Problems with high security clearance system left 43,500 applications delayed

The scathing report from the Australian National Audit Office found Defence did not have proper oversight of the project, breaching Commonwealth Procurement Rules and landed as the Joint Committee of Public Accounts and Audit prepares to run the ruler over this and other procurement debacles across the public service, with a new inquiry announced last week.

The ANAO report, published on Thursday, July 11, found that the myClearance system, which was meant to improve the security vetting system used to enable staff with security clearances to access their workplaces, jettisoned parts of what was agreed the system would deliver.

"As a consequence, the myClearance system will not deliver the full functionality as advised to government in December 2020," acting Auditor General Rona Mellor found.

The need for an upgrade was first identified in February 2014, as the old system reached the end of its life.

In 2016, a need for "expanded security vetting" was included as one of the "principal areas of focus" for Defence's Integrated Investment Program and by the end of that year a formal reform program was established.

An initial cost estimate of $276.3 million was three times more than the initial budget, leading to the project being split.

The project was finally approved for $307.2 million over 10 years as the Vetting Transformation Project and became known as myClearance in June 2022.

The system was built by US software firm Accenture, with support from Deloitte, KPMG and project management firm VOAK Group.

The Audit Office found the process of selecting Accenture did not follow Commonwealth Procurement Rules. The tender documents mandated products by trade name and producers and changes to the technical solution in 2020 provided opportunities to the preferred supplier that were not provided to other prospective suppliers.

As the project was rolled out in late 2022, staff began to raise issues with how the vetting system worked.

These included incorrect data being displayed for users, login failures due to mismatches between surnames and date of birth in myClearance and MyGovID, communication failures regarding police checks and referrals to ASIO, and officers unable to access the system as personal mobile devices required for digital identity authentication were prohibited.

This resulted in customer service and support systems being overwhelmed, leading to "substantial" wait times for users to have their issues responded to and resolved.

A Defence spokesperson said "technical issues" delayed some security clearance cases, but did not impact on the "integrity" of the vetting process.

"Defence has implemented additional steps in ICT project delivery to improve performance and integrity of the system."

These issues were the subject of a Senate Estimates hearing in February 2023, and at the same time, a remediation taskforce was established, involving 80 staff.

The taskforce provided weekly updates to the Assistant Defence Minister, Matt Thistlethewaite. Mr Thistlethwaite blamed the issues on the former Coalition government, saying a lack of oversight from the government contributed to the delays and cost increases.

"We were given assurances that it was all going to plan and then once it went live, it failed," he said.

The audit office found the remediation taskforce had made improvements to the system after it had gone live until the taskforce was dissolved in July 2023, but said a lack of oversight from Defence allowed the project to go off the rails.

An update was provided to the Defence Minister in October 2023 outlining the fixes that had been made, however the next month, Defence advised the government that a significant part of the initial rationale for the program was not going to be met.

"Some reductions to the initial scope of the project to improve the system efficiency were recommended," a Defence spokesperson said.

Defence recommended dropping the continuous assessment, automated risk sharing, use of artificial intelligence and enhanced interface functionality.

"As a consequence, the myClearance system will not deliver the full functionality as advised to government in December 2020," the audit office found.

Four of the eight original identified business needs will not be met, and only one has been fully met, according to the ANAO.

Since then, some reporting of how the system will benefit users has occurred, but the audit office said the reports provided to it, did not identify how these benefits would be measured.

"On the basis of the benefits reporting provided to date, Defence is not able to demonstrate to what extent, if any, the expected benefits have been, or are likely to be realised."

The myClearance debacle is one five procurement sagas that will be examined by a powerful parliamentary committee.

The committee is currently accepting submissions, and will look at myClearance along with how Defence managed the supply of munitions, including when a Defence official solicited a bottle of champagne from arms supplier Thales.

To prevent what occurred with myClearance occurring on other ICT projects, the Audit Office issued two recommendations to ensure risk plans were implemented and that user access is monitored.

Both were agreed to by Defence.

In a response to The Canberra Times, a Defence spokesperson said the department had an ongoing work program to assess the compliance of Defence procurement with Commonwealth and Defence policies.

"This includes updating policy and templates, enhancing training, implementing system improvements and improving assurance activities," the spokesperson said.

"Relevant Defence personnel are undergoing a procurement and commercial upskilling program to ensure compliance with Defence's Procurement Manual, Commonwealth Procurement Rules and other policy and legislative requirements."

Since it has been rolled out, 82,331 security clearances have been completed through the myClearance system in the 2023-24 financial year, a 30 per cent clearance on the previous annual clearance record.

"Delivery timeframes for all clearance levels have consistently met or exceeded benchmark Key Performance Indicators month-on-month since November 2023," the spokesperson said.

"Defence will continue to collaborate with stakeholders and closely monitor the myClearance system over its lifespan to identify further improvements and ensure the system continues to meet requirements of a modern security clearance service."