Assuring a national regulatory programme

In 2017 the Australian Government announced a Consumer Data Right, giving consumers greater access to and control over their own data and encouraging competition between providers. It applied first to banking. The ACCC was the regulator responsible for making it work — which meant standing up an entirely new national data-sharing ecosystem, on legislated deadlines, across participants who were commercial competitors: the Big Four banks, nine fintechs and neobanks, alongside the Data Standards Body, a register technology provider and conformance test-tool vendors.

This was not an enterprise programme. It was a regulated market being built to a statutory timetable, and it had to be assured as a whole.

There is no established playbook for assuring an economy-wide data-sharing regime before it goes live. Testing had to be conceived not as one organisation validating its own systems, but as many independent, competing organisations proving they could interoperate — with the regulator accountable for the outcome.

• The ACCC's expertise is competition and consumer law, not integration testing — the technical leadership had to be supplied in a way that built the client's understanding rather than creating dependency.
• Compliance dates were set in policy, while whether participants could actually meet them was an engineering question nobody yet had the evidence to answer.
• Rules, standards and register design were still forming while test strategy was being designed against a moving specification.
• Every participant owned its own systems; nobody owned the interoperation between them — precisely where a data-sharing regime fails.

Innovo acted as Test Director for the CDR programme, driving test-strategy planning, implementation and support so that the strategy was fit for purpose and supported the ACCC's role as regulator. Critically, Innovo did not only direct — it also supplied the test leads and technical test specialists who designed the industry test scenarios, validated what participants produced against them, and coordinated execution across the ecosystem. The ACCC engaged a director and received a working test capability.

After go-live, the ACCC's CDR division needed specialist operational capability. Having worked with Innovo through the assurance phase, it retained named Innovo specialists — a Technical Incident Manager and an ITSM Toolset Implementation Project Manager — embedded within its own reporting lines. The incident-management role was a direct operational descendant of the cross-participant defect-triage discipline established during the programme phase.

• An Industry Test Strategy and Industry Test Plans for the ecosystem, endorsed and published on 29 August 2019.
• The complete industry test scenario set every participant was assessed against, designed by Innovo's test leads.
• Independent validation of the evidence each participant produced against the industry scenarios, on behalf of the regulator carrying the consequence.
• An obligations traceability matrix mapping regulatory obligations through to test coverage, so compliance could be demonstrated rather than asserted.
• An integrated industry test environment with connectivity established across all participants, and an executive dashboard giving the Commissioner visibility of ecosystem readiness.
• After go-live: technical incident management across the live ecosystem and delivery of the IT service-management toolset the operation ran on, sustained across two years from 1 July 2022 to 30 June 2024.

• Ecosystem-level test strategy design — assurance conceived across many independent, competing organisations rather than within one.
• Industry test scenario design — authoring the full scenario set for a national regime in a form competing institutions would accept as fair.
• Independent validation of participant outcomes on behalf of the regulator.
• Multi-organisation test execution coordination across dozens of independent participants with no line authority over any of them.
• Obligations traceability — connecting legislated obligations to specific test coverage.
• Technical incident management and ITSM toolset implementation inside a Commonwealth regulator, under its own reporting lines.