A $20m monopoly regulator ran its purchasing on undocumented habits

The Nursing Council of New Zealand has a business model most companies would envy. Its customers have to pay, the fees keep rising and there is no competitor. That captive income appears to have let basic financial controls slide, until an external audit forced the issue.

An internal audit of contracting and purchasing, carried out by PwC, found a litany of failures and informal practices, according to the NZ Herald. The council relied on systems without adequate controls that were generally undocumented. Its own executive summary is blunter than any critic could be. The findings showed “widespread and large-scale failings in fundamental management practices, posing major risk to the Council.”

The council has briefed the Minister of Health and the Ministry of Health and formally notified the Office of the Auditor-General. External auditor Baker Tilly began investigative fieldwork this month. The annual report, due in September, is still delayed.

A $1 million contract under the microscope

Part of that fieldwork targets the contract for the Objective Structured Clinical Examination centre in Christchurch, where internationally qualified nurses sit tests for New Zealand registration. Nurse Maude holds the contract. PwC identified wide-ranging irregularities around how it was awarded, as well as a separate establishment cost understood to exceed $1 million.

No finding of wrongdoing has been made. But a seven-figure award with irregular paperwork is exactly the kind of transaction that documented procurement rules exist to protect.

Revenue grew faster than the controls

The council is not short of money. Its 2025 annual report showed revenue of $19.86 million for the year to March 2025, up from $17.99 million. The surplus more than doubled, from $1.53 million to $3.58 million. The same report also showed operating cash flow swinging from a positive $6.9 million to a negative $740,517, a sharp reversal sitting quietly underneath a clean audit opinion.

That growth followed an even bigger jump. In 2025, the Audit Office reported that the council’s revenue rose 46% in 2022/23, driven by a 201% surge in international nurse applications. That was the largest increase among the five health regulators it examined. All five received clean opinions, but the Audit Office still flagged internal control risks across most of them, specifically journal entry approvals and segregation of duties.

In hindsight, that was the warning. A regulator whose income was climbing by millions needed its controls to scale with it. Going by PwC’s findings, they did not.

The checklist was already published

None of this required new guidance. Back in 2024, the Auditor-General set out what good public procurement looks like. Organisations must be able to give complete and accurate accounts of how they use public money, keep records supporting key decisions, and manage conflicts of interest with declarations and a register of interests.

Then-Auditor-General John Ryan wrote in 2024 that conflict of interest management is something all public sector leaders should focus on getting right in their organisations. “Generally undocumented” systems are close to a point-by-point failure against that list.

Questions for the board table

Governance will inevitably come into focus. In 2025, The Post reported that ministers and MPs hand-picked all three nurse members appointed to the council, bypassing candidates put forward by official nominating agencies. Five such candidates missed out.

There is no evidence those appointees are implicated in the procurement failings, and it would be unfair to suggest otherwise. But the episode raised a legitimate question about how board capability and independence are assured at a body handling nearly $20 million a year. The PwC report makes that question harder to dismiss.

The lesson business already knows

Any private firm with a $20 million revenue base would be expected by its bank, its insurer and its auditor to have written procurement policies, a conflicts register and separation between whoever approves a payment and whoever makes it. Miss those and the consequences arrive quickly, in the form of covenant breaches, premium rises or customers walking.

The Nursing Council faced none of that pressure. Nurses cannot withhold their practising certificate fee or switch regulators. Monopoly fee-funded bodies are left to mark their own homework, and the audit system catches problems only after they have grown large enough to call “major risk”.

The next milestones are Baker Tilly’s conclusions on the OSCE contract and the $1 million-plus establishment cost, and whether the Auditor-General goes beyond receiving the notification. Nurses paying the bill deserve a full public account. So does every business owner who keeps a conflicts register because they are told to, and wonders why the regulators did not.

Sources

• NZ Herald: Nursing Council audit finds procurement and payment control failures, Auditor-General notified (2026-11-14)
• The Audit Office: Part 4, Results from our audits and financial trends (2025)
• The Audit Office: Part 1, Introduction (health insights) (2025)
• The Audit Office: Part 1, Key elements of good procurement (2024)
• The Audit Office: Strengthening government procurement, Lessons from our recent work (2024-05)
• The Post: Ministers bypassed usual process to hand-pick Nursing Council members (2025-09-25)