Services Australia is nowhere near to migrating data to its future welfare payment system, despite being five years into a $1.5 billion ICT overhaul, an audit has found.

The Australian National Audit Office looked at the government’s Welfare Payment Infrastructure Transformation Program (WPIT), which commenced in 2015 and with the aim of replacing the current ISIS welfare payment system – considered to be dated, complicated and costly –  by 2022.

Services Australia admitted in internal reports last November that the old system would not be able to be decommissioned on time.

The ANAO confirmed that key elements of the future system are still only in the design phase and delays to decommissioning the old platform it have “put at risk expected benefits of the WPIT program”.

“Services Australia has not yet established appropriate arrangements to migrate data to the future welfare payment system,” Auditor-General Grant Hehir said.

“Approaches to planning data migration commenced but were discontinued and Services Australia has indicated that ‘that there is no significant date migration in the scope of WPIT Program to date”.

The ANAO also found Services Australia had failed to monitor costs and manage cyber threats or accredit some parts of the current system, which contains information about millions of Australians who have received welfare payments over the last thirty years.

“Despite identifying strategic cyber security risks and assessing the generic operational cyber security risk context as ‘high’ in 2018, Services Australia did not cyber security risk-assess, certify or accredit all elements of the welfare payment system as required,” the report says.

It is calculated to have made more than $110 billion in welfare payments to 6 million Australians between 2015-19.

Failure to demonstrate value for money

The ANAO also found Services Australia was unable assess whether it was getting value for money from the current system, which was estimated to cost $98 million a year to maintain.

“Services Australia was unable to break down costs, monitor trends over time or assess the ongoing value for money of this expenditure,” the audit concluded.

The ANAO said the report should serve as a warning to other agencies that have upgrade or replace a major ICT system and face similar risks.

Services Australia has agreed to five recommendations to improve management of operating risks and improve the transition to the future system.

“Services Australia acknowledges that an ongoing risk assessment, project and change management controls, monitoring and reporting for the decommissioning strategy will increase the likelihood that ISIS will be successfully decommissioned under the WPIT program,” Services Australia CEO Rebecca Skinner said.

She also said the department was strengthening governance arrangements and tech costs “with the aim of providing improved visibility of the costs of maintaining different payment platforms”.