Search

Assurance Planning Requirements

The goal of structured assurance planning is to ensure that all in-scope investments proactively design fit-for-purpose and proportionate assurance arrangements which ensure, if the investment is funded, that assurance is applied effectively to support successful delivery and realisation of expected benefits. 

Regardless of tier, all in-scope investments are required to agree an Assurance Plan with the DTA prior to investment decision. This plan must show how the investment will meet the 5 Key Principles for Good Assurance as well as the requirements applicable to the tier. A specific recommendation must be included in your investment submission seeking Cabinet agreement to the Assurance Plan. The DTA will advise and support you in preparing this.

Minimum Requirements by Tier 

Tier 1 and Tier 2 

Assurance arrangements must address the 5 Key Principles for Good Assurance and meet the minimum requirements laid out below. 

Minimum Requirements 

The DTA must be satisfied that you have: 

• Mapped planned assurance activities to key risks, milestones and decision points (the DTA will assess whether the link between planned activities and achieving the investment outcomes and benefits’ are sufficiently clear, and check to ensure overlap is minimised and assurance is proportionate to risk). 
• Integrated assurance into your governance approach (this includes in the terms of reference for governance bodies). 
• Identified who is accountable for ensuring a fit for purpose assurance approach is achieved and maintained for the investment. This includes regularly reviewing the Assurance Plan. For Tier 1 investments, the plan should be reviewed at least every 6 months. For Tier 2, this would generally be at least every year.
• Put arrangements in place to meet the mandatory DTA assurance oversight requirements during delivery (including, for Tier 1 investments, participation by the DTA as an observer on the primary investment governance body). 
• Budgeted for assurance. 
• Planned for regular assurance activities that provide a Delivery Confidence Assessment (DCA) rating, undertaken by suitably skilled, independent and objective assurance providers using the Assurance Framework’s DCA scale outlined in the Assurance Implementation Requirements section (see page 13). For Tier 1 investments, the plan should include assurance activities resulting in a DCA rating at least quarterly. For Tier 2, the plan should include assurance activities resulting in a DCA rating at least every 6 months. 

Tier 3 

Assurance arrangements must address the 5 Key Principles for Good Assurance and the minimum requirements below. The level of detail required for Tier 3 investments will be agreed between the DTA and the agency. 

Minimum Requirements 

The DTA must be satisfied that you have: 

• Arrangements which align to the 5 Key Principles for Good Assurance. 
• Arrangements which are commensurate to the risk and complexity of the proposed investment, which will support good decision-making. 
• Considered and included assurance activities that result in DCA ratings – as needed. 

How DTA Assesses Assurance Plans 

The level of assurance applied to an investment must always be commensurate to risk and complexity. The DTA will assess Assurance Plans with a focus on ensuring that they meet the 5 Key Principles for Good Assurance. This includes by ensuring all plans are: 

• Focussed on key risks and the areas of most importance to successful delivery. 
• Designed to maximise the value of assurance to decision-making, including by timing activities to feed into key decisions. 
• Have clear governance of assurance arrangements, with a focus on maximising the value of assurance including through timely implementation of recommendations. 
• Manage the compliance burden placed on teams through assurance activities, including by avoiding overlap. 

The DTA does not start from a position that every investment requires more assurance. In fact, if the DTA’s assessment of proposed arrangements suggests that there is excessive assurance, or that assurance from multiple sources needs to be better coordinated, the DTA may encourage an agency to reconsider the coverage or frequency of assurance activities. 

Assurance and Benefits Management 

Better practice benefits management applies to all digital and ICT-enabled investments irrespective of size, scale, and complexity. 

Without a clear understanding of the benefits an investment is funded to deliver, decisions made during an investment’s implementation can result in the investment failing to achieve its intended outcomes. 

Suitable and measurable benefits should be identified during investment planning and a culture of reporting benefits embedded in the governance and assurance activity arrangements. This approach not only enables governance bodies to manage and monitor investments to determine whether change is required but can be used as a recovery action to refocus investments on delivering what is important or essential. 

Alignment and compliance with DTA’s Benefits Management Policy (BMP) is assessed by the DTA during the Digital Capability Assessment Process (DCAP) and considered throughout the delivery of an investment. As with all assurance activities, the level of BMP assessment is commensurate with investment, stage, size, and complexity. 

Governance Body Participation 

For all Tier 1 and some Tier 2 investments, the DTA participates as an observer on investment governance bodies to monitor assurance arrangements. This includes ensuring that the arrangements agreed in the Assurance Plan are implemented and the 5 Key Principles for Good Assurance are effectively applied. 

Lead agencies are responsible for advising the DTA of governance body information by emailing investment@dta.gov.au. Agencies must also ensure that the governance body terms of reference clearly identifies DTA participation as well as the role of the governance body in overseeing assurance arrangements. This includes monitoring progress and implementing agreed recommendations. 

Relationship with the Gateway Review Process 

Your agency may also be required to engage with the Department of Finance to determine if any Australian Government Assurance Reviews (including Gateway reviews) will be recommended for an investment. 

Assurance arrangements coordinated by the Department of Finance and the DTA are complementary to one another. When determining whether an investment’s proposed assurance arrangements are fit-for-purpose and meet the requirements under the Assurance Framework, the DTA takes into consideration whether Australian Government Assurance Reviews are expected to be applied.

The Digital Experience Policy (DX Policy) 

Excellent digital services focus on the end-user. The Digital Experience Policy ensures this by mandating four standards that prioritise usability and accessibility from the outset of digital investments. Agencies are required to demonstrate compliance with the DX Policy and any applicable standards, including during project delivery. More information on how the DTA is ensuring compliance with the DX Policy is outlined in the Digital Experience Compliance and Reporting Framework Projects which are in-scope of the DX Policy should include relevant assurance activities in their Assurance Plans which ensure digital experiences enabled through the project will meet the policy requirements. This might include requiring that DX Policy compliance be assessed as part of a solution design review and/or as part of go-live assessments

Assurance implementation requirements

If an in-scope investment is funded, the DTA’s focus turns to monitoring implementation of agreed assurance arrangements and ensuring that minimum requirements continue to be met. This work is undertaken to ensure that assurance advice and information obtained by investments is of consistently high-quality, is sufficiently independent and is used effectively to support decision-making and maintain delivery confidence. 

Regardless of tier, investments are required to continue to apply the Key Principles for Good Assurance during delivery. Additionally, all investments should be benefits-led where the primary focus is on delivering value. The DTA’s Benefits Management Policy provides guidance on this topic.

Requirements by Tier 

Tier 1 

You must show that assurance is being applied effectively throughout delivery, including by continuing to apply the Key Principles for Good Assurance. You must also meet the following minimum requirements: 

• Include DTA representation on your investment’s governance committee. 
• Agree terms of reference for external assurance activities with the DTA prior to commencement. 
• When approaching the market for independent assurance providers, agree approach to market materials with the DTA. 
• Review and update your Assurance Plan through the governance committee with DTA representation every six (6) months (or as otherwise stated in your Assurance Plan), and provide the updated version to the DTA for review and agreement. 
• Provide draft and final assurance reports to the DTA for oversight purposes. Note that Gateway Review reports will be handled in accordance with agreed protocols for the handling of Gateway material. 
• Ensure governance bodies with DTA representation receive regular reporting on progress implementing agreed assurance recommendations. 
• Advise the DTA when there is a material variation from planned assurance arrangements. 

Tier 2 

You must show that assurance is being applied effectively throughout delivery, including by continuing to apply the Key Principles for Good Assurance. You must also meet the following minimum requirements: 

• Provide terms of reference for external assurance activities as endorsed by the SRO to the DTA for comment prior to commencement. 
• Review and update your assurance plan through your governance body at least every 12 months, and provide the updated version to the DTA for review. 
• Provide final assurance reports to the DTA for oversight purposes. Note that Gateway Review reports will be handled in accordance with agreed protocols for the handling of Gateway material. 
• Provide summary reporting to the DTA on recommendation implementation progress. 
• Advise the DTA when there is a material variation from planned assurance arrangements. 

Tier 3 

You must show that assurance is being applied effectively throughout delivery, including by continuing to apply the Key Principles for Good Assurance. You must also meet the following minimum requirements: 

• Provide final assurance opinions and reports to the DTA for oversight purposes. Note that Gateway Review reports will be handled in accordance with agreed protocols for the handling of Gateway material. 
• Advise the DTA when there is a material variation from planned assurance arrangements.

Delivery confidence assessments during implementation 

The DTA draws heavily on assurance information to inform and focus its oversight and engagement across the portfolio of in-flight digital and ICT investments. 

Delivery Confidence Assessment (DCA) ratings result from independent assurance activities that agencies conduct. These confidence ratings provide an indication of an investment’s overall trajectory to deliver on intended outcomes and benefits. 

As per assurance planning requirements articulated in the previous sections: 

• Tier 1 investments are required to conduct assurance activities resulting in a DCA on a quarterly basis with draft and final assurance reports provided to the DTA. 
• Tier 2 investments are required to conduct assurance activities resulting in a DCA on a biannual basis with final assurance reports provided to the DTA. 
• Tier 3 investments are recommended to conduct assurance activities resulting in a DCA as needed with final assurance reports provided to the DTA. 

Consistency in how DCAs are defined is critical to the effectiveness of the DTA’s oversight. Assurance activities that require the inclusion of a DCA in reports provided to the DTA must use the below definitions which align to the DCA ratings used for Australian Government Assurance Reviews or, with the agreement of the DTA, use other definitions which map to the below ratings.

Note: Depending on the tier your investment is assigned, different minimum assurance planning, assurance implementation and escalation protocol requirements will apply. To confirm your investment tier, please contact investment@dta.gov.au.

Guidance for assessing DCAs

Guidance for assessing DCAs The DTA has collaborated with academia to develop guidance for assessing the delivery confidence of digital projects. For more information, visit the DTA’s Digital project research series.

Major Digital Projects Report 

Major Digital Projects Report DCA ratings are released publicly every year through the Major Digital Projects Report (unless exempt, including due to national security considerations). This report provides transparency over digital project performance for Parliament and Australians. 

For more information on the report, please contact portfolio.assurance@dta.gov.au

Escalation protocols

Assurance escalation protocols focus on supporting agencies in the timely resolution of delivery challenges experienced by their investments, as well as keeping Ministers and senior leaders informed of underperforming digital and ICT investments. 

The DTA advises the Government on the progress of major digital projects through regular reporting to the Minister for Finance. This is primarily focused on building visibility of overall portfolio performance and systemic issues which would benefit from whole-of-government responses consistent with the DTA’s mandate. 

Before applying the protocols, the DTA will engage with the lead agency to further understand sources of stress and how the DTA can best support recovery. This stage, known as triage, will ultimately determine whether escalation protocols are necessary and which protocol is the most appropriate. 

Escalation protocols are triggered based on an investment’s Delivery Confidence Assessments (DCAs) and other relevant assurance information. There are three escalation protocols, these are Remediation Plan, Independent Health Check and Investment Review Meeting. 

Remediation plan 

This involves the lead agency preparing a structured, evidence-based plan to restore delivery confidence in the investment. The plan must be action-oriented, with clear individual accountability for implementation. The Remediation Plan is assessed by the DTA, with quarterly updates provided to Cabinet on progress. 

Remediation Plans are generally required from all Tier 1 and Tier 2 investments when DCAs are at Medium or below. Tier 3 investments must complete Remediation Plans when DCAs are at Medium-Low or below but are recommended to complete them starting from Medium.

Independent health check 

An independent assurer is engaged by the agency (in consultation with the DTA), to independently assess the viability of recovering the investment based on the active Remediation Plan, recommending any changes to the plan if required. 

The independent health check is triggered at the DTA’s discretion when efforts to remediate the investment (including application of the Remediation Plan) have been unsuccessful and delivery confidence is Medium-Low or below. 

Investment review meeting 

This is the final protocol. This protocol sees the DTA convene a meeting of relevant central agencies and the lead agency to conduct a review of the basis of the investment, and recommend to Government whether to terminate, suspend, or continue to attempt to remediate. 

Termination: in circumstances where remediation is not considered viable, and options to reshape the investment are limited or unlikely to succeed, recommending that the investment be ceased. 

Suspending: the lead agency is to minimise activity and spend to the extent practicable whilst options are formulated and brought forward for Cabinet decision. 

Continuing to remediate: applying an action plan agreed by the DTA, relevant central agencies and the lead agency as presenting a confident path back to green. Progress implementing this remediation plan will be closely monitored, with a further Investment Review Meeting scheduled at least every three months. 

The Investment Review Meeting protocol will be triggered at the DTA’s discretion when any investment reaches a Low DCA. It may be triggered at higher DCA ratings at the DTA’s discretion, including when an investment is at Medium-Low but reporting a worsening trajectory. 

When protocols are applied

The DTA’s decision whether to apply any of the escalation protocols will take into consideration whether the investment is currently the subject of the Enhanced Notification Process coordinated by the Department of Finance, and any other extant processes which engage Cabinet in reviewing the condition and trajectory of an investment such as the Department of Defence’s Projects of Concern regime. 

As a starting principle, the escalation protocols do not apply to the extent they overlap or duplicate a requirement already triggered through the Enhanced Notification Process. 

The DTA and the Department of Finance will work with agencies to explain requirements in this situation. The DTA will advise agencies when a protocol is required to be applied and provide ongoing support to ensure agencies are able to meet the requirements of the escalation protocols.