Define roles, responsibilities and relationships — the word PRINCE2 7 added, and why Robodebt needed it

PRINCE2 7 made only two changes to the wording of its seven principles. One added a verb — “continued business justification” became “ensure continued business justification.” The other added three words.

“Defined roles and responsibilities” became “define roles, responsibilities and relationships.”

I have watched people skim past that in training and treat it as tidying. It is not. A role is a box on a chart. A responsibility is a line item in a terms of reference. A relationship is what one role is obliged to do when another role tells it something inconvenient — and that is where governance either exists or does not.

The clearest evidence I know of for why that third word matters runs to 990 pages and was published by an Australian Royal Commission in July 2023.

Robodebt

The scheme, formally the Online Compliance Intervention, automated welfare debt raising. It took annual income data from the tax office, averaged it across fortnightly Centrelink reporting periods, and reversed the onus of proof onto the recipient. The manual officer verification step was removed. It ran at national scale from 2015-16.

I want to be precise about what kind of case this is, because it is often filed in the wrong drawer. The Royal Commission’s core finding is that the policy design was unlawful, not that the software failed technically. Income averaging produced debts that did not exist in law or in fact. The system did what it was designed to do.

That is exactly why it belongs in a discussion of project governance rather than IT. Every technical control worked. Every governance relationship failed.

The information existed, from the beginning

Follow the trail the Commission established.

2014. In-house legal advice within the Department of Social Services warned that averaging “might not be consistent with the legislative framework.” That is a lawyer, inside the department, in writing, before the scheme was rolled out.

2017. A subsequent DSS advice supporting averaging cited neither statute nor case law, and contradicted the 2014 warning.

2018. Draft external advice from Clayton Utz concluded that averaging was “not permissible.” It was never finalised and never acted on.

Throughout. Administrative Appeals Tribunal decisions were setting aside debts. Those decisions were not escalated or acted upon by the department.

2017. The Commonwealth Ombudsman’s report effectively validated the scheme despite the legality concerns.

And structurally, the Office of Legal Services Coordination failed to enforce the Legal Services Directions, and Cabinet was not properly informed.

At no point was the problem a shortage of information. Lawyers wrote it down. A tribunal kept ruling on it. An external firm drafted an opinion saying it was not permissible.

The Commissioner’s summary of the whole affair is one of the most quotable sentences in the modern literature of public administration:

“It is remarkable how little interest there seems to have been in ensuring the Scheme’s legality.”

And on the machinery that should have caught it: “the ineffectiveness of what one might consider institutional checks and balances.”

The scale

The Commission recorded 866,857 compliance reviews initiated across the 2010-13 financial years, and 99,404 recipients with debts raised through averaging to January 2017. 381,000 individuals were ultimately affected by debt cancellation. $1.751 billion of debts were written off and $746 million refunded to people who had already paid.

The Prygodicz class action settlement approved in 2021 added $112 million of compensation on top of those write-offs and refunds. A further settlement announced in September 2025 added $475 million more.

The Royal Commission’s own verdict: “Robodebt was a crude and cruel mechanism, neither fair nor legal.” And: “People were traumatised on the off-chance they might owe money.”

What happened to the people

This part is unusual, and worth recording, because most of the cases I write about end with no individual consequence at all.

Commissioner Catherine Holmes referred individuals — names sealed — to the Australian Federal Police, the National Anti-Corruption Commission, the Law Society and the Australian Public Service Commissioner.

The APSC’s subsequent centralised code of conduct inquiry found that twelve current and former public servants and former agency heads breached the APS Code of Conduct on a combined 97 occasions, for “lack of care and diligence and lack of integrity in performing duties, as well as instances of misleading others and failing to uphold APS values.” Four current employees were sanctioned, with outcomes ranging from reprimands and fines to demotions. Several respondents had resigned or retired before or during the inquiries and therefore faced no sanction at all.

That last sentence is its own lesson about accountability regimes.

Roles were defined. Relationships were not.

Every role in the Robodebt story existed and was documented. There were departmental lawyers. There was an Ombudsman. There was a tribunal. There was a legal services coordination office. There was Cabinet.

What did not exist was an obligation attached to the relationship between them. Specifically:

No obligation to escalate. A departmental lawyer wrote a warning in 2014. Nothing in the structure required that warning to travel to a decision-making forum, be minuted, and be answered.

No obligation to reconcile contradiction. The 2017 advice contradicted the 2014 advice. Nothing required anyone to notice that, or to explain which was right and why.

No obligation to act on external findings. The tribunal was, repeatedly, setting aside debts — an external, authoritative signal that the mechanism was wrong. Nothing required the department to treat a pattern of adverse decisions as evidence.

No obligation to finish an inconvenient piece of work. The Clayton Utz draft concluded that averaging was not permissible. It was never finalised. An unfinished document has no owner and creates no duty.

Compare that with how PRINCE2 handles the equivalent situation. An issue is raised. It is logged, assessed for impact, and — if it threatens the project beyond tolerance — escalated as an exception to the project board, which must decide. Project Assurance, appointed by the board and independent of the project manager, has its own route to the board. The Executive is personally accountable for the business case remaining valid.

None of that is exotic. It is a set of obligations attached to relationships. And its absence, at national scale, cost $1.751 billion in write-offs, $746 million in refunds, and nearly $600 million in successive compensation settlements.

The eleven roles of PRINCE2 Agile Version 2

Version 2’s role model is the most explicit the method has ever been: Project Executive, Chief Product Owner, Senior Supplier, Project Assurance, Agile Coach, Project Manager, Project Support, Product Owner, Team Coach, Developer, Tester.

Eleven roles is more than most projects have people, and PRINCE2’s tailoring principle explicitly allows roles to be combined. That is not the point. The point is that the method has taken a position on which accountabilities must exist somewhere, even when one person holds three of them.

Two observations from watching organisations implement this.

The roles that disappear first are the ones that create friction. Project Assurance and the Chief Product Owner. Assurance disappears because it duplicates what the project manager already reports; the Chief Product Owner disappears because product owners “can sort it out between themselves.” Both disappearances remove a check rather than a cost.

And the combinations that matter are the ones that create a conflict. Combining Project Manager and Project Assurance means the project assures itself. Combining Senior Supplier and Supplier Assurance means the supplier assures itself. Combining Project Support with anything is usually harmless. Write down your combinations and look for the ones where the same person both does the work and confirms it was done.

What to write down, in one page

Not a RACI matrix. Those are produced, filed and never read. Something shorter, which I would put at the front of the project initiation documentation and read aloud at the first board meeting:

Who must be told, and by when, when a tolerance is forecast to be breached? With a named role and a time.

Who has the right to speak to the board without the project manager present? If nobody, say so, and understand what you have chosen.

What must happen when an external body — a regulator, a tribunal, an auditor, a court — makes a finding relevant to this project? Who receives it, who assesses it, who decides, and by when.

What happens to an unfinished piece of advice? In my experience this is the single most under-governed artefact in any organisation. A draft opinion that says something unwelcome is very easy to leave in draft. Give drafts an owner and a closure date, exactly as you would a risk.

Who is personally accountable for the business case remaining valid? One name. In PRINCE2 it is the Executive. If your project cannot answer this with a person rather than a committee, you have no business case owner.

And what is the route for a person low in the structure who thinks the whole thing is wrong? Every case in this series had somebody who knew. i6 had a programme board raising concerns while assurance reported green. Phoenix had test failures nobody retested. Robodebt had a lawyer writing a warning in 2014. The information is almost never missing. The route is.

The three words

“Define roles, responsibilities and relationships.”

It reads like a drafting improvement. It is actually the difference between a governance structure that exists on paper and one that produces an event when somebody says something inconvenient.

If you take one thing from PRINCE2 7 into your next project, take that. Draw the boxes if you must — but then draw the arrows, and write on each arrow what the receiving end is obliged to do.

Writing the arrows down

If you want to convert this into something usable, the artefact is short. For each significant relationship in your governance structure, write one row.

Six rows. It takes an afternoon.

Every one of them exists because it was missing in a case with a published investigation. Row two is Robodebt’s 2014 legal advice and the 2018 draft that was never finalised. Row three is the Administrative Appeals Tribunal decisions that were never escalated. Row four is Police Scotland’s i6, where external assurance rated delivery confidence amber or green while the programme board’s own concerns escalated. Row six is every organisation where somebody knew.

The reason to write these as obligations on the receiving role rather than as escalation rights for the sender is that rights go unused. A junior analyst has the right to escalate almost everywhere, and almost nowhere does it happen, because using a right is a personal risk. An obligation on a senior role — you must table this, you must answer it, you must minute the answer — moves the risk to somebody who can carry it.

That is the whole of what the word “relationships” added to the principle. It is not a philosophy. It is six rows in a table.

Sources

• Royal Commission into the Robodebt Scheme, Report (July 2023) — 990 pages, 57 recommendations
• Australian Public Service Commission, Robodebt Centralised Code of Conduct Inquiry — findings and sanctions
• Federal Court of Australia, Prygodicz v Commonwealth of Australia (No 2) — settlement approval (2021); Attorney-General’s portfolio media release on the further settlement (4 September 2025)
• PeopleCert, PRINCE2 Agile Foundation (Version 2) syllabus, v2.0 (May 2025) — the eleven roles — peoplecert.jp
• Purple Griffon, What’s new in PRINCE2 7 (principle wording changes) — purplegriffon.com
• Knowledge Train, PRINCE2 7th edition (the two principle name changes) — knowledgetrain.co.uk
• Audit Scotland, i6 (March 2017) and Office of the Auditor General of Canada, Report 1 — Phoenix Pay System (Spring 2018), cited for comparison