Welcome and introductions - ...Software developers website · 2019-04-16 · • GIG economy e.g. UBER, Airtasker • Sharing economy My income is seasonal and fluctuates a lot throughout

Presented by:

Martin Mane

Director, Digital Partnership Office

Australian Taxation Office

19 March 2019

Strategic Working Group

Welcome and introductions

Recap on key pieces of work

initiated last year

Improving the test environment

Focus group

UNCLASSIFIED – Strategic Working Group – 19 March 2019

5


FOCUS GROUP| Improving the test environment Intent:

A forum where industry and the ATO work together to address irritants with the testing experience.

Key recommendations:

# Item Description

1 Enhance EVTE

Conformance Testing to

align with external

stakeholder expectations

Review the test data sets supporting the existing mocked service and potentially extend to provide accurate and

comprehensive data sets, generating correct responses to all valid and invalid inbound messages.

Review the test data sets supporting the existing mocked services and update to align the client data sets where a

business process is achieved over multiple service actions, e.g. Client update services

2 External stakeholders to

be consulted on the test

scenarios and data to be

used to conduct testing

Initiate project and ATO business engagement with external stakeholders that will be consuming the new services

through a specific purpose working group. Special Purpose Working Group meets and defines test scenarios and

any data requirements.

Test scenarios and data characteristics to be defined based on the business rules of the service including error

messages which would result.

Teams involved in the development of mocked/stubbed services use the same data definition rules as those used

by development teams.

Where there is a limitation on test scenarios supported then a risk based and/or volumetric approach is taken.

3 Share initial test scenarios

early in development

lifecycle (Design Phase)

Test scenarios (including expected results) to be utilised in ATO Integration testing are defined as part of the

design phase.

Test scenarios are shared with External Stakeholders through the Special Purpose Working Groups.

External Stakeholders are invited to comment on the test scenarios from the perspective of business rules

interpretation. Discrepancies in interpretations of business rules are resolved in design phase.

Subsequent changes in business rules and related test scenarios are similarly treated.

6


FOCUS GROUP| Improving the test environment Current Outcomes:

1. Tools are currently being upgraded to improve data sourced from the mainframe system.

2. New scenarios will be tested against business rules that will be used in production before releasing to EVTE.

3. An initial review of test scenarios with DSPs has been conducted on all three actions from the IITR service – Prefill, Pre-Lodge, and Lodge.

4. The ATO will test against the same mainframe code which is being release into production.

5. The data is based on ‘real world’ data, but is scrambled for privacy reasons.

6. The group will be consulted to ensure the scenarios are ‘fit for use’. They will be built in parallel with existing scenarios .

To Progress:

• Finalise the scenarios for the IITR conformance suite and have a final consultation session with developers.

• Embed an approach to engage with DSPs in the early development of new scenarios.

• Review existing conformance data sets and determine lifecycle data scenarios and implementation.

Securing the broader ecosystem

Focus group


8

• Exploring the interest in establishing commonly accepted security

standards across the industry

• Participation has been extended to key platform hosting providers and the

ACCC

• The group have acknowledged the value of commonly accepted cyber

security standards

• General acceptance has been reached for the boundaries of the DSP

Operational Framework

Next steps are to explore:

Existing security standards

Penetration testing as part of the assessment process

The role of identity management

Next meeting to be held in early April 2019


FOCUS GROUP| Securing the broader ecosystem

Payment thinking

Presented by:

Cameron Sorenson

Director, Debt Strategy and Implementation


G1 Delivering Debt and ATO

outcomes Workforce and culture

C O R P O R A T E A L I G N M E N T

2024 Strategic Initiatives

We take a purposeful approach to improving payment on time, balancing support for clients trying to do the right thing with timely stronger action

against those who don’t engage to prevent them gaining an unfair financial advantage.

Our direction is set using insights and intelligence and future orientated collection strategies. Our focus is on improving the payment experience

and payment on/over time, as well as addressing unfair financial advantage.

An effective payment collection system is designed, implemented and managed to maintain a stable and effective operating environment for our

clients and staff. Through the development and maintenance of effective partnerships, we bring expertise in data driven strategy, payment

system design and change management to deliver business improvements and initiatives.

Maximised use of

data and analytics

Debt 2018-19 Strategic priorities

Payment thinking Intermediaries

and community

Optimised experience

for clients and staff Legislative

implementation

74.34%1

16.7m

89.5%

$454.5b

15.6%

3.4m

6.4%

$30.7b

3.0%

0.7m

1.1%

$5.4b

Due

date

90 days

365 days

Not paid 3.1%

$15.7b

7.1%

1.6m

No. of payments (21m)

Value of payments ($491b)

Our Debt Book (2017-18)

Debt Strategic objectives

Payment Thinking

Designing processes, systems and

approaches that make payment an

easy and natural part of activities

across all stages of tax and

superannuation.

Data & Analytics Debt Outbound

Delivering data driven,

tailored client experiences

that optimise our Debt

approach.

Developing and refining

communications to ensure we

get the behaviour and

engagement we want, and

improve the client experience

D E L I V E R E D T H R O U G H O U R P R O G R A M S O F W O R K

Shifting payment on time by 1% is

worth $5.1 billion

› Improving payment on time

› Improving the payment experience

› Addressing unfair financial advantage

› Improving the staff experience

O U R D E S I R E D O U T C O M E S & B U S I N E S S D R I V E R S

PAYMENT THINKING

A signature initiative of 2024 vision

ASFP DEPLOYMENT

December 2019

Better tools

and

information

Right case

at the right

time

Easy to pay

and hard not

to

Manage

collectable

debt

Improved

online

services

Maximised use

of data,

analytics and

automation

Optimised

experience

for staff

Increased

payment

on time

Doing the

basics

brilliantly

TAILORED CLIENT EXPERIENCE

Clients are at the centre of everything we do

Channel experience C1

Operational excellence F1

Productivity using data O1

W1

C2 Support the transition to

digital services

W2 Provide the right tools

and workplace

G1 F1 G1 C1 W2 C1 W2 F1

Suzanne Campbell

Tracy Procter Tracy Procter Suzanne Campbell

Visa

ATO (Debt)

ASFP

Delivering a Payment Receivables

Management (PRM) solution to the

corporate Activity Statement Financial

Processing (ASFP) initiative. Provide

Debt with a tailored transparent change

management framework.

David Azarnikow

Suzanne Campbell

Steve Duffin

13

Scheduling / Settle payment

at time of lodgment

1

New/updated Products

• Payment and due date reminders (ATO initiated

SMS / Email)

Process changes

• Ongoing authorisations to deduct future liabilities

• Personalisation of lodgment outcome information

based on client’s lodgment / account scenario, for

example:

• Present a client with an existing overdue debt

different options than a client with only a new

future liability

• A client whose account is in credit and lodges a

new liability

ATO Online & 3rd party Software

• Voluntary regular payments viewing, modifying

and cancelling (wholesale and retail)

• A recommended prepayments schedule to enable

payment by the due date

• Future one off payment scheduling (wholesale

and retail)

• Credit card for direct debit

• Integrated lodge and pay online interactions

(retail)

• Credit card management – storage and

presentation of credit card details to enable

payment

• Opening and closing balance service IT accounts

(wholesale)

• Payment Plan online services eligibility

enhancement

Payment Plan online services to use consider a

client’s capacity to pay to enhance eligibility criteria

for the service

• Improving to accessibility and visibility of

payment plan services in ATO Online

• Service to extended accounts (currently limited

to IT, AS, SG, SG DP, FBT)

• Direct debit for all accounts

• Ability to tailor payment plan instalments

• Ability to view historic payment plans

• Ability to modify and cancel existing plan

• Use of Credit card for direct debit

• Reminders for payments, including final

instalment reminders

• Single payment plan across multiple accounts

(this is expected to be a stretch / future

deliverable)

• Internal payment plan option with no rules for

utilisation for settlements/securities (staff use

only)

• Differentiated Payment Plan service

Improve payment plan service

available in ATO Online

2

• Short term enhancements to update the existing

ICP monitor service to resolve irritants as part of

Payment Thinking project – Phase 1

• Resolve Issues –

• INC000033676642 – Payment plan instalments

not being monitored

• INC000033826934 – Payment plan finalising

when debt above $100

• Resolve existing BCRs irritants

• BCR 2755 - Daily monitor (which will improve

visibility of instalment schedule online and

improve ‘kept’ instalments)

• BCR 2125 – Remove rule that finalises payment

plans at $100

• Resolve non-existing BCRs irritants

• Continue Direct Debit payments when new debt

causes default

• Recognition of additional liabilities (including

those not yet due) not included in original

payment plan (expected to fix the monitor near

the due date issue)

• Long term: Deliver through the ASFP Stream 3

(monitoring).

Differentiated Payment Plan Service - Analytic

service/s to:

• In-Flight: Predict and engage with clients

unlikely to meet upcoming instalment amounts.

• Default: Determine the recommended action

upon default of a payment plan.

Improved payment plan

monitoring

3

The following projects have received endorsement to proceed to Delivery Planning stage.

PAYMENT THINKING| Short to medium term investments


“Bill Shock” Software Timing Calculation & Visibility Nature of income

• GIG economy e.g. UBER,

Airtasker

• Sharing economy

My income is seasonal and

fluctuates a lot throughout

the year – I can’t forecast

and plan my end of year tax

position in real time

Not all income sources are

(Income Tax) taxed at

source. E.g.

• rental income

• bank interest

• business income

• partnership/trust distribution

• Employee vs Contractor

• Hobby vs Business +

Transactions and impact on

prior earnings

• ‘Cash’ for discount / off

books

Not all small businesses use

software

I don’t know what my total

taxable income amount is

(across all sources) in real

time....so I can’t calculate my

tax rate or estimated liability

and avoid ‘bill shock’

Time lag between when I

get paid or earn income

(collect tax) versus when I

have to pay tax

Some tax calculations are

complicated (Superannuation,

GST and LCT/WET

exemptions, thresholds for

entry etc)

I don’t know how to put aside or

send money for my tax when I

have the money

GST confuses me. I wish it was

sorted out when the customer

pays and I didn’t have to do

anything.

PAYMENT THINKING| Payment challenges


14

Future of e-Invoicing

Presented by:

Mark Stockwell

Assistant Commissioner, Business Reporting and Registration


E-INVOICING OVERVIEW E-Invoicing is the direct exchange of invoices between suppliers’ and buyers’ systems. At the moment, processing of invoices for most small and

medium businesses is manual, inefficient and error-prone.

PRODUCTIVITY

$9.18 estimated cost

of an e-Invoice

(savings of up to

$21.69 per invoice)

Estimated potential

savings across the

economy $28b over

10 yrs.

Reduce errors by

1/3 minimising

reverse workflows

Reduced processing

times and errors lead to

quicker payment

Businesses looking to

reduce processing costs

can incentivise e-Invoice

adoption by offering

shorter payment cycles

Over 1.2 billion invoices are

exchanged annually in Australia,

over 280 million in New Zealand

& 100,000 trans-Tasman

Paper

$30.87 estimated cost to

process a paper invoice

In Australia there are

1,284,708 non employing, 584,887

micro, 197,211 small, 50,849

medium & 3,606 Large businesses

$27.67 estimated cost to

process a PDF invoice

89%

SMEs process

invoices manually

PAYMENT TIMES

Small businesses are

collectively owed

$26 billion in unpaid

invoices at any one time

Australia averages 26

days late payment

compared to the

international average of 6

days

All businesses are able

to enjoy the benefits of

e-Invoicing

Existing participants do

not need to access

separate systems across

trade groups

MARKET IMBALANCE

Large business impose

closed trading

solutions on suppliers

Too many complex,

proprietary standards,

leading to market

fragmentation, so businesses

are reluctant to abandon paper

14

Main reasons for

payment delays are:

Incorrect information (21.4%)

Sent to wrong person (21.9%)


e-INVOICING| Overview

http://www.iconarchive.com/show/vista-artistic-icons-by-awicons/office-building-icon.html

WHAT IS THE PROBLEM

Create

invoice

PAPER INVOICE PROCESS

Print

Post

(need address) Deliver Check Manual

data input Receive

E-INVOICING PROCESS

Create

invoice Receive

Seller Buyer

REMOVING MANUAL INTERVENTION | Faster And Cleaner Data

15

E-Invoicing is the direct exchange of invoices between

suppliers’ and buyers’ software.

traditional (non-EDI based) invoicing is manual

and prone to errors

too many complex standards currently in use and

industry participants are unable to agree among

themselves on a consistent approach.

large business impose closed trading

solutions on suppliers, where suppliers need

(and pay for) different solutions for each

buyer.

Average payment times are 26.4 paydays

late in Australia and affect cash flow of the

business


e-INVOICING| How does e-Invoicing work?

http://www.iconarchive.com/show/vista-artistic-icons-by-awicons/office-building-icon.html

16

In 2016 the Digital Business Council adapted

proven, international standards for the e-Invoicing

Interoperability Framework.

March 2019, e-Invoicing under the Trans-Tasman

Framework is live after the project confirmed:

• Successful end to end testing with a live invoice

• Publication of an updated Trans-Tasman

Interoperability Framework

• Publication of interim operational governance

arrangements (including accreditation)

• Deliver of the Digital Capability Locator as a critical

piece of infrastructure

May 2018, the Australian Government

confirmed their commitment to progressively

adopt e-Invoicing and announced the

establishment of the Trans-Tasman e-Invoicing

Working Group

November 2018 the Australian government

asked the ATO to accelerate the implementation

of e-Invoicing and have the standards,

infrastructure and interim governance in place by

1 March 2019

December 2018 the Minister requested the investigation

into the suitability of the Pan-European Public

Procurement On-Line (PEPPOL) framework for A-NZ e-

Invoicing after a number of submissions from the

consultation identified PEPPOL as a possible option for

longer term governance

February 2019 the A-NZ Prime Ministers jointly

announced the creation of the Australia and New

Zealand Electronic Invoicing Board (ANZEIB); and the

two countries’ intention to jointly adopt the PEPPOL

interoperability framework for trans-Tasman e-Invoicing.

March 2018 the Prime Ministers of Australia and

New Zealand (A-NZ) agreed to work on a

common approach to e-Invoicing as part of the

A-NZ Single Economic Market agenda, with the

ATO and NZ Ministry of Business, Innovation

and Employment (NZ MBIE) as lead agencies


e-INVOICING| The journey so far….

http://sharepoint/GASites/Publishing/banners/016handshake.png

http://sharepoint/GASites/Publishing/banners/022news.png

17

The aim of the pilots was to confirm:

that the DCL works in a Production environment

interoperability between participating access points including the ability to

connect, send and receive conformant AS4 messages between access

points

the complete end to end e-Invoicing lifecycle from supplier to buyer

Purpose of the pilots

Participants:

Corner 1: Lennix Pty Ltd (MYOB user)

Corner 2: MessageXchange

Corner 3: DHS(IBM sterling stack)

Corner 4: DHS(SAP user)

Successful invoice sent from a small business to government

Ozedi

Qvalent (Westpac)

Department of Human Services (DHS)

Payreq and

Message Exchange

Pilot participants

1 2 3 4


e-INVOICING| Pilots and onboarding

18

Australian PEPPOL Authority

There are two levels of PEPPOL governance :

The PEPPOL Coordinating Authority (Open PEPPOL) has authority over all of the central components of the PEPPOL eDelivery Network

(the technical and service specifications, the Service Metadata Locator (SML), the Transport Infrastructure Agreements and its annexes) and

will delegate authority over the implementation and use of the infrastructure within a defined domain to a PEPPOL Authority.

The PEPPOL Authority must ensure Access Point (AP) and Service Metadata Publisher (SMP) services are provided in conformance to the

technical standards and service specifications by entering into separate AP and SMP agreements with each of the respective providers within

their local domain.

The Australian and New Zealand governments’ intend to both establish a PEPPOL Authority to incorporate local legislative and technical

requirements.

PEPPOL is a set of artefacts and specifications enabling cross-border exchange

of standards-based electronic documents over the PEPPOL network (based on a

4-corner model). PEPPOL was established under a European Union (EU)

directive for public procurement, and has expanded to B2B interactions used

across 32 countries in Europe, Asia and North America.

PEPPOL is based on three major pillars:

network (PEPPOL eDelivery Network).

document specifications (PEPPOL Business Interoperability Specifications

‘BIS’)

legal framework that defines the network governance (PEPPOL Transport

Infrastructure Agreements – TIA)

What is PEPPOL?

The use of PEPPOL is governed by a multi-lateral agreement

which is owned and maintained by OpenPEPPOL.

OpenPEPPOL is a non-profit international association

registered under Belgian law. Membership consists of both

public sector and private members. The association has

assumed full responsibility for the development and

maintenance of the PEPPOL specifications, building blocks

and its services and implementation across Europe.

OpenPEPPOL


e-INVOICING| Transition to PEPPOL

Transition Plan – early thinking

Transition Plan – early thinking

e-INVOICING| Transition to PEPPOL

UNCLASSIFIED – Strategic Working Group – 19 March 2019 19

Early thinking around transition timeline to PEPPOL was provided as a working draft document for consultation only

• Timeframes are ambitious, they are the earliest things could happen (used as a starting point for consultation)

• ATO will update the plan based on consultation and further readiness planning - the consultation will allow us to provide an updated PEPPOL implementation

plan (including transition from trans-Tasman) at the Engagement Forum on 10 April

20

PEPPOL Transition Plan

- Consult with industry on transition plan

- Publish transition guidance (including DCL/SML transition)

Establish Australian and New Zealand local PEPPOL authorities

- A-NZ specifications

- Annex 5 jurisdictional requirements

- A-NZ PEPPOL accreditation processes

Engagement and communications

- ATO PEPPOL Digital Service Provider Engagement Forum – 10 April 2019

- Continue to raise e-Invoicing awareness among Federal Government agencies

- Support key stakeholder forums including ANZEIB, Trans-Tasman working group and e-Invoicing Technical working

group

- Continue regular project updates to key stakeholders through forums, ATO websites, regular newsletters and social

media


e-INVOICING| Next steps

21

For more information:

The ATO Software Developers website

https://softwaredevelopers.ato.gov.au/Trans-Tasman-e-invoicing

The ATO website

https://www.ato.gov.au/e-invoicing

Contact Australian Project team @

[email protected] (and sign up for our regular updates).


e-INVOICING| More information













mailto:[email protected]



Security

Presented by:

Christian Motuzas

Cyber Security Operations Centre


23


FOCUS GROUP| Security sharing and awareness

Exploring the interest in sharing intelligence and creating broader industry awareness.

Currently looking at:

Determining what data can be shared and how it can be disseminated with broader industry

Managing Cyber Threat Intelligence provided by Managed Service Providers (MSPs)

How we can work together moving forward

http://sharepoint/GASites/Publishing/banners/083criminal-online.png

1. Understand the security controls and capabilities offered by the

MSP and if the DSP is leveraging them.

2. Evaluate if the security capabilities of the MSP are sufficient and

meet the DSP requirements.

3. Have a well defined incident response and communication plan

with the MSP to avoid chaos in the event of an incident.

4. Understand new threats that are present globally what the risk is

the both the DSP and MSP

MANAGED SERVICE PROVIDERS| Understanding the risks


24

Visibility

Ensuring that DSPs have

visibility into their managed

service, and are informed of all

IT security events that impact

the business.

Communication

The use of MSPs requires all

involved to have well defined

communication and incident

response policies to ensure

that clarity is maintained

Review

Security is not “Set-and-Forget”

as things change. Frequent

review and testing of established

policies and obligations to

identify cyber security risk and

blind spots

CYBER SECURITY| A collective effort


25


CYBER SECURITY| MITRE ATT&CK threat matrix

26

Single Touch Payroll

Presented by:

Martin Mane and Michael Karavas

Director, Single Touch Payroll


28


Legislation to extend STP reporting to include small employers (with 19 or less employees) from 1 July 2019 has received royal assent.

Software developers have been asked to build low-cost STP solutions at or below $10 per month for micro employers – including simple payroll

software, mobile phone apps and portals. A register of providers who intend to build these solutions is available at Low-cost STP solutions.

SINGLE TOUCH PAYROLL | Solutions for micro-employers

DISCUSSION POINT

How can ATO and industry work together to:

• ease the way for and/or support the on-boarding of micro employers

• identify any other support measures or steps to improve take-up of STP by micro employers.

https://www.ato.gov.au/business/single-touch-payroll/in-detail/low-cost-single-touch-payroll-solutions/



Machine to machine

authentication

Presented by:

Martin Mane

Director, Digital Partnership Office


30


MACHINE-TO-MACHINE AUTHENTICATION | Overview

Machine2Machine

GovPass

User

This environment consists of

two types of public users:

1 – Private individuals

2 – Business individuals

Identity Provider

(IDP)

The GovPass ecosystem will

be deployed to support

multiple IDP’s to support

choice for users – with

myGovID as the first.

Federated Identity

Exchange

DHS will be deploying the

exchange as the central

federal broker for individual

identity transactions

Federated

Authorisations

ATO will be deploying RAM as

the central federal

authorisations platform, which

will be used by individuals

and M2M business clients

Relying

Party

Aside from government

services, business too will be

allowed to enter this

environment to provide their

online services and absorb

digital identities

M2M component

GovPass component

31


MACHINE-TO-MACHINE AUTHENTICATION | Timeline

31

Phase 0 Phase 1 Phase 2 Phase 3

• Machine

Authentication System (MAS) only (no supply chain visibility /No encryption)

• Authentication

• Certificate Authority (CA) integration

• SBR migration

• Production

• Registration for

the machine credential

• User Interface available

• RAM

• Performance tuning

• End to end

encryption

• Full capacity

• Supply chain

visibility

April

2019

EVTE

(TBC)

Public

Beta

(TBC)

Public

Beta

(TBC)

Full

deployment

32

MACHINE-TO-MACHINE AUTHENTICATION | Client Model


32

RAM

Business owner

Has Machine Credential

Administrator (MCA) role

but will generally delegate

this to another person

PREREQUISITES

All users have myGovID

All users are authorised for the

business In RAM

Must have SDK loaded

Must have credential

Principal Authority

When creating a machine

credential, they will be the

custodian. Machine

Credential

Administrator (MCA)

Request machine credential

Credential custodian

Server

Machine

credential

created in MAS

via RAM

Download (or install)

credential (different for

each DSP business)

PR

INC

IPA

L

AU

TH

OR

ISE

D A

FF

ILIA

TE

SDK installed

1

3

4

2 MAS

Now has ‘Machine

Credential Admin’ role

Role flow

Credential flow

Grant ‘Machine Credential

Admin’ role to authorised

person via RAM

RAM – Relationship Authorisation Manager

MAS – Machine Authentication Service

MCA requests

new credential

via RAM

33

MACHINE-TO-MACHINE AUTHENTICATION | Data Flow


Software sends valid

certificate to MAS

Software MAS Software

Validates that the certificate

is correct. Provides a SAML

token back to software

M2M

SAML

Processes the

request

ATO

SBR Core

Verifies that machine

credential ABN and

reporting party ABN

match

Business

Business initiates a

transaction and signs the

information using their

machine credential stored

Attaches SAML and related

business information to the

SBR payload. Submits a

single SBR payload to ATO

S B R

P A Y L O A D

34


MACHINE-TO-MACHINE AUTHENTICATION | Impacts

We are designing the machine credential to be backward compatible to limit the impact for DSPs and their users.

DSPs that use CAA

• Will be required to generate and install the new machine credential as well as update their software to point to the new STS endpoint

address.

• There will be no impact to users.

DSPs that do not use CAA

• DSPs will be required to update their software to point to the new STS endpoint address and deploy the updates to their users.

• Users will need to log into RAM to nominate a Machine Credential Administrator to generate a machine credential. Users will then need

to install the machine credential into their software.

Users who have updated their software can continue to use their AUSkey until 2020

Corporate plan

Presented by:

Martin Mane (DPO) and Karen Lay-Brew (ABSIA)

36


CORPORATE PLAN| Strategic initiatives

Support the superannuation system

Increase willing participation and drive transparency in member information and superannuation guarantee by ensuring the system is seen,

valued and owned.

Shifts in work and income

Position the tax and superannuation system to respond to shifts and trends in the nature of work and income.

Channel experience

Use digital interactions wherever possible and limit or close some services in some channels

Wrap up

Documents

Welcome and introductions - ...Software developers website · 2019-04-16 · • GIG economy e.g. UBER, Airtasker • Sharing economy My income is seasonal and fluctuates a lot throughout