HALIFAX -- Nova Scotia's auditor general says he was "shocked and troubled" to find a lack of oversight and basic financial management controls at Atlantic Canada's largest children's hospital.

"It is shocking to me that an organization the size of the IWK, that spends nearly $300 million a year, could have such widespread lack of controls over how it handled Nova Scotians' money entrusted to them to deliver health care," Michael Pickup told a news conference.

Pickup released an audit report Tuesday that was promised in 2017 amid an expense scandal that would eventually claim the jobs of two executives at the IWK Health Centre: CEO Tracy Kitch and chief financial officer Stephen D'Arcy.

Pickup's report says the IWK's board of directors did not create a culture that promoted accountability for the functioning of internal controls.

"The lack of adequate oversight by the board and management significantly increases the risk of fraud, theft, unauthorized transactions, inefficient spending and wasted money which the IWK Health Centre could have used for other organizational priorities."

Pickup found the board and management "did not create an expectation to report and investigate fraud" and didn't have a fraud policy in place.

The report also found 78 per cent of board and executive travel and other expenses paid did not comply with policies, including 32 instances where expenses were inappropriately approved. As well, 12 of 14 board expenses were approved by management but not the board and nine of the expenses had no receipts.

In October, police charged Kitch and D'Arcy with fraud and breach of trust.

Kitch faces charges of fraud over $5,000 and breach of trust, while D'Arcy faces charges of breach of trust, unauthorized use of computer and mischief to data. Both are scheduled to appear in Halifax provincial court on Dec. 20.

Pickup said that one of the things that will stay with him from the audit was the fact the hospital's former management went to the board in 2017 and told them internal controls were working "in part" because of the internal audit group they had.

"Well, they didn't have an internal audit group," Pickup said.

"The fact that nobody on the board questioned management to say: 'How can you say our internal controls are strong?', I find that concerning. I don't think you need a degree in governance to ask some of these questions or to do followup."

The report found the former chief financial officer submitted an $11,500 travel claim that included expenses outside the 60-day timeframe required by IWK Health Centre policy and that one of the expenses had been incurred 173 days before the claim was submitted.

It also found that in January 2016 the former chief financial officer submitted and inappropriately authorized two expense claims from 2014 for another member of the executive team totalling $2,000 with neither claim having receipts to confirm or support the expenses.

The report blamed business policies that were outdated and said appropriate policy guidelines were not developed.

As an example the report said management had not updated the corporate signing authority policy since 2012 and there were "no policies to guide staff on hospitality expenses, internal meeting expenses, staff social events, or gifts of appreciation."

And although management established a whistleblower process in May 2018 and completed a fraud risk assessment in June, the measures were not in place during Pickup's audit period.

"Without policies that provide clear guidance and create clear expectations there is an increased risk the IWK Health Centre will use public funds inefficiently or inappropriately, or staff will not appropriately safeguard assets," says the report.

Procurement controls were also lacking, and allowed individuals to either make unapproved purchases or override processes altogether. Pickup said his team was unable to find eight of the 10 procurement contracts it looked for and there was no evidence of quotes.

The report said 16 of 25 transactions were not "signed or stamped to show goods or services were received before payment was made."

Pickup makes 10 recommendations aimed at improving financial controls and risk oversight.

In its response to the report, the IWK Health Centre said Tuesday it is committed to addressing the recommendations, adding that "significant progress has been made."

"The IWK board is confident that new executive leadership will continue to drive momentum and results around this important work, including broadened reporting and disclosure to the board on a regular basis."

Progressive Conservative Leader Tim Houston said Tuesday was a "brutal day" for the hospital. But Houston said the ultimate responsibility for what happened has to be placed with the Health Department and the minister responsible.

"The message has to be from the top that health care is important," he said. "Every aspect of it including the accounting functions and looking after the dollars."

NDP Leader Gary Burrill said Pickup's findings point to the need for mandatory training for "boards of this kind." The IWK board is voluntary.

"Basic functioning has been lacking here and there needs to be more training, I think that's number one," he said.

The report released Tuesday also found the Health Department isn't providing "effective leadership and direction" on IT in the health sector.

It said the four relevant government organizations -- the Department of Health and Wellness, Department of Internal Services, Nova Scotia Health Authority and the IWK -- haven't formalized roles and accountabilities and are yet to sign off on key agreements for the delivery of IT services.

As a result, Pickup said they aren't adequately managing IT risks -- which has ramifications for the entire health system.

"If this isn't done well, the risks include: unavailable services, disclosure of personal health information and higher costing health care," said Pickup. "To date the Department of Health and Wellness has failed Nova Scotians on this front."