Systems audit, delivered.
Six weeks of audit. Here's what we found, and what we recommend.
Same business,
twelve months apart.
Income is up about 20% on a like-for-like basis. Operating costs roughly quadrupled. What happened between those two snapshots is what this audit looks at.
Five months until the
runway runs out.
FY25 closed with a $3.58M profit. The first 10 months of FY26 burned $2.34M. Cumulative is still positive — just. At today's burn rate, the gap closes by October 2026.
Operating expenses quadrupled in 12 months. The leak isn't grant size — it's how each dollar is being spent.
Cut contractor spend, or cut operations cost by running them efficiently. Phase 2 is the second option, costed and sequenced.
Projection holds the FY26 monthly burn rate ($234K/mo) constant. Some figures need cleaning up before they reconcile to the cent — but the direction of travel is unambiguous. Details on data-quality caveats in take-home §4.
Eight things worth fixing.
No control over 2,500 client records
One disgruntled employee, phishing email, or accidental delete — the master client sheet is gone or held for ransom. Privacy Act penalties for serious breaches reach $50M per incident; a similar provider was fined $5.8M this year.
A dedicated role for 66 invoices a day
EC pays a full-time wage to one person whose job is entirely creating Square invoices — nothing else. Invoices reach clients up to a month after service, by which point the work has been forgotten and collection becomes harder.
$303K outstanding across 10,458 Square invoices
Bank transfers arrive without invoice references. Two staff spend ~40 hrs/week matching by hand — essentially a full FTE. A large share is phantom — money that's already arrived in EC's bank account but never matched back to a specific Square invoice. No one can say which of the $303K is genuinely unpaid versus already-received-but-unreconciled.
DEX reporting drowns the team
~2 hours per day per staff member × 6–7 staff = a full FTE every day. No second pair of eyes catching mistakes. To log in, the team passes around the CEO's mobile for 2FA — anything reported wrong reflects on him.
Transport is an under-served market
EC delivers about 21% of its contracted Transport volume. The service isn't bound by area — anywhere in Melbourne is fair game. This could be a department we grow, not a niche we limit.
Too many Google Sheets, too many hands
Multiple sheets running operations. Data copied and re-keyed between them — error-prone. Too many people with edit access; people who've left still have access. Compliance docs (police checks, WWVP, insurance) scattered across emails and paper.
Tedious aged care worker monitoring
The HM team spends most of its hours coordinating ~30 associated providers and aged care workers through Google Sheets — chasing photos by email, validating time-on-site against contractor claims, manually cross-checking each sheet. This is the role today, not part of it.
No way to know if the business is performing
No metrics for jobs delivered, clients served, worker productivity, financial health. Even Xero is confusing — the data needs cleaning first. Clean the data, then measure the KPIs, then make decisions. Right now leadership flies blind.
Sorted by impact and effort.
Quick Wins
- ·Xero-first invoicing + BPAY
- ·Workspace security & admin
- ·Workspace tenant migration
- ·Operational sheet revamp
- ·Google review automation
Big Swings
- ·DEX submission automation
- ·Aged care worker operations portal
- ·Worker compliance register
- ·AI voice agent
- ·Performance & compliance dashboards
Nice-to-haves
- ·Update website for SAH
- ·Internal comms tool
- ·Social media presence
We don't recommend
- ·Custom ERP build
- ·Standalone CRM for now
- ·Platform migration before CHSP→SAH rules land
Five fixes that start immediately.
QW1 · Xero-first invoicing + BPAY
Avoids: a dedicated invoicing role · weeks-late invoices · the $303K Square backlog · Square's transaction fees on co-contribution receipts. Enables: auto-invoice on job log · pre-matched BPAY receipts · grant-stream P&L drilldown via Xero Activities.
QW2 · Workspace security & admin
Avoids: uncontrolled access, ex-staff still inside the data, no audit trail. Enables: a managed Google admin layer (run by MR Labs) and a defensible posture for audit readiness.
QW3 · Workspace tenant migration
Avoids: personal-Gmail dependency, no MFA, no audit trail; inter-team email scattered across personal inboxes. Enables: data leaves with the company, not the person · shared inboxes for accounts, transport, HM.
QW4 · Operational sheet revamp
Avoids: double-entry across sheets · status held in cell colours · unreliable hour counts. Enables: DEX automation downstream · auditable status · reliable inputs for every report.
QW5 · Google review automation
Avoids: being invisible to the next wave of clients shopping for SAH providers on Google. Enables: systematic capture of positive reviews from satisfied clients (and family members) at the moment of service satisfaction — automated nudge, one-tap submission, public visibility. Higher star-rating compounds into measurable revenue once SAH lands and clients choose providers based on reputation. Cheap to build, compounds over time.
Six builds that change the operation.
BS1 · DEX submission automation
Reclaims: ~1.75 FTE per day · eliminates manual portal login · stops passing the CEO's phone around for 2FA · auditable submission trail.
BS2 · Aged care worker operations portal
The big one. Each associated provider and worker logs in. EC assigns jobs. Live roster. On-site capture: GPS, time, photos, signature. Cuts HM coordination time in half. Real-time visibility.
BS3 · Worker compliance register
Central database for every worker's police check, WWVP, insurance, induction. Auto expiry alerts. One-click audit reports for ACQSC. Seeds BS2 Operations Portal as its compliance layer.
BS4 · AI voice agent
Deploy one for Transport, one for Home Maintenance. Each replaces approximately one full FTE answering routine calls 24/7. Books via 13Cabs / Uber APIs; human escalation for complex cases.
BS5 · Performance & compliance dashboards
One dashboard for the CEO with the KPIs that measure business health. Another for client-level MAC assessment status with 60-day expiry alerts. Acquittal defence rock-solid.
BS6 · WFH transition readiness
Beats Victoria's 1 Sep 2026 deadline. Telephony solution that frees phone-handling roles from a physical desk · time & presence tracking · OH&S workstation framework · formal WFH policy. Hardware (laptops, headsets, kits) billed separately. Sequenced right after QW2.
Where the value
actually comes from.
| Solution | Hrs/mo saved | FTE | Annual savings | Annual revenue | Implem. cost | Year-1 ROI |
|---|---|---|---|---|---|---|
| Quick Wins · Stage A · months 1–3 | ||||||
| QW1 · Xero-First Invoicing + BPAY | 120 | 0.75 | $67,600 | $50,000 | $14,000 | 840% |
| QW2 · Workspace Security & Admin | 4 | 0.03 | $1,920 | Strategic* | $3,500 | Strategic* |
| QW3 · Workspace Tenant Migration | 8 | 0.05 | $3,840 | Intangible | $6,000 | 64% |
| QW4 · Operational Sheet Revamp | 100 | 0.63 | $48,000 | $20,000 | $8,000 | 850% |
| QW5 · Google Review Automation | — | — | — | $15,000 | $3,000 | 500% |
| Big Swings · months 4–12 | ||||||
| BS1 · DEX Submission Automation | 280 | 1.75 | $134,400 | $50,000 | $12,000 | 1,537% |
| BS2 · Aged Care Worker Operations Portal | 240 | 1.50 | $115,200 | $40,000 | $30,000 | 517% |
| BS3 · Worker Compliance Register | 36 | 0.23 | $17,280 | Strategic* | $18,000 | 96% |
| BS4 · AI Voice Agent (Transport + HM) | 320 | 2.00 | $153,600 | $30,000 | $25,000 | 734% |
| BS5 · Performance & Compliance Dashboards | 20 | 0.13 | $9,600 | Strategic* | $15,000 | 64% |
| BS6 · WFH Transition Readiness | 20 | 0.13 | $9,600 | Strategic* | $10,000 | 96% |
| TOTAL · 11 solutions · 12 months | 1,148 hrs | 7.18 | $561,040 | $205,000+ | $144,500 | 530% |
Savings calculated at $40/hr blended FTE rate × hours saved × 12 months (conservative — most saved hours are admin/coordinator level, not management). FTE column = hrs/mo ÷ 160 hrs (one full-time month). Year-1 ROI = (savings + revenue) ÷ implementation cost. *Strategic items avoid catastrophic single-event losses (Privacy Act fine up to $50M; ACQSC penalty $75K–$300K per breach; failed acquittal $1.5M–$2.5M). Expected-value math and full per-line methodology in the take-home report §7.
What this returns.
From today to May 2027.
Phase 1 delivered today. Phase 2 builds across nine months in three overlapping sub-phases. Phase 3 retainer kicks in once Phase 2 wraps.
2026
2027
Two regulatory shifts.
One near, one far.
EC is approaching two distinct regulatory transitions. They land in different windows and demand different preparation — both shaped Phase 2's design.
Working-From-Home legislation.
Victorian commencement: 1 September 2026 for workplaces with 15+ employees (deferred 1 Jul 2027 for under-15). Workers gain the right to request WFH up to two days a week.
EC today: phone-handling roles tied to physical mobiles. No softphone. No presence tracking. No formal WFH policy. No OH&S framework for home workstations. Compliance fails on day one without a build.
Our answer: BS6 WFH Transition Readiness — softphones, time & presence tracking, formal policy, workstation kits. Sequenced right after QW2 Workspace migration. Operational before 1 Sep 2026.
CHSP-to-Support-at-Home.
CHSP transitions no earlier than 1 July 2027. Home Care Packages already moved on 1 November 2025. CHSP-specific mechanics haven't yet been published; HCP precedent suggests guidance lands 1–12 months before commencement.
EC today: CHSP-only provider. No Aged Care provider registration. No experience with billable-unit reporting or assessment-driven funding.
Our answer: Phase 3 retainer covers ongoing rule-tracking, transition-grant applications, and reporting integration when guidance lands. EC keeps a partner who already knows the operation.
Sign the SOW today.
We've prepared the Statement of Work for Phase 2 · Stage A — the five Quick Wins. Three quick decisions to lock in now, and we start the work.
-
Which Quick Win does week 1 hit first?
Five Quick Wins in Stage A. We sequence them — but you tell us which lands first. Our recommendation: data security lockdown (week 1, the binary risk) + sheet revamp (weeks 2–4, the foundation for everything else).
-
Who at EC owns Phase 2 day-to-day?
MR Labs builds it. EC needs one person who unblocks decisions, gives MR Labs access, shepherds workstreams through the team. Our recommendation: the General Manager.
-
Sign the Stage A SOW now?
The 31 August 2026 acquittal deadline doesn't wait. We've signed-and-ready paperwork on the table. Approve today, we invoice this week, work starts within two weeks. Our recommendation: yes.
The take-home report covers every recommendation in full — for further reading.
But we want the Stage A decision today, not in two weeks. The acquittal clock is ticking.
