Top 4 lessons from an ICAC NSW Health employee investigation

The NSW corruption watchdog said this investigation highlights recruitment, procurement, conflicts of interest and governance lessons for all organisations.

The NSW Independent Commission Against Corruption (ICAC) has released its report of an investigation into the conduct of former NSW Health director of engineering and asset management Zoran Ribicic. In its Operation Tivoli investigation, ICAC found that, for more than a decade, the former Illawarra Shoalhaven Local Health District (ISLHD) — a division of NSW Health — employee engaged in serious corrupt conduct.

This conduct involved false qualifications, undisclosed conflicts of interest and unauthorised secondary employment, with ICAC saying it will refer relevant evidence to the NSW Director of Public Prosecutions regarding possible fraud offences. Ribicic also improperly awarded work to his sister’s company, split contracts to avoid going through competitive processes, failed to declare conflicts of interest and took on secondary employment while working in a senior public sector role, ICAC said.

ICAC said the Operation Tivoli investigation report “identifies important lessons for all organisations regarding recruitment, procurement, conflicts of interest and governance”.

Lesson 1: Verify credentials, don’t simply accept them

Ribicic had faked his qualifications and used false references to obtain several public sector positions between 2012 and 2025, ICAC found. Qualifications including a doctorate in business administration, a master’s degree in project management, a bachelor’s degree in engineering and a TAFE Engineering diploma were dishonestly represented by Ribicic, ICAC said. Ribicic also provided false references in support of employment applications. Transport for NSW, Illawarra Shoalhaven Local Health District (NSW Health), Port Authority of NSW and Penrith City Council all failed to detect dishonesty and hired him, ICAC revealed.

“Operation Tivoli demonstrates the importance of independently verifying qualifications, registrations and references,” ICAC said. “The Commission’s investigation identified weaknesses in recruitment due diligence and highlights the importance of checking qualifications directly with issuing institutions, conducting rigorous referee checks, and regularly reviewing recruitment practices to ensure they remain effective. With the rise of artificial intelligence, it will be even more important for human resources staff to verify documents and references at source.”

Lesson 2: Personal relationships must be disclosed

Ribicic knowingly failed to declare a conflict of interest involving his sister, whose company Risk Control Consulting (RCC) was engaged to undertake work for ISLHD. Between March 2022 and July 2024, RCC received more than $275,000 in payments from ISLHD, with Ribicic managing the engagement and approval process. Ribicic deliberately concealed the conflict and improperly favoured the company over potential competitors, ICAC found.

“Transparency, early disclosure and independent oversight are essential safeguards against favouritism, misconduct and loss of public trust,” ICAC said about this lesson concerning conflicts of interest, nepotism and favouritism.

Lesson 3: Watch for procurement red flags

Through a process of ‘order splitting’, ICAC found that hundreds of thousands of dollars of taxpayers’ money was improperly awarded by Ribicic to external contractors, including RCC. He was authorised to approve quotes up to $30,000, and requested favoured suppliers to break much larger bodies of work into bundles below $30,000, a move that allowed him to engage his family and associates without the competition and oversight that would ordinarily apply to substantial contracts.

“Order splitting can be a lazy way of shortcutting proper procurement processes, or it can be the means by which corruption occurs,” ICAC said. “Either way, order splitting avoids proper oversight and accountability for public expenditure. Agencies should ensure their procurement processes include effective oversight, segregation of duties, conflict of interest controls, supplier due diligence and data analytics that identify unusual spending patterns and procurement anomalies.”

Lesson 4: Secondary employment must be transparent

It was also found by ICAC that while working full-time at ISLHD, Ribicic deliberately failed to declare and seek approval for secondary employment. He received $210,375 for 10 months’ work with a private company that Ribicic had previously brought on as a consultant to ISLHD while employed in his senior public sector role.

“As more workers utilise flexible arrangements, undeclared secondary employment is a growing risk,” ICAC said. “It can lead to unmanaged conflicts of interest, compromise public sector performance and undermine public confidence in the integrity of public officials. Disclosure and oversight arrangements are fundamental controls that help agencies identify and manage these risks.”

Commissioner comments

Regarding Operation Tivoli, ICAC Commissioner the Hon Helen Murrell SC said it “exposes how a determined and dishonest individual can exploit weaknesses in recruitment and procurement systems within the public service, and we hope that agencies across NSW will learn from our investigation and implement the Commission’s recommendations.

“Mr Ribicic held a senior role with NSW Health. By falsely claiming qualifications he did not possess, he secured a position of significant responsibility and public trust.

“This was not the first time — or the last time — that he lied to secure a public sector job. Over a period of more than a decade, he relied on false qualifications to obtain responsible positions with multiple agencies. When an agency hires an unqualified person who has dishonestly maintained they hold qualifications that they do not, it should come as no surprise that, once in the job, the person may perform the role dishonestly and/ or incompetently. It is an understatement to say that public confidence could be impaired by the recruitment of unqualified and dishonest people.

“Every organisation should ensure its governance controls are robust, transparent and capable of detecting misconduct.”

The full report can be downloaded here.

Image credit: iStock.com/jacoblund