Government IT Procurement Red Flags: Global SI Audit Guide

This investigation is part of the Capgemini Series. For analysis of taxpayer-funded panels, read Capgemini's Government Contracts in Australia and our Enterprise Contract Exit Playbook.

Australian public sector ICT procurement represents billions in annual taxpayer expenditure across panels including AusTender, buy.nsw.gov.au, and Victoria's eServices & Support (Buying for Victoria). When evaluating major digital transformation, cloud migration, and managed service tenders, government evaluation committees frequently find themselves comparing established domestic Australian MSPs against Global Systems Integrators (GSIs) such as Capgemini, DXC Technology, and NTT Data.

While GSIs offer massive balance sheets and global partner tiering with Microsoft, AWS, SAP, and Salesforce, their commercial operating models present hidden delivery continuity, sovereign data, and budget risks that standard procurement templates fail to capture.

This guide provides Australian Commonwealth, State, and Local Government procurement officers, evaluation panel chairs, and internal auditors with a forensic due diligence framework to identify and neutralize tender manipulation, offshore labour arbitrage, and delivery failure risks.

---

1. Why Low Headline Tender Bids Cost Taxpayers Double

A recurring vulnerability in public sector tender evaluation is the disproportionate weighting assigned to the initial Financial Score based on headline hourly rate cards. Global Systems Integrators routinely deploy a "loss-leader panel strategy" to secure panel status and multi-year master service agreements:

                  THE PUBLIC SECTOR TENDER MARGIN ARBITRAGE
┌─────────────────────────────────────────────────────────────────────────────┐
│ 1. PANEL BID: GSI bids discounted rate: A$140 - $180/hr to win evaluation.   │
├─────────────────────────────────────────────────────────────────────────────┤
│ 2. DELIVERY SUBSTITUTION: Billed role is performed from offshore delivery   │
│    centre where annual salary is A$25,000 - $40,000 (Cost: ~A$22/hr).       │
├─────────────────────────────────────────────────────────────────────────────┤
│ 3. GROSS MARGIN EXTRACTION: The GSI pockets 70% to 85% gross margin on       │
│    taxpayer funds while domestic bidders paying Australian wages lose tender.│
├─────────────────────────────────────────────────────────────────────────────┤
│ 4. VARIATION SQUEEZE: Core requirements are declared "out-of-scope" and      │
│    billed under secondary Change Requests at premium commercial rates.      │
└─────────────────────────────────────────────────────────────────────────────┘

The Mechanism of Labour Arbitrage

In standard government panels, rate cards frequently categorize roles broadly (e.g., "Application Specialist - Level 3"). A domestic Australian firm bids a local senior engineer residing in Canberra, Sydney, or Brisbane paid an Australian market median of A$130,000–$160,000 plus superannuation. A Global SI bids the identical category but fulfills the task using an offshore resource based in Bangalore or Pune earning a fraction of that baseline.

Unless tender evaluation criteria explicitly mandate geographic residency, verifiable Australian payroll records, and on-soil delivery commitments, evaluation algorithms penalize local providers while rewarding multinational labour arbitrage.

The Scope Variation Trap

Once embedded in an agency, the initial low bid is recovered through aggressive Change Requests (CRs). A tender initially contracted for A$4.2 million can rapidly balloon to A$8 million through sequential variations. When public servants raise objections, the vendor leverages operational dependency: pausing work would jeopardize ministerial milestone deadlines.

---

2. Post-Acquisition Hollowing & Delivery Continuity Risk

Government agencies prioritize operational stability. However, engaging a Global SI that grows primarily via debt-fueled corporate acquisitions introduces acute delivery continuity risk.

Between 2020 and 2024, Capgemini Australia executed a rapid acquisition spree, absorbing four established domestic IT consultancies:

Acquired Australian Brand	Acquisition Cost	Acquisition Date	Historical Specialisation	Eventual Operational Outcome
Empired Limited	A$233 Million	November 2021	1,100+ Microsoft Dynamics, cloud & public sector specialists across ANZ	Brand erased by 2024; substantial senior leadership & architectural turnover.
RXP Services	A$86.8 Million	March 2021	550+ digital consultants across Melbourne, Sydney, Canberra, Hobart	Brand retired; creative & consulting units restructured or discontinued.
The Works	Included in RXP	March 2021	Award-winning Australian brand and digital experience agency	Closed in August 2024; founding partners departed, staff made redundant.
Acclimation	Undisclosed	July 2021	SAP systems integrator with deep enterprise customer footprint	Integrated into global practice; local identity dismantled.

The "Acquire, Absorb, Hollow" Pattern

When an established Australian IT firm is acquired by a multinational conglomerate, a documented cycle occurs:

1. Brand Capitalisation: The SI bids on government panels citing the pristine past performance, local security clearances, and case studies of the acquired entity.
2. Cultural Shock & Restructuring: Corporate overhead, rigid European/US reporting hierarchies, and global wage policies are imposed. Salary freezes and offshore delivery mandates are initiated.
3. The Talent Exodus: Senior local architects and principals with decades of institutional knowledge exit the firm, leaving the agency with an inexperienced delivery team that bears little resemblance to the team evaluated during procurement.

Tender Remedy: Mandatory 24-Month Turnover Disclosures

Procurement officers must include mandatory evaluation criteria requiring tenderers to disclose verified Australian staff turnover rates:

### TENDER EVALUATION CRITERION 4.3: WORKFORCE CONTINUITY & LOCAL ATTRITION

The Tenderer must provide an audited statement certified by an authorised corporate officer detailing:
(a) The annualized voluntary turnover rate of Australian-resident permanent technical staff over the preceding 24 months;
(b) The percentage of staff who performed delivery on cited Reference Projects who remain actively employed by the Tenderer in Australia; and
(c) In relation to any corporate acquisition completed by the Tenderer within the preceding five (5) years, the percentage of acquired technical personnel who remain employed within the Australian practice.

*Failure to disclose, or voluntary turnover exceeding 20% per annum, may result in disqualification on operational continuity risk grounds.*

---

3. ACSC Essential Eight, AGSVA Clearances & Sovereign Data Controls

With cybersecurity and foreign interference threats targeting government systems, the procurement of managed services and cloud integrators is no longer merely an IT operational choice—it is a national security concern.

┌────────────────────────────────────────────────────────────────────────┐
│             AUSTRALIAN GOVERNMENT SOVEREIGN DATA BOUNDARY              │
│                                                                        │
│   ┌──────────────────────────┐         ┌───────────────────────────┐   │
│   │   Commonwealth Agency    │ <=====> │ Australian Sovereign Data │   │
│   │ Tenant / Production Core │   MFA   │ Centre (Canberra/Sydney)  │   │
│   └─────────────▲────────────┘         └───────────────────────────┘   │
│                 │                                                      │
└─────────────────┼──────────────────────────────────────────────────────┘
                  │ ❌ PROHIBITED: Unvetted Offshore Bridging Access
                  │ (Remote jump hosts, unverified offshore administrators)
┌─────────────────▼──────────────────────────────────────────────────────┐
│                    OFFSHORE DELIVERY & BPO CENTRES                     │
│  • 66,000+ Offshore BPO staff (e.g. WNS / Third-party shared services) │
│  • High-turnover administrative shifts outside Australian jurisdiction │
└────────────────────────────────────────────────────────────────────────┘

AGSVA Clearances: The "Bridging Support" Loophole

Government tenders frequently specify that personnel accessing sensitive environments must hold active Australian Government Security Vetting Agency (AGSVA) clearances (Baseline, Negative Vetting Level 1 [NV1], or NV2).

However, procurement teams often overlook a common operational loophole: offshore back-office tier-2/3 bridging support. In this scenario:

• A cleared onshore engineer serves as the primary "face" on the change ticket.
• Behind the scenes, the onshore engineer initiates remote desktop sharing, hands over console access, or copies diagnostic database dumps to unvetted offshore personnel for analysis.
• Unvetted offshore staff effectively interact with government data in breach of the Commonwealth Protective Security Policy Framework (PSPF).

Enforcing ACSC Essential Eight Maturity Level 2/3

Tenders must require strict adherence to the Australian Cyber Security Centre (ACSC) Essential Eight:

1. Restricting Administrative Privileges: Vendors must not use shared accounts. Every vendor technician must possess an individual, named account subject to conditional access policies that block logins originating outside Australia.
2. Multi-Factor Authentication (MFA): Mandatory phishing-resistant MFA (FIDO2 / hardware tokens) for all remote administrative access.
3. Application Control & Patching: Strict application allowlisting on all jump boxes and bastion hosts used to manage agency infrastructure.
4. Non-Repudiable Logging: All vendor administrative activity must be mirrored to an immutable, agency-controlled SIEM (e.g., Microsoft Sentinel or Splunk) located within Australia, preventing vendor modification of access logs.

---

4. The Procurement Officer's Due Diligence Scorecard

To evaluate bids rigorously during tender deliberations, evaluation committees should score submissions against this 10-point due diligence matrix:

Evaluation Dimension	Weight	Acceptable Bid Standard (Green Flag)	Disqualifying Risk (Red Flag)
1. Geographic Delivery Ratio	15%	≥ 70% of total billed engineering hours performed on-soil in Australia.	Uncapped offshore delivery; vague "follow-the-sun" global delivery clauses.
2. Named Key Personnel	15%	Binding 12-month lock-in of proposed architects with financial substitution penalties.	Generic resumes; disclaimers that staff are "indicative and subject to availability."
3. Workforce Stability	10%	Audited annual voluntary turnover in Australia < 15%; verified leadership retention.	Attrition > 25%; recent absorption and closure of acquired brands (e.g. The Works).
4. AGSVA Verification	15%	Audited register of active Baseline/NV1 personnel; zero offshore access to data.	Relying on unvetted offshore technical pods under the guise of "back-office support."
5. Essential Eight Maturity	10%	Verified independent audit confirming ACSC Essential Eight Maturity Level 2 or 3.	Self-certified security compliance; refusal to allow unannounced security audits.
6. Scope & Variation Controls	10%	Fixed-price milestones; cumulative change request fees contractually capped at 10%.	Open-ended Time & Materials (T&M); ambiguous deliverables and milestone gating.
7. Privacy Act & APP 8	10%	Full disclosure of all overseas corporate subsidiaries (e.g. WNS BPO) touching data.	Undisclosed offshore subcontractors; generic global privacy disclaimers.
8. Disengagement Terms	5%	30-day exit without penalty; fixed transition rates; mandatory knowledge transfer.	Multi-year lock-in; punitive termination penalties; proprietary tooling silos.
9. Dispute History & Judgments	5%	Clean litigation record across ANZ and APAC public sector panels.	Documented data breach damages (e.g. Razer v Capgemini) or major public project failures.
10. Value for Money	5%	Balanced total cost of ownership factoring in variation risks and rework history.	Unrealistically low headline rate cards designed to win initial panel selection.

---

Strategic Due Diligence Next Steps

Before awarding multi-million dollar public sector tenders or renewing existing panel arrangements:

• Audit Vendor Financials & Headcount: Review verified corporate structures and parent entity metrics in The MSP Ledger and the Capgemini Profile.
• Benchmark Against Competitors: Compare vendor performance metrics using our MSP Comparison Tool (e.g. Capgemini vs Datacom or DXC vs Capgemini).
• Draft Tight Tender Specifications: Generate un-gameable RFP requirements and SLA penalty schedules using our automated RFP Generator and SLA Calculator.
• Evaluate Draft Contracts: Analyze vendor-provided master agreements with our Contract Grader and Contract Clause Analyser.

For guidance on auditing vendor delivery ratios or reporting procurement misconduct, consult our MSP Due Diligence Toolkit or submit confidential evidence through our Whistleblower Channel.