Report of the Auditor-General No. 10 of 2025-26 – Planning and Early Implementation of the Human Resources Information System
Legislative Council, Tuesday 18 August 2026
Ms FORREST (Murchison) – Mr President, I move –
That this House note the Report of the Auditor-General No. 10 of 2025-26 Planning and Early Implementation of the Human Resources Information System
It was tabled with you, I understand, on 25 May 2026.
Members of Estimates Committee A will recall years of asking questions in health Estimates that when we were regularly informed these answers would be able to be provided or the questions responded to effectively once HRIS – I will call it HRIS – was completed. It was a regular response that provided no comfort it would ever happen and felt more like a reason not to answer genuine questions. It was very frustrating. Legitimate questions the committee was asking that we could answer those questions if we had this. Many of us held real concerns about the cost and time being spent on the human resource information system program without any clarity about what was actually being achieved for that expenditure.
The Audit Tasmania report clearly shows those concerns were. I thank the Audit Tasmania team who were involved in this work and to our Auditor-General who reports the evidence without fear or favour as the independent office requires. I do acknowledge he’s put out some pretty interesting reports of late, and they’re critical reading for all Tasmanians.
I will start with the numbers in the report because they tell their own story. This is what’s reported by the Auditor-General. Over four years, from 2020 to 2024, the Department of Health spent $47 million of public money on the HRIS program. At the end of those four years, not one intended module had been delivered. Since the program transferred to the Department of Premier and Cabinet in mid-2024, the department has spent a further $19.7 million and now anticipates it will need a further $53.1 million to complete the work.
Add that together and according to DPAC’s own business case, and expenditure to date, we’re looking at a total expected program cost of $119.8 million, close to $120 million. This is a significant cost overrun whichever way you look at it.
The other matter and a critical matter is that this IT upgrade is critical. It’s not a nice to have thing. It’s critical as current systems are clearly at the end of life and not fit for purpose. As I said, it’s not something that’s nice to have. It is essential infrastructure and it will cause cost problems if it’s not addressed.
With the cost approaching $120 million of Tasmanian taxpayers’ money committed to replace a payroll and HR system that six years ago it began, has still not been delivered to a program and support it was intended to deliver is is I’m sure, disappointing for everyone. Including those people who worked on it. We should also not forget that the need for this reform was first identified not in 2020, but in 2013, so we’ve known for a very long time that this needed to happen. We know that digital transformations are challenging and big-ticket items, but it’s been a long time and a lot of money’s been spent, and we’re seeing very little to show for it. DPAC developed a business case back then in 2013 – or maybe a little bit after. It was endorsed in 2016. A project to better configure existing systems ran until early 2021, when it was stopped following a review that found no proper project management approach, a lack of appropriate governance, a lack of reporting and accountability for decisions, and extreme or high levels of risk across every area examined. This was not the Auditor‑General’s report. This was a report done by government.
Members should note that pattern because, as I will come to it, it repeats, and that’s a major concern too. The Auditor‑General’s conclusion on Health’s management of the HRIS program is unambiguous. It was not effective or economical. But I do want to be fair to the department here because the Auditor‑General is fair to it in that report. Health did develop a largely appropriate draft business case. Credit where credit’s due, they did that. It correctly identified intended benefits, payroll efficiency and accuracy – pretty important when you’re on the receiving end of that – better workforce management, improved employee experience, reduced system outage risk. Those benefits were well aligned to real problems, including the COVID‑19 contact tracing failures at the North West Regional Hospital and issues this audit office has already reported on in 2019 in relation to specialist rostering. That feeds directly into this whole process. If members want to read another Auditor‑General’s report to update themselves, that report into specialist rostering is another important read.
The problem was never the diagnosis of the problem; it was everything that came after that. That business case was never actually finalised; it was never approved. By March 2023, three years into the program, the steering committee was told there were four different versions of the business case in existence, but none of them had formal approval. Imagine how difficult that is for people trying to deliver this, not really knowing which business case they were to be acting on. The project team could not be sure what they were actually working on it seems, and that was no doubt very challenging. Four years and $47 million were expended without clear evidence that the relevant business case had ever actually endorsed what was being built or why. We understood the problem, but you do need to have a very clear plan for those trying to deliver it, particularly in this space. Or every space, for that matter.
Underneath that failure sat three specific unresolved system design decisions: how awards should be interpreted, how to handle employees in multiple or concurrent positions, and how rostering should work consistently across the department. We’re talking about Health here initially, because Health does have significant rostering challenges, and we’ve known for a long time it’s been problematic. These problems – the three I’ve just listed – how awards are interpreted, how to handle employees in multiple concurrent positions, and how rostering should work consistently – are not IT problems. They are business and workforce policy problems that needed to be resolved before any system could be built around them. Until you resolve those matters, it’s really hard to build a system around them to make them work. These needed to be addressed and resolved before any IT solution could be fully developed. Again, on these matters, the report is quite clear. These three issues were identified as dependencies as early as 2020 and reported repeatedly and transparently to successive steering committees right through 2022 and 2023. They were never resolved.
Health commissioned its own external review in 2024, which is accepted, and it’s a good thing they did that. It found that governance of the program was ineffective and that the steering committee did not have the capability to govern a transformation of this size and scale, and that the mitigation strategies in place were not mitigation strategies at all. The audit cites one example where the proposed treatment for a risk was simply, ‘reduce the likelihood,’ which is not really a strategy. It doesn’t sound like a strategy to me. This is more a restatement of the problem. We know we have a problem; we’re just going to try to reduce the risk. A problem that really needed a proper solution to make it work.
I also want to note the finding on Cabinet’s decision to expand this from a health project into a whole-of-government solution. In May 2021, the project team was advised that Cabinet had endorsed the business case being developed with regard to it being a whole-of-government solution in the future where applicable. That is the entirety of what the program team and the Audit Office, despite its statutory powers under the Audit Act 2008, could establish about the decision; there was nothing more. According to the audit report – the information provided by the Auditor-General, he had engagement right across the relevant sectors and nobody could produce the full cabinet decision. Now, to be clear, the Auditor-General wasn’t asking for the Cabinet’s deliberations, he was asking for the cabinet decision because the decision is what the bureaucrats and people trying to deliver this program need. If they don’t have a decision or they’re not really sure what the decision is, how can they possibly implement it? This is a bit of a recurring theme for the Audit Office and something we need to take very seriously and respond to.
So, DPAC advised the Auditor‑General that it held no record beyond an email quoting from it. So he found an email quoting from the decision but not the decision itself. Was that the whole decision or part of the decision – who knows? The Auditor-General notes that this has now happened in more than one recent audit, this inability to get access to information, and we should all be troubled by that. A decision to fundamentally re‑scope a $20 million project into one that would eventually cost the state closer to $120 million was made by Cabinet and neither the officials responsible for delivering it, nor the independent Auditor-General of this state could establish with any confidence what the decision actually required.
No‑one was able to provide written evidence or an actual record of this decision and what was agreed and what was required to be delivered. How was the project team to be sure they could deliver exactly what Cabinet agreed? How could the Auditor-General audit compliance against the cabinet decision and the business case? If these documents couldn’t be produced by either party, this is deeply concerning. And the problem is far more than a technicality, it goes to the heart of accountability as to how our money is spent, what the expenditure delivers and whether the intended outcomes have been achieved. That’s what we should all be focusing our attention on, the outcomes that are achieved on the money that’s spent, or appropriated or agreed to be spent.
As noted in the report, the Department of Health did not adequately brief its ministers. The relevant minister was briefed only twice, in December 2021 and February 2022, and those briefings were basic background material. There is no evidence ministers were given what they needed to make the threshold decisions that this program required, including the decision to expand it to the whole of government. Parliament, in turn, was not adequately informed.
To give credit where it’s due, I will note one thing in Health’s favour particularly, when the program reached the point of implementation in early 2023 and the independent assurance adviser found that 20‑30 requirements were unmet and seven deliverables were outstanding from the system integrator, the steering committee did hold the rollout at that point rather than deploy an unsuitable system and that is commendable, but it’s a worry that we got to that point and that those underlying fundamental problems weren’t corrected. Given what we’ve seen in Queensland Health’s payroll disaster a number of years ago and the Canadian government’s payroll catastrophe, all of which I’ll come to, that decision not to proceed, prevented what could have been a far worse outcome for Tasmania’s public servants who rely on being paid correctly and on time. So I do commend the government and the Health department for taking that action.
As a result of this process and review, responsibility transferred to Department of Premier and Cabinet in mid 2024 and the program was rebranded the Human Resource Transformation Program or HRTP. The Auditor‑General finds real improvement here and I accept that finding. Governance has been elevated to the secretaries board; roles and accountability have been pushed out to agency leaders and business owners, rather than concentrated in the chief information officer, which was one of Health’s structural weaknesses. Risk assessment now complies with DPAC’s enterprise risk framework, and mitigation strategies are broadly proportionate, but – and we need to be really clear about this – DPAC has not resolved the fundamental problems that sank Health’s effort. They still remain unresolved problems. As at March 2026, 20 months after taking over the program, DPAC’s business case was still not finalised. The same three design decisions that defeated Health, award interpretation, concurrent employment, are now an expanded list including pay harmonisation across three different pay cycles, a payroll remediation strategy, data sharing across agencies, and integration with at least eight separate instances of the Finance One system remain unresolved. You can’t fix the problem if you don’t fix the underlying problem.
There is progress to acknowledge on some of these. A proof of concept for concurrent employment has been developed with the system integrator, Accenture, and a process for centralised award interpretation is under development. It is good to hear that there is progress being made on these problems we’ve known about for a very long time, but the audit is also explicit that other key risks, including long-term funding remain unresolved. To summarise, our independent Auditor-General, after examining six years and $67 million of continuous expenditure on this program under DPAC’s stewardship to date, cannot yet provide any assurance to the parliament as to whether it’s going to work. Hopefully, the Leader might have something more to say on this.
With regard to stakeholder engagement, the Auditor-General surveyed members of DPAC’s own human resources directors forum, the very people meant to represent business process owners in this program, in October 2025. Their responses are somewhat concerning. I will quote briefly because these are the voices of the people DPAC itself asked to be its eyes and ears across the servers. One member said, and this is reported by the Auditor-General, that there isn’t a shared updated risk register, ‘so [they] have little confidence that risk mitigation strategies are clearly defined and managed and appropriately escalated.’ Another said, they were ‘not aware of what the actual mitigation strategies are, how they were developed, or who is accountable for them.’ A third said they did not have a ‘comprehensive view of the risks and barriers and how these are being managed.’ I know one person may feel a bit at sea on this, but when you have similar concerns being raised repeatedly, it should raise alarm bells. DPAC has, to its credit, taken steps since October 2025 to address this, including an intranet page, resources for agencies, presentations on the implementation approach, and a self-reporting process. It is too early to know if this is working, and something we will need to continue to scrutinise through questions and relevant committee scrutiny.
We should also be aware of a specific and recurrent problem, money. The 2025‑26 Budget provided $24.8 million for the HRTP in 2026‑27, but DPAC’s own business case says $53.1 million is needed across the budget and forward estimates. That is a $28.3 million gap between what DPAC says it needs, and what’s actually provided by this parliament through the government’s budget. DPAC’s response to the Auditor‑General on this point was that it was working with Treasury toward a final 2027‑28 Budget request with the remaining funds, and with the whole-of-government rollout now expected to complete in 2028-29. This is one of the holes in the budget. It’s a rather large hole, but it’s one of them. If everything’s included in the 2027‑28 Budget that’s sort of been talked about as, ‘We didn’t this in this budget, it’ll be in the next one,’ it’s going to be a shocker. So, here we are again, being asked to trust that funding will materialise in future budgets for a program that has already consumed $67 million, without full parliamentary appropriation of its cost, and on the back of a program that, in its previous incarnation, spent $47 million, and delivered effectively nothing.
The Auditor‑General’s own words are, ‘There is an ongoing risk that mistakes at Health will be repeated in DPAC’s program.’ I share that concern, particularly on some levels. I also know what appears to be considering approaches to procurement in the HRTP as we are also now seeing in Health with the Blue Gum Digital Transformation Project. I raise this because it bears directly on whether the lessons of this report are actually being absorbed by the government or whether the same underlying weaknesses are already resurfacing on the very programs meant to demonstrate improvement.
I do have some questions on notice related to this matter with regard to the HRTP, but the Auditor-General’s report is explicit that detailed procurement and contract management for the HRIS program and the HRTP program are outside the scope of his audit, so he didn’t actually look at them in that particular audit. I’m not referring to a matter that was subject to an audit report and an audit finding with regard to the procurement matters, but what I am raising is a pattern that, on the evidence available to me, warrants further scrutiny and attention.
Treasury website has published information relating to contracts associated with the HRTP which show that many of those contracts priced between $90,000 and $99,990, that is just under the $100,000 threshold at which the Treasurer’s instructions require open market quoting. Eight of those contracts were priced at exactly $99,990.
Several vendors appear more than once in the list within short periods of each other at or near the same value. There is also reporting of contracts well over $100,000, well over the threshold that ordinarily require competitive tender appearing to have been exempted from that process and this goes to the heart of the questions I’ve put on notice.
There also appears to be a reported inconsistency in how one vendor has been classified for ‘buy local’ purposes between 2025 and 2026, using the same interstate address for both years. The four contracts totalling over $900,000 were reportedly executed on Christmas Eve last year. These measures require our attention, and hence my questions on notice.
I raised this because of the pattern and the fact that the HRTP is essentially reborn HRIS. This sub threshold pricing cluster just under the mandatory tender trigger, repeated awards to the same vendors and an almost total absence of competitive tension is precisely the kind of administrative behaviour that Treasurer’s instructions exist to avoid. What concerns me, is this not an isolated problem.
At Estimates hearing for health this year on 3 June, the member Elwick put to the minister and the secretary of Health that a search of the Treasury contracts’ website returned more than 130 contracts connected to the Blue Gum Health Transformation Project, another IT project in Health, each under $100,000 totalling around $12.4 million including multiple contracts to the same contractors in some cases for the same contract period.
The secretary’s answer was that these were properly characterised as labour hire rather than consultancy, that the department was complying with the Treasurer’s instructions as they currently stand and that Health has written to Treasury at least two occasions over roughly two years seeking a change to those instructions to allow a panel style arrangement for this kind of engagement. A change Treasury has on the secretary’s own advice to the committee, declined to make.
I asked the secretary directly at the hearing why we should not be concerned about another major digital transformation program showing the same low value, high volume contracting pattern that characterised the environment around the HRIS program’s failure, and I did not receive an answer that resolved that concern. The secretary’s position, as I understood it, was that the Treasurer’s instructions do not currently provide him with a suitable mechanism for directing labour hire to the scale this program requires or required, and that in the absence of that mechanism, the Department has proceeded regardless.
I’m not sure Treasury share this position nor share that approach. I accept the secretary of Health’s account was given in good faith, but a department knowingly working around a gap in the Treasurer’s instructions for two years without resolution on a program with a current capital allocation of $140 million is not, in my view, acceptable, and that is why I’ve commented on this as it is relevant to the report and its notings and findings.
Also, I want to bring to members’ attention that the government has two other matters – when you take two matters taken together – that I’ve just referred to; unresolved threshold‑adjacent contracting on the HRTP at DPAC and acknowledged threshold‑adjacent contracting on Bluegum at Health sit either side of the same central agencies that this report tells us must demonstrate improved governance if the HRTP is to succeed, where the HRIS program failed.
Both programs report at senior levels to the same secretary’s board structure now overseeing the HRTP. If that structure cannot resolve a known admitted gap in procurement practice on one major digital program for two years, we are entitled to ask what confidence we should have that the same structure will resolve the unresolved system design decisions; award interpretation – working on it, not resolved; concurrent employment – working on it, not resolved; pay harmonisation and finance systems integration that this report tells us remain open on the HRTP itself.
Mr President, I raise those matters because procurement integrity is not a side issue in this. It’s integral to the way we deliver such projects. It’s not a side issue to program governance. It does require strict guidelines and adherence to the rules and the intent of the rules. With significant expenditure going towards digital transformation, work that is urgently needed has been identified for a very long time. We need to be assured of, and actually see, robust program governance. The government and the parliament must insist on seeing program management and procurement done properly, not merely accepting assurances that it is.
Since I began writing my contribution on this motion, a further report has been tabled that speaks directly to the concerns I have just raised. I’m not going to go right into that, but I just want to bring it to members’ attention now because it moves this from a pattern I was putting to the government for explanation and to a matter the Auditor‑General has now formally confirmed. The Report of the Auditor‑General No. 1 of 2026‑27 – the annual audit update tabled on 12 August this year – examines the internal control environment of every state entity, including the Department of Health, the Tasmanian Health Service, and Ambulance Tasmania. That report, which is the one that was tabled just a few days ago – and if members went to the briefing, they would have found it a little bit disturbing – that report identifies two high‑risk items for Health: the entities fraud framework raised in October 2025, and directly on point, non‑compliance with the Treasurer’s instruction – PF3 – the procurement framework that was raised in June 2026.
The Auditor‑General’s findings here are quite clear as well. I want to put them on the record because they’re not allegations, they’re the outcome of an audit testing. From 1 July 2023 to 30 April 2026, Health awarded 508 contracts valued at more than $50,000 but less than $100,000, totalling $42.76 million. That’s 508 contracts in that range. That is an average of 169 such contracts worth a combined $14.25 million every year. The significance of that threshold is not incidental. Below $100,000, Health is not required to run a competitive process. It is not required to apply the Tasmanian content weighting and is not required to refer the engagement to the procurement review committee. A lot of it flies below the radar. Above that threshold all those requirements apply.
The Auditor‑General found Health had been in breach of PF3 in at least two specific and serious respects. First, the instruction requires the accountable authority to ensure external contracts are engaged only after options from sourcing within the agency or another agency have been fully considered. When asked to demonstrate this, Health’s own documentation told a different story. Its process is titled a ‘request for contractor resource’ form. The audit found no direction to, or evidence of, consideration of internal sourcing at all. The Treasurer’s instruction requires that. The audit also examined Health’s contract renewal process and found it weaker again – fewer control steps than a new engagement, and no consideration of whether the value or duration of a renewed contract should trigger a higher level of scrutiny.
Second, and just as concerning, the audit tested whether Health’s own explanation for the pattern could be substantiated, that contract values reflect the full duration of the project rather than an artificially short term. Therefore, of the 508 contracts, only six have been extended. The Auditor-General’s conclusion as stated in the report is that the evidence supports a finding that Health frequently reduces the duration of contract terms, specifically to keep the contract values under $100,000. I hope you’re all listening to this because it’s just blows my mind.
Ms Thomas – Doesn’t pass the pub test.
Ms FORREST – Thereby, bypassing the probity, competition and value for money requirements that apply above that threshold. We should all be very concerned about this, and I thank the Auditor-General for his work.
This is a shocking indictment on the Department of Health and the responsible minister and Treasurer. This should have been reviewed and stopped a long time ago. I’m aware of some of the reasons that have been made for ongoing practises, but I do not believe they are adequate. We have Treasurer’s instructions for a reason, and both Treasury and the department should be monitoring compliance. It seems it’s nobody’s job.
The report also confirms something else worth our attention. Of the 508 contracts, 80 had a start date before the contract’s award date, meaning contractors began work before Health had actually approved their engagement: a direct breach of the PF-3 requirement that accountable authority approval be obtained prior to appointment. That was 80. Seventeen contracts were awarded a single day after the work had already started, while 30 were awarded more than 10 days late, and one contract with JAM Web Services Pty Ltd was not awarded until 122 days after the contractor’s start date of 1 November 2025. Who was checking this? Where is the government oversight of this? Thanks to the Auditor-General, we’ve now had a light shone on this, but it’s obviously not a new problem.
Critically for this debate, the Auditor-General records that the majority of these 508 contracts relate to either digital health readiness program or the Bluegum Health Transformation, the same program I’ve just raised on the basis of the Estimates hearing in June and the questions that the member for Elwick raised. This is no longer two separate concerns sitting side by side. It’s a confirmed pattern, now independently verified by the Auditor-General, running across Health’s largest digital transformation program over close to three years – this particular one – worth over $42 million in contracts alone, and possibly – and I’ll hold my judgement on this until we’re sure – occurring in the Department of Premier and Cabinet (DPAC) with the Human Resource Transformation Program (HRTP) project. I hope those answers can be forthcoming pretty promptly on that matter, on the one on notice. I know that another minister down here said he would answer questions this week and he’s failed to do so today; maybe tomorrow.
I acknowledge, in fairness, that Health has not been silent on this. I do want to be fair. We should be. The Auditor-General records that the Secretary of Health approved new arrangements for the procurement of Information and Communications Technology (ICT) labour hire on 10 July 2026, following collaborative work with Treasury through May and June. That was after this all came to light, I might add. I welcome that change, but I would say to the House that this is now the second time within a matter of months that the parliament has been told after the fact that a Health digital transformation program has been operating outside the procurement rules that exist to protect public money. First, through the Estimates exchange on Bluegum, and now through a formal audit finding covering 508 separate contracts. Two high-risk findings, raised months apart, on the same department, on the same category of program.
If the Treasury instructions aren’t fit for purpose, let’s have a discussion about that. But they’re not subject to any parliamentary approval, so we don’t actually get involved in it. That’s a matter for the Treasurer, Treasury and the government.
I do not think it’s good enough for parliament to receive these confirmations one report at a time, months after the fact and treat them as an isolated correction. That’s why I’ve brought in the second report because I think it’s really important we look at the big picture here. This pattern is now established on the Auditor-General’s own evidence. We are entitled to ask how many other digital transformation programs across government carry the same undisclosed risk, and what assurance have we that the new arrangements that were agreed to in July have been applied, consistently, rather than simply added to the list of frameworks that look appropriate on paper but do not change practise on the ground?
I now wish to come back to the matters I referred to earlier and noted in the Auditor-General’s report. The comparative material in chapter 1 of the report should inform how we consider the matters I’ve just raised and the issue of accountability going forward. Major overspends in other jurisdictions on similar projects should not be taken as an excuse for what’s occurred here. It is a fact that HR and payroll transformation programs of this kind fail more often than they succeed worldwide. It is a challenging area. There’s no question about that. The Canadian Federal Parliament’s Phoenix payroll system costs $3.5 billion and produced years of pay errors requiring costly remediation. Queensland Health payroll system, at $1.2 billion, led to a commission of inquiry and what the report describes as terrible consequences for employees. Western Australia’s $370-million attempt to centralise shared services did not succeed. I believe that, basically, it was scrapped. A $340-million Commonwealth finance, HR and procurement system was terminated before its objectives could be achieved. Clearly, it’s not easy. The ACT spent $78 million on delivering a single module, a learning management system.
They’re the failures. I hope we don’t have to add Tasmania to it. Against that backdrop, NSW stands alone as a rare success: a $360-million program that delivered a common platform for 75 agencies in 2024, now extending to another 100. It can be done, but we need the proper processes in place to ensure that it does. These accounts clearly show that this is an area of high risk of cost overruns in a complex environment, and the NSW example demonstrates this can be done without that failure eventuating.
It’s not inevitable that government HR transformation fails. It is, however, inevitable that it fails when the business case is not finalised, when governance lacks the capability and the reach to resolve cross agency issues, and when known risks that have been reported for years remain unresolved. This is precisely the pattern Tasmania has now repeated for six years, first at Health and now, on the Auditor-General’s own conclusion, it is at risk of repeating again at DPAC.
I now turn to the submissions in appendix C, because we should not ignore the responses from government. I note that the Auditor-General almost always includes the full response of government ministers and relevant parties to ensure they’re not taken out of context, and that they have that full right of reply after they are sent a draft copy of the report.
The way the government responds to independent audit findings says as much about accountability in this state as the findings themselves. I acknowledge and appreciate the fact that these responses are, as I said, provided in full. The Premier’s response does not accept the observations or conclusions of this report. The Premier states he considers the report does not adequately or accurately characterise the program’s context and that, in his assessment, the report gives rise to conclusions that are, in his words, ‘incomplete and in material respects potentially misleading’.
I take that response seriously, as I do take any response seriously from the Premier, but I would remind members and the Premier what actually sits behind an Auditor-General’s report of this kind, because it does matter directly of how much weight this parliament should give the Premier’s blanket rejection of it.
The audit was conducted in accordance with Australian Standard ASAE 3500 Performance Engagements issued by the Australian Auditing and Assurance Standards Board. This is the specific standard governing how performance audit must be planned, evidenced and concluded for the purpose of the Auditor-General expressing a reasonable assurance opinion, not a lesser indicative one.
Separately, the Tasmanian Audit Office, as a firm, operates under Australian standard ASQM1, which requires it to maintain an ongoing system of quality management, covering ethical requirements, professional standards and regulatory compliance across its practice as a whole. One standard governs this engagement, the other governs the office itself.
Those two things, serious rules or the standards they apply. On top of that, the Auditor-General’s rejoinder sets out the specific discipline behind this report. Quality gate controls at every phase, planning, implementation, reporting and tabling, an independent team member who substantiated the report before release, tracing every finding back to the evidence and giving the significance of this program an additional technical review committee, and an externally contracted engagement quality reviewer who examined the entire audit file. So, don’t tell me it hasn’t been properly considered and is potentially misleading. It is an inappropriate comment, and I ask the Premier to think seriously about making such comments and communication to our Auditor-General, who has far more standards imposed on him than it seems the government does.
Mr President, this report is based in the evidence collected by Audit Tasmania. They haven’t gone off looking for a witch hunt, they’ve looked at the evidence available. I say this not to suggest the Premier has no right to disagree with how the findings are framed, of course he does, and his office and both secretaries have set out in length in Appendix C, their views on that. But there is a difference between disagreeing with framing and treating that disagreement as equivalent with the findings being unreliable or potentially misleading. There’s a very big difference. Nothing in any of these three responses of the relevant entities identifies a factual error in the evidence base, a departure from the ASAE 3500, or a defect in the officers ASQM1 quality management. What is offered is a difference of interpretation about the complexity and sequencing, which does not, in my assessment, displace a reasonable assurance conclusion reached through this process. The secretary of Health’s response accepts that the HRIS program did not proceed to implementation, and did not deliver its intended outcomes, he was accepting that and acknowledges the report’s findings on governance and risk – management. I think he was taking some responsibility there. That acceptance is appropriate and I welcome it.
But the secretary’s response also pushes back on the characterisation that the program delivered no outcomes at all, pointing to a configured system architecture, business process works and artefacts that have been used since, by DPAC. Well, the proof will be in the pudding on that, Mr President. There is something to that, as well. Work is not always visible in a deployed system, but I would say is that configured artefacts and design documentation, not the same as a working payroll and HR system for the people who needed it. After four years and $47 million, that is what Health was funded to deliver and did not. It will remain to be seen whether the things that were delivered actually don’t see the the cutting room floor, because those underlying problems that were fundamental at the start are still not fully resolved.
The response from the secretary of DPAC and Head of State Service goes further still. She rejects the audit’s framing of this as two separate programs, arguing it has always been one continuous program of work across six budget periods and six sets of Estimates hearings – I did refer to those, and how frustrating they were earlier – and that the modules now being delivered by DPAC are a direct product of the work done by Health. Well, let’s see if we can get the information out of it. She specifically disputes the finding that the program did not progress to system testing, stating that the system integration and data migration testing was in fact undertaken in 2023-24 with formal deliverables, and that this work underpinned the first live deployment of the People Central Establishment Management module in DPAC, in November 2025. We do also need to remember that’s when the review was done by Health that said: woah, we better stop, it’s not working.
The Secretary of DPAC also provides revised cost estimates, putting the net present value of the implementation cost to 2028 at $75.4 million, rather than the $53.1 million reference elsewhere. It has gone up even more while arguing the projected system will ultimately be cheaper than the ageing systems it replaces over a four-year horizon. I would hope that’s a no brainer when we have so many problems in the current system. We don’t want a Queensland situation where we end up with some commission of inquiry into stuffed up payroll.
In my own observation, whether one characterises this as one continuous program or not, the plain fact remains that $47 million was spent under Health stewardship without a functioning system reaching a single Tasmanian public servant, and that six years after this reform began and 20 months after DPAC assumed responsibility, the state’s independent auditor cannot give this parliament assurance that the program will succeed. Disagreement about framing does not change that reality.
The Auditor-General makes one recommendation to Health and two to DPAC. All are accepted, and I welcome that. However, we cannot take accepted or even completed at face value where the cultural and good governance problems persist. Health has marked as completed its acceptance of stronger business case requirements, project gating and external communication frameworks; those matters we will need to follow up in budget and Health scrutiny, particularly in relation to the Bluegum Digital Transformation project. DPAC is also marked as completed its finalisation of the business case and the embedding of project gates. These administrative steps matter and I’m not dismissing them, but they should have been there at the start, but this report itself demonstrates that Health had governance frameworks, risk registers, and reporting structures that looked appropriate on paper throughout the life of the HRIS Program.
The Auditor-General found that the risk register had all the required elements and that reporting to steering committees was genuinely transparent. The failure was not the absence of a framework; it was the absence of capability and authority to act on what the framework revealed. A tick against completed on a recommendation without establishing a gating process tells us nothing about whether the next set of officials sitting around that table has a seniority, the reach across agencies, and the willingness to actually pause the program when the evidence says it should be paused, but let’s hope that is the case. Let’s hope they can deliver it.
This is why we need to continue to scrutinise and ask questions about costs and delivery of these digital transformation projects. As I said, the need for HR and payroll reform in the Tasmanian State Service is real and it’s been real since 2013, particularly across the health sector. More than 40 ageing systems over 20,000 staff on manual fortnightly timesheets. This is more an issue in like Health, for example, you do have large rostering demands, 30 industrial instruments, $6 billion in wages and salaries paid annually. The case for a modern integrated system is absolutely not in dispute. DPAC’s own estimate that a working system could save the state $296 million over 14 years is a benefit worth pursuing properly.
What is in dispute though, and what this report puts beyond dispute is whether the way we have gone about pursuing that benefit to this point has been effective, economical and properly accountable to the department. I share the Auditor-General’s view on this, it hasn’t. Tasmanian’s have paid $67 million for a program that has yet to deliver on top of the $47 million that health spent and cannot account for in outcomes, and we are now told a further $53 million or on DPAC’s revised figure, $75.4 million is required without the funding to match fully appropriated across the forward Estimates. That’s a hole in the forward estimates that will have to be filled if we’re going to see this this delivered.
Programs of this scale and complexity are not a reason for less scrutiny; they’re an argument for the contrary. They are precisely why we must maintain it. I do thank the Auditor-General and Audit Tasmania for their work on this important matter, not just in the HRIS report but also the most recent annual audit update that was released last week. These are incredibly important matters. I’m sure his office as well as the members will be watching the progress of the HRTP and Bluegum digital projects and other digital transformation projects, whether perhaps a bit more renewed interest.
I note the report.