it (ATO) also downgraded its assessment of external fraud risks from “severe” to “low” two months before the scam took off in mid-2021.

I can guarantee I know how this happened. Some pube thought they needed to remove all ‘severe’ risks from a risk register and made some idiotic claims that no one dared speak out against.