ABRAHAMS, Mrs Michelle, Acting Assistant Secretary, Enterprise Technology Operations, Department of Defence [by video link] ARDELJAN, Mr John, Acting Assistant Secretary, Defence Protected Environment Program, Department of Defence [by video link] ATKINSON, Mr Simon, Chief Financial Officer, NBN Co Limited [by video link] BENFIELD, Mr Sean, Senior Executive Director, Financial Statements Audit Services Group, Australian National Audit Office CRASWELL, Ms Lesa, Group Executive Director, Systems Assurance and Data Analytics Group, Australian National Audit Office FOX, Ms Amy, First Assistant Secretary, Financial Analysis, Reporting and Management Division, Department of Finance HILDER, Professor Emily, First Assistant Secretary, Digital Capability, Department of Defence [by video link] JAGO, Ms Carla, Acting Deputy Auditor-General, Australian National Audit Office McLIESH, Dr Caralee, PSM, Auditor-General, Australian National Audit Office SAMARANAYAKE, Mr Lasantha, Assistant Secretary, Accounting and Frameworks Branch, Financial Analysis, Reporting and Management Division, Department of Finance SEWELL, Mr Robert, Chief Information Officer, NBN Co Limited [10:36] CHAIR: Welcome. This hearing is a formal proceeding of the parliament. The giving of false or misleading evidence is a serious matter and may be regarded as a contempt of the parliament. The evidence given today will be recorded by Hansard and attracts parliamentary privilege. I remind all present that, as chair, I will ensure that proceedings are conducted in an orderly, respectful and courteous way. Witnesses are reminded that any claim that it would be contrary to the public interest to answer a question must be made by a minister and accompanied by a statement setting out the basis for the claim. Does anyone have any opening remarks before we move to questions from the committee? Alright. I'll go back to my notes. IT security has obviously been a key focus of the ANAO's work. I'm going to start with the Department of Defence. Why did the defence department submit no category A or category B audit findings during the ANAO's audit of Defence's financial statement? Mr Ardeljan : I might start and then I might ask my co-witness Emily to provide a response. Referring back to the ANAO audit in 2023-24, that outlined that there were some outstanding issues around user access management, with particular reference to ISM control, one of the Essential Eight controls relating to access to systems and networks. That audit finding did identify that there were some gaps in Defence's ability to articulate how we remove users across all employment types in a timely manner. That was probably the starting point with that one. Emily, I would seek any further commentary from you. Prof. Hilder : To clarify the question, was this relating to the most recent statement of financial performance from Defence? CHAIR: For 2024-25. Prof. Hilder : I would have to take on notice why we haven't submitted any category A or category C findings from that. I can make assumptions, but I'd prefer to make sure we provide you with a correct answer on that. Mr Benfield : I might add that for 2024-25 the A finding that we raised was first raised in 2022-23. Defence sought to resolve that in 2023-24. We were unable, during that period, to verify that the actions that had been taken by Defence were satisfactory for the resolution of that finding, mainly around data issues. During 2024-25, Defence undertook actions, including standing up a project team, that successfully resolved the matter, including implementing controls as well as data reconciliation that was able to demonstrate to us the effectiveness of those controls. As such, at the end of the 2025 year there were no A or B findings that the ANAO raised. So Defence had successfully resolved the matter during 2024-25. CHAIR: So the ANAO raised concerns in 2022-23. Defence resolved them and then you didn't have any further findings in 2024-25. Mr Benfield : That's correct—no significant or moderate findings. CHAIR: How did you get to that point? What were the things Defence did that meant you fixed it? Mr Benfield : I might hand over to Defence to talk about that. Mr Ardeljan : I led the project trident team, which has been called out in ANAO's submission for the 2024-25 closure report. I'm happy to step through the broad principles of design of the project—what it got after and how it achieved the outcome. In briefing through the structure of the project team, the principles of engagement were very clear up-front. One was ensuring that we had sponsorship. At the tail end of 2024 the senior officer responsible for closing out the category A finding moved across to the CIO, so it became more of a technically driven solution, with partnership from the business. Another one was having that strong sponsorship in place, having clear plans in communications across all stakeholders, including the SRO, including key stakeholders, and including both internal and external audit components—working very closely with the ANAO. Another principle was being transparent—maintaining transparency across the project, regular feedback loops and testing the hypothesis of design and ensuring that as the project progressed through its iterative development of the solution that it was actually cross-checking and taking on that feedback. Finally, it was about embedding both business and technical components in the delivery of the project. In terms of what project trident had undertaken, there were three phases. The first phase was driven around discovery, a clear understanding of the three data sources in question, and, of course, driving towards defining what initial operating capability would look like. Trident was established in the first week of November 2024, and by 11 January 2025 we had achieved the initial phase of IOC, which was the process required to be able to verify and initiate the removal of user access from our systems manually. Phase 2 was a move into a semi-automated process. There were a range of business rules that were developed, and each of these steps was moving towards phase 3, which is a fully automated solution. In terms of timeframes, phase 1 achieved its outcome by 11 January 2025, phase 2 achieved its outcome of semi-automation by 19 February, and, in the intervening period, ANAO was consulted, as was the internal audit team, to ensure that what was being built was fit for purpose and use. Phase 3 had a longer tail. It took some months to be able to build a fully automated solution, but that was achieved on 14 October. Between phase 2 and phase 3 was when the ANAO deemed it had a level of confidence that what project trident was delivering was fit for purpose. I'm happy to take any questions. CHAIR: You started off, basically, going, 'Users need to be removed; let's do this manually when they leave the organisation,' and then you migrated across to an automated version of that. Can you explain how that works and why it's better to do it in an automated way? Mr Ardeljan : Absolutely. The steps taken were to look at the source datasets. We have two distinct datasets. There's one that focuses on our permanent employment workforce, both APS and ADF. That's our HR system, in the form of PMKeyS. The second is our contractor workforce, which is managed in a separate database and is managed around contract timeframes—so commencement and conclusion of contract. Those two elements become the source of truth in terms of delineation between ongoing employment and cessation, and that became the basis of how we validated access against network, and that network authentication was driven through our active directory dataset. CHAIR: How many people are we talking about? Give me a scale. How many people are we talking about coming off the system? Mr Ardeljan : As Trident went through its phased delivery, in the earlier weeks what we were identifying—and I do want to just qualify this statement; the business rules around Trident were being built iteratively. In the first few weeks we saw numbers in the vicinity of hundreds of exceptions—and I want to again qualify that. It does not mean that they were not removed in a timely manner. They were actually exceptions to the business rules which we were building. As those business rules matured, we were able to articulate that there were specific employment types and conditions that needed to be accounted for, and therefore the business-rule library then formed quite a solid foundation to formulate automation. CHAIR: Just to unpack that, there were hundreds of users who had logins or the ability to access the network, and, as project trident was being developed, it was identifying either people who had access to different parts that wasn't appropriate, or people who should be removed altogether. Is that the kind of thing? Mr Ardeljan : Can I correct the record please, Chair. It wasn't that the individuals had access beyond what was required. It was the rules, the exceptions, which Trident had established, and we were capturing those exceptions. The basis of Trident delivering an enduring solution was to ensure that we had a high-confidence error caught framework that established that. As we identified exceptions, we had treatment plans in place for those, and those treatment plans have been documented as part of the enduring solution. CHAIR: Was it more the case that people had just left the organisation—moved or whatever—and had their accounts but weren't accessing them, or were people accessing accounts that they shouldn't have been accessing? Mr Ardeljan : I think the delineation here is the movement type, as an individual may move between different employment types within the organisation. They're an APS one day then move into an ADF role or potentially become a contractor. It was about understanding that delineation and how that would be mapped into our framework. CHAIR: So it was more that people had a different role and, therefore, should have had different access. And they were still having access through the old role, but they were in the new role. Mr Ardeljan : That would be a fair characterisation. CHAIR: Were there any incidents where Trident identified that people were accessing information that they shouldn't have accessed? Mr Ardeljan : The basis of Trident is to remove access first and ask questions later. Where we have identified exceptions, they go through a process of being assessed by our security organisation. They look at the kind of access and what's being accessed. There are some examples where that's occurred. But, as I've mentioned, access is removed first and questions asked later. CHAIR: What questions were asked? Mr Ardeljan : In most cases, the reason is that they have legitimately moved from one employment type to the next. There are some prime examples that have been brought forward and support the position that the employee has put forward. CHAIR: So there were no major security concerns as part of this process. Mr Ardeljan : Not that Trident has picked up. And that has been assessed through our SOC, security operations centre, as well. That is working very closely with Trident's processes. Any exceptions that are identified are treated as security incidents and assessed on a case-by-case basis. CHAIR: These hearings are also about identifying good examples for departments to follow. It sounds like there's been a very direct effort to address the issues that were raised by the Auditor-General. Are there any comments by the Auditor-General on that, around how this project was able to remedy or on things that other departments can take from this process? There are clearly still gaps in other parts of the Public Service. Dr McLiesh : I think the Defence experience is really significant for other entities across the public sector. What we've seen in our financial statements audits, for a number of years now, is that the single greatest category of audit findings relates to weaknesses in IT controls. The single largest category of weaknesses in IT controls relates to IT security—specifically, user access controls. So there's a lot of relevance from the Defence experience for other entities. The public sector is sitting on a considerable amount of risk related to IT systems, and it is concerning that this has been the case for many years now. In our financial statements audits, we consistently find these weaknesses in IT controls. One of the things that's most notable about Defence's experience, as we heard, is that the risk was treated not just as a technical issue but as a business risk. As we heard, there was senior leadership sponsorship for change to happen. And that has helped to create the change that we have heard described and that led to the downgrading of the finding. I think the other factor was the quality data that was generated to inform the changes that needed to be made to controls. What we often see, in efforts to address findings, is that the matter is treated more as a technical issue, and we don't see that sort of whole-of-agency leadership that we saw in Defence. So I think there are a number of lessons to learn from the experience. Ms Craswell : Defence outlined the work that they've done. Mr Ardeljan outlined that they'd set up a project, Trident. Sometimes other organisations consider the size of Defence and think, 'But we can't do that.' The quantum of Defence is such that this was actually a very large issue that was complex. The thing that helped Defence succeed, as the Auditor-General said, was treating it not just as an IT issue. As Mr Adeljan outlined, it was a project that brought together the data, the IT, the technical and the business people. They put in assurance processes along the way and ensured that the controls that they were putting in place were fit for purpose and actually addressed the issue. Other entities can do that for the same scale and risk that they have, as entities. If they look at working with business, HR, and IT together, they can actually address the risks in their IT environment and have a good source of data to understand what their environment looks like. CHAIR: I think this is a nice segue to the Department of Finance. Obviously you play a role in ensuring that the financial reporting is happening across departments. Have you identified, in your liaison with other departments, any weaknesses or risks for agencies? Ms Fox : Not in addition to those identified by the Auditor-General and her team. I think we would support the comments made by the ANAO in regard to the importance of the IT general controls, particularly to financial reporting, and we continue to provide as much support as we possibly can to chief financial officers and their teams around guidance material, training seminars and panel discussions—including with the Auditor-General's team—to try and elevate the prominence of these particular risks within entities. CHAIR: How does it work with Finance? You do panels and training, that kind of stuff, but do you look at the reports that other departments produce? Do you assess where the other departments are up to in their reporting or in identifying risks? Ms Fox : We do look at their reports—not just those from the Auditor-General but those from other review bodies as well. We don't make assessments of departments and their action or remediation against those particular reports. That's not the role of the Department of Finance and not within our remit. What we do do, where a persistent or pervasive problem has been identified, is look to build that into our policies and guidance back out to entities. We work very closely with the Auditor-General on specific issues in relation to that and financial reporting, particularly, and across other areas as well. CHAIR: So, basically, Finance's job is to read the reports, see if there are any trends that span departments and then build that into your engagement with all agencies as part of your work on this in order to uplift the general capability, in a broad sense. Is that the approach? Ms Fox : I think that's correct. Where particular departments and, I'm going to say also, particularly smaller entities have more significant issues, we will work more closely with them on a case-by-case basis. I think we have very good, positive relationships with chief financial officers and their staff. It is the smaller entities that struggle a little bit more with remediating some of these issues that are identified. They have very, very small teams. In some entities, the finance team might be one person and the IT team might be one person. Their capacity and capability are somewhat more limited than in the larger portfolio departments, so we will work with them and work with their portfolio department to assist as well. CHAIR: Assist with what? Ms Fox : Supporting them to remediate the issues that have been identified and be compliant with our policies and guidance, where appropriate. CHAIR: What sort of issues are they? Ms Fox : Ones identified by the Auditor-General in her reports. From time to time, there may be particular accounting policy issues that might arise that we might work with them on understanding and reaching a position on, for example. CHAIR: So, basically, the Auditor-General makes findings, they identify issues within different agencies and Finance will then work with those agencies to try and assist them in meeting the Auditor-General's requirements, basically—or advice. Ms Fox : At times. We do operate more, as you mentioned before, at a whole-of-government level. We don't work with all agencies that have issues that have been reported by the Auditor-General. CHAIR: Just the small ones on a case-by-case basis? Ms Fox : That's correct. CHAIR: Do you ever work with agencies separate to an Auditor-General finding? Ms Fox : At times, yes. That would be the case where there may be, for example, themes that we may have identified in our work with agencies. We are very frequently sought out for our advice across the APS. If we start to get repeated requests for advice in particular areas, for example, then we would identify that that might be something where additional training and guidance might be helpful. CHAIR: But nothing initiated by the Department of Finance? You never initiate that sort of engagement? Ms Fox : That example that I just gave would be initiated by us. So there isn't an issue that's reported by the Auditor-General or been identified in any other reviews or recommendations. That's through our work with agencies where we may have identified a capability gap. So we may then look to update our guidance policy material, or it could just be as simple as running a training session that's available to all CFOs and their teams on that particular subject matter. CHAIR: But it's not a direct engagement with a department to identify a problem or discuss a problem—where you identify a problem or they identify a problem, then you give training and advice, and you then, a few months later, work out if that's all been implemented? It's not that kind of arrangement? Ms Fox : In some cases, some examples, it may be. An agency may reach out to us directly and say: 'We've got this issue from the Auditor-General. We're not sure how to resolve it. Are you able to offer us some help?' And, if we're able to, we would. CHAIR: What have been the main things that you've done training or remediation on? Ms Fox : We have a very broad range of training. I would say it's not generally in the area of specific IT controls. That's not within our remit. But it may be on how to prepare financial statements or particular aspects of disclosures in financial statements. We also do a lot of career-management-type conversations with CFOs and their teams as well—a very broad variety of financial and accounting policy related training. I don't have the list in front of me today, but we could certainly provide that to you if that is of interest. CHAIR: All of that sounds completely reasonable and like the Department of Finance is trying to be helpful, especially with agencies or when there's an Auditor-General finding of some risk or weakness in either IT controls or financial reporting that you then provide training on. Isn't that process a bit vague and distant? It's a general approach to things that you identify and then include in training. It doesn't seem like there's much directness in stating that there's a problem, for example, saying: 'This agency's got a problem with financial reporting. We have a team within Finance that assists this organisation.' Through engaging with the Department of Finance, they then get up to a level in which they are compliant with the regulations and requirements of that organisation. That engagement is ongoing until the Department of Finance has confidence that those standards are being met. It seems like we're beating around the bush when, actually, we can just go and talk to people and fix things. Is that not what's going on? Ms Fox : We do have portfolio leads in our agency advice units within the department, but we don't actively seek out departments or smaller entities and all of their audit findings and seek to work with them extremely closely to resolve their issues. Under the PGPA Act accountable authorities are responsible for their system of internal control. It is a devolved framework. We do lean in where it's helpful to do so, but, at the same time, that ultimate responsibility does sit with the accountable authority. In relation to financial reporting, that would be chief financial officers. For IT matters, it would be chief information officers. They all have roles to play. I'm not attempting to not take responsibility or accountability. As I say, we will lean in where it is helpful to do so on those matters, but, ultimately, the accountable authorities are responsible for that control environment. They need to be assured about their risk assessments, the controls that are in place and the operation of those controls as well. CHAIR: But isn't Finance's role to ensure that reporting across the Commonwealth and IT controls are effective? What is Finance's role here? What do you have to do? Ms Fox : We put the policies and guidance in place to support accountable authorities to meet those requirements. CHAIR: So you set the policies. You don't have any statutory role or any requirement to actually ensure that they're being upheld? Ms Fox : We don't have a compliance role at all. CHAIR: But, in the setting of those policies, you engage directly with agencies in order to understand what's going on in their organisations and the themes and the issues that are identified. Ms Fox : That's correct. CHAIR: More specifically, what are some of the things that you've identified? What are the big issues across the APS where the Department of Finance has said: 'Look, this now needs to be our new baseline for how we have IT control across the APS. This is the policy that everyone needs to comply with in order to give everyone confidence that agencies are actually doing the right thing.' Ms Fox : The Department of Finance doesn't set the baseline for IT controls and IT security. We certainly do for financial reporting purposes, and there are a variety of matters that I could mention in relation to that. But, for IT specifically, that is not the role of the Department of Finance. CHAIR: So there is no engagement with IT controls? Ms Fox : Not no engagement. As I mentioned before, we do look to understand the matters that have been identified by the Auditor-General and her team in the performance of their work. If we think there are matters in relation to that where we can be helpful to entities and provide extra information, extra guidance or general training about financial reporting, then we would. We have done that a number of times, including with officers from the Australian National Audit Office, by bringing CFOs and CIOs together. As both the Auditor-General and Ms Craswell mentioned, we would agree that bringing together IT and business is very important, so we have also strongly advocated for that in the context of financial reporting. CHAIR: What are the things that you've identified across financial reporting that could deal with the issues across the APS? Ms Fox : Accounting for estimates is one particular technical area that we have been very strongly supporting CFOs and their teams with. On the appropriations framework, a little earlier in the hearing today there was conversation about section 83 and legislative compliance. Those are the matters that are perhaps at the front of our minds at the moment. CHAIR: It makes perfect sense. If I can go back to the ANAO—we'll go back to other IT control assessments in the same way that Finance is doing the financial reporting—is this something that you think is a gap across the APS? Is anyone else playing that role to a level other than you guys when it comes to assessing whether agencies are looking after their IT? Dr McLiesh : Given the persistence of our findings on IT controls, I think it's fair to say that more needs to be done in accountable authorities, and there is a question about what more can be done centrally. The reality is the risks that are related to our IT findings are growing considerably. We're in an environment with heightened cybersecurity threats, and agencies are increasingly using emerging technologies and artificial intelligence and are using new technologies more broadly to deliver services to run their operations, so risks around IT controls are growing. In our view, there's a need to accelerate efforts to strengthen IT controls. There are efforts that are underway, and we welcome those. We work closely with Finance in some of their panel discussions and communications across the sector, as has been outlined. But there is, in our view, a need for further efforts. I think it speaks to the priority that's placed on IT controls across the sector. We still have findings and we're not seeing them addressed at the rate that we think they should be. CHAIR: Dr McLiesh, maybe you or one of your team can start with this next question, and then I might go back to Finance, given the in-and-among conversations about how agencies address this. Each entity has its own responsibility to ensure that it's compliant, safe and protecting the user's information, the public information or the data that it holds, but clearly there are mixed responses depending on the effectiveness of that agency. Are the problems related to a lack of capacity or a lack of awareness of each individual agency, or is it the fact that there isn't a central, go-to authority that is there to be constantly assisting, monitoring and upholding the IT controls of different agencies? If the committee is making a recommendation about where the best place to start is to fix this—it sounds like Finance is doing a good job when it comes to training, identifying issues, providing training and assisting with organisations and agencies, but the rubber's not hitting the road in accordance with your findings. Dr McLiesh : There are whole-of-government policies and requirements in place around IT controls, and I think ASD has a primary responsibility for the ISM, which is about IT controls. When we look at all-of-government policies and their application across the sector, there's always a question to the policy owner: how do you know whether that policy is working? While the policy owner might not have compliance functions, there is a role as a policy owner to ensure that the policy is being put into effect well. What we see in the IT control space is that more can be done to ensure that the policy is working as intended. There are always choices to be made about, as Ms Fox put it, where to lean in and where to put the responsibility on the accountable authority. But, when you see persistent weaknesses over many years, I think that is evidence that, centrally, more needs to be done to ensure that accountable authorities are implementing policies as intended. CHAIR: Is there any advice from Finance? In your submission, relating to IT controls, Finance says: It will continue to provide support to CFOs to identify and manage the risks as they relate to financial reporting. In the recent past, this has included convening dedicated seminars and panel discussions, including with representatives of the ANAO, on the importance of strong and effective IT controls and impacts on financial reporting. What comes out of your seminars, your panel discussions and the support that you provide to CFOs? What organisations say: 'Here's our pathway forward. Here's how we're going to manage it'? Is it about upskilling each individual agency and each CFO, or is there more support needed, do you think, in order to fix things? Ms Fox : The Auditor-General mentioned that the remit for the ISM, the Information Security Manual, sits within the ASD, the Australian Signals Directorate. I can't comment specifically on their role as policy owners and where they may be doing work in this space. We have definitely, in the past, collaborated with them on some of the training that we have provided to chief financial officers. But I think it's important that chief financial officers aren't generally solely responsible for IT controls within their agency. It does take that collaboration with the chief information officer also. So there's a very important link there that perhaps needs to be made. It may also be worth having a conversation with ASD. CHAIR: Yes, that's good advice. I know I asked a lot of annoying, little, specific process questions, but the reason behind it, Ms Fox, was to answer that exact question about there being these persistent findings by the Auditor-General that IT controls are not being managed and there being this really good example by the Department of Defence that basically identifies that a whole lot of people were having access to parts of the organisation that they shouldn't be having access to. They identified a team, they got straight down to it and identified the processes and the way in which it needed to be checked and they built automation around that. If you take action to protect information and data first, then you can always walk that back and create new accounts if you need to. It seems like a really targeted way of dealing with the problem. No doubt project trident cost a fortune. John seems very impressive, and his team probably has a budget to navigate the big job that they have to do, but, for something like this, with the pace of IT, risks, incidents and issues can move so fast. Through Finance, through different agencies and through different things that are very general—in response to an Auditor-General's report on this—it just seems like our committee's focus needs to be on what we can recommend to ensure, if there are persistent findings by the Auditor-General, what needs to happen so that the IT intervention or the IT controls can be improved quickly and in a targeted way so each agency has a clear place to go in order to get the help that it needs to do things quickly and build structures. That way, they can protect their information and data or minimise their risk with less of this, 'Well, you've got a responsibility.' There are policies. Finance is there to help support training, but I'm not surprised that the Auditor-General keeps on finding that there are still risks. It's not Finance's fault. Finance's job—as you said, Ms Fox—is not to be in there and roll the sleeves up on identifying or helping to identify. It's about the support around financial statements and financial reporting as well. It's a tough one, but it sounds like that's where the big gap is. Is that consistent with the Auditor-General's finding that there is still a gap around the way in which agencies are able to remedy, identify or take action swiftly to minimise their IT controls? Dr McLiesh : I don't think that there's a technical gap. In fact, we've just heard from Defence that it is entirely possible to address weaknesses in IT controls. I think we have NBN here as well. They have successfully done the same thing. One of the key takeaways from those experiences is the need for entities to have strong sponsorship of leaders and for leaders to treat these matters as a whole of business risk and bring different parts of the business together, IT and others, to help resolve it. It is entirely possible to do. We think there just needs to be more of a focus on this. CHAIR: Maybe in the last couple of minutes, before we pause the hearings and come back with our session on AI, does the NBN, on that theme of leadership, taking this seriously and putting the resources in that it requires, want to talk through how that happened across the NBN? Was there buy-in across leadership of the organisation? Mr Atkinson : Our learnings are consistent with what the ANAO has said: once we realised that this wasn't an IT issue and that it was all a business issue, we brought the right resources to bear and a multidisciplinary project team looked across this. The way that we considered it was looking at it along the hierarchy of controls. What are the preventative controls that we can put in place? What are the detection controls that we can put in place? What are the mitigating controls that we can put in place? In running through that hierarchy of controls, we found that, across the business, we were able to address each one of those. For example, in the preventive controls, we worked with P&C, People and Culture, who owned the process but also owned the training and e-learning and educated our people on the importance of making sure people were removed from the system. We went into the enhancement of controls. In fact, the detection in our Splunk report was developed, and my colleague can talk more about that. That sits across all of our systems to detect when we've got inconsistencies, particularly around access to our systems. On our mitigating controls with P&C, our people and culture team now run a report by the executive on a monthly basis that tells us who has terminated people late in our system so that we can then address the behaviours and make sure that those don't get blown out. I completely concur with the comment that it took a multidisciplinary approach for us to find a pathway forward. While it was bogged down as an IT solution, because this was a behavioural issue, it was floundering. But, once we turned that corner and saw it as multidisciplinary, we found that solution. CHAIR: What do you mean by 'behavioural issue'? Mr Atkinson : Where you take somebody into the system and actually put the date and termination date into the system—if people don't do that and they don't appreciate why that's important, then that's where things tend to lag and things get done retrospectively. That's why the e-learning at the beginning is so critically important—to make sure that people appreciate the importance of that. When I talk about behavioural controls, I talk about them as soft controls. Hard controls are things that people cannot break; soft controls are things that rely on behaviours. Making sure that people's behaviour is consistent with what we require of them is very important. CHAIR: Great. What was the timing? How long did it take NBN Co to identify the problem, throw resources at it and make the necessary changes in order to quickly identify some of the risks and fix them? Mr Atkinson : Thanks for the question. Initially, the problem was identified in FY23 as a C finding. It was elevated in FY24 when the ANAO detected that people who had been terminated had accessed the system. That was elevated in importance. When that happened, that was the turning point when the multidiscipline team came together. But I defer to my colleague who was here at the time and who can maybe speak to that. Mr Sewell : You're right. That's when we put together the cross-functional team with finance-HR function which we call People and Culture—and obviously technology—and we really did stare into the full suite of controls after that. In less than a year, we had had it downgraded quite rapidly in the ANAO's estimation to a C finding again and then closed before the end of FY25. CHAIR: So, within a year and a half, you had basically fixed it? Mr Sewell : Yes. CHAIR: What were the main problems that you fixed, again? Basically, people had had access even after termination or after they had finished working for NBN Co—and a few other risks? Was there anything else? What were the other things that you had to fix? Mr Sewell : At the heart of the problem, when our HR system—and we just have one for all of our internal and external staff—was aware of the exit date of an employee, then, at that end date, all the systems automatically flowed through to remove access. But, if an employee left early or a contractor left early and the manager had not told the system that, then that didn't happen automatically. The controls we strengthened were, first of all, as Simon's talked about, the training—and also the reporting so that people would get constant reminders about taking action to tell the system when somebody is leaving before their expected contract termination date. With that, things flow through. But we also strengthened all of our detective controls. Yes, if the system had not been told that someone was leaving, it was possible for them to access the system after their termination date. It should be made clear that we never saw any instance of people accessing the financial systems or anything critical like that. We did see a few examples of people accessing their email after they had left. So we enhanced those detective controls as well so that we were able to quickly pick up—also, anytime we do observe a late termination now, it's automatically referred to our security team for an investigation. CHAIR: In the interest of time, I'm not going to go down a rabbit hole, but I thank you for that advice. This session has been very useful, and I think it gives the committee some really clear parameters on which to focus our attention. Thank you very much for giving evidence here today. If you have taken questions on notice or been asked to provide additional information, please forward your responses to the secretariat by Wednesday 13 May. If the committee has further questions, they'll be sent to you in writing through the secretariat. Proceedings suspended from 11:29 to 11:41 .