Five years of Salesforce platform delivery for an Australian state government agency

The challenge

A state regulatory programme where records must be accurate, retained and defensible to auditors. The register is the evidence base for regulatory decisions, so what it holds has to stand up years after the work it describes was done.

That shapes the system. One register has to hold the sites, the regulated items found on them, the assessments made against them, the remediation work and the certification that closes it out. Most of the people who create and consume those records sit outside the agency, across four distinct external groups. Each group needs a different slice of the same data, and none can be given more than its slice.

The agency also needed a delivery partner able to keep a platform of that kind running to public sector expectations for privacy, auditability, accessibility and security, over years rather than through a single build.

What we built

The platform is a Salesforce org acting as the system of record. Business logic, authentication and data all sit on the platform.

• A Lightning application for agency staff covering the register itself: sites, assets, regulated items, assessments, remediation jobs, certification and the case queue that ties them together.
• An Experience Cloud portal for the organisations that hold the assets on the register, giving each organisation access to its own records, reports and requests.
• A second portal for the licensed practitioners who carry out assessments, covering firm access requests, assessment capture and generated assessment reports.
• Two further public-facing portals serving the remaining external user groups.
• A multi-tier organisation hierarchy, so large external groups are modelled as parent bodies with sub-entities beneath them and data visibility follows the structure.
• An extension of the register to further regulated material types, later merged into the core platform rather than run as a separate application.
• Bulk load templates and workflows for high-volume record creation and correction.
• Integrations to mapping and address validation services.
• Analytics dashboards surfaced to external portal users as well as to internal staff.
• A design-system refresh of the main external portal, built and currently in test.

Sharing is private by default. Access is granted deliberately through record types, permission sets and sharing rules. Automation runs on Apex triggers using a standardised trigger framework, alongside Flows and approval processes.

A field mobile application synchronises against the platform. It is covered in a separate study.

How we worked

Two streams run in parallel. A BAU stream takes client-raised cases, defects and small changes. A project stream delivers new portals and larger platform capability. Both are staffed by a dedicated team rather than a shared pool, covering Salesforce development, business analysis, QA and project management.

Releases are versioned and scheduled, with a separate production hotfix path for work that cannot wait for the next train. Changes move through development and SIT sandboxes into UAT before production. Deployment runs through pipeline-based CI. QA covers functional test passes, portal regression runs and structured UAT bug verification.

Platform security is a standing workstream rather than a periodic project. It covers multi-factor authentication, access and least-privilege review, and a monthly review of vendor security advisories. We also assess each seasonal Salesforce release against the platform ahead of the upgrade window and report the impact to the agency before it lands.

The team works to the agency’s priorities rather than to a fixed backlog. Portal enhancements requested after industry feedback were started and live inside two weeks.

Outcomes

• Continuous engagement since 2021. The platform has been in production and under active development throughout that period.
• A single system of record for the agency’s regulatory programme, holding the register, the assessment lifecycle, remediation and certification in one audit trail.
• Self-service for four external user groups through purpose-built portals, so external users transact against the register directly rather than through agency staff.
• Register coverage extended to further regulated material types, then consolidated into the core platform rather than maintained as a second application.
• A sustained versioned release cadence with a hotfix path, and a vendor release assessment delivered ahead of each seasonal upgrade window.
• Change delivered to the agency’s timetable, including portal enhancements taken from request to production in two weeks.

Measured outcome figures are not published in this study. They are held pending client approval.