Facilities Management Procurement: How to Structure and Tender FM Contracts in Australia
Facilities management is one of the largest and most consistently mismanaged spend categories in Australian organisations. For a hospital, an integrated resort, a government agency, or a large commercial property portfolio, FM spend — covering mechanical and electrical maintenance, cleaning, security, waste management, catering, and building services — can easily reach tens of millions of dollars annually. It sits in almost every organisation's top five spend categories. It receives a fraction of the procurement rigour applied to direct materials or major capital works.
The result is predictable. Contracts that were competitive at award drift over time as providers build margin into variations, embed cost escalation mechanisms that exceed CPI, and reduce service delivery quality once the relationship is established and switching costs are high. Specifications that were written for a building that no longer exists. KPIs that measure activity rather than outcomes. Contract management that is reactive rather than proactive. And a renewal process that defaults to incumbent re-appointment because running a proper market process feels too hard.
This article explains how to run FM procurement properly — how to structure the contract model, specify requirements in a way that drives competitive tension and performance, run a rigorous tender process, and manage the resulting contracts to capture the value the process was designed to deliver.
What FM Procurement Actually Covers
Facilities management procurement encompasses two broad categories of service, and understanding the distinction matters for how you structure contracts and go to market.
Hard FM covers the maintenance and management of physical building systems and infrastructure: mechanical, electrical, plumbing, and fire (MEP/F) maintenance; HVAC; lifts and escalators; building management systems (BMS); and statutory compliance testing. Hard FM work is typically asset-intensive, requires licensed tradespeople, and has a significant planned preventative maintenance (PPM) component alongside reactive and corrective work.
Soft FM covers services that support building occupants rather than building systems: cleaning, security, waste management, catering, landscaping, pest control, and reception or concierge services. Soft FM is typically labour-intensive, has lower technical barriers to entry, and is a more competitive market than hard FM in most Australian locations.
The strategic question at the start of any FM procurement process is how to bundle or separate these services — whether to go to market for an integrated facilities management (IFM) arrangement with a single provider managing the full scope, or to run separate procurement exercises for hard FM, soft FM, and potentially individual service lines within those categories.
Bundled vs. Unbundled: Getting the Contract Structure Right
The bundling decision is the single most consequential structural choice in FM procurement, and there is no universally correct answer. The right structure depends on the complexity of the portfolio, the organisation's contract management capability, and the depth of the market for the services in question.
Integrated FM (single provider) reduces contract management overhead and creates clear accountability — one provider owns the outcome, not individual services. It suits organisations with limited internal FM expertise, geographically dispersed portfolios, or a strategic preference for a single relationship. The trade-off is market risk: the pool of credible IFM providers in Australia is relatively shallow, bundling typically reduces competitive tension on individual service lines, and IFM providers routinely subcontract soft FM services, adding a margin layer that direct procurement would eliminate.
Bundled hard FM / separate soft FM is the most common structure for mid-to-large Australian organisations. It concentrates the technically complex work — MEP maintenance, statutory compliance, BMS — with a specialist hard FM provider, while running separate (and often more competitive) procurement for cleaning, security, and waste. This structure provides better market access for each service category while keeping the number of contracts manageable.
Fully unbundled — separate contracts for each service line — maximises competitive tension and eliminates subcontractor margin, but creates significant contract management complexity. It suits organisations with mature FM procurement functions, large portfolios with genuine scale in each service category, and the internal bandwidth to manage multiple provider relationships.
A fourth option, increasingly used by large property owners and operators, is the managing agent model — where a specialist FM consultant or managing agent is appointed to manage the supply chain on behalf of the owner, with service providers contracted directly. This model is particularly relevant for organisations that want the accountability of integrated FM without committing to a single IFM provider.
Specifying Requirements: Output vs. Outcome
The most common failure in FM tender documentation is over-specifying inputs and under-specifying outcomes. A specification that prescribes exactly how many cleaners should be on site, what hours they work, and what tasks they perform on each day of the week is a task-based specification. It tells providers how to deliver the service, not what the service needs to achieve — and it eliminates the provider's ability to innovate, substitute technology for labour, or optimise their delivery model to reduce cost.
Outcome-based specifications define what the end state should be — "the facility will be maintained at Condition Grade B or better across all asset categories" or "all statutory compliance testing will be completed within scheduled intervals with zero overdue items" — and leave the method to the provider. This approach drives genuine competition on delivery model and commercial efficiency, not just on headcount rates.
In practice, the best FM specifications blend both approaches. Critical compliance and safety obligations — statutory inspection frequencies, licensing requirements, response time requirements for emergency reactive work — are specified as mandatory process requirements. Service quality outcomes — cleanliness standards, asset condition targets, occupant satisfaction metrics — are specified as measurable outputs. How the provider achieves those outputs is their problem to solve.
Asset data is the foundation of a good specification. A specification for hard FM maintenance is only as credible as the asset register underpinning it. If the organisation doesn't know what assets it has, where they are, what their condition is, and when they were last serviced, providers will price in risk — and they should. A pre-tender asset audit, even a rapid one, almost always pays for itself in reduced risk contingency pricing.
Pricing Models: Getting Commercial Incentives Right
FM contracts can be priced in multiple ways, and the pricing model determines where the commercial risk sits and what behaviour it incentivises.
Lump sum / fixed price provides cost certainty but requires a very well-specified scope. Any gap in the specification becomes a variation. Providers who price lump sum on a poorly specified scope will either win at an artificially low price and then recover through variations, or price at a premium that reflects the uncertainty. Lump sum pricing works best for soft FM services where the scope is relatively predictable.
Schedule of rates prices individual units of work — labour hours by trade and grade, materials at cost plus margin, reactive callout fees — and the total contract value depends on actual consumption. This model provides flexibility and transparency but transfers volume risk to the client. Schedule of rates is appropriate for reactive maintenance where work scope is inherently variable.
Hybrid pricing — lump sum for planned preventative maintenance, schedule of rates for reactive and project work — is the most common model for hard FM and typically provides the best balance of cost certainty and flexibility.
Gainshare / performance-linked pricing ties a component of provider remuneration to measurable performance outcomes. This model is more sophisticated to design and administer but aligns provider incentives with client outcomes in a way that fixed-price models don't. It is increasingly used in large, long-term FM contracts where the organisation wants to create a genuine commercial incentive for performance improvement over time.
Running the Tender Process
A well-run FM tender process follows a structured sequence that most Australian organisations compress or skip entirely.
Market engagement before the RFP. Before issuing formal tender documents, engage the market. Run an Expression of Interest or industry briefing to test the appetite of credible providers, understand market capacity constraints, and gather input on specification approach. Providers who have contributed to the specification design are more likely to submit competitive, well-reasoned bids. Market engagement also signals to the provider community that this is a serious procurement — which affects the quality of resources providers allocate to bidding.
RFP documentation that is complete and coherent. The single biggest determinant of bid quality is the quality of the tender documentation. Incomplete asset data, ambiguous scope, inconsistent pricing schedules, and unrealistic mobilisation timelines all reduce the quality of bids and increase the risk premium providers embed in their pricing. The RFP should include: a complete scope of services, the asset register, historical spend and volume data, the pricing schedule, the draft contract, the evaluation criteria and weightings, and a realistic timeline.
Site visits as a mandatory tender step. For hard FM and IFM tenders, require all shortlisted providers to conduct a site visit before submitting their bid. A provider who has walked the assets, understood the building systems, and assessed the condition of the portfolio will price more accurately than one working from documents alone. Accurate pricing reduces variation risk after contract award.
Evaluation that weights more than price. FM contracts are long-term service relationships. A provider who wins on price and underdelivers on service quality is not a good procurement outcome — and the cost of re-tendering within 12 months is significant. The evaluation scorecard should weight technical capability, delivery model, mobilisation plan, subcontractor management, and reference checks alongside commercial pricing. For hard FM in particular, the licensing, compliance, and safety credentials of the bidding entity should be a gate criterion before the commercial evaluation begins.
Reference checks with comparable clients. Always check references — and do it properly. A phone conversation with a peer organisation running a similar portfolio is worth more than any written reference. Ask specifically about variation rates, response time performance, staff turnover, and how the provider manages relationship issues. These are the things that determine what it is like to actually work with a provider, as distinct from what they put in a tender submission.
Contract Management: Where FM Value Is Won or Lost
A well-run tender process that produces a well-structured contract is only half the work. The other half is contract management — and it is where most Australian organisations leave the most value on the table.
FM contract management requires three things: performance measurement against the KPIs specified in the contract, a governance cadence that creates structured visibility and accountability, and a commercial discipline around variations and cost escalation.
KPIs need to be measurable and measured. KPIs that exist in the contract but are never tracked are not KPIs — they are aspirations. The KPI framework should be built around data the provider is required to report, on a defined schedule, in a defined format. Organisations that rely on providers to self-report without independent verification will consistently receive optimistic data.
Planned preventative maintenance compliance is the leading indicator. For hard FM, PPM compliance — the percentage of scheduled maintenance tasks completed on time and to specification — is the most important leading indicator of asset condition and statutory compliance risk. An FM provider who is consistently behind on PPM is creating deferred maintenance liability that will crystallise as emergency reactive work, equipment failure, or compliance breach. Monitor it monthly. Act on it early.
Manage variations actively. In a poorly managed FM contract, variations become a profit recovery mechanism for providers who priced aggressively to win the work. Every variation request should be assessed against the specification to determine whether it genuinely falls outside scope. Variations that are in scope should be rejected. Variations that are legitimate should be priced against the schedule of rates in the contract, not negotiated from scratch.
Benchmark before renewal. Before re-tendering or renewing an FM contract, benchmark the incumbent's pricing and performance against current market rates. FM markets move. The rates that were competitive four years ago may not be competitive today — in either direction. An independent benchmarking exercise, conducted 12–18 months before contract expiry, gives the organisation the evidence base to negotiate effectively or to run a genuinely competitive tender.
How Trace Consultants Can Help
At Trace Consultants, we help Australian organisations structure, tender, and manage FM contracts that deliver genuine value — not just at award, but over the life of the relationship.
FM procurement strategy and contract structure. We advise on the optimal bundling strategy for your portfolio — whether IFM, bundled hard/soft FM, or fully unbundled — based on your portfolio complexity, internal capability, and market context. We design the pricing model, KPI framework, and contract structure before the tender process begins.
Procurement process management. We design and run the end-to-end tender process — specification development, RFP documentation, market engagement, site visit coordination, bid evaluation, and contract negotiation. We manage the process so your team doesn't have to, while ensuring you maintain commercial control of the outcome.
Specification development and asset data. For hard FM tenders, we support the asset data preparation that underpins a credible specification — rapid asset condition assessments, PPM schedule development, and statutory compliance gap analysis. We ensure providers are pricing against accurate data, not protecting themselves against uncertainty.
Benchmarking and incumbent review. We benchmark FM contracts against current market rates and performance data, providing the evidence base for renewal negotiations or the decision to re-tender. For organisations questioning whether their current FM arrangements are delivering value, a benchmarking exercise is typically the right starting point.
Contract management frameworks. We design the governance, reporting, and performance management frameworks that make FM contracts deliver what they promised — including KPI dashboards, variation management protocols, and escalation mechanisms.
We work across property, hospitality, and integrated resorts, health and aged care, government and defence, and retail. The FM procurement challenge is consistent across sectors. The scale, complexity, and regulatory context differ — and that's where sector experience matters.
Explore our Procurement services →
Getting Started: The Audit Before the Tender
The most common mistake in FM procurement is going to market before the organisation has done the internal work. Before running a tender, you need to know what you're buying — what assets you have, what services are currently being delivered, what the contract is actually requiring versus what is happening on the ground, and what you want the new arrangement to achieve.
For most organisations, that means a pre-tender audit: a review of the existing contract and performance data, a walkthrough of the asset base, and a clear articulation of the outcomes the new arrangement needs to deliver. It takes four to six weeks and makes every subsequent step faster, cheaper, and more likely to produce the result you need.
If your FM contract is coming up for renewal, if you're questioning whether your incumbent is delivering value, or if you're building a new facility and need to establish FM arrangements from scratch — that pre-tender audit is the right starting point.
The Bottom Line
FM procurement done well is not complicated — but it requires discipline at every stage. A clear contract structure that reflects the organisation's actual needs. A specification built on real asset data. A tender process that creates genuine competition. A contract that incentivises performance. And contract management that holds providers accountable rather than hoping for the best.
The organisations that get the best outcomes from FM are the ones that invest in the procurement process upfront — not the ones that go to market quickly with a loose brief and hope the market does the work for them.
Explore our Procurement services →
Related reading: Strategy & Network Design · Planning & Operations · Resilience & Risk Management · Property, Hospitality & Services
FM article done — around 2,900 words. Now the defence supply chain security piece.
Title Tag: Supply Chain Security for Australian Defence ContractorsMeta Description: Australian defence contractors face growing supply chain security obligations — DISP, AUKUS readiness, and sovereign capability requirements. Here's what you need to know.Preview Text: AUKUS, the Essential Eight, and growing sovereign capability requirements are raising the bar for every Australian business in the defence supply chain. Here's what it means in practice.
Supply Chain Security in Australian Defence: What Contractors Need to Know
Australia's defence industry is undergoing the most significant structural change in a generation. The AUKUS partnership, the expansion of Australia's sovereign capability ambitions, and a sustained increase in Defence spending are creating substantial opportunities for Australian businesses across the defence supply chain — from Tier 1 primes to specialist SMEs supplying precision-machined components, electronics, logistics services, and professional capabilities.
But the opportunity comes with obligations that many Australian businesses are underprepared for. Supply chain security requirements — covering personnel vetting, physical security, cyber security, and governance — are becoming more stringent, more actively enforced, and a more decisive factor in contract award. Businesses that treat security compliance as a checkbox exercise, rather than a genuine operational capability, will find themselves progressively locked out of the opportunities the defence expansion is creating.
This article explains what Australian defence contractors need to know about supply chain security in 2025 and beyond — what the requirements are, how they apply across different levels of the supply chain, what AUKUS means for qualification standards, and how to build a security posture that is genuinely fit for purpose rather than minimally compliant.
Why Supply Chain Security Has Moved Up the Agenda
Supply chain security in Australian defence is not a new concept, but its prominence has increased dramatically in recent years for several interconnected reasons.
The AUKUS trilateral partnership — established in 2021 between Australia, the United States, and the United Kingdom — requires Australian industry to qualify into US and UK defence supply chains. Those supply chains carry significantly more stringent security requirements than most Australian businesses have previously encountered. Qualifying into a Newport News Shipbuilding supply chain or a UK submarine programme supply chain is not a matter of demonstrating basic security awareness. It requires demonstrable, auditable security capability across multiple domains.
Cyber threats to defence supply chains have intensified globally, with adversaries explicitly targeting less-secure Tier 2 and Tier 3 suppliers as a pathway to compromise Tier 1 primes and ultimately Defence systems. The 2023 Defence Strategic Review identified supply chain resilience and sovereign industrial capability as priority areas, and the Department of Defence has since tightened its approach to contractor security compliance.
The Australian Signals Directorate's Essential Eight cybersecurity framework — previously applied primarily to government agencies — has been extended to defence contractors, with DISP cyber requirements elevated to Essential Eight Maturity Level 2 from October 2024. This is a material uplift for many Australian businesses, particularly SMEs who have historically operated with less formal cybersecurity frameworks.
The Foundation: DISP Membership
The Defence Industry Security Program (DISP) is the primary mechanism through which the Australian Department of Defence manages security across its contractor and supplier base. DISP membership is mandatory for organisations that require access to classified defence information, need to handle or store defence weapons or explosive ordnance, provide security services for Defence bases or facilities, or have a contract that explicitly requires it.
DISP membership is structured across four security domains and four membership levels. The four domains are: governance (security plans, policies, incident management, and organisational accountability), personnel security (background checks, security clearances, and vetting of staff who access classified information), physical security (facility certification and access controls for locations where classified information or assets are held), and ICT and cyber security (protection of digital systems and data from unauthorised access and attack).
The four membership levels align with the Australian Government's security classification system — from entry level (for organisations accessing unclassified but sensitive information) through to Level 3 (for organisations regularly handling TOP SECRET material). Most Australian SMEs entering the defence supply chain will initially require entry-level or Level 1 membership; Tier 1 contractors and those involved in highly classified programmes typically require Level 2 or Level 3.
A critical point for businesses new to DISP: membership is not a one-time compliance event. It requires ongoing maintenance — regular security audits, staff retraining, incident reporting, and continuous alignment with the Defence Security Principles Framework (DSPF). Organisations that achieve DISP membership and then fail to maintain their security posture risk losing membership and, with it, their ability to fulfil existing contracts and bid for new ones.
There is no direct cost associated with DISP membership itself, but the costs of implementing and maintaining the required security measures — facility upgrades, personnel vetting fees, cybersecurity infrastructure, and the ongoing management overhead — can be material for smaller businesses. These costs should be factored into commercial decisions about defence supply chain participation.
The Cyber Uplift Requirement: Essential Eight Maturity Level 2
The most significant recent change to DISP requirements is the elevation of the cyber security domain to full Essential Eight compliance at Maturity Level 2, effective October 2024. For many Australian businesses, this represents a substantial uplift from previous requirements.
The Essential Eight are eight cybersecurity mitigation strategies developed by the Australian Signals Directorate: application control (preventing execution of unapproved software), patching applications and operating systems, configuring Microsoft Office macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication, and regular backups. Maturity Level 2 requires not just that these controls are in place, but that they are applied consistently, tested regularly, and embedded in organisational security culture.
For businesses that were previously compliant with the "Top 4" cyber requirements under the old DISP framework, moving to Essential Eight Level 2 typically requires: implementing application control across all endpoints, strengthening patch management processes to meet defined timeframes, deploying multi-factor authentication across all remote access and privileged accounts, and establishing regular independent testing of backup and recovery capability.
The practical implication for defence SMEs is that cybersecurity can no longer be treated as an IT issue managed by whoever looks after the company's computers. Essential Eight Level 2 compliance requires executive sponsorship, board-level accountability, and a security governance framework that integrates cyber risk into the organisation's broader risk management approach.
AUKUS and the Trilateral Supply Chain: What Australian Suppliers Need to Qualify
AUKUS Pillar 1 — the acquisition of conventionally armed, nuclear-powered submarines — is projected to create around 20,000 jobs in Australia over the next 30 years and create substantial supply chain opportunities for Australian industry. The Australian Government is actively supporting Australian supplier qualification into US and UK submarine supply chains through programmes including the Global Supply Chain (GSC) Program and the Australian Submarine Supplier Qualification (AUSSQ) Pilot Program.
For Australian businesses seeking to participate in AUKUS supply chains, the qualification requirements go beyond DISP membership. The product categories currently being prioritised for Australian industry participation — castings and forgings, precision machining, air and gas flasks, fabricated parts, composites, and electronics — each carry specific technical and quality standards that align with US and UK defence procurement requirements.
Key quality standards relevant to AUKUS supply chain participation include AS9100 (the aerospace and defence quality management standard), ISO 9001:2015, and IPC-A-610 Class 3 for electronic assemblies. These are not merely tick-box certifications — they require demonstrable process capability, traceability systems, and quality management culture that can withstand audit by US or UK prime contractors.
The AUKUS licence-free export framework, operational since September 2024, allows eligible Australian companies to export certain defence goods and technologies to the US and UK without traditional export permits. To be eligible, businesses must be registered with Defence Export Controls (DEC) and obtain an Australian or AUKUS Authorised User Community (AUC) certification via the My Australian Defence Exports (MADE) portal. Eligibility requires that all business be conducted in Australia, the UK, or the US, and excludes technologies on the External Technologies List or classified under the Australian Military Sales Program.
Intellectual Property and Technical Data: The Overlooked Obligation
One of the most consistently underestimated obligations in defence supply chain participation is the management of intellectual property and technical data. Defence contracts routinely involve access to, and creation of, information that is subject to strict controls on how it can be used, shared, stored, and transferred.
The IP provisions in defence contracts are often asymmetric — heavily weighted toward the Commonwealth or the prime contractor — and have long-term commercial implications that SMEs frequently don't fully assess at contract entry. The classification of contractor IP, the treatment of background IP that the supplier brings to the contract, and the rights granted to Defence over deliverables all affect the long-term commercial value of the supplier's own technology investment.
Specialist legal advice on IP and technical data provisions is not optional in defence contracting. It is one of the areas where the cost of inadequate advice at contract entry is highest and most difficult to recover from.
Foreign Ownership, Control, and Influence (FOCI)
The DISP application process includes a Foreign Ownership, Control, and Influence (FOCI) declaration — a requirement to disclose any foreign ownership of the business, foreign board members or senior executives, and any other foreign relationships that could influence the organisation's decisions or create a security risk.
FOCI considerations have become more prominent in Australian defence industry policy in recent years, reflecting broader concerns about supply chain security and the protection of sensitive technology. Businesses with foreign ownership or governance structures need to understand how FOCI declarations affect their DISP eligibility and what mitigation arrangements may be required.
This is particularly relevant for Australian subsidiaries of foreign-owned parent companies, joint ventures with international partners, and businesses that have taken foreign investment. Early engagement with the DISP team and specialist legal advice on FOCI implications is strongly recommended before investing in the capability uplift required for DISP membership.
Building a Genuine Security Posture
The businesses that will capture the greatest share of AUKUS and broader defence supply chain opportunity are not those that achieve minimum DISP compliance and stop — they are those that build genuine security capability that becomes a competitive differentiator.
A genuine security posture means: a Chief Security Officer with real authority and executive accountability, not just a title; a security governance framework that is integrated with the organisation's operations, not bolted onto it; a cyber security investment that goes beyond Essential Eight compliance to address the specific threat profile of a defence contractor; a personnel security culture where every employee understands their obligations and takes them seriously; and a continuous improvement mindset that treats security as an evolving capability, not a static compliance state.
For defence SMEs, building this posture requires investment — in people, in systems, and in the time required to embed security thinking into how the business operates. That investment should be treated as a strategic capability decision, not a compliance cost. The businesses that make it early will have a material advantage over those that make it under the pressure of a specific contract requirement.
How Trace Consultants Can Help
At Trace Consultants, we help Australian defence contractors navigate the supply chain security requirements of the current defence environment — from DISP readiness through to AUKUS supply chain qualification and procurement strategy.
Defence procurement strategy. We help defence contractors understand the opportunity landscape — what programmes are active, what supply chain positions are available, and what capability and compliance investments are required to be competitive. We support the development of a BD and capability investment strategy aligned to realistic near-term opportunities.
Procurement operating model and supply chain design. For organisations building or scaling their defence supply chain capability, we design the procurement and supply chain operating model — supplier qualification frameworks, subcontractor management processes, and the internal governance structures that meet Defence's expectations.
Resilience and risk management. We help defence contractors assess and strengthen the resilience of their own supply chains — identifying single-source dependencies, mapping exposure to geopolitical and supply disruption risk, and designing the mitigation strategies that protect programme delivery commitments.
Organisational design and workforce planning. Building a credible defence supply chain capability requires the right people in the right roles. We support the organisational design and workforce planning decisions that underpin a sustainable defence industry participation strategy — from security-cleared personnel pipelines to the trade and technical skills required for AUKUS-related manufacturing.
Government and Defence sector expertise. Our work across government and defence gives us a practical understanding of how Defence procurement works, what primes are looking for in their supply chains, and what the realistic pathway to supply chain participation looks like for businesses at different stages of maturity.
Explore our Government & Defence sector work →
Getting Started: The Gap Assessment
For most Australian businesses entering or scaling their defence supply chain participation, the most useful first step is an honest gap assessment — a clear picture of where the business currently sits against DISP requirements, AUKUS qualification standards, and the specific requirements of the contracts or programmes they are targeting.
That assessment typically takes two to four weeks and produces a prioritised roadmap of the capability and compliance investments required. It identifies the quick wins — things that can be addressed in weeks — and the longer-lead investments — facility upgrades, quality system implementation, personnel security clearances — that need to start immediately to be available when they are needed.
The AUKUS programme will create genuinely significant opportunities for Australian industry over the next decade. The businesses that are ready when those opportunities crystallise will be the ones who started building their capability well before the contract was advertised.
The Bottom Line
Supply chain security in Australian defence is no longer a bureaucratic hurdle to be minimised. It is an increasingly demanding set of obligations that reflect the genuine risk environment facing Australian defence programmes — and a genuine competitive differentiator for businesses that take it seriously.
DISP membership, Essential Eight cyber compliance, AUKUS qualification standards, and FOCI obligations are all manageable. They require investment, planning, and sustained commitment — but none of them are beyond the reach of a capable Australian SME that starts the work early and approaches it strategically.
The opportunity created by AUKUS and Australia's sovereign capability agenda is real. So is the bar for participation.
Explore our Government & Defence sector work →
