified financial benefits or property are used for their intended purpose (ss 14–16, 19–21). The Auditor‑General must prepare specifications, consult on draft specifications, and provide final specifications (ss 16–18).
Gives VAGO formal powers to gather information, require documents and compel attendances (information gathering notices) (ss 29–37), and to enter and inspect premises of public bodies and, in limited circumstances, associated entities (entry notices and inspections) (ss 43–51). It sets service timeframes and procedural protections (ss 32, 44–46) and requires audio/video recording of compelled attendances with reporting to Integrity Oversight Victoria (s 37, as amended by s 39).

JSON API

Deep Dive

4,296 words · generated 12/05/2026

What it does

The Audit Act 1994 establishes the legal framework for the audit of the Victorian public sector. Its purposes, set out in section 1, are to provide for the conduct of efficient and effective financial audits, performance audits, and assurance reviews in the Victorian public sector; to provide for reports on those audits and assurance reviews by the Auditor-General to the Parliament; and to provide for the administration and audit of the Victorian Auditor-General’s Office (VAGO). Section 3A expands on these objectives: to determine whether financial statements of public bodies and the State present fairly their financial position and results; to determine whether public bodies achieve their objectives effectively, economically, efficiently and in compliance with all relevant Acts; to determine whether operations or activities of the Victorian public sector are performed effectively, economically, efficiently and in compliance; to determine whether financial benefits or property given by a public body to an associated entity or other entity are used effectively, economically and efficiently for the particular purpose; to determine whether there has been wastage of public resources or lack of probity or financial prudence; to ensure the Auditor-General has necessary powers; and to ensure the Auditor-General is held accountable. The Act creates three core audit functions: mandatory annual financial audits of every public body (section 10), discretionary performance audits of public bodies and the wider public sector (sections 14 and 15), and mandatory assurance reviews of estimated financial statements plus discretionary assurance reviews of operations (sections 19 and 20). It grants the Auditor-General extensive information-gathering powers in Part 7, including the power to serve information gathering notices requiring documents, information, and attendance; the power to enter and inspect premises owned or occupied by public bodies or associated entities; and the power to examine persons on oath or affirmation. Part 8 governs reporting to Parliament, including mandatory reporting on the annual financial report of the State (section 57). Part 9 imposes mandatory notification obligations to IBAC and Integrity Oversight Victoria, and authorises information sharing with other integrity bodies and Auditors-General. Part 10 imposes accountability obligations on the Auditor-General, including preparation of an annual plan (section 73), annual report (section 75), and application of auditing and assurance standards (section 78). Part 11 provides for independent audit of the Auditor-General and VAGO: an independent financial auditor appointed by resolution of both Houses (section 79) and an independent performance auditor appointed to conduct a performance audit at least once every four years (section 82). The Act binds the Crown (section 3C) and has extra-territorial operation to the full extent of Victoria’s legislative power (section 3B).

Current sections

Direct links to the current provisions in Audit Act 1994.

113

Official source available

Zoe has indexed the source text for search and analysis. Use the official register for the original document and download formats.

View on official register

Sourced from Victorian Legislation (legislation.vic.gov.au), CC BY 4.0.

Officially the Act exists to secure efficient and effective financial audits, performance audits and assurance reviews in the Victorian public sector and to provide Parliament with reports on those activities (s 1; objectives in s 3A).
How the Act advances those purposes (mechanisms supported by the text): expanded information‑gathering and entry powers (Part 7) and compulsory attendances give VAGO practical capacity to obtain evidence quickly (ss 30–33, 43). Audit specifications, mandatory consultations and annual planning create predictable work programs and avenues for external input (ss 16–18, 73–75). Information sharing and mandatory notifications integrate audits with integrity and law‑enforcement agencies (ss 66–69).
Trade‑offs, costs and incentives (source‑grounded):
- Compliance burden is placed on public bodies, associated entities and individuals required to respond to information gathering or entry notices; non‑compliance carries substantial criminal penalties (ss 30, 43, 52–55). Those entities also bear fees for audits and reviews payable into the Consolidated Fund (s 13).
- The Auditor‑General has broad discretion to decide audit scope, to issue or amend specifications and to delegate many functions within VAGO (ss 14–18, 8). Parliamentary Committee processes (ss 73–76) are the statutory check on that discretion and on budgets (s 77).
- The Act reduces some legal and contractual confidentiality barriers to evidence‑gathering (s 40), and it exempts certain audit materials from FOI (s 70). That increases VAGO access to information but reduces external public access to draft or working materials (s 42, s 70), raising potential tension between audit effectiveness and transparency over unpublished materials.
- Information sharing with other jurisdictions and agencies is enabled but limited by non‑disclosure rules and protections for commercial or investigatoryly sensitive material (ss 68–69, 27, 62, 65, 70–72). This balances investigative cooperation against risk of harm to private commercial interests or ongoing investigations.
Implementation risks and administrative costs evident in the Act: operating the new compulsory powers (e.g. arranging attendances, recordings, entry notices, interpreter and vulnerable‑person protocols) will require procedural capacity and recordkeeping (ss 32–37, 49–50). The Act also requires VAGO to manage confidential information securely and to report specified actions to Integrity Oversight Victoria (ss 37(6), 39, 51). Independent auditing of VAGO (ss 79–83) creates additional administrative and financial requirements.
Effects on private enterprise and contract freedom (source‑grounded): associated entities and third‑party contractors providing services to public bodies can be subject to performance audit scope and entry/inspection powers when those services relate to public functions or property (s 15, s 43(2)). The Act limits use of contractual confidentiality to refuse production of relevant information for audits (s 40(2)), which constrains parties' ability to rely on contractual secrecy in audit contexts.

Main concepts

The Act defines several key concepts in section 3. A “public body” is broadly defined and includes any public sector body within the meaning of the Public Administration Act 2004, corporate or unincorporated bodies established for a public purpose by or under an Act (including universities), entities of which the State or another public body has sole or joint control, councils under the Local Government Act 2020, State owned enterprises, trust bodies, trustees of trusts where the State or a council is the principal beneficiary, regional libraries, registered community health centres, and any other prescribed entity. Importantly, an “exempt entity” is excluded from the definition and includes a department of the Parliament, a court, or any other prescribed entity. An “associated entity” is any person or body that provides services or performs functions for or on behalf of a public body, and expressly includes contracted service providers, sub-contractors, agents, delegates, concession holders, trustees, partners in joint ventures, and third party contractors. This definition is critical because the Auditor-General may conduct performance audits and assurance reviews of the use of financial benefits or property given to associated entities (sections 15 and 21). A “performance audit” is defined by reference to sections 14 and 15 (for general audits) and section 82 (for audits of the Auditor-General). An “assurance review” has the same meaning as a limited assurance engagement within the meaning of the auditing and assurance standards. The Act distinguishes between “auditing and assurance standards” (standards made by the Auditing and Assurance Standards Board under the Corporations Act or ASIC Act) and “additional auditing and assurance standards” (standards made by comparable bodies). The Auditor-General must apply the former and may apply the latter (section 78). Part 7 introduces several new operational concepts: “information gathering notice” (a notice served under section 30), “entry notice” (a notice served under section 44), “authorised person” (a Deputy Auditor-General, person acting as Deputy, or senior VAGO officer authorised under section 29), and “VAGO officer” (a defined class including the Auditor-General, Deputy, employees, contractors, and authorised persons). The Act also creates a “public purpose audit arrangement” under section 24, allowing the Auditor-General to audit financial statements of non-public body entities that exist for a public purpose. The “Parliamentary Committee” is the Public Accounts and Estimates Committee under the Parliamentary Committees Act 2003. “Integrity Oversight Victoria” is defined by reference to the Integrity Oversight Victoria Act 2011, replacing the former Victorian Inspectorate. The Act provides for the Crown to be bound (section 3C) and for extra-territorial operation of Parts 3-7 and 9 to the full extent of the State’s legislative power (section 3B), covering land, things, acts, omissions, and transactions outside Victoria.

Who it affects

The Act directly affects a wide range of entities and individuals. The primary duty-bearer is the Auditor-General, who is appointed under section 94A of the Constitution Act 1975. The Auditor-General must perform all functions under the Act, including auditing public bodies, conducting performance audits and assurance reviews, reporting to Parliament, and exercising information-gathering powers. The Deputy Auditor-General and persons acting in those offices have powers while acting as deputy (section 5). VAGO officers, including all employees and contractors of VAGO, are subject to secrecy obligations (sections 71 and 72) and may exercise delegated powers. The independent financial auditor and independent performance auditor (appointed under Part 11) audit VAGO itself. Public bodies are the primary subjects of audit: every public body must have its financial statements audited at least annually (section 10) and must pay audit fees (section 13). Public bodies are also subject to performance audits (section 14). Associated entities are affected where they provide services for public bodies; they may be included in performance audits of financial benefits or property under section 15, and in assurance reviews under section 21. They may receive information gathering notices and entry notices, and must provide reasonable assistance (section 47). Ministers are affected in several ways: they receive audit opinions (section 11), must pay fees for audits of the annual financial report and estimated financial statements (section 13), must lay reports before Parliament (section 19), and are consulted on reports (sections 57 and 58). The Parliamentary Committee (Public Accounts and Estimates Committee) plays a significant oversight role: it comments on the Auditor-General’s draft annual plan (section 73), determines the budget (section 77), can vary obligations under the Financial Management Act (section 76), and recommends appointments of independent auditors (sections 79 and 82). IBAC receives mandatory notifications of suspected corrupt conduct (section 66). Integrity Oversight Victoria receives notifications of service of information gathering notices and entry notices (sections 39 and 51) and notifications of suspected misconduct of IBAC personnel and others (section 67). Entities not public bodies may enter into public purpose audit arrangements (section 24). Any person who receives confidential information from VAGO is subject to the unauthorised disclosure offence in section 72. The public is indirectly affected through the transparency and accountability of public sector financial management. The Act binds the Crown in right of Victoria (section 3C).

Key duties and rights

The Act imposes several key duties. The Auditor-General must audit the financial statements of each public body from time to time and at least once each year (section 10(1)), though part or all of an audit may be dispensed with (section 10(2)). After audit, the Auditor-General must express a written audit opinion within four weeks after receiving the financial statements (section 11). Copies of audit opinions must be given to the responsible Minister and, if modified or concerning matters requiring attention, to the administering Minister. The Auditor-General must express an audit opinion on each annual financial report of the State a reasonable time before it is transmitted to Parliament (section 12). For estimated financial statements, the Auditor-General must conduct an assurance review and report to Parliament on consistency, methodology, and reasonableness (section 19). The Minister must provide access to all requested documents (section 19(4)). The Auditor-General may conduct performance audits (sections 14, 15) and assurance reviews (section 20, 21) when considered necessary. Before any performance audit, the Auditor-General must prepare a specification (section 16), consult on a draft with relevant public bodies and the Parliamentary Committee (section 17), and provide the final specification (section 18). If the final specification is materially amended, further consultation is required (section 18(4)). The Auditor-General must report to Parliament on audits and assurance reviews (section 56) and must report on the annual financial report (section 57). Reports must not include trade secrets, information causing material disadvantage, information prejudicing investigations, findings of guilt, or recommendations for prosecution (sections 62, 65). The Auditor-General must not question the merits of government policy objectives (section 63). The Auditor-General must notify IBAC of suspected corrupt conduct (section 66) and notify Integrity Oversight Victoria of suspected misconduct of IBAC personnel, Ombudsman officers, VAGO officers, the Chief Examiner, or Examiners (section 67). Within three business days of serving an information gathering notice or entry notice, the Auditor-General must report to Integrity Oversight Victoria (sections 39, 51). The Auditor-General must prepare an annual plan before each financial year, submit a draft to the Parliamentary Committee, and transmit the final plan to Parliament (section 73). An annual report of VAGO’s operations must be prepared, sent to the independent financial auditor, and transmitted to Parliament (section 75). The Auditor-General has extensive rights: to call for information, documents, and attendances (section 30), to examine on oath or affirmation (section 33), to enter and inspect premises of public bodies and associated entities (section 43), to inspect and retain documents (section 41), to delegate powers (section 8), to engage contractors (section 7), to charge fees (section 13), and to share information with specified entities and other Auditors-General (sections 68, 69). Persons receiving information gathering notices have the right to legal representation (section 34) and the same protections as witnesses in the Supreme Court. Attendances must be audio or video recorded (section 37). Persons under 16 cannot be compelled (section 35). Vulnerable persons protections are required (section 50). The State must indemnify the Auditor-General, Deputy, acting officers, and employees against liability for good faith acts (section 9).

Penalties and enforcement

Part 7 Division 4 creates several criminal offences with significant penalties. Under section 52, a person who is served with an information gathering notice must not, without reasonable excuse, refuse or fail to comply. The maximum penalty is 240 penalty units or imprisonment for two years. The same penalty applies for failing to comply with an entry notice (section 53). Under section 54, a person served with an information gathering notice must not, without reasonable excuse, refuse or fail to take an oath or make an affirmation when required, or refuse or fail to answer a question. Again, the penalty is 240 penalty units or imprisonment for two years. However, subsection (3) provides a defence if the Auditor-General or authorised person fails to inform the person that refusal is an offence before requiring the oath or answer. Section 55 creates two separate offences: making a false or misleading statement to the Auditor-General or an authorised person (knowingly false in a material particular) carries 120 penalty units or imprisonment for 12 months; producing a document or thing known to be false or misleading in a material particular carries the same penalty, unless the person indicates the falsity and provides correct information. A note to section 55 also references perjury under section 314 of the Crimes Act 1958 and destruction of evidence under section 254 of that Act. Beyond Part 7, Part 9 creates additional offences. Section 71 applies to VAGO officers, the independent financial auditor, and the independent performance auditor: they must not make improper use of, or directly or indirectly disclose, information acquired in the course of their duties. Penalty: 120 penalty units or imprisonment for 12 months. Section 72 applies to any person who receives confidential information from VAGO: they must not disclose it except in specified circumstances. Penalty: 120 penalty units or imprisonment for 12 months. Confidential information includes proposed reports, draft reports, working documents, and information provided under information sharing provisions. The Act does not provide for civil penalties or infringement notices; enforcement is through criminal prosecution. The Act provides that a person is not subject to civil, administrative, or disciplinary proceeding solely because they complied with a request or information gathering notice (section 40(6)). Section 40 also provides that secrecy and confidentiality provisions in other enactments, rules of law, or contracts do not provide a reasonable excuse for failing to comply with an information gathering notice, except for Cabinet confidentiality where the notice is not for a financial audit, performance audit, assurance review, or another Act that expressly authorises provision. The Act does not create any private right of action for breach of its provisions.

How it interacts with other laws

The Act contains several provisions that expressly regulate its relationship with other laws. Section 40(2) provides that a person may comply with a request for information or documents despite anything in another enactment, rule of law, or contract that prohibits giving the information or imposes a duty of confidentiality, subject to Cabinet confidentiality limitations. Section 40(4) states that it is not a reasonable excuse to refuse compliance with an information gathering notice on grounds of other secrecy or confidentiality provisions, again with an exception for Cabinet confidentiality unless the notice is for a financial audit, performance audit, assurance review, or another Act authorising such provision. The Act explicitly overrides the Freedom of Information Act 1982: section 70 provides that FOI does not apply to documents of the Auditor-General or VAGO to the extent they disclose information about audits, assurance reviews, reports, or functions under the Gambling Regulation Act 2003. The Act also interacts with the Constitution Act 1975: the Auditor-General is appointed under section 94A of that Act, and reports published during recess have the same privilege as parliamentary publications (sections 59(7), 74(5)). The Act interacts with the Financial Management Act 1994: the annual financial report is defined by reference to that Act (section 24 of FMA), estimated financial statements under section 23H of FMA, and the Auditor-General must audit those statements and reports. The Act also references the Public Administration Act 2004 for definitions of “department” and “Department Head”, and for employment of VAGO staff under Part 3 of that Act (section 6). The Act interacts with the Corporations Act: the Auditor-General may accept appointment as auditor of a State company under the Corporations Act (section 22); auditing and assurance standards are those made under the Corporations Act or ASIC Act (section 3 definition). The Act interacts with the Independent Broad-based Anti-corruption Commission Act 2011: the Auditor-General must notify IBAC of suspected corrupt conduct (section 66) and may refer matters; “corrupt conduct” is defined by reference to that Act. The Act now interacts with the Integrity Oversight Victoria Act 2011: notifications must be given to Integrity Oversight Victoria (sections 39, 51, 67). The Act also interacts with the Major Crime (Investigative Powers) Act 2004 for definitions of Chief Examiner and Examiner. The Act provides that the Electronic Transactions (Victoria) Act 2000 applies to the preparation and provision of reports, specifications, and audit opinions (note to section 3). Fee disputes under section 13 are referred to arbitration under the Commercial Arbitration Act 2011. The Act binds the Crown (section 3C) and operates extra-territorially (section 3B). The Act does not affect the operation of the Ombudsman Act 1973 or other integrity statutes except as expressly provided.

Amendment history

This version (No. 068) incorporates amendments as at 10 February 2025. The original Act was No. 2 of 1994, assented to on 27 April 1994, with Part 1 operative on that day and the rest on 1 July 1994. Significant amendments include the Audit (Amendment) Act 1999 (No. 53/1999), which restructured the office of Auditor-General effective 1 January 2000. The Audit (Amendment) Act 2003 (No. 36/2003) introduced performance audits and revised definitions. The Integrity and Accountability Legislation Amendment Act 2012 (No. 82/2012) inserted extensive provisions on compulsory appearances, examinations, and reporting to the Victorian Inspectorate (since replaced by Integrity Oversight Victoria). The Integrity and Accountability Legislation Amendment (A Stronger System) Act 2016 (No. 30/2016) expanded the definition of associated entity, introduced extra-territorial operation, and added new provisions on financial benefits. The single most transformative amendment was the Audit Amendment Act 2019 (No. 12/2019), which substantially rewrote the Act effective 1 July 2019. This repealed Parts 2, 2A, 2B, 3, 3A, 3B, 4, 4A, 5, 6, 7, and 8, and inserted entirely new Parts 2 through 13. Key changes in 2019 included: restructured provisions on acting Auditor-General and Deputy; new information gathering powers (Part 7) replacing former compulsory appearance provisions; new specification and consultation requirements for performance audits (sections 16-18); mandatory reporting to Integrity Oversight Victoria (then Victorian Inspectorate) on notices; new offences; revised reporting and consultation procedures; new Part 11 for independent audit of VAGO; and extensive transitional provisions (sections 85-93). The Local Government Act 2020 (No. 9/2020) updated references to local government reform, effective 1 July 2021. The Justice Legislation Amendment (Integrity, Defamation and Other Matters) Act 2024 (No. 31/2024) substituted references from “Victorian Inspectorate” to “Integrity Oversight Victoria” and made consequential amendments, effective 10 February 2025. Other amending Acts are listed in the Table of Amendments, covering 1995-2024, including minor amendments from the Commercial Arbitration Act 2011, Oaths and Affirmations Act 2018, and various omnibus Acts.

Litigation history

The Act itself does not refer to any specific litigation or court decisions. The source text contains no case citations, no references to judicial interpretation of any provision, and no mention of any legal proceedings. The only dispute resolution mechanism explicitly provided in the Act is arbitration: under section 13(4), if a public body or Minister disputes the reasonableness of an audit fee, the dispute is referred to arbitration under the Commercial Arbitration Act 2011. The Act also provides that a person attending before the Auditor-General or an authorised person has the same protection and immunity as a witness in a proceeding in the Supreme Court (section 34(3)), and a legal practitioner has the same protection and immunity as in representing a party in the Supreme Court (section 34(2)). This suggests that analogous protections from defamation, self-incrimination, and legal professional privilege may apply, but the Act does not elaborate. Section 37(2) provides that evidence of anything said during a compulsory attendance is inadmissible in any court or tribunal unless the attendance was audio or video recorded and the recording is available to be tendered, unless a court or tribunal admits it in exceptional circumstances. Section 37(5) allows the person to listen to or view the recording at VAGO premises if the Auditor-General decides not to provide a copy. Section 59(7) provides that reports published by the Auditor-General on the website during parliamentary recess are absolutely privileged as if published by the Government Printer under parliamentary authority. Section 74(5) provides the same privilege for the annual plan. These provisions reflect an intention to protect the Auditor-General’s reports from defamation or other legal challenge, consistent with parliamentary privilege. The Act does not expressly preclude judicial review of the Auditor-General’s actions or decisions, and general administrative law principles would apply. No provisions of the Act have been the subject of litigation referenced in the source text.

Gotchas

Several provisions in the Act contain traps for the unwary. The 15-business-day consultation window for draft performance audit specifications (section 17(3)) and amended specifications (section 18(6)) is critical: if the public body, associated entity, or other entity does not respond within that period, they are deemed to have no comment, and the Auditor-General may finalise or continue. This deeming provision applies equally to consultation on the independent performance auditor’s specification with the Auditor-General (section 82(8)). The 10-business-day consultation period for reports on performance audits and 5-business-day period for other audits (section 58(2)(c)) also carry weight; comments must be made by the specified date to be included. The 5-business-day minimum service period for information gathering notices (section 32(1)) and entry notices (section 45(1)) can be shortened if the Auditor-General considers delay likely to prejudice the conduct of the audit, or if the person consents. Persons served with notices cannot rely on general secrecy or confidentiality provisions as a reasonable excuse for non-compliance (section 40(4)), except for Cabinet confidentiality and only for non-audit purposes (section 40(5)). The offence provisions in Part 7 are strict in the sense that only “reasonable excuse” is a defence. Persons attending must be informed that refusal is an offence before being required to take an oath or answer questions; failure to so inform means no offence is committed (section 54(3)). The requirement to audio or video record attendances is mandatory (section 37(1)); otherwise evidence is generally inadmissible. The Auditor-General must report to Integrity Oversight Victoria within three business days of serving either type of notice (sections 39 and 51). Failure to do so does not invalidate the notice but could be a breach of duty. The Auditor-General cannot delegate the power to express an audit opinion under section 12 (on the annual financial report of the State) or to make reports under sections 19, 56, 57, or 60, or the delegation power itself (section 8(1)). Delegation to a registered company auditor of the power to express an audit opinion under section 11 is limited to public bodies whose total expenditure does not exceed the threshold amount, which is indexed to CPI from a 2018 base (section 8(2)-(4)). The independent performance auditor must conduct an audit at least once every four years (section 82(4)), and the independent financial auditor must audit at least once each financial year (section 79(4)). The Auditor-General must not question the merits of government policy objectives (section 63). This is a significant restriction on the scope of reports. The definition of “policy objectives” is broad, including a Government policy direction of a Minister, a policy statement in a Budget Paper, a statement of objectives in a corporate plan approved by a Minister, and any other document evidencing a policy decision. The Act also prohibits including in reports any finding that a specified person is guilty of an offence or any recommendation for prosecution (section 65(1)). Adverse comments about named officers or employees must be preceded by a reasonable opportunity to respond (section 65(2)). The public body, associated entity, or other entity must provide that opportunity, not the Auditor-General.

How to comply

For public bodies, compliance begins with ensuring financial statements are prepared each year and submitted to the Auditor-General for audit. The Auditor-General must receive the statements; once audited, the Auditor-General expresses an opinion within four weeks (section 11(2)). The public body must pay the audit fee determined by the Auditor-General; disputes go to arbitration under the Commercial Arbitration Act 2011 (section 13(4)). If the Auditor-General conducts a performance audit, the public body should expect a draft specification and must respond within 15 business days or be deemed to have no comment (section 17(3)). After a final specification is provided, the public body must cooperate with information requests, whether by consent or pursuant to an information gathering notice. Compliance with an information gathering notice is mandatory; failure without reasonable excuse is an offence with up to two years imprisonment. If an entry notice is served, the public body must provide all reasonable assistance (section 47). The public body must also ensure that any officers or employees who are named in a proposed report are given a reasonable opportunity to respond to adverse material (section 65(2)). For associated entities, the same duties apply if they are included in a performance audit under section 15 or an assurance review under section 21. They should respond promptly to consultation requests. They may also be subject to entry notices if premises are used predominantly for providing services to a public body or contain public property (section 43(2)). VAGO officers must comply with the strict secrecy and confidentiality obligations in sections 71 and 72; improper use or unauthorised disclosure of information acquired in the course of duties is an offence. They must also comply with the protocols for interacting with vulnerable persons when entering premises (section 50). The Auditor-General must follow the specification procedures (sections 16-18), consult with the Parliamentary Committee as required, report to Integrity Oversight Victoria within three business days of serving any notice (sections 39, 51), and ensure that all reports comply with the content restrictions (sections 62-65). The Auditor-General must also prepare an annual plan (section 73) and annual report (section 75). Both independent auditors must comply with directions from the Parliamentary Committee and must respect the same reporting restrictions as the Auditor-General (sections 81, 83). Any person who receives confidential information from VAGO (including proposed reports, draft reports, working documents, or information shared under sections 68 or 69) must not disclose it except in the specific circumstances listed in section 72(2): making submissions on a proposed report, obtaining legal or financial advice, if already public, if required for official duties as an officer of a public body or Department Head, if required for official duties by another Auditor-General, or if the Auditor-General consents. Breach is an offence with up to 12 months imprisonment.