Energy 2024

This report summarises the audit results of Queensland’s state-owned energy entities. These entities generate, transmit, and distribute electricity for Queensland, and provide retail services to residential, commercial, and industrial customers. This report also outlines the progress on Queensland’s transition to renewable energy to October 2024. This report does not cover changes in the strategy following the change in government, except for the cancellation of Pioneer-Buderkin Pumped Hydro Project – those will be included in our Energy 2025 report.

The entities’ financial statements are reliable

We issued 7 audit opinions for the energy sector. The financial statements of the energy entities are reliable and comply with relevant reporting requirements. All energy entities met the legislative deadlines for signing their financial statements.

Security issues with information systems are increasing

This year, we identified more security issues in systems and processes (internal controls) than last year because we tested more systems and identified similar issues across multiple systems. The majority related to how entities manage and restrict access to their information systems. We also found that entities had not addressed the root causes of deficiencies from prior years. They are taking steps to address the weaknesses, but these security issues expose them to cyber attacks.

Energy Queensland’s digital transformation is re-focusing

As part of its digital program, Energy Queensland is implementing a series of targeted releases of systems for asset management, data management, governance, and cyber security. By shifting its focus from a large, single-release program, it aims to improve monitoring and reduce implementation delays. As of 30 June 2024, it had spent $706 million on its digital transformation program.

Financial results across energy entities varied

The generators and retailer improved their profitability, but the transmission entity had a lower profit and the distribution entity reported a loss. The generators and retailer improved their results as they benefitted from changes in the value of contracts used to manage fluctuations in wholesale electricity prices. The generators also recorded lower write-downs in the value of their assets.

The lower results of transmission and distribution entities were impacted by higher employee numbers and salaries, and higher costs because of inflation. The future profitability of these entities depends on their ability to reduce their operating costs, increase their revenues generated from their customers, or to fund any shortfalls. The shortfalls can be funded by additional debts or from shareholders.

The energy transition is progressing

On 18 April 2024, the Queensland Government passed the Energy (Renewable Transformation and Jobs) Act 2024. The first annual progress statement in September 2024 indicated that the state is on track to meet its renewable energy targets under the current legislation, despite some delays in the milestones originally scheduled for completion in 2024.

Learnings from Callide power station incidents

Incidents at Callide units C3 and C4 coal-fired plants significantly affected CS Energy’s financial performance. In July 2024, CS Energy released 2 reports and an action plan in response to these incidents. We encourage all energy entities to apply the learnings from these to strengthen their process safety controls and the safe operation of their critical and ageing infrastructure assets.

We do not make any new recommendations to energy entities this financial year. For a list of prior year recommendations and their status, see Appendix D.

Status of recommendations made in Energy 2023 (Report 5: 2023–24)

The energy sector entities are addressing recommendations we made in last year's report. Despite this, we have found control weaknesses that require further action regarding the security of information systems. We have reported these weaknesses and the related areas for improvement to the relevant entities.

We have included a full list of prior year recommendations and their status in Appendix D.

Reference to comments

In accordance with s.64 of the Auditor-General Act 2009, we provided a copy of this report to relevant entities. In reaching our conclusions, we considered their views and represented them to the extent we deemed relevant and warranted. Any formal responses from the entities are in Appendix A.

In Queensland, state government owned corporations generate, transmit, and distribute electricity, and provide retail services to customers. As part of the Queensland Energy and Jobs Plan, they are investing in renewable energy projects, connecting projects to the electricity network, and upgrading and expanding the electricity grid. The following diagram shows their roles in the Queensland energy sector supply chain.

This chapter gives an overview of our audit opinions for the energy sector entities. It also provides conclusions on the effectiveness of the systems and processes (internal controls) entities use to prepare financial statements. It then gives an update on Energy Queensland’s digital transformation program.

Chapter snapshot

Notes:

• A deficiency arises when internal controls are ineffective or missing, and are unable to prevent, or detect and correct, misstatements in the financial statements. A deficiency may also result in non-compliance with policies and applicable laws and regulations and/or inappropriate use of public resources. A significant deficiency is a deficiency, or a combination of deficiencies, in internal controls requiring immediate remedial action.
• The Australian Energy Regulator uses regulatory information notices to collect information from the distribution entities, to assist it in deciding how much these entities can earn.
• Entities must have Australian financial services licences if they enter into fixed-price contracts to manage the future risk of fluctuating electricity prices. These entities must lodge an annual compliance form with the Australian Securities and Investments Commission. 

Audit opinion results

We issued unmodified audit opinions for all state-owned energy entities in Queensland. This means the results in their financial statements can be relied upon, as they were prepared in accordance with the relevant legislative requirements and Australian accounting standards.

All entities reported their results within their legislative deadlines. Appendix E provides details on the audit opinions we issued for energy sector entities in 2024.

This year, we issued an unmodified audit opinion on the financial statements of CS Energy Financial Services Pty Ltd, which we audited for the first time in 2023–24. It prepared these statements to comply with the reporting requirements for holding an Australian financial services licence.

Last year, we audited the financial statements of Yurika Pty Ltd, to comply with Queensland Building and Construction Commission licence requirements. We issued an unmodified audit opinion. This year, we did not need to audit it separately and have tested it as part of our audit of the consolidated financial statements of Energy Queensland.

Other audit certifications

The distribution entities prepare regulatory information notices for the Australian Energy Regulator and include actual and estimated financial and non-financial information. We issued 8 unmodified audit opinions for actual financial data and 12 unmodified review conclusions for estimated financial and non-financial data (such as the number of customers connected to the distribution network during the year).

In 2023–24, the distribution entities updated how they classify the overhead costs they report in the regulatory information notices, as instructed by the Australian Energy Regulator. We issued audit opinions for the resubmitted information, covering the period from 30 June 2021 to 30 June 2023.

Energy entities must hold an Australian financial services licence to be able to trade in electricity financial products to manage the risk of fluctuating electricity prices. They must also comply with the conditions of those licences. We issued 4 unmodified audit opinions relating to these licences.

In Appendix E, we list the assurances we performed during the year on regulatory information notices and Australian financial services licences.

Entities not preparing financial statements

For each state public sector company, other than government owned corporations, the board of directors considers the requirements of the Corporations Act 2001 and the company’s constitution to determine whether financial statements need to be prepared.

When entities are part of a larger group and are secured by a guarantee with other entities in that group (that they will cover their debts), the Australian Securities and Investments Commission allows them to not prepare a financial report. In addition, dormant or small companies that meet specific criteria under the Corporations Act 2001 are not required to prepare financial statements. Appendix F lists the energy entities that are not required to produce financial statements for 2024.

Internal controls are generally effective, but entities must address security issues with their information systems

We assess whether the internal controls entities use to prepare financial statements are reliable. We report any deficiencies in the design and/or operation of those internal controls to management for their action. The deficiencies are rated as either significant deficiencies (those of higher risk that require immediate action by management) or deficiencies (those of lower risk that can be corrected over time).

The number of deficiencies has increased

Overall, we found the entities’ internal controls are generally effective but need further improvement, particularly in relation to information systems. We identified 78 control deficiencies this year. Of these, 86 per cent related to weaknesses in the security of information systems. 

Several factors have resulted in the number of deficiencies increasing this year, including:

• we tested additional information systems this year because of an extended scope and upgrades in existing systems. We found the same types of deficiencies arising across multiple systems
• a lack of root cause analysis by entities to prevent similar issues from occurring and to ensure system controls continue to operate effectively. We rated some of the deficiencies as significant, as they have remained unresolved for lengthy periods. This puts the entities at risk of cyber attacks
• legacy (older) systems that limit the implementation of strong security measures, as they may no longer be supported or may not integrate effectively with current systems.

While it is critical that entities address these deficiencies to improve the security of their information systems, we were able to rely on the systems and processes they used to prepare financial statements. 

The energy entities continue to work on resolving control deficiencies from previous years.

Entities need to proactively identify and address security weaknesses in their information systems

Of the total number of deficiencies we found this year, we assessed 6 as significant (2023: 2), requiring immediate action. They related to entities:

• not setting appropriate authorisation limits for payments in their banking portals (a number of users had higher limits than their delegations allowed)
• not monitoring the activities of users with full-system (unrestricted) access to information systems
• not performing regular reviews of users’ access to ensure it aligns with what they need to perform their roles. (More than one of the significant deficiencies we identified related to this)
• having a high number of users with full-system access, which means they can make significant changes to system configuration and bypass security settings. This is contrary to Australian Cyber Security Centre principles and software vendor recommendations
• having weak password settings for service accounts. These are special types of accounts that are used to run automated business processes, and they are used by applications rather than people. Service accounts should be secured to prevent any human interaction, given that their role is to run processes and enable communication between systems without any human input.

We also identified several other deficiencies (not rated as significant) about the same types of issues. The most common related to entities not restricting users’ access appropriately (access management), not adequately monitoring the activities of users who can access sensitive data, and not enforcing stringent password settings for all users (security configuration).

Recent cyber security incidents have shown these types of weaknesses can lead to compromised systems. By strengthening their internal controls, entities can better manage the risk of potential attacks and protect against future threats.

Entities need ongoing effort to effectively manage cyber risks It is essential that entities continuously manage cyber risks. We encourage all entities to regularly self-assess the strengths of their information systems against the recommendations we made in: Managing cyber security risks (Report 3: 2019–20) Responding to and recovering from cyber attacks (Report 12: 2023–24).

As highlighted in the Queensland Audit Office’s Forward work plan 2024–27, we intend to undertake an audit on managing third-party cyber security risks. It will examine how effectively the Queensland Government identifies third parties with access to its data and networks, assesses related security vulnerabilities, establishes relevant controls, and minimises the impact of security breaches through these third parties.

Energy Queensland’s digital transformation program

Energy Queensland’s digital transformation program began in 2016, with the aim of replacing its outdated technology systems. It has faced challenges, including changes in scope and implementation delays. 

As of 30 June 2024, Energy Queensland has:

• spent $706 million of the $717 million budget approved in 2022, including costs for the payroll system implemented in November 2023. The total expenditure to date includes a write-off of $85 million for program components no longer expected to deliver benefits, of which $43 million relates to 2023–24

• revised its program scope and associated budget to $850 million, down from last year’s estimate of $952 million. This change reflects a modified scope and includes the addition of new components to meet the entity’s system requirements. It excludes other components related to outdated programs, and now has a reduced budget for coping with contingencies. Certain project elements are still being re-scoped. They will likely require additional approvals and further budget adjustments.

Energy Queensland began reviewing the program scope and budget in 2023. Our Energy 2023 (Report 5: 2023–24) report highlighted that it changed the implementation strategy from a single-release program to a series of projects and releases. It also outlined strengths and weaknesses of the program, and the actions that Energy Queensland was planning to implement. Energy Queensland has continued to work on these actions, including enhancing leadership and oversight, and aligning the program with business outcomes.  

The new approach will focus on addressing gaps in information technology requirements and enhancing cyber security measures.

Delays in implementing the program may increase project costs and affect returns from Energy Queensland to the Queensland Government (the shareholder). Management will continue to monitor progress of the projects to ensure timely completion within the approved budget.

This chapter analyses the financial performance and position of energy sector entities. We also consider emerging issues relevant to the sector.

Chapter snapshot

Results across energy entities varied

The generators and retailer significantly improved their performance compared to the previous year. The transmission entity had a lower profit and the distribution entity continued to experience a loss. Figure 4A outlines the profits of these energy entities.

Returns to the Queensland Government (the shareholder) have significantly increased

Returns to the Queensland Government, as shareholder, are made up of dividends payable (a share of profits paid to the shareholder), and income tax equivalents (which are taxes payable by commercial operators in government so they do not have a competitive advantage over other, non-government operators).

In 2023–24, total returns to the state government amounted to $986 million, an increase of $713 million (261 per cent) from the previous year. Figure 4B expands on this.

Cost-of-living rebates were the main reason for a significant increase in support to customers this year

Support to customers refers to government payments and other subsidies aimed at reducing electricity costs for customers. It also includes incentives to support customers who generate their own solar energy. Total support to customers amounted to $2,541 million in 2023–24, an increase of 70 per cent from 2022–23. Figure 4C shows the support to customers from 2020–21 to 2023–24.

Wholesale electricity prices in Queensland reduced in 2023–24 compared to the previous year. Lower wholesale prices do not automatically translate into lower retail prices for customers, for several reasons. Retail prices do not just include wholesale costs. They also have to take into account network fees for maintaining the infrastructure that delivers electricity to customers, as well as charges from retailers for their services.

Another factor is the timing of when retail prices are set, which may not reflect immediate changes in wholesale prices. For these reasons, governments fund various rebates, concessions, and payments – to offer relief to customers.

Cost-of-living and other electricity rebates and concessions of $1,613 million contributed to the significant increase in support provided to customers for 2023–24. Of this amount, 85 per cent (2023: 62 per cent) relates to electricity rebates for households and small businesses, as announced in the government’s 2023–24 state budget.

The Queensland Government, through various departments, allocates funds and disburses rebates to retailers (including Ergon Energy Queensland), who then apply these rebates to customers’ electricity bills to reduce their payments.

The timing of payments depends on individual customers’ billing cycles, with some being paid a one-off amount and others on a quarterly basis. These rebates do not affect the revenue of Ergon Energy Queensland, as they are passed directly through to customers.

Figure 4D outlines the 3 types of cost-of-living rebates paid from 2022–23 to 2023–24, and those planned for 2024–25. 

The community service obligation payments made to Energy Queensland remained stable from last year. They subsidise the higher costs of providing electricity to regional Queensland.

The Solar Bonus Scheme and feed-in tariffs relate to payments made by Energy Queensland, and its subsidiary Ergon Energy Queensland, to customers for the electricity they contribute to the energy grid through their rooftop solar.

They are a combination of payments under the Solar Bonus Scheme (which pays a fixed rate of 44 cents per kilowatt hour generated) and ordinary feed-in tariff payments at the rates set by the Queensland Competition Authority. The Solar Bonus Scheme is closed to new customers and will end for existing eligible customers on 1 July 2028. The increase in 2023–24 (as shown in Figure 4C) is due to increased uptake of rooftop solar.

Queensland wholesale electricity prices have decreased

Average wholesale electricity prices in Queensland have decreased in the past 2 years, driven by a more stable supply of and demand for electricity, and the greater availability of renewables.

The average annual wholesale prices across the other states in the National Electricity Market (NEM) have also decreased this year, in contrast to the increases they experienced in 2022–23.

Figure 4E shows the changes in the wholesale electricity prices in Queensland and the NEM states since last year.

Progress is being made towards renewable energy targets

On 18 April 2024, the Queensland renewable energy targets became law through the Energy (Renewable Transformation and Jobs) Act 2024 (the Act). These targets require 50 per cent of electricity generated in Queensland to be from renewable sources by 2030, then 70 per cent by 2032, and 80 per cent by 2035. The Act established the Queensland Energy System Advisory Board, which is tasked with advising the government on the progress of the state's energy system transition. 

In September 2024, the board released its first annual progress statement, outlining the high-level milestones achieved during 2023–24 and Queensland’s progress towards decarbonising its electricity system. These included identifying new renewable energy zones and developing funding plans. 

As of October 2024, some Queensland Energy and Jobs Plan (QEJP) milestones due by 2023–24 had been delayed, including:

• finalising an environmental upgrade agreement framework, which could allow for lenders to offer loans for environmental upgrades to commercial property owners, which are paid back through local government rates
• building capacity to manufacture components for technologies such as batteries and electrolysers (electrolysers are used to split water into hydrogen and oxygen)
• planning how local manufacturers and suppliers will be involved in renewable projects
• updating the Hydrogen Industry Development Strategy, which is the government's plan for growing the local hydrogen industry
• developing guidelines and procedures for the Job Security Guarantee Fund, which helps maintain employment for government energy-sector employees during the transition to renewables
• early works for the Borumba Pumped Hydro Energy Storage project, largely due to the timing of regulatory approvals.

The Department of Energy and Climate (now part of Queensland Treasury) considers these to be in progress, except the environmental upgrade agreement framework.

Since the initial release of the Queensland Energy and Jobs Plan in 2022, the department has provided high-level updates through the 2023 Queensland Energy and Jobs Plan Update and the departmental website on the status of its activities. It has not, however, reported on the achievement of the original detailed implementation activities, which are set for completion between 2022 and 2026.

In its annual progress statement, the board highlighted that, despite the delays, the state was on track to achieve the 3 renewable energy targets in the Energy (Renewable Transformation and Jobs) Act 2024.

Renewable energy generation is steadily increasing

Queensland’s energy mix includes more renewables each year. Figure 4F highlights the increasing proportion of Queensland’s generation profile that comes from renewable energy sources. It also shows that coal is still the main source of energy in Queensland.

Our Major projects 2024 report will outline the status of energy sector projects such as the CopperString project (a transmission line running from Townsville to Mount Isa that will connect the north west minerals province to the national electricity grid).

In Energy 2023 (Report 5: 2023–24), we highlighted the key risks and challenges the Queensland Government needs to monitor and address in delivering significant infrastructure projects. Some of the risks that could affect the government’s ability to meet the renewable energy targets include potential delays or cancellations of renewable energy projects.

The Pioneer-Burdekin Pumped Hydro project was cancelled in November 2024 and the feasibility of replacing it with smaller hydro projects is being explored. 

In line with our previous recommendation in Managing Queensland’s transition to renewable energy (Report 5: 2021–22), the government will assess its progress towards these targets by 2025.

Learnings from the Callide power station incidents

An incident at Callide Unit C4 in 2021 forced the generation unit offline, and Callide Unit C3 in 2022 experienced a partial collapse of its cooling tower. These incidents at the coal-fired plants significantly impacted on CS Energy’s financial performance due to:

• lower generation capacity, which reduced revenues
• significant repair and maintenance costs to return the units to service
• increased effort and costs associated with negotiating complex insurance claims. Claims for lost revenues and rebuilding the Callide Unit 4 are still pending. As reported in its annual report, CS Energy has begun legal proceedings against its insurers.

CS Energy published its action plan – A safer, better CS Energy – in response to the Brady Heywood investigation of the Callide Unit C4 incident and the Hartz EPM report into the partial collapse of the Callide Unit C3 cooling tower. The action plan outlines how it is applying learnings from the incidents to improve the safety, reliability, and resilience of its operations. 

The Brady Heywood investigation report into the Callide C4 incident highlights the importance of effective risk management and process safety controls to prevent asset failures in the energy sector.

The state-owned energy entities continue to work on plans to improve their asset management processes. Safe operation of energy assets is critical for ensuring affordable and reliable electricity. As these assets age, having robust maintenance, inspection, and testing programs becomes essential to maintaining their safe operation.  

Developments in reporting standards

The Australian Government has recently introduced new standards on climate reporting. This is to improve transparency in climate reporting by the Australian corporate entities, which also applies to the state-owned energy entities.

These changes reflect the evolving landscape of the energy sector and the growing importance of reporting on sustainability and renewable energy in financial reports.

Climate-related disclosures report

Energy entities must present their first climate-related disclosure reports within their annual reports for the financial year ending 30 June 2026.

In the first year of reporting, they are required to report on their Scope 1 and Scope 2 greenhouse gas emissions, governance practices, and strategies related to sustainability. They will be required to report on their Scope 3 emissions in the following year. The Queensland Audit Office will audit and validate the accuracy and completeness of these disclosures.

Readiness of energy entities for climate-related reporting

Entities are at varying stages of preparedness for the new reporting requirements. While plans are underway, challenges remain, particularly in terms of the quality of data collection and accuracy of their reporting.

We will work with the energy entities this year on preparing for a climate reporting and assurance process. This year, we conducted a survey to assess the preparedness of the entities. It focused on how ready they are to identify climate-related challenges, establish governance arrangements, and manage processes to gather the required data to enable reporting. 

Figure 4G summarises the results of the survey.

The introduction of new climate reporting standards, including obligations to report on emissions, represents a significant change in reporting practices. This will require careful planning and implementation. To comply with their climate reporting obligations, energy entities will need to adequately prepare by:

• assessing the risks and opportunities that climate change may have on their operations, and how these factors affect their financial statements
• consulting with Queensland Treasury and applying the guidance it will issue for measuring and reporting emissions for Scopes 1, 2, and 3.

Reporting on contracts for purchasing renewable electricity

In May 2024, the Australian Accounting Standards Board released a draft standard – Contracts for Renewable Electricity. This document aims to provide more guidance on how entities recognise and measure renewable power purchase agreements in their financial statements.

The changes are planned to take effect in the 2025–26 financial year. We will engage with the energy entities and assess any impacts on their financial reports.