“You’ll never guess what I heard last week” – The trusted insider and how government agencies can improve integrity.

A brief lapse in judgement doesn’t seem like a big deal and is often unintentional, but the reality is it can quickly incur significant consequences.

The concept of an “Insider threat” has always been an important part of protective security arrangements within government. However over the last decade we have seen both the threat landscape and the scale of vulnerabilities evolve at a pace that requires government agencies to invest in pro-integrity to proactively manage insider risks.

Traditionally, identifying an insider threat involved solely trying to analyse and understand threat actors with ill-natured intent and figuring out how they could cause harm. But there has been a shift in thinking with agencies now recognising that the unintentional insider threat can present just as much risk as those with malicious intentions.

According to APS Census data, 81 per cent of employees believe their agency manages integrity well. However, there is a gap between believing an organisation values integrity and feeling confident enough to act. Of those who had witnessed corruption, 74 per cent did not report the conduct.

Embedding true integrity across agencies is about creating environments where everyone clearly understands what is expected of them, feels confident making good decisions, knows what to do when something doesn’t seem right and beyond that, actually takes preventative actions.

From trusted insider to insider threat

Everyone in the APS is familiar with the concept of a trusted insider. An employee that has gone through clearance and processes before being deemed suitable by an organisation to have access to its assets, resources and people. So how do these people cross over from being a trusted insider to becoming an insider threat?

Often, it is simply a series of small decisions. Imagine three APS employees sitting in a Canberra café having lunch. They start talking about their weekend, but the conversation quickly moves to an upcoming ICT project. They discuss stakeholder challenges, budget pressures and frustrations with a legacy system.

At the next table, someone is working on their laptop. They happen to recognise some of the information being discussed. They don’t directly work on the project, but they know enough to become interested and take out their phone and record the conversation. Later, they upload that audio file into an AI tool and use additional prompts to work out which agencies and project are being discussed.

The three APS employees never intended for information to leave the room and were oblivious to the fourth person. But a simple failure to consider their surroundings has created a potential security issue.

This is why insider threats are so challenging. They start with ordinary people doing ordinary things.

Integrity and insider threats are connected

A decline in integrity is a key driver of insider threat. When integrity and professional excellence are embedded across an organisation, the likelihood of these types of scenarios reduce significantly.

The National Anti-Corruption Commission’s Integrity Maturity Framework provides one example of how agencies can assess and strengthen their integrity approaches. Many agencies already operate within a complex landscape of fraud control frameworks, integrity frameworks, security frameworks, HR policies, procurement requirements and APS Code of Conduct obligations.

Controls generally fall into three categories:

• Preventative controls – things designed to stop a problem occurring, such as security clearances, suitability assessments and access controls.
• Detective controls – things that help identify issues when they occur, such as reporting processes.
• Corrective controls – things that reduce the consequences after something has happened, such as disciplinary action, sanctions or revisions to policy and process.

Some controls are particularly important because they are relied upon across multiple risks. These are the controls organisations really need to understand and test.

But it’s not enough for government organisations to just have the right controls and processes laid out, they need to be implemented and tested regularly. A policy sitting on an intranet does not necessarily mean people understand it. A training session being delivered does not necessarily mean behaviours have changed. A policy might describe how a process should work. But the reality of how people operate day-to-day can be very different and understanding that gap is critical.

Creating culture where people speak up

Embedding integrity across an agency hinges on building the right culture.

There are many reasons why people may not report if they hear or see something that could pose a risk. They may be unsure whether their concern is serious enough. They may not feel empowered to act. They may worry about consequences for themselves, their relationships or their career. If people look around their organisation and see poor behaviours being tolerated, they are more likely to become a bystander rather than a champion for upholding APS integrity.

This is why psychological safety matters, and this is built through small behaviours every day.

If someone approaches their manager and says, “I’m really worried about this,” and the response is simply, “Don’t worry, it’ll be fine,” that interaction can determine whether they feel comfortable raising a concern in the future.

There is a saying: trust is gained in drops but lost in buckets.

Building a pro-integrity culture goes beyond just frameworks and policies and requires leaders and teams who understand their role, test whether controls are working and create environments where people feel confident doing the right thing.

Published on publicspectrum.com in August 2026

About SPA Australia

SPA Australia (Systems Planning & Analysis, Australia) is a leading provider of integrated legal, commercial, consulting and analytics services to government.      

Our multidisciplinary approach, trusted advice and leading-edge technology and analysis help clients deliver measurable outcomes.    

In 2025, SPA Australia acquired Proximity, a highly regarded professional services firm specialising in government legal, consulting, and commercial advisory services.    

Our parent company, SPA, has more than 3,000 employees in 30 locations within the US, UK and Australia. In Australia, more than 130 employees are based across Canberra, Melbourne, Sydney and Adelaide, where our local teams deliver sovereign capability backed by global expertise.