How to Take Back Control of a Software Project from an Offshore Agency

The retainer agency has gone quiet. The website is still live, and nobody else in the business can change it. The login you were given opens the front end, not the AWS or Azure account, not DNS, and not the repository. Invoices keep arriving. That is the usual point at which an owner starts asking how to take back control of a software project from an offshore agency, and the useful answer is not a rushed vendor swap. It is an evidence-gated transition: decide which capabilities come back first, fund the overlap, and prove the receiving team can run the system before you cut the agency off.

Table of Contents

• The 90-Day Recovery Plan at a Glance
  • What the first month actually changes
• Securing Accounts and Credentials Before Touching the Code
  • Why a meeting is not a handover
• Assessing Status, Scope and Risk Before Any Change
  • Five steps to a baseline someone else can check
• Documenting Dependencies, Data and Contract Terms
  • Privacy still sits with you
  • What you own, and what you do not
• Managing Delivery and Security Risks During Transition
  • Treat the Essential Eight as acceptance criteria
• Budgeting the Takeover and Its Overlap Period
• Deciding What to Keep Offshore and Proving Independence
  • What the labour market actually allows
  • Gates that prove the team can run it

The 90-Day Recovery Plan at a Glance

Recovery runs in four stages across about 90 days. Each stage ends at an exit gate, not a calendar date. If a gate fails, you stay in that stage. A date on a slide is not evidence that anyone can rebuild the environment.

Before week one, name one accountable product owner inside the business and rebuild the decision record. In the Digital Transformation Agency’s Major Digital Projects reporting, 23 of 62 assessed Tier 1 and Tier 2 projects, 37.1%, were rated Medium or below for delivery confidence. The same reporting links stronger confidence with early governance, well-prepared documentation and experienced personnel, and notes that only 52.1% of relevant projects had a delivery-confidence assessment in 2024, against 98.4% in 2025, with independent assessments covering 80.3% that year (Major Digital Projects).

What the first month actually changes

Days 0 to 30 put every production change behind Australian-owner approval, rotate shared credentials, enforce multi-factor authentication and least privilege, map personal-information flows, and freeze non-essential features. Days 31 to 60 reproduce environments with infrastructure as code, add unit, integration and smoke tests, and set service-level indicators for availability, latency, error rate, deployment frequency, change-failure rate and mean time to recovery. Pull requests need review by at least two authorised maintainers. Days 61 to 90 run a disaster-recovery exercise, restore a production-like backup into an isolated account, audit dependencies and licences, and have the successor team complete an unassisted release.

Use thresholds, not a feeling that things look better. 100% of production assets inventoried. 100% of privileged accounts tied to named people. Restore success shown twice. No critical vulnerability accepted without written risk ownership. A common mistake is treating compliance as something the supplier owns. When several entities hold affected personal information, each keeps obligations under the Notifiable Data Breaches scheme. In July to December 2022, eight of 40 large-scale breaches affecting more than 5,000 Australians involved a service-provider relationship (OAIC Notifiable Data Breaches report). Contract for rapid escalation, audit rights, subcontractor disclosure, an Australian data-location decision where it matters, a secure deletion certificate, and a tested exit-assistance period. Success is operational independence, not a thick handover folder.

By Friday, write a one-page brief: live systems, contract end date, outstanding invoices, and every person who holds admin rights today.

Securing Accounts and Credentials Before Touching the Code

Production safety depends on who can change it. I still find a root email address sitting with an agency engineer more often than any other gap. Clients keep ownership of intellectual property they supply, so confirm which materials are yours before you move a file. Account control is also the first capability to bring back in-house: until your own team holds the keys, every other recovery step rests on the agency’s cooperation.

1. Send a written preservation notice. Ask the agency to freeze repositories, cloud resources, CI/CD settings, credentials, tickets, monitoring data, architecture records, dependency manifests, test evidence and production runbooks. A freeze stops quiet edits while you take stock.
2. Stand up an Australian-owned source of truth. Take administrator rights on Git hosting, AWS or Azure, DNS, container registries, analytics, app stores, SaaS integrations and billing. The destination account should be yours, not either supplier’s.
3. Export immutable backups and record a chain of custody. Note who copied what, when, and how. Later disputes turn on that record.
4. Build an access register, then rotate secrets. List every privileged account and service credential, remove dormant users, and replace shared passwords. Shared logins cannot be attributed after an incident.
5. Enforce MFA and named privileged accounts. The Essential Eight expects privileged-access requests to be validated when first requested, and privileged access to systems, applications and data repositories to be disabled after 12 months unless revalidated. It also separates privileged and unprivileged environments and covers local administrator and service-account credentials (Essential Eight maturity model).
6. Assign breach roles before you revoke anyone. Name who decides a notification, who talks to the agency, and what must be retained.

Why a meeting is not a handover

Access on paper is not access in practice. Require the incumbent to demonstrate a clean build and deployment from written instructions while your team watches, then have your team repeat it unassisted. That second run is the gate. If it fails, the agency keeps limited access and you keep paying for overlap until it passes.

Agree rollback criteria before any cutover: a higher error rate, rising latency, failed health checks, or unexplained cost growth. Evidence-based exit gates beat a slide pack: a reproducible build, a successful restore test, a tested incident procedure, a privileged-access review, and owner-approved acceptance criteria.

The stakes are real. July to December 2023 produced 483 data-breach notifications and 121 secondary notifications, and the OAIC identified cloud and software-provider relationships as a recurring source of multi-party breaches (data breach report on supply chain risks). If a breach lands mid-transition, “we were changing suppliers” is not a defence.

Practical rule: Do not reset the last shared password until you know which pipeline, webhook and monitoring tool still depends on it.

Assessing Status, Scope and Risk Before Any Change

Every incoming supplier asks the same question first: what is built, and what remains. Answer it with two tracks at once. The technical track inventories services, data flows, deployment paths, secrets, licences and single points of failure. The commercial track compares what was paid, what milestones were reported, and what working software exists.

Five steps to a baseline someone else can check

1. Freeze the record. Export the backlog, commit history, test results and invoices before anyone “tidies” them.
2. Classify every open item. Mark it as unfinished scope, rework, technical debt, or a disputed change request. Those four categories get mixed in status reports, and the mix is where budgets disappear.
3. Read the defects that hurt the business. Review high-impact issues in the source and run root cause analysis on crashes that keep returning. That is the work we did for Pangolin Associates, pairing source review with monitoring rather than guessing from a ticket title. The same discipline sits behind enterprise application monitoring and debugging.
4. Rank one remediation backlog by business risk. A cosmetic defect on a marketing page does not sit above a broken payment path.
5. Write remaining scope, budget and a critical-path schedule, then have someone independent check it. The checker should not be the team that will bill the rebuild.

Western Australia’s Auditor General reviewed 10 major IT projects and found their estimated combined cost had reached at least $4.2 billion, $1.6 billion or 62% above the $2.6 billion first advised to government. Eight of the 10 were late, with delays from four to 78 months. Reporting gaps included limited governance oversight and missing foundational planning documents, so full cost and time information could not be produced. The Queensland Audit Office had earlier reported that 18% of projects on the Queensland ICT dashboard had stayed in delivery for more than three years, while noting governance had improved since 2013 (Queensland Audit Office ICT monitoring summary).

A new supplier inherits the same information asymmetry if you skip the baseline. They cannot tell unfinished work from rework, technical debt or a disputed change.

Capture evidence first: repositories, cloud accounts, source code, deployment credentials, contracts, backlog history, test results, architecture decisions, incident records and cost data. The next milestone is an independently verified recovery plan. Do not replace the vendor until that baseline exists.

Documenting Dependencies, Data and Contract Terms

The surprises in a takeover rarely sit in the application code. They sit in the services, people and clauses around it. Record those before you argue about a rewrite, and before you plan any cloud migration.

Privacy still sits with you

Under Australian Privacy Principle 8.1, before you send personal information to an overseas recipient you must take reasonable steps to ensure that recipient does not breach the Australian Privacy Principles, and you can remain accountable if they do. A handover pack should include a data inventory, approved transfer locations, contractual privacy obligations, breach-notification requirements, deletion or return procedures, and a list of subcontractors who can reach production data. The OAIC treats information supplied to an overseas cloud provider solely for storage, where a binding contract limits the provider’s handling, as a use rather than a disclosure (sending personal information overseas). Exact wording and the access model decide how databases, logs, backups and support environments are treated.

What you own, and what you do not

Ownership of custom-developed deliverables transfers to the client on full payment. Check that payment status before you assume the repository is yours. The provider keeps its pre-existing tools, frameworks, methodologies, templates and proprietary systems, so ask which parts of the build are those, not custom work paid for by you.

Small businesses may have protection against unfair terms in standard-form contracts. The ACCC describes an unfair term as one that creates a significant imbalance, is not reasonably necessary to protect the other party’s legitimate interests, and would cause financial or other harm if enforced. Thresholds in its guidance have varied: businesses with 20 or fewer employees and an upfront price below $300,000, or $1 million for contracts longer than 12 months, under an earlier description, and businesses with fewer than 100 employees or annual turnover below $10 million for newer or varied standard-form contracts. A term a court or tribunal finds unfair can be void while the rest of the contract continues where possible (ACCC guidance on contracts). Look hard at suspension, source-code access, data export and termination assistance. Take legal advice before you rely on any of those clauses.

Managing Delivery and Security Risks During Transition

The failures that matter are the ones that appear while access is moving, not a generic security poster on the wall. These seven show up on almost every stalled handover I walk into.

Treat the Essential Eight as acceptance criteria

The eight mitigation strategies are patching applications, patching operating systems, multi-factor authentication, restricting administrative privileges, application control, restricting Microsoft Office macros, user-application hardening, and regular backups. During a transition they become tests, not slogans. Require MFA on administrator and repository accounts, restrict administrative privileges to named people, confirm backups restore, and name who patches applications and who patches operating systems. The model also says allowed and blocked application-control events should be centrally logged, and that application-control rulesets should be validated at least annually (Essential Eight maturity model, November 2023.pdf)). Access logs, restore results, patch reports, ruleset reviews and deployment records are the proof that control moved. A folder of PDFs is not.

Agree rollback triggers before go-live: a higher error rate, rising latency, failed health checks, or unexplained cost growth. Tie each release to its commit so an error traces to the change that caused it. For Pangolin Associates we connected GitHub with error monitoring for that reason. Unexplained cloud spend is a separate failure mode, and the patterns in common AWS mistakes SMEs make are the ones a quiet agency account tends to hide.

Your organisation still carries breach obligations when personal information is involved, even if a supplier caused the incident. Do not write the transition plan as if accountability left with the offshore team.

Budgeting the Takeover and Its Overlap Period

Price the takeover before you negotiate the exit. The largest cost is usually the overlap, not the handover meeting. Four lines cover it, and each should have a monthly budget released only when its exit gate passes.

Overlap. The agency and the receiving team run in parallel across the 90-day window. Budget both. Agree in writing which hours are knowledge transfer and which are still delivery. Unmarked hours become a second retainer you did not approve.

Rebuild. Reproducing environments with infrastructure as code, adding automated tests and standing up staging is paid engineering time. It is not “included in the exit”. If you are weighing that effort against a fresh build, a grounded custom app cost comparison stops the rebuild from being priced on hope.

Assurance. Pay for an independent check of remaining scope, budget and the critical path, plus a disaster-recovery exercise that restores into an isolated account. That isolated account has its own cloud bill. Put it on the forecast.

Legal and access. Review termination and suspension clauses, and document the outcome of any disputed invoice. Keep disputed amounts separate from routine payments. A suspension right tied to an unpaid bill can lock production during the weeks you most need access.

Compare the cost of a funded overlap with the cost of a rushed exit. The rushed version usually arrives as an outage, a backup that will not restore, or a privacy incident, and those costs land after the agency has already left. Releasing funds against gates, rather than against a monthly invoice, is the commercial control that matches the technical one.

Deciding What to Keep Offshore and Proving Independence

Taking control back does not have to mean insourcing every task. Score each capability by how critical it is to the business and by how easily someone else could replace it. Geography is a weak proxy. A local supplier that still holds your identity provider, repositories, billing, monitoring and disaster-recovery knowledge leaves you exposed in the same way an offshore team does.

What the labour market actually allows

The 2025 Jobs and Skills Australia Occupation Shortage List found software engineers were no longer in shortage in any state or territory, while cybersecurity engineers, cybersecurity operations coordinators, software testers, and most cybersecurity governance, risk and compliance specialists remained in shortage (ACS on the occupation list). You may be able to rebuild application development locally and still fail to recreate security, testing and assurance. So pull privileged access, production deployment authority, cloud-account ownership, incident response, data definitions and acceptance criteria inside first. Outsource bounded implementation only after those controls exist.

The hiring picture argues for the same split. The Future Skills Organisation projects a shortage of 131,000 technology workers in Australia by 2030, including 19,600 software and applications programmers and 18,000 database and ICT-security specialists, and the Australian Public Service separately identifies a potential digital-talent shortfall of more than 8,000 people over five years (Workforce Plan 2025, Technology). A handover workshop does not close that gap. NGOs and enterprises that cannot absorb a sudden loss of scarce cyber and QA skill should plan on keeping some implementation offshore while control moves in-house.

Gates that prove the team can run it

Require two or three production releases led by the new owner, incidents resolved without the agency, tested rollback and restore, verified access revocation, reproducible environments, current dependency and data-flow inventories, and an on-call rota that still works after one person leaves. If a gate is missed, convert the contract into a time-limited knowledge-transfer arrangement with measurable obligations. Delaying the exit is safer than forcing it.

Evidence beats intention here. For ClubScout we paired documentation with knowledge transfer so the client could own the platform, and we delivered working automation: GitHub Actions pipelines and a dedicated staging environment, not a slide of “next steps”. If your internal team is thin, business IT consulting is a way to hold architecture and release approval while implementation stays bounded. Cut access in order: production deployment, administrator roles, secrets, and finally logs you still need for audit. After an enquiry we schedule a short call to see whether that split fits.

Continuum Solutions helps Australian organisations reclaim stalled software by securing cloud accounts, auditing the codebase, and proving the receiving team can release without the incumbent agency. We design AWS account ownership, deployment pipelines and handover evidence so control sits with you, not with a supplier’s status report. If you are ready to set those gates, visit Continuum Solutions and tell us which systems you cannot currently change.