Anatomy of an $2.3b government tech failure

Treasury was the responsible department, but had next to zero experience with planning and overseeing big IT project delivery, a digital project that if it had proceeded would have been the biggest ever undertaken in the civilian public sector.

The Tax Office was to take over the business registers, a move Rees observed had only been done by Albania. The Australian Securities and Investments Commission, which had run the 30 or more registers, was left to sulk, sidelined as a bit player.

A series of Treasury business cases finally predicted the project would cost around $480 million and deliver direct and indirect economic benefits of just under $4 billion out to 2030.

About $585 million would come from regulatory and efficiency savings for business and ASIC’s legacy technology and the remaining 85 per cent (circa $3.3 billion) from increased tax revenue and reduced fraud, primarily through the new directors’ ID program which was to be linked to the companies registry, to combat phoenixing.

The principle benefit from the whole scheme was to be a high integrity “data spine” that would bring together ATO and ASIC data to provide a backbone platform for anyone wanting to interrogate the Australian business market.

This was estimated to deliver $550 million of the savings, but, along with the phoenixing savings, was never modelled. Nor was any baseline established to enable these benefits to be captured and measured.

The project was rushed through the 2019-20 mid-year economic and fiscal outlook as part of a “laser focus” to reduce business compliance costs. Coalition ministers were dubious if the lawyers who dominate ASIC could deliver such a high-tech project.

Foundation for commerce

Firms daily rely on the foundational system to do business with counterparties and the regulator uses the information to oversee companies and their commercial practices.

The more than 30 ASIC registers were running on 1990s legacy technology and in desperate need of overhaul to ensure against cybersecurity and data loss risks.

The registers are governed by differing laws and over the decades have grown higgledy-piggledy, creating a hotchpotch of obligations and forms and a nightmare of usability, confusion and cost for business owners.

This very complexity has spawned a vast industry of lawyers, accountants and data players who make a nice living managing the regulatory requirements for traders overwhelmed by the differing requirements and endless re-entering of information.

The lack of a solid identification system had also fuelled a wave of company phoenixing, estimated to be costing somewhere between $2.9 billion to $5.1 billion a year.

Agency wars

There were and remain deep cultural differences between the ATO and ASIC. Tax is a money-collecting agency, run with teutonic engineering efficiency. ASIC enforces business rules and is populated by lawyers who argue for their living. It was a key mis-step.

The ATO, somewhat reluctantly, took on the project but ran it more as a mid-tier IT project, reporting in to the CIDO and looking to integrate the off-the-shelf software tightly with its systems.

That software, known as Verne, had been developed by Kiwi firm Foster Moore and uses an exotic JavaScript, known as Groovy, used by less than 0.2 of the programming world.

According to Boston Consulting Group, which undertook the technology and governance review, Foster Moore had done only two national rollouts, one for the New Zealand Companies Office and the other for Botswana.

Unloved

ASIC had its own internal worries and lost interest, attending only one in five of the board meetings, while the Tax Office slow-walked ASIC’s data synch requests. In one instance, reaching agreement on a file-sharing format for one form (Form 5602) took six months, delaying key decisions.

The lack of a real business owner or ministerial champion for the heroic program was evident when the project was virtually shut down during the COVID-19 pandemic. ASIC was due to close it servers this fiscal year, but there were red flags the project had deep problems and was no way going to meet its deadlines. At one stage, 17 of the 37 open risks had been open for a year.

Scope was expanded to include extra registries. Amid sky-high developer costs and a dearth of security-cleared technicians who understood the arcane world of federal business registries, the actual external labour costs were 75 per cent higher than what Treasury estimated. The now 500-strong project team was burning cash at $12 million a month or an eye-watering $600,000 each working day.

The Coalition government had already junked its $1 billion visa and permissions platform and no one wanted to hear about another tech wreck. In July last year, the new government was told the cost had tripled to $1.5 billion, prompting the Rees review.

Nowhere was the lack of program leadership more obvious than around the legislative simplification process that was meant to remove much of the legacy complexity. This key work was practically forgotten, leaving project leaders uncertain about the very foundations of the scheme and building in even more risk.

The lack of an obvious north star for the project saw much effort going into making the interfaces easier to work with. But as Rees noted, this was not of much benefit to the high-volume users who rely on data exchanges to drive their own proprietary systems and applications.

While the project was being run using agile workplace practices, the actual programme was a classic waterfall style, design-then-build program, meaning most of the benefits only come at the rear of the whole exercise.

This meant there was no “off-ramp” to pull up the project once it became obvious there had been a major miscalculation on just how complex the scheme was.

Who is accountable?

McKinsey found the project was more likely to cost $2.4 to $2.8 billion, making it Australia’s biggest civilian gov-tech project ever.

The Rees review gave the fiscally strapped Albanese government the option of dumping the scheme and returning the whole shebang back to ASIC. This week it eagerly took that option. The sting in the tail was McKinsey’s finding that another half-a-billion dollars will be needed to stabilise ASICs technology and get a basic data platform working.

The question of who will be held to account for the complete miscalculation of the complexity risk has to date been lost in the fog of the Treasury portfolio. Ministers have long gone, but so far, no officials have been called out for the five times higher cost and five-year delays in delivery.

In his final chapter, Rees noted many of the issues associated with the flawed program are not unique. His primary advice is to avoid big bang transformation. Invest in maintaining legacy systems, so there is not such a huge modernisation gap, and when change is needed, do it in small, digestible pieces that independently add value. Start small and do not scale up the funding or team size until critical proof points and learnings have been achieved.

In short, Canberra must learn to be frugal with its tech dollars. A simple, but powerful message.