Case Study – Agile Transformation at an Australian Bank

Introduction

This case study examines the agile transformation of a hypothetical mid-tier Australian bank, referred to as the Bank, across the 24 months from July 2023 to June 2025. The Bank is an authorised deposit-taking institution listed on the Australian Securities Exchange, holding total assets of A$118 billion, serving 1.42 million retail and business customers, and employing approximately 7,800 people. In FY2023 it replaced a project-based delivery model with a persistent tribe and squad structure covering its entire retail and business banking change portfolio. All figures are illustrative.

The analysis establishes the competitive and regulatory drivers of the change, describes the operating model adopted, quantifies the shift in delivery performance using the four measures established by Forsgren, Humble and Kim (2018), examines the obstacles encountered, and evaluates the change program against the ADKAR framework (Hiatt 2006). It closes by separating what the transformation demonstrably fixed from what it did not, since the second category is the more instructive for a prudentially regulated institution.

Case Background and Drivers

Competitive pressure

The Bank’s operating environment changed faster than its delivery capability. Cash fell to 13 per cent of the number of Australian consumer payments in 2022, from 27 per cent three years earlier (Reserve Bank of Australia 2023), and 78 per cent of the Bank’s own transactions were initiated in its mobile application by FY2025 against 61 per cent in FY2022. The branch network, historically the source of relationship advantage, had become a cost centre servicing a shrinking share of interactions.

Two structural forces compounded this. The four major banks deploy technology budgets an order of magnitude larger than the Bank’s, so competing feature for feature was never viable and speed of response to a narrower set of needs was the only defensible position. The Consumer Data Right then lowered the friction of switching by requiring accredited data sharing, a regime the Australian Competition and Consumer Commission (2024) has treated as an enforcement priority. Where switching costs fall, a delivery cycle measured in quarters becomes a commercial liability rather than an operational inconvenience.

Regulatory drivers

Regulation pushed in the same direction, which distinguishes this case from transformations in unregulated sectors. The final report of the Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry (Commonwealth of Australia 2019) generated a multi-year program of remediation and accountability work that consumed A$71.2 million, or 38.2 per cent, of the FY2023 change budget of A$186.4 million. Discretionary investment was therefore the residual of a mandatory obligation, and the slower the delivery engine, the smaller that residual became.

Three instruments framed the design constraints. Prudential Standard CPS 234 requires systematic testing of information security controls (Australian Prudential Regulation Authority 2019); Prudential Standard CPS 230, effective from 1 July 2025, requires identified critical operations, articulated tolerance levels and end-to-end management of service provider risk (Australian Prudential Regulation Authority 2023); and the Financial Accountability Regime Act 2023 (Cth) requires named accountable persons with mapped responsibilities. Each assumes traceable, individually attributable control, which sits uneasily beside the collective ownership that squad autonomy presumes.

The Transformation Design

The Bank adopted a variant of the model documented by Kniberg and Ivarsson (2012): persistent, cross-functional squads grouped into tribes by customer mission, with chapters providing functional depth across tribes and guilds carrying voluntary communities of practice. Six tribes were created, each containing 12 squads of 8 to 9 people, placing 612 of the 1,150 in-scope technology and change staff into squads. The remaining 538 staff sat in platform engineering, production support, cyber, data platform and leadership roles. Figure 1 sets out the resulting structure.

Three design decisions carried most of the weight. Squads were funded persistently against a tribe run rate rather than approved project by project, removing the annual capital allocation cycle as a gate on small changes. Chapters, not tribes, owned professional standards, so an engineer’s technical practice was governed by the engineering chapter lead while their daily priorities came from the squad’s product owner. A Risk and Controls chapter placed a qualified risk partner inside every squad, the structural answer to the accountability tension identified above and a departure from the reference model, in which risk sits outside delivery entirely.

Delivery Performance Before and After

Table 1 compares the FY2023 baseline with FY2025 across the four delivery measures of Forsgren, Humble and Kim (2018) together with throughput and unit cost.

Table 1: Delivery performance of the Bank’s retail and business banking change portfolio, FY2023 baseline compared with FY2025.

Lead time and deployment frequency

Value stream mapping of 40 sampled changes decomposed the FY2023 lead time of 47 days into requirements analysis (9), design and architecture approval (7), build (12), test environment queuing (6), testing (8) and change advisory board approval and release (5). Of these, 27 days, or 27 / 47 = 57.4 per cent, were queuing, approval or coordination rather than analysis, build or test. The FY2025 path of 9 days retains only 3 non-value-adding days:

Lead time reduction = (47 – 9) / 47 = 38 / 47 = 80.9%.

Deployment frequency moved from 24 bundled enterprise releases per year to 4,320 independent deployments. Normalised for team count and a 46 week delivery year:

FY2023 = 24 / (62 x 46) = 0.008 deployments per team per week; FY2025 = 4,320 / (72 x 46) = 1.30.

At 1.30 deployments per squad per week the Bank sits in the high performing rather than the elite band of Forsgren, Humble and Kim (2018), which is the honest reading: 3,890 of the 4,320 deployments, or 90.0 per cent, targeted the digital channel and application programming interface layer, while the vendor core banking platform continued to release 12 times a year.

Stability

Stability improved alongside speed, contradicting the trade-off that the FY2023 governance model implicitly assumed. Change failure rate is the proportion of production changes requiring unplanned remediation:

FY2023 = 344 / 1,860 = 18.5%; FY2025 = 311 / 4,320 = 7.2%.

Mean time to restore is total restoration time divided by the number of priority 1 and 2 incidents:

FY2023 = 1,391 / 148 = 9.40 hours; FY2025 = 254 / 121 = 2.10 hours, a reduction of 7.30 / 9.40 = 77.7%.

The mechanism is batch size. Smaller, more frequent changes contain fewer defects each and are easier to diagnose, so a rise in deployment frequency reduces rather than increases risk provided the deployment itself is automated and reversible. This is material for CPS 234 compliance, since demonstrable, repeatable control testing is easier to evidence in an automated pipeline than in a manual quarterly release (Australian Prudential Regulation Authority 2019).

Throughput and unit cost

Throughput per delivery team per quarter rose from 214 / (62 x 4) = 0.86 to 1,036 / (72 x 4) = 3.60, an apparent uplift of 319 per cent. That figure is not defensible without normalisation, because the average effort embodied in a delivered change fell from 310 to 95 person-days as work was decomposed. Weighting by effort:

FY2023 = 214 x 310 = 66,340 person-days; FY2025 = 1,036 x 95 = 98,420 person-days; uplift = 98,420 / 66,340 = 1.484, or 48.4%.

With the delivery workforce falling from 769 to 612 FTE, output per FTE rose from 66,340 / 769 = 86.3 to 98,420 / 612 = 160.8 person-days, an increase of 86 per cent. Unit cost follows the same logic. Cost per release fell from 186,400,000 / 24 = A$7,766,667 to 164,200,000 / 4,320 = A$38,009, a fall of 99.5 per cent, but the denominator has changed meaning entirely and should not be reported to a board without qualification. The stable measure is cost per delivered person-day of change:

FY2023 = 186,400,000 / 66,340 = A$2,810; FY2025 = 164,200,000 / 98,420 = A$1,668, a reduction of 40.6%.

The portfolio consequence matters more than any single ratio. Mandatory and remediation work absorbed A$44.1 million of the FY2025 budget, or 26.9 per cent, against 38.2 per cent two years earlier, so discretionary investment rose from A$115.2 million to A$120.1 million, an increase of 4.3 per cent, despite total spend falling 11.9 per cent.

Challenges and Mitigations

Table 2 records the six obstacles that materially threatened the program and the responses adopted.

Table 2: Principal transformation challenges, mitigations and residual position at FY2025.

Change Management

The Bank framed the people dimension using ADKAR (Hiatt 2006), better suited than Kotter (2012) to an organisation where the required change is individual behaviour repeated across 1,150 staff rather than a single strategic redirection. Kotter’s model was retained at the executive level, and the Bank’s clearest failure maps to his second step: the guiding coalition initially comprised technology and product leaders only, and risk and compliance executives were brought in five months after launch, by which point the first two tribes had designed control processes the second line subsequently rejected. Table 3 sets out the ADKAR application.

Table 3: ADKAR analysis of the Bank’s transformation, with interventions and indicators at 24 months.

The sequencing lesson is that Knowledge and Ability were addressed first, on the assumption that training resolves resistance, while Desire was addressed last. The displaced-leader attrition rate of 30.0 per cent is the cost of that inversion, falling on precisely the population whose tacit knowledge of the legacy systems the squads most needed.

Critical Evaluation

Three claims survive scrutiny. First, the transformation resolved a flow problem, not a productivity problem: because 57.4 per cent of the original lead time was queuing and approval, restructuring around persistent teams that own a change end to end removed the hand-offs that generated the queues, so the reduction from 47 to 9 days is explicable by the intervention rather than coincident with it. Second, speed and stability improved together, consistent with the finding that the two are complements once deployment is automated (Forsgren, Humble and Kim 2018). Third, the model expanded discretionary capacity by 4.3 per cent within a budget that fell 11.9 per cent, which for a mid-tier bank competing against far larger technology budgets is the strategically decisive outcome.

Other claims do not survive. The headline throughput uplift of 319 per cent per team is an artefact of decomposition, and normalising by effort reduces it to 48.4 per cent, while the cost per release improvement of 99.5 per cent is close to meaningless. Rigby, Sutherland and Takeuchi (2016) warn that agile methods suit genuinely uncertain work, and reporting undifferentiated aggregates conceals where value actually arose.

Architecture, not method, set the ceiling. The 22 per cent of the portfolio touching the core banking platform retained a median lead time of 38 days, more than four times the portfolio median, because no team structure can grant autonomy that the system boundaries do not permit; the Bank arguably restructured teams before decoupling the platform (Skelton and Pais 2019). Dependencies rose rather than disappeared, from 418 to 604, but the earlier figure understated reality because project plans absorbed dependencies invisibly, and the real improvement is the fall from 68 to 31 per cent in the proportion requiring a scheduled hand-off.

The regulatory tension was managed rather than resolved. CPS 230 requires end-to-end control over critical operations and equivalent tolerances for service providers (Australian Prudential Regulation Authority 2023), and the Financial Accountability Regime requires identified individuals to carry responsibility. Squad-level collective ownership satisfies neither, so the Bank maintains an accountability map above and outside the squad structure, and faster deployment expands the surface across which a reportable situation might arise under the breach reporting obligations administered by the Australian Securities and Investments Commission (2024), tolerable only because control evidence is generated automatically at each release. Any Australian ADI adopting this model should expect the same hybrid rather than the pure form described by Kniberg and Ivarsson (2012), which documented a specific culture, not a transferable blueprint.

Two limitations close the evaluation. Annosi, Foss and Martini (2020) find that short iteration cycles can crowd out longer-horizon learning, and the evidence is consistent: multi-year platform renewal fell from 18 to 11 per cent of portfolio spend, or from A$33.6 million to A$18.1 million, precisely the investment that would relieve the core constraint. Attribution is also confounded, since the cost-to-income ratio improved from 54.8 to 52.1 per cent over a window in which a rising cash rate cycle expanded sector net interest margins and the technology labour market loosened (Australian Bureau of Statistics 2025). Finally, agile improved the rate of delivery without improving the choice of what to deliver: 1,036 of 1,610 requested items were completed, a rate of 64.3 per cent, so prioritisation remains the binding constraint.

Conclusion

The Bank’s transformation succeeded against the objectives it could reasonably own. Lead time fell 80.9 per cent, change failure rate fell from 18.5 to 7.2 per cent, mean time to restore fell 77.7 per cent, effort-normalised output per FTE rose 86 per cent, and the cost of a delivered person-day of change fell 40.6 per cent, releasing discretionary capacity within a smaller budget. These gains came from removing hand-offs and approval queues, and they were sustained across four consecutive quarters rather than appearing as a launch effect.

What it did not fix is equally clear. It did not modernise the core platform, and 22 per cent of the portfolio still runs at legacy speed. It did not eliminate dependencies, only reveal and reduce the cost of them. It did not reconcile collective squad ownership with the individual accountability that CPS 230 and the Financial Accountability Regime require, and it reduced the long-horizon investment that would have relieved its own principal constraint. The generalisable conclusion for Australian ADIs is that an operating model change of this kind is necessary but insufficient: it lifts delivery throughput to the limit the architecture, funding model and accountability regime allow, and having reached that limit within two years, the Bank’s next constraint is no longer organisational.

References

Annosi, MC, Foss, N & Martini, A 2020, ‘When agile harms learning and innovation’, California Management Review, vol. 63, no. 1, pp. 61-80.

Australian Bureau of Statistics 2025, Labour force, Australia, detailed, ABS, Canberra.

Australian Competition and Consumer Commission 2024, Consumer Data Right compliance and enforcement policy, ACCC, Canberra.

Australian Prudential Regulation Authority 2019, Prudential Standard CPS 234 Information Security, APRA, Sydney.

Australian Prudential Regulation Authority 2023, Prudential Standard CPS 230 Operational Risk Management, APRA, Sydney.

Australian Securities and Investments Commission 2024, Regulatory guide 78: breach reporting by AFS licensees and credit licensees, ASIC, Sydney.

Commonwealth of Australia 2019, Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry: final report, Commonwealth of Australia, Canberra.

Forsgren, N, Humble, J & Kim, G 2018, Accelerate: the science of lean software and DevOps, IT Revolution Press, Portland.

Hiatt, JM 2006, ADKAR: a model for change in business, government and our community, Prosci Learning Center, Loveland.

Kniberg, H & Ivarsson, A 2012, Scaling agile at Spotify, Crisp, Stockholm.

Kotter, JP 2012, Leading change, Harvard Business Review Press, Boston.

Reserve Bank of Australia 2023, ‘Consumer payment behaviour in Australia’, RBA Bulletin, June, Reserve Bank of Australia, Sydney.

Rigby, DK, Sutherland, J & Takeuchi, H 2016, ‘Embracing agile’, Harvard Business Review, vol. 94, no. 5, pp. 40-50.

Skelton, M & Pais, M 2019, Team topologies: organizing business and technology teams for fast flow, IT Revolution Press, Portland.