CommBank is probably a bad example, as they do all sorts of crazy things. In some areas, Infrastructure is outsourced to HP, Application management is shared b

CommBank is probably a bad example, as they do all sorts of crazy things. In some areas, Infrastructure is outsourced to HP, Application management is shared between internal staff and consultancies. In others, its all in-house, and in others its a mix of independent contractors and internal staff. The Federal Government is a mixed bag. The larger agencies are required to comply with the Information Security Manual, which is a prescriptive set of controls from ASD. They mostly outsource infrastructure to a contractor and then either have in-source development or outsource it depending on the amount of development performed. For example, if they need to set up a new system as a once off, its probably outsourced. If its something that will continually be added to they will hire developers. Government departments struggle to get skilled staff who will work for government wages and pass a security clearance. They also lack a lot of knowledge around IT at upper levels. Additionally, when they budget for systems they are terrible about asking for additional CAPEX to reduce on-going OPEX. They usually undercut their budget, half implement a system and then rely on manual processes. The efficiency dividend and on-going cuts then eat into their ability to perform those manual processes.