Digital Delivery for Australian Government Agencies: A Practical Playbook
Government digital projects don't fail for the same reasons private sector ones do. The technology is rarely the hard part; a citizen portal or case management system uses well understood patterns. What sinks agency projects is everything around the technology: procurement that doesn't match delivery reality, security and accessibility treated as a late stage review instead of a design input, and no clear owner once the initial build is done. This playbook covers what we've learned delivering government digital work at national scale, starting with our team's role in the Digital Delivery of COVIDSafe at the Australian Digital Transformation Agency (ADTA).
Why government projects face a different bar
A consumer app that ships with a rough edge gets a bad review. A government system that ships with a rough edge gets a Senate estimates question, an audit finding, or a story about a citizen who couldn't access a service they were entitled to. That level of scrutiny is a feature of the environment, not a reason to avoid it, but it means security, accessibility and auditability have to be part of the brief from day one rather than something bolted on before launch.
Five principles that hold up under scrutiny
Security and compliance are inputs, not gates
Waiting until pre launch to run a security review means every finding becomes a delay. Threat modelling and compliance requirements (Essential Eight, relevant ISM controls, agency specific policy) should shape the architecture from the first sprint.
Accessibility is a requirement, not a checkbox
WCAG conformance affects real citizens, including the ones least able to use an alternative channel if the digital one fails them. It needs dedicated testing, not a plugin scan at the end.
Governance needs a named owner
Multi stakeholder government projects stall when no single accountable owner can make a call. Agree early who signs off on scope, security exceptions, and delivery trade offs.
Plan for the adoption curve, not just the launch
A citizen facing service or internal case management tool doesn't get adopted on day one. Budget for the change management, training and support that gets a workforce or public actually using it.
Build the audit trail in from the start
Who accessed what, when, and under what approval is a question agencies get asked early and often. Retrofitting logging and access control after launch is far more expensive than designing for it up front.
What national scale delivery actually teaches you
Delivering COVIDSafe under national scrutiny, and supporting federal and ACT agency work since, taught us that trust is earned in the unglamorous parts of a project: consistent security posture, a clear escalation path when something goes wrong, and being straightforward with stakeholders about trade offs instead of overselling a timeline. Agencies that build those habits in from the start move faster later, because they aren't relitigating security or accessibility decisions during the review that happens right before launch.