Victoria’s auditor-general says the state's IT recovery systems are not good enough, and could fail under attack.

Auditor-general Andrew Greaves warned that while significant disruption is unlikely, the consequences could be “catastrophic”.

“At present, none of the agencies we audited have sufficient assurance that they can recover and restore all of their critical systems to meet business requirements in the event of a disruption,” the report said.

Mr Greaves looked at IT disaster recovery plans for Victoria Police as well as the departments of Justice and Regulation, Health and Human Services, Environment, Land and Planning and Economic Development, Jobs, Transport and Resources.

The report found that across the agencies, 49 per cent of computer systems were obsolete.

Things are particularly bad at Victoria Police, where 79 per cent of computer systems supporting critical business functions were found to be obsolete.

Just three of Victoria Police’s computer systems have disaster recovery plans.

“Systems that operate on obsolete hardware or software present a significant disaster recovery risk, because of the limited availability of hardware spare parts, vendor technical support, and staff knowledge and skill,” it stated.

“At worst, agencies risk catastrophic equipment failure, extended outage of public services, and exploitation of vulnerable systems by computer virus attacks.

“These circumstances place critical business functions and the continued delivery of public services at an unacceptably high risk should a disruption occur.”

The agencies were also found to lack processes to identify, plan and recover systems following a disruption.

“Without having disaster recovery plans and testing them regularly, agencies risk not being able to recover systems in a timely way because of a lack of guidance for staff on what is required to bring systems back online,” it stated.

“As a result, critical government services — such as criminal justice and policing operations — may be unavailable for longer than is necessary, depending on the scale of the disruption.”

The report called for the four departments and Victoria Police to form a “disaster recovery working group”.

Victoria Police says it has accepted all the recommendations and is already working to improve its systems.

“Victoria Police is currently engaged in an extensive IT transformation program which will significantly enhance our IT capabilities,” a spokesperson for the force said.

“This includes the rollout of mobile technology to police members in the field and the introduction of a significantly improved intelligence management.”