Deputy State Services Commissioner John Ombler will lead the investigation.
"Mr Makhlouf believes that at all times he acted in good faith," Hughes said.
"Nonetheless, he and I agree that it is in everyone's interests that the facts are established before he leaves his role on June 27, if possible. Mr Makhlouf is happy to co-operate fully to achieve that."
Makhlouf, who is leaving on June 27 to take up a role as head of the Irish Central Bank, will continue working during this period.
The commission is already holding an inquiry into the security of the Treasury's website, but Ardern said at her post-Cabinet press conference today that she expected the commission to look at the "quality of advice that was provided to ministers as well".
National Party leader Simon Bridges has called for Makhlouf to resign for implying that the party had hacked into the Treasury's website to obtain confidential Budget 2019 information.
But National staffers had simply used the website's search function, and police have said that nothing illegal appeared to have taken place.
Bridges has also called for Finance Minister Grant Robertson to resign for being "donkey deep" in what happened.
National has also asked for communications between Ardern and Robertson's office to be looked at, but Ardern said she had already released that information.
Last week Ardern said in the House that she had found out about the Treasury's referral of the matter to police only after Makhlouf had informed Robertson on Tuesday evening.
That meeting was attended by Ardern's chief press secretary Andrew Campbell and deputy chief of staff Raj Nahna, who then informed Ardern.
Ardern also clarified today that the Treasury did not seek any Government advice before calling the police, adding that that was appropriate because it avoided any perception that the decision was a political one.
She had not received an offer of resignation from Makhlouf.
"As of now I do not believe any resignation has been offered."
After National started to release Budget 2019 information ahead of Budget day, Makhlouf said last Tuesday that the Treasury had been "deliberately and systematically hacked".
He called the Police, citing advice from the National Cyber Security Centre (NCSC), an arm of the Government Communications Security Bureau (GCSB).
That reference escalated the seriousness of the issue and how the information was accessed, which was reinforced the following morning when Makhlouf said publicly that there had been 2000 attempts to access information in 48 hours.
However the NCSC said in a statement that the Treasury's computer system was not compromised.
"Given the incident did not involve a compromise of the Treasury computer network and was therefore not the type of incident the NCSC would normally respond to it was recommended that the matter be referred to police for their assessment."
Police told the Treasury the following day that nothing unlawful appeared to have happened, but this was not revealed until the Treasury released a statement on Friday morning at 5am.
National deputy leader Paula Bennett has also written to the commission, asking it to investigate whether Makhlouf and Robertson had misled New Zealanders.
On Tuesday night, after Makhlouf's statement, Robertson said: "We have contacted the National Party tonight to request that they do not release any further material, given that the Treasury said they have sufficient evidence that indicates the material is a result of a systematic hack and is now subject to a Police investigation."
In the following days, Ardern and Robertson said that no one was implying that National had hacked the Treasury website, and they were simply repeating what the Treasury had told them.
The commission cannot investigate whether Robertson's comments have been appropriate, as its jurisdiction does not include ministers.
Bridges also called for Deputy Prime Minister Winston Peters to publicly apologise for saying National had acted illegally - but Peters has stood by his comments.
If Makhlouf is found to have misled a minister or ministers, it would be considered a serious breach.
Bennett also wanted the communications between the Finance Minister's office and the Prime Minister's office to be looked at, given the "no surprises" policy.
"The actions of the Secretary to the Treasury and the Minister of Finance in misleading the public in this way have had a detrimental effect in maintaining public confidence in a neutral public service that works without political influences," Bennett said in the letter.
Timeline
• Tuesday, 10:01am: In a press release, National publishes what it claims to be details of the 2019 Budget
• Tuesday, 11:30am: Finance Minister Grant Robertson confirms "some" of the details in the press release were from Budget 2019
• Tuesday, 1:30pm and 4.01pm: National releases more Budget details
• Tuesday before 6pm: Treasury asks the National Cyber Security Centre (NCSC) about how confidential information on its website was accessed. The NCSC says the Treasury's computer network was not compromised, and the matter should be referred to the police given that it's not what the NCSC would normally respond to
• Tuesday, 6pm: Treasury Secretary Gabriel Makhlouf refers the matter to the police
• Tuesday, 7pm to 7:15pm: Makhlouf informs Finance Minister Grant Robertson that he has referred the matter to the police. Robertson says that Makhlouf described it as a "hack" but did not know at the time how it happened. Meeting attended by Ardern's chief press secretary Andrew Campbell and deputy chief of staff Raj Nahna.
• Tuesday, 7:20pm: Prime Minister Jacinda Ardern is informed of the situation
• Tuesday, 8:02pm: Treasury issues press release saying it had "sufficient evidence" that it had been "deliberately and systematically hacked". It cites the NCSC advice in saying it has been referred to the police
• Tuesday, 8:19pm: Grant Robertson issues a press release, asking National not to release any further information because "the material is a result of a systematic hack".
• Wednesday, 7:04am: Makhlouf said there had been 2000 hacking attempts in the 48 hours
• Wednesday, 9am: Simon Bridges strongly denies the information National released came into its possession unlawfully, but refuses to say how the information was obtained.
• Wednesday afternoon: Deputy Prime Minister Winston Peters says he knows National has acted illegally.
• Wednesday night: Makhlouf informs Robertson that police have advised that nothing illegal appears to have happened, and a statement will be released in the morning.
• Thursday, 5am: Treasury releases police advice that the information was obtained in a way that does not appear to be unlawful. State Services Commission, at Makhlouf's invitation, launches inquiry into how Treasury's Budget information was accessed.
• Thursday, 8:45am: Simon Bridges fronts a press conference where he outlined how National used a simple search function to get the info. He calls for Robertson and Makhlouf to resign, and for Peters to apologise
• Thursday afternoon: Peters stands by his earlier comments and won't apologise. Says lawyers, such as himself, would know what constitutes illegal activity better than the police
• Friday: Paula Bennett writes to SSC to ask for it to investigate Makhlouf and Robertson and whether they have acted appropriately
• Today: Ardern says she expects the commission to look into the quality of advice that Treasury provided to ministers. State Services Commissioner Peter Hughes announces a new investigation into these matters shortly afterwards.
