Introduction

1.1 Since its emergence in late 2019, coronavirus disease 2019 (COVID-19) has become a global pandemic that is impacting on human health and national economies. On 21 January 2020 the Australian Government listed COVID-19 as a disease of pandemic potential under the Biosecurity Act 2015.² The World Health Organisation declared COVID-19 to be a ‘public health emergency of international concern’ on 30 January 2020.

1.2 From February 2020, the Australian Government commenced the introduction of a range of policies and measures in response to the emergence of COVID-19. On 18 March 2020, in response to the pandemic in Australia, the Governor-General of the Commonwealth of Australia declared that a human biosecurity emergency exists.³

1.3 The Australian Government’s health and economic response has included:

• travel restrictions and international border control and quarantine arrangements;
• delivery of substantial economic stimulus, including financial support for affected individuals, businesses and communities; and
• support for essential services and procurement of critical medical supplies.

1.4 With the release of the 2020–21 Budget on 6 October 2020, the Australian Government reported it had committed $507 billion in overall support since the onset of the pandemic, including $272 billion over five years (2019–20 to 2023–24) in direct economic and health support.

1.5 Risks in relation to the rapid development and implementation of major new measures may arise from workforce redeployment, IT system development and data integrity, stakeholder engagement and coordination, adapting service delivery, potential internal and external fraud, and non-compliance with regulatory requirements.

Key Commonwealth requirements on risk management

1.6 Under the Public Governance, Performance and Accountability Act 2013 (PGPA Act), the accountable authority must establish and maintain:

• an appropriate system of risk oversight and management for the entity; and
• an appropriate system of internal control for the entity; including by implementing measures directed at ensuring officials of the entity comply with the finance law.⁴

1.7 This legislative requirement is supported by the Commonwealth Risk Management Policy, which sets out nine elements that non-corporate Commonwealth entities must comply with in order to establish an appropriate system of risk oversight and management (Box 2).⁵

Source: Reproduced from the Commonwealth Risk Management Policy (1 July 2014).

1.8 The stated goal of the Commonwealth Risk Management Policy is to embed risk management as part of the culture of Commonwealth entities where the shared understanding of risk leads to well informed decision making.

Economic response measures administered by the ATO

1.9 The Australian Taxation Office (ATO) is a non-corporate Commonwealth entity within the Treasury portfolio. Under the PGPA Act, the accountable authority of the ATO is the Commissioner of Taxation. The responsibilities of the ATO includes the administration of legislation governing tax, superannuation and the Australian Business Register, and supporting the delivery of government benefits to the community. The ATO has a workforce comprising just over 21,000 staff (as at 30 June 2020). The ATO is structured into five main groups — Client Engagement, Law Design and Practice, Service Delivery, Enterprise Solutions and Technology, and Enterprise Strategy and Corporate Operations.

1.10 The ATO is responsible for implementing and administering six measures as part of the Australian Government’s economic response to the COVID-19 pandemic (Table 1.1).

Table 1.1: Overview of the six economic response measures administered by the ATO

Note: The ATO informed the ANAO that the introduction of the 2020–21 Budget measure, JobMaker Plan — temporary full expensing to support investment and jobs (see Box 3), is likely to reduce the uptake and cost of Enhancing the Instant Asset Write-Off and Backing Business Investment measures over the forward estimates period.

Note a: The government announced an extension to this measure on 6 October 2020 (see Box 3).

Note b: See page 13 of the Explanatory Memorandum, available at: https://www.legislation.gov.au/Details/C2020B00036/Explanatory%20Memorandum/Text [accessed 6 October 2020].

Note c: On 22 May 2020, the Department of the Treasury and the ATO issued a joint statement advising of a reporting error in estimates of the number of employees likely to access the JobKeeper scheme. The statement advised that Treasury’s revised estimate of the cost of the JobKeeper scheme is around $70 billion (not $130 billion).

Source: ANAO, based on public records and the ATO’s records.

Announcement, legislation and implementation timeframes

1.11 The six economic response measures were announced, legislated and implemented between 12 March and 1 July 2020. Key implementation milestones are listed in Figure 1.1.

Figure 1.1: Key implementation milestones for the six economic response measures administered by the ATO

Source: ANAO, based on public records and the ATO’s records.

1.12 All six measures required legislation to be passed in the Parliament of Australia. The six measures were contained in three pieces of legislation:

• the Coronavirus Economic Response Package Omnibus Act 2020, which provides for Enhancing the Instant Asset Write-Off, Backing Business Investment, Early Release of Superannuation, and Temporary Reduction of Superannuation Minimum Drawdown Rates, and consequential amendments to enable Boosting Cash Flow for Employers;
• the Boosting Cash Flow for Employers (Coronavirus Economic Response Package) Act 2020, which provides for the named measure; and
• the Coronavirus Economic Response Package (Payments and Benefits) Act 2020, which provides for the Treasurer to make rules relating to economic response payments.
  • On 9 April 2020, the Treasurer made rules for the JobKeeper scheme, which were set out in a legislative instrument called the Coronavirus Economic Response Package (Payments and Benefits) Rules 2020.

1.13 The period between announcement and implementation was between four to six weeks for three measures — JobKeeper, Boosting Cash Flow for Employers, and Early Release of Superannuation.

Subsequent announcements

1.14 Since the six measures were originally announced and legislated, the Australian Government has announced a number of further changes to some measures, particularly JobKeeper (Box 3).

Note: As at 25 November 2020 all of the announced changes had been legislated.

Source: ANAO, based on public records.

1.15 In his opening statement to the Parliament of Australia’s Senate Select Committee on COVID-19 on 7 May 2020, the Commissioner of Taxation articulated the ATO’s approach to administering the economic response measures as follows:

In response to COVID-19, the ATO has pivoted our focus to ensure the efficient rollout of the five key measures, in particular the JobKeeper payments, early release of superannuation, cash flow boost, increasing the instant asset write-off, and accelerated depreciation. Our priority has been to deliver on the government’s commitment to get millions of Australians access to financial support quickly and as easily as possible during this difficult time.⁶

The ATO’s risk management policy and Enterprise Risk Management Framework

1.16 The ATO’s risk management policy is set out in a Chief Executive Instruction on Risk Management.⁷

1.17 The ATO’s Enterprise Risk Management Framework (ERMF) is an overarching document that sets out how the ATO addresses requirements under the PGPA Act, the Commonwealth Risk Management Policy, and in accordance with AS ISO 31000:2018.⁸

1.18 As illustrated in Figure 1.2, the ATO’s ERMF is built on four pillars — governance, informing decisions, culture, and data-driven insights. The ERMF includes a four-step methodology to support the identification and management of risks.

Figure 1.2: The ATO’s Enterprise Risk Management Framework and risk methodology

Source: Reproduced from the ATO’s Enterprise Risk Management Framework (Version 1.3, 24 April 2020).

1.19 The ATO’s ERMF is supported by a number of guidance documents and tools, including a Risk Management Guide⁹, a Shared Risk Guide, a Risk Tolerance Guide, and various templates such as the Risk Assessment and Treatment Plan template.

1.20 The ATO’s ERMF distinguishes between three levels of risk — strategic, enterprise, and business — and sets out the responsibilities for managing risks across the ATO. This includes defining roles for the Commissioner of Taxation, various committees (such as the Enterprise Risk Management Committee, and the Audit and Risk Committee), a Chief Risk Officer supported by a Corporate Risk and Assurance Branch, as well as individual risk owners and risk managers.

Rationale for undertaking the audit

1.21 The COVID-19 pandemic and the pace and scale of the Australian Government’s response impacts on the risk environment faced by the Australian public sector. This audit is one of five performance audits conducted under phase one of the ANAO’s multi-year strategy that will focus on the effective, efficient, economical and ethical delivery of the Australian Government’s response to the COVID-19 pandemic.¹⁰

1.22 The ATO is playing a significant role in supporting the Australian Government’s economic response to the COVID-19 pandemic. An early stage audit examining the ATO’s risk management arrangements will inform ongoing administration of the measures, including strategies to support the integrity of the measures.

Audit approach

Audit objective, criteria and scope

1.23 The objective of the audit was to assess whether the ATO has effectively managed risks related to the rapid implementation of COVID-19 economic response measures.

1.24 The three high-level criteria were:

• Was appropriate planning undertaken for rapid implementation?
• Were changes in the ATO’s risk environment appropriately assessed, documented and communicated?
• Have identified risks been effectively managed, monitored and reviewed?

1.25 The scope of the audit focused on the six economic response measures, announced in March 2020, and the impact of those measures on the ATO’s existing operations.

Audit methodology

1.26 The audit methodology involved:

• document examination, including the ATO’s advice on implementation matters to government and other entities, governance committee agendas and minutes, project material, and information recorded in the ATO’s Enterprise Risk Register; and
• interviews with ATO staff, including the Chief Risk Officer, the project leads for the economic response measures, and members of governance and oversight committees.

1.27 The audit did not include an assessment of the design, effectiveness or outcomes of the six measures.

1.28 The audit was conducted in accordance with ANAO Auditing Standards at a cost to the ANAO of approximately $437,000.

1.29 The team members for this audit were Michael McGillion, Amanda Reynolds, Chay Kulatunge and Mark Rodrigues.

2.1 To form a view on the ATO’s planning to support the rapid implementation of the six economic response measures, this chapter examines whether the ATO:

• established suitable governance and oversight arrangements for the six measures;
• followed a sound process to identify and obtain required resources and capabilities for the six measures; and
• undertook consultation with government entities and external stakeholders, including on shared risks.

Were suitable governance and oversight arrangements implemented?

2.2 The Commonwealth Risk Management Policy includes a number of requirements in relation to the governance and oversight of entity risks, in particular that:

• the accountable authority of an entity must define the responsibility for managing risk, including by defining entity roles and responsibilities in managing individual risks; and
• each entity must ensure that the systematic management of risk is embedded in key business processes, including in the establishment of governance arrangements.

2.3 The Commonwealth Risk Management Policy defines ‘risk oversight’ as the ‘supervision of the risk management framework and risk management process’.

2.4 The policy requirements in relation to risk governance and oversight arrangements are reflected in the ATO’s Enterprise Risk Management Framework, and in the ATO’s Chief Executive Instruction on Risk Management.

Responsibilities for managing risk

2.5 As discussed in paragraph 1.20, the ATO’s Chief Executive Instruction on Risk Management refers to two key roles responsible for managing individual risks. The ‘risk owner’ is personally accountable for an identified risk, and is responsible for setting risk tolerance and overseeing risk management activities in relation to that risk. The ‘risk manager’ supports the risk owner by managing the risk under the risk owner’s direction, and escalating emerging risks to the risk owner for consideration.

2.6 As shown in Table 2.1, the corporate Risk Assessment and Treatment Plans (discussed further in paragraph 3.14) for four of the six measures identified the Senior Accountable Officer (see paragraph 2.11) as the risk owner, and the project manager as the risk manager. The remaining two measures identified the supervisor of the Senior Accountable Officer¹¹ as the risk owner, and the Senior Accountable Officer as the risk manager.

Table 2.1: Identified risk owners and risk managers for the six economic response measures

Note: ‘SES’ is a Senior Executive Service officer, ‘EL’ is an Executive Level officer.

Source: ANAO, based on the ATO’s records.

2.7 Supporting the risk owners and risk managers nominated at a whole-of-measure level, the ATO identified officers who would be responsible for managing one or more project-level risks recorded in the project risk register for three measures (JobKeeper, Early Release of Superannuation and Boosting Cash Flow for Employers).¹² The officers were recorded in the risk registers as ‘risk owners’ for these subordinate risks.

2.8 As well as identifying risk owners for each measure, the ATO had previously identified the Deputy Commissioner, Integrated Compliance as the risk owner for enterprise risks associated with external fraud and serious and organised crime, and recorded this detail on the Enterprise Risk Register. On 9 April 2020 the Deputy Commissioner, Integrated Compliance assigned four SES Band 1 officers, each supported by an EL2 officer, to develop strategies to mitigate risks to the integrity of the tax and superannuation system specifically stemming from the economic response measures. Five of the six Risk Assessment and Treatment Plans listed SES officers from Integrated Compliance under ‘other risk owners, managers or contacts’.

Project management and governance

2.9 The ATO has an established methodology, process and set of governance arrangements associated with the implementation of new policy and law measures where the ATO is responsible for administering implementation, either whole or in part.

2.10 The ATO adjusted its existing project management framework for new policy measures, with the purpose of providing a ‘streamlined approach to governance’ for the six measures. This approach involved reducing the number of ‘gates’ through which each project had to pass compared to the ATO’s established project pathway, as well as reducing or changing the project ‘artefacts’¹³ that needed to be maintained.

2.11 The ATO assigned a ‘Senior Accountable Officer’ (SAO) for each of the six measures in accordance with its governance framework for new programs/projects.¹⁴ The SAO is accountable for ensuring the project is governed according to the ATO’s Program and Project Management Policy, including meeting project objectives and outcomes, escalating significant risks, and meeting assurance requirements unless an oversight committee is in place.¹⁵

2.12 An ATO COVID-19 Steering Committee, chaired by an acting Second Commissioner, was formed in March 2020. The Committee’s role was to provide high-level strategic leadership and oversight of the ATO’s activities in response to the pandemic ‘from the initial impact to returning operations to normality’. Deputy Commissioners from across the ATO are members of the Committee, providing advice and guidance on business continuity management, risks and business operations including the six measures.

2.13 Governance structures were established for all of the six measures as illustrated in Figure 2.1. For five of the measures, this involved using pre-existing committees:

• the Policy and Implementation Committee for Enhancing the Instant Asset Write-Off, and Backing Business Investment; and
• the Superannuation and Employer Obligations Project Change Committee for the Early Release of Superannuation, Temporary Reduction of Superannuation Minimum Drawdown Rates, and Boosting Cash Flow for Employers.

2.14 A new governance committee was established for the JobKeeper scheme called the JobKeeper Program Board, initially consisting of Second, Deputy, and Assistant Commissioners from across the ATO. The Charter stated that the JobKeeper Program Board was responsible for the operation of the scheme, to focus on the end-to-end design of the scheme, emerging risks and issues and significant changes that threatened the scheme’s implementation, and to monitor the scheme’s performance.

Figure 2.1: Governance structures for the six economic response measures

Source: ANAO, based on the ATO’s records.

2.15 The ATO categorised the Temporary Reduction of Superannuation Minimum Drawdown Rates measure as a ‘Business Line’ project. The ATO considered that as the measure involved a change in the drawdown rate from that in prior legislation and no major transition strategies were required, ongoing management could be undertaken as part of business-as-usual activities by the business area.

Oversight of the measures

2.16 Oversight of the six measures was provided through the COVID-19 Steering Committee and governance committees for each measure, such as the JobKeeper Program Board, and, at a higher level, through the ATO’s existing oversight mechanisms — principally, the ATO Executive Committee.

2.17 The Chair of the COVID-19 Steering Committee provided regular briefings to the ATO Executive Committee on the issues arising in conducting the ATO’s functions, covering both measure-specific and existing activities. From 17 March until 8 May 2020, these briefings occurred on a daily basis, but were reduced to a weekly meeting from 15 May 2020 as implementation progressed. Deputy Commissioners updated the Steering Committee members on the issues arising within their business lines as a result of COVID-19 and advised how these were being addressed. On 31 July 2020 the COVID-19 Steering Committee was advised by its Chair that the ATO’s COVID-19 response was mature and that any operational issues would be managed in the future by the Chief Operating Officer.

2.18 A number of papers were provided to the ATO Executive Committee on the six measures. This included a paper considered by the Committee on 2 June 2020 entitled ‘Risk approach to COVID-19 stimulus measures’. The paper explained that the ATO’s risk appetite and risk tolerances for the measures were being established through ‘lived experiences’ (with examples provided of this approach). The paper also provided risk profiles for the JobKeeper, Boosting Cash Flow for Employers and Early Release of Superannuation measures, as well as a summary of the risk and decision process for each measure. The ATO Executive Committee endorsed the risk strategy for the economic response measures, noting that additional work was required to clearly articulate the risks arising along with the mitigation and compliance strategies.

2.19 To address the request from the ATO Executive Committee, a further paper was provided to the Committee on 30 June 2020 with an update on the compliance programs for JobKeeper, Boosting Cash Flow for Employers, and Early Release of Superannuation. The paper noted that the top three joint risks for JobKeeper and Boosting Cash Flow for Employers were:

• enterprise risk (for example, whether the entity exists and shows signs of business activity);
• registration risk (for instance, the ATO would check for Australian Business Number manipulation); and
• turnover (as indicated by changes in GST data).

2.20 The paper also noted that, for the most part, the compliance programs are not anticipated to take longer than the life of the measures unless there has been fraudulent or criminal behaviour. The ATO Executive Committee agreed that an important factor of the compliance program is to balance the government requirements with community views on fairness. The Executive Committee further agreed that it is essential to have the correct settings to maintain community confidence and these may need to be recalibrated regularly.

Other committees

2.21 The ATO’s Enterprise Risk Management Committee (ERMC) did not have a significant role in overseeing the six measures. As discussed further in paragraph 3.15, none of the six measures (individually or collectively) were categorised as ‘enterprise risks’, which would have required direct oversight by the ERMC. Consistent with its role of overseeing enterprise risks, the ERMC considered matters associated with the ATO’s response to the COVID-19 pandemic.¹⁶

2.22 On 10 June 2020, the ATO’s Audit and Risk Committee was briefed on the ATO’s role in the Australian Government’s pandemic response. The role of the Audit and Risk Committee is to provide independent assurance to the Commissioner of Taxation on the appropriateness of the ATO’s financial reporting, performance reporting, system of risk oversight and management and system of internal control.

Review of governance arrangements for JobKeeper

2.23 In May 2020, the ATO engaged an external firm (PwC) to undertake a review and provide recommendations for a fit-for-purpose accountability and governance structure for the next phase of the JobKeeper scheme. In July 2020, ATO’s Chief Risk Officer presented a paper to the ATO Executive Committee recommending the establishment of an oversight committee for the JobKeeper program.¹⁷ The paper also recommended that the scope of the oversight committee include the six economic response measures, and that the Senior Accountable Officer for the JobKeeper measure remain at Deputy Commissioner level (rather than being elevated to Second Commissioner as was proposed in the review).

2.24 The ATO Stimulus Measures Oversight Committee held its first meeting on 25 August 2020.¹⁸ At this meeting, the Committee received the executive summary of a draft report from an external firm (PwC) that had been engaged to review the ATO’s governance, risk and assurance over the six economic response measures. The draft report identified a number of opportunities for improvement, including that the ATO provide greater definition of its risk appetite and tolerances, to provide more guidance for all people involved in how key decisions are made and the trade-offs. The draft report also noted that the boundaries of accepted tolerances should be based on reliable, relevant data, and regularly re-calibrated.

Record keeping

2.25 The ATO’s Risk Management Guide states that the purpose of recording and reporting in the risk management process is to:

• communicate risk management activities and outcomes across the organisation;
• provide information for decision-making;
• improve risk management activities; and
• assist interaction with stakeholders, including those with responsibility and accountability for risk management activities.

2.26 The ATO used its Internal Audit staff to support the measure-specific project teams by establishing ‘decision logs’ for each of the measures. The decision logs were intended to complement the record of risk management considerations in the implementation of the measures. Other records, such as the Risk Assessment and Treatment Plans, were retrospectively prepared by the ATO’s Corporate Risk and Assurance Branch in conjunction with the project teams, drawing on contemporaneous documents created for the measures.

2.27 The email and other records maintained in the decision logs evidence a range of activities undertaken across the ATO to implement the six measures, including responding to questions raised by the Department of the Treasury and addressing IT issues.

2.28 The ATO has also maintained documentation of the key meetings, deliberations and decisions of the governance committees and boards for each of the measures and the higher level oversight committees.

Was a sound process followed to identify and obtain required resources and capabilities?

2.29 Key lessons from previous performance audits of entities involved in the rapid implementation of Australian Government initiatives have highlighted the importance of:

• drawing upon the full range of human resources available to support the design, implementation and administration of significant programs, adopting a strategic, entity-level approach where necessary; and
• quickly identifying and addressing necessary ICT system enhancements and development required to support rapid program delivery.¹⁹

2.30 In implementing the economic response measures, the ATO also needed to identify the impacts on its business-as-usual activities, including preparations for Tax Time 2020.

Securing the full range of necessary human resources

2.31 The ATO’s records indicate that over 10,000 staff were reassigned or placed on standby to support the implementation of the economic response measures (Box 4).

2.32 The ATO adapted its existing processes to train staff to support the economic response measures, as the measures were delivered through existing business line areas rather than discrete new areas. These processes primarily comprised the reallocation of existing resources within each group, the redeployment of staff internally between groups within the ATO, and the increased recruitment of casual and contracted staff through mechanisms used to boost staffing numbers to meet the demands of Tax Time.

Source: ANAO, based on the ATO’s records.

2.33 On 17 March 2020, the ATO tasked its groups²⁰ to collate a list of both critical functions that would be a priority for staffing, and those functions that could cease work immediately and redeploy to support priority areas. This task identified four likely impacts on ATO staffing:

• business continuity needs during the pandemic, both within the ATO and whole-of-government;
• a strategic decision to temporarily scale down the ATO’s discretionary work programs in the face of disruption to business-as-usual interaction with taxpayers as well as to alleviate regulatory burden on the community (Box 5);
• increased demand-driven work associated with taxpayers contacting the ATO to seek relief or advice as a result of the economic effects of the pandemic; and
• the announcement (on 12 March 2020) of the first tranche of economic support measures to be led by the ATO (Boosting Cash Flow for Employers, Backing Business Investment and Enhancing the Instant Asset Write-Off, later supplemented with the remaining measures).

Source: ANAO, based on the ATO’s records.

2.34 The critical functions lists were intended to inform discussions between groups to internally redeploy staff, where a group could not secure adequate staffing to support the economic response measures from within its existing resources. Responsibility for determining the number of staff and level of training required to support the new measures lay with the receiving group (that is, the group who would use the staff). Groups offering staff would then liaise with the receiving group to match available staff to vacant positions and identify any skill gaps requiring training based on the existing experience of the identified staff members.

2.35 The COVID-19 Steering Committee maintained oversight of these discussions, but did not adopt a decision-making role in relation to individual redeployments. On 26 March 2020, an SES officer within the ATO’s Enterprise Strategy and Corporate Operations Group was appointed to coordinate efforts to identify re-deployable staff. This officer was responsible for:

• briefing the Assistant Minister to the Prime Minister and Cabinet on the ATO’s internal redeployments;
• identifying excess non-critical staff that might be redeployed across the broader Australian Public Service; and
• ensuring internal redeployments supported the ATO’s strategic priorities (that is, new measures and critical business-as-usual functions).

2.36 On 30 March 2020, the ATO Executive Committee was briefed on a consolidated version of the critical functions list (Table 2.2), which had been further refined to categorise staff by availability to move.

Table 2.2: ATO assessment of staff availability for redeployment as at 30 March 2020

Source: ANAO, based on the ATO’s records.

2.37 Later on 30 March 2020 the ATO provided summarised figures and advice on its staffing needs to the Chief Operating Officer of the Australian Bureau of Statistics. The advice was to be included in a consolidated response from the Treasury portfolio to the Australian Public Service Commission in compliance with a direction from the Prime Minister under section 21(1) of the Public Service Act 1999. The advice concluded that apart from ‘small individual requests’ to redeploy staff to other Australian Public Service agencies, the ATO would generally be unable to support requests to redeploy staff due to its need for staff to support ATO critical functions (both immediately and in a contingency capacity), noting the ATO’s role in the COVID-19 economic response.

Engagement of casual staff

2.38 Besides internal redeployment of staff, the ATO adjusted its existing practice of engaging casual staff to meet the seasonal demand experienced by the ATO during Tax Time. The ATO prepared a revised forecast of casual staffing needs based on an analysis of contact centre traffic throughout March and April 2020. The ATO informed the ANAO that it brought forward the engagement of casual staff because staffing demand driven by the pandemic and economic response measures occurred earlier in the year than the demand expected for Tax Time 2020 (Box 6).

2.39 The ATO conducted a risk review of its pre-engagement and integrity clearance (PEIC) processes in April 2020. Based on this assessment the ATO approved a temporary relaxation of PEIC requirements that would permit casual staff to be conditionally engaged while certain integrity checks were being completed. The risk associated with this decision was categorised as a ‘business risk’²¹, and placed on the Enterprise Risk Register on 4 April 2020 with a review date of 8 November 2020. This risk was ‘closed’ by the ATO on 3 August 2020 following a return to business-as-usual practices for pre-engagement checks.

Note a: For comparison, the ATO informed the ANAO that it engaged 459 casual employees for Tax Time 2019 and was planning to hire 600 casual employees for Tax Time 2020.

Source: ANAO, based on the ATO’s records.

Changes to IT infrastructure and systems

2.40 The ATO identified three major ICT change requirements for the delivery of the economic response measures:

• the rapid, wide-scale adoption of working from home arrangements as a business continuity measure in March 2020;
• provisioning large numbers of new staff with ICT equipment and systems access and expanding telephony capacity as staffing surged to support ATO contact centre operations; and
• the rapid development and implementation of ICT systems enabling the delivery of the economic response measures.

2.41 The ATO informed the ANAO that, prior to March 2020, the ATO’s remote working solution permitted a maximum of 1400 staff to connect remotely to ATO systems. The ATO engaged with service providers to identify a scalable solution using existing platforms, and commenced a pilot on 16 March 2020. The pilot was expanded each day. By 27 March 2020 the COVID-19 Steering Committee was briefed that approximately 9000 staff were able to log in remotely and by 1 April 2020 this had increased to approximately 11,000 staff.

2.42 The COVID-19 Steering Committee was briefed that the ATO had procured 2000 additional laptops and monitors for staff who required them to work remotely, and that these were distributed to staff from 2 April 2020 onwards. The ATO informed the ANAO that routing contact centre traffic to remote working staff was within the capacity of a new telephony platform that the ATO had deployed in February 2020, and the reconfiguration of the system was tested before full deployment.

2.43 The ATO forecasted likely telephony demands for the contact centre based on Tax Time 2019 call volumes, known peak periods in the implementation schedule for the economic response measures, and information collected in early registration phases of relevant measures. The ATO informed the ANAO that it used configuration changes of existing telephony infrastructure and negotiated flexible license arrangements with vendors to address the forecasted contact centre demand.

2.44 Systems development for JobKeeper, Early Release of Superannuation and Boosting Cash Flow for Employers followed standard but expedited development processes.²² ICT system design was integrated into the core design teams for these measures, ensuring it supported policy, legal and business requirements. The ATO informed the ANAO that senior decision makers for each measure provided direction for ICT design on a daily basis, to a greater extent than would ordinarily occur, and that developers were reassigned from lower priority projects and worked extended hours or in around-the-clock shift arrangements for surge periods before key roll-out dates. The risk of staff burnout under these conditions was monitored and reported to the COVID-19 Steering Committee.

Sufficiency of mobilised resources

2.45 The ATO mobilised staff to manage the increased contact centre traffic associated with the new measures. Key announcements on 12 and 22 March 2020 and commencement dates on 20 April (for JobKeeper, and Early Release of Superannuation) and 4 May 2020 (for JobKeeper) precipitated record-setting contact centre demand, as shown in Figure 2.2. Full ICT capacity and/or staffing capacity was reached at peak periods on several days, resulting in calls being blocked.²³ These issues were transient and actively managed by the ATO.

Figure 2.2: Inbound call statistics for the ATO contact centre 13 March to 21 May 2020 (business days only)

Source: ANAO, based on the ATO’s data.

2.46 In addition to the call blocking depicted in Figure 2.2, in the period 21–28 April 2020, the ATO blocked 71,563 calls at a network level²⁴ to manage the load on its telephony networks.

2.47 The ATO also experienced service degradation between 20–22 April 2020 that prevented at least 109,457 calls from connecting to the ATO.²⁵ On 21 April 2020 the ATO commenced an investigation into the service degradation and identified that 16 per cent of its contact centre trunk capacity was unavailable as it had been used to enable a working from home pilot. The COVID-19 Steering Committee was briefed that the full contact centre trunk capacity was restored on 22 April 2020.

2.48 The ATO informed the ANAO that it experienced some issues on-boarding new staff such as temporarily running out of available telephone number ranges and delays to system access. Between April to July 2020 the COVID-19 Steering Committee expressed its overall satisfaction at the level of ICT support being provided to support the recruitment of staff and the significant contact centre demand.

2.49 The ATO identified ICT system enhancements and developments and mobilised resources to support the implementation of the measures. Systems for JobKeeper, Early Release of Superannuation and Boosting Cash Flow for Employers were deployed in accordance with the scheduled timeframe. System capacity for ATO Online and related services was exceeded once between 1–2 July 2020. The ATO responded by limiting the number of external users accessing the service concurrently. The ATO had prepared for this contingency by implementing a ‘wait-listing’ solution prior to 18 April 2020 that permitted users up to maximum capacity to continue using the service while excess users were directed to try again later.

2.50 As the ATO’s experience demonstrated, clear assessment and decision-making about business priorities can support appropriate reallocation of existing staff. Where feasible and necessary, reallocating existing staff to meet staffing needs leverages existing access to equipment, information and premises, and may reduce some training requirements, particularly for staff with relevant previous experience.

Was consultation undertaken with government entities and relevant stakeholders, including on shared risks?

2.51 The Commonwealth Risk Management Policy requires entities to implement arrangements to:

• communicate and consult about risk in a timely and effective manner to both internal and external stakeholders; and
• understand and contribute to the management of shared risks — which are described as risks extending beyond a single entity which require shared oversight and management.

2.52 These requirements are reflected in the ATO’s Enterprise Risk Management Framework. In addition, the ATO has prepared a Shared Risk Guide²⁶ that provides additional guidance to staff on the identification and management of shared risks.

Engagement with government entities

2.53 In fulfilling its legislative purposes, the ATO has a key existing relationship with the Department of the Treasury (Treasury), with whom the ATO works closely to influence the development of policies and legislation for the tax and superannuation systems.²⁷

2.54 The ATO’s records provide evidence of regular engagement and consultation between the Treasury and the ATO during the development of the six economic response measures, particularly in the design of the law and explanatory material. For each of the measures, ATO staff provided input (often of a tax technical nature) on the proposed legislative arrangements, typically under compressed timeframes (Box 7).

Source: ANAO, based on the ATO’s records.

2.55 The ATO engaged with Services Australia to develop a data-matching protocol and arrangements for JobSeeker and JobKeeper. An ‘Abridged Arrangement’ to the Services Schedule for Data Exchange between the ATO and Services Australia was signed between the entities on 15 May 2020 (and expires on 30 October 2020). The principal aim of the data-matching arrangement is for the ATO to provide JobKeeper data to assist Services Australia in identifying eligibility issues for JobSeeker. The agreement provided for data provision to commence on 18 May 2020 with a weekly transfer of data to occur thereafter.

2.56 In addition, the ATO participated in various cross-agency arrangements including:

• an inter-departmental committee (IDC) on JobKeeper — and the Program Risk and Integrity Working Group (which reports to the IDC);
• representation on the Chief Operating Officers (COO) Committee, and the Assurance and Risk Working Group (which reported to the COO Committee); and
• the Serious Financial Crime Taskforce, a multi-agency taskforce targeting serious financial crime in Australia, led by the ATO.

2.57 The ATO’s representation on the JobKeeper Program Risk and Integrity Working Group provides an example of the management of shared risks between the entities involved (Box 8).

Note a: The IDC is chaired by Treasury, with SES representatives from the ATO, the Attorney-General’s Department, the Fair Work Commission, the Fair Work Ombudsman, Services Australia, the Department of Education, Skills and Employment, the Department of Social Services, and the Department of the Prime Minister and Cabinet.

Source: ANAO, based on the ATO’s records.

Identification of shared risks

2.58 The ATO’s corporate Risk Assessment and Treatment Plan template requires staff to indicate whether the risk being identified is shared externally.

2.59 Shared risks were identified in two of the corporate Risk Assessment and Treatment Plans developed for the six measures — Early Release of Superannuation, and Temporary Reduction of Superannuation Minimum Drawdown Rates. In both cases, the ATO identified the Australian Prudential Regulation Authority (APRA) as another government entity that was sharing the risk of these measures. For the Early Release of Superannuation measure, the ATO also identified APRA-regulated funds (including their administrators), Self-managed Super Funds, the Australian Securities and Investments Commission (ASIC), and Services Australia (in relation to myGov).

2.60 The ATO’s Shared Risk Guide outlines a number of specific actions that ATO staff should take to manage identified shared risks. These include developing and implementing procedures to manage shared risks, and recording, monitoring and reporting information on shared risks. The Guide also states that ‘For all shared risks, it is paramount that each entity acknowledges the interdependency, agrees on roles and responsibilities, and how to actively manage the risk.’

2.61 The documentation maintained by the ATO did not demonstrate that the actions outlined in the Shared Risk Guide were followed for the two measures where shared risks were specifically identified. In particular, for the Early Release of Superannuation measure, the ATO’s documentation did not clearly outline which risks were shared and how these risks would be monitored and reported on by the identified parties.

2.62 The ATO informed the ANAO that the shared risks for the Early Release of Superannuation measure were managed through a cross-agency working group in a more informal manner given the speed of implementation. A ‘Fraud & Compliance Controls’ map was developed by the ATO and was shared with the members of the cross-agency working group in April 2020.²⁸

Engagement with external stakeholders

2.63 The ATO’s records provide evidence of consultation with external stakeholders for all six measures. The consultation was undertaken through the ATO’s existing consultation arrangements such as ‘Stewardship Groups’²⁹ and other existing committees and forums including Digital Service Providers. The bodies consulted included the Tax Practitioner Stewardship Group, BAS Agent Association Group, Tax Practitioner Professional Association representatives, Not-for-profit Stewardship Group, Private Groups Stewardship Group, Small Business Stewardship Group, Superannuation Industry Stewardship Group, the Super and Employment Change Network meeting, and the Superannuation Administration Group.

2.64 Consultation undertaken by the ATO on the two superannuation measures is outlined in Box 9.

Source: ANAO, based on the ATO’s records.

3.1 The COVID-19 pandemic and the Australian Government’s response to it have impacted on the risk environment faced by the Australian public sector.

3.2 For the ATO, the changed risk environment includes the responsibility of rapidly implementing six measures as part of the Australian Government’s economic response to the pandemic, as well as managing other risks and impacts associated with its ongoing responsibility for administering the tax and superannuation systems.

3.3 This chapter examines whether the ATO has:

• identified new or changed risks associated with the six measures and to its existing operations;
• determined ‘risk tolerances’³⁰ to guide its implementation of the six measures, and developed associated risk mitigation strategies; and
• informed decision-makers of identified risks, mitigation strategies and broader impacts on its operations.

Were new or changed risks identified, including to existing operations?

3.4 The first three steps in the ATO’s four-step risk methodology concern risk identification and assessment:

• clearly articulate the objectives³¹ so that the scope, context and criteria for the risk management process can be established;
• plan the key strategies that will be used to achieve the objectives; and
• identify and assess areas of uncertainty (risks) that may impact the implementation of the strategies and achievement of the objectives.

3.5 The fourth step of the ATO’s risk methodology relates to the monitoring of risk management activities, and is discussed at paragraph 4.18.

Articulating the objectives

3.6 The ATO articulated the objectives for its administration of all six economic response measures in an iterative fashion.

3.7 In March 2020, the ATO Executive Committee noted the intent of the measures ‘to stimulate the Australian economy and achieve a flow of money in the community’. As further details became available with the passage of legislation and the maturing of the ATO’s key implementation strategies and governance arrangements, Senior Accountable Officers refined and formally articulated objectives specific to each measure.

3.8 Examples of objectives as articulated by the ATO are depicted in Table 3.1. These objectives contained a greater level of detail than the requirements outlined in the enabling legislation.

3.9 When briefing the ATO Executive Committee on 2 June 2020 regarding the risk approach to the six measures, the Chief Risk Officer articulated the primary objective of each measure in broad terms as ‘[ensuring] that implementation gives effect to the government’s policy intent and conforms with the law as enacted by the Parliament.’

Planning key implementation strategies

3.10 The design of the economic response measures was largely based on leveraging existing ATO systems and operations to provide the foundation of the ATO’s implementation strategies:

• repurposing the ATO’s existing ICT systems to implement new operations for JobKeeper;
• withholding tax and business activity statements for Boosting Cash Flow for Employers;
• existing superannuation system for Early Release of Superannuation and Temporary Reduction of Superannuation Minimum Drawdown Rates; and
• annual tax returns for Backing Business Investment and Enhancing the Instant Asset Write-Off.

3.11 In the Risk Assessment and Treatment Plans for each measure, the ATO identified several distinct lines of work (‘streams’) necessary to achieve the objective. The streams nominated by the ATO for each measure are depicted in Table 3.2. Each stream was led by a representative drawn from a relevant area of the ATO. The stream leads collaborated as an interdisciplinary core design team³² to develop the implementation strategy for each measure. For three measures (JobKeeper, Early Release of Superannuation and Boosting Cash Flow for Employers) stream leads were also responsible for executing the strategy as it applied to that stream. For the remaining measures, a single project team was responsible for executing the strategy decided by the core design team.

3.12 Within each stream, some further strategy documents were prepared in coordination with other streams through the core design team. Three measures that required significant ICT systems development (JobKeeper, Boosting Cash Flow for Employers and Early Release of Superannuation) used standard templates to plan system design, development and deployment. Individual integrity strategy documents were prepared for each measure by Integrated Compliance. The ATO developed a communication strategy for each of the six measures. The strategies detailed how the ATO would raise awareness and provide information to relevant stakeholders on the measures, including on its website and through other channels such as social media, news articles, and webinars.

Identifying risks to objectives and implementation strategies

3.13 As discussed in paragraph 3.19, records retained by the ATO demonstrate that risks were considered during the initial implementation phase (March to April 2020). However, for four measures with earlier implementation milestones (Early Release of Superannuation, JobKeeper, Boosting Cash Flow for Employers, and Temporary Reduction of Superannuation Minimum Drawdown Rates), consolidated risk assessments in accordance with the requirements of the ATO’s Enterprise Risk Management Framework were not prepared until after critical implementation decisions had been made.

3.14 Risk Assessment and Treatment Plans for each of the six measures were prepared in May and June 2020. The plans assessed a single risk, namely that ‘the implementation and delivery of’ each measure ‘fails to meet Government intent’. The ATO described the intent of these post-decision assessments as an assurance exercise to retrospectively capture a consolidated view of the ATO’s risk management of each measure that would otherwise be evidenced by project artefacts. These assessments played a limited role in informing risk choices made by the ATO.

3.15 The six measure-level risks identified by the ATO in the consolidated risk assessments were categorised as ‘business risks’ rather than as ‘enterprise’ or ‘strategic’ risks, as per the three categories listed in the ATO’s Enterprise Risk Management Framework (Table 3.3).

Table 3.3: The ATO’s risk hierarchy and risk owners

Source: ANAO, reproduced from the ATO’s Enterprise Risk Management Framework (dated 24 April 2020).

3.16 The ATO’s decision to categorise the six measures as ‘business’ risks was not consistent with the nature and implications of the risk levels as defined by the ATO. In particular, the JobKeeper scheme has been described by Treasury as one of the largest fiscal and labour market interventions in Australia’s economic history. On this basis, the JobKeeper scheme aligns with the ATO’s criteria of a significant government commitment that is likely to have broader impacts across government.

3.17 The categorisation of the six measures as business risks meant that those risks were not considered by the ATO’s Enterprise Risk Management Committee alongside other enterprise risks to the ATO. In practice, the categorisation did not materially detract from the ATO’s attention towards the measures. The ATO managed these risks through the governance and oversight arrangements for each measure (see paragraphs 2.2 to 2.24), which included reporting to the ATO Executive Committee on JobKeeper, Boosting Cash Flow for Employers and Early Release of Superannuation.

3.18 In July 2020, the ATO informed the ANAO that its classification of enterprise risks was under review.

Risk identification at the project level

3.19 In the absence of a contemporaneous formal risk assessment for each measure, the ATO adopted an iterative approach to identifying risks that ran parallel to its implementation planning. Risk registers were maintained for five of the six measures in accordance with the ATO’s existing project management methodology:

• For three measures (JobKeeper, Boosting Cash Flow for Employers and Early Release of Superannuation), risks were identified, recorded on the risk register and assigned to risk owners from the earliest stages of the projects.
  • Two of these registers (JobKeeper and Early Release of Superannuation) assigned risk ratings to individual risks.
• For Backing Business Investment, a risk register was created on 27 May 2020 after most implementation decisions had been made but before 1 July 2020 when the first claims could be made under the measure. Key risks were also identified in monthly project status reports in April and May 2020.
• As Enhancing the Instant Asset Write-Off was a change to an existing measure, the existing project risk register was continued and updated.
• For Temporary Reduction of Superannuation Minimum Drawdown Rates, the ATO assessed that the risks of the project were so low as to not require a project level risk register.³³

3.20 Risks entered into the risk registers were more detailed than the risk articulated in the corporate Risk Assessment and Treatment Plan for each measure; examples of this detail are provided in Box 10. The registers recorded descriptions of actions being taken by stream leads that controlled, treated or monitored each risk. The registers made provision for closing risks as the uncertainty associated with a risk was resolved.

Source: ANAO, based on the ATO’s records.

3.21 In addition to the risk registers, the ATO identified a range of integrity risks in documents prepared by Integrated Compliance in conjunction with each project team.

3.22 The registers were also used to record risks presented by the measures to existing ATO operations, including risks such as the capacity of shared corporate systems and the ATO contact centre to respond to client demand, reputational risk, and compliance with privacy legislation when using corporate data.

Were risk tolerances determined and risk mitigation strategies developed?

3.23 The Commonwealth Risk Management Policy defines ‘risk tolerance’ as ‘the levels of risk taking that are acceptable in order to achieve a specific objective or manage a category of risk.’ The ATO’s Risk Tolerance Guide states that:

Risk tolerance relates directly to individual risks. In the ATO, risk tolerance is expressed in terms of a maximum acceptable risk level (or risk rating) that combines a likelihood and consequence rating.

3.24 The Risk Tolerance Guide states that defining risk tolerance assists the ATO to recognise when action will be taken to further prevent or mitigate a risk. The ATO’s risk tolerance bands are outlined in Figure 3.1.

Figure 3.1: The ATO’s risk tolerance bands

Source: Reproduced from the ATO’s Risk Tolerance Guide (15 June 2018).

Risk tolerances for the six economic response measures

3.25 During the period March to April 2020, the ATO did not record its risk tolerance with respect to the implementation of the six measures within corporate Risk Assessment and Treatment Plans. A paper to the ATO’s Executive Committee on 2 June 2020 described the context for not documenting risk tolerance contemporaneously:

A traditional approach to tolerance has not been taken during the implementation of the stimulus measures due to the unprecedently short period between announcement and implementation and the nature of the work associated with implementing new measures. Tolerance has been considered in the current environment through a highly practical approach to decision making where trade-offs between options and the likely results are considered in real time to help inform decisions.³⁴

3.26 The ATO’s Risk Assessment and Treatment Plan template includes the following rating scale to determine the level of a risk: low, moderate, significant, high, severe, and catastrophic.

3.27 The ATO documented its risk tolerances in a corporate Risk Assessment and Treatment Plan for each of the six measures in the period May 2020 to 2 June 2020, after the initial implementation phase for each measure had commenced. In each case, the risk presented in the plans (of failing to meet the Government’s intent for the measure) was assessed to be within the stated tolerance level (Table 3.4).

3.28 The ATO’s Risk Tolerance Guide notes that the underlying assumptions to risk tolerance decisions should be made explicit and transparent. The rationale for the stated tolerance levels for the six measures was not included on the corporate Risk Assessment and Treatment Plans or associated documentation.

3.29 The ATO informed the ANAO in July 2020 that the tolerance level of ‘high’ for all measures except JobKeeper originated from a pre-existing decision within the ATO’s Client Engagement Group (which is responsible for implementing the six measures) to set a ‘high’ risk tolerance for all new policy measures. This default setting was applied to the five measures when the corporate Risk Assessment and Treatment Plans were prepared.

3.30 The ATO further informed the ANAO that the tolerance level of ‘significant’ for the JobKeeper scheme was intended to match the overall risk rating for the measure, which was also significant. The ATO’s Risk Management Guide notes that if the assessed risk rating is below the tolerance level then no additional action needs to be taken to manage the risk (beyond the identified controls).³⁵

Tolerance levels for integrity risks

3.31 For two measures (Enhancing the Instant Asset Write-Off and Backing Business Investment) the ATO prepared separate Risk Assessment and Treatment Plans, which focused on ‘integrity measures’. These plans were prepared by Integrated Compliance in conjunction with the project teams for these measures and the ATO’s Corporate Risk and Assurance Branch. In both cases, the assessed level of risk was determined to be above the ATO’s tolerance level (Table 3.5). The rationale for the stated risk tolerance level was not included in the two plans.

Table 3.5: Risk tolerances for integrity risks — Backing Business Investment and Enhancing the Instant Asset Write-Off

Note: The Deputy Commissioner, Integrated Compliance is recorded as the ‘risk owner’ for both of these risks.

Source: ANAO, based on the ATO’s records.

3.32 Separate ‘integrity measures’ Risk Assessment and Treatment Plans were not prepared for the other four measures. A range of other documentation was produced for JobKeeper, Boosting Cash Flow for Employers and Early Release of Superannuation, which indicated the ATO’s emphasis on managing fraud and other integrity risks for these measures. This documentation included:

• a Concept of Operations³⁶ paper for the integrity measures in JobKeeper, Boosting Cash Flow for Employers and Early Release of Superannuation, and also for Backing Business Investment;
• compliance strategies for Boosting Cash Flow for Employers, Early Release of Superannuation, and JobKeeper; and
• entries in project-level risk registers.

3.33 In addition, the ATO has undertaken activities to manage fraud risks across the economic response measures through its role in leading the Serious Financial Crime Taskforce and the Phoenix Taskforce.³⁷

3.34 The concept of risk tolerance assists entities to make informed decisions about whether mitigation strategies in addition to existing controls are required and, if so, the level of resourcing required to achieve desired outcomes. Articulating risk tolerance early in the implementation phase of new measures provides a sound basis on which to support effective risk management, including the best use of entity resources. The rationale for setting the risk tolerance for particular risks or categories of risk should be clearly documented, both to evidence entity decision-making and to support subsequent assurance activities.

Development of risk treatment strategies

3.35 The ATO’s Risk Management Guide states that:

If the assessed risk rating is above the tolerance level then this is an indicator that further action is required to mitigate the risk, known as treatments.

If the assessed risk rating is below the tolerance level then no additional action needs to be taken to manage the risk. However, where gaps or uncertainties have been identified in the controls, treatment plans can still be developed if desired.

3.36 The Risk Assessment and Treatment Plans for the six measures all indicated that no further risk treatment was needed (beyond the risk controls outlined in each plan) because the assessed risk level was within tolerance. The focus of the ATO’s risk mitigation strategies for these measures was to monitor the effectiveness of the identified controls.

3.37 In the six plans, the ATO assessed that the identified controls were:

• ‘partially effective’ overall for four measures — Backing Business Investment, Enhancing the Instant Asset Write-Off, Boosting Cash Flow for Employers, and JobKeeper; and
• ‘effective’ overall for the two remaining measures — Early Release of Superannuation, and Temporary Reduction of Superannuation Minimum Drawdown Rates.

3.38 The ATO’s categorisation of control effectiveness is provided in Box 11.

Note: The ATO’s Risk Assessment and Treatment Plan template includes two other categories of control effectiveness — ‘Ineffective’ and ‘Insufficient evidence’.

Source: Reproduced from the ATO’s Risk Assessment and Treatment Plan template.

3.39 The separate ‘Integrity measures’ plans produced for Enhancing the Instant Asset Write-Off and Backing Business Investment both indicated that further treatment was required because the assessed risk level was not within tolerance. For both measures, the stated focus of the treatment plans was to ‘Maintain existing treatments and review with consideration with the interactions of other measures and existing models.’ As of 5 June 2020, when both plans were initially prepared, the status of the treatment plans was recorded as ‘pending’. A fortnightly review cycle was identified for the treatment plans of both measures.

Were decision-makers informed of risks, mitigation strategies and broader impacts?

3.40 As noted in paragraph 2.51, the Commonwealth Risk Management Policy requires entities to implement arrangements to communicate and consult about risk in a timely and effective manner to both internal and external stakeholders — which includes government.

3.41 Previous performance audits of entities involved in the rapid implementation of Australian Government initiatives have highlighted the importance of:

• keeping decision-makers abreast of significant emerging risks and issues;
• establishing a common understanding of the risk appetite³⁸ for the initiative between the policy and implementing entities, and the government;
• ensuring that ministers receive complete, accurate and timely advice on program design features and implementation progress, challenges and risks; and
• keeping senior management and ministers informed of significant changes in risk, and any revised mitigation strategies.

Advice to government

3.42 The ATO uses the Parliamentary Document Management System to provide submissions, briefs and other ad hoc advice and documents to relevant ministers³⁹ and to their offices.⁴⁰ The records stored in this system show that the ATO provided submissions⁴¹ to ministers (typically the Treasurer and the Assistant Treasurer) on various aspects of the economic response measures. This included submissions on:

• information and updates on fraud and integrity matters in relation to the Early Release of Superannuation measure;
• advice or information on different aspects of the JobKeeper scheme, including the ATO’s consultation on the alternative decline in turnover tests relevant for eligibility to JobKeeper, on schemes that seek to exploit JobKeeper, on payments that have been paused due to the application of integrity risk models, and on the ATO’s proposed communications plan to the end of March 2020; and
• information and updates on the ATO’s compliance activities for Early Release of Superannuation, and Boosting Cash Flow for Employers.

3.43 The first ministerial submission was sent on 21 April 2020. The ATO informed the ANAO that prior to the first ministerial submission, it provided informal advice to ministers on tax and superannuation matters arising from the pandemic. The ATO noted that Treasury, as the policy entity, took the lead role in providing advice to government in the design phase of the measures.

3.44 The ATO also provided over 100 ministerial briefs⁴² on various aspects of its response to the COVID-19 pandemic, including specific matters related to the economic response measures. These included briefs on the volume of activity statements submitted for the Boosting Cash Flow for Employers measure, definitions of ‘sole trader’ and ‘self-employed’ for the JobKeeper program, and advice and data on the JobKeeper tip-off line.

3.45 The advice and information provided to ministers’ offices reflect the ATO’s role as an implementing entity rather than a policy entity. Much of the advice could be characterised as ‘operational’ in nature — providing information on specific aspects of the measures rather than raising policy or strategic issues for government to consider.

Implementation plans

3.46 The ATO provided a number of regular (or cyclical) reports to ministers’ offices, including an implementation report on all six measures (called the COVID-19 ATO Implementation Plan). The implementation plans provided a progressive status update on each measure, detailing matters such as communication activities, ATO system build, integrity of measures, governance and assurance, ATO service delivery, and other activities specific to the measure.

3.47 The first implementation plan was produced on 31 March 2020 and was provided to the Assistant Treasurer’s office. Recipients of subsequent implementation plans included the Treasurer’s and Assistant Treasurer’s offices, the Treasury and ATO staff. The ATO informed the ANAO that the implementation plan was initially provided every two days, but as measures were implemented the plan was provided on a weekly basis.

3.48 The last implementation plan was provided on 3 July 2020, after which they were discontinued.⁴³ The ATO continued to provide daily ‘dashboard’ reports to the Treasurer’s office and to Treasury, providing information on the uptake and costs of JobKeeper, Boosting Cash Flow for Employers, and Early Release of Superannuation.

3.49 In addition to the implementation plans, other reports provided on a regular basis to ministers’ offices during the implementation period for the six measures included:

• daily reports on the ATO’s contact centre volumes and activities;
• the ATO’s forward program of outbound communications on the six measures (for example, letters to applicants);
• advice on JobKeeper registration data; and
• updates on the Early Release of Superannuation measure, including in relation to fraud matters.

4.1 The Commonwealth Risk Management Policy states that risk management is not a ‘one-off event’. The effective management of risk is a process of continuous improvement, requiring regular review and evaluation mechanisms.

4.2 Regularly monitoring risks and the effectiveness of mitigation strategies is important where there are ongoing changes in the broader risk environment and where specific changes have been introduced for some of the six economic response measures.

4.3 To assess the ATO’s monitoring of identified risks and strategies, this chapter examines whether the ATO has effectively:

• developed identified treatment strategies for fraud and compliance risks;
• monitored and managed identified risks, including to its business-as-usual activities; and
• reviewed and adjusted its business arrangements in line with changed risks and circumstances.

Have risk management strategies been implemented as intended?

4.4 As indicated in paragraph 2.18, the ATO identified the need to develop treatment strategies for fraud and compliance risks to support the integrity of the measures.

4.5 Compliance strategies have been documented for five of the measures — JobKeeper, Boosting Cash Flow for Employers, Early Release of Superannuation, Backing Business Investment and Enhancing the Instant Asset Write-Off.

4.6 For the Temporary Reduction of Superannuation Minimum Drawdown Rates measure, the ATO determined that specific compliance and assurance processes were not required as existing controls in the sector (such as within APRA-regulated funds) were sufficient. The Risk Assessment and Treatment Plan sets out the ATO’s intended controls for this measure.

Strategies for JobKeeper, Early Release of Superannuation and Boosting Cash Flow for Employers

4.7 During the design phase of JobKeeper, Early Release of Superannuation and Boosting Cash Flow for Employers, the ATO identified and developed client ‘personas’ as a tool to typify the different integrity risks that each measure may face. Collectively, these personas aimed to portray a spectrum of non-compliant behaviour, from serious organised crime groups targeting the economic response measures to vulnerable persons acting in error. The ATO used this analysis to develop compliance strategies for these measures consistent with a set of overarching integrity principles, listed in Figure 4.1.

Figure 4.1: Integrity principles for three measures

Source: Reproduced from the ATO’s records.

4.8 The ATO’s compliance programs for JobKeeper, Early Release of Superannuation and Boosting Cash Flow for Employers comprise four broad categories of response:

• initially excluding entities that the ATO could confirm do not qualify for the measure at the point of enrolment (for JobKeeper), application (for Early Release of Superannuation) or identification by the ATO (for Boosting Cash Flow for Employers);
• identifying high risk payments and suspending these for review before payment is made (‘pre-issue’) — applicable to JobKeeper and Boosting Cash Flow for Employers only;
• reviewing payments or determinations after they have been made (‘post-issue’) and taking remedial compliance action ranging from education and targeted messaging to applying penalties (unlike the first two categories, the ATO considered that these activities did not need to be planned in detail before the measures were rolled out⁴⁴); and
• complementary to these three categories, the ATO has undertaken to detect and investigate criminal activity throughout the life of each measure, based on the ATO’s existing criminal intelligence and investigation frameworks, such as accepting tip-offs through the ATO Tax Integrity Centre and information sharing with other government entities in the Serious Financial Crime Taskforce.

Aligning treatment strategies to risks

4.9 On 14 April 2020 the JobKeeper Board was briefed on 15 key compliance risks associated with the measure. The Board determined that it would address four of these risks with ‘enrolment’ and ‘pre-issue’ checks and the remainder with ‘post-issue’ activities. By 23 April 2020, the ATO had refined its pre-issue strategy to model a workflow for pre-issue checks and assign responsibility for pre-payment verification actions to business line areas in accordance with their responsibilities, with provision for prioritisation and overflow.

4.10 On 16 April 2020 the Cash Flow Boost core design team was briefed on eight key compliance risks associated with the measure. The ATO adopted a strategy whereby refund payments displaying indicators of the eight identified risks would be reviewed ‘pre-issue’ and where ineligibility or fraud could be confirmed payment of a Cash Flow Boost refund would be stopped. Payments that were not sufficiently risky to warrant pre-issue review, and assurance reviews of businesses displaying riskier indicators, would be addressed by ‘post-issue’ activities.

4.11 On 1 April 2020 the Early Release of Superannuation program lead briefed the Superannuation and Employer Obligations Risk Committee that two main integrity risks existed with the Early Release of Superannuation measure, described as identity theft and fraud risk, and the risk that applicants will misrepresent or inappropriately self-assess their eligibility. The ATO adopted a strategy whereby applicants would be subject to identity verification procedures before an application would be accepted. Limited automated controls would be established that would reject applicants upfront.

4.12 Unlike for JobKeeper and Boosting Cash Flow for Employers, the ATO did not implement controls to suspend applications ‘pre-issue’ pending review against eligibility criteria for the Early Release of Superannuation measure as the relevant legislation required the ATO to issue a determination upon receipt of an application that was not rejected upfront by the controls outlined in paragraph 4.11.⁴⁵ However, the strategy also provided for ‘pre-issue’ scanning of applications with a view to identifying higher-risk determinations and flagging these with the nominated superannuation fund for additional scrutiny by the fund. The primary mechanism for assuring an applicant’s self-assessment of eligibility would be ‘post-issue’ activities.

Development of post-issue strategies

4.13 Following key implementation milestones for the three measures in April and May 2020, the ATO proceeded to develop its ‘post-issue’ integrity treatment strategies. On 30 June 2020, the ATO Executive Committee was jointly briefed on the proposed strategies for each of the three measures. Each brief:

• estimated the prevalence of non-compliance remaining to be addressed within the measure (an example is provided in Box 12);
• identified ‘risk pools’ of potentially non-compliant entities displaying similar typologies suitable for post-issue intervention; and
• proposed a series of activities to address the potential non-compliance within these risk pools during the period July to December 2020.

Box 12: Assurance review for Early Release of Superannuation

In June 2020, the ATO commenced analysis of applications for early release submitted in 2019–20 to inform its post-issue compliance strategies. As reported to the ATO Executive Committee, the analysis used ATO data such as PAYG withholding tax records to identify applicants whose employment status and history did not appear to match the grounds nominated in their application for early release. By 15 June 2020, the ATO reached a high degree of confidence with respect to the eligibility of around 70 per cent of applicants for early release; and lower confidence with respect to the eligibility of the remaining applicants. The ATO Executive Committee was briefed on the analysis, including a projection of how additional analysis and post-issue intervention would be likely to alter the initial estimates. The ATO continued to refine its analysis beyond June, including conducting data-matching with Services Australia to confirm whether applicants were eligible on the ground of receiving government benefits such as JobSeeker. By 31 July 2020, the ATO assessed that: around 90% of applicants in 2019–20 were eligible to apply; and under 0.02% of applications were affected by fraud.

Source: ANAO, based on the ATO’s data and records.

Tax labels for the two asset measures

4.14 Compliance risks for Backing Business Investment and Enhancing the Instant Asset Write-Off are set out in the ‘Integrity measures’ Risk Assessment and Treatment Plan for each measure, as well as being recorded in project-level risk registers. The compliance risks for both measures were assessed to be outside the ATO’s acceptable tolerance level.

4.15 A key limitation in the ATO’s ability to identify uptake and manage identified compliance risks for both measures is the absence of specific information being captured in the 2020 tax return process (Box 13). For both measures, the ATO sought to obtain specific ‘tax labels’ to directly identify claims for each measure.⁴⁶ Due to the lead time required to introduce labels ahead of each tax year, no such label was able to be introduced for Backing Business Investment; and for Enhancing the Instant Asset Write-Off, the ATO has relied on existing labels covering claims by small businesses only.⁴⁷

Source: ANAO, based on the ATO’s records.

Status and outcome of compliance actions

4.16 Key implementation phases of the compliance strategies for each of the five measures remain in progress. This is particularly so for Backing Business Investment and Enhancing the Instant Asset Write-Off, where claims for these measures are able to made in the 2020–21 tax year (with many businesses not required to lodge returns until the first half of 2022).

4.17 The ATO has developed a set of key performance indicators and controls for JobKeeper, Boosting Cash Flow for Employers, and Early Release of Superannuation. This information was provided to the first meeting of the ATO’s Stimulus Measures Oversight Committee meeting on 25 August 2020. Examples of the information provided to this Committee on the ATO’s compliance activities for each of the three measures is outlined in Table 4.1.

Table 4.1: Compliance activities for JobKeeper, Boosting Cash Flow for Employers and Early Release of Superannuation (17 August 2020)

Note a: The ATO informed the ANAO that this percentage is based on 3,612,579 applications for JobKeeper over the reporting period 30 March 2020 to 11 August 2020.

Note b: Rejected applications are due to individuals applying for a second release in the same financial year; only one release is permitted under the law.

Source: ANAO, reproducing the ATO’s data.

Have risks and strategies been appropriately monitored?

4.18 Step four of the ATO’s risk methodology (Figure 1.2 in Chapter 1) states that: ‘Monitoring and assessing our strategies and risk management activities helps us determine their effectiveness and enables us to make adjustments as needed so we stay on track to achieve the objectives.’

4.19 Responsibilities for overseeing or monitoring risks, controls and treatment strategies are assigned to risk owners and risk managers under the ATO’s Enterprise Risk Management Framework. The monitoring of risk is also built into the ATO’s corporate project management method, and provided through the governance arrangements established for each measure.

Review of corporate Risk Assessment and Treatment Plans

4.20 The corporate Risk Assessment and Treatment Plans for the six economic response measures were developed to provide assurance that the elements of the ATO’s four-step risk methodology are being substantively considered on an ongoing basis.

4.21 A specific action outlined in the ATO’s Risk Management Guide is that risk ratings should be reviewed whenever there are changes in the environment. The ATO also requires that risk tolerances be monitored and reviewed throughout the risk management process.

4.22 As of August 2020 the ATO had revised the corporate Risk Assessment and Treatment Plans for two of three measures where the Australian Government had announced changes to the measures (Table 4.2).

Table 4.2: Risk Assessment and Treatment Plans updated (as of August 2020)

Source: ANAO, based on the ATO’s records.

4.23 A review date was not specified on the Risk Assessment and Treatment Plan for the Early Release of Superannuation measure. It was not evident from the ATO’s records whether the plan has been reviewed following the Australian Government’s announcement (on 23 July 2020) that the application timeframe for the second tranche of the measure would be extended from 24 September to 31 December 2020. The ATO informed the ANAO that the change in timeframe is not expected to result in a significant number of additional applications, beyond the surge in applications for 2020–21 shortly after 1 July 2020.

4.24 For the three remaining measures:

• The Risk Assessment and Treatment Plan for Backing Business Investment was revised on 30 July 2020. Minor changes were made to the content, including a reference to treatment plans being developed for different client groups; no changes were made to the overall risk rating or tolerance levels.
• A monthly review cycle was specified in the Boosting Cash Flow for Employers measure. While there was no evidence that the plan has been reviewed in line with this timeframe, the ATO undertook ‘deep dives’ of this measure in May, June and July 2020, which included an assessment of risks and integrity controls.
• A quarterly review period was specified for the Temporary Reduction of Superannuation Minimum Drawdown Rates measure. The Risk Assessment and Treatment Plan was revised on 24 August 2020. Minor changes were made to the document to reflect changes in controls. The overall risk rating and tolerance levels were unchanged.

Project-level monitoring

4.25 The ATO’s records provide evidence of a range of monitoring activities and actions being undertaken at a project-level for the six measures, including through the governance bodies described in paragraph 2.13. Key examples are provided in Table 4.3.

Table 4.3: Examples of project-level monitoring activities and actions on the six economic response measures

Source: ANAO, based on the ATO’s records.

Oversight of compliance strategies

4.26 As discussed in paragraph 2.19, papers on the ATO’s compliance strategies for JobKeeper, Boosting Cash Flow for Employers and Early Release of Superannuation were provided to the ATO Executive Committee in early June 2020. The risk profile and summary for all six measures (as of July 2020) were provided to the newly-established Stimulus Measures Oversight Committee to consider at its first meeting on 25 August 2020. The documents provide an assessment of the risk rating, current control actions and tolerance considerations against the identified categories of risk (such as compliance, client experience, data and systems).

Have business arrangements been reviewed/adjusted in line with changed circumstances and risks?

4.27 The six economic response measures being administered by the ATO are intended by the Australian Government to be temporary rather than ongoing. This requires the ATO to have arrangements in place to manage the closure of the measures, and to transition to ongoing business activities.

Closure reports for the measures

4.28 The streamlined project governance arrangements determined for the six measures include the requirement to prepare a ‘closure report’ for each measure. The closure report is to provide a range of information on project performance, conformance with legislative and other requirements, and lessons learned. The closure reports require the consideration of an appropriate range of matters and are a standard requirement under the ATO’s project management framework.

4.29 As at 15 August 2020, one of the six measures had been required to produce a final closure report — the Temporary Reduction of Superannuation Minimum Drawdown Rates. The closure report was finalised on 13 May 2020, and was approved by the Senior Accountable Officer. In relation to project performance, the closure report stated that:

There were no impacts to delivering the outcome of the project and all milestones were delivered on time. The risks associated with this project were successfully mitigated with no escalations. The critical date of 31 March 2020 to deliver ATO web content and scripting has been met.

4.30 The indicative timeframes for the completion of the closure reports for the remaining five measures are:

• Boosting Cash Flow for Employers, November 2020;
• Enhancing the Instant Asset Write-Off, February 2021;
• Early Release of Superannuation, March 2021;
• JobKeeper scheme, June 2021; and
• Backing Business Investment, August 2021.

4.31 Consistent with the ATO’s standard requirements, a more comprehensive closure report is required for the remaining five measures than for the Temporary Reduction of Superannuation Minimum Drawdown Rates measure (which adopted a tailored approach to reflect the size of the measure).

Focus on current, emerging and longer-term risks

4.32 As discussed in paragraph 2.21, the ATO’s Enterprise Risk Management Committee (ERMC) has considered the impacts associated with the COVID-19 pandemic, and its impacts on the ATO’s operations.⁴⁸

4.33 In May 2020, the ERMC considered papers on the theme of ‘Recovery and Future Strategy’. These papers included:

• Transitioning back to a ‘new normal’;
• Managing client transition back to business-as-usual;
• Impact of COVID-19 on the ATO’s enterprise risk profile; and
• Long term impacts on ATO and Government’s objectives.

4.34 In June 2020 the ERMC finalised its forward work program for the remainder of 2020. The work program included an ongoing focus on COVID-19 matters (Strategic decision points — Post COVID-19 exit strategy, and Post COVID-19 review — Lessons Learned — Implementing Law Reform). The forward work program also includes a series of ‘deep dives’ in other focus areas — for example, managing tax and superannuation administration in a recession.

4.35 The forward work program was considered by the ATO Executive Committee on 3 June 2020 and was amended to include ‘high priority’ focus areas endorsed by the Executive (such as the ATO’s future operating model, and its management of small business clients).

Debt and lodgment strategy

4.36 The ATO has developed a three-phase Debt and Lodgment Strategy aimed at re-engaging with taxpayers, as illustrated in Figure 4.2. The strategy follows the pause in ATO-initiated debt recovery and non-lodgment interventions in the period March to June 2020. The decision to pause these interventions was made by the ATO’s COVID-19 Steering Committee.

Figure 4.2: Overview of the ATO’s draft Debt and Lodgment Strategy 2020–21

Source: Reproduced from the ATO’s records (July 2020).

4.37 The ATO’s records indicate that the strategy is important in preventing taxpayers from losing touch with the tax system given the disruption to business and the significant number of deferred due dates and payment plans.

4.38 The development of the ATO’s Debt and Lodgment Strategy 2020–21 also recognises that the ATO’s ‘debt book’ has increased as a result of the pandemic and associated economic conditions. The ATO advised that, as at 30 June 2020, the collectable debt book was $34.18 billion.

4.39 The strategy also seeks to maximise opportunities of a new operating model for debt and lodgment introduced from 1 April 2020. The ATO informed the ANAO that the model aims to differentiate its interactions with clients, depending on whether clients are in vulnerable situations and need assistance, or are well-positioned to meet their obligations and are appropriately prioritised and managed. The ATO noted that the implementation of the new model is in progress.

Appendix 1 Australian Taxation Office response