Introduction

1.1 Airservices Australia (Airservices) is established under the Air Services Act 1995 (Airservices Act) to provide air traffic control and other related services to the aviation industry in Australian-administered airspace — 11 per cent of world airspace. Airservices is responsible for the safe and orderly flow of aircraft carrying 150 million passengers a year. Airservices’ functions include:

• providing facilities and services such as air traffic control, aeronautical information, aviation communication and aviation rescue firefighting services;
• promoting and fostering civil aviation;
• carrying out activities to protect the environment from the effects of aircraft operations;
• cooperating with the Australian Transport Safety Bureau; and
• other general functions such as those required by regulation under the Air Navigation Act 1920 and the Aviation Transport Security Act 2004.

1.2 Under the Airservices Act, Airservices must prioritise safety in carrying out these functions.

1.3 Airservices is a corporate Commonwealth entity under the Public Governance, Performance and Accountability Act 2023 (PGPA Act) and is in the Infrastructure portfolio.⁴ The Airservices Board is the governing body and accountable authority under the PGPA Act.⁵ The Chief Executive Officer (CEO) is responsible for the management of Airservices under direction from the Airservices Board.

1.4 Airservices is funded through revenue from industry (charges to aircraft operators for en-route air traffic control services, terminal navigation, and aviation and rescue firefighting services) and borrowing from debt markets. Airservices’ prices are regulated by the Australian Competition and Consumer Commission (ACCC).⁶

1.5 Airservices is delivering a significant change program and OneSKY is a key part of this. Airservices advised the ANAO in May 2025 that the OneSKY program currently represents one third of its capital investment program.

1.6 The Department of Defence (Defence) provides air traffic management to military and civil aviation in Australia, including at Defence and joint user airfields that operate with shared military and civil use. Defence is a non-corporate Commonwealth entity under the PGPA Act.

OneSKY program

1.7 The OneSKY program aims to build and operate a joint civil–military air traffic management system.⁷ The program includes the design and delivery of the new Civil Military Air Traffic Management System (CMATS) as well as supporting infrastructure for Airservices and Defence. Airservices is the lead agency for CMATS, being delivered under the OneSKY Program, in collaboration with Defence.

1.8 Figure 1.1 sets out the relationship between the OneSKY program, CMATS and AIR5431 Phase 3 (the related Defence project), and shows the work packages (as at January 2025) established by Airservices and Defence to support the implementation of the program.

Figure 1.1: OneSKY program, CMATS and Defence project relationship

Source: Airservices documentation.

Civil Military Air Traffic Management System

1.9 CMATS is the IT system that, once operational, will support air traffic services at specific Airservices and Defence sites.⁸ CMATS will replace the currently independent civil and military IT systems, both of which had been due to reach their nominal end of life in 2015⁹:

• civil air traffic control system — the Australian Advanced Air Traffic System (TAAATS) — built and supported by Thales Australia Limited (Thales); and
• military air traffic control system — the Australian Defence Air Traffic System (ADATS) — built and supported by Raytheon.

1.10 CMATS is being delivered through two contracts with Thales:

• the supply of system capability through the acquisition contract (to develop and provide the CMATS hardware and software); and
• the ongoing sustainment of CMATS through the support contract (to provide support services to CMATS once operational).

1.11 As the lead agency, Airservices entered into the contracts with Thales and manages the CMATS program and contracts. Airservices will on-supply to Defence the system and support for CMATS delivered by Thales. Airservices and Defence have entered into an on-supply agreement to govern these arrangements. Table 1.1 sets out the primary arrangements to support the delivery of CMATS.¹⁰

Table 1.1: Summary of primary arrangements for CMATS delivery

Note a: The acquisition contract also has provisions that extend past the end of the contract covering intellectual property and the right of Airservices to recover money.

Note b: The operative date is the first handover from Thales.

Source: ANAO analysis of Airservices documentation.

CMATS project delays and revised delivery strategy

1.12 When Airservices and Thales entered into two contracts in February 2018, CMATS was to be delivered in three phases:

• release zero — initial minimum software functionality at Defence sites operational in mid-2022;
• release one — minimum functionality at Airservices sites operational in 2024; and
• release two — full scope of CMATS ready for deployment by February 2025, with final acceptance by August 2025.

1.13 The project has experienced delays. In 2019 the first CMATS design milestone was completed, which found engineering design deficiencies that were expected to be addressed prior to the next design milestone — the critical design review. In 2020 the critical design review milestone was partially completed and found a series of significant defects and omissions. In 2022 Thales began experiencing technical integration issues. Airservices conducted integrated baseline reviews in July 2018, March 2020 and February 2023.¹¹

1.14 In October 2022 the Minister for Defence Industry declared the Defence project for CMATS (Project AIR5431 Phase 3) a Project of Concern due to cost, schedule and technical issues. In December 2022 Airservices, Defence and Thales agreed on remediation goals and in March 2023 on a remediation plan and actions, including to jointly examine opportunities to revise the delivery strategy and schedule.

Standstill deed, settlement deed and contract variation

1.15 In July 2023 Airservices, Defence and Thales entered into a ‘standstill deed’ to pause and preserve certain rights under the contracts (such as maintaining some aspects of Thales’ work) while they negotiated a revised delivery strategy. In December 2023, Airservices and Thales resolved the standstill deed when they executed:

• a settlement deed — closing and giving effect to the agreements negotiated during the standstill period and providing the basis for a revised delivery strategy; and
• a contract variation to implement the revised delivery strategy.

1.16 The contract variation made changes to the acquisition contract by updating:

• delivery sequence from release zero, release one and release two to remove release zero from the sequence and prioritise delivery to Airservices sites followed by Defence sites¹²;
• milestone delivery dates; and
• the payment structure to give greater weight to milestone payments.

1.17 On 1 March 2024 Defence and Airservices executed a corresponding variation to the on-supply agreement. Figure 1.2 shows key dates for the negotiation of the revised delivery strategy.

Figure 1.2: Timeline of key events for the negotiation of the revised delivery strategy

Note a: The functional baseline is the agreed functionality and performance of the CMATS system.

Source: ANAO analysis of Airservices documentation.

1.18 As at January 2025, release one (Airservices capability) is due for system acceptance in June 2028, release two (full CMATS capability) in August 2029 and final acceptance in February 2030. Table 1.2 shows the key system acceptance dates at contract signing in February 2018 compared with January 2025.

Table 1.2: Contract delivery schedule for key milestones

Source: ANAO analysis of acquisition contract and variations.

1.19 As at 31 December 2024, since February 2018 the acquisition contact has been varied 44 times and the support contract three times. The current acquisition contract target price is $1.365 billion (AUD equivalent) and ceiling price $1.465 billion (AUD equivalent) (see Figure 1.3).¹³

Figure 1.3: Acquisition contract payments and impact of variations

Note: As at 31 December 2024 acquisition contract variations had increased target and ceiling prices by $160 million.

Source: ANAO analysis of Airservices documentation and contract variation deeds of execution.

Previous ANAO audits

1.20 The procurement for CMATS was conducted through a phased approach. In June 2013 Airservices issued a request for tender and proceeded through tender evaluation phases. In September 2014 Airservices selected Thales as the successful tenderer, and protracted negotiations followed. Thales submitted offers in October and December 2014, which expired in October 2015. In June 2016 and September 2017 Thales submitted further offers. Airservices and Thales then further negotiated scope, price and commercial terms — ultimately agreeing on important changes after Airservices had selected the successful tenderer. In 2017 and 2019 the ANAO audited the tender evaluations and contract negotiations. The 2019 ANAO report found that Airservices had established an appropriate governance framework to evaluate contract value for money and assessment of Thales’ 2016 offer was appropriate (which was rejected for not providing value for money) but there were shortcomings in the application of the governance arrangements for the final (accepted) offer in September 2017 (see footnote 1).

Rationale for undertaking the audit

1.21 Passengers in Australian airspace rely on Airservices to provide critical air traffic control infrastructure safely and efficiently. The OneSKY program is a major change for Airservices, and CMATS is a core component of the program. Airservices has contracted Thales to develop and support CMATS. The ANAO has previously undertaken three performance audits on the procurements for CMATS, the most recent in 2019. Procurement and contract management of large-scale IT projects involve elevated risks. The audit provides assurance to the Parliament on whether Airservices is managing the contract for CMATS effectively.

Audit approach

Audit objective, criteria and scope

1.22 The objective of the audit was to assess the effectiveness of Airservices’ contract management for the OneSKY program.

1.23 To form a conclusion against the audit objective, the audit team applied the following high-level criteria:

• Has Airservices developed appropriate governance arrangements to support contract management?
• Has Airservices managed the contract effectively to achieve value for money?

Audit methodology

1.24 The audit methodology involved:

• reviewing Airservices’ procurement and contract management frameworks and governance;
• examining project and contract documentation — for example, contract management plans, contract variations, and risk management plans and registers;
• reviewing internal and external reporting on CMATS; and
• meetings with Airservices, Defence and Department of Infrastructure, Transport, Regional Development, Communications, Sports and the Arts staff.

1.25 The audit was conducted in accordance with ANAO Auditing Standards at a cost to the ANAO of approximately $716,213.

1.26 The team members for this audit were Jane Wiles, Thea Ingold, Caitlin Williams, Maggie Lee, Renina Boyd, Anne Rainger and Michelle Page.

2.1 As a corporate Commonwealth entity, Airservices is not required to comply with the Commonwealth Procurement Rules.¹⁴ Airservices has developed its own procurement and contract management policies and procedures to assist it to meet its general obligations under the Public Governance, Performance and Accountability Act 2013 (PGPA Act) to promote the proper use and management of public resources.

2.2 Sound contract management frameworks, governance and risk management help ensure intended contractual benefits are realised and value-for-money outcomes achieved. A fit-for-purpose contract management plan enables the customer/purchaser to hold the contractor to account. The plan should enable the customer/purchaser to identify performance issues, provide levers to manage performance and set out how and when such levers should be used.

Has Airservices developed a fit-for-purpose contract management plan and supporting governance?

Enterprise-wide contract management procedure

2.3 Airservices has an enterprise-wide contract management procedure. Its purpose is to ‘set out the minimum requirements and processes for the management of all contracts entered into by Airservices’. It establishes:

• a contract management plan is required for contracts that have a high impact on Airservices’ core business;
• that the structure of a contract management plan can vary depending on the contract management approach and complexity of the contract; and
• the mandatory requirements for a contract management plan.

OneSKY contract management plan

2.4 In November 2018 the OneSKY Program Executive approved the first OneSKY contract management plan.¹⁵ This was seven months after Airservices and Thales signed the acquisition and support contracts. Airservices advised the ANAO in October 2024 that the delay was due to workloads of key staff at the time and the need to analyse and extract the obligations of each contract to include in the plan.

2.5 The contract management plan states that it will be reviewed annually. A second version of the contract management plan was approved in April 2021 and a third version in October 2024.¹⁶ Airservices advised the ANAO in October 2024 that informal reviews of the contract management plan had occurred with updates released formally when necessary.

2.6 The purpose of the contract management plan is to describe how Airservices will govern, manage and administer all OneSKY contracts, including the CMATS acquisition and support contracts. Table 2.1 summarises the main components of the contract management plan applying to the CMATS acquisition and support contracts.

Table 2.1: Contract management plan key components

Note a: The acquisition contract includes the delivery milestone dates.

Note b: A separate OneSKY stakeholder management plan covers OneSKY stakeholders including Defence, suppliers, airline customers, regulators and internal business groups. The plan states that engagement with suppliers is conducted in ‘accordance with the governance arrangements set out in respective contracts and agreements’.

Source: ANAO analysis of Airservices documentation.

2.7 The contract management plan includes a range of information consistent with the Airservices enterprise-wide contract management procedure. It does not address how contract management risks for the CMATS contracts are managed through the OneSKY program risk management process (see paragraphs 2.23 to 2.34) or how probity is intended to be managed through the OneSKY probity management plan or enterprise-wide policies and procedures (see paragraph 3.71).

2.8 The contract management plan briefly covers performance. It does not include a comprehensive description of a coordinated approach to contract performance management, monitoring and reporting, or when to use certain levers if underperformance occurs and how these relate to contract remedies. It does not list all remediation activities available under the contract — for example, postponement or schedule recovery (see paragraph 3.65 to 3.66).

Contract management roles and responsibilities

2.9 The Program Executive reports to the Chief Executive Officer (CEO) and is the Airservices executive responsible for strategic oversight of the OneSKY program. As at March 2025, this is the Airservices Deputy CEO.¹⁷

2.10 The contract management plan sets out other contract management roles:

• Head of Transformation OneSKY/OneSKY Portfolio Lead — senior responsible officer for the overarching OneSKY program and co-chair of the CMATS Review Group (see Appendix 3). The Head of Transformation — OneSKY position was created following the Project of Concern remediation, when the former Program Director function was split.
• Joint Program Director (also called Joint Program Lead) — senior manager responsible for the day-to-day management and delivery of the CMATS program. Also responsible for all joint Airservices–Defence program activities. As at February 2025, the Joint Program Director is also the ‘customer representative’, who represents Airservices with Thales on contract matters. The contract management plan states that the customer representative is ‘responsible for the full administration of the contract’.
• Commercial and Legal Manager — manager ‘accountable for the implementation and maintenance of an effective commercial and legal framework’ including the development of contracting frameworks and ensuring OneSKY contracts are updated with contract variations. The contract management plan states that ‘in addition to the Customer Representative’ the Commercial and Legal Manager is ‘responsible for the management of the project contracts’.
• Finance and Procurement Team — responsible for all OneSKY contract-specific finance and procurement for the program.

OneSKY CMATS governance forums

2.11 As at January 2025, the OneSKY program has 12 governance forums, split into three streams based on membership: Airservices specific; joint Airservices and Defence; and tri-party Airservices, Defence and Thales (see Figure 2.1). OneSKY CMATS program and contract documentation (for example, the acquisition contract, contract management plan and on-supply agreement) outlines the governance arrangements, membership and meeting frequency for these forums. Ten of the 12 governance forums have terms of reference outlining roles and functions (see Appendix 3).¹⁸

2.12 In October 2022, Defence project AIR5431 Phase 3 was declared a Project of Concern, outside the formal program governance arrangements (see paragraph 2.50). Prior to this the project had experienced delays and cost increases, and governance forums discussed these issues. At the August 2021 CMATS Executive Committee meeting, Defence indicated that project delays had exceeded Defence’s tolerance and that it intended to escalate the project to ministerial level. Airservices supported this intervention.

2.13 In September 2022 Airservices and Defence engaged Mr Andrew Pyke to review the efficiency and effectiveness of the governance arrangements supporting the on-supply agreement.¹⁹ The report (finalised December 2022 and submitted to the Joint Executive Committee) listed opportunities for improvement, including by clarifying lead agency arrangements and revising the escalation of issues within the governance framework.²⁰

2.14 In March 2023 Airservices, Defence and Thales agreed on actions as part of the Project of Concern remediation plan to review OneSKY governance arrangements (see paragraphs 2.55 to 2.56). The action items included pursuing opportunities to maximise efficiencies and strengthen governance, ‘taking into account the recommendations from the 2022 Governance Review’.

2.15 Following these reviews OneSKY program governance was changed and an additional CMATS Steering Committee governance forum established — with Airservices, Defence and Thales SES Band 2/2-star military equivalent representatives (see Appendix 3). Airservices advised the ANAO on 20 January 2025 that other changes made in response to these governance reviews included updating Air Navigation Service Providers strategic documentation and the ‘active and regular participation of Defence Executives in governance forum/s with Thales’.²¹

2.16 The ANAO reviewed a sample of 55 papers and minutes across the forums from between February 2023 and October 2024 plus whenever a contract variation went to the Board Technology Committee and Airservices Board.²² Project updates, risks, schedule and issues were consistently discussed. The forums discussed contract management issues as part of broader program delivery and focused on what was occurring in the project at the time (for example, the Project of Concern remediation plan and subsequent actions; see paragraphs 2.49 to 2.58).

2.17 The OneSKY Strategic Relationship Forum membership comprises the Airservices, Defence and Thales accountable authorities and has not met despite the requirement to meet in ‘extraordinary circumstances’.

Contract reviews

2.18 Airservices’ enterprise-wide contract management procedure provides that Airservices must review:

• contract effectiveness annually, including by comparing existing and alternative suppliers and testing to ensure the contract remains on track to realise benefits; and
• contracts covering a period of more than seven years periodically to ensure value for money is maintained.

2.19 Airservices has not conducted a dedicated review of contract management practice or the suitability of the acquisition contract outside the value-for-money assessment of the December 2023 contract variation to support the revised delivery strategy (see paragraphs 3.25 to 3.27).

Are appropriate processes in place to monitor contract management risks?

Risk management documentation

2.22 Airservices has enterprise-wide risk management frameworks and processes including a risk appetite statement; a governance, risk and compliance policy; a governance, risk and compliance framework; a risk management standard; a risk management procedure; and an IT system for documenting enterprise-wide risk known as the Corporate Integrated Reporting and Risk Information System (CIRRIS).

2.23 Airservices has established risk management documentation and artefacts specific to the OneSKY program.

• Risk management plan — describes the risk management process, procedures and roles and responsibilities in relation to risk management for the program.²³ The plan broadly aligns with the risk management processes described in Airservices’ enterprise-wide documents. Three risk assessment tools described in the OneSKY risk management plan have been tailored for the OneSKY program.
• Program risk register — captures program-level risks to the OneSKY program.²⁴ The register contains fields to record information on the individual risk identity (description, context, and causes or threats), risk assessment outcomes and other operational information on the risk such as risk owner, risk trend, last and next risk review date and risk status.
• Project risk register — records project-level risks. The project risk register contains fields to record individual risk identity, risk assessment outcomes and other operational information.

Risk identification, assessment and monitoring

2.24 The OneSKY CMATS risk management plan categorises risk as:

• tier 1 — enterprise-wide;
• tier 2 — program-level; and
• tier 3 — project-level.

2.25 As at February 2025, Airservices has an enterprise risk in CIRRIS, rated medium, for the OneSKY program: ‘the OneSKY program not being delivered and benefits enabled on time and within budget’.²⁵ One cause of the risk identified is ineffective OneSKY CMATS commercial or contract framework management (see paragraph 2.28). Airservices noted in CIRRIS that controls and treatments are in place to mitigate this enterprise-wide risk and that these cover ‘oversight of scheduling and additional assurance activities including, corrective actions as part of Project of Concern mitigations’.²⁶

2.26 The OneSKY program and project risk registers also capture tier 2 and tier 3 risks. Risks rated high and medium for the program relate to system security, schedule delays, eroded program benefits, Thales’ and Airservices’ resource profile and capability, cost overruns, fitness for purpose, technology maturity and technology operations.

Contract management risks

2.27 The Airservices contract management procedure includes a list of contract management risks — for example, contract management capability, benefits realisation, supplier performance, stakeholder relationships and supply chain problems.

2.28 Airservices has grouped key contract management risks into one program risk — ineffective OneSKY CMATS commercial or contract framework management. Table 2.2 sets out the key details for this risk recorded in the program risk register.

Table 2.2: Contract management risk recorded in the program risk register

Note: Airservices’ OneSKY risk management plan defines a control as an ‘existing or pre-emptive measure used to modify a risk, opportunity or issue’. The plan sets out that a treatment addresses the causes, consequences or likelihood of a risk, opportunity or issue event.

Source: ANAO analysis of Airservices records.

2.29 Airservices documented the contract management risk in the risk registers consistent with the OneSKY risk management plan tools/matrix. It rated the risk treatments overall as ‘substantially effective’, with monitoring Thales’ performance ‘partially effective’ and reviewing the operations of the Commercial and Legal team ‘not yet effective’. Performance monitoring is further discussed in paragraphs 3.52 to 3.69 and the contract management plan in paragraphs 2.4 to 2.8.

2.30 The OneSKY risk assessment tools set out how frequently risks should be reviewed according to risk rating:

• ‘low’ twice each year;
• ‘medium’ each quarter;
• ‘high’ each month; and
• ‘extreme’ continuously.

2.31 Airservices has a monthly risk review process to monitor risks associated with the OneSKY program. It maintains a risk review log and version history for each risk identified in the register. The Program Risk and Opportunity Forum meets monthly and reviews risks that are identified as high, have an increasing trend or are due for review.²⁷ Airservices maintains a record of its meeting minutes and presentation slides. The OneSKY Program Board (see Appendix 3) discusses risk profiles and artefacts.

2.32 Airservices reviewed the contract management risk consistent with its risk rating (see paragraph 2.30) and updated the risk register as necessary. The risk registers recorded the reviewer, whether the risk had been reviewed at the Program Risk and Opportunity Forum and any changes including treatment plans, risk trend and rating.

2.33 The program and project risk registers identify linkages between risks. Airservices has linked the contract management risk to the following CMATS program risks:

• technology is not fit for purpose;
• CMATS requirements change; and
• CMATS will not be transitioned into operational service within schedule or will not deliver all elements of the OneSKY business case in a timely manner.

2.34 For these risks, the identified controls and treatments related to contract management are high-level — for example, the acquisition contract, development of a contract management plan, the remediation plan and the revised delivery strategy. Airservices has not recorded detail on how it would utilise these controls or other contract management levers to effectively mitigate these risks — for example, by actively monitoring Thales’ performance, using the contract variations process to assess value for money when program requirements change or expanding on treatments following the revised delivery strategy to ensure achievement of contract deliverables and program objectives remain on track.

Issues register

2.37 Airservices records and tracks program and project issues through a register. The issues register contains fields for issue description, rating, trend, resolution actions and other operational details such as manager and review date. The risk management plan sets out that issues should be reported, discussed and reviewed at program-level boards including the OneSKY Program Board as relevant, and the issues register captures when this occurs. The issues register does not go to other governance forums.

2.38 The issues register recorded 36 administrative, technical and project issues from 2020 to 2024. As at 14 January 2025, the issues register has one open issue related to contract management: the support contract ‘does not reflect all of the CCPs [contract change proposals] signed for [the] acquisition [contract]’. Airservices has recorded information including actions to be taken and review dates against this issue.

Defence risks

2.39 Airservices’ program- and project-level risk register identifies risks specific to Airservices and risks that collectively impact Airservices and Defence. In Auditor-General Report No. 20 2024–25, 2023–24 Major Projects Report, Defence states that it maintains a separate risk register for Defence-specific or unique risks and issues, and summarises risks to AIR5431 Phase 3 as being ‘contractor performance, schedule, workforce, [Defence] customer furnished (materials, supplies, services, data), and program delivery’.²⁸ It notes that it is mitigating the risks through implementing the Project of Concern remediation plan, the revised delivery strategy, program governance arrangements and updates of joint strategic plans. Defence concludes that overall risk has reduced since 2022–23 as a result of implementation of Project of Concern remediation plan actions.²⁹

Has Airservices Australia established a fit-for-purpose arrangement with Defence?

2.40 As the lead agency, Airservices has entered into contracts with Thales for the acquisition and support of CMATS on behalf of Airservices and Defence. The acquisition and support contracts include common elements, Airservices-unique deliverables and Defence-unique deliverables. The acquisition contract provides that Airservices may at any time partially novate the contract so that Defence and Airservices would each proceed with separate contracts with Thales and own the relevant CMATS components.

2.41 Airservices will on-supply to Defence the CMATS capability and support required by Defence as formalised through an on-supply agreement signed on 22 February 2018.

On-supply agreement

2.42 The on-supply agreement is a contract that covers the CMATS capability and support services to be delivered, the relationship between the parties and Defence’s contribution to CMATS and other OneSKY sub-programs.³⁰

2.43 The on-supply agreement includes:

• program scope — describes the CMATS elements (services and goods/supplies) covered by the on-supply agreement and to be provided to Defence;
• governance — outlines Joint Airservices/Defence governance forums (see Appendix 3) and Defence’s role in CMATS contract variations;
• agreement management — describes how the agreement can be amended with variations;
• financing and payments — describes the invoicing arrangements;
• termination of the agreement — outlines the exit terms for each party; and
• associated payment schedules — outlines payments including cost allocation across financial years and milestones.

2.44 The on-supply agreement sets out that Airservices and Defence will work collaboratively, be transparent, act in good faith to achieve program objectives and ‘resolve any future management, technical, operational and commercial issues that may arise, through the governance forums’. The on-supply agreement also sets out that Airservices and Defence will work collaboratively with Thales to resolve any conflicts. Although the on-supply agreement and governance arrangements were in place, CMATS was listed as a Project of Concern at the request of Defence (see paragraph 2.50) in order to remediate the program and contract.

2.45 The on-supply agreement provides that Defence can terminate it with approval from the Secretary of the Department of Defence, the Chief of the Defence Force and the Chair of the Airservices Board. On termination of the agreement, Airservices would be required to provide Defence all deliverables existing at the time, including software and hardware.

2.46 The Joint Program Team is comprised of Airservices and Defence personnel and was established to manage the CMATS program. Its role and functions are outlined in the on-supply agreement.

2.47 Since February 2018 Airservices and Defence have varied the on-supply agreement 10 times, largely in response to CMATS acquisition contract variations (see Table 2.3). Airservices and Defence signed and dated all variations to the on-supply agreement.

Table 2.3: On-supply agreement variations

Key: ✔ Yes ✘ No.

Source: ANAO analysis of on-supply agreement variations.

2.48 Defence and Airservices have commenced work to update on-supply arrangements to better reflect the services required for the ongoing sustainment and business-as-usual support of CMATS once operational.³¹

Project of Concern

2.49 The Defence Project of Concern and Interest framework provides for ministerial oversight of Defence projects and development of remediation for Defence projects that are not meeting targets. The Minister for Defence Industry lists projects on advice from Defence.

2.50 The Minister for Defence and the Minister for Defence Industry first jointly declared CMATS a Project of Concern in August 2017, following protracted negotiations that led to a delay in the execution of the acquisition contract.³² The project was removed from the list in May 2018 and managed as a Project of Interest.³³ In August 2021 Defence wrote to the Minister for Defence and the Minister for Defence Industry recommending that AIR5431 Phase 3 be declared a Project of Concern. In September 2021 the Minister of Defence directed that CMATS be returned to the Projects of Concern list. On 27 October 2022 the Minister for Defence Industry declared CMATS a Project of Concern due to ‘significant schedule, technical and cost challenges’.³⁴

2.51 Through the Project of Concern process the Minister for Defence Industry holds meetings (called summits) with the principal stakeholders of listed projects to remediate performance. As at February 2025 the Minister for Defence Industry has held six summits on CMATS (see Table 2.4).

2.52 Attendees at these summits were the Minister for Defence Industry, the Minister for Infrastructure, Transport, Regional Development and Local Government (8 December 2023 summit only), senior Defence officials, senior global and Australian Thales representatives, Airservices executives and the Deputy Secretary, Transport Group, Department of Infrastructure, Transport, Regional Development, Communications, Sports and the Arts. Table 2.4 sets out summit dates and outcomes. The next summit is expected to be held in August 2025.

Table 2.4: CMATS Project of Concern summits

Note a: In December 2022 Airservices contracted TBH Consultancy (Contract CW47386, 29 March 2023 to 8 May 2023, $172,000) to conduct an integrated baseline review of the Thales schedule to deliver CMATS. TBH Consultancy advised Airservices in February 2023 that it could not provide assurance over the schedule and that ‘significant work [was] required for the program to develop credible, defensible and achievable cost and schedule baselines’. The findings of the review were incorporated into the development of the remediation plan.

Source: ANAO analysis of Project of Concern summit minutes and outcomes.

Remediation plan

2.53 The Project of Concern process involves the development and monitoring of dedicated remediation plans. At the December 2022 summit it was agreed that a remediation plan for CMATS would be developed by February 2023.

2.54 On 20 March 2023 Defence approved the remediation plan, with endorsement from Airservices and Thales.³⁵ The purpose of the plan was to remediate the project across requirements, schedule, governance oversight and cost efficiency through a revised delivery strategy. While the Project of Concern process is led by Defence, the remediation plan included actions that impacted the whole CMATS program.

2.55 The plan listed high-level actions across three focus areas, an ‘action plan’ (discrete tasks to achieve the overarching action) together with ‘action owner’, expected outcome, evidence of completion and deadline. The focus areas and high-level actions were:

• capability and cost objectives — review strategic documents that cover the relationship between Airservices and Defence as Air Navigation Service Providers and confirm the program delivery strategy for CMATS;
• schedule objectives — Thales to develop a credible, executable and resourced schedule for delivery and Airservices to develop an integrated master schedule for delivery of CMATS across the program for planning purposes; and
• governance objectives — pursue opportunities to maximise efficiencies and strengthen governance and pursue tools to track progress and provide an accurate assessment in the delivery of CMATS.

2.56 At the December 2023 summit it was agreed that the majority of the remediation plan actions from the first version of the remediation plan had been achieved. Key actions implemented were a revised delivery strategy and delivery dates — executed through a contract variation in December 2023 (see paragraph 3.27) and development of program-level key performance indicators (see paragraph 3.58).

2.57 In July 2024 Defence approved a second version of the remediation plan, with endorsement from Airservices and Thales. The actions had a greater focus on Defence, with the incorporation of the exit criteria (see Table 2.5). Actions listed in the second version of the plan were:

• three residual items from the first version of the plan (development of an integrated master schedule, review of strategic documents and finalisation and use of the program-level key performance indicators);
• a new item on updating the support contract to reflect changes made to the acquisition contract as a result of the revised delivery strategy contract variation; and
• new items relating to the exit criteria.

Table 2.5: CMATS Project of Concern exit criteria

Note a: CMATS is due to be deployed at multiple military air bases including RAAF Base East Sale (see footnote 8). Additional work is required to consider the security accreditation required for access to Defence networks and to demonstrate successful software integration.

Note b: Release 1.8 is a software release. To confirm this milestone, Airservices and Defence will endorse that testing for this component has taken place.

Note c: The OneSKY program includes other contracts such as the one with SAAB for the supply and support of replacement tower systems for four regional Defence sites known as ADOT (see footnote 10).

Source: Second version of the Project of Concern remediation plan.

2.58 In November 2024 Defence prepared a status report on the second version of the remediation plan. It set out that:

• the residual items from the first version of the remediation plan were completed and the new item to update the support contract was ‘work-in-progress’; and
• three of four actions linked to the exit criteria were ‘work-in-progress’ and one was ‘yet to start’.

2.59 Defence reports monthly on CMATS to the Minister for Defence Industry under the Project of Concern process. The reporting includes an overall summary of the progress of the project against milestones and remediation plan actions. At the February 2025 update, Defence reported that project progress was positive.

Defence payments

2.60 Under the original on-supply agreement the Defence component of the project was to be supplied at a fixed price of $521 million (OSA AUD equivalent).³⁶ Variations made from July 2019 to January 2025 increased the fixed price to $564 million (OSA AUD equivalent).

2.61 Defence paid Airservices quarterly from 2017–18 to 2024–25, and the total paid as at February 2025 was $509 million (OSA AUD equivalent).³⁷

2.62 In March 2024, following the December 2023 implementation of the revised delivery strategy, Airservices and Defence executed a variation to the on-supply agreement. This variation changed the payment structure so that the funds remaining after Defence’s final quarterly payment (quarter 2, 2024–25) would be assigned to achievement of future milestones that included Defence elements of CMATS, as shown in Table 2.6. Defence advised the ANAO on 7 March 2025 that it expects to recognise milestone completion when it is supported by evidence — for example, a milestone acceptance certificate.

Table 2.6: Estimated future Defence milestone payments, by financial year

Note: Amounts are shown in OSA AUD equivalent.

Source: On-supply agreement (August 2024).

3.1 The Department of Finance (Finance) defines contract management as ‘all the activities undertaken by an entity, after the contract has been signed or commenced, to manage the performance of the contract (including any corrective action) and to achieve the agreed outcomes’.³⁸ Effective contract management facilitates delivery of the contract consistent with the terms agreed at contract execution and value for money.

Have contract variations been approved and documented in line with the contract management plan and procedures?

Civil Military Traffic Management System contract variations

3.2 Between 22 February 2018 and 31 December 2024, Airservices and Thales agreed 44 contract variations for the acquisition contract and three for the support contract. The combined impact of the variations on the acquisition contract target and ceiling prices was around $160 million (AUD equivalent) and a delivery delay of 53 months (four-and-a-half years). One support contract variation increased the support contract by around $14 million (AUD equivalent).³⁹ Additional acquisition contract costs resulting from variations are allocated from the OneSKY program budget (see paragraph 3.29).

3.3 The number of contract variations fluctuated each year. Table 3.1 sets out acquisition contract variations executed by year, number executed per year, cost per year and effect on scheduled delivery.

Table 3.1: CMATS acquisition contract variations and impact^a

Note: Amounts are shown in AUD equivalent.

Note a: Contract variations with cost implications change the target and ceiling price by the same amount.

Note b: The second contract variation reduced the cost of the contract overall by reducing scope for the Department of Defence (Defence) component (by $38.6 million AUD equivalent) and increasing scope for the Airservices component (by $30.4 million AUD equivalent). This resulted in a net reduction to the contract price of $8.2 million (AUD equivalent) but an overall increase to Airservices of $30.4 million (AUD equivalent). Airservices advised the ANAO on 29 November 2024 that these changes were anticipated at contract signing and resolved after additional technical work to align the contract and engineering requirements.

Source: Airservices records.

3.4 Primary drivers of the acquisition contract variations were scope change (19 variations), technical change (13 variations), administrative change (11 variations) and delivery schedule change (three variations).⁴⁰ None of the administrative variations increased cost or affected the delivery schedule.

3.5 Airservices measures the amount of scope change through a ‘requirements stability score’ key performance indicator (KPI), and this is reviewed by the Program Review Board.⁴¹ From August to November 2024 Airservices rated this KPI as ‘requires monitoring’ (see Table 3.9). Program Review Board discussion indicates that it considered the key driver of the rating to be the 22 engineering (technical) variations to be incorporated into a contract variation (subsequently executed on 19 January 2025).

3.6 Airservices, Defence or Thales can initiate a contract variation. Of the 47 contract variations executed to the acquisition and support contracts between 22 February 2018 and 31 December 2024, Airservices advised the ANAO on 3 February 2025 that it initiated 18 variations, Thales initiated 18, Airservices and Thales jointly initiated five, and Defence initiated six. If Airservices and/or Defence identify the need for a variation, the acquisition contract allows for Thales to be paid ‘reasonable costs’ to develop the contract change proposal.⁴² Airservices advised the ANAO on 7 March 2025 that it paid Thales $4,913,045 (AUD equivalent) for preparation of contract variations between 22 February 2018 and 30 June 2024, and Defence contributed $1,030,029 (AUD equivalent).⁴³

Contract variation guidance

3.7 Airservices’ enterprise-wide contract management procedure sets out requirements for contract variations, including that potential variations should be assessed against the Airservices procurement policy and financial obligations, recognising that they may not always be appropriate.

3.8 The Airservices procurement policy states that Airservices is ‘not required to comply with the Commonwealth Procurement Rules [but] adopts its high-level principles; the main principle being the achievement of value for money.’ It provides that value for money must be assessed and achieved for all procurements, provides a list of value-for-money considerations and states that delegates must be provided with sufficient information.

3.9 The CMATS acquisition and support contracts include provisions for contract variations. The contracts cover responsibility for cost of development, how a variation should be prepared and executed and the process for evaluation and approval. This is supported by additional detail in program documentation, as outlined in Table 3.2.

Table 3.2: Airservices documents and frameworks for CMATS contract variation management

Source: ANAO analysis of Airservices documentation.

3.10 In October 2023 Airservices conducted an internal audit to ‘provide assurance that the process in place for assessment of value for money and recording of decisions for contract changes was adequate’. The audit found that Airservices assesses ‘risk, technical feasibility and costs’ for contract variations (including through the contract variation evaluation reports introduced in June 2022) but that it did not draw these together into a ‘value for money perspective’.

3.11 In January 2024 Airservices updated the OneSKY CMATS Program Technology Change Management Plan in response to these findings. The updates set out that the evaluation report should document value-for-money considerations consistent with the procurement policy, that the Control Change Board had a role in considering value for money and that Airservices needed to ‘confirm the change proposal represents “value for money” principles and is suitable for approval and execution’. A section on Defence engagement was also added.

Contract variation process

3.12 Airservices has developed a process to manage the development, evaluation and approval of contract variations, as outlined in Box 1.

Note a: Airservices initiates variations where necessary to address regulator requirements.

Note b: Airservices provided the ANAO with two 2024 examples of it rejecting requests for a contract variation from Thales. In one, Airservices rejected Thales’ request because it believed that the issue was the result of a Thales’ design rather than a need for a scope change. In the other, Airservices advised that it believed it was Thales’ design decisions rather than Airservices’ action or inaction that led to its need for a variation.

Note c: The Change Control Board provides oversight and direction over proposed changes to the OneSKY CMATS Program. It does not approve the business case or funding for variations. In 2015 the OneSKY Change Control Board and the Joint Change Control Board were established as separate entities to consider engineering and technical changes relating to either the OneSKY Program or Defence capability. In 2019 new terms of reference were established (and updated in 2020, 2021 and 2024) and the entities were combined into a single board with members comprising Airservices and Defence representatives.

Note d: The Board Technology Committee ordinarily endorses the allocation of funding for costed variations before they are considered by the Airservices Board. Should Airservices require a decision on a variation before the next scheduled Board Technology Committee meeting, the Airservices Board considers the variation without Board Technology Committee review — noting the crossover in membership between the forums and that the Board Technology Committee is a sub-committee of the Board. See Appendix 3 for Board Technology Committee membership and purpose.

Airservices’ compliance with the contract variation process

Approvals

3.13 The ANAO reviewed the Airservices Board approval, Change Control Board endorsement and CEO approval process for all 47 contract variations executed between 22 February 2018 and 31 December 2024. For the 44 acquisition contract variations:

• the Airservices Board considered and approved the funding allocation for the 26 contract variations that had a financial impact and the revised delivery strategy variation due to its impact on the overall program (see paragraph 3.25);
• the Change Control Board endorsed 40 variations⁴⁴; and
• the CEO signed all but one deed of variation, which was signed by the OneSKY Program Executive.⁴⁵

3.14 Three support contract variations were executed between 22 February 2018 and 31 December 2024. Of these, one had a financial implication and was considered by the Airservices Board. The Change Control Board endorsed all three variations. The CEO approved and signed all three.

Governance and value-for-money assessment

3.15 The ANAO analysed a sample of 16 variations to assess compliance with the end-to-end process. Table 3.3 provides the ANAO analysis of Airservices’ compliance with the process for the sample. Paragraphs 3.16 to 3.20 discuss the testing results.

Table 3.3: Airservices’ compliance with contract variation process

Key: ● Compliant ◕ Largely compliant ◑ Partly compliant

Note a: The ANAO did not test Thales’ development of contract variations. This process is external to Airservices.

Source: ANAO analysis of Airservices documentation and records.

Identification and definition

3.16 For the 16 variations tested, Airservices defined its request for Thales to develop variation proposals and used the formal letter template for 12.

Evaluation and approval

3.17 The evaluation report was introduced in June 2022 (see Box 1). Reports were prepared for all but one variation executed since its introduction and these covered risks, technical evaluation, financial breakdown of the increased cost and a value-for-money statement for each variation based on the proposed change. The completed reports included wording to state that value for money was achieved — for example, ‘represents value for money’ or ‘entering into the CCP represents value for money in the circumstances’ — but did not expand on how the evaluation team drew together its findings and made this conclusion.

3.18 Airservices prepared an approval brief for each of the 16 variations tested. The content of the briefs generally covered background and rationale for the variation, Change Control Board endorsement, evaluation report, financial and risk implications, and Airservices Board approval (if relevant).

3.19 The approval brief, or subsequent approval, did not routinely document:

• how the various considerations (for example, new scope, cost, risk and contract value overall) collectively justified the value-for-money assessment in sufficient detail;
• whether the variation altered the original procurement value-for-money assessment;
• Thales’ past performance, impact of delays on program delivery and confidence to deliver the change; and
• the appropriateness of an extension (even if minor) as opposed to undertaking a new procurement — noting eight of the variations tested had a schedule impact and the cumulative impact of variations of 53 months to the contract.

3.20 The exception was the process undertaken for the contract variation in December 2023 to support the revised delivery strategy. The CEO brief for this variation explained that the evaluation report detailed the negotiations, and set out the Airservices Board consideration and endorsement of the value-for-money assessment (see paragraphs 3.25 to 3.26).

Revised delivery strategy and standstill deed

3.22 In July 2023 Airservices, Defence and Thales agreed to pause certain rights and obligations under the acquisition contract and enter into a standstill deed while they negotiated a revised delivery strategy under the Project of Concern remediation plan (see paragraphs 2.53 to 2.59).⁴⁶ Airservices advised the ANAO on 10 December 2024 that the cumulative effect of several factors related to Thales’ performance, together with the Project of Concern listing and remediation plan, provided the impetus for Airservices, Defence and Thales to take this approach.

3.23 The standstill deed included:

• 11 ‘principal issues’ to be negotiated between Airservices, Defence and Thales and the objective, conditions and detail on negotiations for each⁴⁷; and
• other issues to be negotiated such as the revised delivery schedule and any other matters causing contract delays.

3.24 Airservices, Defence and Thales held 39 negotiation sessions to resolve the principal and other issues. On 6 December 2023 the three parties agreed on the revised delivery strategy contract variation, to act in good faith to negotiate any related variations and on how they would resolve each of the 11 principal issues.

Contract variation for revised delivery strategy

3.25 The Airservices Board noted on 4 December 2023 that Airservices, Defence and Thales had reached in-principle agreement on a contract variation for the revised delivery strategy and authorised the CEO to execute it together with associated changes to the on-supply agreement. It was presented to the Board due to its high risk for Airservices, and to date this is the only non-financial contract variation the Board has considered.

3.26 In endorsing the variation value-for-money assessment, the Board noted:

• the variation would remediate the issues resulting from Thales’ failure to deliver on its contractual requirements;
• Thales had forecast exceeding the ceiling price, which would result in Airservices paying $100 million (AUD equivalent) under the pain-share arrangements;
• the acquisition contract price would not increase;
• the external value-for-money report⁴⁸; and
• an updated OneSKY financial position and OneSKY business case would be provided to the Board at a subsequent meeting (see paragraphs 3.31 to 3.32).

3.27 In December 2023 Airservices and Thales executed the contract variation. It changed the delivery sequence from release zero, release one and release two to move directly to release one, with deployment to Airservices sites first followed by Defence sites. It also revised the system acceptance dates for release one from January 2027 to June 2028 and release two from June 2027 to August 2029, with deployment to civil sites first, followed by Defence sites.⁴⁹

Settlement deed

3.28 On 20 December 2023 Airservices, Defence and Thales executed the settlement deed. The settlement deed:

• closed the standstill deed;
• gave effect to the resolutions agreed for each of the principal issues;
• enabled the execution of the contract variation to support the revised delivery strategy; and
• set obligations and timeframes for Airservices, Defence and Thales to review the implementation of the contract variation until the deed expiry in December 2024.

Has Airservices Australia appropriately managed supplier payments and performance?

OneSKY budget

3.29 The Airservices OneSKY program budget covers the overall program and includes the CMATS acquisition contract and other OneSKY program costs. The OneSKY budget has increased over time, as set out in Table 3.4.

Table 3.4: Airservices OneSKY program budget and costs incurred

Note: Amounts are shown in AUD equivalent as calculated by Airservices.

Source: Airservices documentation.

3.30 In briefing the Board Technology Committee in September 2024, Airservices advised that additional costs for the OneSKY program related to:

• increased costs of the acquisition contract — including increases due to variations and $100 million for its component of the pain-share arrangement (see paragraph 2.41);
• Airservices project management costs;
• transition and training; and
• proposed contingency.

Updated OneSKY business case

3.31 In December 2017 Airservices finalised the OneSKY business case, which recommended replacing The Australian Advanced Air Traffic System (TAAATS) with a new civil–military air traffic management system (CMATS). In May 2024 Airservices presented an updated OneSKY program financial position and OneSKY business case to the Board Technology Committee.⁵⁰ The updated business case compared ‘like for like’ the 2017 business case with an updated 2024 OneSKY program position — reflecting the revised schedule, cost and benefits assessment. In briefing its Board, Airservices advised:

• ‘the CMATS case, with updated schedule, cost and benefit information, still ranks favourably against’ the continuation of TAAATS; and
• ‘program delays and associated cost increases had no material impact on the economic viability of the program over the 20-year life of the asset’.

3.32 In May 2024 the Board Technology Committee accepted the findings of the updated business case and requested that Airservices conduct additional analysis to determine whether ‘future benefits still exceed costs to be incurred’. In September 2024 Airservices presented the additional information, and at that meeting the Board Technology Committee executed its right to form a Board (with an overlap in membership). The Airservices Board then noted that ‘the benefits significantly outweigh the remaining whole-of-life costs’.

Payments

Payment structure

3.33 Under the contract, Airservices reimburses Thales for actual costs incurred for works performed under the contract up to the ceiling cost. A margin is then payable on the completion of the specified milestone. The acquisition contract defines key pricing elements, as set out in Table 3.5.

Table 3.5: CMATS acquisition contract key pricing elements

Source: ANAO analysis of acquisition contract.

Pain-share/gain-share arrangement

3.34 In February 2018, when Airservices and Thales executed the acquisition contract, they agreed to an incentive arrangement rather than a fixed price. The incentive is designed so that they share costs and savings through a pain-share/gain-share arrangement established through target and ceiling prices. The acquisition contract establishes the purpose of this arrangement: to support ongoing collaboration; allow Airservices and Thales to manage risk, contingency and contractual performance; align their interests; and incentivise contractor performance.⁵¹

3.35 Under the pain-share arrangement, Airservices pays for all the actual costs incurred up to the target cost and half of those actual costs incurred between target cost and ceiling cost. Milestone payments, including a margin component, are paid on the completion of specific milestones. Thales will become liable for all costs over the ceiling cost.

3.36 Conversely, if Thales delivers the contract below the target cost, the parties will activate the gain-share arrangement and Airservices will pay Thales a ‘bonus’ of 50 per cent of the difference between the target cost and Thales’ actual costs as well as the margin.⁵²

3.37 Table 3.6 shows the relationship between the pain-share/gain-share arrangements and Airservices’ payments to Thales.

Table 3.6: CMATS acquisition contract payments structure

Source: ANAO analysis of the acquisition contract.

Milestone payments

3.38 Under the acquisition contract as agreed in February 2018, Airservices reimbursed Thales monthly for actual costs (direct and indirect costs) and paid the margin on achievement of specified milestones. Following the execution of the contract variation for the revised delivery strategy, Airservices:

• pays 60 per cent of direct costs incurred every two months rather than every month; and
• pays the remaining 40 per cent of direct costs, indirect costs (incurred after 1 February 2023) and the margin in milestone payments.⁵³

3.39 The contract specifies ‘cost checkpoints’ and a cost ceiling for actual costs paid to that checkpoint. The contract provides that Thales will not be entitled to payment at a particular checkpoint if actual costs accrued exceed the checkpoint ceiling cost before it achieves the specified milestone — unless Airservices and Thales have executed a contract variation or the Program Review Board has made a decision to modify the checkpoint ceiling cost.

Payments to Thales

3.40 As at December 2024 the target price was $1.365 billion (AUD equivalent) and the ceiling price $1.465 billion (AUD equivalent). Airservices advised the ANAO on 31 March 2025 that as at February 2025 it had paid Thales $1.189 billion under the acquisition contract.⁵⁴

3.41 Airservices advised the ANAO in June 2025 that based on the current financial position of the contract it is likely that Thales will reach target cost during the 2025 year and ceiling cost prior to expiry of the acquisition contract. As a consequence, Airservices expects to be liable for $100 million (AUD equivalent) under the pain-share arrangement. In December 2023 Airservices advised its Board that reasons for increases in Thales’ actual costs included an extension to the program by over four years, complexity of software development, engineering requirements such as those related to security and safety, and integration issues.

3.42 If Thales exceeds the ceiling cost, it will be entitled to milestone payments only. This presents a risk that Thales will lack the incentive to deliver the project to schedule. Airservices advised the ANAO in December 2024 that it considered this risk as part of the delivery strategy variation and, to mitigate it, moved a percentage of direct and indirect costs into milestone payments.

Payment pauses

3.43 Thales performed work under the contract without payment between February and December 2023. This was a result of Thales pausing invoicing of Airservices for incurred actual costs from February to November 2023, after it exceeded the checkpoint ceiling cost for a milestone it had not achieved in January 2023.

3.44 Under the standstill deed, Airservices and Thales agreed that Thales would achieve three intermediate milestones during the period July to December 2023 and that Airservices would pay Thales 80 per cent of the direct costs it accrued between February and October 2023, when it achieved the final intermediate milestone. In January 2024, following the December 2023 execution of the settlement deed, Airservices paid Thales the remaining 20 per cent. Airservices and Thales agreed that it would pay Thales the indirect costs as accrued from February 2023 through future milestone payments.

3.45 Defence paused payments to Airservices from March 2023, during the period that Thales paused invoicing of Airservices. Defence back-paid Airservices following the execution on 1 March 2024 of an on-supply agreement variation.

Invoicing and payment arrangements

3.46 Under the revised delivery strategy, Thales submits invoices to Airservices every two months for 60 per cent of actual costs and a milestone claim on completion of each relevant milestone. On receipt of the invoice, Airservices reviews a sample of transactions listed for accuracy and the Head of Transformation OneSKY approves the invoice from a business perspective before it is paid. For Airservices to accept that milestones have been achieved, the Joint Program Team (see paragraph 2.46) reviews Thales’ submission and makes a recommendation to the Program Director for final decision.

3.47 Through the course of Airservices’ financial statements audit, the ANAO tested Airservices’ payments of Thales’ invoices for CMATS for 2022–23 and 2023–24 and made no findings in Airservices’ reported transactions.

Support contract

3.48 Under the support contract Thales will provide services to Airservices to support CMATS once operational. Airservices will pay Thales quarterly and monthly in arrears depending on the service provided subject to any reduction in the amount payable to Thales should it underperform.

3.49 Airservices commenced engaging with Thales in October 2022 on whether it would move to a subscription delivery model. Airservices advised the ANAO on 10 December 2024 that it had suspended this engagement with Thales in June 2024. Airservices further advised the ANAO that it resumed engagement with Thales in February 2025 by inviting Thales to provide a proposal on how to incorporate the subscription delivery model under the contract.

Performance management

3.50 Airservices’ enterprise-wide contract management procedure covers requirements for contractor performance management. It sets out:

• that performance management is essential to contract management and that it is used to ensure Airservices and the supplier adhere to their obligations;
• the requirement that contract management plans cover the use of key performance indicators and approach to performance management processes; and
• a list of requirements including regular review of contract KPIs with feedback provided to the supplier, implementation of a performance plan if a contract supplier does not meet satisfactory standards for two review periods in a row and review of contract effectiveness (see paragraphs 2.18).

3.51 Airservices considers Thales’ contract performance through schedule and price. This is provided for in the acquisition contract, support contract and OneSKY program framework documents, as outlined in Table 3.7.

Table 3.7: Airservices contract performance mechanisms

Source: ANAO analysis of acquisition and support contracts and Airservices documentation.

Performance monitoring

Reporting artefacts

3.52 The acquisition contract lists the reporting artefacts that Thales is required to submit to Airservices. This list provides details on individual reporting artefacts, including how reports are to be submitted and reviewed by Airservices, frequency of reporting and description of the report. Table 3.8 describes the main reporting artefacts.

Table 3.8: CMATS contract reporting requirements

Note a: Under the Project of Concern remediation plan, Airservices and Defence agreed to reduce costs and effort by refining contract documentation and improving governance and reporting systems. In 2023 Airservices replaced the Contract Status Report with the streamlined Mini Contract Status Report.

Note b: Performance measurement baseline combines the approved budget with the planned work schedule.

Source: ANAO analysis of Airservices documentation and records.

3.53 Airservices reviews the reporting documentation to check the quality of the artefacts and may ask Thales to amend reporting artefacts before approval. Airservices tracks the status of the reporting artefacts, including the associated milestone, whether the artefact was approved the first time it was received, how many revisions were required and whether it was delivered on time.

Project ledger system

3.54 The ledger system is a contractual mechanism to manage ‘ledger events’ and the subsequent treatment of such events.⁵⁵ The acquisition contract states that the Program Review Board is to develop and maintain a project ledger to capture these issues.

3.55 Airservices advised the ANAO on 15 October 2024 that the project ledger system had not been formally implemented as a contractual mechanism and Program Review Board function, although several attempts were made to implement its use. Airservices further advised the ANAO in June 2025 that a working group has been established to implement the ledger system and effectiveness of the ledger will be reviewed within a year.

Contract performance reviews

3.56 The acquisition contract and the contract management plan set out that Airservices and Thales should hold six-monthly (or as otherwise agreed) contract performance reviews. The purpose of the reviews is to:

• facilitate Airservices’ evaluation of Thales’ performance and Thales’ of the Airservices team;
• consider the quality of the developing work and ongoing services, and assess final products and services; and
• facilitate early identification and mitigation of any adverse effects of performance.

3.57 Airservices advised the ANAO on 12 December 2024 that it does not use the contract performance reviews to review Thales’ performance and that it monitors Thales’ performance through the Program Review Board and performance reporting artefacts instead (see Table 3.8).

Program key performance indicators

3.58 Airservices established program KPIs under the Project of Concern remediation plan and uses these to monitor overall OneSKY program performance. Prior to this Airservices did not use program or contract management KPIs to provide assurance that Thales was meeting its obligations under the contract or program objectives were being achieved. The OneSKY program KPIs support the key result areas — scope, schedule, cost, organisation, safety and security.⁵⁶

3.59 Airservices uses a traffic light system to present monthly performance ratings for individual KPIs. It presents KPI dashboards to the three tiers of governance (see Figure 2.1) — with the level of detail and data provided varying depending on the tier. Table 3.9 sets out the KPIs presented to the Program Review Board between August and December 2024.

Table 3.9: Program Review Board KPI reporting, August to December 2024

Key: ◆ On track ▲ Requires monitoring ■ Requires intervention — insufficient data/not due

Note a: The name of the KPI changed between August and December 2024 either to align the name with an upcoming milestone or in response to an update of individual KPI characteristics.

Note b: This did not have results for August to October 2024 because no requirements were planned for completion at that time.

Note c: This is measured through a survey of two key Airservices staff.

Source: ANAO analysis of Airservices records (Program Review Board reports, August to December 2024).

3.60 Individual KPIs are supported by a document that captures the reporting methodology. This includes details on the purpose of the KPI, defined thresholds for performance ratings (green — on track; amber — requires monitoring; and red — requires intervention). The OneSKY Performance Management Plan (approved on 9 December 2024) also sets out how KPIs are to be used. It includes information on the how KPI data are presented to different levels of governance, roles and responsibilities, and detailed supporting KPI data (for example, purpose, review frequency and assessment method).

3.61 Neither the KPI documentation nor the contract management plan defines associated contract management actions such as contractual remedy or the process for Thales should it not meet KPIs.

Program Review Board

3.64 The acquisition contract outlines the governance role of the Program Review Board in monitoring performance. The ANAO reviewed a sample of its meeting minutes and reports from 2023–24. Discussion included:

• Project of Concern process and implementation of the deed of settlement;
• program KPIs for feedback on development, relevance and results, and poor results in the late delivery of reporting artefacts provided by Thales; and
• combining release 1.7 and release 1.8 milestones together with changes to scope, benefits and associated risks.⁵⁷

Contract remedies

3.65 The contract management plan outlines remediation activities including:

• checkpoint ceiling — triggered when actual costs exceed certain thresholds (see paragraph 3.39). Remediation activities may include a ‘cost management remediation plan’, governance mechanisms, withholding payment, contract termination or payment on issue resolution⁵⁸;
• warranty provisions under the Joint Acquisition Statement of Work (statement of requirements included in the acquisition contract) stating that defects are to be fixed; and
• substituted performance — provides Airservices with the discretion to perform or procure ‘remedial work’ with an alternative party to Thales if specific criteria are met.

3.66 The acquisition contract also includes remediation mechanisms (not listed in the contract management plan):

• postponement — obligations placed on Thales to inform Airservices if delays to delivery are expected. Airservices and Thales can agree to postpone a milestone delivery using a contract variation; and
• schedule recovery — Thales as the contractor must deliver each milestone by the milestone date outlined in the delivery schedule. Schedule recovery may be used to direct Thales to take any measures Airservices considers reasonably necessary to ensure contract delivery (including to meet milestone delivery dates). If changes are not met the contract may be terminated using contract termination provisions (see Table 3.10).

3.67 Airservices advised the ANAO in January 2025 that it utilised schedule recovery procedures in 2021. On 17 March 2021 Thales notified Airservices of anticipated delays to milestones. Airservices provided written responses on 13 August 2021 and 30 September 2021 detailing its intent to work with Thales to resolve the claim for postponement and update the applicable dates for milestones 12, 13 and 15.⁵⁹ On 17 February 2025 Airservices advised the ANAO that the postponement claim was actioned through the COVID-19 variation in 2021 and the new milestone delivery dates negotiated as part of the revised delivery strategy.⁶⁰

3.68 Airservices also advised that the Project of Concern remediation plan and revised delivery strategy are consistent with schedule recovery procedures, although this is not explicit in the plan or contract variation.

Contract dispute resolution and termination

3.69 The acquisition and support contracts and contract management plan provide advice on dispute resolution and termination, as outlined in Table 3.10. Airservices advised the ANAO on 12 December 2024 that it had not had to use any formal dispute processes in response to Thales’ performance.

Table 3.10: CMATS contract dispute resolution and termination mechanisms

Note a: A ‘default’ occurs when Airservices considers that Thales has failed to commence work under the acquisition contract within 30 days of the effective date, failed to complete any milestone by the relevant milestone date or failed to comply with another obligation to be performed or observed under the acquisition contract.

Source: ANAO analysis of acquisition contract and Airservices documentation.

Were probity risks managed throughout the project?

3.70 The Department of Finance Contract Management Guide states that probity is the evidence of ethical behaviour, defined as demonstrated integrity, uprightness and honesty in a particular process. The guide identifies that, in addition to an overarching contract management plan, entities should consider developing a probity plan that ‘details the mechanisms for assuring probity within the management of the contract’.⁶¹ Probity management includes the identification and management of conflicts of interest, and appropriate handling of gifts and benefits.

Management of probity

CMATS probity plan

3.71 Airservices established the current version of the CMATS program probity plan in February 2018, when the acquisition and support contracts were signed.⁶² The plan has since been updated four times. The current version (effective October 2023) sets out:

• general practices expected from all program officials, for example that program activities are to be conducted in accordance with the relevant protocols, code of conduct and legislation;
• that official information must be accessed, protected and stored in accordance with applicable legislation, and government and Airservices policies and procedures; and
• practices relating to the management of conflicts of interest for the program.

3.72 The probity plan specifies that it applies to ‘program participants’ or persons involved in the OneSKY program. The Airservices CEO and Board have defined roles and responsibilities in relation to the governance of the OneSKY CMATS project — in particular, approval of contract variations. Airservices advised the ANAO on 20 November 2024 that the CEO and Board members are not subject to the conflict-of-interest protocols described in the probity plan such as completing a conflict-of-interest declaration for the OneSKY program. Airservices uses CEO and Board member conflict-of-interest declarations made at an enterprise-wide level to inform their program-specific conflicts (see paragraph 3.80). The probity plan does not reference the use of the enterprise-wide conflict of interest protocols.

OneSKY probity procedures

3.74 Airservices executes the conflict of interest and information access procedures described in the probity plan through an automated task management system in SharePoint.

3.75 When a person commences a position in the program, they complete a probity declaration form in the workflow.⁶³ The form consists of a conflict of interest declaration and a confidentiality acknowledgement. The probity declaration is then sent to the probity officer (the Commercial and Legal Manager or a member of their team) and a member of the OneSKY leadership team for approval.⁶⁴

3.76 The workflow notifies program officials via email annually to refresh their probity declaration and every three years to submit a new probity declaration.⁶⁵ The probity plan sets out that program officials must disclose any changes in their circumstances that relate to their current conflict-of-interest declaration as soon as they arise.

3.77 Airservices has a probity register that captures the details of each program participant and contains a link to each program official’s workflow records, which capture decisions and actions relating to their probity declaration, clearance and portal access such as probity assessment outcome.⁶⁶ As at January 2025, and since the current register was established in 2019, around 900 officials who worked on the program over its life had submitted a probity declaration. Airservices also has a register of conflicts of interest declared by program officials through the probity register. Airservices advised the ANAO on 18 December 2024 that conflicts are recorded in the register manually and are not regularly reconciled with declared conflicts in the probity register.

3.79 Between 2020 and 2024, 24 conflicts were recorded in the conflict register. The ANAO examined a sample of 10 conflicts and found that five had mitigation strategies in place, and for the remaining five Airservices had determined that existing controls were adequate. No rationale was provided in the cases where the probity officer determined that existing controls were adequate; however, they had selected the option on the form to note that ‘no specific control measures are required or portal access changes are required’.

CEO and board declarations

3.80 The CEO and Board members must complete a conflict-of-interest declaration, refresh their conflict of interest declaration annually and ensure their declarations are kept up-to-date to reflect their current personal circumstances. The ANAO reviewed the CEO’s and Board members’ disclosures of personal interest from 2019 to 2024, and none had disclosed a personal interest in Thales.

Gifts, benefits and hospitality

Enterprise-wide documents

3.81 Airservices has established enterprise-wide policies that set out the conduct expected of staff and contractors including in relation to conflicts of interest and gifts, benefits and hospitality (see Table 3.11). Airservices advised the ANAO on 3 December 2024 that it relies on the enterprise-wide finance manual for gifts, benefits and hospitality procedures in relation to the OneSKY program.

Table 3.11: Airservices enterprise-wide probity policies

Note a: The Airservices Code of Conduct replaced the Code of Conduct Management Instruction (August 2019 to May 2020).

Note b: Airservices advised the ANAO in March 2025 that it implements this requirement through the corporate standing disclosures described in paragraph 3.80.

Source: ANAO analysis of Airservices documentation.

3.82 Airservices does not include in its finance manual, procurement manual and contract management procedure:

• a requirement that officials make a notification for offers of gifts, benefits or hospitality that were not accepted;
• a definition of corporate or official hospitality; or
• guidance on disclosure, suitability or management of gifts, benefits or hospitality/meetings at outside venues (such as dinners or lunch meetings at restaurants) with contractors to manage probity risks during contract management.

Gifts, benefits and hospitality procedures

3.83 Airservices advised the ANAO on 21 October 2024 that it has an established a process for managing gifts and benefits to implement the finance manual policy. The executive assistant for each business group records the gifts and benefits received by individuals in their business group that are valued at over $100 (excluding GST). The internal gifts and benefits register is published quarterly after being cleared by the CEO.

3.84 The ANAO has reviewed the gifts and benefits declared in the public register. One entry related to a 14 June 2024 lunch meeting between Thales and the acting Airservices CEO valued at $110.

3.85 The ANAO reviewed Airservices’ email and calendar records relating to engagement with Thales for gifts, benefits and hospitality around key contract variation dates. This review identified 21 instances of Airservices employees in the CMATS program engaging in lunch, dinner and other events with Thales in these periods.

• calendar invitations for drinks, breakfast, lunch or dinner with Thales employees including drinks to celebrate achievements related to the revised delivery strategy and sharing an invitation with other Airservices employees to have lunch to celebrate the ‘closure on the TAAATS EoL extension’;
• offers made from Airservices to Thales employees to have lunch, dinner or dinner and drinks at hospitality venues; and
• dinners for Airservices Board and Thales Board members.

3.86 These records did not show whether the engagements related to official hospitality provided by Airservices that would require approval or that would meet the reporting threshold for corporate hospitality as a gift or benefit according to the finance manual. The Airservices Code of Conduct requires that staff report gifts and benefits where a perceived conflict of interest may exist. Given the significance of the contract to Airservices and the number and frequency of variations, these engagements represent ongoing risk around potential, perceived and actual conflicts.

3.87 Airservices advised the ANAO on 2 March 2025 that the published gifts and benefits register captures all the information contained in its internal register and that it does not have a record of approved provision of hospitality to Thales. Airservices’ gifts and benefits register does not include the hospitality engagements identified.

3.88 The ANAO approached Thales in January 2025 and asked whether it had records of gifts, benefits or hospitality provided to Airservices.⁶⁷ The response from Thales identified 18 instances of the acceptance of a gift, benefit or hospitality by Airservices staff to a total of $3,501 (see Table 3.12). Airservices advised in March and June 2025 that it did not have a record of these 18 instances of accepted gifts, benefits or hospitality from Thales.⁶⁸ In not recording these, Airservices staff may not have complied with the Airservices Code of Conduct requirement that they declare gifts or benefits where a perceived conflict of interest exists.

Table 3.12: Gifts accepted by Airservices staff, as advised by Thales

Source: ANAO analysis of Thales’ gifts and benefits register.

Appendix 1 Entity responses

Airservices Australia

ANAO note: See footnote 3 for explanation of Report Preparation Papers prepared as part of the performance audit process.

Department of Defence

Appendix 2 Improvements observed by the ANAO

1. The existence of independent external audit, and the accompanying potential for scrutiny improves performance. Improvements in administrative and management practices usually occur: in anticipation of ANAO audit activity; during an audit engagement; as interim findings are made; and/or after the audit has been completed and formal findings are communicated.

2. The Joint Committee of Public Accounts and Audit (JCPAA) has encouraged the ANAO to consider ways in which the ANAO could capture and describe some of these impacts. The ANAO’s corporate plan states that the ANAO’s annual performance statements will provide a narrative that will consider, amongst other matters, analysis of key improvements made by entities during a performance audit process based on information included in tabled performance audit reports.

3. Performance audits involve close engagement between the ANAO and the audited entity as well as other stakeholders involved in the program or activity being audited. Throughout the audit engagement, the ANAO outlines to the entity the preliminary audit findings, conclusions and potential audit recommendations. This ensures that final recommendations are appropriately targeted and encourages entities to take early remedial action on any identified matters during the course of an audit. Remedial actions entities may take during the audit include:

• strengthening governance arrangements;
• introducing or revising policies, strategies, guidelines or administrative processes; and
• initiating reviews or investigations.

4. In the course of finalising the audit Airservices Australia (Airservices) advised the ANAO that it had:

• updated the Contract Management Plan (for example see paragraphs 2.21, 2.36 and 3.63);
• updated the Evaluation Report template for contract variations (see from paragraph 3.21); and
• commenced a working group to progress the ledger system that is intended to capture matters impacting the performance of the contract (see paragraph 3.55).

5. The ANAO has not sought to obtain assurance over these actions or whether they have been appropriately implemented.

Appendix 3 OneSKY governance forums and responsibilities

Note a: The Board Technology Investment Committee was renamed the Board Technology Committee on 14 November 2023.

Note b: Since 2019 the Change Control Board has sat as a joint board with members comprising Airservices and Defence representatives. Prior to that the OneSKY Change Control Board sat separately to consider contract variations that related to Airservices only and the Joint Change Control Board for those that affected Defence.

Source: ANAO analysis of Airservices documentation and records.