Assurance implementation requirements

When an in-scope investment is funded, the DTA’s focus turns to monitoring implementation of agreed assurance arrangements and ensuring that minimum requirements continue to be met. This work is undertaken to ensure that assurance advice and information obtained by investments is of consistently high-quality, is sufficiently independent and is used effectively to support decision-making and maintain delivery confidence.

Regardless of tier, investments are required to continue to apply the 5 Key Principles for Good Assurance during delivery. All investments should be benefits-led, with a primary focus on delivering value.

For guidance:

see the Benefits Management Policy
view a simple guide to Minimum Assurance Requirements.

Requirements by Tier

Tier 1

SRO to complete Digital Governance Program, as required.
Include DTA representation as an observer on your investment’s primary governance board.
When approaching the market for independent assurance providers, agree approach to market materials with the DTA, for example, your Request for Quote or alternative high-level procurement documentation.
Agree terms of reference or statement of requirements for external assurance activities with the DTA prior to commencement.
Review and update your Assurance Plan every 6 months or as otherwise stated in your Assurance Plan. Your updated Assurance Plan must be provided to the DTA for review and agreement. The final, SRO approved, governance board endorsed version must also be provided to the DTA.
Complete regular assurance activities that result in a DCA rating, at least quarterly.
Provide draft and final assurance reports to the DTA for oversight purposes. Note that Gateway Review reports will be handled in accordance with agreed protocols for the handling of Gateway material.
Ensure governance boards with DTA representation receive regular progress reporting on implementing agreed assurance recommendations.
Advise the DTA when there is a material variation from planned assurance arrangements.

Tier 2

SRO to complete Digital Governance Program, as required.
Include DTA representation as an observer on your investment’s primary governance board, if requested by the DTA.
Provide the DTA with the SRO approved terms of reference or statement of requirements for external assurance activities prior to commencement.
Review and update your Assurance Plan at least every 12 months or as otherwise stated in your Assurance Plan. Your updated Assurance Plan must be provided to the DTA for review and agreement. The final, SRO approved, governance board endorsed version must also be provided to the DTA.
Complete regular assurance activities that result in a DCA rating, at least every 6 months.
Provide final assurance reports to the DTA for oversight purposes.
Provide summary reporting to the DTA on progress of implementing assurance arrangements.
Advise the DTA when there is a material variation from planned assurance arrangements.

Tier 3

SRO to complete Digital Governance Program, as required.
Provide final assurance opinions and reports to the DTA for oversight purposes.
Review and update your Assurance Plan as needed to retain its currency. Your updated Assurance Plan must be provided to the DTA for review and agreement. The final, SRO approved, governance board endorsed version must also be provided to the DTA.
Advise the DTA when there is a material variation from planned assurance arrangements.

Delivery confidence assessments during implementation

The DTA draws heavily on assurance information to inform and focus its oversight and engagement across the portfolio of in-flight digital investments.

Independent assurance activities that agencies conduct will result in Delivery Confidence Assessment (DCA) ratings. These confidence ratings provide an indication of an investment’s overall trajectory to deliver on intended outcomes and benefits.

As per assurance requirements articulated in the previous sections:

Tier 1 investments are required to conduct assurance activities resulting in a DCA on a quarterly basis with draft and final assurance reports provided to the DTA.
Tier 2 investments are required to conduct assurance activities resulting in a DCA on a biannual basis with final assurance reports provided to the DTA.
Tier 3 investments are recommended to conduct assurance activities resulting in a DCA as needed with final assurance reports provided to the DTA.

Depending on the tier your investment is assigned, different minimum assurance planning, assurance implementation and escalation protocol requirements will apply.

To confirm your investment tier, please contact investment@dta.gov.au. For other editions in the series, visit the DTA’s Digital project research series.

DCA ratings and descriptions

Consistency in how DCAs are defined is critical to the effectiveness of the DTA’s oversight. Assurance activities that require the inclusion of a DCA in reports provided to the DTA must use the below definitions which align to the DCA ratings used for Australian Government Assurance Reviews or, with the agreement of the DTA, use other definitions which map to the below ratings.

High: Successful delivery of the investment to time, cost, quality standards and benefits realisation appears highly likely and there are no major outstanding issues that at this stage appear to threaten delivery significantly.
Medium High: Successful delivery of the investment to time, cost, quality standards and benefits realisation appears probable however constant attention will be needed to ensure risks do not become major issues threatening delivery.
Medium: Successful delivery of the investment against budget, schedule, scope and benefits, appears feasible but significant issues already exist, requiring management attention. These appear resolvable at this stage and, if addressed promptly, should not present a cost/schedule overrun or loss/delay of benefits.
Medium Low: Successful delivery of the investment requires urgent action to address major risks or issues in a number of key areas. Changes to budget, schedule, scope or benefits may be necessary if the investment is to be delivered successfully.
Low: Successful delivery of the investment requires changes to budget, schedule, scope or benefits. There are major issues with investment definition, schedule, budget, quality and/or benefits delivery, which don’t appear to be manageable or resolvable without such changes being made.

Guidance for assessing DCAs

The DTA has collaborated with academia to develop guidance for assessing the delivery confidence of digital projects. For other editions in the series, visit the DTA’s Digital project research series.

Major Digital Projects Report

DCA ratings are released publicly every year through the Major Digital Projects Report (unless exempt, including due to national security considerations). This report provides transparency over digital project performance for Parliament and Australians.

For more information on the report, please contact assurance.reporting@dta.gov.au.

Assurance Framework for Digital and ICT Investments