Audit snapshot

Why did we do this audit?

  • This audit is one of five performance audits conducted under phase one of the ANAO’s multi-year strategy that focuses on the effective, efficient, economical and ethical delivery of the Australian Government’s response to the COVID-19 pandemic.
  • The rapid implementation of COVID-19 economic response measures created new and increased risks for the Australian Taxation Office (ATO) to effectively identify, consider and manage.
  • Risks may arise from workforce redeployment, IT system development and data integrity, stakeholder engagement and coordination, adapting service delivery, potential internal and external fraud, and non-compliance with regulatory requirements.

Key facts

  • Nearly $70 billion in JobKeeper payments had been disbursed as at 1 November 2020.
  • Over 800,000 businesses had been credited with cash flow boosts totalling $30.28 billion as at 20 October 2020.
  • Over 2.8 million individuals had applied for early release of superannuation as at 30 September 2020.

What did we find?

  • The ATO has been effective in managing risks related to the rapid implementation of COVID-19 economic response measures.
  • The ATO undertook appropriate planning to support the rapid implementation of the six economic response measures — predominantly using its existing systems and processes to support governance, resourcing, and consultation.
  • The ATO’s risk documentation evidences its priority of implementing the measures in a timely manner, while also managing fraud and other integrity risks on a progressive basis.

What did we recommend?

  • The Auditor-General made no recommendations but identified key messages for Australian Government entities to consider in identifying and responding to the challenges and risks associated with the rapid implementation of initiatives.

$101.3 billion

Total forecasted cost of the JobKeeper scheme

Over 10,000

ATO staff members reassigned duties to support the six economic response measures

4 to 6 weeks

The time period between announcement and implementation for three of the six measures

Summary

Background

1. Since its emergence in late 2019, coronavirus disease 2019 (COVID-19) has become a global pandemic that is impacting on human health and national economies. From February 2020, the Australian Government commenced the introduction of a range of policies and measures in response to the emergence of COVID-19 that included:

  • travel restrictions and international border control and quarantine arrangements;
  • delivery of substantial economic stimulus, including financial support for affected individuals, businesses and communities; and
  • support for essential services and procurement of critical medical supplies.

2. The Australian Taxation Office (ATO) is responsible for implementing and administering six measures as part of the Australian Government’s economic response to the COVID-19 pandemic (Box 1).

Box 1: COVID-19 economic response measures implemented and administered by the ATO

1. Enhancing the Instant Asset Write-Off — from 12 March to 31 December 2020a, businesses with aggregated turnover of less than $500 million can access an immediate tax deduction through their 2019–20 or 2020–21 tax returns for certain depreciating assets purchased for less than $150,000.

2. Backing Business Investment — businesses with aggregated turnover of less than $500 million can access an accelerated rate of depreciation for certain new assets, provided the asset is first held and used or ready for use between 12 March 2020 and 30 June 2021.

3. Boosting Cash Flow for Employers — small and medium-sized businesses and not-for-profit organisations with aggregated turnover under $50 million who employ staff are eligible to receive credits totalling between $20,000 and $100,000 when they lodge their activity statements for tax periods from March 2020 through to and including the September 2020 period.

4. Early Release of Superannuation — eligible individuals affected by COVID-19 could access up to $10,000 of their superannuation in 2019–20 and a further $10,000 in 2020–21. Eligible temporary visa holders were eligible to access up to $10,000 of their superannuation in 2019–20.

5. Temporary Reduction of Superannuation Minimum Drawdown Rates — for 2019–20 and 2020–21, the superannuation minimum drawdown requirements for account-based pensions and similar products have been reduced by 50 per cent.

6. JobKeeper scheme — the JobKeeper Payment is a wage subsidy (paid in arrears) designed to help businesses affected by COVID-19 to cover the costs of their employees’ wages, so that more employees can retain their job and continue to earn an income.

Note a: The government announced an extension to this measure on 6 October 2020 (see Box 3).

Source: ANAO, based on public records and the ATO’s records.

3. The six measures were announced and implemented over the period from 12 March to 1 July 2020.1

Rationale for undertaking the audit

4. The COVID-19 pandemic and the pace and scale of the Australian Government’s response impacts on the risk environment faced by the Australian public sector. This audit is one of five performance audits conducted under phase one of the ANAO’s multi-year strategy that will focus on the effective, efficient, economical and ethical delivery of the Australian Government’s response to the COVID-19 pandemic.

5. The ATO is playing a significant role in supporting the Australian Government’s economic response to the COVID-19 pandemic. An early stage audit examining the ATO’s risk management arrangements will inform ongoing administration of the measures, including strategies to support the integrity of the measures.

Audit objective and criteria

6. The objective of the audit was to assess whether the ATO has effectively managed risks related to the rapid implementation of COVID-19 economic response measures.

7. The three high-level criteria were:

  • Was appropriate planning undertaken for rapid implementation?
  • Were changes in the ATO’s risk environment appropriately assessed, documented and communicated?
  • Have identified risks been effectively managed, monitored and reviewed?

Conclusion

8. The ATO has been effective in managing risks related to the rapid implementation of COVID-19 economic response measures.

9. The ATO undertook appropriate planning to support the rapid implementation of the six economic response measures — predominantly using its existing systems and processes to support governance, resourcing, and consultation.

10. In implementing the six economic response measures, the ATO assessed, documented and communicated changes in its risk environment in an appropriate manner. The ATO’s risk documentation evidences its priority of implementing the measures in a timely manner, while also managing fraud and other integrity risks on a progressive basis.

11. The ATO has established effective arrangements to monitor identified risks and associated risk mitigation strategies through the project management and governance structures established for the six economic response measures. The ATO has commenced planning for the further adjustment of existing operations in line with changed circumstances and risks.

Supporting findings

Planning for rapid implementation

12. The ATO implemented fit-for-purpose governance and oversight arrangements for the six economic response measures, drawing on existing bodies and frameworks where it could, and introducing specific and additional structures where needed.

13. The ATO followed a sound process to identify and obtain required resources and capabilities to support the rapid implementation of the six economic response measures, and to understand the impacts on its business-as-usual activities. The ATO identified constraints and developed responses to address staffing and ICT capability requirements to deliver the measures.

14. The ATO consulted with government entities and external stakeholders during the implementation of the six economic response measures — generally leveraging its existing relationships and arrangements. The ATO’s strategies for managing identified shared risks were not documented consistently.

Identifying risks and impacts

15. The ATO identified new and changing risks, including to existing operations. The ATO adopted an iterative approach to identifying risks at a project and program level that was fit-for-purpose.

16. The ATO identified risk tolerances, controls and treatment strategies. Risks associated with the implementation of the six economic response measures were assessed to be within tolerance, to be managed by identified controls, with the exception of integrity risks where the need for additional treatment strategies was identified. Aspects of the ATO’s approach to determining risk tolerances could have been better documented to support risk-informed decision-making.

17. The ATO informed government decision-makers of risks, mitigation strategies and broader impacts through a variety of operationally focused briefs, submissions and reports.

Monitoring identified risks

18. The ATO has progressively developed and commenced the implementation of treatment strategies for fraud and compliance risks associated with the economic response measures.

19. The ATO has appropriately monitored identified risks and strategies. At August 2020, the ATO had revised Risk Assessment and Treatment Plans for four measures. A range of monitoring activities have been undertaken at a project level for all six measures.

20. The ATO has reviewed business arrangements in line with changed circumstances and risks. Future state strategic planning has commenced, including for the adjustment of pre-existing arrangements for debt and lodgment.

Australian Taxation Office summary response

21. The ATO’s summary response to the audit is provided below, while its full response is reproduced at Appendix 1.

The ATO welcomes this review and considers the report supportive of our approach to managing risks related to the rapid implementation of COVID-19 economic response measures. This rapid implementation, particularly in an operational environment impacted by COVID-19, prompted a significant review of the minimum viable products that support new measures. This enabled the economic response measures to be implemented within weeks, where the typical timeline for these types of activities would be at least 6–12 months.

In finding the ATO effective in managing risks related to the rapid implementation of the economic response measures, we do support the suggestions made within the key messages and will be reviewing these opportunities for improvement within our future risk management processes. In particular, the ATO had already recognised shared risk and risk tolerance to be two areas that could be further enhanced to better support our overall risk management practices within the organisation.

Key messages from this audit for all Australian Government entities

Below is a summary of key messages, including instances of good practice, which have been identified in this audit and may be relevant for the operations of other Australian Government entities.

Governance and risk management

1. Background

Introduction

1.1 Since its emergence in late 2019, coronavirus disease 2019 (COVID-19) has become a global pandemic that is impacting on human health and national economies. On 21 January 2020 the Australian Government listed COVID-19 as a disease of pandemic potential under the Biosecurity Act 2015.2 The World Health Organisation declared COVID-19 to be a ‘public health emergency of international concern’ on 30 January 2020.

1.2 From February 2020, the Australian Government commenced the introduction of a range of policies and measures in response to the emergence of COVID-19. On 18 March 2020, in response to the pandemic in Australia, the Governor-General of the Commonwealth of Australia declared that a human biosecurity emergency exists.3

1.3 The Australian Government’s health and economic response has included:

  • travel restrictions and international border control and quarantine arrangements;
  • delivery of substantial economic stimulus, including financial support for affected individuals, businesses and communities; and
  • support for essential services and procurement of critical medical supplies.

1.4 With the release of the 2020–21 Budget on 6 October 2020, the Australian Government reported it had committed $507 billion in overall support since the onset of the pandemic, including $272 billion over five years (2019–20 to 2023–24) in direct economic and health support.

1.5 Risks in relation to the rapid development and implementation of major new measures may arise from workforce redeployment, IT system development and data integrity, stakeholder engagement and coordination, adapting service delivery, potential internal and external fraud, and non-compliance with regulatory requirements.

Key Commonwealth requirements on risk management

1.6 Under the Public Governance, Performance and Accountability Act 2013 (PGPA Act), the accountable authority must establish and maintain:

  • an appropriate system of risk oversight and management for the entity; and
  • an appropriate system of internal control for the entity; including by implementing measures directed at ensuring officials of the entity comply with the finance law.4

1.7 This legislative requirement is supported by the Commonwealth Risk Management Policy, which sets out nine elements that non-corporate Commonwealth entities must comply with in order to establish an appropriate system of risk oversight and management (Box 2).5

Box 2: The nine elements of the Commonwealth Risk Management Policy

  • Establishing a risk management policy
  • Establishing a risk management framework
  • Defining responsibility for managing risk
  • Embedding systematic risk management into business processes
  • Developing a positive risk culture
  • Communicating and consulting about risk
  • Understanding and managing shared risk
  • Maintaining risk management capability
  • Reviewing and continuously improving the management of risk

Source: Reproduced from the Commonwealth Risk Management Policy (1 July 2014).

1.8 The stated goal of the Commonwealth Risk Management Policy is to embed risk management as part of the culture of Commonwealth entities where the shared understanding of risk leads to well informed decision making.

Economic response measures administered by the ATO

1.9 The Australian Taxation Office (ATO) is a non-corporate Commonwealth entity within the Treasury portfolio. Under the PGPA Act, the accountable authority of the ATO is the Commissioner of Taxation. The responsibilities of the ATO includes the administration of legislation governing tax, superannuation and the Australian Business Register, and supporting the delivery of government benefits to the community. The ATO has a workforce comprising just over 21,000 staff (as at 30 June 2020). The ATO is structured into five main groups — Client Engagement, Law Design and Practice, Service Delivery, Enterprise Solutions and Technology, and Enterprise Strategy and Corporate Operations.

1.10 The ATO is responsible for implementing and administering six measures as part of the Australian Government’s economic response to the COVID-19 pandemic (Table 1.1).

Table 1.1: Overview of the six economic response measures administered by the ATO

Measure

Summary of the measure

Uptake and cost

Enhancing the Instant Asset Write-Off

For the period from 12 March to 31 December 2020a, businesses with aggregated turnover of less than $500 million (previously $50 million) can access an immediate tax deduction through their 2019–20 or 2020–21 tax returns for certain depreciating assets purchased for less than $150,000 (previously $30,000).

Together with the Backing Business Investment measure (see below), this measure was designed to support business sticking with investment they had planned, and encouraging them to bring investment forward to support economic growth over the short term.

The measure announced on 12 March 2020 is estimated to reduce revenue by $700 million over the forward estimates period. The extension to the measure announced on 9 June 2020 is estimated to reduce revenue by $300 million over the forward estimates period.

Backing Business Investment

Businesses with aggregated turnover of less than $500 million can access an accelerated rate of depreciation for certain new assets, provided the asset is first held and used or ready for use between 12 March 2020 and 30 June 2021.

Businesses can deduct 50% of the cost of an eligible asset on installation, with existing depreciation rules applying to the balance of the asset’s cost. Deductions are claimed through 2019–20 or 2020–21 tax returns.

This measure is estimated to have a cost of $3.2 billion over the forward estimates period.

Boosting Cash Flow for Employers

Small and medium-sized businesses and not-for-profit organisations with aggregated turnover under $50 million who employ staff are eligible to receive credits totalling between $20,000 and $100,000 when they lodge their activity statements for tax periods from March 2020 through to and including the September 2020 period. The amount provided is automatically credited against PAYG withholding and GST due in these quarters, with any excess credit paid directly to the business as a refund.

The cash flow boosts are provided in two phases. Eligible businesses received the first cash flow boost for the March to June 2020 periods. These payments equate to 100% of the tax withheld on their employees’ salary and wages in this period. The minimum initial payment was $10,000 and the maximum initial payment $50,000.

Businesses who received an initial cash flow boost will receive an additional cash flow boost for the June to September 2020 tax periods. The total additional cash flow boost received will equal the total initial cash flow boost received and will be paid in equal instalments across the June to September 2020 tax periods.

801,660 businesses credited with an initial cash flow boost (as at 20 October 2020).

$30.28 billion credited (as at 20 October 2020).

$7.92 billion excess credits paid as a refund (as at 20 October 2020).

Early Release of Superannuation

Eligible individuals affected by COVID-19 could access up to $10,000 of their superannuation in 2019–20 and a further $10,000 in 2020–21. Individuals will not need to pay tax on amounts released and the money they withdraw will not affect Centrelink or Veterans’ Affairs payments.

Eligible temporary visa holders were eligible to access up to $10,000 of their superannuation in 2019–20.

2,873,608 individual applicants (as at 30 September 2020).

$35.6 billion approved for release (as at 30 September 2020).

Temporary Reduction of Superannuation Minimum Drawdown Rates

For 2019–20 and 2020–21, the superannuation minimum drawdown requirements for account-based pensions and similar products have been reduced by 50%. For instance, the minimum drawdown requirement for a retiree between 65–74 years old was reduced from 5% per annum to 2.5%.

This measure is aimed at benefiting retirees by providing them with more flexibility as to how they manage their superannuation assets.

The nature of this measure is such that a reliable estimate of financial impact was not included in the Explanatory Memorandum.b

JobKeeper schemec

The JobKeeper Payment is a wage subsidy (paid in arrears) designed to help businesses affected by COVID-19 to cover the costs of their employees’ wages, so that more employees can retain their job and continue to earn an income.

For the first phase of the scheme, from 30 March to 27 September 2020, payments of $1500 per fortnight per employee were available to eligible employers. The payments are made to the employers monthly in arrears by the ATO.

For the second phase of the scheme, payments change to $1200 per fortnight from 28 September 2020 to 3 January 2021, and to $1000 per fortnight from 4 January 2021 to 28 March 2021. Lower payment rates apply to employees working less than 20 hours per week.

1,051,338 applications from businesses (as at 1 November 2020).

3,549,895 employees and eligible business participants subsidised (based on September reporting period).

$69.6 billion in payments disbursed (as at 1 November 2020).

     

Note: The ATO informed the ANAO that the introduction of the 2020–21 Budget measure, JobMaker Plan — temporary full expensing to support investment and jobs (see Box 3), is likely to reduce the uptake and cost of Enhancing the Instant Asset Write-Off and Backing Business Investment measures over the forward estimates period.

Note a: The government announced an extension to this measure on 6 October 2020 (see Box 3).

Note b: See page 13 of the Explanatory Memorandum, available at: https://www.legislation.gov.au/Details/C2020B00036/Explanatory%20Memorandum/Text [accessed 6 October 2020].

Note c: On 22 May 2020, the Department of the Treasury and the ATO issued a joint statement advising of a reporting error in estimates of the number of employees likely to access the JobKeeper scheme. The statement advised that Treasury’s revised estimate of the cost of the JobKeeper scheme is around $70 billion (not $130 billion).

Source: ANAO, based on public records and the ATO’s records.

Announcement, legislation and implementation timeframes

1.11 The six economic response measures were announced, legislated and implemented between 12 March and 1 July 2020. Key implementation milestones are listed in Figure 1.1.

Figure 1.1: Key implementation milestones for the six economic response measures administered by the ATO

A timeline showing the key implementation milestones for the six economic response measures administered by the ATO.

Source: ANAO, based on public records and the ATO’s records.

1.12 All six measures required legislation to be passed in the Parliament of Australia. The six measures were contained in three pieces of legislation:

  • the Coronavirus Economic Response Package Omnibus Act 2020, which provides for Enhancing the Instant Asset Write-Off, Backing Business Investment, Early Release of Superannuation, and Temporary Reduction of Superannuation Minimum Drawdown Rates, and consequential amendments to enable Boosting Cash Flow for Employers;
  • the Boosting Cash Flow for Employers (Coronavirus Economic Response Package) Act 2020, which provides for the named measure; and
  • the Coronavirus Economic Response Package (Payments and Benefits) Act 2020, which provides for the Treasurer to make rules relating to economic response payments.
    • On 9 April 2020, the Treasurer made rules for the JobKeeper scheme, which were set out in a legislative instrument called the Coronavirus Economic Response Package (Payments and Benefits) Rules 2020.

1.13 The period between announcement and implementation was between four to six weeks for three measures — JobKeeper, Boosting Cash Flow for Employers, and Early Release of Superannuation.

Subsequent announcements

1.14 Since the six measures were originally announced and legislated, the Australian Government has announced a number of further changes to some measures, particularly JobKeeper (Box 3).

Box 3: Announced changes to the economic response measures

  • On 8 June 2020, the Australian Government announced that JobKeeper would cease for the childcare sector from 20 July 2020.
  • On 9 June 2020, the Australian Government extended the timeframe for Enhancing the Instant Asset Write-Off measure by six months to 31 December 2020 (from 30 June 2020).
  • On 21 July 2020, following a review of JobKeeper by the Department of the Treasury, the Australian Government announced an extension of JobKeeper by six months until 28 March 2021 (from 27 September 2020) as well as changes to payment tiers and other arrangements. The announced changes were expected to cost an additional $16.6 billion.
  • On 23 July 2020, the Australian Government announced an extension to the application period for the Early Release of Superannuation measure from 24 September to 31 December 2020. The announcement was made as part of the Australian Government’s Economic and Fiscal Update.
  • On 7 August 2020, the Australian Government announced adjustments to JobKeeper to assist more businesses to qualify for JobKeeper.
  • On 6 October 2020, as part of the 2020–21 Budget, the Australian Government announced a new measure, JobMaker Plan — temporary full expensing to support investment and jobs, allowing businesses with aggregated annual turnover of less than $5 billion to deduct the full cost of eligible depreciating assets of any value in the year they are first held, and first used or installed ready for use. The incentive is available from 6 October 2020 to 30 June 2022. Full expensing also applies to the cost of improvements to existing eligible depreciating assets. The timeframe for Enhancing the Instant Asset Write-Off measure was also extended by six months to 30 June 2021.

Note: As at 25 November 2020 all of the announced changes had been legislated.

Source: ANAO, based on public records.

1.15 In his opening statement to the Parliament of Australia’s Senate Select Committee on COVID-19 on 7 May 2020, the Commissioner of Taxation articulated the ATO’s approach to administering the economic response measures as follows:

In response to COVID-19, the ATO has pivoted our focus to ensure the efficient rollout of the five key measures, in particular the JobKeeper payments, early release of superannuation, cash flow boost, increasing the instant asset write-off, and accelerated depreciation. Our priority has been to deliver on the government’s commitment to get millions of Australians access to financial support quickly and as easily as possible during this difficult time.6

The ATO’s risk management policy and Enterprise Risk Management Framework

1.16 The ATO’s risk management policy is set out in a Chief Executive Instruction on Risk Management.7

1.17 The ATO’s Enterprise Risk Management Framework (ERMF) is an overarching document that sets out how the ATO addresses requirements under the PGPA Act, the Commonwealth Risk Management Policy, and in accordance with AS ISO 31000:2018.8

1.18 As illustrated in Figure 1.2, the ATO’s ERMF is built on four pillars — governance, informing decisions, culture, and data-driven insights. The ERMF includes a four-step methodology to support the identification and management of risks.

Figure 1.2: The ATO’s Enterprise Risk Management Framework and risk methodology

A diagram showing the ATO’s Enterprise Risk Management Framework and risk methodology.

Source: Reproduced from the ATO’s Enterprise Risk Management Framework (Version 1.3, 24 April 2020).

1.19 The ATO’s ERMF is supported by a number of guidance documents and tools, including a Risk Management Guide9, a Shared Risk Guide, a Risk Tolerance Guide, and various templates such as the Risk Assessment and Treatment Plan template.

1.20 The ATO’s ERMF distinguishes between three levels of risk — strategic, enterprise, and business — and sets out the responsibilities for managing risks across the ATO. This includes defining roles for the Commissioner of Taxation, various committees (such as the Enterprise Risk Management Committee, and the Audit and Risk Committee), a Chief Risk Officer supported by a Corporate Risk and Assurance Branch, as well as individual risk owners and risk managers.

Rationale for undertaking the audit

1.21 The COVID-19 pandemic and the pace and scale of the Australian Government’s response impacts on the risk environment faced by the Australian public sector. This audit is one of five performance audits conducted under phase one of the ANAO’s multi-year strategy that will focus on the effective, efficient, economical and ethical delivery of the Australian Government’s response to the COVID-19 pandemic.10

1.22 The ATO is playing a significant role in supporting the Australian Government’s economic response to the COVID-19 pandemic. An early stage audit examining the ATO’s risk management arrangements will inform ongoing administration of the measures, including strategies to support the integrity of the measures.

Audit approach

Audit objective, criteria and scope

1.23 The objective of the audit was to assess whether the ATO has effectively managed risks related to the rapid implementation of COVID-19 economic response measures.

1.24 The three high-level criteria were:

  • Was appropriate planning undertaken for rapid implementation?
  • Were changes in the ATO’s risk environment appropriately assessed, documented and communicated?
  • Have identified risks been effectively managed, monitored and reviewed?

1.25 The scope of the audit focused on the six economic response measures, announced in March 2020, and the impact of those measures on the ATO’s existing operations.

Audit methodology

1.26 The audit methodology involved:

  • document examination, including the ATO’s advice on implementation matters to government and other entities, governance committee agendas and minutes, project material, and information recorded in the ATO’s Enterprise Risk Register; and
  • interviews with ATO staff, including the Chief Risk Officer, the project leads for the economic response measures, and members of governance and oversight committees.

1.27 The audit did not include an assessment of the design, effectiveness or outcomes of the six measures.

1.28 The audit was conducted in accordance with ANAO Auditing Standards at a cost to the ANAO of approximately $437,000.

1.29 The team members for this audit were Michael McGillion, Amanda Reynolds, Chay Kulatunge and Mark Rodrigues.

2. Planning for rapid implementation

Areas examined

This chapter examines whether the Australian Taxation Office (ATO) undertook appropriate planning to support the rapid implementation of the six economic response measures.

Conclusion

The ATO undertook appropriate planning to support the rapid implementation of the six economic response measures — predominantly using its existing systems and processes to support governance, resourcing, and consultation.

2.1 To form a view on the ATO’s planning to support the rapid implementation of the six economic response measures, this chapter examines whether the ATO:

  • established suitable governance and oversight arrangements for the six measures;
  • followed a sound process to identify and obtain required resources and capabilities for the six measures; and
  • undertook consultation with government entities and external stakeholders, including on shared risks.

Were suitable governance and oversight arrangements implemented?

The ATO implemented fit-for-purpose governance and oversight arrangements for the six economic response measures, drawing on existing bodies and frameworks where it could, and introducing specific and additional structures where needed.

2.2 The Commonwealth Risk Management Policy includes a number of requirements in relation to the governance and oversight of entity risks, in particular that:

  • the accountable authority of an entity must define the responsibility for managing risk, including by defining entity roles and responsibilities in managing individual risks; and
  • each entity must ensure that the systematic management of risk is embedded in key business processes, including in the establishment of governance arrangements.

2.3 The Commonwealth Risk Management Policy defines ‘risk oversight’ as the ‘supervision of the risk management framework and risk management process’.

2.4 The policy requirements in relation to risk governance and oversight arrangements are reflected in the ATO’s Enterprise Risk Management Framework, and in the ATO’s Chief Executive Instruction on Risk Management.

Responsibilities for managing risk

2.5 As discussed in paragraph 1.20, the ATO’s Chief Executive Instruction on Risk Management refers to two key roles responsible for managing individual risks. The ‘risk owner’ is personally accountable for an identified risk, and is responsible for setting risk tolerance and overseeing risk management activities in relation to that risk. The ‘risk manager’ supports the risk owner by managing the risk under the risk owner’s direction, and escalating emerging risks to the risk owner for consideration.

2.6 As shown in Table 2.1, the corporate Risk Assessment and Treatment Plans (discussed further in paragraph 3.14) for four of the six measures identified the Senior Accountable Officer (see paragraph 2.11) as the risk owner, and the project manager as the risk manager. The remaining two measures identified the supervisor of the Senior Accountable Officer11 as the risk owner, and the Senior Accountable Officer as the risk manager.

Table 2.1: Identified risk owners and risk managers for the six economic response measures

Measure

Measure risk owner(s)

Measure risk manager(s)

JobKeeper scheme

  • The Senior Accountable Officer, Deputy Commissioner, JobKeeper Payment Program (SES Band 2)
  • The SES Program Lead, Assistant Commissioner, JobKeeper Payment Program (SES Band 1)

Boosting Cash Flow for Employers

  • The Senior Accountable Office, A/g Deputy Commissioner Superannuation and Employer Obligations (SES Band 2)
  • The SES Sponsor, Assistant Commissioner Superannuation and Employer Obligations (SES Band 1)
  • The Program Lead (EL2)
  • The Program Governance Stream Lead (EL2)
  • The PAYGW Risk Manager (EL2)

Early Release of Superannuation

  • The Senior Accountable Officer, A/g Deputy Commissioner Superannuation and Employer Obligations (SES Band 2)
  • The SES Sponsor, Assistant Commissioner Superannuation and Employer Obligations (SES Band 1)
  • The Program Lead (EL2)

Backing Business Investment

  • The Senior Accountable Officer, Assistant Commissioner Public Groups and International (SES Band 1)
  • The Project Manager (EL1)

Enhancing the Instant Asset Write-Off

  • The immediate supervisor, Deputy Commissioner, Small Business (SES Band 2) of the Senior Accountable Officer
  • The Senior Accountable Officer, Assistant Commissioner Small Business (SES Band 1)

Temporary Reduction of Superannuation Minimum Drawdown Rates

  • The immediate supervisor, A/g Deputy Commissioner Superannuation and Employer Obligations (SES Band 2) of the Senior Accountable Officer
  • The Senior Accountable Officer, A/g Assistant Commissioner Superannuation and Employer Obligations (SES Band 1)
     

Note: ‘SES’ is a Senior Executive Service officer, ‘EL’ is an Executive Level officer.

Source: ANAO, based on the ATO’s records.

2.7 Supporting the risk owners and risk managers nominated at a whole-of-measure level, the ATO identified officers who would be responsible for managing one or more project-level risks recorded in the project risk register for three measures (JobKeeper, Early Release of Superannuation and Boosting Cash Flow for Employers).12 The officers were recorded in the risk registers as ‘risk owners’ for these subordinate risks.

2.8 As well as identifying risk owners for each measure, the ATO had previously identified the Deputy Commissioner, Integrated Compliance as the risk owner for enterprise risks associated with external fraud and serious and organised crime, and recorded this detail on the Enterprise Risk Register. On 9 April 2020 the Deputy Commissioner, Integrated Compliance assigned four SES Band 1 officers, each supported by an EL2 officer, to develop strategies to mitigate risks to the integrity of the tax and superannuation system specifically stemming from the economic response measures. Five of the six Risk Assessment and Treatment Plans listed SES officers from Integrated Compliance under ‘other risk owners, managers or contacts’.

Project management and governance

2.9 The ATO has an established methodology, process and set of governance arrangements associated with the implementation of new policy and law measures where the ATO is responsible for administering implementation, either whole or in part.

2.10 The ATO adjusted its existing project management framework for new policy measures, with the purpose of providing a ‘streamlined approach to governance’ for the six measures. This approach involved reducing the number of ‘gates’ through which each project had to pass compared to the ATO’s established project pathway, as well as reducing or changing the project ‘artefacts’13 that needed to be maintained.

2.11 The ATO assigned a ‘Senior Accountable Officer’ (SAO) for each of the six measures in accordance with its governance framework for new programs/projects.14 The SAO is accountable for ensuring the project is governed according to the ATO’s Program and Project Management Policy, including meeting project objectives and outcomes, escalating significant risks, and meeting assurance requirements unless an oversight committee is in place.15

2.12 An ATO COVID-19 Steering Committee, chaired by an acting Second Commissioner, was formed in March 2020. The Committee’s role was to provide high-level strategic leadership and oversight of the ATO’s activities in response to the pandemic ‘from the initial impact to returning operations to normality’. Deputy Commissioners from across the ATO are members of the Committee, providing advice and guidance on business continuity management, risks and business operations including the six measures.

2.13 Governance structures were established for all of the six measures as illustrated in Figure 2.1. For five of the measures, this involved using pre-existing committees:

  • the Policy and Implementation Committee for Enhancing the Instant Asset Write-Off, and Backing Business Investment; and
  • the Superannuation and Employer Obligations Project Change Committee for the Early Release of Superannuation, Temporary Reduction of Superannuation Minimum Drawdown Rates, and Boosting Cash Flow for Employers.

2.14 A new governance committee was established for the JobKeeper scheme called the JobKeeper Program Board, initially consisting of Second, Deputy, and Assistant Commissioners from across the ATO. The Charter stated that the JobKeeper Program Board was responsible for the operation of the scheme, to focus on the end-to-end design of the scheme, emerging risks and issues and significant changes that threatened the scheme’s implementation, and to monitor the scheme’s performance.

Figure 2.1: Governance structures for the six economic response measures

A hierarchical chart showing the governance structures for the six economic response measures.

Source: ANAO, based on the ATO’s records.

2.15 The ATO categorised the Temporary Reduction of Superannuation Minimum Drawdown Rates measure as a ‘Business Line’ project. The ATO considered that as the measure involved a change in the drawdown rate from that in prior legislation and no major transition strategies were required, ongoing management could be undertaken as part of business-as-usual activities by the business area.

Oversight of the measures

2.16 Oversight of the six measures was provided through the COVID-19 Steering Committee and governance committees for each measure, such as the JobKeeper Program Board, and, at a higher level, through the ATO’s existing oversight mechanisms — principally, the ATO Executive Committee.

2.17 The Chair of the COVID-19 Steering Committee provided regular briefings to the ATO Executive Committee on the issues arising in conducting the ATO’s functions, covering both measure-specific and existing activities. From 17 March until 8 May 2020, these briefings occurred on a daily basis, but were reduced to a weekly meeting from 15 May 2020 as implementation progressed. Deputy Commissioners updated the Steering Committee members on the issues arising within their business lines as a result of COVID-19 and advised how these were being addressed. On 31 July 2020 the COVID-19 Steering Committee was advised by its Chair that the ATO’s COVID-19 response was mature and that any operational issues would be managed in the future by the Chief Operating Officer.

2.18 A number of papers were provided to the ATO Executive Committee on the six measures. This included a paper considered by the Committee on 2 June 2020 entitled ‘Risk approach to COVID-19 stimulus measures’. The paper explained that the ATO’s risk appetite and risk tolerances for the measures were being established through ‘lived experiences’ (with examples provided of this approach). The paper also provided risk profiles for the JobKeeper, Boosting Cash Flow for Employers and Early Release of Superannuation measures, as well as a summary of the risk and decision process for each measure. The ATO Executive Committee endorsed the risk strategy for the economic response measures, noting that additional work was required to clearly articulate the risks arising along with the mitigation and compliance strategies.

2.19 To address the request from the ATO Executive Committee, a further paper was provided to the Committee on 30 June 2020 with an update on the compliance programs for JobKeeper, Boosting Cash Flow for Employers, and Early Release of Superannuation. The paper noted that the top three joint risks for JobKeeper and Boosting Cash Flow for Employers were:

  • enterprise risk (for example, whether the entity exists and shows signs of business activity);
  • registration risk (for instance, the ATO would check for Australian Business Number manipulation); and
  • turnover (as indicated by changes in GST data).

2.20 The paper also noted that, for the most part, the compliance programs are not anticipated to take longer than the life of the measures unless there has been fraudulent or criminal behaviour. The ATO Executive Committee agreed that an important factor of the compliance program is to balance the government requirements with community views on fairness. The Executive Committee further agreed that it is essential to have the correct settings to maintain community confidence and these may need to be recalibrated regularly.

Other committees

2.21 The ATO’s Enterprise Risk Management Committee (ERMC) did not have a significant role in overseeing the six measures. As discussed further in paragraph 3.15, none of the six measures (individually or collectively) were categorised as ‘enterprise risks’, which would have required direct oversight by the ERMC. Consistent with its role of overseeing enterprise risks, the ERMC considered matters associated with the ATO’s response to the COVID-19 pandemic.16

2.22 On 10 June 2020, the ATO’s Audit and Risk Committee was briefed on the ATO’s role in the Australian Government’s pandemic response. The role of the Audit and Risk Committee is to provide independent assurance to the Commissioner of Taxation on the appropriateness of the ATO’s financial reporting, performance reporting, system of risk oversight and management and system of internal control.

Review of governance arrangements for JobKeeper

2.23 In May 2020, the ATO engaged an external firm (PwC) to undertake a review and provide recommendations for a fit-for-purpose accountability and governance structure for the next phase of the JobKeeper scheme. In July 2020, ATO’s Chief Risk Officer presented a paper to the ATO Executive Committee recommending the establishment of an oversight committee for the JobKeeper program.17 The paper also recommended that the scope of the oversight committee include the six economic response measures, and that the Senior Accountable Officer for the JobKeeper measure remain at Deputy Commissioner level (rather than being elevated to Second Commissioner as was proposed in the review).

2.24 The ATO Stimulus Measures Oversight Committee held its first meeting on 25 August 2020.18 At this meeting, the Committee received the executive summary of a draft report from an external firm (PwC) that had been engaged to review the ATO’s governance, risk and assurance over the six economic response measures. The draft report identified a number of opportunities for improvement, including that the ATO provide greater definition of its risk appetite and tolerances, to provide more guidance for all people involved in how key decisions are made and the trade-offs. The draft report also noted that the boundaries of accepted tolerances should be based on reliable, relevant data, and regularly re-calibrated.

Record keeping

2.25 The ATO’s Risk Management Guide states that the purpose of recording and reporting in the risk management process is to:

  • communicate risk management activities and outcomes across the organisation;
  • provide information for decision-making;
  • improve risk management activities; and
  • assist interaction with stakeholders, including those with responsibility and accountability for risk management activities.

2.26 The ATO used its Internal Audit staff to support the measure-specific project teams by establishing ‘decision logs’ for each of the measures. The decision logs were intended to complement the record of risk management considerations in the implementation of the measures. Other records, such as the Risk Assessment and Treatment Plans, were retrospectively prepared by the ATO’s Corporate Risk and Assurance Branch in conjunction with the project teams, drawing on contemporaneous documents created for the measures.

2.27 The email and other records maintained in the decision logs evidence a range of activities undertaken across the ATO to implement the six measures, including responding to questions raised by the Department of the Treasury and addressing IT issues.

2.28 The ATO has also maintained documentation of the key meetings, deliberations and decisions of the governance committees and boards for each of the measures and the higher level oversight committees.

Was a sound process followed to identify and obtain required resources and capabilities?

The ATO followed a sound process to identify and obtain required resources and capabilities to support the rapid implementation of the six economic response measures, and to understand the impacts on its business-as-usual activities. The ATO identified constraints and developed responses to address staffing and ICT capability requirements to deliver the measures.

2.29 Key lessons from previous performance audits of entities involved in the rapid implementation of Australian Government initiatives have highlighted the importance of:

  • drawing upon the full range of human resources available to support the design, implementation and administration of significant programs, adopting a strategic, entity-level approach where necessary; and
  • quickly identifying and addressing necessary ICT system enhancements and development required to support rapid program delivery.19

2.30 In implementing the economic response measures, the ATO also needed to identify the impacts on its business-as-usual activities, including preparations for Tax Time 2020.

Securing the full range of necessary human resources

2.31 The ATO’s records indicate that over 10,000 staff were reassigned or placed on standby to support the implementation of the economic response measures (Box 4).

2.32 The ATO adapted its existing processes to train staff to support the economic response measures, as the measures were delivered through existing business line areas rather than discrete new areas. These processes primarily comprised the reallocation of existing resources within each group, the redeployment of staff internally between groups within the ATO, and the increased recruitment of casual and contracted staff through mechanisms used to boost staffing numbers to meet the demands of Tax Time.

Box 4: ATO staff reassignment at a glance

By 22 June 2020:

  • 9376 ATO staff had been reassigned within their usual group;
  • 1332 ATO staff were reassigned to another group; and
  • an additional 777 ATO staff were prepared to provide additional surge capacity in anticipation of peak demand around 1 July 2020.

Source: ANAO, based on the ATO’s records.

2.33 On 17 March 2020, the ATO tasked its groups20 to collate a list of both critical functions that would be a priority for staffing, and those functions that could cease work immediately and redeploy to support priority areas. This task identified four likely impacts on ATO staffing:

  • business continuity needs during the pandemic, both within the ATO and whole-of-government;
  • a strategic decision to temporarily scale down the ATO’s discretionary work programs in the face of disruption to business-as-usual interaction with taxpayers as well as to alleviate regulatory burden on the community (Box 5);
  • increased demand-driven work associated with taxpayers contacting the ATO to seek relief or advice as a result of the economic effects of the pandemic; and
  • the announcement (on 12 March 2020) of the first tranche of economic support measures to be led by the ATO (Boosting Cash Flow for Employers, Backing Business Investment and Enhancing the Instant Asset Write-Off, later supplemented with the remaining measures).

Box 5: Strategic reprioritisation of the ATO’s Client Engagement Group

On 26 March 2020 the acting Second Commissioner of the ATO’s Client Engagement Group issued a set of guiding principles to the group to define work to be continued or suspended during the initial phase of the pandemic. These principles included:

We will cease all face-to-face interactions with our clients.

We will engage with taxpayers and their agents where we already have advice, review and audit activity in progress, to offer assistance and provide taxpayers with the choice as to whether it is appropriate for the engagement to continue…

We will provide the opportunity to discuss the client’s concerns, debt and lodgment options, and gather important intelligence about sentiment in the community…

Pre-issue activity will continue to support the release of refunds.

We will not commence any new post-issue audit activity which requires client interactions…with the exception of potential fraud or evasion cases.

Cases approaching period of review will be empathetically discussed with clients and decisions made on a case-by-case basis. We will not be afraid to walk away from non-strategic matters if the period of review is expiring.

There will be a small number of exceptional circumstances where we will continue activity, approved by an SES, even if not preferred by the taxpayer or their agent…

We will remit certain penalties and interest incurred by COVID-19 affected businesses on request…

We will focus on providing reliable and timely information, advice and assistance to taxpayers and agents through this difficult time. We will take a balanced approach to risk and the decision whether to continue an engagement.

We will be looking…to identify common problems and issues arising, and find pragmatic, practical solutions so that tax doesn’t get in the way of our clients doing the right things in response to this challenge.

Source: ANAO, based on the ATO’s records.

2.34 The critical functions lists were intended to inform discussions between groups to internally redeploy staff, where a group could not secure adequate staffing to support the economic response measures from within its existing resources. Responsibility for determining the number of staff and level of training required to support the new measures lay with the receiving group (that is, the group who would use the staff). Groups offering staff would then liaise with the receiving group to match available staff to vacant positions and identify any skill gaps requiring training based on the existing experience of the identified staff members.

2.35 The COVID-19 Steering Committee maintained oversight of these discussions, but did not adopt a decision-making role in relation to individual redeployments. On 26 March 2020, an SES officer within the ATO’s Enterprise Strategy and Corporate Operations Group was appointed to coordinate efforts to identify re-deployable staff. This officer was responsible for:

  • briefing the Assistant Minister to the Prime Minister and Cabinet on the ATO’s internal redeployments;
  • identifying excess non-critical staff that might be redeployed across the broader Australian Public Service; and
  • ensuring internal redeployments supported the ATO’s strategic priorities (that is, new measures and critical business-as-usual functions).

2.36 On 30 March 2020, the ATO Executive Committee was briefed on a consolidated version of the critical functions list (Table 2.2), which had been further refined to categorise staff by availability to move.

Table 2.2: ATO assessment of staff availability for redeployment as at 30 March 2020

Category

Number of staff identified at 30 March 2020

Critical role

14,226

Back-up for critical role / new economic measures

3547

Good candidate for internal reassignment to support critical roles

1919

Left/leaving the ATO or on long term leave

473

Not critical but unavailable for redeployment due to high risk personal circumstances (relating to COVID-19)

485

Able to be freed for redeployment externally if required

807

   

Source: ANAO, based on the ATO’s records.

2.37 Later on 30 March 2020 the ATO provided summarised figures and advice on its staffing needs to the Chief Operating Officer of the Australian Bureau of Statistics. The advice was to be included in a consolidated response from the Treasury portfolio to the Australian Public Service Commission in compliance with a direction from the Prime Minister under section 21(1) of the Public Service Act 1999. The advice concluded that apart from ‘small individual requests’ to redeploy staff to other Australian Public Service agencies, the ATO would generally be unable to support requests to redeploy staff due to its need for staff to support ATO critical functions (both immediately and in a contingency capacity), noting the ATO’s role in the COVID-19 economic response.

Engagement of casual staff

2.38 Besides internal redeployment of staff, the ATO adjusted its existing practice of engaging casual staff to meet the seasonal demand experienced by the ATO during Tax Time. The ATO prepared a revised forecast of casual staffing needs based on an analysis of contact centre traffic throughout March and April 2020. The ATO informed the ANAO that it brought forward the engagement of casual staff because staffing demand driven by the pandemic and economic response measures occurred earlier in the year than the demand expected for Tax Time 2020 (Box 6).

2.39 The ATO conducted a risk review of its pre-engagement and integrity clearance (PEIC) processes in April 2020. Based on this assessment the ATO approved a temporary relaxation of PEIC requirements that would permit casual staff to be conditionally engaged while certain integrity checks were being completed. The risk associated with this decision was categorised as a ‘business risk’21, and placed on the Enterprise Risk Register on 4 April 2020 with a review date of 8 November 2020. This risk was ‘closed’ by the ATO on 3 August 2020 following a return to business-as-usual practices for pre-engagement checks.

Box 6: Recruitment of casuals at a glance

The ATO recruited over 1500 casual employees to support the economic response measures and Tax Time 2020 requirements.a

The ATO informed the ANAO that:

  • 448 staff commenced 27 April 2020;
  • 316 staff commenced 4 May 2020;
  • 287 staff commenced 11 May 2020; and
  • 534 staff commenced 25 May 2020.

In addition, approximately 800 casual staff (as at 30 June 2020) were placed into a casual pool for potential shift work allocation if required.

The ATO also entered into an outsourcing arrangement engaging a workforce of over 2500 personnel from a private call centre provider to cover Tax Time 2020 demand.

Note a: For comparison, the ATO informed the ANAO that it engaged 459 casual employees for Tax Time 2019 and was planning to hire 600 casual employees for Tax Time 2020.

Source: ANAO, based on the ATO’s records.

Changes to IT infrastructure and systems

2.40 The ATO identified three major ICT change requirements for the delivery of the economic response measures:

  • the rapid, wide-scale adoption of working from home arrangements as a business continuity measure in March 2020;
  • provisioning large numbers of new staff with ICT equipment and systems access and expanding telephony capacity as staffing surged to support ATO contact centre operations; and
  • the rapid development and implementation of ICT systems enabling the delivery of the economic response measures.

2.41 The ATO informed the ANAO that, prior to March 2020, the ATO’s remote working solution permitted a maximum of 1400 staff to connect remotely to ATO systems. The ATO engaged with service providers to identify a scalable solution using existing platforms, and commenced a pilot on 16 March 2020. The pilot was expanded each day. By 27 March 2020 the COVID-19 Steering Committee was briefed that approximately 9000 staff were able to log in remotely and by 1 April 2020 this had increased to approximately 11,000 staff.

2.42 The COVID-19 Steering Committee was briefed that the ATO had procured 2000 additional laptops and monitors for staff who required them to work remotely, and that these were distributed to staff from 2 April 2020 onwards. The ATO informed the ANAO that routing contact centre traffic to remote working staff was within the capacity of a new telephony platform that the ATO had deployed in February 2020, and the reconfiguration of the system was tested before full deployment.

2.43 The ATO forecasted likely telephony demands for the contact centre based on Tax Time 2019 call volumes, known peak periods in the implementation schedule for the economic response measures, and information collected in early registration phases of relevant measures. The ATO informed the ANAO that it used configuration changes of existing telephony infrastructure and negotiated flexible license arrangements with vendors to address the forecasted contact centre demand.

2.44 Systems development for JobKeeper, Early Release of Superannuation and Boosting Cash Flow for Employers followed standard but expedited development processes.22 ICT system design was integrated into the core design teams for these measures, ensuring it supported policy, legal and business requirements. The ATO informed the ANAO that senior decision makers for each measure provided direction for ICT design on a daily basis, to a greater extent than would ordinarily occur, and that developers were reassigned from lower priority projects and worked extended hours or in around-the-clock shift arrangements for surge periods before key roll-out dates. The risk of staff burnout under these conditions was monitored and reported to the COVID-19 Steering Committee.

Sufficiency of mobilised resources

2.45 The ATO mobilised staff to manage the increased contact centre traffic associated with the new measures. Key announcements on 12 and 22 March 2020 and commencement dates on 20 April (for JobKeeper, and Early Release of Superannuation) and 4 May 2020 (for JobKeeper) precipitated record-setting contact centre demand, as shown in Figure 2.2. Full ICT capacity and/or staffing capacity was reached at peak periods on several days, resulting in calls being blocked.23 These issues were transient and actively managed by the ATO.

Figure 2.2: Inbound call statistics for the ATO contact centre 13 March to 21 May 2020 (business days only)

This figure shows a sharp rise in calls blocked on 20 April 2020, and a corresponding rise in average wait time (in minutes) over the period 20 April 2020 to around 28 April 2020.

Source: ANAO, based on the ATO’s data.

2.46 In addition to the call blocking depicted in Figure 2.2, in the period 21–28 April 2020, the ATO blocked 71,563 calls at a network level24 to manage the load on its telephony networks.

2.47 The ATO also experienced service degradation between 20–22 April 2020 that prevented at least 109,457 calls from connecting to the ATO.25 On 21 April 2020 the ATO commenced an investigation into the service degradation and identified that 16 per cent of its contact centre trunk capacity was unavailable as it had been used to enable a working from home pilot. The COVID-19 Steering Committee was briefed that the full contact centre trunk capacity was restored on 22 April 2020.

2.48 The ATO informed the ANAO that it experienced some issues on-boarding new staff such as temporarily running out of available telephone number ranges and delays to system access. Between April to July 2020 the COVID-19 Steering Committee expressed its overall satisfaction at the level of ICT support being provided to support the recruitment of staff and the significant contact centre demand.

2.49 The ATO identified ICT system enhancements and developments and mobilised resources to support the implementation of the measures. Systems for JobKeeper, Early Release of Superannuation and Boosting Cash Flow for Employers were deployed in accordance with the scheduled timeframe. System capacity for ATO Online and related services was exceeded once between 1–2 July 2020. The ATO responded by limiting the number of external users accessing the service concurrently. The ATO had prepared for this contingency by implementing a ‘wait-listing’ solution prior to 18 April 2020 that permitted users up to maximum capacity to continue using the service while excess users were directed to try again later.

2.50 As the ATO’s experience demonstrated, clear assessment and decision-making about business priorities can support appropriate reallocation of existing staff. Where feasible and necessary, reallocating existing staff to meet staffing needs leverages existing access to equipment, information and premises, and may reduce some training requirements, particularly for staff with relevant previous experience.

Was consultation undertaken with government entities and relevant stakeholders, including on shared risks?

The ATO consulted with government entities and external stakeholders during the implementation of the six economic response measures — generally leveraging its existing relationships and arrangements. The ATO’s strategies for managing identified shared risks were not documented consistently.

2.51 The Commonwealth Risk Management Policy requires entities to implement arrangements to:

  • communicate and consult about risk in a timely and effective manner to both internal and external stakeholders; and
  • understand and contribute to the management of shared risks — which are described as risks extending beyond a single entity which require shared oversight and management.

2.52 These requirements are reflected in the ATO’s Enterprise Risk Management Framework. In addition, the ATO has prepared a Shared Risk Guide26 that provides additional guidance to staff on the identification and management of shared risks.

Engagement with government entities

2.53 In fulfilling its legislative purposes, the ATO has a key existing relationship with the Department of the Treasury (Treasury), with whom the ATO works closely to influence the development of policies and legislation for the tax and superannuation systems.27

2.54 The ATO’s records provide evidence of regular engagement and consultation between the Treasury and the ATO during the development of the six economic response measures, particularly in the design of the law and explanatory material. For each of the measures, ATO staff provided input (often of a tax technical nature) on the proposed legislative arrangements, typically under compressed timeframes (Box 7).

Box 7: Engagement between the ATO and Treasury on Enhancing the Instant Asset Write-Off measure

The ATO informed the ANAO that ATO Second Commissioners and Band 2 and Band 1 Senior Executives were informed of the Enhancing the Instant Asset Write-Off measure by Treasury during the weekend of 7–8 March, prior to the announcement of the measure on 12 March 2020.

At 2.05 pm on Tuesday 10 March 2020 Treasury forwarded to the ATO the anticipated timetable for introducing legislation to enable the economic response measures, including the Enhancing the Instant Asset Write-Off measure, to proceed.

At 3.31 pm on Wednesday 11 March 2020, the first draft of the legislative amendments was sent to the ATO by Treasury, with comments to be returned to Treasury by close of business Thursday 12 March 2020. The ATO responded with a number of tax technical issues including the potential risk that assets purchased to take advantage of the increased thresholds would not be first ‘used or installed ready for use’ between the announcement and the original end date of 30 June 2020.

At 3.46 pm on Friday 13 March 2020 Treasury provided the draft explanatory memorandum (EM) to the ATO for input and requested the ATO’s comments by Monday 16 March 2020 at 9.30 am. The revised EM and draft bill was returned to the ATO at 4.01 pm on 16 March 2020 with final comments to be provided to Treasury by 9.00 am on 17 March 2020. The ATO’s comments included revised wording to clarify the terms of the measure and to provide businesses with greater certainty as to what was allowed.

Source: ANAO, based on the ATO’s records.

2.55 The ATO engaged with Services Australia to develop a data-matching protocol and arrangements for JobSeeker and JobKeeper. An ‘Abridged Arrangement’ to the Services Schedule for Data Exchange between the ATO and Services Australia was signed between the entities on 15 May 2020 (and expires on 30 October 2020). The principal aim of the data-matching arrangement is for the ATO to provide JobKeeper data to assist Services Australia in identifying eligibility issues for JobSeeker. The agreement provided for data provision to commence on 18 May 2020 with a weekly transfer of data to occur thereafter.

2.56 In addition, the ATO participated in various cross-agency arrangements including:

  • an inter-departmental committee (IDC) on JobKeeper — and the Program Risk and Integrity Working Group (which reports to the IDC);
  • representation on the Chief Operating Officers (COO) Committee, and the Assurance and Risk Working Group (which reported to the COO Committee); and
  • the Serious Financial Crime Taskforce, a multi-agency taskforce targeting serious financial crime in Australia, led by the ATO.

2.57 The ATO’s representation on the JobKeeper Program Risk and Integrity Working Group provides an example of the management of shared risks between the entities involved (Box 8).

Box 8: The establishment and operation of the JobKeeper Program Risk and Integrity Working Group

The JobKeeper Program Risk and Integrity Working Group was established by the JobKeeper Inter-Departmental Committee (IDC) at the IDC’s inaugural meeting on 23 April 2020.a

The Working Group comprised representatives from Treasury (which chairs the group), the Attorney-General’s Department, the ATO, the Fair Work Commission, and the Fair Work Ombudsman.

The key role of the Working Group is to identify, monitor and mitigate risks in relation to the JobKeeper program, as well as to monitor the effectiveness of the integrity measures that have been put in place for the program. The Working Group’s key tasks include:

  • identifying the various risks across the JobKeeper program and escalating where necessary to the JobKeeper IDC;
  • understanding the interdependency of the various risk measures across different agencies; and
  • ensuring and monitoring the integrity of the JobKeeper program and its governance throughout.

In July 2020, the Working Group drafted a JobKeeper Program Strategic and Shared Risk Strategy — a draft document aimed at providing a fit-for-purpose guide and framework to support management of strategic and shared risks to the Program.

On 21 July 2020, the Working Group drafted a Job Keeper Program Strategic and Shared Risk Report. The report sets out 12 identified risks to the JobKeeper program — 4 of which are assigned to the ATO as the risk owner. These risks are:

  • failure to effectively manage the experience of employers and be responsive to emerging issues;
  • failure to manage low-level non-compliance will negatively impact the objectives of the program;
  • failure to manage fraud and corruption will negatively impact the objectives of the program; and
  • failure to facilitate access to program information for agencies with compliance and dispute resolution functions will mean the objectives of the program, and individual workplace participants, will be negatively impacted.

All 12 identified risks were assessed to have a risk rating of ‘medium’. The ATO developed individual risk response plans for the 4 risks for which it was the assigned risk owner.

Note a: The IDC is chaired by Treasury, with SES representatives from the ATO, the Attorney-General’s Department, the Fair Work Commission, the Fair Work Ombudsman, Services Australia, the Department of Education, Skills and Employment, the Department of Social Services, and the Department of the Prime Minister and Cabinet.

Source: ANAO, based on the ATO’s records.

Identification of shared risks

2.58 The ATO’s corporate Risk Assessment and Treatment Plan template requires staff to indicate whether the risk being identified is shared externally.

2.59 Shared risks were identified in two of the corporate Risk Assessment and Treatment Plans developed for the six measures — Early Release of Superannuation, and Temporary Reduction of Superannuation Minimum Drawdown Rates. In both cases, the ATO identified the Australian Prudential Regulation Authority (APRA) as another government entity that was sharing the risk of these measures. For the Early Release of Superannuation measure, the ATO also identified APRA-regulated funds (including their administrators), Self-managed Super Funds, the Australian Securities and Investments Commission (ASIC), and Services Australia (in relation to myGov).

2.60 The ATO’s Shared Risk Guide outlines a number of specific actions that ATO staff should take to manage identified shared risks. These include developing and implementing procedures to manage shared risks, and recording, monitoring and reporting information on shared risks. The Guide also states that ‘For all shared risks, it is paramount that each entity acknowledges the interdependency, agrees on roles and responsibilities, and how to actively manage the risk.’

2.61 The documentation maintained by the ATO did not demonstrate that the actions outlined in the Shared Risk Guide were followed for the two measures where shared risks were specifically identified. In particular, for the Early Release of Superannuation measure, the ATO’s documentation did not clearly outline which risks were shared and how these risks would be monitored and reported on by the identified parties.

2.62 The ATO informed the ANAO that the shared risks for the Early Release of Superannuation measure were managed through a cross-agency working group in a more informal manner given the speed of implementation. A ‘Fraud & Compliance Controls’ map was developed by the ATO and was shared with the members of the cross-agency working group in April 2020.28

Engagement with external stakeholders

2.63 The ATO’s records provide evidence of consultation with external stakeholders for all six measures. The consultation was undertaken through the ATO’s existing consultation arrangements such as ‘Stewardship Groups’29 and other existing committees and forums including Digital Service Providers. The bodies consulted included the Tax Practitioner Stewardship Group, BAS Agent Association Group, Tax Practitioner Professional Association representatives, Not-for-profit Stewardship Group, Private Groups Stewardship Group, Small Business Stewardship Group, Superannuation Industry Stewardship Group, the Super and Employment Change Network meeting, and the Superannuation Administration Group.

2.64 Consultation undertaken by the ATO on the two superannuation measures is outlined in Box 9.

Box 9: Examples of the ATO’s consultation on Early Release of Superannuation and the Temporary Reduction of Superannuation Minimum Drawdown Rates

  • From 24 March to 16 April 2020, the ATO chaired a series of meetings (via teleconference) with the Superannuation Administration Group to discuss various aspects of the Early Release of Superannuation measure and the Temporary Reduction of Superannuation Minimum Drawdown Rates measure. The Superannuation Administration Group is comprised of industry and government representatives (including from APRA and ASIC). Matters discussed in the meetings included bulk file transfers for the Early Release of Superannuation approvals, the individual application process, security and fraud issues, and screen shots of the application process and outline of the ATO’s security controls.
  • On 15 May 2020, the ATO chaired a meeting (via teleconference) with the Superannuation Industry Stewardship Group, comprised of industry bodies and government representatives. The purpose of the meeting was to identify the learnings and opportunities from Fund and Regulators’ perspectives in preparation for the second tranche of the Early Release of Superannuation measure.

Source: ANAO, based on the ATO’s records.

3. Identifying risks and impacts

Areas examined

This chapter examines whether, in implementing the six economic response measures, the Australian Taxation Office (ATO) appropriately assessed, documented, and communicated changes in its risk environment.

Conclusion

In implementing the six economic response measures, the ATO assessed, documented and communicated changes in its risk environment in an appropriate manner. The ATO’s risk documentation evidences its priority of implementing the measures in a timely manner, while also managing fraud and other integrity risks on a progressive basis.

3.1 The COVID-19 pandemic and the Australian Government’s response to it have impacted on the risk environment faced by the Australian public sector.

3.2 For the ATO, the changed risk environment includes the responsibility of rapidly implementing six measures as part of the Australian Government’s economic response to the pandemic, as well as managing other risks and impacts associated with its ongoing responsibility for administering the tax and superannuation systems.

3.3 This chapter examines whether the ATO has:

  • identified new or changed risks associated with the six measures and to its existing operations;
  • determined ‘risk tolerances’30 to guide its implementation of the six measures, and developed associated risk mitigation strategies; and
  • informed decision-makers of identified risks, mitigation strategies and broader impacts on its operations.

Were new or changed risks identified, including to existing operations?

The ATO identified new and changing risks, including to existing operations. The ATO adopted an iterative approach to identifying risks at a project and program level that was fit-for-purpose.

3.4 The first three steps in the ATO’s four-step risk methodology concern risk identification and assessment:

  • clearly articulate the objectives31 so that the scope, context and criteria for the risk management process can be established;
  • plan the key strategies that will be used to achieve the objectives; and
  • identify and assess areas of uncertainty (risks) that may impact the implementation of the strategies and achievement of the objectives.

3.5 The fourth step of the ATO’s risk methodology relates to the monitoring of risk management activities, and is discussed at paragraph 4.18.

Articulating the objectives

3.6 The ATO articulated the objectives for its administration of all six economic response measures in an iterative fashion.

3.7 In March 2020, the ATO Executive Committee noted the intent of the measures ‘to stimulate the Australian economy and achieve a flow of money in the community’. As further details became available with the passage of legislation and the maturing of the ATO’s key implementation strategies and governance arrangements, Senior Accountable Officers refined and formally articulated objectives specific to each measure.

3.8 Examples of objectives as articulated by the ATO are depicted in Table 3.1. These objectives contained a greater level of detail than the requirements outlined in the enabling legislation.

Table 3.1: Tailored objectives articulated for three economic response measures

JobKeeper (14 April 2020)

Early Release of Superannuation (7 May 2020)

Boosting Cash Flow for Employers (21 May 2020)

The JobKeeper Program has been established to…ensure that the community has confidence in the administration of the JobKeeper scheme and:

  • the payments are received and paid to ‘eligible employers’ in a timely way…as seamlessly as possible and are then available to assist the business in accordance with the objectives of the law;
  • there is a strong and robust governance framework maintained;
  • the highest level of assurance and integrity is maintained to monitor and act to identify and prevent apparent misuse and fraud;
  • the coordination of the various streams of work are in place which need to come together to enable the program to succeed; and
  • the monitoring and reporting of key performance indicators and milestones are in place to support the policy objective.

The Early Release of Super Program has been established to…ensure that:

  • early release of super is applied to eligible clients in accordance with the law;
  • the highest level of assurance and integrity is maintained to monitor applications through the system and act to identify and prevent potential fraud;
  • the monitoring and reporting of key deliverables are in place to support the policy objective; and
  • there is a strong and robust governance framework maintained.

The Cash Flow Boost Program…will ensure that:

  • cash flow boost credits are applied to eligible clients in accordance with the law;
  • credits remaining after cash flow boosts have been applied (to reduce liabilities arising from the same activity statement) are refunded in a timely and seamless manner;
  • the highest level of assurance and integrity is maintained to monitor and act to identify and prevent potential misuse and fraud;
  • the monitoring and reporting of key deliverables and milestones are in place to support the policy objective; and
  • there is a strong and robust governance framework maintained.
     

Source: ANAO, reproduced from the ATO’s records.

3.9 When briefing the ATO Executive Committee on 2 June 2020 regarding the risk approach to the six measures, the Chief Risk Officer articulated the primary objective of each measure in broad terms as ‘[ensuring] that implementation gives effect to the government’s policy intent and conforms with the law as enacted by the Parliament.’

Planning key implementation strategies

3.10 The design of the economic response measures was largely based on leveraging existing ATO systems and operations to provide the foundation of the ATO’s implementation strategies:

  • repurposing the ATO’s existing ICT systems to implement new operations for JobKeeper;
  • withholding tax and business activity statements for Boosting Cash Flow for Employers;
  • existing superannuation system for Early Release of Superannuation and Temporary Reduction of Superannuation Minimum Drawdown Rates; and
  • annual tax returns for Backing Business Investment and Enhancing the Instant Asset Write-Off.

3.11 In the Risk Assessment and Treatment Plans for each measure, the ATO identified several distinct lines of work (‘streams’) necessary to achieve the objective. The streams nominated by the ATO for each measure are depicted in Table 3.2. Each stream was led by a representative drawn from a relevant area of the ATO. The stream leads collaborated as an interdisciplinary core design team32 to develop the implementation strategy for each measure. For three measures (JobKeeper, Early Release of Superannuation and Boosting Cash Flow for Employers) stream leads were also responsible for executing the strategy as it applied to that stream. For the remaining measures, a single project team was responsible for executing the strategy decided by the core design team.

Table 3.2: Implementation streams for the six economic response measures

JobKeeper

Early Release of Superannuation

Boosting Cash Flow for Employers

Backing Business Investment

Enhancing the Instant Asset Write-Off

Temporary Reduction of Superannuation Minimum Drawdown Rates

  • Governance/project management — cross agency program management
  • Design Client and Staff Experiences
  • Marketing and Communications
  • Systems Delivery
  • Advice and Guidance
  • ATO Readiness
  • Smarter Data
  • Compliance Integrity
  • Review and Objections
  • Communications Strategy
  • Engagement Strategy
  • Law interpretation, advice and guidance approach
  • System Readiness
  • Compliance approach
  • Business Readiness
  • Fraud and Integrity Strategy (including cyber crime)
  • Whole of Government approach
  • Governance arrangements
  • Law interpretation
  • System design, architecture, data models and business readiness
  • Communications (internal and external)
  • Integrity & fraud strategy
  • Governance and reporting
  • Compliance
  • Staff experience
  • Client experience
  • Integrity strategy (under development)
  • Fraud and Integrity
  • Legislation, advice and guidance
  • ATO readiness
  • System build
  • Communication strategy (living document)
  • Governance
  • Compliance strategy
  • Legislation, advice and guidance
  • ATO readiness
  • Marketing and communications strategy
  • System build
  • Governance
  • Marketing and communications strategy
  • Legislation, advice and guidance
  • Staff experience — ATO readiness
  • Governance/project management
  • Compliance strategy (via SMSF auditors and assurance of auditors)
           

Source: ANAO, reproduced from the ATO’s records.

3.12 Within each stream, some further strategy documents were prepared in coordination with other streams through the core design team. Three measures that required significant ICT systems development (JobKeeper, Boosting Cash Flow for Employers and Early Release of Superannuation) used standard templates to plan system design, development and deployment. Individual integrity strategy documents were prepared for each measure by Integrated Compliance. The ATO developed a communication strategy for each of the six measures. The strategies detailed how the ATO would raise awareness and provide information to relevant stakeholders on the measures, including on its website and through other channels such as social media, news articles, and webinars.

Identifying risks to objectives and implementation strategies

3.13 As discussed in paragraph 3.19, records retained by the ATO demonstrate that risks were considered during the initial implementation phase (March to April 2020). However, for four measures with earlier implementation milestones (Early Release of Superannuation, JobKeeper, Boosting Cash Flow for Employers, and Temporary Reduction of Superannuation Minimum Drawdown Rates), consolidated risk assessments in accordance with the requirements of the ATO’s Enterprise Risk Management Framework were not prepared until after critical implementation decisions had been made.

3.14 Risk Assessment and Treatment Plans for each of the six measures were prepared in May and June 2020. The plans assessed a single risk, namely that ‘the implementation and delivery of’ each measure ‘fails to meet Government intent’. The ATO described the intent of these post-decision assessments as an assurance exercise to retrospectively capture a consolidated view of the ATO’s risk management of each measure that would otherwise be evidenced by project artefacts. These assessments played a limited role in informing risk choices made by the ATO.

3.15 The six measure-level risks identified by the ATO in the consolidated risk assessments were categorised as ‘business risks’ rather than as ‘enterprise’ or ‘strategic’ risks, as per the three categories listed in the ATO’s Enterprise Risk Management Framework (Table 3.3).

Table 3.3: The ATO’s risk hierarchy and risk owners

Risk level

Definition

Owner

Strategic risk

A risk that may impact the achievement of our purpose and/or 2024 aspirations. They are informed by our external environment, determined by the ATO Executive and included in the ATO’s corporate plan.

Accountability for strategic risks may be assigned to individual ATO Executive members.

Enterprise risk

A risk that has a material impact on the achievement of an ATO strategic objective. A risk may be material if it is:

  • critical in achieving an ATO strategic objective;
  • directly linked to the delivery of an ATO strategic initiative;
  • related to a significant investment and/or government commitment;
  • controlled through activities that occur in more than one group; and
  • likely to have broader impacts across government.

Enterprise risks are linked to one or more strategic objectives in the corporate plan.

Owned and managed at the Senior Executive Service level and overseen by the Enterprise Risk Management Committee.

Business risk

All other risks associated with the day-to-day operations of the ATO. This may be at the group, business line, team or project level.

Owned and managed by a Senior Executive Service Band 1, Executive Level 2 or Executive Level 1 staff member.

     

Source: ANAO, reproduced from the ATO’s Enterprise Risk Management Framework (dated 24 April 2020).

3.16 The ATO’s decision to categorise the six measures as ‘business’ risks was not consistent with the nature and implications of the risk levels as defined by the ATO. In particular, the JobKeeper scheme has been described by Treasury as one of the largest fiscal and labour market interventions in Australia’s economic history. On this basis, the JobKeeper scheme aligns with the ATO’s criteria of a significant government commitment that is likely to have broader impacts across government.

3.17 The categorisation of the six measures as business risks meant that those risks were not considered by the ATO’s Enterprise Risk Management Committee alongside other enterprise risks to the ATO. In practice, the categorisation did not materially detract from the ATO’s attention towards the measures. The ATO managed these risks through the governance and oversight arrangements for each measure (see paragraphs 2.2 to 2.24), which included reporting to the ATO Executive Committee on JobKeeper, Boosting Cash Flow for Employers and Early Release of Superannuation.

3.18 In July 2020, the ATO informed the ANAO that its classification of enterprise risks was under review.

Risk identification at the project level

3.19 In the absence of a contemporaneous formal risk assessment for each measure, the ATO adopted an iterative approach to identifying risks that ran parallel to its implementation planning. Risk registers were maintained for five of the six measures in accordance with the ATO’s existing project management methodology:

  • For three measures (JobKeeper, Boosting Cash Flow for Employers and Early Release of Superannuation), risks were identified, recorded on the risk register and assigned to risk owners from the earliest stages of the projects.
    • Two of these registers (JobKeeper and Early Release of Superannuation) assigned risk ratings to individual risks.
  • For Backing Business Investment, a risk register was created on 27 May 2020 after most implementation decisions had been made but before 1 July 2020 when the first claims could be made under the measure. Key risks were also identified in monthly project status reports in April and May 2020.
  • As Enhancing the Instant Asset Write-Off was a change to an existing measure, the existing project risk register was continued and updated.
  • For Temporary Reduction of Superannuation Minimum Drawdown Rates, the ATO assessed that the risks of the project were so low as to not require a project level risk register.33

3.20 Risks entered into the risk registers were more detailed than the risk articulated in the corporate Risk Assessment and Treatment Plan for each measure; examples of this detail are provided in Box 10. The registers recorded descriptions of actions being taken by stream leads that controlled, treated or monitored each risk. The registers made provision for closing risks as the uncertainty associated with a risk was resolved.

Box 10: Examples of risks identified by the ATO, March–June 2020

The JobKeeper risk register included the following ‘significant’ risks.

  • Employer does not pay employees.
  • Legislative interpretation errors or aggressive positions to meet eligibility test where not entitled.
  • Individual getting both JobKeeper and JobSeeker.
  • Employers do not participate because of fear of getting it wrong.
  • Data security and privacy not protected adequately.

The Early Release of Superannuation risk register included the following ‘high’ risks.

  • Implementing a fully tested and automated ATO solution to be available by 20 April 2020.
  • Ineligible individuals approved for an early release of super payment as there are no physical evidentiary verification requirements undertaken by the ATO.

The Boosting Cash Flow for Employers risk register included the following risks.

  • Widespread staff illness impacting on project delivery.
  • Client experience is impacted by ATO service and manual workarounds.
  • Volume of cases stopped for manual review.

Source: ANAO, based on the ATO’s records.

3.21 In addition to the risk registers, the ATO identified a range of integrity risks in documents prepared by Integrated Compliance in conjunction with each project team.

3.22 The registers were also used to record risks presented by the measures to existing ATO operations, including risks such as the capacity of shared corporate systems and the ATO contact centre to respond to client demand, reputational risk, and compliance with privacy legislation when using corporate data.

Were risk tolerances determined and risk mitigation strategies developed?

The ATO identified risk tolerances, controls and treatment strategies. Risks associated with the implementation of the six economic response measures were assessed to be within tolerance, to be managed by identified controls, with the exception of integrity risks where the need for additional treatment strategies was identified. Aspects of the ATO’s approach to determining risk tolerances could have been better documented to support risk-informed decision-making.

3.23 The Commonwealth Risk Management Policy defines ‘risk tolerance’ as ‘the levels of risk taking that are acceptable in order to achieve a specific objective or manage a category of risk.’ The ATO’s Risk Tolerance Guide states that:

Risk tolerance relates directly to individual risks. In the ATO, risk tolerance is expressed in terms of a maximum acceptable risk level (or risk rating) that combines a likelihood and consequence rating.

3.24 The Risk Tolerance Guide states that defining risk tolerance assists the ATO to recognise when action will be taken to further prevent or mitigate a risk. The ATO’s risk tolerance bands are outlined in Figure 3.1.

Figure 3.1: The ATO’s risk tolerance bands

This figure shows the ATO’s three risk tolerance bands – ranging from the ‘Generally intolerable region’, where the risk is to be reduced within tolerance, to the ‘Tolerable region’ where further risk reduction measures are balanced against the benefit/re

Source: Reproduced from the ATO’s Risk Tolerance Guide (15 June 2018).

Risk tolerances for the six economic response measures

3.25 During the period March to April 2020, the ATO did not record its risk tolerance with respect to the implementation of the six measures within corporate Risk Assessment and Treatment Plans. A paper to the ATO’s Executive Committee on 2 June 2020 described the context for not documenting risk tolerance contemporaneously:

A traditional approach to tolerance has not been taken during the implementation of the stimulus measures due to the unprecedently short period between announcement and implementation and the nature of the work associated with implementing new measures. Tolerance has been considered in the current environment through a highly practical approach to decision making where trade-offs between options and the likely results are considered in real time to help inform decisions.34

3.26 The ATO’s Risk Assessment and Treatment Plan template includes the following rating scale to determine the level of a risk: low, moderate, significant, high, severe, and catastrophic.

3.27 The ATO documented its risk tolerances in a corporate Risk Assessment and Treatment Plan for each of the six measures in the period May 2020 to 2 June 2020, after the initial implementation phase for each measure had commenced. In each case, the risk presented in the plans (of failing to meet the Government’s intent for the measure) was assessed to be within the stated tolerance level (Table 3.4).

Table 3.4: Tolerance levels for the six economic response measures

Measure

Described risk

Overall risk rating

Stated tolerance level

Risk within tolerance?

Backing Business Investment

The implementation and delivery of Backing Business Investment fails to meet Government intent.

Significant

High

Yes

Boosting Cash Flow for Employers

The implementation and delivery of boosting cash flow for employers economic response package fails to meet Government intent.

Significant

High

Yes

Early Release of Superannuation

The implementation and delivery of the temporary early access to superannuation economic response package fails to meet Government intent.

High

High

Yes

Enhancing the Instant Asset Write-Off

The implementation and delivery of the instant asset write-off fails to meet Government intent.

Significant

High

Yes

JobKeeper scheme

The implementation and delivery of JobKeeper fails to meet Government intent.

Significant

Significant

Yes

Temporary Reduction of Superannuation Minimum Drawdown Rates

The implementation and delivery of the ATO’s component of Temporarily reducing superannuation minimum drawdown rates measure fails to meet Government intent.

Moderate

High

Yes

         

Source: ANAO, based on the ATO’s records.

3.28 The ATO’s Risk Tolerance Guide notes that the underlying assumptions to risk tolerance decisions should be made explicit and transparent. The rationale for the stated tolerance levels for the six measures was not included on the corporate Risk Assessment and Treatment Plans or associated documentation.

3.29 The ATO informed the ANAO in July 2020 that the tolerance level of ‘high’ for all measures except JobKeeper originated from a pre-existing decision within the ATO’s Client Engagement Group (which is responsible for implementing the six measures) to set a ‘high’ risk tolerance for all new policy measures. This default setting was applied to the five measures when the corporate Risk Assessment and Treatment Plans were prepared.

3.30 The ATO further informed the ANAO that the tolerance level of ‘significant’ for the JobKeeper scheme was intended to match the overall risk rating for the measure, which was also significant. The ATO’s Risk Management Guide notes that if the assessed risk rating is below the tolerance level then no additional action needs to be taken to manage the risk (beyond the identified controls).35

Tolerance levels for integrity risks

3.31 For two measures (Enhancing the Instant Asset Write-Off and Backing Business Investment) the ATO prepared separate Risk Assessment and Treatment Plans, which focused on ‘integrity measures’. These plans were prepared by Integrated Compliance in conjunction with the project teams for these measures and the ATO’s Corporate Risk and Assurance Branch. In both cases, the assessed level of risk was determined to be above the ATO’s tolerance level (Table 3.5). The rationale for the stated risk tolerance level was not included in the two plans.

Table 3.5: Risk tolerances for integrity risks — Backing Business Investment and Enhancing the Instant Asset Write-Off

Measure

Described risk

Overall risk rating

Stated tolerance level

Risk within tolerance?

Backing Business Investment

The integrity of the tax system could be exposed by incorrect claims made or arrangements used under the Backing Business Investment stimulus measure which go against the intended purpose and the ATO.

High

Generally intolerable

No

Enhancing the Instant Asset Write-Off

The integrity of the tax system could be exposed by incorrect claims made or arrangements used under the Instant Asset Write-Off stimulus measure which go against the intended purpose and the ATO.

High

Generally intolerable

No

         

Note: The Deputy Commissioner, Integrated Compliance is recorded as the ‘risk owner’ for both of these risks.

Source: ANAO, based on the ATO’s records.

3.32 Separate ‘integrity measures’ Risk Assessment and Treatment Plans were not prepared for the other four measures. A range of other documentation was produced for JobKeeper, Boosting Cash Flow for Employers and Early Release of Superannuation, which indicated the ATO’s emphasis on managing fraud and other integrity risks for these measures. This documentation included:

  • a Concept of Operations36 paper for the integrity measures in JobKeeper, Boosting Cash Flow for Employers and Early Release of Superannuation, and also for Backing Business Investment;
  • compliance strategies for Boosting Cash Flow for Employers, Early Release of Superannuation, and JobKeeper; and
  • entries in project-level risk registers.

3.33 In addition, the ATO has undertaken activities to manage fraud risks across the economic response measures through its role in leading the Serious Financial Crime Taskforce and the Phoenix Taskforce.37

3.34 The concept of risk tolerance assists entities to make informed decisions about whether mitigation strategies in addition to existing controls are required and, if so, the level of resourcing required to achieve desired outcomes. Articulating risk tolerance early in the implementation phase of new measures provides a sound basis on which to support effective risk management, including the best use of entity resources. The rationale for setting the risk tolerance for particular risks or categories of risk should be clearly documented, both to evidence entity decision-making and to support subsequent assurance activities.

Development of risk treatment strategies

3.35 The ATO’s Risk Management Guide states that:

If the assessed risk rating is above the tolerance level then this is an indicator that further action is required to mitigate the risk, known as treatments.

If the assessed risk rating is below the tolerance level then no additional action needs to be taken to manage the risk. However, where gaps or uncertainties have been identified in the controls, treatment plans can still be developed if desired.

3.36 The Risk Assessment and Treatment Plans for the six measures all indicated that no further risk treatment was needed (beyond the risk controls outlined in each plan) because the assessed risk level was within tolerance. The focus of the ATO’s risk mitigation strategies for these measures was to monitor the effectiveness of the identified controls.

3.37 In the six plans, the ATO assessed that the identified controls were:

  • ‘partially effective’ overall for four measures — Backing Business Investment, Enhancing the Instant Asset Write-Off, Boosting Cash Flow for Employers, and JobKeeper; and
  • ‘effective’ overall for the two remaining measures — Early Release of Superannuation, and Temporary Reduction of Superannuation Minimum Drawdown Rates.

3.38 The ATO’s categorisation of control effectiveness is provided in Box 11.

Box 11: The ATO’s categorisation of control effectiveness in its Risk Assessment and Treatment Plan template

Effective

  • Management believes and can provide reasonable assurance that the controls are effective and reliable
  • Most controls are current, adequate and understood by the staff
  • Monitoring and review practices are mostly in place
  • Continue to review and monitor with minor adjustment as required

Partially effective

  • Some controls may be adequate but others are lacking assurance and may not be effective and reliable
  • The controls may not be operating as intended
  • Re-design or improvement of controls is required
  • Some monitoring and review practices are conducted or are informal

Note: The ATO’s Risk Assessment and Treatment Plan template includes two other categories of control effectiveness — ‘Ineffective’ and ‘Insufficient evidence’.

Source: Reproduced from the ATO’s Risk Assessment and Treatment Plan template.

3.39 The separate ‘Integrity measures’ plans produced for Enhancing the Instant Asset Write-Off and Backing Business Investment both indicated that further treatment was required because the assessed risk level was not within tolerance. For both measures, the stated focus of the treatment plans was to ‘Maintain existing treatments and review with consideration with the interactions of other measures and existing models.’ As of 5 June 2020, when both plans were initially prepared, the status of the treatment plans was recorded as ‘pending’. A fortnightly review cycle was identified for the treatment plans of both measures.

Were decision-makers informed of risks, mitigation strategies and broader impacts?

The ATO informed government decision-makers of risks, mitigation strategies and broader impacts through a variety of operationally focused briefs, submissions and reports.

3.40 As noted in paragraph 2.51, the Commonwealth Risk Management Policy requires entities to implement arrangements to communicate and consult about risk in a timely and effective manner to both internal and external stakeholders — which includes government.

3.41 Previous performance audits of entities involved in the rapid implementation of Australian Government initiatives have highlighted the importance of:

  • keeping decision-makers abreast of significant emerging risks and issues;
  • establishing a common understanding of the risk appetite38 for the initiative between the policy and implementing entities, and the government;
  • ensuring that ministers receive complete, accurate and timely advice on program design features and implementation progress, challenges and risks; and
  • keeping senior management and ministers informed of significant changes in risk, and any revised mitigation strategies.

Advice to government

3.42 The ATO uses the Parliamentary Document Management System to provide submissions, briefs and other ad hoc advice and documents to relevant ministers39 and to their offices.40 The records stored in this system show that the ATO provided submissions41 to ministers (typically the Treasurer and the Assistant Treasurer) on various aspects of the economic response measures. This included submissions on:

  • information and updates on fraud and integrity matters in relation to the Early Release of Superannuation measure;
  • advice or information on different aspects of the JobKeeper scheme, including the ATO’s consultation on the alternative decline in turnover tests relevant for eligibility to JobKeeper, on schemes that seek to exploit JobKeeper, on payments that have been paused due to the application of integrity risk models, and on the ATO’s proposed communications plan to the end of March 2020; and
  • information and updates on the ATO’s compliance activities for Early Release of Superannuation, and Boosting Cash Flow for Employers.

3.43 The first ministerial submission was sent on 21 April 2020. The ATO informed the ANAO that prior to the first ministerial submission, it provided informal advice to ministers on tax and superannuation matters arising from the pandemic. The ATO noted that Treasury, as the policy entity, took the lead role in providing advice to government in the design phase of the measures.

3.44 The ATO also provided over 100 ministerial briefs42 on various aspects of its response to the COVID-19 pandemic, including specific matters related to the economic response measures. These included briefs on the volume of activity statements submitted for the Boosting Cash Flow for Employers measure, definitions of ‘sole trader’ and ‘self-employed’ for the JobKeeper program, and advice and data on the JobKeeper tip-off line.

3.45 The advice and information provided to ministers’ offices reflect the ATO’s role as an implementing entity rather than a policy entity. Much of the advice could be characterised as ‘operational’ in nature — providing information on specific aspects of the measures rather than raising policy or strategic issues for government to consider.

Implementation plans

3.46 The ATO provided a number of regular (or cyclical) reports to ministers’ offices, including an implementation report on all six measures (called the COVID-19 ATO Implementation Plan). The implementation plans provided a progressive status update on each measure, detailing matters such as communication activities, ATO system build, integrity of measures, governance and assurance, ATO service delivery, and other activities specific to the measure.

3.47 The first implementation plan was produced on 31 March 2020 and was provided to the Assistant Treasurer’s office. Recipients of subsequent implementation plans included the Treasurer’s and Assistant Treasurer’s offices, the Treasury and ATO staff. The ATO informed the ANAO that the implementation plan was initially provided every two days, but as measures were implemented the plan was provided on a weekly basis.

3.48 The last implementation plan was provided on 3 July 2020, after which they were discontinued.43 The ATO continued to provide daily ‘dashboard’ reports to the Treasurer’s office and to Treasury, providing information on the uptake and costs of JobKeeper, Boosting Cash Flow for Employers, and Early Release of Superannuation.

3.49 In addition to the implementation plans, other reports provided on a regular basis to ministers’ offices during the implementation period for the six measures included:

  • daily reports on the ATO’s contact centre volumes and activities;
  • the ATO’s forward program of outbound communications on the six measures (for example, letters to applicants);
  • advice on JobKeeper registration data; and
  • updates on the Early Release of Superannuation measure, including in relation to fraud matters.

4. Monitoring identified risks

Areas examined

This chapter examines whether the Australian Taxation Office (ATO) has effectively managed, monitored and reviewed identified risks associated with the rapid implementation of economic response measures — including impacts to its existing operations.

Conclusion

The ATO has established effective arrangements to monitor identified risks and associated risk mitigation strategies through the project management and governance structures established for the six economic response measures. The ATO has commenced planning for the further adjustment of existing operations in line with changed circumstances and risks.

4.1 The Commonwealth Risk Management Policy states that risk management is not a ‘one-off event’. The effective management of risk is a process of continuous improvement, requiring regular review and evaluation mechanisms.

4.2 Regularly monitoring risks and the effectiveness of mitigation strategies is important where there are ongoing changes in the broader risk environment and where specific changes have been introduced for some of the six economic response measures.

4.3 To assess the ATO’s monitoring of identified risks and strategies, this chapter examines whether the ATO has effectively:

  • developed identified treatment strategies for fraud and compliance risks;
  • monitored and managed identified risks, including to its business-as-usual activities; and
  • reviewed and adjusted its business arrangements in line with changed risks and circumstances.

Have risk management strategies been implemented as intended?

The ATO has progressively developed and commenced the implementation of treatment strategies for fraud and compliance risks associated with the economic response measures.

4.4 As indicated in paragraph 2.18, the ATO identified the need to develop treatment strategies for fraud and compliance risks to support the integrity of the measures.

4.5 Compliance strategies have been documented for five of the measures — JobKeeper, Boosting Cash Flow for Employers, Early Release of Superannuation, Backing Business Investment and Enhancing the Instant Asset Write-Off.

4.6 For the Temporary Reduction of Superannuation Minimum Drawdown Rates measure, the ATO determined that specific compliance and assurance processes were not required as existing controls in the sector (such as within APRA-regulated funds) were sufficient. The Risk Assessment and Treatment Plan sets out the ATO’s intended controls for this measure.

Strategies for JobKeeper, Early Release of Superannuation and Boosting Cash Flow for Employers

4.7 During the design phase of JobKeeper, Early Release of Superannuation and Boosting Cash Flow for Employers, the ATO identified and developed client ‘personas’ as a tool to typify the different integrity risks that each measure may face. Collectively, these personas aimed to portray a spectrum of non-compliant behaviour, from serious organised crime groups targeting the economic response measures to vulnerable persons acting in error. The ATO used this analysis to develop compliance strategies for these measures consistent with a set of overarching integrity principles, listed in Figure 4.1.

Figure 4.1: Integrity principles for three measures

A five-step flowchart showing the integrity principles for three measures.

Source: Reproduced from the ATO’s records.

4.8 The ATO’s compliance programs for JobKeeper, Early Release of Superannuation and Boosting Cash Flow for Employers comprise four broad categories of response:

  • initially excluding entities that the ATO could confirm do not qualify for the measure at the point of enrolment (for JobKeeper), application (for Early Release of Superannuation) or identification by the ATO (for Boosting Cash Flow for Employers);
  • identifying high risk payments and suspending these for review before payment is made (‘pre-issue’) — applicable to JobKeeper and Boosting Cash Flow for Employers only;
  • reviewing payments or determinations after they have been made (‘post-issue’) and taking remedial compliance action ranging from education and targeted messaging to applying penalties (unlike the first two categories, the ATO considered that these activities did not need to be planned in detail before the measures were rolled out44); and
  • complementary to these three categories, the ATO has undertaken to detect and investigate criminal activity throughout the life of each measure, based on the ATO’s existing criminal intelligence and investigation frameworks, such as accepting tip-offs through the ATO Tax Integrity Centre and information sharing with other government entities in the Serious Financial Crime Taskforce.
Aligning treatment strategies to risks

4.9 On 14 April 2020 the JobKeeper Board was briefed on 15 key compliance risks associated with the measure. The Board determined that it would address four of these risks with ‘enrolment’ and ‘pre-issue’ checks and the remainder with ‘post-issue’ activities. By 23 April 2020, the ATO had refined its pre-issue strategy to model a workflow for pre-issue checks and assign responsibility for pre-payment verification actions to business line areas in accordance with their responsibilities, with provision for prioritisation and overflow.

4.10 On 16 April 2020 the Cash Flow Boost core design team was briefed on eight key compliance risks associated with the measure. The ATO adopted a strategy whereby refund payments displaying indicators of the eight identified risks would be reviewed ‘pre-issue’ and where ineligibility or fraud could be confirmed payment of a Cash Flow Boost refund would be stopped. Payments that were not sufficiently risky to warrant pre-issue review, and assurance reviews of businesses displaying riskier indicators, would be addressed by ‘post-issue’ activities.

4.11 On 1 April 2020 the Early Release of Superannuation program lead briefed the Superannuation and Employer Obligations Risk Committee that two main integrity risks existed with the Early Release of Superannuation measure, described as identity theft and fraud risk, and the risk that applicants will misrepresent or inappropriately self-assess their eligibility. The ATO adopted a strategy whereby applicants would be subject to identity verification procedures before an application would be accepted. Limited automated controls would be established that would reject applicants upfront.

4.12 Unlike for JobKeeper and Boosting Cash Flow for Employers, the ATO did not implement controls to suspend applications ‘pre-issue’ pending review against eligibility criteria for the Early Release of Superannuation measure as the relevant legislation required the ATO to issue a determination upon receipt of an application that was not rejected upfront by the controls outlined in paragraph 4.11.45 However, the strategy also provided for ‘pre-issue’ scanning of applications with a view to identifying higher-risk determinations and flagging these with the nominated superannuation fund for additional scrutiny by the fund. The primary mechanism for assuring an applicant’s self-assessment of eligibility would be ‘post-issue’ activities.

Development of post-issue strategies

4.13 Following key implementation milestones for the three measures in April and May 2020, the ATO proceeded to develop its ‘post-issue’ integrity treatment strategies. On 30 June 2020, the ATO Executive Committee was jointly briefed on the proposed strategies for each of the three measures. Each brief:

  • estimated the prevalence of non-compliance remaining to be addressed within the measure (an example is provided in Box 12);
  • identified ‘risk pools’ of potentially non-compliant entities displaying similar typologies suitable for post-issue intervention; and
  • proposed a series of activities to address the potential non-compliance within these risk pools during the period July to December 2020.

Box 12: Assurance review for Early Release of Superannuation

In June 2020, the ATO commenced analysis of applications for early release submitted in 2019–20 to inform its post-issue compliance strategies. As reported to the ATO Executive Committee, the analysis used ATO data such as PAYG withholding tax records to identify applicants whose employment status and history did not appear to match the grounds nominated in their application for early release.

By 15 June 2020, the ATO reached a high degree of confidence with respect to the eligibility of around 70 per cent of applicants for early release; and lower confidence with respect to the eligibility of the remaining applicants. The ATO Executive Committee was briefed on the analysis, including a projection of how additional analysis and post-issue intervention would be likely to alter the initial estimates.

The figure in this box shows a side-by-side comparison of the ATO’s assurance work on the Early Release of Superannuation measure. The first bar column, under the heading ‘Where are we now’, says that the ATO had high confidence that around 70 per cent of applicants for this measure were eligible. It also says that 30 per cent of applicants may be ineligible. The second bar column, under the heading ‘Where we expect to be’, says that the ATO wants high confidence that more than 85 per cent of applicants will be eligible. It also says that around 10 per cent may be ineligible, with less than 1 per cent found to be fraudulent.

The ATO continued to refine its analysis beyond June, including conducting data-matching with Services Australia to confirm whether applicants were eligible on the ground of receiving government benefits such as JobSeeker.

By 31 July 2020, the ATO assessed that:

  • around 90% of applicants in 2019–20 were eligible to apply; and
  • under 0.02% of applications were affected by fraud.

Source: ANAO, based on the ATO’s data and records.

Tax labels for the two asset measures

4.14 Compliance risks for Backing Business Investment and Enhancing the Instant Asset Write-Off are set out in the ‘Integrity measures’ Risk Assessment and Treatment Plan for each measure, as well as being recorded in project-level risk registers. The compliance risks for both measures were assessed to be outside the ATO’s acceptable tolerance level.

4.15 A key limitation in the ATO’s ability to identify uptake and manage identified compliance risks for both measures is the absence of specific information being captured in the 2020 tax return process (Box 13). For both measures, the ATO sought to obtain specific ‘tax labels’ to directly identify claims for each measure.46 Due to the lead time required to introduce labels ahead of each tax year, no such label was able to be introduced for Backing Business Investment; and for Enhancing the Instant Asset Write-Off, the ATO has relied on existing labels covering claims by small businesses only.47

Box 13: Using specific tax labels to help manage identified compliance risks

Changes to the ATO’s annual tax return form require ICT systems development to occur within the ATO and within a community of third-party accounting software vendors that configure their products to communicate with ATO systems. There is usually a minimum six-month lead time for changes to the form.

On 27 March 2020 the project team for Backing Business Investment requested an urgent change to the 2020 company tax return form to include additional labels that would capture specific information pertaining to claims for accelerated depreciation under this measure. The label was intended to assist in the mitigation of compliance risks associated with the measure.

The request was not agreed by the Assistant Commissioner responsible for developing the return form, who noted that changes so late in the production schedule (that is, two months before implementation) would present substantial risks to Tax Time 2020 that could not be justified considering the measure could still be implemented with the existing form (such as by reporting Backing Business Investment claims together with other claims for depreciation as a single amount under the generic depreciation label).

The project team accepted this decision, and revised its treatment plan for compliance risks in financial year 2019–20 accordingly. Specific labels for Backing Business Investment and Enhancing the Instant Asset Write-Off have been sought for the 2021 tax year.

Source: ANAO, based on the ATO’s records.

Status and outcome of compliance actions

4.16 Key implementation phases of the compliance strategies for each of the five measures remain in progress. This is particularly so for Backing Business Investment and Enhancing the Instant Asset Write-Off, where claims for these measures are able to made in the 2020–21 tax year (with many businesses not required to lodge returns until the first half of 2022).

4.17 The ATO has developed a set of key performance indicators and controls for JobKeeper, Boosting Cash Flow for Employers, and Early Release of Superannuation. This information was provided to the first meeting of the ATO’s Stimulus Measures Oversight Committee meeting on 25 August 2020. Examples of the information provided to this Committee on the ATO’s compliance activities for each of the three measures is outlined in Table 4.1.

Table 4.1: Compliance activities for JobKeeper, Boosting Cash Flow for Employers and Early Release of Superannuation (17 August 2020)

Measure

Compliance activity

JobKeeper

  • Fraud detected — 46 businesses currently under active investigation; 8 matters referred to the Serious Financial Crime Taskforce (4 Australian Federal Police led); 38 referred ATO’s Criminal Law Program.
  • Number of penalties applied and total value — nil to date.
  • Number of overpayments made and total value — measure under development.
  • Prevented — almost 55,000 enrolments or applications ineligible; entity not meeting the basic JobKeeper payment eligibility criteria.
  • Number of reviews — approximately 75,000 clients have had (or currently have) a payment stopped for review. This is over 103,000 applications (2.85%)a for $1.123 billion in payments.

Boosting Cash Flow for Employers

  • Fraud detected — there have been no identified instances of systemic fraud in relation to cash flow boost.
  • Number of penalties applied and total value — there have been no penalties imposed to date.
  • Number of audits as at 14 August 2020 — paused credits for approximately 19,190 entities whilst undertaking pre-issue verification checks. 16,300 are completed and approximately 2890 still on hand.
  • Number of overpayments made and total value — identified and contacted approximately 1400 large public and private businesses where overpayments were made to a value of approximately $95 million. We are working with and supporting those businesses to repay overpaid amounts.

Early Release of Superannuation

  • Suspected fraud detected — around 800, less than 0.02% of total approved applications (1 in every 5000).
  • Number of penalties applied and total value — compliance (eligibility) assessments have commenced, but no penalties have been imposed at this stage.
  • Number of applications rejected/revokedb — Tranche 1 — 2.6% of total received (66,396 rejected/revoked). Tranche 2 — 2.1% of total received (32,423 rejected/revoked).
   

Note a: The ATO informed the ANAO that this percentage is based on 3,612,579 applications for JobKeeper over the reporting period 30 March 2020 to 11 August 2020.

Note b: Rejected applications are due to individuals applying for a second release in the same financial year; only one release is permitted under the law.

Source: ANAO, reproducing the ATO’s data.

Have risks and strategies been appropriately monitored?

The ATO has appropriately monitored identified risks and strategies. At August 2020, the ATO had revised Risk Assessment and Treatment Plans for four measures. A range of monitoring activities have been undertaken at a project level for all six measures.

4.18 Step four of the ATO’s risk methodology (Figure 1.2 in Chapter 1) states that: ‘Monitoring and assessing our strategies and risk management activities helps us determine their effectiveness and enables us to make adjustments as needed so we stay on track to achieve the objectives.’

4.19 Responsibilities for overseeing or monitoring risks, controls and treatment strategies are assigned to risk owners and risk managers under the ATO’s Enterprise Risk Management Framework. The monitoring of risk is also built into the ATO’s corporate project management method, and provided through the governance arrangements established for each measure.

Review of corporate Risk Assessment and Treatment Plans

4.20 The corporate Risk Assessment and Treatment Plans for the six economic response measures were developed to provide assurance that the elements of the ATO’s four-step risk methodology are being substantively considered on an ongoing basis.

4.21 A specific action outlined in the ATO’s Risk Management Guide is that risk ratings should be reviewed whenever there are changes in the environment. The ATO also requires that risk tolerances be monitored and reviewed throughout the risk management process.

4.22 As of August 2020 the ATO had revised the corporate Risk Assessment and Treatment Plans for two of three measures where the Australian Government had announced changes to the measures (Table 4.2).

Table 4.2: Risk Assessment and Treatment Plans updated (as of August 2020)

Measure

Summary of the changes made

Enhancing the Instant Asset Write-Off

The Risk Assessment and Treatment Plan was reviewed in July 2020 and endorsed by the Risk Manager/Assistant Commissioner on 4 August 2020.

The review followed the Australian Government’s announcement that the timeframe for this measure would be extended from 30 June to 31 December 2020.

Minor changes were made to the document to reflect the extended timeframes for this measure.

The overall risk rating remained unchanged at ‘Significant’.

The tolerance level was revised from ‘High’ to ‘Tolerable’.

JobKeeper

The Risk Assessment and Treatment Plan for the JobKeeper measure was reviewed and endorsed by the Risk Owner on 3 August 2020, following announced changes to the scheme on 21 July 2020.

No changes were made to the document.

The overall risk rating and tolerance level remained unchanged at ‘Significant’.

The ATO updated other documentation relating to the proposed risk environment for the JobKeeper scheme.

The risk was closed by the Risk Owner on 3 August 2020. A new risk ‘ATO not ready to support extension/change to program’ was added to the JobKeeper risk register in July in anticipation of the extension announcement.

   

Source: ANAO, based on the ATO’s records.

4.23 A review date was not specified on the Risk Assessment and Treatment Plan for the Early Release of Superannuation measure. It was not evident from the ATO’s records whether the plan has been reviewed following the Australian Government’s announcement (on 23 July 2020) that the application timeframe for the second tranche of the measure would be extended from 24 September to 31 December 2020. The ATO informed the ANAO that the change in timeframe is not expected to result in a significant number of additional applications, beyond the surge in applications for 2020–21 shortly after 1 July 2020.

4.24 For the three remaining measures:

  • The Risk Assessment and Treatment Plan for Backing Business Investment was revised on 30 July 2020. Minor changes were made to the content, including a reference to treatment plans being developed for different client groups; no changes were made to the overall risk rating or tolerance levels.
  • A monthly review cycle was specified in the Boosting Cash Flow for Employers measure. While there was no evidence that the plan has been reviewed in line with this timeframe, the ATO undertook ‘deep dives’ of this measure in May, June and July 2020, which included an assessment of risks and integrity controls.
  • A quarterly review period was specified for the Temporary Reduction of Superannuation Minimum Drawdown Rates measure. The Risk Assessment and Treatment Plan was revised on 24 August 2020. Minor changes were made to the document to reflect changes in controls. The overall risk rating and tolerance levels were unchanged.

Project-level monitoring

4.25 The ATO’s records provide evidence of a range of monitoring activities and actions being undertaken at a project-level for the six measures, including through the governance bodies described in paragraph 2.13. Key examples are provided in Table 4.3.

Table 4.3: Examples of project-level monitoring activities and actions on the six economic response measures

Measure

Activities and actions

Enhancing the Instant Asset Write-Off

  • Revised communication activities to reflect the changes to existing depreciation allowances and the revised eligibility criteria.
  • Revising information available for contact centre staff to answer questions on the new criteria.

Backing Business Investment

  • Monitoring and completing the new IT build required to implement the measure and provide an online calculator to assist taxpayers.
  • Developing communications activities to publicise the new depreciation regime available.
  • Discussions with stakeholders following identification of a misunderstanding regarding the eligibility of vehicle depreciation under this measure.

Temporary Reduction of Superannuation Minimum Drawdown Rates

  • Project closure report prepared after communications strategy and IT changes implemented.
  • A survey was undertaken into the awareness and take-up of the measure with the outcomes provided to the minister.

Early Release of Superannuation

  • Issuing Client Relationship Team (CRT) alerts to the superannuation industry on data file information, updated questions and answers, and eligibility, application and security controls.
  • Updating the User Experience Compliance Controls.
  • Submission of Project Status reports to the ATO’s Central Project Management Office covering the status of key tasks.
  • Updating the web content as the measure matured.
  • Providing updates to the COVID-19 Steering Committee, the ATO Executive Committee and the Stimulus Measures Oversight Committee.

Boosting Cash Flow for Employers

  • Updating system-based risk rules to help identify inappropriate claims.
  • Reviewing strategies for compliance activities post-issue of Boosting Cash Flow for Employers payments and addressing fraud.
  • Revising the communications strategy for the measure with current activities.
  • Submission of project status reports to the ATO’s Central Project Management Office covering the status of key tasks.
  • Providing updates to the COVID-19 Steering Committee, the ATO Executive and the Stimulus Measures Oversight Committee.

JobKeeper scheme

  • Revising existing and developing new media content to reflect current status of measure.
  • Adjusted the number of contact centre staff to meet the support required for JobKeeper.
  • Reviewing outstanding work management activities on employee verification risks following application of the risk rules, with a summary report prepared.
  • Briefing the Project Board on the status of the measure, data sets and enrolments.
  • Developing practice notes to support administration of the scheme.
  • Undertaking ‘deep dives’ into specific aspects of the measure, including eligible business participants and applications held in suspense for review following application of the risk rules.
   

Source: ANAO, based on the ATO’s records.

Oversight of compliance strategies

4.26 As discussed in paragraph 2.19, papers on the ATO’s compliance strategies for JobKeeper, Boosting Cash Flow for Employers and Early Release of Superannuation were provided to the ATO Executive Committee in early June 2020. The risk profile and summary for all six measures (as of July 2020) were provided to the newly-established Stimulus Measures Oversight Committee to consider at its first meeting on 25 August 2020. The documents provide an assessment of the risk rating, current control actions and tolerance considerations against the identified categories of risk (such as compliance, client experience, data and systems).

Have business arrangements been reviewed/adjusted in line with changed circumstances and risks?

The ATO has reviewed business arrangements in line with changed circumstances and risks. Future state strategic planning has commenced, including for the adjustment of pre-existing arrangements for debt and lodgment.

4.27 The six economic response measures being administered by the ATO are intended by the Australian Government to be temporary rather than ongoing. This requires the ATO to have arrangements in place to manage the closure of the measures, and to transition to ongoing business activities.

Closure reports for the measures

4.28 The streamlined project governance arrangements determined for the six measures include the requirement to prepare a ‘closure report’ for each measure. The closure report is to provide a range of information on project performance, conformance with legislative and other requirements, and lessons learned. The closure reports require the consideration of an appropriate range of matters and are a standard requirement under the ATO’s project management framework.

4.29 As at 15 August 2020, one of the six measures had been required to produce a final closure report — the Temporary Reduction of Superannuation Minimum Drawdown Rates. The closure report was finalised on 13 May 2020, and was approved by the Senior Accountable Officer. In relation to project performance, the closure report stated that:

There were no impacts to delivering the outcome of the project and all milestones were delivered on time. The risks associated with this project were successfully mitigated with no escalations. The critical date of 31 March 2020 to deliver ATO web content and scripting has been met.

4.30 The indicative timeframes for the completion of the closure reports for the remaining five measures are:

  • Boosting Cash Flow for Employers, November 2020;
  • Enhancing the Instant Asset Write-Off, February 2021;
  • Early Release of Superannuation, March 2021;
  • JobKeeper scheme, June 2021; and
  • Backing Business Investment, August 2021.

4.31 Consistent with the ATO’s standard requirements, a more comprehensive closure report is required for the remaining five measures than for the Temporary Reduction of Superannuation Minimum Drawdown Rates measure (which adopted a tailored approach to reflect the size of the measure).

Focus on current, emerging and longer-term risks

4.32 As discussed in paragraph 2.21, the ATO’s Enterprise Risk Management Committee (ERMC) has considered the impacts associated with the COVID-19 pandemic, and its impacts on the ATO’s operations.48

4.33 In May 2020, the ERMC considered papers on the theme of ‘Recovery and Future Strategy’. These papers included:

  • Transitioning back to a ‘new normal’;
  • Managing client transition back to business-as-usual;
  • Impact of COVID-19 on the ATO’s enterprise risk profile; and
  • Long term impacts on ATO and Government’s objectives.

4.34 In June 2020 the ERMC finalised its forward work program for the remainder of 2020. The work program included an ongoing focus on COVID-19 matters (Strategic decision points — Post COVID-19 exit strategy, and Post COVID-19 review — Lessons Learned — Implementing Law Reform). The forward work program also includes a series of ‘deep dives’ in other focus areas — for example, managing tax and superannuation administration in a recession.

4.35 The forward work program was considered by the ATO Executive Committee on 3 June 2020 and was amended to include ‘high priority’ focus areas endorsed by the Executive (such as the ATO’s future operating model, and its management of small business clients).

Debt and lodgment strategy

4.36 The ATO has developed a three-phase Debt and Lodgment Strategy aimed at re-engaging with taxpayers, as illustrated in Figure 4.2. The strategy follows the pause in ATO-initiated debt recovery and non-lodgment interventions in the period March to June 2020. The decision to pause these interventions was made by the ATO’s COVID-19 Steering Committee.

Figure 4.2: Overview of the ATO’s draft Debt and Lodgment Strategy 2020–21

This figure shows three phases of the ATO’s draft debt and logdment strategy following a pause in ATO-initiated actions in March 2020. Phase 1 is recommencing engagement; Phase 2 is introducing consequence warnings; and Phase 3 is introducing consequences

Source: Reproduced from the ATO’s records (July 2020).

4.37 The ATO’s records indicate that the strategy is important in preventing taxpayers from losing touch with the tax system given the disruption to business and the significant number of deferred due dates and payment plans.

4.38 The development of the ATO’s Debt and Lodgment Strategy 2020–21 also recognises that the ATO’s ‘debt book’ has increased as a result of the pandemic and associated economic conditions. The ATO advised that, as at 30 June 2020, the collectable debt book was $34.18 billion.

4.39 The strategy also seeks to maximise opportunities of a new operating model for debt and lodgment introduced from 1 April 2020. The ATO informed the ANAO that the model aims to differentiate its interactions with clients, depending on whether clients are in vulnerable situations and need assistance, or are well-positioned to meet their obligations and are appropriately prioritised and managed. The ATO noted that the implementation of the new model is in progress.

Appendices

Appendix 1 Australian Taxation Office response

The response from the Australian Taxation Office. A summary of the response is contained in the summary chapter of this report.

Footnotes

1 This period covers the key implementation milestones listed in Figure 1.1.

2Biosecurity (Listed Human Diseases) Amendment Determination 2020, 21 January 2020.

3Biosecurity (Human Biosecurity Emergency) (Human Coronavirus with Pandemic Potential) Declaration 2020, 18 March 2020.

4 See section 16 of the PGPA Act, available at: https://www.legislation.gov.au/Details/C2017C00269 [accessed 24 August 2020].

5 The Department of Finance has issued guidance on implementing the Commonwealth Risk Management Policy, available at: https://www.finance.gov.au/government/managing-commonwealth-resources/implementing-commonwealth-risk-management-policy-rmg-211 [accessed 24 August 2020].

6 Mr Chris Jordan AO, Commissioner of Taxation, as quoted in Senate Select Committee on COVID-19 (2020) Debates, 7 May 2020, p. 1. In addition to the five measures mentioned in the Commissioner’s statement, the ATO is also administering the Temporary Reduction of Superannuation Minimum Drawdown Rates measure, as described in Table 1.1.

7 This document is dated 1 March 2015 and was last reviewed on 2 September 2019.

8 Standards Australia (2018) Risk Management – Guidelines (AS ISO 31000:2018).

9 The purpose of the Guide is to outline key features of the ATO’s Enterprise Risk Management Framework and provide information on completion of the fields in the ATO’s Enterprise Risk Register.

10 Further details on the ANAO’s COVID-19 multi-year audit strategy can be found at: https://www.anao.gov.au/work-program/covid-19.

11 That is, the officer to whom the Senior Accountable Officer reports in the course of ordinary ATO operations.

12 As discussed further in paragraph 3.19.

13 An ‘artefact’ is a document used in the decision-making process such as an email, brief, or meeting paper.

14 Specifically called the ATO Corporate Project Method.

15 In September 2020, the ATO informed the ANAO that its current practice is to refer to the accountable officer for each measure as the ‘Senior Responsible Officer’.

16 This is discussed further at paragraphs 4.32 to 4.35.

17 An oversight committee was contemplated by the ATO as part of the original governance arrangements for the JobKeeper scheme. The need for this committee was revisited in PwC’s review.

18 The ATO has changed the name of this committee to the Economic Response Oversight Committee.

19 See page 6 of the ANAO’s Audit Insights paper on the Rapid Implementation of Australian Government Initiatives, available at: https://www.anao.gov.au/work/audit-insights/rapid-implementation-australian-government-initiatives [accessed 7 September 2020].

20 For example, Client Engagement Group.

21 See Table 3.3 for a definition of a Business Risk.

22 The ATO informed the ANAO that its methods to expedite development included increased overtime hours and shift work, diverting resources from non-critical projects to these measures, and concurrent scheduling of activities that would usually be done consecutively.

23 The ATO ‘blocks’ calls when inbound calls are expected to significantly exceed the ATO’s capacity to answer them. According to the ATO, this minimises the risk of clients queuing for excessive periods of time, and then subsequently abandoning the call without receiving service.

24 Figure 2.2 depicts calls blocked where a caller was able to make selections in the interactive voice recording menu and selected an option leading to a service channel whose customer service officers had reached capacity. Callers blocked at the network level would simply receive a message requesting the caller call back later, without accessing the interactive voice recording menu at all.

25 The ATO informed the ANAO that the data it used to quantify these calls expires after 24 hours. By the time the ATO started investigating this issue, the data for calls on 20 April was unavailable.

26 The ATO’s Shared Risk Guide is in draft (Version 0.3, 15 August 2019).

27 The ATO’s 2019–20 Corporate Plan includes a performance measure of influencing government and Treasury perceptions of the ATO and the quality of its advice.

28 The cross-agency working group on the Early Release of Superannuation measure comprised representatives from Treasury, ASIC, APRA and the Australian Transaction Reports and Analysis Centre (AUSTRAC).

29 The ATO’s stewardship groups are a standing consultation arrangement with industry and government representatives focussing on a particular market or product segment across the tax and superannuation systems.

30 The Commonwealth Risk Management Policy defines ‘risk tolerance’ as the ‘levels of risk taking that are acceptable in order to achieve a specific objective or manage a category of risk.’

31 That is, the objectives of a program or project must be determined before the effects of uncertainty on the objectives of the program or project can be managed.

32 The ATO informed the ANAO that core design teams are put in place at the discretion of the Senior Accountable Officer or Program Board, and are generally established where the complexity, size or scope of the design work may benefit from bringing together subject matter experts to flesh out the high level design of a project or program.

33 This measure involved adjusting an existing obligation on the superannuation industry, with no IT development or business process changes within the ATO.

34 As mentioned in paragraph 2.18, the ATO Executive Committee endorsed the risk strategy for the economic response measures, noting that additional work was required to clearly articulate the risks arising along with the mitigation and compliance strategies.

35 The ATO’s Risk Management Guide also notes that where gaps or uncertainties have been identified in the controls, treatment plans can still be developed if desired.

36 These documents identify behavioural integrity and fraud risks as well as potential prevention and mitigation strategies to maintain integrity and prevent abuse.

37 The Phoenix Taskforce comprises 38 federal, state and territory government agencies, including the ATO, ASIC, the Attorney-General’s Department, and the Fair Work Ombudsman. The Phoenix Taskforce takes a whole-of-government approach to combating illegal phoenix activity. Illegal phoenix activity is when a new company is created to continue the business of a company that has been deliberately liquidated to avoid paying its debts.

38 The Commonwealth Risk Management Policy defines ‘Risk appetite’ as ‘The amount of risk an entity is willing to accept or retain in order to achieve its objectives. It is a statement or series of statements that describes the entity’s attitude toward risk taking‘.

39 The ATO serves four ministers: the Treasurer; the Minister for Housing and Assistant Treasurer; the Assistant Minister for Superannuation, Financial Services and Financial Technology; and the Assistant Minister for Finance, Charities and Electoral Matters.

40 The ATO’s practice is to provide advice through the Parliamentary Document Management System to ministers’ offices (that is, to ministerial advisers and Departmental Liaison Officers) rather than directly to ministers.

41 Ministerial submissions are ATO-initiated documents. Submissions provide formal advice on significant issues or action to be taken by the ATO. Submissions are addressed to a minister.

42 In contrast to ministerial submissions, which are ATO-initiated documents, ministerial briefs are requested by the relevant minister’s office and provide information on a range of matters. The ATO sends ministerial briefs to the relevant minister’s office.

43 The reason for discontinuing these plans was not evident from the ATO’s records.

44 The ATO informed the ANAO that there were two underlying reasons for this approach. First, all other things being equal, recovering overpayments is a less effective and efficient approach to managing eligibility relative to seeking not to make overpayments in the first place. Second, given the confined timeline available for implementation of the measures, focussing on the first two categories (that is, the first two dot-points in paragraph 4.8) was prioritised prior to the measures going live.

45 See sub-regulation 4.22B(3) of the Retirement Savings Accounts Regulations 1997 and sub-regulation 6.19B(3) of the Superannuation Industry (Supervision) Regulations 1994.

46 A ‘tax label’ is a field in the ATO’s tax return form that seeks to capture taxpayer data on a specific tax matter.

47 That is, businesses with less than $10 million in aggregated turnover.

48 The stated purpose of the ERMC is ‘To improve the ATO’s ability to manage risk associated with achieving the strategic objectives that enable the ATO to fully carry out its purpose to contribute to the economic and social wellbeing of Australians by fostering willing participation in the tax and superannuation systems.’