The Tax Office's response to major outages hitting its IT systems was effective, despite shortcomings in a plan it used when handling problems with critical infrastructure, the national auditor says.
Subscribe now for unlimited access.
$0/
(min cost $0)
or signup to continue reading
A report released on Tuesday looking at the Australian Taxation Office's response to its tech failures found it was pursuing reforms recommended following two massive IT crashes in December 2016 and February 2017.
While that June review had shaped its reforms since, and the agency had achieved four of the 14 recommendations, the Australian National Audit Office said "considerable work" was needed to make the other planned changes before the ATO achieved many of their intended results.
The auditor also found the ATO lacked service commitments relating especially to the availability of its IT systems, but that the Tax Office did specify system outage tolerances in its major contracts with service providers.
"To monitor the impact of ICT service outages on satisfaction with its services, the ATO should develop service standards that are aligned with system outage tolerances in its contracts with ICT service providers," it said.
As outages gripped its IT systems in December 2016 and February 2017, the ATO resorted to a plan in response that was limited in correcting system failures with critical infrastructure including data centres.
"The business continuity processes also did not recognise weaknesses in ICT design - particularly that the system recovery tools used to restore ICT services were on the affected storage area networks - which resulted in services not being fully restored for ten days for the December 2016 incident and five days for the February 2017 incident."
The auditor said that despite its limited planning for the critical failures, the ATO's responses to the incidents were largely effective, as it worked closely with the contracted ICT service providers to identify the system fault and restore services.
It could have better communicated with stakeholders throughout the incidents, the auditor said.
An independent review by consulting firm PwC, released in December, found a massive failure of Tax Office IT systems had a "disproportionately significant impact" on services because such a meltdown had not been planned for, while remediation efforts might not be effective.
Tax commissioner Chris Jordan has previously said the major outages were unexpected and, to the ATO's knowledge, unprecedented.
ATO chief information officer Ramez Katf said changes including a major refresh of the hardware and software used to run client-facing systems were already under way.
"Through improved real-time monitoring, we are better placed to detect and respond to issues to minimise any impact on the community," he said.
"We will focus on improving our IT design and governance, further strengthening our cyber security posture and improving the technology used by ATO staff to ensure they have the right tools to do their job."
Mr Katf said the ATO had made progress in the last six months implementing recommendations of its review, including improvements to the business continuity plan criticised in the auditor's report, and real-time monitoring of systems.
More than 20 outages have hit the Tax Office's systems in two years, and a parliamentary inquiry is investigating the Australian Public Service's tech reforms prompted in part by the agency's IT failures.
Follow Doug Dingwall on Twitter.
