Summary

  • In the ten agencies examined in detail, 5,736 of 11,602 hardware devices and appliances met the audit’s definition of legacy. That is a sample count, not an inventory of every South Australian public body.
  • Fourteen of eighteen surveyed agencies said replacement funding was partial or absent. A separate $326.5 million digital fund supports cyber, AI and other public-sector projects, so its headline value cannot be set against the agencies’ separate $435 million estimate as if both described one bill.

The fleet is counted; the state is not

There is a seductive way to read the audit’s largest number: South Australia has 5,736 old devices to replace. It is crisp, alarming and wrong in two useful ways. The number came from ten agencies selected for detailed review, and “legacy” was a risk classification assembled from agency data and vendor support information. It is not a statewide shopping list, and it does not say every device should be replaced.

The Auditor-General surveyed 18 major agencies in 2025, then examined ten in more detail. South Australia has about 170 government entities. Every respondent reported legacy systems; most said they supported key business applications. The report’s sample establishes that the issue is widespread among the agencies asked. It does not supply a census or a reliable state-wide total.

Nor did the audit define legacy as “old enough to make a good headline.” A system first had to meet a Category A condition: end of life or outside vendor support, including extended support. It also had to meet at least one Category B condition, such as being impractical to support or update, poor value to keep, above acceptable risk, of diminishing business use, or an obstacle to the agency’s technology strategy. A purchase date is a weak proxy for those conditions. A supported component can be old but manageable; a newer dependency can already be costly or strategically trapped.

The percentages describe different parts of the estate

Across the ten agencies reviewed in detail, the audit classified 5,736 of 11,602 hardware devices or appliances as legacy: 49%. It also counted 766 of 3,181 operating-system instances (24%), 168 of 1,026 database-management systems (16%) and 121 of 392 virtualisation platforms (31%). Applications were assessed across nine agencies: 195 of 812 (24%). The Department for Health and Wellbeing’s applications were left out because their volume and hybrid ownership arrangements made them unsuitable for that count.

Those denominators matter. A physical device, an operating-system instance, a database platform and an application are not interchangeable units. One business service can depend on several of them, while one platform can support many services. Adding the five legacy counts would create a number with theatrical scale and no useful meaning. Treating 49% as the share of all state-government hardware would be equally misleading.

The useful signal is the range: the sampled estate contains legacy conditions at multiple layers. Replacing a server does not retire a database dependency by magic. Updating an operating system does not repair the business process wrapped around an unsupported application. The governance record needs to follow the service across those layers, not let each technical inventory tell a separate story.

A funding headline is not a funding gap

Fourteen of the 18 responding agencies told the audit that only partial or no funding had been secured to replace systems. Ten agencies estimated upgrade or replacement costs at A$435 million. The audit did not independently validate those survey responses; some agencies could not quantify their costs without extensive work. This is an agency-reported snapshot, not an audited liability for the whole state.

The Digital Investment Fund began at A$200 million over five years and grew to A$326.5 million across the 2024–25 and 2025–26 budgets. By the end of April 2026 it had received 55 applications; 22 were approved, with A$225 million committed and A$113 million spent. The fund backs cyber and digital initiatives across government, and the later expansion added a dedicated AI program. It is not a ring-fenced replacement account for the systems included in the audit survey.

Subtracting A$326.5 million from A$435 million would produce a bogus shortfall. One figure is a portfolio-level fund with multiple purposes; the other is an estimate from ten agencies of upgrade and replacement costs, not all of which could be quantified. Their overlap is not published. An executive committee cannot allocate money responsibly from arithmetic that joins different populations and then calls the remainder a need.

The fund’s public project list does show that modernisation is moving. The Department for Child Protection’s C3MS Modernisation, eCARL and eLOG replacement is listed as in flight, with requirements discovery and market analysis underway. That is useful evidence of work, not proof of a completed replacement, a delivery date or a cleared risk register. The Audit Office’s October 2026 annual report still described legacy ICT as an operational, security and governance risk across the public sector.

When a system becomes a service constraint

The report gives the count a human consequence without needing a cinematic outage. The Department for Child Protection implemented its Connected Client and Case Management System (C3MS) in 2009 to record and share information about vulnerable children and families. By the audit, the department said the system was beyond end-of-life support, depended on hard-to-maintain specialist skills and forced staff to use manual workarounds and duplicate data entry. The audit linked those constraints to the timeliness and completeness of information used in high-risk decisions.

That is a service-delivery mechanism: time spent reconciling duplicate records is time unavailable for other work; difficulty finding complete information changes the conditions under which staff make decisions. The report does not describe a breach or outage, and none is needed to make the case. A system can erode service quality through routine friction while the lights stay on.

This is why a percentage cannot rank the replacement queue. A high count of lower-criticality devices may be cheaper to renew than one platform that holds a high-risk service together. The decision needs evidence about the service, the dependency and the treatment—not an automatic rule that every red item must become a procurement project.

Put the decision on one page

The audit recommended completing existing upgrade or replacement projects, formally assessing and documenting the risks of systems without plans, keeping risk registers current, assessing assets regularly, and giving governance committees updates on treatment and residual risk. A useful operating record would make those recommendations comparable across agencies while leaving the actual technical choice local.

For each legacy item or grouped dependency, that record should identify the asset and business service; the evidence and date behind its support status; the accountable owner; the consequence of failure; the current control; the chosen treatment; the migration stage; the cost range and confidence; the funding source and amount secured; and the next decision date. “No plan” should be visible as a state with an owner and a deadline, not disappear into a project register that only tracks approved projects.

Executives could then compare like with like: which services depend on unsupported components, which temporary controls are buying real time, which estimates are mature enough for a budget bid, and which systems can be retired or consolidated rather than replaced. The shared layer is the evidence needed to compare risk. Each agency still chooses whether its best path is replacement, containment, consolidation or retirement.

South Australia has already built a fund for digital investment and a process for business cases. The audit shows why the application stage cannot be the only view of the estate: agencies need to show both what they want funded and what they continue to carry while waiting. The next useful public number is not another giant sum. It is the share of identified legacy dependencies with a named service, verified support status, funded treatment, accountable owner and dated exit decision.

Sources