5. Who do we share your information with?

- Service providers — for example, mortgage insurers, loyalty program partners and our product distributors

- Businesses who do some of our work for us — including direct marketing, statement production, debt recovery and IT - support

- Organisations involved in our funding arrangements — like loan purchasers, investors, advisers, researchers, trustees - and rating agencies

- Auditors, insurers and re-insurers

- Current or previous employers — for example, to confirm your employment

- Credit reporting bodies and credit providers

https://www.commbank.com.au/security-privacy/general-securit...

I can tell you at least that Accenture were heavily involved in NPfIT too. They were forced out with the work uncompleted, although they somehow managed to dodge most of the fine.

There are some obvious lessons to take away about trying to avoid projects which have massive scopes and vague, changing requirements.

Also that contracting out to a consortium doesn't mitigate risk or project size, because the hardest parts of most IT projects are 1) deciding what to build and 2) dividing up the work into the correct pieces.

For me, though the main lesson is that contracting IT systems is really risky if you don't have in-house engineers to vet it. Companies with no competence in delivering software will sell you the wrong things at the wrong prices, and they will do it really convincingly.

For those who work in government, those companies will also have a terrible track record, but your institutional amnesia will prevent you from noticing, so you will hire them anyway. (Probably someone in your department previously attempted to get a company wiki to organise this sort of information, but ended up getting Sharepoint instead, and now no-one looks at it.)