No Get Out of Jail Free card this time. ANAO slams ACIC in latest performance report.

To receive a report and be told you are “deficient in almost every significant respect”, is a pretty solid effort. It’s almost like you covered your eyes and let everything just happen around you; and that’s exactly how the Australian National Audit Office’s (ANAO)’s latest performance report reads.

The ANAO released it’s latest Performance Audit report on Monday 21 January. The objective of the audit was to assess the effectiveness of Australian Criminal Intelligence Commission’s (ACIC)’s administration of the Biometric Identification Services (BIS) project. It’s a lot to take in… bare with me.

As per the ANAO’s own report (which can be read in full here), on 1 July 2016, the ACIC was created through the merger of the CrimTrac agency (CrimTrac), the Australian Crime Commission (ACC) and the Australian Institute of Criminology (AIC).1 Prior to the merger, CrimTrac had commenced planning and initial administration of the BIS project. The contract was signed on 20 April 2016 between NEC Australia and CromTrac (just before the ACIC agency was created). I hope you’re still following.

The BIS project was a $52 million project with two key goals:

• replacement of the existing National Automated Fingerprint Identification System (NAFIS)2; and
• addition of a facial recognition capability to enhance law enforcement’s biometric capabilities.

The ANAO did not hold back in it’s report, and rightly so. Total expenditure on the project was $34 million and not a single one of the project’s milestones or deliverables were met. A massive failure on so many fronts.

The report does acknowledge that there were issues at the start of the contract and that the ACIC executive even intervened. It also mentions that the Acting Chief Operating Officer for ACIC requested the ANAO to perform the review; a ballsy move as all ANAO reports are generally made public, and the light in which the report will paint both NEC and the ACIC. PwC however did make a guest appearance in the saga also, assisting the ACIC with the requirements gathering exercise. The ANAO point out a number of factors that were overlooked by PwC during the process.

Whilst the report mentions that the procurement process undertaken was inline with the Commonwealth Procurement Rules (CPRs), the bulk of the issues relate to the management of the contract. Failure to achieve a single milestone while handing out a few millions would show pretty clearly that contract management was going to be the main issue.

To make matters worse, there was even two external reviews which pointed our failures in the risk management process. The audit committee was also never informed of the project’s status. Fair play to NEC though, who, as any good contractor does, managed to swindle an extra AUD$12m out of ACIC in additional work. According to the report, documentation sighted indicated that some of the work may have been unnecessary or already covered by the existing project.

To further add to ACIC’s woes, with no new system, they were forced to keep with the old system, and didn’t the provider know about it. Morpho operated the National Automated Fingerprint Identification System (NAFIS). This is the system that the BIS was due to replace. Morpho was unsuccessful in its tender for the new BIS. Given that the BIS project did not take off, the ACIC was forced to return to Morpho who clearly knew the ACIC has no bargaining position. Morpho increased the fees for the NAFIS each year from a mere $3,790,000 in 2011-12 to an astounding $9,339,800 in 2019-2020, representing an increase of 146% since the start of the contract.

Source: ANAO Performance Report

The only winners out of this situation are both the NEC and Morpho.

Where to from here? The ACIC has shown its many floors and that it is essentially a cash cow, handing out more money than an ATM. The Agency is without a replacement for the NAFIS and any replacement will take a long time to implement, meaning Morpho can leech even more money. The only upside is that it gives the ACIC time to get itself sorted and put into place some good programs and training to avoid any disastrous repeat.

Further reading: Sydney Morning Herald: https://www.smh.com.au/politics/federal/acic-reveals-26-million-wasted-on-dumped-biometric-project-20181129-p50j8l.html