An Australian Audit Found Upgrades Marked Complete but Unverified

← Back · ACT I · Chapter 6: Tech Bloat as Governance Failure

In December 2023, Australia’s Department of Foreign Affairs and Trade closed a program, first funded in 2018-19, to harden its embassies and consulates against attack. The government had approved A$394.3 million for it. According to the Australian National Audit Office, the department closed it “on the basis that it was an overall success, having achieved at least partial realisation of all intended benefits.”

The audit office reported on the program in July 2026. Its own conclusion was shorter: “The expected benefits from the Security Enhancements Program have been partly realised.”

There is a lot in the report. I want to look at one part of it, because it describes a problem any buyer of installed technology can have, and can carry for years without knowing.

The Numbers Said Done

One piece of the program was to put new security equipment, including alarms, access control and CCTV, into 55 overseas posts. By the department’s own analysis, as of 30 June 2024 it “had completed all its metrics associated with the security asset and infrastructure upgrade project.” On paper, delivery was finished.

The auditors then tried to confirm that, and the next paragraph of the report says what they found: “The ANAO could not verify that the posts had received the upgrades set out in DFAT’s benefits reporting.” Evidence that the access control and CCTV systems had been commissioned was not centrally recorded. When the auditors compared the department’s benefits analysis with its own security equipment database, the installation dates matched for nine of 63 CCTV upgrades. Twenty-six records had no installation date at all, and 28 showed a different date from the one in the benefits analysis.

The cameras may well all be there. The department simply could not show, from its central records, when they went in, or that anyone confirmed they worked on the day they were handed over.

Installed Is the Easy Half

The second gap sits after delivery. Preventative maintenance, the auditors wrote, “is critical to ensure the measures are available to posts and operating effectively.” They then quoted an internal departmental minute from May 2023, seven months before the program was closed: “Neither OPO, Post nor DSD have the operating budget currently needed to support the ongoing maintenance of all security measures which increases the risk of measures failing or becoming ineffectual in reducing the risk of the threats they are installed to mitigate.” The three names are the department’s property office, the posts themselves and its security division. The auditors’ own finding, three years later, was that maintenance of the new assets “has not occurred in accordance with guidance from other Australian Government agencies and manufacturer instructions.”

So the equipment was paid for, and by the department’s own account the money to keep all of it maintained was not in anyone’s budget. A metric that counts an installation stays complete on the day the equipment stops working, because nothing in it ever looks at the equipment again.

The audit office put the lesson for every Australian government agency in one line: “Project outputs may not provide an adequate measurement alone to evaluate the success of the delivery status of a program.” A second line said that whole-of-life costs, “including sustainment costs, should be considered during the planning/design phase.”

This Is a Capability Problem

Most writing on benefits realization is about definitions: name the outcome, set a baseline, measure against it. That work matters, and this program had gaps there too. But the finding above would survive a perfect definition.

Chapter 6 of The Value Standard argues that technology has to be judged on the outcomes it produces, and that usage and features get mistaken for value. This audit shows what a buyer has to have in hand before that judgment is possible.

A buyer can write down exactly the right outcome and still be unable to check it, because checking takes two things the buyer has to hold after the supplier has gone home. One is a record, in the buyer’s own system, of what was installed, when, and the test that showed it worked at handover. The other is a funded team that keeps it working long enough for the outcome to show up. Neither one is the supplier’s to keep on the buyer’s behalf, and both tend to be treated as housekeeping.

Every later measurement depends on them. A buyer with no record of its own is left trusting the supplier’s delivery report, and if the upkeep is unfunded, the benefit can wear away for years while the metric still reads complete.

Write It Into the Purchase

The fix starts before signature, as a step in the buyer’s own process. The buyer writes down what the purchase has to produce, in operating terms rather than units installed, and how and when that will be measured, with at least one check well after go-live. Among the conditions that must hold for the result to arrive go a funded operating budget and a team that owns upkeep. The evidence the supplier hands over is specified too: dated commissioning test results, loaded into the buyer’s own records, rather than a closure summary. Written by the buyer before the purchase, that set of requirements is a Request for Value.

A supplier that commissions properly gives up nothing here. Its work becomes provable in the buyer’s records, instead of resting on a report that an auditor may later be unable to confirm.

The department has agreed to develop a risk-based approach to preventative maintenance, which goes to the second gap. The first gap is harder to close now, because the time to capture a record of what was installed and tested was at handover.

The same audit also found the program’s targets changing while it ran, which I cover in How a Purchase Stops Paying Off Without Anything Breaking. The distance between deployed and working in enterprise AI is the subject of Launching an AI Model Proves Little Until the Results Show Up.

References: Australian National Audit Office, Auditor-General Report No. 2 2026-27, DFAT’s Protection of Overseas Missions: Realisation of Benefits from the Security Enhancements Program (tabled 14 July 2026), paragraphs 8, 10, 17, 3.21, 3.22, 3.35, 3.36, 3.44 and the key messages for all Australian Government entities.

Keep reading: ACT I · Chapter 6: Tech Bloat as Governance Failure