Audit snapshot

Why did we do this audit?

  • The OneSKY program aims to build and operate a joint civil–military air traffic management system (CMATS) and is a major investment for Airservices Australia (Airservices).
  • The ANAO has conducted three audits into the procurement related to CMATS, the most recent in 2019.
  • This audit provides assurance to Parliament on the effectiveness of Airservices’ contract management for CMATS.

Key facts

  • In February 2018 Airservices entered into contracts for the delivery and support of CMATS with Thales Australia Limited (Thales) and an on-supply agreement with the Department of Defence (Defence). As at 31 December 2024, the contracts with Thales have been varied 47 times.
  • In December 2023 Airservices, Defence and Thales negotiated a revised delivery strategy and implementation dates.

What did we find?

  • Airservices’ contract management of the OneSKY program has been partly effective.
  • Airservices’ governance arrangements to support contract management are partly effective.
  • Airservices’ management of the contract has been partly effective.

What did we recommend?

  • The ANAO made five recommendations to Airservices relating to its contract management plan, risk management, documentation of contract variation value-for-money assessments, performance management, and guidance and practice for accepting gifts, benefits and hospitality.
  • Airservices agreed to four recommendations and partly agreed to one.

$1.2 bn

(AUD equivalent)
paid to Thales for CMATS as at February 2025

$160 m

(AUD equivalent)
in acquisition contract variations executed between February 2018 and December 2024

4½ years

added to project schedule between February 2018 and December 2024

Summary and recommendations

Background

1. Airservices Australia (Airservices) is established under the Air Services Act 1995 to provide air traffic control and other related services to the aviation industry in Australian-administered airspace. The Department of Defence (Defence) provides air traffic management to military aviation in Australia, including at Defence airfields that operate with shared military and civil use.

2. The OneSKY program aims to build and operate a joint civil–military air traffic management system. The program includes the design and delivery of the new Civil Military Air Traffic Management System (CMATS) plus supporting infrastructure for Airservices and Defence. Airservices is the lead agency delivering the CMATS program in collaboration with Defence.

3. In February 2018 Airservices entered into separate acquisition and support contracts with Thales Australia Limited (Thales) and an on-supply agreement with Defence.

Rationale for undertaking the audit

4. Passengers in Australian airspace rely on Airservices to provide critical air traffic control infrastructure safely and efficiently. The OneSKY program is a major change for Airservices, and CMATS is a core component of the program. Airservices has contracted Thales to develop and support CMATS. The ANAO has previously undertaken three performance audits on the procurements for CMATS, the most recent in 2019.1 Procurement and contract management of large-scale IT projects involve elevated risks. The audit provides assurance to Parliament on whether Airservices is managing the contract for CMATS effectively.

Audit objective and criteria

5. The objective of the audit was to assess the effectiveness of Airservices’ contract management for the OneSKY program.

6. To form a conclusion against the audit objective, the audit team applied the following high-level criteria:

  • Has Airservices developed appropriate governance arrangements to support contract management?
  • Has Airservices managed the contract effectively to achieve value for money?

Conclusion

7. Airservices’ contract management of the OneSKY program is partly effective. It has governance processes in place and has developed procedures to manage the contract. Shortcomings in contract management planning, performance management and probity have limited its effectiveness in managing the contract to minimise cost increases and schedule delays.

8. Airservices has implemented partly appropriate contract management governance arrangements. A contract management plan is in place; however, arrangements did not sufficiently cover provider performance, program risk and probity issues. Risk processes did not completely capture interdependencies between contract management and program risks. An on-supply agreement formalised arrangements between Airservices and the Defence for the delivery of CMATS. It relies on effective collaboration and governance forums for issues escalation. The Defence component of CMATS was declared a Project of Concern in October 2022 outside of the formal governance forums.

9. Airservices is partly effective in managing the contract to achieve value for money. It has a process to manage variations; however, a high number of variations to date have resulted in cost increases and schedule extensions, and the rationale for its value-for-money assessment was not consistently documented when seeking approval. The incentive-based pricing model agreed in the contract between Airservices and Thales has not been fully effective in containing costs, with the target price expected to be met. Airservices’ supplier performance management is not fully developed or utilised. Airservices applies enterprise-wide probity procedures for conflicts of interest and gifts and benefits, but staff did not always follow these.

Supporting findings

Contract management governance

10. Airservices has developed a OneSKY contract management plan. The plan covers elements set out in the Airservices contract management procedure, such as roles and responsibilities, governance arrangements and the variation process. It does not cover contract management risk or probity for CMATS, and does not reference the CMATS risk management plan or probity plan. The contract management plan does not sufficiently cover contractual performance management. The OneSKY program has 12 governance forums that are intended to provide direction and oversight. The OneSKY Strategic Relationship Forum has never met and in October 2022 CMATS was declared a Project of Concern. (See paragraphs 2.3 to 2.21)

11. Airservices applies the OneSKY program risk management process to contract management risks. It has risk management plans and documentation to identify and monitor contract risks; however, controls and treatments are not fully effective and contract management risks have been realised throughout the project. The interdependency between contract management risks (including Thales’ performance) and risk to overall program delivery and objectives is not fully captured — for example, through documentation of specific contract management actions and levers to ensure program-wide deliverables are achieved. (See paragraphs 2.22 to 2.39)

12. The on-supply agreement formalised the relationship between Airservices and Defence for the delivery of CMATS and has been varied 10 times. It covers collaboration between the two entities and governance forums, but does not provide for escalation if issues cannot be resolved within these mechanisms. In August 2021 Defence escalated its concerns about the project to ministerial level and in October 2022 the Minister for Defence Industry declared CMATS a Project of Concern. The Minister for Defence Industry has since held six meetings with principal stakeholders to address project underperformance. These have resulted in the development of a remediation plan to address program-wide issues. As at February 2025 CMATS remains on the Project of Concern list, with exit criteria formulated to demonstrate delivery of Defence capability. The exit criteria are not expected to be met before 2027. (See paragraphs 2.40 to 2.62)

Achievement of value for money

13. The combined impact of 44 variations as at 31 December 2024 has seen the cost of the acquisition contract increased by $160 million (AUD equivalent) and the delivery date extended by 53 months (four-and-a-half years). Airservices has a process in place to support the development and assessment of contract variations. Briefs to the approval delegate did not completely document how the various elements (technical need, risk and cost) collectively justified the value-for-money assessment or the effect of incremental change on the overall contract value for money. (See paragraphs 3.2 to 3.28)

14. The acquisition contract operates under an incentive arrangement where Airservices and Thales share costs and savings. Under the contract agreed in February 2018, Airservices reimburses Thales for actual costs incurred for works performed up to the ceiling cost. Since December 2023 the arrangement has focused on payments based on milestones. Airservices has mechanisms in place to monitor Thales’ performance, but it does not fully utilise these. In February 2024 program-level key performance indicators were introduced as part of Project of Concern remedial action but these do not provide associated consequences for supplier underperformance where relevant. (See paragraphs 3.29 to 3.69)

15. Airservices has procedures for probity management. Airservices utilises enterprise-wide conflict of interest procedures and gifts, benefits and hospitality acceptance procedures, but these are not reflected in OneSKY probity plans. Airservices staff accepted and did not declare gifts, benefits or hospitality, indicating limited compliance with Airservices’ code of conduct requirements and procedures on perceived and actual conflicts. (See paragraphs 3.70 to 3.88)

Recommendations

Recommendation no. 1

Paragraph 2.20

Airservices Australia update the contract management plan to:

  1. include how contract management risks and probity are managed;
  2. provide sufficient guidance on the performance management approach; and
  3. incorporate additional oversight and periodic contract reviews to ensure contract deliverables remain on track and commercial arrangements are fit for purpose.

Airservices Australia response: Agreed.

Recommendation no. 2

Paragraph 2.35

Airservices Australia identify and document how contract management risk connects to risk at the program level and when specific contract management action could be used to mitigate and improve control of program risks.

Airservices Australia response: Agreed.

Recommendation no. 3

Paragraph 3.21

Airservices Australia, when assessing contract variations:

  1. record the rationale in approval documentation explaining its value-for-money assessment, including against the overall contract cost and program delivery objectives; and
  2. identify thresholds for when the impact of incremental change warrants a more significant value-for-money assessment or new procurement rather than varying the current contract.

Airservices Australia response: Partially agreed.

Recommendation no. 4

Paragraph 3.62

Airservices Australia identify which program key performance indicators relate to contract management and link the results of these to contract management actions to better ensure Thales’ accountability in delivering under the contract.

Airservices Australia response: Agreed.

Recommendation no. 5

Paragraph 3.89

Airservices Australia strengthen guidance, education and process around accepting gifts, benefits and hospitality during contract management to address probity risks.

Airservices Australia response: Agreed.

Summary of entity responses

16. The proposed audit report was provided to Airservices and Defence. An extract was provided to Thales. Airservices’ and Defence’s summary responses are provided below and their full responses are provided at Appendix 1.2

Airservices Australia

Airservices acknowledges the report’s findings and appreciates its thorough analysis. While some findings do not fully align with the recommendations, the latter primarily focus on documentation improvements rather than significant deficiencies in existing practices. There are substantial differences between the previously shared report preparation paper (RPP) and the S19 proposed report, specifically noting that the newly added ‘Conclusion’ section presents a more negative view than the broader findings suggest.3 It is pertinent to note Airservices has swiftly implemented corrective actions, addressing all recommendations reflecting its commitment to the OneSKY program and national airspace management harmonization.

Key responses to the recommendations include updating the OneSKY Program Contract Management Plan to enhance guidance on risk management, performance monitoring, and periodic contract reviews. Contract management risks have been integrated into the broader program risk framework, while the Evaluation Report Template has been refined to further clarify value-for-money assessments. The in-practice structured set of approved KPIs have also been linked with contract management plan for cross-reference, and a new procedure has been introduced to strengthen probity awareness regarding hospitality, gifts, and benefits.

These promptly implemented actions demonstrate Airservices’ dedication to continuous improvement in successfully delivering the complex OneSKY program.

Department of Defence

Defence welcomes the ANAO Audit Report into the Management of the OneSKY contract and acknowledges the findings. Defence notes the five recommendations contained in the audit report relate to Airservices Australia’s (Airservices) contract management processes.

Defence is committed to strengthening and standardising processes and controls for contract management. Whilst the audit recommendations are against Airservices’ processes, as part of the collaboration between Airservices and Defence on the OneSKY Program, Defence will work with Airservices and assist, where required and appropriate, to apply the audit recommendations.

Key messages from this audit for all Australian Government entities

17. Below is a summary of key messages, including instances of good practice, which have been identified in this audit and may be relevant for the operations of other Australian Government entities.

Group title

Contract management

Key learning reference
  • Entities should consider the approach to value-for-money assessment for contract variations where there is incremental change.
  • Entities should develop robust frameworks for contract management following procurement. This includes establishing governance structures to actively drive contract management outcomes. Entities outsourcing program delivery should consider and mitigate risks in long-term contract management, particularly with respect to conflicts of interest and performance management.
  • Entities should identify contract key performance indicators and associated contract management actions to monitor and address underperformance.

1. Background

Introduction

1.1 Airservices Australia (Airservices) is established under the Air Services Act 1995 (Airservices Act) to provide air traffic control and other related services to the aviation industry in Australian-administered airspace — 11 per cent of world airspace. Airservices is responsible for the safe and orderly flow of aircraft carrying 150 million passengers a year. Airservices’ functions include:

  • providing facilities and services such as air traffic control, aeronautical information, aviation communication and aviation rescue firefighting services;
  • promoting and fostering civil aviation;
  • carrying out activities to protect the environment from the effects of aircraft operations;
  • cooperating with the Australian Transport Safety Bureau; and
  • other general functions such as those required by regulation under the Air Navigation Act 1920 and the Aviation Transport Security Act 2004.

1.2 Under the Airservices Act, Airservices must prioritise safety in carrying out these functions.

1.3 Airservices is a corporate Commonwealth entity under the Public Governance, Performance and Accountability Act 2023 (PGPA Act) and is in the Infrastructure portfolio.4 The Airservices Board is the governing body and accountable authority under the PGPA Act.5 The Chief Executive Officer (CEO) is responsible for the management of Airservices under direction from the Airservices Board.

1.4 Airservices is funded through revenue from industry (charges to aircraft operators for en-route air traffic control services, terminal navigation, and aviation and rescue firefighting services) and borrowing from debt markets. Airservices’ prices are regulated by the Australian Competition and Consumer Commission (ACCC).6

1.5 Airservices is delivering a significant change program and OneSKY is a key part of this. Airservices advised the ANAO in May 2025 that the OneSKY program currently represents one third of its capital investment program.

1.6 The Department of Defence (Defence) provides air traffic management to military and civil aviation in Australia, including at Defence and joint user airfields that operate with shared military and civil use. Defence is a non-corporate Commonwealth entity under the PGPA Act.

OneSKY program

1.7 The OneSKY program aims to build and operate a joint civil–military air traffic management system.7 The program includes the design and delivery of the new Civil Military Air Traffic Management System (CMATS) as well as supporting infrastructure for Airservices and Defence. Airservices is the lead agency for CMATS, being delivered under the OneSKY Program, in collaboration with Defence.

1.8 Figure 1.1 sets out the relationship between the OneSKY program, CMATS and AIR5431 Phase 3 (the related Defence project), and shows the work packages (as at January 2025) established by Airservices and Defence to support the implementation of the program.

Figure 1.1: OneSKY program, CMATS and Defence project relationship

A venn diagram that shows the overlap of the Civil Military Air Traffic Management System (CMATS) program between the OneSKY program managed by Airservicves and the AIR5431 Phase 3 project managed by Defence.

Source: Airservices documentation.

Civil Military Air Traffic Management System

1.9 CMATS is the IT system that, once operational, will support air traffic services at specific Airservices and Defence sites.8 CMATS will replace the currently independent civil and military IT systems, both of which had been due to reach their nominal end of life in 20159:

  • civil air traffic control system — the Australian Advanced Air Traffic System (TAAATS) — built and supported by Thales Australia Limited (Thales); and
  • military air traffic control system — the Australian Defence Air Traffic System (ADATS) — built and supported by Raytheon.

1.10 CMATS is being delivered through two contracts with Thales:

  • the supply of system capability through the acquisition contract (to develop and provide the CMATS hardware and software); and
  • the ongoing sustainment of CMATS through the support contract (to provide support services to CMATS once operational).

1.11 As the lead agency, Airservices entered into the contracts with Thales and manages the CMATS program and contracts. Airservices will on-supply to Defence the system and support for CMATS delivered by Thales. Airservices and Defence have entered into an on-supply agreement to govern these arrangements. Table 1.1 sets out the primary arrangements to support the delivery of CMATS.10

Table 1.1: Summary of primary arrangements for CMATS delivery

Title

Parties

Start date

End date

Description

Contract (Acquisition)

Airservices and Thales

February 2018

Based on final acceptance as outlined in the contracta

The contract covers the delivery of CMATS including design, development, integration, testing and installation. It establishes scope of requirements and supporting contractual arrangements. It includes attachments that provide additional detail on key parts of the contract.

Contract (Support)

February 2018

Initial term of seven years from operative date.b Three options for five-year extensions are available

The contract covers the services to enable CMATS to operate such as maintenance. It includes other support arrangements such as updates and contractual elements like pricing/payments.

On-supply agreement

Airservices and Defence

February 2018

Termination or expiry of the support contract

Agreement covers the on-supply of CMATS to Defence. It includes governance arrangements, scope of services being provided and payments.

Air Traffic Management System Commonwealth Collateral Deed

Airservices, Defence and Thales

February 2018

Expiry of the support contract

Noting that Defence is not a party to the acquisition or support contract, the deed creates a contractual relationship between the three parties and sets out obligations and rights of the parties relating to Defence deliverables under the CMATS contracts.

         

Note a: The acquisition contract also has provisions that extend past the end of the contract covering intellectual property and the right of Airservices to recover money.

Note b: The operative date is the first handover from Thales.

Source: ANAO analysis of Airservices documentation.

CMATS project delays and revised delivery strategy

1.12 When Airservices and Thales entered into two contracts in February 2018, CMATS was to be delivered in three phases:

  • release zero — initial minimum software functionality at Defence sites operational in mid-2022;
  • release one — minimum functionality at Airservices sites operational in 2024; and
  • release two — full scope of CMATS ready for deployment by February 2025, with final acceptance by August 2025.

1.13 The project has experienced delays. In 2019 the first CMATS design milestone was completed, which found engineering design deficiencies that were expected to be addressed prior to the next design milestone — the critical design review. In 2020 the critical design review milestone was partially completed and found a series of significant defects and omissions. In 2022 Thales began experiencing technical integration issues. Airservices conducted integrated baseline reviews in July 2018, March 2020 and February 2023.11

1.14 In October 2022 the Minister for Defence Industry declared the Defence project for CMATS (Project AIR5431 Phase 3) a Project of Concern due to cost, schedule and technical issues. In December 2022 Airservices, Defence and Thales agreed on remediation goals and in March 2023 on a remediation plan and actions, including to jointly examine opportunities to revise the delivery strategy and schedule.

Standstill deed, settlement deed and contract variation

1.15 In July 2023 Airservices, Defence and Thales entered into a ‘standstill deed’ to pause and preserve certain rights under the contracts (such as maintaining some aspects of Thales’ work) while they negotiated a revised delivery strategy. In December 2023, Airservices and Thales resolved the standstill deed when they executed:

  • a settlement deed — closing and giving effect to the agreements negotiated during the standstill period and providing the basis for a revised delivery strategy; and
  • a contract variation to implement the revised delivery strategy.

1.16 The contract variation made changes to the acquisition contract by updating:

  • delivery sequence from release zero, release one and release two to remove release zero from the sequence and prioritise delivery to Airservices sites followed by Defence sites12;
  • milestone delivery dates; and
  • the payment structure to give greater weight to milestone payments.

1.17 On 1 March 2024 Defence and Airservices executed a corresponding variation to the on-supply agreement. Figure 1.2 shows key dates for the negotiation of the revised delivery strategy.

Figure 1.2: Timeline of key events for the negotiation of the revised delivery strategy

A timeline that demonstrates the key events in the negotiation of the revised delivery strategy between signing of the acquisition contract in February 2018 and expiry of the settlement deed in December 2024.

Note a: The functional baseline is the agreed functionality and performance of the CMATS system.

Source: ANAO analysis of Airservices documentation.

1.18 As at January 2025, release one (Airservices capability) is due for system acceptance in June 2028, release two (full CMATS capability) in August 2029 and final acceptance in February 2030. Table 1.2 shows the key system acceptance dates at contract signing in February 2018 compared with January 2025.

Table 1.2: Contract delivery schedule for key milestones

Milestone

Original contract — February 2018

As at January 2025

Release zero

August 2022

Milestone removed as part of contract variation for revised delivery strategy in December 2023 (see paragraph 1.16)

Release one

July 2024

June 2028

Release two

February 2025

August 2029

Final acceptance

August 2025

February 2030

     

Source: ANAO analysis of acquisition contract and variations.

1.19 As at 31 December 2024, since February 2018 the acquisition contact has been varied 44 times and the support contract three times. The current acquisition contract target price is $1.365 billion (AUD equivalent) and ceiling price $1.465 billion (AUD equivalent) (see Figure 1.3).13

Figure 1.3: Acquisition contract payments and impact of variations

A bar graph that includes two columns to show the increase in the target and ceiling price from $1.205 and $1.305 billion in February 2018 to $1.365 and $1.465 billion in February 2025. A dotted line represents the $1.189 billion which has been paid to Thales up to February 2025.

Note: As at 31 December 2024 acquisition contract variations had increased target and ceiling prices by $160 million.

Source: ANAO analysis of Airservices documentation and contract variation deeds of execution.

Previous ANAO audits

1.20 The procurement for CMATS was conducted through a phased approach. In June 2013 Airservices issued a request for tender and proceeded through tender evaluation phases. In September 2014 Airservices selected Thales as the successful tenderer, and protracted negotiations followed. Thales submitted offers in October and December 2014, which expired in October 2015. In June 2016 and September 2017 Thales submitted further offers. Airservices and Thales then further negotiated scope, price and commercial terms — ultimately agreeing on important changes after Airservices had selected the successful tenderer. In 2017 and 2019 the ANAO audited the tender evaluations and contract negotiations. The 2019 ANAO report found that Airservices had established an appropriate governance framework to evaluate contract value for money and assessment of Thales’ 2016 offer was appropriate (which was rejected for not providing value for money) but there were shortcomings in the application of the governance arrangements for the final (accepted) offer in September 2017 (see footnote 1).

Rationale for undertaking the audit

1.21 Passengers in Australian airspace rely on Airservices to provide critical air traffic control infrastructure safely and efficiently. The OneSKY program is a major change for Airservices, and CMATS is a core component of the program. Airservices has contracted Thales to develop and support CMATS. The ANAO has previously undertaken three performance audits on the procurements for CMATS, the most recent in 2019. Procurement and contract management of large-scale IT projects involve elevated risks. The audit provides assurance to the Parliament on whether Airservices is managing the contract for CMATS effectively.

Audit approach

Audit objective, criteria and scope

1.22 The objective of the audit was to assess the effectiveness of Airservices’ contract management for the OneSKY program.

1.23 To form a conclusion against the audit objective, the audit team applied the following high-level criteria:

  • Has Airservices developed appropriate governance arrangements to support contract management?
  • Has Airservices managed the contract effectively to achieve value for money?

Audit methodology

1.24 The audit methodology involved:

  • reviewing Airservices’ procurement and contract management frameworks and governance;
  • examining project and contract documentation — for example, contract management plans, contract variations, and risk management plans and registers;
  • reviewing internal and external reporting on CMATS; and
  • meetings with Airservices, Defence and Department of Infrastructure, Transport, Regional Development, Communications, Sports and the Arts staff.

1.25 The audit was conducted in accordance with ANAO Auditing Standards at a cost to the ANAO of approximately $716,213.

1.26 The team members for this audit were Jane Wiles, Thea Ingold, Caitlin Williams, Maggie Lee, Renina Boyd, Anne Rainger and Michelle Page.

2. Governance arrangements

Areas examined

This chapter examines whether Airservices Australia (Airservices) had appropriate governance arrangements in place to support contract management.

Conclusion

Airservices has implemented partly appropriate contract management governance arrangements. A contract management plan is in place; however, arrangements did not sufficiently cover provider performance, program risk and probity issues. Risk process did not completely capture interdependencies between contract management and program risks. An on-supply agreement formalised arrangements between Airservices and the Department of Defence (Defence) for the delivery of the Civil Military Air Traffic Management System (CMATS). It relies on effective collaboration and governance forums for issues escalation. The Defence component of CMATS was declared a Project of Concern in October 2022 outside of formal governance forums.

Areas for improvement

The ANAO made two recommendations: that Airservices update the OneSKY CMATS contract management plan and contract review mechanisms; and that Airservices identify and document where contract management actions could mitigate overall program delivery risks.

2.1 As a corporate Commonwealth entity, Airservices is not required to comply with the Commonwealth Procurement Rules.14 Airservices has developed its own procurement and contract management policies and procedures to assist it to meet its general obligations under the Public Governance, Performance and Accountability Act 2013 (PGPA Act) to promote the proper use and management of public resources.

2.2 Sound contract management frameworks, governance and risk management help ensure intended contractual benefits are realised and value-for-money outcomes achieved. A fit-for-purpose contract management plan enables the customer/purchaser to hold the contractor to account. The plan should enable the customer/purchaser to identify performance issues, provide levers to manage performance and set out how and when such levers should be used.

Has Airservices developed a fit-for-purpose contract management plan and supporting governance?

Airservices has developed a OneSKY contract management plan. The plan covers elements set out in the Airservices contract management procedure, such as roles and responsibilities, governance arrangements and the variation process. It does not cover contract management risk or probity for CMATS, and does not reference the CMATS risk management plan or probity plan. The contract management plan does not sufficiently cover contractual performance management. The OneSKY program has 12 governance forums that are intended to provide direction and oversight. The OneSKY Strategic Relationship Forum has never met and in October 2022 CMATS was declared a Project of Concern.

Enterprise-wide contract management procedure

2.3 Airservices has an enterprise-wide contract management procedure. Its purpose is to ‘set out the minimum requirements and processes for the management of all contracts entered into by Airservices’. It establishes:

  • a contract management plan is required for contracts that have a high impact on Airservices’ core business;
  • that the structure of a contract management plan can vary depending on the contract management approach and complexity of the contract; and
  • the mandatory requirements for a contract management plan.

OneSKY contract management plan

2.4 In November 2018 the OneSKY Program Executive approved the first OneSKY contract management plan.15 This was seven months after Airservices and Thales signed the acquisition and support contracts. Airservices advised the ANAO in October 2024 that the delay was due to workloads of key staff at the time and the need to analyse and extract the obligations of each contract to include in the plan.

2.5 The contract management plan states that it will be reviewed annually. A second version of the contract management plan was approved in April 2021 and a third version in October 2024.16 Airservices advised the ANAO in October 2024 that informal reviews of the contract management plan had occurred with updates released formally when necessary.

2.6 The purpose of the contract management plan is to describe how Airservices will govern, manage and administer all OneSKY contracts, including the CMATS acquisition and support contracts. Table 2.1 summarises the main components of the contract management plan applying to the CMATS acquisition and support contracts.

Table 2.1: Contract management plan key components

Component

Summary

Roles and responsibilities

The plan outlines the key personnel and program governance forum responsibilities. See paragraphs 2.9 and 2.10 for description of roles and responsibilities.

Risk

Airservices has a separate risk management plan, and program and project risk registers for OneSKY (see paragraph 2.23). The contract management plan does not reference the risk management plan to capture how CMATS contract management risks are managed.

Probity

The plan identifies Commercial and Legal Team as responsible for implementing commercial and legal frameworks including probity in the CMATS program.

Airservices has a separate OneSKY CMATS probity plan. The contract management plan does not reference the probity plan.

Performance

The plan outlines the role of the Program Review Board and use of the ledger system, schedule, pricing models, contract remedies and meetings between Airservices, Defence and Thales (for example, contractor performance reviews). See paragraph 3.51.

Milestones

The plan sets out a schedule of key contract milestones. The first version of the contract management plan (2018) provided dates associated with these milestones. Dates were removed from subsequent versions.a

Payments

The plan includes a summary of the CMATS payment structure and provides a glossary of key pricing terms (for example, actual costs, ceiling price and target price). It provides that the Finance and Procurement Team are responsible for payments.

Variations

The plan lists key controls over the contract variation process. It describes the variation process in brief and references the OneSKY CMATS Program Technology Change Management Plan for more detail. Previous versions (2021 and 2018) described the variation process in full.

Relationship management

The plan describes relevant governance forums, communication protocols (for example, use of an authorised repository to share formal documentation and official communication through letters) and dispute resolution.b The plan also covers the relationship with Defence, including through the on-supply agreement, governance forums and financial management.

Contract remedies

The plan lists some of the acquisition contract clauses relating to remediation activities.

   

Note a: The acquisition contract includes the delivery milestone dates.

Note b: A separate OneSKY stakeholder management plan covers OneSKY stakeholders including Defence, suppliers, airline customers, regulators and internal business groups. The plan states that engagement with suppliers is conducted in ‘accordance with the governance arrangements set out in respective contracts and agreements’.

Source: ANAO analysis of Airservices documentation.

2.7 The contract management plan includes a range of information consistent with the Airservices enterprise-wide contract management procedure. It does not address how contract management risks for the CMATS contracts are managed through the OneSKY program risk management process (see paragraphs 2.23 to 2.34) or how probity is intended to be managed through the OneSKY probity management plan or enterprise-wide policies and procedures (see paragraph 3.71).

2.8 The contract management plan briefly covers performance. It does not include a comprehensive description of a coordinated approach to contract performance management, monitoring and reporting, or when to use certain levers if underperformance occurs and how these relate to contract remedies. It does not list all remediation activities available under the contract — for example, postponement or schedule recovery (see paragraph 3.65 to 3.66).

Contract management roles and responsibilities

2.9 The Program Executive reports to the Chief Executive Officer (CEO) and is the Airservices executive responsible for strategic oversight of the OneSKY program. As at March 2025, this is the Airservices Deputy CEO.17

2.10 The contract management plan sets out other contract management roles:

  • Head of Transformation OneSKY/OneSKY Portfolio Lead — senior responsible officer for the overarching OneSKY program and co-chair of the CMATS Review Group (see Appendix 3). The Head of Transformation — OneSKY position was created following the Project of Concern remediation, when the former Program Director function was split.
  • Joint Program Director (also called Joint Program Lead) — senior manager responsible for the day-to-day management and delivery of the CMATS program. Also responsible for all joint Airservices–Defence program activities. As at February 2025, the Joint Program Director is also the ‘customer representative’, who represents Airservices with Thales on contract matters. The contract management plan states that the customer representative is ‘responsible for the full administration of the contract’.
  • Commercial and Legal Manager — manager ‘accountable for the implementation and maintenance of an effective commercial and legal framework’ including the development of contracting frameworks and ensuring OneSKY contracts are updated with contract variations. The contract management plan states that ‘in addition to the Customer Representative’ the Commercial and Legal Manager is ‘responsible for the management of the project contracts’.
  • Finance and Procurement Team — responsible for all OneSKY contract-specific finance and procurement for the program.

OneSKY CMATS governance forums

2.11 As at January 2025, the OneSKY program has 12 governance forums, split into three streams based on membership: Airservices specific; joint Airservices and Defence; and tri-party Airservices, Defence and Thales (see Figure 2.1). OneSKY CMATS program and contract documentation (for example, the acquisition contract, contract management plan and on-supply agreement) outlines the governance arrangements, membership and meeting frequency for these forums. Ten of the 12 governance forums have terms of reference outlining roles and functions (see Appendix 3).18

Figure 2.1: OneSKY governance forums

A diagram that displays the 12 program governance forums according to whether the membership is Airservices specific, Joint (Airservices and Defence) or CMATS wide (Airservices, Defence and Thales). The forums are also divided according to the level of forum membership and its focus across program level, executive level and strategic level. The diagram includes the name of each governance forum and how often the forums meet.

Note: Prior to March 2024 the Air Navigation Service Providers Strategic Forum was known as the Joint Strategic Forum and the Air Navigation Service Providers Steering Committee as the Joint Executive Committee.

Source: ANAO analysis of Airservices documentation.

2.12 In October 2022, Defence project AIR5431 Phase 3 was declared a Project of Concern, outside the formal program governance arrangements (see paragraph 2.50). Prior to this the project had experienced delays and cost increases, and governance forums discussed these issues. At the August 2021 CMATS Executive Committee meeting, Defence indicated that project delays had exceeded Defence’s tolerance and that it intended to escalate the project to ministerial level. Airservices supported this intervention.

2.13 In September 2022 Airservices and Defence engaged Mr Andrew Pyke to review the efficiency and effectiveness of the governance arrangements supporting the on-supply agreement.19 The report (finalised December 2022 and submitted to the Joint Executive Committee) listed opportunities for improvement, including by clarifying lead agency arrangements and revising the escalation of issues within the governance framework.20

2.14 In March 2023 Airservices, Defence and Thales agreed on actions as part of the Project of Concern remediation plan to review OneSKY governance arrangements (see paragraphs 2.55 to 2.56). The action items included pursuing opportunities to maximise efficiencies and strengthen governance, ‘taking into account the recommendations from the 2022 Governance Review’.

2.15 Following these reviews OneSKY program governance was changed and an additional CMATS Steering Committee governance forum established — with Airservices, Defence and Thales SES Band 2/2-star military equivalent representatives (see Appendix 3). Airservices advised the ANAO on 20 January 2025 that other changes made in response to these governance reviews included updating Air Navigation Service Providers strategic documentation and the ‘active and regular participation of Defence Executives in governance forum/s with Thales’.21

2.16 The ANAO reviewed a sample of 55 papers and minutes across the forums from between February 2023 and October 2024 plus whenever a contract variation went to the Board Technology Committee and Airservices Board.22 Project updates, risks, schedule and issues were consistently discussed. The forums discussed contract management issues as part of broader program delivery and focused on what was occurring in the project at the time (for example, the Project of Concern remediation plan and subsequent actions; see paragraphs 2.49 to 2.58).

2.17 The OneSKY Strategic Relationship Forum membership comprises the Airservices, Defence and Thales accountable authorities and has not met despite the requirement to meet in ‘extraordinary circumstances’.

Contract reviews

2.18 Airservices’ enterprise-wide contract management procedure provides that Airservices must review:

  • contract effectiveness annually, including by comparing existing and alternative suppliers and testing to ensure the contract remains on track to realise benefits; and
  • contracts covering a period of more than seven years periodically to ensure value for money is maintained.

2.19 Airservices has not conducted a dedicated review of contract management practice or the suitability of the acquisition contract outside the value-for-money assessment of the December 2023 contract variation to support the revised delivery strategy (see paragraphs 3.25 to 3.27).

Recommendation no.1

2.20 Airservices Australia update the contract management plan to:

  1. include how contract management risks and probity are managed;
  2. provide sufficient guidance on the performance management approach; and
  3. incorporate additional oversight and periodic contract reviews to ensure contract deliverables remain on track and commercial arrangements are fit for purpose.

Airservices Australia response: Agreed.

2.21 The OneSKY Program Contract Management Plan has been updated to:

  1. provide additional guidance on the management of contract management risks and probity (including references to the OneSKY Risk Management Plan and OneSKY CMATS Probity Requirements document)
  2. provide additional guidance on the performance management approach
  3. incorporate additional periodic contract reviews.

Are appropriate processes in place to monitor contract management risks?

Airservices applies the OneSKY program risk management process to contract management risks. It has risk management plans and documentation to identify and monitor contract risks; however, controls and treatments are not fully effective and contract management risks have been realised throughout the project. The interdependency between contract management risks (including Thales’ performance) and risk to overall program delivery and objectives is not fully captured — for example, through documentation of specific contract management actions and levers to ensure program-wide deliverables are achieved.

Risk management documentation

2.22 Airservices has enterprise-wide risk management frameworks and processes including a risk appetite statement; a governance, risk and compliance policy; a governance, risk and compliance framework; a risk management standard; a risk management procedure; and an IT system for documenting enterprise-wide risk known as the Corporate Integrated Reporting and Risk Information System (CIRRIS).

2.23 Airservices has established risk management documentation and artefacts specific to the OneSKY program.

  • Risk management plan — describes the risk management process, procedures and roles and responsibilities in relation to risk management for the program.23 The plan broadly aligns with the risk management processes described in Airservices’ enterprise-wide documents. Three risk assessment tools described in the OneSKY risk management plan have been tailored for the OneSKY program.
  • Program risk register — captures program-level risks to the OneSKY program.24 The register contains fields to record information on the individual risk identity (description, context, and causes or threats), risk assessment outcomes and other operational information on the risk such as risk owner, risk trend, last and next risk review date and risk status.
  • Project risk register — records project-level risks. The project risk register contains fields to record individual risk identity, risk assessment outcomes and other operational information.

Risk identification, assessment and monitoring

2.24 The OneSKY CMATS risk management plan categorises risk as:

  • tier 1 — enterprise-wide;
  • tier 2 — program-level; and
  • tier 3 — project-level.

2.25 As at February 2025, Airservices has an enterprise risk in CIRRIS, rated medium, for the OneSKY program: ‘the OneSKY program not being delivered and benefits enabled on time and within budget’.25 One cause of the risk identified is ineffective OneSKY CMATS commercial or contract framework management (see paragraph 2.28). Airservices noted in CIRRIS that controls and treatments are in place to mitigate this enterprise-wide risk and that these cover ‘oversight of scheduling and additional assurance activities including, corrective actions as part of Project of Concern mitigations’.26

2.26 The OneSKY program and project risk registers also capture tier 2 and tier 3 risks. Risks rated high and medium for the program relate to system security, schedule delays, eroded program benefits, Thales’ and Airservices’ resource profile and capability, cost overruns, fitness for purpose, technology maturity and technology operations.

Contract management risks

2.27 The Airservices contract management procedure includes a list of contract management risks — for example, contract management capability, benefits realisation, supplier performance, stakeholder relationships and supply chain problems.

2.28 Airservices has grouped key contract management risks into one program risk — ineffective OneSKY CMATS commercial or contract framework management. Table 2.2 sets out the key details for this risk recorded in the program risk register.

Table 2.2: Contract management risk recorded in the program risk register

Field

Risk register detail

Risk description

  • Ineffective OneSKY CMATS commercial or contract framework management practices that impact delivery, benefits or value for money

Risk rating before treatment

  • High

Risk rating after treatment

  • Medium

Cause/threat

  • Ineffective contract and legal management
  • Ambiguity between the on-supply agreement and the scope of OneSKY
  • Contractor performance, governance, reporting not commensurate with the complexity of the program
  • Extensive remediation, rescheduling and change activities impact contract delivery, change management and resourcing

Controls

  • Contract
  • Contract management plan
  • Other program management documents

Treatments

  • Monitoring Thales’ performance
  • Reviewing the operations of the Commercial and Legal Team (see paragraph 2.10 for description of the team)
  • Project of Concern remediation plan

Consequences

  • Thales not held to account with subsequent impact on benefits, schedule or value for money
  • Reduced leverage over Thales or commercial claims by Thales against Airservices
  • Reputational damage
   

Note: Airservices’ OneSKY risk management plan defines a control as an ‘existing or pre-emptive measure used to modify a risk, opportunity or issue’. The plan sets out that a treatment addresses the causes, consequences or likelihood of a risk, opportunity or issue event.

Source: ANAO analysis of Airservices records.

2.29 Airservices documented the contract management risk in the risk registers consistent with the OneSKY risk management plan tools/matrix. It rated the risk treatments overall as ‘substantially effective’, with monitoring Thales’ performance ‘partially effective’ and reviewing the operations of the Commercial and Legal team ‘not yet effective’. Performance monitoring is further discussed in paragraphs 3.52 to 3.69 and the contract management plan in paragraphs 2.4 to 2.8.

2.30 The OneSKY risk assessment tools set out how frequently risks should be reviewed according to risk rating:

  • ‘low’ twice each year;
  • ‘medium’ each quarter;
  • ‘high’ each month; and
  • ‘extreme’ continuously.

2.31 Airservices has a monthly risk review process to monitor risks associated with the OneSKY program. It maintains a risk review log and version history for each risk identified in the register. The Program Risk and Opportunity Forum meets monthly and reviews risks that are identified as high, have an increasing trend or are due for review.27 Airservices maintains a record of its meeting minutes and presentation slides. The OneSKY Program Board (see Appendix 3) discusses risk profiles and artefacts.

2.32 Airservices reviewed the contract management risk consistent with its risk rating (see paragraph 2.30) and updated the risk register as necessary. The risk registers recorded the reviewer, whether the risk had been reviewed at the Program Risk and Opportunity Forum and any changes including treatment plans, risk trend and rating.

2.33 The program and project risk registers identify linkages between risks. Airservices has linked the contract management risk to the following CMATS program risks:

  • technology is not fit for purpose;
  • CMATS requirements change; and
  • CMATS will not be transitioned into operational service within schedule or will not deliver all elements of the OneSKY business case in a timely manner.

2.34 For these risks, the identified controls and treatments related to contract management are high-level — for example, the acquisition contract, development of a contract management plan, the remediation plan and the revised delivery strategy. Airservices has not recorded detail on how it would utilise these controls or other contract management levers to effectively mitigate these risks — for example, by actively monitoring Thales’ performance, using the contract variations process to assess value for money when program requirements change or expanding on treatments following the revised delivery strategy to ensure achievement of contract deliverables and program objectives remain on track.

Recommendation no.2

2.35 Airservices Australia identify and document how contract management risk connects to risk at the program level and when specific contract management action could be used to mitigate and improve control of program risks.

Airservices Australia response: Agreed.

2.36 The OneSKY Program Contract Management Plan has been updated to reflect how program and project level risks, including contract management risks, are managed. Contract management risks are managed within the program level framework and risks. Contract management risks now have a dedicated category within the OneSKY Project Risk Register which identifies specific actions for mitigation and control.

Issues register

2.37 Airservices records and tracks program and project issues through a register. The issues register contains fields for issue description, rating, trend, resolution actions and other operational details such as manager and review date. The risk management plan sets out that issues should be reported, discussed and reviewed at program-level boards including the OneSKY Program Board as relevant, and the issues register captures when this occurs. The issues register does not go to other governance forums.

2.38 The issues register recorded 36 administrative, technical and project issues from 2020 to 2024. As at 14 January 2025, the issues register has one open issue related to contract management: the support contract ‘does not reflect all of the CCPs [contract change proposals] signed for [the] acquisition [contract]’. Airservices has recorded information including actions to be taken and review dates against this issue.

Defence risks

2.39 Airservices’ program- and project-level risk register identifies risks specific to Airservices and risks that collectively impact Airservices and Defence. In Auditor-General Report No. 20 2024–25, 2023–24 Major Projects Report, Defence states that it maintains a separate risk register for Defence-specific or unique risks and issues, and summarises risks to AIR5431 Phase 3 as being ‘contractor performance, schedule, workforce, [Defence] customer furnished (materials, supplies, services, data), and program delivery’.28 It notes that it is mitigating the risks through implementing the Project of Concern remediation plan, the revised delivery strategy, program governance arrangements and updates of joint strategic plans. Defence concludes that overall risk has reduced since 2022–23 as a result of implementation of Project of Concern remediation plan actions.29

Has Airservices Australia established a fit-for-purpose arrangement with Defence?

The on-supply agreement formalised the relationship between Airservices and Defence for the delivery of CMATS and has been varied 10 times. It covers collaboration between the two entities and governance forums, but does not provide for escalation if issues cannot be resolved within these mechanisms. In August 2021 Defence escalated its concerns about the project to ministerial level and in October 2022 the Minister for Defence Industry declared CMATS a Project of Concern. The Minister for Defence Industry has since held six meetings with principal stakeholders to address project underperformance. These have resulted in the development of a remediation plan to address program-wide issues. As at February 2025 CMATS remained on the Project of Concern list, with exit criteria formulated to demonstrate delivery of Defence capability. The exit criteria are not expected to be met before 2027.

2.40 As the lead agency, Airservices has entered into contracts with Thales for the acquisition and support of CMATS on behalf of Airservices and Defence. The acquisition and support contracts include common elements, Airservices-unique deliverables and Defence-unique deliverables. The acquisition contract provides that Airservices may at any time partially novate the contract so that Defence and Airservices would each proceed with separate contracts with Thales and own the relevant CMATS components.

2.41 Airservices will on-supply to Defence the CMATS capability and support required by Defence as formalised through an on-supply agreement signed on 22 February 2018.

On-supply agreement

2.42 The on-supply agreement is a contract that covers the CMATS capability and support services to be delivered, the relationship between the parties and Defence’s contribution to CMATS and other OneSKY sub-programs.30

2.43 The on-supply agreement includes:

  • program scope — describes the CMATS elements (services and goods/supplies) covered by the on-supply agreement and to be provided to Defence;
  • governance — outlines Joint Airservices/Defence governance forums (see Appendix 3) and Defence’s role in CMATS contract variations;
  • agreement management — describes how the agreement can be amended with variations;
  • financing and payments — describes the invoicing arrangements;
  • termination of the agreement — outlines the exit terms for each party; and
  • associated payment schedules — outlines payments including cost allocation across financial years and milestones.

2.44 The on-supply agreement sets out that Airservices and Defence will work collaboratively, be transparent, act in good faith to achieve program objectives and ‘resolve any future management, technical, operational and commercial issues that may arise, through the governance forums’. The on-supply agreement also sets out that Airservices and Defence will work collaboratively with Thales to resolve any conflicts. Although the on-supply agreement and governance arrangements were in place, CMATS was listed as a Project of Concern at the request of Defence (see paragraph 2.50) in order to remediate the program and contract.

2.45 The on-supply agreement provides that Defence can terminate it with approval from the Secretary of the Department of Defence, the Chief of the Defence Force and the Chair of the Airservices Board. On termination of the agreement, Airservices would be required to provide Defence all deliverables existing at the time, including software and hardware.

2.46 The Joint Program Team is comprised of Airservices and Defence personnel and was established to manage the CMATS program. Its role and functions are outlined in the on-supply agreement.

2.47 Since February 2018 Airservices and Defence have varied the on-supply agreement 10 times, largely in response to CMATS acquisition contract variations (see Table 2.3). Airservices and Defence signed and dated all variations to the on-supply agreement.

Table 2.3: On-supply agreement variations

Variation number

Execution date

Additional cost to Defence

Reason for change

1

12 July 2019

In response to a contract variation to update a radio interface.

2

21 December 2020

In response to a contract variation to add a console to a Defence site.

3

21 December 2020

Clarification of contract requirements, including supplementary funding.

4

1 April 2021

In response to a contract variation to incorporate additional CMATS scope required to support secure communications.

5

18 July 2022

In response to a contract variation including an additional system element to CMATS.

6

19 August 2023

In response to a contract variation, for additional CMATS requirements.

7

29 September 2023

In response to contract variations for additional console, uplift of security standards and additional training to meet requirements.

8

13 December 2023

In response to contract variations for additional CMATS software updates required to update the software to ensure compliance with regulatory standards and changes to governance framework.

9

1 March 2024

In response to the revised delivery strategy contract variation, to split remaining Defence payments to Airservices into seven payments including five at key milestones that include Defence capability delivery (see Table 2.6).

10

13 August 2024

In response to a contract variation, for additional funding for ADOT software changes to align the system with regulatory standards.

       

Key: ✔ Yes ✘ No.

Source: ANAO analysis of on-supply agreement variations.

2.48 Defence and Airservices have commenced work to update on-supply arrangements to better reflect the services required for the ongoing sustainment and business-as-usual support of CMATS once operational.31

Project of Concern

2.49 The Defence Project of Concern and Interest framework provides for ministerial oversight of Defence projects and development of remediation for Defence projects that are not meeting targets. The Minister for Defence Industry lists projects on advice from Defence.

2.50 The Minister for Defence and the Minister for Defence Industry first jointly declared CMATS a Project of Concern in August 2017, following protracted negotiations that led to a delay in the execution of the acquisition contract.32 The project was removed from the list in May 2018 and managed as a Project of Interest.33 In August 2021 Defence wrote to the Minister for Defence and the Minister for Defence Industry recommending that AIR5431 Phase 3 be declared a Project of Concern. In September 2021 the Minister of Defence directed that CMATS be returned to the Projects of Concern list. On 27 October 2022 the Minister for Defence Industry declared CMATS a Project of Concern due to ‘significant schedule, technical and cost challenges’.34

2.51 Through the Project of Concern process the Minister for Defence Industry holds meetings (called summits) with the principal stakeholders of listed projects to remediate performance. As at February 2025 the Minister for Defence Industry has held six summits on CMATS (see Table 2.4).

2.52 Attendees at these summits were the Minister for Defence Industry, the Minister for Infrastructure, Transport, Regional Development and Local Government (8 December 2023 summit only), senior Defence officials, senior global and Australian Thales representatives, Airservices executives and the Deputy Secretary, Transport Group, Department of Infrastructure, Transport, Regional Development, Communications, Sports and the Arts. Table 2.4 sets out summit dates and outcomes. The next summit is expected to be held in August 2025.

Table 2.4: CMATS Project of Concern summits

Date

Discussion and outcomes

2 December 2022

Meeting outcomes were not prepared or signed for this summit. A summary of actions was prepared and provided to the Minister for Defence Industry via their office.

Action items from the meeting outlined in the summary document included a review of key documentation, a review of the schedule and governance arrangements and preparation of a remediation plan.

31 March 2023

The meeting noted that the remediation plan was agreed — although high risks remained on schedule and resourcing.

Updates were provided on the Joint Program Team, action items and integrated baseline review outcomes.a

Agreed actions included developing a credible contract master schedule and progressing an update on revised costings and understanding of contract changes required.

19 September 2023

An update on the project was provided including on actions relating to the contract master schedule review, performance metrics and improved working relationships. Concern was expressed regarding the success of the next software demonstration.

Agreed actions included negotiating contract updates, developing exit criteria and further developing the integrated master delivery schedule.

8 December 2023

An update on the project was provided including that a successful software demonstration had been completed, preparation for contract changes to the acquisition contract was underway and remediation plan actions were progressed. Exit criteria were agreed. Other agreed actions included updating the schedule, updating the support contract to reflect changes in the acquisition contract and reviewing the suitability of performance metrics.

8 July 2024

Progress was noted on executing the acquisition contract variations, and Thales’ positive performance. The schedule, the completion of a test readiness review and commencement of software testing were discussed.

Agreed actions were: maturing the integrated master schedule; continuing the governance documentation update; and executing an updated support contract.

26 November 2024

Cyber security requirements for CMATS, the schedule, Airservices Defence OneSKY Towers (ADOT, see footnote 10) and progress on software releases were discussed.

It was noted that action on the support contract was ongoing with negotiation occurring, Thales’ performance was positive and the new governance forum (the CMATS Steering Committee; see paragraph 2.15) was working well. Progress against the agreed exit criteria was noted.

   

Note a: In December 2022 Airservices contracted TBH Consultancy (Contract CW47386, 29 March 2023 to 8 May 2023, $172,000) to conduct an integrated baseline review of the Thales schedule to deliver CMATS. TBH Consultancy advised Airservices in February 2023 that it could not provide assurance over the schedule and that ‘significant work [was] required for the program to develop credible, defensible and achievable cost and schedule baselines’. The findings of the review were incorporated into the development of the remediation plan.

Source: ANAO analysis of Project of Concern summit minutes and outcomes.

Remediation plan

2.53 The Project of Concern process involves the development and monitoring of dedicated remediation plans. At the December 2022 summit it was agreed that a remediation plan for CMATS would be developed by February 2023.

2.54 On 20 March 2023 Defence approved the remediation plan, with endorsement from Airservices and Thales.35 The purpose of the plan was to remediate the project across requirements, schedule, governance oversight and cost efficiency through a revised delivery strategy. While the Project of Concern process is led by Defence, the remediation plan included actions that impacted the whole CMATS program.

2.55 The plan listed high-level actions across three focus areas, an ‘action plan’ (discrete tasks to achieve the overarching action) together with ‘action owner’, expected outcome, evidence of completion and deadline. The focus areas and high-level actions were:

  • capability and cost objectives — review strategic documents that cover the relationship between Airservices and Defence as Air Navigation Service Providers and confirm the program delivery strategy for CMATS;
  • schedule objectives — Thales to develop a credible, executable and resourced schedule for delivery and Airservices to develop an integrated master schedule for delivery of CMATS across the program for planning purposes; and
  • governance objectives — pursue opportunities to maximise efficiencies and strengthen governance and pursue tools to track progress and provide an accurate assessment in the delivery of CMATS.

2.56 At the December 2023 summit it was agreed that the majority of the remediation plan actions from the first version of the remediation plan had been achieved. Key actions implemented were a revised delivery strategy and delivery dates — executed through a contract variation in December 2023 (see paragraph 3.27) and development of program-level key performance indicators (see paragraph 3.58).

2.57 In July 2024 Defence approved a second version of the remediation plan, with endorsement from Airservices and Thales. The actions had a greater focus on Defence, with the incorporation of the exit criteria (see Table 2.5). Actions listed in the second version of the plan were:

  • three residual items from the first version of the plan (development of an integrated master schedule, review of strategic documents and finalisation and use of the program-level key performance indicators);
  • a new item on updating the support contract to reflect changes made to the acquisition contract as a result of the revised delivery strategy contract variation; and
  • new items relating to the exit criteria.

Table 2.5: CMATS Project of Concern exit criteria

Exit criteria

Due date

Successful achievement of RAAF Base East Sale de-risking and demonstration activitiesa

20 August 2026

Achievement of CMATS release 1.8 system verificationb

26 February 2027

Site acceptance of the first Airservices Defence OneSKY tower site (ADOT)c

31 March 2027

Advice from an independent review that the project is forecast to successfully complete (conducted after the completion of all other exit criteria)

30 June 2027

   

Note a: CMATS is due to be deployed at multiple military air bases including RAAF Base East Sale (see footnote 8). Additional work is required to consider the security accreditation required for access to Defence networks and to demonstrate successful software integration.

Note b: Release 1.8 is a software release. To confirm this milestone, Airservices and Defence will endorse that testing for this component has taken place.

Note c: The OneSKY program includes other contracts such as the one with SAAB for the supply and support of replacement tower systems for four regional Defence sites known as ADOT (see footnote 10).

Source: Second version of the Project of Concern remediation plan.

2.58 In November 2024 Defence prepared a status report on the second version of the remediation plan. It set out that:

  • the residual items from the first version of the remediation plan were completed and the new item to update the support contract was ‘work-in-progress’; and
  • three of four actions linked to the exit criteria were ‘work-in-progress’ and one was ‘yet to start’.

2.59 Defence reports monthly on CMATS to the Minister for Defence Industry under the Project of Concern process. The reporting includes an overall summary of the progress of the project against milestones and remediation plan actions. At the February 2025 update, Defence reported that project progress was positive.

Defence payments

2.60 Under the original on-supply agreement the Defence component of the project was to be supplied at a fixed price of $521 million (OSA AUD equivalent).36 Variations made from July 2019 to January 2025 increased the fixed price to $564 million (OSA AUD equivalent).

2.61 Defence paid Airservices quarterly from 2017–18 to 2024–25, and the total paid as at February 2025 was $509 million (OSA AUD equivalent).37

2.62 In March 2024, following the December 2023 implementation of the revised delivery strategy, Airservices and Defence executed a variation to the on-supply agreement. This variation changed the payment structure so that the funds remaining after Defence’s final quarterly payment (quarter 2, 2024–25) would be assigned to achievement of future milestones that included Defence elements of CMATS, as shown in Table 2.6. Defence advised the ANAO on 7 March 2025 that it expects to recognise milestone completion when it is supported by evidence — for example, a milestone acceptance certificate.

Table 2.6: Estimated future Defence milestone payments, by financial year

Milestones

Estimated financial year

Defence payment

($)

System verification

2025–26

10,114,620

Defence base acceptance

2028–29

11,916,912

First provisional acceptance at a military site

2028–29

21,291,973

CMATS release two system acceptance

2028–29

5,677,794

Final acceptance of CMATS system

2029–30

5,677,794

Total

54,679,093

     

Note: Amounts are shown in OSA AUD equivalent.

Source: On-supply agreement (August 2024).

3. Contract management

Areas examined

This chapter examines whether Airservices Australia (Airservices) has effectively managed the contract for the Civil Military Air Traffic Management System (CMATS).

Conclusion and findings

Airservices is partly effective in managing the contract to achieve value for money. It has a process to manage variations; however, a high number of variations to date have resulted in cost increases and schedule extensions, and the rationale for its value-for-money assessment was not consistently documented when seeking approval. The incentive-based pricing model agreed in the contract between Airservices and Thales has not been fully effective in containing costs, with the target price expected to be met. Airservices’ supplier performance management is not fully developed or utilised. Airservices applies enterprise-wide probity procedures for conflicts of interest and gifts and benefits, but staff did not always follow these.

Areas for improvement

The ANAO made three recommendations aimed at improving contract variation value-for-money assessments, better ensuring Thales’ accountability against key performance indicators and strengthening probity guidance and practice.

The ANAO identified two opportunities for improvement for Airservices: to update its probity plan and reconcile its conflicts of interest and probity registers.

3.1 The Department of Finance (Finance) defines contract management as ‘all the activities undertaken by an entity, after the contract has been signed or commenced, to manage the performance of the contract (including any corrective action) and to achieve the agreed outcomes’.38 Effective contract management facilitates delivery of the contract consistent with the terms agreed at contract execution and value for money.

Have contract variations been approved and documented in line with the contract management plan and procedures?

The combined impact of 44 variations as at 31 December 2024 has seen the cost of the acquisition contract increased by $160 million (AUD equivalent) and the delivery date extended by 53 months (four-and-a-half years). Airservices has a process in place to support the development and assessment of contract variations. Briefs to the approval delegate did not completely document how the various elements (technical need, risk and cost) collectively justified the value-for-money assessment or the effect of incremental change on the overall contract value for money.

Civil Military Traffic Management System contract variations

3.2 Between 22 February 2018 and 31 December 2024, Airservices and Thales agreed 44 contract variations for the acquisition contract and three for the support contract. The combined impact of the variations on the acquisition contract target and ceiling prices was around $160 million (AUD equivalent) and a delivery delay of 53 months (four-and-a-half years). One support contract variation increased the support contract by around $14 million (AUD equivalent).39 Additional acquisition contract costs resulting from variations are allocated from the OneSKY program budget (see paragraph 3.29).

3.3 The number of contract variations fluctuated each year. Table 3.1 sets out acquisition contract variations executed by year, number executed per year, cost per year and effect on scheduled delivery.

Table 3.1: CMATS acquisition contract variations and impacta

Year

No. variations executed

Target and ceiling price change

($)

Extension (months)

2018

2

(8,240,499.92)b

6

2019

4

35,823,041.65

2020

4

4,260,539.33

2021

5

412,624.00

2022

8

42,290,797.01

19

2023

16

74,194,075.33

28

2024

5

11,342,833.93

Total

44

160,083,411.33

53

       

Note: Amounts are shown in AUD equivalent.

Note a: Contract variations with cost implications change the target and ceiling price by the same amount.

Note b: The second contract variation reduced the cost of the contract overall by reducing scope for the Department of Defence (Defence) component (by $38.6 million AUD equivalent) and increasing scope for the Airservices component (by $30.4 million AUD equivalent). This resulted in a net reduction to the contract price of $8.2 million (AUD equivalent) but an overall increase to Airservices of $30.4 million (AUD equivalent). Airservices advised the ANAO on 29 November 2024 that these changes were anticipated at contract signing and resolved after additional technical work to align the contract and engineering requirements.

Source: Airservices records.

3.4 Primary drivers of the acquisition contract variations were scope change (19 variations), technical change (13 variations), administrative change (11 variations) and delivery schedule change (three variations).40 None of the administrative variations increased cost or affected the delivery schedule.

3.5 Airservices measures the amount of scope change through a ‘requirements stability score’ key performance indicator (KPI), and this is reviewed by the Program Review Board.41 From August to November 2024 Airservices rated this KPI as ‘requires monitoring’ (see Table 3.9). Program Review Board discussion indicates that it considered the key driver of the rating to be the 22 engineering (technical) variations to be incorporated into a contract variation (subsequently executed on 19 January 2025).

3.6 Airservices, Defence or Thales can initiate a contract variation. Of the 47 contract variations executed to the acquisition and support contracts between 22 February 2018 and 31 December 2024, Airservices advised the ANAO on 3 February 2025 that it initiated 18 variations, Thales initiated 18, Airservices and Thales jointly initiated five, and Defence initiated six. If Airservices and/or Defence identify the need for a variation, the acquisition contract allows for Thales to be paid ‘reasonable costs’ to develop the contract change proposal.42 Airservices advised the ANAO on 7 March 2025 that it paid Thales $4,913,045 (AUD equivalent) for preparation of contract variations between 22 February 2018 and 30 June 2024, and Defence contributed $1,030,029 (AUD equivalent).43

Contract variation guidance

3.7 Airservices’ enterprise-wide contract management procedure sets out requirements for contract variations, including that potential variations should be assessed against the Airservices procurement policy and financial obligations, recognising that they may not always be appropriate.

3.8 The Airservices procurement policy states that Airservices is ‘not required to comply with the Commonwealth Procurement Rules [but] adopts its high-level principles; the main principle being the achievement of value for money.’ It provides that value for money must be assessed and achieved for all procurements, provides a list of value-for-money considerations and states that delegates must be provided with sufficient information.

3.9 The CMATS acquisition and support contracts include provisions for contract variations. The contracts cover responsibility for cost of development, how a variation should be prepared and executed and the process for evaluation and approval. This is supported by additional detail in program documentation, as outlined in Table 3.2.

Table 3.2: Airservices documents and frameworks for CMATS contract variation management

Document

Summary

OneSKY CMATS Program Technology Change Management Plan (2024)

Sets out the approach to managing changes in the OneSKY CMATS program to ensure systematic management. Covers change principles, expectations, triggers and the contract variation process in detail. The plan sets out that contract variations:

  • are defined, approved and budgeted before development;
  • should have clear benefits;
  • should represent value for money;
  • are authorised through OneSKY and Defence governance frameworks; and
  • are controlled and tracked through implementation.

OneSKY Program Contract Management Plan (2024)

Directs that proposed variations be managed consistent with the OneSKY CMATS Program Technology Change Management Plan. The plan sets out high-level controls and governance for variations:

  • Use of a formal contract variation document — contract change proposal;
  • Joint Change Control Board governance;
  • Formal review logs and development of evaluation reports for contract change proposals, including assessment of value for money;
  • Independent legal assurance of contract change proposals to review legal and contracting risk;
  • Board Technology Committee endorsement; and
  • Airservices Board financial approval.

OneSKY Program Financial Management Plan (2022)

Provides that new contracts, variations to existing contracts and standalone agreements must be approved by the occupant of the position with the appropriate delegation.

On-Supply Agreement (2018)

Provides that, where Airservices seeks a Defence contribution to the cost of preparing or implementing a contract variation, Airservices and Defence must agree on the contribution before Airservices asks Thales to prepare the contract change proposal.

Airservices and Defence must agree in writing to any contract change proposal that would change the scope or performance of Defence services and goods/supplies unless already agreed by Defence through another governance process.

   

Source: ANAO analysis of Airservices documentation.

3.10 In October 2023 Airservices conducted an internal audit to ‘provide assurance that the process in place for assessment of value for money and recording of decisions for contract changes was adequate’. The audit found that Airservices assesses ‘risk, technical feasibility and costs’ for contract variations (including through the contract variation evaluation reports introduced in June 2022) but that it did not draw these together into a ‘value for money perspective’.

3.11 In January 2024 Airservices updated the OneSKY CMATS Program Technology Change Management Plan in response to these findings. The updates set out that the evaluation report should document value-for-money considerations consistent with the procurement policy, that the Control Change Board had a role in considering value for money and that Airservices needed to ‘confirm the change proposal represents “value for money” principles and is suitable for approval and execution’. A section on Defence engagement was also added.

Contract variation process

3.12 Airservices has developed a process to manage the development, evaluation and approval of contract variations, as outlined in Box 1.

Box 1: CMATS contract variation process steps

Identification and definition

Airservices, Defence, Thales or an external regulatora (for example, the Civil Aviation Safety Authority) identifies a variation requirement.b Airservices (and Defence, where relevant) defines the variation requirements in a supplier change request. The Change Control Board endorses the supplier change request.c The OneSKY CMATS Program Director submits a formal letter to Thales that outlines the details of the supplier change request and asks Thales to develop a contract change proposal.

Development

Thales prepares the contract change proposal according to the supplier change request. Should Thales initiate the change request, the process commences at this point.

Evaluation and approval

Airservices (and Defence where relevant) evaluates the proposal after Thales provides the costed contract change proposal.

Airservices Board approval

The Airservices Board (on Board Technology Committee advice)d allocates a funding envelope for variations that have a financial implication because of the total value of the CMATS contract or that are high risk. It delegates approval of the contract variation, should it be approved through governance processes, to the Chief Executive Officer (CEO).

OneSKY/Defence review and endorsement

The Change Control Board reviews and endorses the contract change proposal for completeness, accuracy and consequences. The Evaluation Team prepares an evaluation report to document financial, risk and value-for-money implications of the variation. The Legal and Commercial Team obtains third-party legal assurance on the contract change proposal.

Defence provides written agreement where it would contribute financially to implementation costs, subject to the change representing value for money for Defence.

Chief Executive Officer approval

The CEO approves the proposal after reviewing a brief providing evidence of Board approval (if relevant) together with Change Control Board endorsement, evaluation report and third-party legal assurance endorsement. The brief notes Defence agreement and implications for the on-supply agreement where relevant.

Execution

The Airservices CEO and the Thales representative sign the deed of execution. Airservices incorporates the variation into the contract and other program baseline documents. Thales is authorised to implement the variation.

Note a: Airservices initiates variations where necessary to address regulator requirements.

Note b: Airservices provided the ANAO with two 2024 examples of it rejecting requests for a contract variation from Thales. In one, Airservices rejected Thales’ request because it believed that the issue was the result of a Thales’ design rather than a need for a scope change. In the other, Airservices advised that it believed it was Thales’ design decisions rather than Airservices’ action or inaction that led to its need for a variation.

Note c: The Change Control Board provides oversight and direction over proposed changes to the OneSKY CMATS Program. It does not approve the business case or funding for variations. In 2015 the OneSKY Change Control Board and the Joint Change Control Board were established as separate entities to consider engineering and technical changes relating to either the OneSKY Program or Defence capability. In 2019 new terms of reference were established (and updated in 2020, 2021 and 2024) and the entities were combined into a single board with members comprising Airservices and Defence representatives.

Note d: The Board Technology Committee ordinarily endorses the allocation of funding for costed variations before they are considered by the Airservices Board. Should Airservices require a decision on a variation before the next scheduled Board Technology Committee meeting, the Airservices Board considers the variation without Board Technology Committee review — noting the crossover in membership between the forums and that the Board Technology Committee is a sub-committee of the Board. See Appendix 3 for Board Technology Committee membership and purpose.

Airservices’ compliance with the contract variation process

Approvals

3.13 The ANAO reviewed the Airservices Board approval, Change Control Board endorsement and CEO approval process for all 47 contract variations executed between 22 February 2018 and 31 December 2024. For the 44 acquisition contract variations:

  • the Airservices Board considered and approved the funding allocation for the 26 contract variations that had a financial impact and the revised delivery strategy variation due to its impact on the overall program (see paragraph 3.25);
  • the Change Control Board endorsed 40 variations44; and
  • the CEO signed all but one deed of variation, which was signed by the OneSKY Program Executive.45

3.14 Three support contract variations were executed between 22 February 2018 and 31 December 2024. Of these, one had a financial implication and was considered by the Airservices Board. The Change Control Board endorsed all three variations. The CEO approved and signed all three.

Governance and value-for-money assessment

3.15 The ANAO analysed a sample of 16 variations to assess compliance with the end-to-end process. Table 3.3 provides the ANAO analysis of Airservices’ compliance with the process for the sample. Paragraphs 3.16 to 3.20 discuss the testing results.

Table 3.3: Airservices’ compliance with contract variation process

Phase

Step

ANAO analysis of compliance

Airservices variation management

  1. Identification and definition

Thales variation management

  1. Development

Not testeda

Airservices variation evaluation, approval and execution

  1. Evaluation and approval

  1. Execution

     

Key:  Compliant Largely compliant Partly compliant

Note a: The ANAO did not test Thales’ development of contract variations. This process is external to Airservices.

Source: ANAO analysis of Airservices documentation and records.

Identification and definition

3.16 For the 16 variations tested, Airservices defined its request for Thales to develop variation proposals and used the formal letter template for 12.

Evaluation and approval

3.17 The evaluation report was introduced in June 2022 (see Box 1). Reports were prepared for all but one variation executed since its introduction and these covered risks, technical evaluation, financial breakdown of the increased cost and a value-for-money statement for each variation based on the proposed change. The completed reports included wording to state that value for money was achieved — for example, ‘represents value for money’ or ‘entering into the CCP represents value for money in the circumstances’ — but did not expand on how the evaluation team drew together its findings and made this conclusion.

3.18 Airservices prepared an approval brief for each of the 16 variations tested. The content of the briefs generally covered background and rationale for the variation, Change Control Board endorsement, evaluation report, financial and risk implications, and Airservices Board approval (if relevant).

3.19 The approval brief, or subsequent approval, did not routinely document:

  • how the various considerations (for example, new scope, cost, risk and contract value overall) collectively justified the value-for-money assessment in sufficient detail;
  • whether the variation altered the original procurement value-for-money assessment;
  • Thales’ past performance, impact of delays on program delivery and confidence to deliver the change; and
  • the appropriateness of an extension (even if minor) as opposed to undertaking a new procurement — noting eight of the variations tested had a schedule impact and the cumulative impact of variations of 53 months to the contract.

3.20 The exception was the process undertaken for the contract variation in December 2023 to support the revised delivery strategy. The CEO brief for this variation explained that the evaluation report detailed the negotiations, and set out the Airservices Board consideration and endorsement of the value-for-money assessment (see paragraphs 3.25 to 3.26).

Recommendation no.3

3.21 Airservices Australia, when assessing contract variations:

  1. record the rationale in approval documentation explaining its value-for-money assessment, including against the overall contract cost and program delivery objectives; and
  2. identify thresholds for when the impact of incremental change warrants a more significant value-for-money assessment or new procurement rather than varying the current contract.

Airservices Australia response: Partially agreed.

  1. Value-for-money recommendations are evidenced in an Evaluation Report which have assessed changes against the overall contract cost when considered relevant.
  2. Evaluation Reports also outline the evaluation process and findings to support a recommendation based on technical, commercial/legal and financial evaluation.
  3. We have amended the Evaluation Report Template to make it clearer that the report’s primary purpose is to be a value-for-money evaluation, and to require that subject-matter-expert evaluations consider key value-for-money criteria (including impact on overall contract cost and achieving program delivery objectives).
  4. The OneSKY Program Contract Management Plan has been updated to identify where an alternate procurement could be undertaken and provide guidance on when specific value-for-money criteria should be included, and when not (including when it is appropriate to address value against the overall contract cost and program delivery objectives).

Revised delivery strategy and standstill deed

3.22 In July 2023 Airservices, Defence and Thales agreed to pause certain rights and obligations under the acquisition contract and enter into a standstill deed while they negotiated a revised delivery strategy under the Project of Concern remediation plan (see paragraphs 2.53 to 2.59).46 Airservices advised the ANAO on 10 December 2024 that the cumulative effect of several factors related to Thales’ performance, together with the Project of Concern listing and remediation plan, provided the impetus for Airservices, Defence and Thales to take this approach.

3.23 The standstill deed included:

  • 11 ‘principal issues’ to be negotiated between Airservices, Defence and Thales and the objective, conditions and detail on negotiations for each47; and
  • other issues to be negotiated such as the revised delivery schedule and any other matters causing contract delays.

3.24 Airservices, Defence and Thales held 39 negotiation sessions to resolve the principal and other issues. On 6 December 2023 the three parties agreed on the revised delivery strategy contract variation, to act in good faith to negotiate any related variations and on how they would resolve each of the 11 principal issues.

Contract variation for revised delivery strategy

3.25 The Airservices Board noted on 4 December 2023 that Airservices, Defence and Thales had reached in-principle agreement on a contract variation for the revised delivery strategy and authorised the CEO to execute it together with associated changes to the on-supply agreement. It was presented to the Board due to its high risk for Airservices, and to date this is the only non-financial contract variation the Board has considered.

3.26 In endorsing the variation value-for-money assessment, the Board noted:

  • the variation would remediate the issues resulting from Thales’ failure to deliver on its contractual requirements;
  • Thales had forecast exceeding the ceiling price, which would result in Airservices paying $100 million (AUD equivalent) under the pain-share arrangements;
  • the acquisition contract price would not increase;
  • the external value-for-money report48; and
  • an updated OneSKY financial position and OneSKY business case would be provided to the Board at a subsequent meeting (see paragraphs 3.31 to 3.32).

3.27 In December 2023 Airservices and Thales executed the contract variation. It changed the delivery sequence from release zero, release one and release two to move directly to release one, with deployment to Airservices sites first followed by Defence sites. It also revised the system acceptance dates for release one from January 2027 to June 2028 and release two from June 2027 to August 2029, with deployment to civil sites first, followed by Defence sites.49

Settlement deed

3.28 On 20 December 2023 Airservices, Defence and Thales executed the settlement deed. The settlement deed:

  • closed the standstill deed;
  • gave effect to the resolutions agreed for each of the principal issues;
  • enabled the execution of the contract variation to support the revised delivery strategy; and
  • set obligations and timeframes for Airservices, Defence and Thales to review the implementation of the contract variation until the deed expiry in December 2024.

Has Airservices Australia appropriately managed supplier payments and performance?

The acquisition contract operates under an incentive arrangement where Airservices and Thales share costs and savings. Under the contract agreed in February 2018, Airservices reimburses Thales for actual costs incurred for works performed up to the ceiling cost. Since December 2023 the arrangement has focused on payments based on milestones. Airservices has mechanisms in place to monitor Thales’ performance, but it does not fully utilise these. In February 2024 program-level key performance indicators were introduced as part of Project of Concern remedial action but these do not provide associated consequences for supplier underperformance where relevant.

OneSKY budget

3.29 The Airservices OneSKY program budget covers the overall program and includes the CMATS acquisition contract and other OneSKY program costs. The OneSKY budget has increased over time, as set out in Table 3.4.

Table 3.4: Airservices OneSKY program budget and costs incurred

Initial budget (2017) $m

Revised budget (September 2024)

$ m

Costs incurred (February 2025)

$ m

Remaining budget (February 2025)

$ m

1,517

1,992

1,325

667

       

Note: Amounts are shown in AUD equivalent as calculated by Airservices.

Source: Airservices documentation.

3.30 In briefing the Board Technology Committee in September 2024, Airservices advised that additional costs for the OneSKY program related to:

  • increased costs of the acquisition contract — including increases due to variations and $100 million for its component of the pain-share arrangement (see paragraph 2.41);
  • Airservices project management costs;
  • transition and training; and
  • proposed contingency.

Updated OneSKY business case

3.31 In December 2017 Airservices finalised the OneSKY business case, which recommended replacing The Australian Advanced Air Traffic System (TAAATS) with a new civil–military air traffic management system (CMATS). In May 2024 Airservices presented an updated OneSKY program financial position and OneSKY business case to the Board Technology Committee.50 The updated business case compared ‘like for like’ the 2017 business case with an updated 2024 OneSKY program position — reflecting the revised schedule, cost and benefits assessment. In briefing its Board, Airservices advised:

  • ‘the CMATS case, with updated schedule, cost and benefit information, still ranks favourably against’ the continuation of TAAATS; and
  • ‘program delays and associated cost increases had no material impact on the economic viability of the program over the 20-year life of the asset’.

3.32 In May 2024 the Board Technology Committee accepted the findings of the updated business case and requested that Airservices conduct additional analysis to determine whether ‘future benefits still exceed costs to be incurred’. In September 2024 Airservices presented the additional information, and at that meeting the Board Technology Committee executed its right to form a Board (with an overlap in membership). The Airservices Board then noted that ‘the benefits significantly outweigh the remaining whole-of-life costs’.

Payments

Payment structure

3.33 Under the contract, Airservices reimburses Thales for actual costs incurred for works performed under the contract up to the ceiling cost. A margin is then payable on the completion of the specified milestone. The acquisition contract defines key pricing elements, as set out in Table 3.5.

Table 3.5: CMATS acquisition contract key pricing elements

Term

Definition

Actual cost

Sum of the indirect and direct costs incurred by Thales. Direct costs include direct labour costs, direct material costs, direct subcontractor costs and other costs such as travel incurred by Thales. Indirect costs include corporate fees, an allocation of overhead costs to direct costs and other non-direct Thales costs.

Target cost

Total actual costs expected to be incurred by Thales, excluding the margin.

Ceiling cost

Maximum actual cost that Airservices will pay Thales excluding the margin.

Margin

Airservices payment to Thales as profit.

Target price

Total expected price that Airservices will pay Thales and equal to the sum of the target cost and margin.

Ceiling price

Maximum amount that Thales is entitled to and equal to the sum of the ceiling cost and the margin.

   

Source: ANAO analysis of acquisition contract.

Pain-share/gain-share arrangement

3.34 In February 2018, when Airservices and Thales executed the acquisition contract, they agreed to an incentive arrangement rather than a fixed price. The incentive is designed so that they share costs and savings through a pain-share/gain-share arrangement established through target and ceiling prices. The acquisition contract establishes the purpose of this arrangement: to support ongoing collaboration; allow Airservices and Thales to manage risk, contingency and contractual performance; align their interests; and incentivise contractor performance.51

3.35 Under the pain-share arrangement, Airservices pays for all the actual costs incurred up to the target cost and half of those actual costs incurred between target cost and ceiling cost. Milestone payments, including a margin component, are paid on the completion of specific milestones. Thales will become liable for all costs over the ceiling cost.

3.36 Conversely, if Thales delivers the contract below the target cost, the parties will activate the gain-share arrangement and Airservices will pay Thales a ‘bonus’ of 50 per cent of the difference between the target cost and Thales’ actual costs as well as the margin.52

3.37 Table 3.6 shows the relationship between the pain-share/gain-share arrangements and Airservices’ payments to Thales.

Table 3.6: CMATS acquisition contract payments structure

Thales’ actual costs

Airservices payments

Under or at target cost

  • 100 per cent payment for costs under target cost; and
  • 50 per cent of the difference between actual and target costs

Between target and ceiling cost

  • 100 per cent payment for costs under target cost; and
  • 50 per cent payment for actual costs exceeding target cost to the ceiling cost

Exceeds ceiling cost

  • ceiling cost; and
  • zero per cent payment for costs exceeding ceiling cost
   

Source: ANAO analysis of the acquisition contract.

Milestone payments

3.38 Under the acquisition contract as agreed in February 2018, Airservices reimbursed Thales monthly for actual costs (direct and indirect costs) and paid the margin on achievement of specified milestones. Following the execution of the contract variation for the revised delivery strategy, Airservices:

  • pays 60 per cent of direct costs incurred every two months rather than every month; and
  • pays the remaining 40 per cent of direct costs, indirect costs (incurred after 1 February 2023) and the margin in milestone payments.53

3.39 The contract specifies ‘cost checkpoints’ and a cost ceiling for actual costs paid to that checkpoint. The contract provides that Thales will not be entitled to payment at a particular checkpoint if actual costs accrued exceed the checkpoint ceiling cost before it achieves the specified milestone — unless Airservices and Thales have executed a contract variation or the Program Review Board has made a decision to modify the checkpoint ceiling cost.

Payments to Thales

3.40 As at December 2024 the target price was $1.365 billion (AUD equivalent) and the ceiling price $1.465 billion (AUD equivalent). Airservices advised the ANAO on 31 March 2025 that as at February 2025 it had paid Thales $1.189 billion under the acquisition contract.54

3.41 Airservices advised the ANAO in June 2025 that based on the current financial position of the contract it is likely that Thales will reach target cost during the 2025 year and ceiling cost prior to expiry of the acquisition contract. As a consequence, Airservices expects to be liable for $100 million (AUD equivalent) under the pain-share arrangement. In December 2023 Airservices advised its Board that reasons for increases in Thales’ actual costs included an extension to the program by over four years, complexity of software development, engineering requirements such as those related to security and safety, and integration issues.

3.42 If Thales exceeds the ceiling cost, it will be entitled to milestone payments only. This presents a risk that Thales will lack the incentive to deliver the project to schedule. Airservices advised the ANAO in December 2024 that it considered this risk as part of the delivery strategy variation and, to mitigate it, moved a percentage of direct and indirect costs into milestone payments.

Payment pauses

3.43 Thales performed work under the contract without payment between February and December 2023. This was a result of Thales pausing invoicing of Airservices for incurred actual costs from February to November 2023, after it exceeded the checkpoint ceiling cost for a milestone it had not achieved in January 2023.

3.44 Under the standstill deed, Airservices and Thales agreed that Thales would achieve three intermediate milestones during the period July to December 2023 and that Airservices would pay Thales 80 per cent of the direct costs it accrued between February and October 2023, when it achieved the final intermediate milestone. In January 2024, following the December 2023 execution of the settlement deed, Airservices paid Thales the remaining 20 per cent. Airservices and Thales agreed that it would pay Thales the indirect costs as accrued from February 2023 through future milestone payments.

3.45 Defence paused payments to Airservices from March 2023, during the period that Thales paused invoicing of Airservices. Defence back-paid Airservices following the execution on 1 March 2024 of an on-supply agreement variation.

Invoicing and payment arrangements

3.46 Under the revised delivery strategy, Thales submits invoices to Airservices every two months for 60 per cent of actual costs and a milestone claim on completion of each relevant milestone. On receipt of the invoice, Airservices reviews a sample of transactions listed for accuracy and the Head of Transformation OneSKY approves the invoice from a business perspective before it is paid. For Airservices to accept that milestones have been achieved, the Joint Program Team (see paragraph 2.46) reviews Thales’ submission and makes a recommendation to the Program Director for final decision.

3.47 Through the course of Airservices’ financial statements audit, the ANAO tested Airservices’ payments of Thales’ invoices for CMATS for 2022–23 and 2023–24 and made no findings in Airservices’ reported transactions.

Support contract

3.48 Under the support contract Thales will provide services to Airservices to support CMATS once operational. Airservices will pay Thales quarterly and monthly in arrears depending on the service provided subject to any reduction in the amount payable to Thales should it underperform.

3.49 Airservices commenced engaging with Thales in October 2022 on whether it would move to a subscription delivery model. Airservices advised the ANAO on 10 December 2024 that it had suspended this engagement with Thales in June 2024. Airservices further advised the ANAO that it resumed engagement with Thales in February 2025 by inviting Thales to provide a proposal on how to incorporate the subscription delivery model under the contract.

Performance management

3.50 Airservices’ enterprise-wide contract management procedure covers requirements for contractor performance management. It sets out:

  • that performance management is essential to contract management and that it is used to ensure Airservices and the supplier adhere to their obligations;
  • the requirement that contract management plans cover the use of key performance indicators and approach to performance management processes; and
  • a list of requirements including regular review of contract KPIs with feedback provided to the supplier, implementation of a performance plan if a contract supplier does not meet satisfactory standards for two review periods in a row and review of contract effectiveness (see paragraphs 2.18).

3.51 Airservices considers Thales’ contract performance through schedule and price. This is provided for in the acquisition contract, support contract and OneSKY program framework documents, as outlined in Table 3.7.

Table 3.7: Airservices contract performance mechanisms

Document

Summary

Acquisition contract

The acquisition contract includes details on contract performance.

  • Governance: provides a description of the functions and responsibilities of the Program Review Board, including its role in monitoring contract performance and use of the ledger system to support performance issues.
  • Schedule: states the importance of the schedule and that Thales must ‘ensure its obligations under the contract are carried out in a timely manner to comply with its schedule obligations’. Defines contract milestones and expected delivery dates. Sets out schedule performance reporting artefacts including contract master schedule and mini contract status reports (see Table 3.8). Outlines contractual remedies related to schedule performance (see paragraphs 3.65 to 3.68).
  • Price and payments: includes key pricing models and mechanisms (see Table 3.5). The contract also sets out that Thales must use ‘reasonable endeavours’ to keep the cost below the target price at final acceptance.
  • Delivery, acceptance and ownership: details how deliverables are provided and processes in place to accept the deliverables and transfer ownership between Thales and Airservices.
  • Reporting artefacts: describes reporting artefacts used to cover schedule, system implementation, progress reporting and contract performance. Details additional information on reporting requirements and review of documentation.

Support contract

Includes information on underperformance, acceptance and ownership, including how performance will be considered when the contract comes into effect. This is supported by detailed information on the use of key performance indicators, including their management and how they are to be reported on.

OneSKY Program Contract Management Plan (2024)

The plan outlines the role of the Program Review Board and use of the ledger system, schedule, pricing models, contract remedies and meetings between Airservices and Thales (for example, progress meetings and contractor performance reviews).

   

Source: ANAO analysis of acquisition and support contracts and Airservices documentation.

Performance monitoring

Reporting artefacts

3.52 The acquisition contract lists the reporting artefacts that Thales is required to submit to Airservices. This list provides details on individual reporting artefacts, including how reports are to be submitted and reviewed by Airservices, frequency of reporting and description of the report. Table 3.8 describes the main reporting artefacts.

Table 3.8: CMATS contract reporting requirements

Artefact

Summary

Mini contract status reportsa

Thales provides updates every two months on delivery status against the contract. This can include detail on, for example:

  • contract progress (including summary of significant work activities in the previous and current reporting periods, financial reports and technical status reports)
  • performance against milestones
  • recruitment update
  • risk report
  • problem identification report
  • engineering development test and evaluation report.

Earned value performance reports

From January 2024, Thales provides the earned value performance reports every two months. The report identifies the impact of actual and potential problems causing significant schedule and cost variances, and program status information. Reports are provided in three sections:

  • data to measure cost and schedule performance;
  • performance measurement baselineb including changes during the reporting period; and
  • a narrative report to explain significant cost and schedule variances and other contract problems identified.

Contract master schedule

Thales provides the contract master schedule every two months to describe the planned sequence of activities and milestones. Airservices uses the contract master schedule to gain visibility of Thales’ planning, evaluate its approach to meeting the scope of work requirements and for Airservices and Defence planning.

   

Note a: Under the Project of Concern remediation plan, Airservices and Defence agreed to reduce costs and effort by refining contract documentation and improving governance and reporting systems. In 2023 Airservices replaced the Contract Status Report with the streamlined Mini Contract Status Report.

Note b: Performance measurement baseline combines the approved budget with the planned work schedule.

Source: ANAO analysis of Airservices documentation and records.

3.53 Airservices reviews the reporting documentation to check the quality of the artefacts and may ask Thales to amend reporting artefacts before approval. Airservices tracks the status of the reporting artefacts, including the associated milestone, whether the artefact was approved the first time it was received, how many revisions were required and whether it was delivered on time.

Project ledger system

3.54 The ledger system is a contractual mechanism to manage ‘ledger events’ and the subsequent treatment of such events.55 The acquisition contract states that the Program Review Board is to develop and maintain a project ledger to capture these issues.

3.55 Airservices advised the ANAO on 15 October 2024 that the project ledger system had not been formally implemented as a contractual mechanism and Program Review Board function, although several attempts were made to implement its use. Airservices further advised the ANAO in June 2025 that a working group has been established to implement the ledger system and effectiveness of the ledger will be reviewed within a year.

Contract performance reviews

3.56 The acquisition contract and the contract management plan set out that Airservices and Thales should hold six-monthly (or as otherwise agreed) contract performance reviews. The purpose of the reviews is to:

  • facilitate Airservices’ evaluation of Thales’ performance and Thales’ of the Airservices team;
  • consider the quality of the developing work and ongoing services, and assess final products and services; and
  • facilitate early identification and mitigation of any adverse effects of performance.

3.57 Airservices advised the ANAO on 12 December 2024 that it does not use the contract performance reviews to review Thales’ performance and that it monitors Thales’ performance through the Program Review Board and performance reporting artefacts instead (see Table 3.8).

Program key performance indicators

3.58 Airservices established program KPIs under the Project of Concern remediation plan and uses these to monitor overall OneSKY program performance. Prior to this Airservices did not use program or contract management KPIs to provide assurance that Thales was meeting its obligations under the contract or program objectives were being achieved. The OneSKY program KPIs support the key result areas — scope, schedule, cost, organisation, safety and security.56

3.59 Airservices uses a traffic light system to present monthly performance ratings for individual KPIs. It presents KPI dashboards to the three tiers of governance (see Figure 2.1) — with the level of detail and data provided varying depending on the tier. Table 3.9 sets out the KPIs presented to the Program Review Board between August and December 2024.

Table 3.9: Program Review Board KPI reporting, August to December 2024

Key result area

Key performance indicator

Aug

Sep

Oct

Nov

Dec

Scope

Requirements stability score

Current requirements testing pass ratea

Software assurance

CMATS forward confidence index

Schedule

Planned milestone completiona,b

Thales schedule performance index

Customer/purchaser furnished material deliverya

On-time delivery of reporting artefacts

Schedule contingency

Cost

Thales cost performance index

Reporting artefacts approval iterations

Organisation

Staff separation rate

Open required vacancies

Likelihood of program successc

Overdue actions

Governance forum attendance

Safety

Safety talksa

Safety incidents

             

Key:  On track Requires monitoring Requires intervention — insufficient data/not due

Note a: The name of the KPI changed between August and December 2024 either to align the name with an upcoming milestone or in response to an update of individual KPI characteristics.

Note b: This did not have results for August to October 2024 because no requirements were planned for completion at that time.

Note c: This is measured through a survey of two key Airservices staff.

Source: ANAO analysis of Airservices records (Program Review Board reports, August to December 2024).

3.60 Individual KPIs are supported by a document that captures the reporting methodology. This includes details on the purpose of the KPI, defined thresholds for performance ratings (green — on track; amber — requires monitoring; and red — requires intervention). The OneSKY Performance Management Plan (approved on 9 December 2024) also sets out how KPIs are to be used. It includes information on the how KPI data are presented to different levels of governance, roles and responsibilities, and detailed supporting KPI data (for example, purpose, review frequency and assessment method).

3.61 Neither the KPI documentation nor the contract management plan defines associated contract management actions such as contractual remedy or the process for Thales should it not meet KPIs.

Recommendation no.4

3.62 Airservices Australia identify which program key performance indicators relate to contract management and link the results of these to contract management actions to better ensure Thales’ accountability in delivering under the contract.

Airservices Australia response: Agreed.

3.63 Key Performance Indicators (KPIs) have been identified and agreed by all parties (Airservices, Defence and Thales) and accepted at the Project of Concern (POC) summit. Contractor performance, including through KPI reporting, is being monitored actively at all governance forums and through POC summits. As appropriate, Airservices ensures that decisions flowing from this reporting are – where applicable – implemented through the performance mechanisms of the contract where these exist. Airservices has updated the OneSKY Contract Management Plan to identify contract-management-relevant KPIs with specific triggers for contract management action.

Program Review Board

3.64 The acquisition contract outlines the governance role of the Program Review Board in monitoring performance. The ANAO reviewed a sample of its meeting minutes and reports from 2023–24. Discussion included:

  • Project of Concern process and implementation of the deed of settlement;
  • program KPIs for feedback on development, relevance and results, and poor results in the late delivery of reporting artefacts provided by Thales; and
  • combining release 1.7 and release 1.8 milestones together with changes to scope, benefits and associated risks.57
Contract remedies

3.65 The contract management plan outlines remediation activities including:

  • checkpoint ceiling — triggered when actual costs exceed certain thresholds (see paragraph 3.39). Remediation activities may include a ‘cost management remediation plan’, governance mechanisms, withholding payment, contract termination or payment on issue resolution58;
  • warranty provisions under the Joint Acquisition Statement of Work (statement of requirements included in the acquisition contract) stating that defects are to be fixed; and
  • substituted performance — provides Airservices with the discretion to perform or procure ‘remedial work’ with an alternative party to Thales if specific criteria are met.

3.66 The acquisition contract also includes remediation mechanisms (not listed in the contract management plan):

  • postponement — obligations placed on Thales to inform Airservices if delays to delivery are expected. Airservices and Thales can agree to postpone a milestone delivery using a contract variation; and
  • schedule recovery — Thales as the contractor must deliver each milestone by the milestone date outlined in the delivery schedule. Schedule recovery may be used to direct Thales to take any measures Airservices considers reasonably necessary to ensure contract delivery (including to meet milestone delivery dates). If changes are not met the contract may be terminated using contract termination provisions (see Table 3.10).

3.67 Airservices advised the ANAO in January 2025 that it utilised schedule recovery procedures in 2021. On 17 March 2021 Thales notified Airservices of anticipated delays to milestones. Airservices provided written responses on 13 August 2021 and 30 September 2021 detailing its intent to work with Thales to resolve the claim for postponement and update the applicable dates for milestones 12, 13 and 15.59 On 17 February 2025 Airservices advised the ANAO that the postponement claim was actioned through the COVID-19 variation in 2021 and the new milestone delivery dates negotiated as part of the revised delivery strategy.60

3.68 Airservices also advised that the Project of Concern remediation plan and revised delivery strategy are consistent with schedule recovery procedures, although this is not explicit in the plan or contract variation.

Contract dispute resolution and termination

3.69 The acquisition and support contracts and contract management plan provide advice on dispute resolution and termination, as outlined in Table 3.10. Airservices advised the ANAO on 12 December 2024 that it had not had to use any formal dispute processes in response to Thales’ performance.

Table 3.10: CMATS contract dispute resolution and termination mechanisms

Mechanism

Summary

Resolution of disputes

The acquisition contract sets out that disputes should be negotiated in good faith and resolved as quickly as possible. The Program Review Board may consider disputes. A dispute adjudication panel may be used to adjudicate the dispute. The contract management plan states that ‘attempts to resolve disputes should always be at the lowest level practical’.

Contractor defaulta

Airservices may terminate the acquisition contract through contractual provisions including:

  • Immediate termination for default — may include a reduction in project scope or immediate termination by notice in writing to Thales in response to outcomes such as bankruptcy or insolvency, or Thales ceasing to continue business, failing to meet any cost checkpoints within 12 months of a relevant milestone date or failing to achieve any other milestone within 18 months of the relevant milestone date.
  • Termination following default notice — may include Thales failing to meet any milestone by the relevant milestone date or failing to comply with contractual obligations. Default notices are to be remedied according to the outlined provisions of the notice or termination of contract, or reduction of scope may be enacted.

Termination for convenience

Airservices may at any time terminate the acquisition contract or reduce the scope of the contract by notifying Thales in writing.

Right of customer to recover money

Where Thales owes money, Airservices can deduct the amount of the debt from payment of any claim due and payable or give Thales a written notice of the existence of a debt to be recovered. Thales is to pay this within 30 days of receipt of the notice.

   

Note a: A ‘default’ occurs when Airservices considers that Thales has failed to commence work under the acquisition contract within 30 days of the effective date, failed to complete any milestone by the relevant milestone date or failed to comply with another obligation to be performed or observed under the acquisition contract.

Source: ANAO analysis of acquisition contract and Airservices documentation.

Were probity risks managed throughout the project?

Airservices has procedures for probity management. Airservices utilises enterprise-wide conflict of interest procedures and gifts, benefits and hospitality acceptance procedures, but these are not reflected in OneSKY probity plans. Airservices staff accepted and did not declare gifts, benefits or hospitality, indicating limited compliance with Airservices’ code of conduct requirements and conflict of interest procedures on perceived and actual conflicts.

3.70 The Department of Finance Contract Management Guide states that probity is the evidence of ethical behaviour, defined as demonstrated integrity, uprightness and honesty in a particular process. The guide identifies that, in addition to an overarching contract management plan, entities should consider developing a probity plan that ‘details the mechanisms for assuring probity within the management of the contract’.61 Probity management includes the identification and management of conflicts of interest, and appropriate handling of gifts and benefits.

Management of probity

CMATS probity plan

3.71 Airservices established the current version of the CMATS program probity plan in February 2018, when the acquisition and support contracts were signed.62 The plan has since been updated four times. The current version (effective October 2023) sets out:

  • general practices expected from all program officials, for example that program activities are to be conducted in accordance with the relevant protocols, code of conduct and legislation;
  • that official information must be accessed, protected and stored in accordance with applicable legislation, and government and Airservices policies and procedures; and
  • practices relating to the management of conflicts of interest for the program.

3.72 The probity plan specifies that it applies to ‘program participants’ or persons involved in the OneSKY program. The Airservices CEO and Board have defined roles and responsibilities in relation to the governance of the OneSKY CMATS project — in particular, approval of contract variations. Airservices advised the ANAO on 20 November 2024 that the CEO and Board members are not subject to the conflict-of-interest protocols described in the probity plan such as completing a conflict-of-interest declaration for the OneSKY program. Airservices uses CEO and Board member conflict-of-interest declarations made at an enterprise-wide level to inform their program-specific conflicts (see paragraph 3.80). The probity plan does not reference the use of the enterprise-wide conflict of interest protocols.

Opportunity for improvement

3.73 Airservices could update the CMATS probity plan to reference the use of enterprise-wide protocols for managing conflicts of interest.

OneSKY probity procedures

3.74 Airservices executes the conflict of interest and information access procedures described in the probity plan through an automated task management system in SharePoint.

3.75 When a person commences a position in the program, they complete a probity declaration form in the workflow.63 The form consists of a conflict of interest declaration and a confidentiality acknowledgement. The probity declaration is then sent to the probity officer (the Commercial and Legal Manager or a member of their team) and a member of the OneSKY leadership team for approval.64

3.76 The workflow notifies program officials via email annually to refresh their probity declaration and every three years to submit a new probity declaration.65 The probity plan sets out that program officials must disclose any changes in their circumstances that relate to their current conflict-of-interest declaration as soon as they arise.

3.77 Airservices has a probity register that captures the details of each program participant and contains a link to each program official’s workflow records, which capture decisions and actions relating to their probity declaration, clearance and portal access such as probity assessment outcome.66 As at January 2025, and since the current register was established in 2019, around 900 officials who worked on the program over its life had submitted a probity declaration. Airservices also has a register of conflicts of interest declared by program officials through the probity register. Airservices advised the ANAO on 18 December 2024 that conflicts are recorded in the register manually and are not regularly reconciled with declared conflicts in the probity register.

Opportunity for improvement

3.78 Airservices could periodically reconcile the conflict-of-interest register with the probity register to ensure it has captured all conflicts.

3.79 Between 2020 and 2024, 24 conflicts were recorded in the conflict register. The ANAO examined a sample of 10 conflicts and found that five had mitigation strategies in place, and for the remaining five Airservices had determined that existing controls were adequate. No rationale was provided in the cases where the probity officer determined that existing controls were adequate; however, they had selected the option on the form to note that ‘no specific control measures are required or portal access changes are required’.

CEO and board declarations

3.80 The CEO and Board members must complete a conflict-of-interest declaration, refresh their conflict of interest declaration annually and ensure their declarations are kept up-to-date to reflect their current personal circumstances. The ANAO reviewed the CEO’s and Board members’ disclosures of personal interest from 2019 to 2024, and none had disclosed a personal interest in Thales.

Gifts, benefits and hospitality

Enterprise-wide documents

3.81 Airservices has established enterprise-wide policies that set out the conduct expected of staff and contractors including in relation to conflicts of interest and gifts, benefits and hospitality (see Table 3.11). Airservices advised the ANAO on 3 December 2024 that it relies on the enterprise-wide finance manual for gifts, benefits and hospitality procedures in relation to the OneSKY program.

Table 3.11: Airservices enterprise-wide probity policies

Document

Probity requirements covered

Airservices Code of Conducta

(from May 2020)

  • A conflict of interest arises when an Airservices employee ‘is presented with the opportunity to make or influence a work-related decision that will [or] could benefit [themselves] or a third party’.
  • Examples of conflicts of interest are personal relationships and acceptance of gifts and benefits.
  • Real or apparent conflicts of interest and offered bribes are to be disclosed as soon as they arise.
  • Gifts and benefits that might reasonably be perceived to compromise official duties must not be solicited, accepted or offered.
  • All offered, solicited and accepted gifts or benefits in relation to an official’s employment that could be perceived as a conflict of interest are to be declared in a gifts and benefits register.
  • Officials are to access, protect and store information in accordance with applicable legislation and policies.

Contract management procedure (enterprise wide)

  • Conflict-of-interest declarations should be completed annually by employees who have a role in the management of a contract.
  • Appropriate actions should be taken where a conflict has been declared.
  • Unless conflict-of-interest declarations are otherwise obtained from financial delegates, the execution memorandums for contracts (including variations) should include the statement, ‘Signatories to this memorandum declare that they do not have any conflicts of interest in relation to this contract/supplier unless otherwise disclosed and documented’.b

Finance manual

  • Approval must be sought prior to providing official hospitality. The Airservices financial delegation instrument sets out each delegate’s approval limit for official hospitality expenses.
  • Gifts and corporate hospitality events valued at over $100 must be evaluated prior to acceptance and disclosed to the relevant executive assistant.
  • Staff involved in procurement are not to accept or solicit gifts or entertainment from respondents or potential respondents; and
  • Gifts and benefits received by the CEO and Executive team valued over $100 (GST excluded) must be published on Airservices’ external website each quarter.

Procurement manual

  • Staff involved in procurement should not solicit or accept gifts and benefits for themselves or another person under circumstances that might reasonably be perceived to compromise official duties.
  • Staff involved in procurement should identify and manage conflicts of interest as soon as they are known.
   

Note a: The Airservices Code of Conduct replaced the Code of Conduct Management Instruction (August 2019 to May 2020).

Note b: Airservices advised the ANAO in March 2025 that it implements this requirement through the corporate standing disclosures described in paragraph 3.80.

Source: ANAO analysis of Airservices documentation.

3.82 Airservices does not include in its finance manual, procurement manual and contract management procedure:

  • a requirement that officials make a notification for offers of gifts, benefits or hospitality that were not accepted;
  • a definition of corporate or official hospitality; or
  • guidance on disclosure, suitability or management of gifts, benefits or hospitality/meetings at outside venues (such as dinners or lunch meetings at restaurants) with contractors to manage probity risks during contract management.
Gifts, benefits and hospitality procedures

3.83 Airservices advised the ANAO on 21 October 2024 that it has an established a process for managing gifts and benefits to implement the finance manual policy. The executive assistant for each business group records the gifts and benefits received by individuals in their business group that are valued at over $100 (excluding GST). The internal gifts and benefits register is published quarterly after being cleared by the CEO.

3.84 The ANAO has reviewed the gifts and benefits declared in the public register. One entry related to a 14 June 2024 lunch meeting between Thales and the acting Airservices CEO valued at $110.

3.85 The ANAO reviewed Airservices’ email and calendar records relating to engagement with Thales for gifts, benefits and hospitality around key contract variation dates. This review identified 21 instances of Airservices employees in the CMATS program engaging in lunch, dinner and other events with Thales in these periods.

  • calendar invitations for drinks, breakfast, lunch or dinner with Thales employees including drinks to celebrate achievements related to the revised delivery strategy and sharing an invitation with other Airservices employees to have lunch to celebrate the ‘closure on the TAAATS EoL extension’;
  • offers made from Airservices to Thales employees to have lunch, dinner or dinner and drinks at hospitality venues; and
  • dinners for Airservices Board and Thales Board members.

3.86 These records did not show whether the engagements related to official hospitality provided by Airservices that would require approval or that would meet the reporting threshold for corporate hospitality as a gift or benefit according to the finance manual. The Airservices Code of Conduct requires that staff report gifts and benefits where a perceived conflict of interest may exist. Given the significance of the contract to Airservices and the number and frequency of variations, these engagements represent ongoing risk around potential, perceived and actual conflicts.

3.87 Airservices advised the ANAO on 2 March 2025 that the published gifts and benefits register captures all the information contained in its internal register and that it does not have a record of approved provision of hospitality to Thales. Airservices’ gifts and benefits register does not include the hospitality engagements identified.

3.88 The ANAO approached Thales in January 2025 and asked whether it had records of gifts, benefits or hospitality provided to Airservices.67 The response from Thales identified 18 instances of the acceptance of a gift, benefit or hospitality by Airservices staff to a total of $3,501 (see Table 3.12). Airservices advised in March and June 2025 that it did not have a record of these 18 instances of accepted gifts, benefits or hospitality from Thales.68 In not recording these, Airservices staff may not have complied with the Airservices Code of Conduct requirement that they declare gifts or benefits where a perceived conflict of interest exists.

Table 3.12: Gifts accepted by Airservices staff, as advised by Thales

Gift description

Date

Amount ($)

Dinner

18/03/2019

787.00

Gift

16/03/2019

260.00

Dinner

11/02/2020

110.00

Dinner

30/04/2021

74.83

Lunch

5/10/2022

35.00

Dinner

8/11/2022

123.00

Dinner

15/02/2023

134.50

Dinner

16/02/2023

211.50

Gift

14/03/2023

80.00

Dinner

11/05/2023

109.33

Dinner

19/06/2023

576.00

Meal

18/07/2023

147.00

Dinner

2/08/2023

158.00

Dinner

16/08/2023

86.00

Dinner

14/11/2023

149.50

Flowers

15/05/2024

137.35

Lunch

14/06/2024

226.00

Dinner

20/06/2024

96.06

Total

3,501.07

     

Source: ANAO analysis of Thales’ gifts and benefits register.

Recommendation no.5

3.89 Airservices Australia strengthen guidance, education and process around accepting gifts, benefits and hospitality during contract management to address probity risks.

Airservices Australia response: Agreed.

3.90 Airservices has published and communicated a new Provision and Receipt of Hospitality Gifts and Benefits Procedure. The OneSKY Probity Requirements document and the OneSKY Program Contract Management Plan have been updated to ensure compliance with the new Airservices guidance as well as the ANAO’s recommendations in relation to probity risks more broadly.

Appendices

Appendix 1 Entity responses

Airservices Australia

Page one of the response from Airservices Australia. A summary of the response can be found in the summary and recommendations chapter.

Page two of the response from Airservices Australia. A summary of the response can be found in the summary and recommendations chapter.

ANAO note: See footnote 3 for explanation of Report Preparation Papers prepared as part of the performance audit process.

Department of Defence

Page one of the response from Defence. A summary of the response can be found in the summary and recommendations chapter.

Appendix 2 Improvements observed by the ANAO

1. The existence of independent external audit, and the accompanying potential for scrutiny improves performance. Improvements in administrative and management practices usually occur: in anticipation of ANAO audit activity; during an audit engagement; as interim findings are made; and/or after the audit has been completed and formal findings are communicated.

2. The Joint Committee of Public Accounts and Audit (JCPAA) has encouraged the ANAO to consider ways in which the ANAO could capture and describe some of these impacts. The ANAO’s corporate plan states that the ANAO’s annual performance statements will provide a narrative that will consider, amongst other matters, analysis of key improvements made by entities during a performance audit process based on information included in tabled performance audit reports.

3. Performance audits involve close engagement between the ANAO and the audited entity as well as other stakeholders involved in the program or activity being audited. Throughout the audit engagement, the ANAO outlines to the entity the preliminary audit findings, conclusions and potential audit recommendations. This ensures that final recommendations are appropriately targeted and encourages entities to take early remedial action on any identified matters during the course of an audit. Remedial actions entities may take during the audit include:

  • strengthening governance arrangements;
  • introducing or revising policies, strategies, guidelines or administrative processes; and
  • initiating reviews or investigations.

4. In the course of finalising the audit Airservices Australia (Airservices) advised the ANAO that it had:

  • updated the Contract Management Plan (for example see paragraphs 2.21, 2.36 and 3.63);
  • updated the Evaluation Report template for contract variations (see from paragraph 3.21); and
  • commenced a working group to progress the ledger system that is intended to capture matters impacting the performance of the contract (see paragraph 3.55).

5. The ANAO has not sought to obtain assurance over these actions or whether they have been appropriately implemented.

Appendix 3 OneSKY governance forums and responsibilities

Forum membership and meeting frequency

Forum purpose

Airservices specific

Airservices Board

  • Chair
  • Deputy Chair
  • Chief Executive Officer
  • six other members

Meets ‘as it considers necessary’. Airservices advised the ANAO in November 2024 that the Board holds at least eight meetings annually.

Purpose is to set Airservices objectives, strategies and policies and to ensure that Airservices fulfills its functions in a ‘proper, efficient and effective manner’. The board’s duties include establishing and maintaining systems relating to risk and control.

Approves contract variations with financial implications or that are high risk.

Board Technology Committeea

  • Chair (non-executive board member appointed by the Airservices Board)
  • Airservices Board Chair
  • Chief Executive Officer
  • at least two non-executive board members

Meets minimum four times a year (unless otherwise determined by the Board).

Purpose is to assist the Airservices Board in discharging its responsibilities by providing oversight of Airservices technology strategies, policies and strategic direction and to facilitate discussion on matters relating to technology and impact on Airservices operations.

The committee is not a decision-making body.

Performance Oversight Meeting

  • Chair — Chief Financial Officer
  • Airservices Executive team

Meets monthly. Does not have terms of reference.

Purpose is to review organisational performance and provide Airservices Executive with visibility of papers before they go to the Airservices Board.

OneSKY Change Program Board

  • Chair/SRO — Head of Transformation OneSKY
  • Change program leadership team
  • Strategy execution office coach
  • Business change managers
  • Asset and capability lifestyle manager
  • Procurement and commercial services Manager

Meets monthly.

Purpose is to provide strategic direction, guidance and assurance across the program and review the progress of major OneSKY programs including CMATS.

Responsibilities include providing resources and support to the senior responsible officer for each project, providing technical input for program wide decisions and helping to ensure each project delivers its outcomes and benefits. Chair runs the meeting and members provide decision support.

Change Control Board (CCB)b

  • Chair — Head of Transformation OneSKY
  • OneSKY CMATS Program Director
  • Defence Project Director AIR5431 Phase 3
  • CMATS Deputy Program Director
  • OneSKY Commercial and Legal Manager
  • OneSKY Finance Manager
  • OneSKY ATM Operations Principal
  • OneSKY Joint Program Engineering Manager
  • OneSKY Joint Program Logistics Manager
  • OneSKY Transition and Support Program Manager
  • OneSKY Infrastructure Program Manager
  • Head of Transformation — Western Sydney Airport
  • OneSKY Configuration Manager
  • AIR5431 Phase 3 Commercial Director
  • AIR5431 Phase 3 Design Acceptance Representative
  • Director Strategic Airspace Management

Meets as needed to consider contract change proposals.

Purpose is to provide oversight of proposed contract and engineering variations including to identify, define and assess proposals and then to endorse, reject or refer for further consideration.

Does not hold any financial delegations.

Joint (Airservices and Defence)

Air Navigation Service Providers (ANSP) Strategic Forum

(previously Joint Strategic Forum)

  • Co-Chair — CEO Airservices
  • Co-Chair — Defence Deputy Secretary, Capability Acquisition and Sustainment Group (DEPSEC CASG)
  • Co-Chair — Chief of Airforce (CAF)

Meets at least once every 12 months unless otherwise requested by the co-chairs.

Purpose is to provide strategic direction to deliver Australian air navigation services and achieve air traffic management harmonisation across civil and military airspace.

Terms of reference do not have a specific focus on contract management but a function is to agree on positions ahead of key meetings with Thales.

Air Navigation Service Providers (ANSP) Steering Committee

(previously Joint Executive Committee)

  • Co-Chair — Airservices Chief Services Delivery Officer (CSDO)
  • Co-Chair — Head Air Defence and Space Systems Division (HADSSD)
  • Co-Chair — Head Air Capability — Air Force (HAC)

Meets quarterly unless otherwise requested by the co-chairs.

Purpose is to establish, monitor and provide executive direction to all joint air traffic management activities, including CMATS, to determine any significant scope, cost or schedule changes to joint projects, monitor strategic risks, and discuss and resolve any issues referred to the committee.

CMATS Review Group

  • Co-Chair: Head of Transformation — OneSKY
  • Co-Chair: Director General Air and Surface Surveillance and Control Branch (DG-ASSC)
  • CRG Secretariat

Meets monthly.

Representative body responsible for delivery of CMATS and ADOT systems.

Includes providing direction to the joint program team, oversight of performance of the on-supply agreement and direction to the Joint Program Team.

Tri-party (Airservices, Defence and Thales)

OneSKY Strategic Forum (OSRF)

  • CEO Airservices Australia
  • Chair of Airservices Board
  • Defence Deputy Secretary, Capability Acquisition and Sustainment Group (DEPSEC CASG)
  • Chief of Air Force (CAF)
  • CEO Thales Australia and New Zealand
  • Chair of Thales Group Board
  • Executive Vice President Global Business Unit responsible for Air Traffic Management Business Line.

Meets only in extraordinary circumstances. Had not met as at 1 February 2025.

Purpose is to ensure a cooperative relationship for all levels of the acquisition and support contract, ensure all parties develop the capabilities required and act as a final escalation point for issues that require strategic guidance beyond that provided by the Executive Committee.

Has responsibility to achieve the outcomes of the contract, advise Thales on achieving objectives at agreed contractual price, and maintain and evolve constructive contractual arrangements.

CMATS Executive Committee

  • Airservices Australia CEO
  • Two other members to be nominated by Airservices, one of which must be from Defence
  • CEO Thales Australia and New Zealand
  • Two other members to be nominated by Thales.

Meets quarterly or as required.

Purpose is to provide executive-level leadership of the management of the relationship, strategic guidance on OneSKY program and act as an escalation point for issues that arise from the Program Review Board.

Responsibilities to provide guidance to achieve contractual objective and ensure alignment of goals across the program consistent with the contract.

CMATS Steering Committee

  • Airservices Deputy CEO
  • Defence Head of Air Defence and Space Systems Division (CASG)
  • Thales Vice President Airspace Mobility
  • Vice President Global Business Unit responsible for Air Traffic Management Business line

The November 2024 Project of Concern summit specified that committee comprise representatives at the SES Band 2/2-star military equivalent level (see paragraph 2.15).

Meets monthly.

Airservices advised the ANAO on 17 February 2025 that the purpose of the committee is to provide executive-level guidance, advice and oversight to matters associated with the acquisition contract and to act as an escalation forum for the Program Review Board.

Terms of reference not defined as at 1 February 2025.

Program Review Board

  • no more than three representatives of Airservices (including the Customer Representative, who is Chair)
  • no more than three representatives of Thales (including the Contractor Representative)
  • a Defence representative

Meets monthly.

Purpose is to collaborate and facilitate ongoing discussion and monitoring on contract performance. Manages risks, issues and opportunities associated with contract delivery.

   

Note a: The Board Technology Investment Committee was renamed the Board Technology Committee on 14 November 2023.

Note b: Since 2019 the Change Control Board has sat as a joint board with members comprising Airservices and Defence representatives. Prior to that the OneSKY Change Control Board sat separately to consider contract variations that related to Airservices only and the Joint Change Control Board for those that affected Defence.

Source: ANAO analysis of Airservices documentation and records.

Footnotes

1 Auditor-General Report No. 1 2016–17, Procurement of the International Centre for Complex Project Management to Assist on the OneSKY Australia Program, available from https://www.anao.gov.au/work/performance-audit/procurement-iccpm-onesky-australia-program [accessed 18 March 2025], Auditor-General Report No. 46 2016–17, Conduct of the OneSKY Tender, available from https://www.anao.gov.au/work/performance-audit/conduct-the-onesky-tender [accessed 18 March 2025] and Auditor-General Report No. 4 2019–20, OneSKY: Contractual Arrangements, available from https://www.anao.gov.au/work/performance-audit/onesky-contractual-arrangements [accessed 18 March 2025].

2 Thales provided the ANAO with updates to the data it provided for the audit (see paragraph 3.88).

3 As part of the performance audit process Report Preparation Papers (RPPs) are prepared to outline the evidence, preliminary audit findings and potential audit recommendations. RPPs are not a draft report and are not required to be issued under legislation. They are shared with entities to provide an opportunity for the entity to consider the draft audit findings and provide feedback to the audit team. Further information on the performance audit process can be found on the Australian National Audit Office (ANAO) website at https://www.anao.gov.au/work/insights/performance-audit-process.

4 A corporate Commonwealth entity is a body corporate that is a separate legal entity from the Commonwealth and, while still part of the Australian Government, it can enter into contracts and own property separate from the Commonwealth.

5 The Airservices Act establishes the functions and power of the Board to set the objectives, strategies and policies of Airservices and ensure that it performs its function in a proper, efficient and effective manner.

6 In 2023, Airservices submitted a draft and revised draft proposal to the ACCC to increase its charges and in July 2024 submitted a further amendment proposing a single weighted average 6 per cent price increase. In October 2024, Airservices submitted a formal price notification to the ACCC and the ACCC subsequently released its decision not to object. Airservices submitted the proposal to the Minister for Infrastructure, Transport, Regional Development and Local Government, seeking a decision on the proposed price change. In November 2024 Airservices withdrew its proposal.

7 The OneSKY program was established in response to the 2009 National aviation white paper, which identified benefits from synchronising civil and military air traffic management, and the 2009 Defence white paper, which set out the need for better coordinated air surveillance.

Department of Infrastructure, Transport, Regional Development, Communications, Sports and the Arts, National aviation white paper 2009, Canberra, p. 122, available from https://www.infrastructure.gov.au/department/media/publications/national-aviation-policy-white-paper-2009 [accessed 3 March 2025].

Department of Defence, Defending Australia in the Asia Pacific century: force 2030 — Defence white paper 2009, Canberra, p. 79, available from https://www.defence.gov.au/about/strategic-planning/defence-white-paper [accessed 3 March 2025].

8 CMATS is the integrated IT system, comprising 12 subsystems. CMATS will be deployed at Airservices Brisbane, Airservices Melbourne, Airservices Perth, Airservices Sydney, Naval Air Station Nowra, Royal Australian Air Force (RAAF) Amberley, RAAF Darwin, RAAF East Sale, RAAF Pearce, RAAF Tindal, RAAF Townsville and RAAF Williamtown.

9 Airservices and Defence have extended the contracts with the providers for these systems.

10 The OneSKY program includes other contracts such as with SAAB for the supply and support of replacement tower systems for four regional Defence sites known as Airservices Defence OneSKY Towers (ADOT) and with Frequentis for voice communication systems for the ADOT towers.

11 An integrated baseline review is a formal review of the supplier’s planning on project cost, documentation, schedule and scope against the customer/purchaser’s expectation of the performance of the contract.

12 Under the phased approach agreed in the contract in February 2018 Thales had worked on separate streams in parallel (release zero for Defence sites and release one for Airservices capability). This increased resource demand and split Thales’ staff expertise.

13 The acquisition contract has a target price and a ceiling price (maximum amount to be paid for actual costs plus profit margin); see paragraph 3.33. The ceiling price is $100 million (AUD equivalent) higher than the target price.

The acquisition and support contracts comprise separate Australian dollar and Euro components. Airservices uses a 0.6722 conversion rate as a proxy to convert Euros to Australian dollar equivalent for reporting purposes. The ANAO has applied that rate to convert Euros to calculate the Australian dollar equivalent for figures for this report in respect of the acquisition and support contract. This is shown as ‘AUD equivalent’.

14 The Commonwealth Procurement Rules apply to non-corporate Commonwealth entities and Commonwealth entities prescribed under the Public Governance, Performance and Accountability Rule. As at February 2025, Airservices is not prescribed under the rule.

15 See paragraphs 2.9 and 2.10 for description of contract management roles and responsibilities.

16 The 2021 version was approved by the OneSKY Program Director (who at the time reported to the Program Executive). The 2024 plan was approved by the Head of Transformation — OneSKY.

17 As at March 2025, the Airservices Deputy CEO is responsible for two of Airservices’ eight transformation portfolios — OneSKY and the Western Sydney Airport.

18 The two committees that did not have terms of reference as at February 2025 were the Performance Oversight Meeting, which discusses corporate/operational matters, and the CMATS Steering Committee, which first met in August 2024.

19 A contract (CN3796966) for the review was signed on 22 July 2021. Defence advised the ANAO in February 2025 that Mr Pyke was paid $58,880.25 (including GST) for the review. As at February 2025, Mr Pyke is a fellow at the International Centre for Complex Program Management. He was a lead negotiator in the OneSKY program contract negotiation. See Auditor-General Report No. 1 2016–17, Procurement of the International Centre for Complex Project Management to Assist on the OneSKY Australia Program.

20 The Joint Executive Committee was renamed the Air Navigation Service Providers (ANSP) Steering Committee in response to review recommendations on governance. The terms of reference were updated in March 2024 and signed by Airservices and Defence in July 2024. See Appendix 3 for membership and remit.

21 The Airservices and Defence Surveillance and Response Group are Air Navigation Service Providers providing air navigation services to the Australian Government. The strategic documents describe their responsibilities.

22 The sample excluded the Change Control Board (because its primary role is to provide oversight of contract variations and it does not have a role in broader contract management), the CMATS Steering Committee (first meeting in August 2024) and the OneSKY Strategic Forum (because as at February 2025 it has not met).

23 The OneSKY CMATS risk management plan was updated four times between 2019 and 2024. Key components such as the risk management process remained consistent.

24 Program-level risks relate to events that can impact ‘the program, individual or cross program or management stream as a whole’.

25 The OneSKY program enterprise-wide risk was rated medium from 2019 to May 2023, high from May 2023 to December 2023 and medium from January 2024.

26 This OneSKY program risk is categorised as an enterprise risk in CIRRIS and is a ‘subsidiary risk’ to a change delivery enterprise-wide risk. In January 2024, Airservices established an enterprise-wide ‘change delivery’ risk, which applies across all transformational change portfolios including the OneSKY program and other programs such as Western Sydney Airport.

27 The forum is an operational committee intended to provide assurance on enterprise-wide and program- and project-level risks and issues. It is chaired by the Head of Transformation OneSKY.

28 Customer-furnished materials are goods or services provided to Thales for the delivery of CMATS.

29 Auditor-General Report No. 20 2024–25, 2023–24 Major Projects Report, ANAO, Canberra, 2024, p. 287, available from https://www.anao.gov.au/work/major-projects-report/2023-24-major-projects-report [accessed 7 February 2025].

30 The on-supply agreement also covers the on-supply for other contracts under the OneSKY program — for example, the provisions of Airservices Defence OneSKY Towers (ADOT). See footnote 10.

31 Auditor-General Report No. 20 2024–25, 2023–24 Major Projects Report, Part 3. Project Data Summary Sheets, Canberra, p. 295.

32 In the request for tender, Airservices set out its expectation that the acquisition contract would be executed in April 2015. The contract was executed in February 2018. See Auditor-General Report No. 4 2019–20, OneSKY: Contractual Arrangements for discussion on the delay.

33 A Project of Interest is a project that Defence considers to be underperforming and in need of senior management attention and close monitoring to prevent it from deteriorating to a Project of Concern.

34 The ANAO 2023–24 Major Projects Report covered the delay in adding CMATS to the Projects of Concern list. It reported that in September 2021 the Minister for Defence made a written direction that CMATS be returned to the list. Defence did not update internal reporting in response to that direction. On 27 October 2022 the Minister for Defence Industry declared CMATS a Project of Concern via a media release on Projects of Concern, available from https://www.minister.defence.gov.au/media-releases/2022-10-27/update-projects-concern [accessed 20 February 2025].

Auditor-General Report No. 14 2023–24, 2022–23 Major Projects Report, Part 1. ANAO Review and Analysis, Canberra, p. 30, available from https://www.anao.gov.au/work/major-projects-report/2022-23-major-projects-report [accessed 20 February 2025].

35 Defence advised the ANAO on 5 February 2025 that the remediation plan must be approved by the Defence delivery division head — for CMATS this is the Head Air Defence and Space Systems Division. The Head Air Defence and Space Systems Division approved the remediation plan and the updated version.

36 The on-supply agreement (OSA) sets out payments in separate Australian dollar, Euro and US dollar components (the US dollar component applies to work with SAAB on ADOT). For the purpose of the on-supply agreement, the exchange rate used for Euros to Australian dollars is 0.6722 and for US dollars to Australian dollars is 0.7353. The on-supply agreement provides figures in ‘AUD equivalent’. The ANAO presents these figures from the on-supply agreement as ‘OSA AUD equivalent’.

37 Defence advised the ANAO on 31 March 2025 that it uses accrual accounting to report expenditure to date and reports its annual accrued expenditure in the Major Projects Report. For example, see Auditor-General Report No. 20 2024–25, 2023–24 Major Projects Report.

From 2019 to 2024 (excluding 2023), Airservices received payments from Defence in excess of the amount Airservices had allocated to the costs it incurred for Defence’s share of the work conducted by Thales under the CMATS acquisition contract. Airservices has captured this in its annual reports 2019–20 to 2023–24. In 2023 Defence paused payments to Airservices under the on-supply agreement while Thales paused invoicing of Airservices (see paragraphs 3.43 to 3.45). Auditor-General Report No. 20 2024–25, 2023–24 Major Projects Report, ANAO, Canberra, 2024, p. 288, available from https://www.anao.gov.au/work/major-projects-report/2023-24-major-projects-report [accessed 1 April 2025].

38 Department of Finance, Australian Government Contract Management Guide, p. 2.

39 In September 2024 the Airservices Board noted the support contract value of $245 million, with Airservices’ share being $138 million (Airservices and Defence have agreed to cost sharing arrangements for support costs associated with CMATS, with costs to be shared equally). Airservices advised the ANAO on 17 December 2024 that the budget for the support contract is prepared and approved as part of Airservices’ annual corporate budget allocation process (outside of the OneSKY program budget) for a period of five years.

40 A single variation can implement more than one contract change. For example, delivery schedule change was the primary driver of three variations and a factor in nine variations. Examples of administrative change were to correct drafting errors and update the schedule of subcontractors. Technical changes included establishing a functional baseline and rationalising interfaces (interactions between different software components).

41 This KPI is a measure of the number and impact of scope requirements that have been added, deleted or modified, noting that scope change can significantly impact program cost and schedule.

42 Airservices and Thales agree on preparation costs when Airservices submits a formal request to Thales to prepare the contract change proposal and is subject to a ‘not-to-exceed’ amount. Contract variation preparation costs are covered by ‘problem resolution services’ under the contract that allow for payment for problem identification, reporting and rectification services.

43 Airservices advised the ANAO on 14 March 2025 that Thales had yet to invoice for preparation costs for contract variations past 30 June 2024.

44 For the remaining four variations, the Change Control Board did not review three because they were developed before its role in reviewing contract variations was established on 30 September 2019. Airservices advised the ANAO in December 2024 that one variation was time critical and the Change Control Board was unable to meet to review it so it was processed without endorsement.

45 The OneSKY Program Executive reports to the Chief Executive Officer. This variation was an administrative update, executed on 16 August 2018, and Airservices and Thales had agreed when signing the contract in February 2018 to execute this change.

46 This approach was approved on 20 July 2023 by the Air Navigation Service Provider Steering Committee (see Appendix 3).

47 Airservices issued the negotiation team (comprising OneSKY Program Executives from Airservices and Defence) with a negotiation directive covering conduct and limitation of their authority. Airservices provided negotiators with a probity briefing.

48 Airservices engaged Ngamuru Advisory (Contract CW48576, 27 June 2022 to 25 August 2023, $135,750) to assess value for money for the Project of Concern remediation plan. In August 2023 Ngamuru advised that ‘it would be open to an Airservices delegate to agree’ to the remediation plan and contract change proposal because it did not increase the target price; it improved confidence in Thales delivering the project; continuing without the remediation plan may have led to a contractual dispute, further delays and financial and non-financial costs; and a viable alternative to achieve the capability and national harmonisation was not available.

49 The original system acceptance dates of July 2024 for release one and February 2025 for release two had been amended via contract variations to January 2027 and July 2027 before CMATS was listed as a Project of Concern.

50 Airservices engaged Altura Partners (Contract CW58082, 26 September 2024 to 31 March 2025, $62,940) to prepare its updated business case.

51 Defence is not subject to these arrangements and pays Airservices amounts owing up to its CMATS program contribution of $564 million, including any amounts resulting from contract variations to the on-supply agreement (see paragraph 2.62).

52 The bonus will be paid at the relevant cost checkpoint milestones (see paragraph 3.39). The margin will be paid at milestones.

53 The standstill deed and delivery strategy variation (approved in December 2023) set out the payment arrangements from 1 November 2023. Airservices has paid Thales indirect costs incurred from February 2023 as part of milestone payments. Should Thales’ incurred actual costs exceed the target cost but remain below the ceiling cost, Airservices will reimburse its indirect costs in payments every two months rather than in milestone payments.

54 AUD equivalent as converted by Airservices.

55 A ledger event impacts on the performance of the acquisition contract and may entitle Thales to an extension of time or otherwise delay performance of the work under the acquisition contract.

56 Results for the three security KPIs were not available because targets had not been set for two and the other was an annual measure. The next reporting is expected in October 2025.

57 Thales requested that these milestones be combined due to an increase in engineering change requests following the implementation of the revised delivery strategy. As at 31 December 2024 the contract variation to formalise this had not been executed.

58 A cost management remediation plan is used to demonstrate the strategies put in place by Thales to effectively manage actual costs incurred if the milestone cost checkpoint is exceeded.

59 Milestone 12: Test Readiness Review (TRR) for System Verification (SV) release zero was expected to be delivered on 31 August 2021; Milestone 13: Task Analysis Requirements Review (TARR) release zero on 26 July 2021; and Milestone 15: Software Specification Review (SSR) release one Batch 1 on 26 February 2021.

60 The COVID-19 variation was executed on 14 December 2021 in response to the impact of COVID-19 restrictions on Thales’ productivity. Airservices agreed to remove $19 million (AUD equivalent as calculated by Airservices) it had paid Thales in actual costs from the total target cost. This variation did not increase target or ceiling price in the contract but added four months delay.

61 Department of Finance, Australian Government Contract Management Guide, p. 18.

62 Airservices had a separate probity plan and protocols for the CMATS procurement process.

63 This includes Defence program officials who require access to the portals.

64 The probity officer has a role in ensuring OneSKY program probity best practice, which includes assessing probity declarations for clearance and managing conflicts of interest.

65 The probity plan outlines the requirement that probity declarations be refreshed annually. It does not reference the requirement for officials to submit a new declaration where it has been more than three years since their last refresh.

66 Airservices holds the probity declarations submitted by program officials in a document library. Probity-cleared program officials can only view their own listed probity declaration in the library.

67 In 2024, the Joint Committee of Public Accounts and Audit recommended that the ANAO when auditing entities with respect to gifts and hospitality should consider obtaining information from private sector entities that contract to the Commonwealth. JCPAA, Inquiry into procurement at Services Australia and the NDIA, June 2024, Canberra, available from https://www.aph.gov.au/Parliamentary_Business/Committees/Joint/Public_Accounts_and_Audit/SAandNDIA/Final_Report [accessed 31 March 2025].

68 One of the 21 instances identified in paragraph 3.85 was listed in Thales’ gifts and benefits register. The ANAO has not tested the data from Thales.