Executive Summary
In short:
- The problem: Most Australian organisations do not have a shortage of software. They have a shortage of connection between it. When finance, sales, payments and operations systems cannot exchange data, people fill the gap by hand with exports, copy-and-paste and reconciliation.
- The cost: Manual handovers slow decisions, introduce errors and leave a weak trail when an auditor or regulator asks where a number came from. They also widen the attack surface. The Australian Signals Directorate (ASD) received over 84,700 cybercrime reports in FY2024–25, and the Office of the Australian Information Commissioner (OAIC) recorded 1,205 data breach notifications in 2025, a record high.
- The pattern in practice: The Australian case studies reviewed here show integration solving four recurring problems: moving money, keeping finance and operations in step, exchanging sensitive clinical messages and linking existing tools without replacing them.
- The framework: Good integration follows six steps: map the handovers, agree the data rules, choose the pattern, secure the connection, test failure and monitor reconciliation.
What's next?
Write down the one handover between two systems that costs your team the most time or risk today. Note both systems, what data moves, how often and who touches it. That single page is the most useful input to any integration decision.
Why Do So Many Australian Businesses Still Run on Copy-and-Paste?
It is 4.45 pm on the last day of the month. A finance analyst exports a report from the sales platform, reformats it in a spreadsheet and keys the totals into the accounting system. Another colleague checks card payments against bank deposits line by line. Everyone knows the process is fragile. No one has time to fix it.
This is the quiet cost of disconnected software. Each system works well on its own. The trouble sits between them, in the handovers that people perform because no one has connected the systems properly.
Fixing that gap is the job of an integration service: the design, build and ongoing care of connections between applications, payment providers, ERP and accounting systems, messaging services and data stores, so information flows without manual re-entry.
This article draws on case studies published by C9, an Australian custom software developer, to show what integration work looks like in practice. It groups them by outcome, sets out a practical framework and is clear about what the evidence does not prove.
In plain terms: Software integration links separate applications through APIs, middleware or scheduled data exchange, so a change in one system updates the others automatically, consistently and with a record of what happened.
What Does Disconnected Software Cost an Australian Organisation?
The cost is rarely a line on the budget. It appears in slower decisions, avoidable errors and risk that builds quietly.
Slow decisions. When reports depend on manual compilation, leaders act on last month's picture. The delay is built into the process.
Errors and rework. Every manual transfer is a chance for a figure to drift. Finance teams end up reconciling instead of analysing.
Key-person dependency. If one employee or one supplier understands the spreadsheets and scripts holding systems together, you have a dependency, not a capability.
A weaker evidence trail. Auditors, boards and regulators ask where data came from and who changed it. Ad hoc exports make those questions slow to answer.
Security exposure. Manual exports travel by email and shared drives, which widens the places data can leak. Australian figures show why this matters:
- The ASD's Annual Cyber Threat Report 2024–25 records over 84,700 cybercrime reports. Average self-reported cost per report was $56,571 for small business, $97,166 for medium business and $202,691 for large business. ASD cautions that the large-business figure may be inflated by outliers and a rise in business email compromise losses, that the data is self-reported and that most cybercrime goes unreported.
- The OAIC recorded 1,205 data breach notifications in 2025, up 8% from 1,112 in 2024. Of these, 716 were malicious or criminal attacks. The OAIC's dataset period (1 July to 31 December 2025) differs from the 2025 calendar-year headline, so treat the totals as indicative.
Regulatory pressure is also rising. Australian Privacy Principle 11 requires organisations covered by the Privacy Act to take reasonable steps to protect personal information. From 10 December 2026, organisations covered by the Privacy Act must also describe in their privacy policy how personal information is used in computer programs that make, or substantially and directly support, decisions that could significantly affect individuals. You cannot disclose what you cannot map, and a tangle of undocumented system handovers makes mapping harder. Our automated decision-making audit guide covers that obligation in detail.
For APRA-regulated entities, CPS 230 Operational Risk Management adds a service-provider dimension. It took effect on 1 July 2025, with transitional arrangements for existing contracts, and requires regulated entities to maintain a register of material service providers and manage the risks of relying on them. Integrations that connect critical operations to third-party systems sit squarely inside that conversation. Our guide to CPS 230 and CPS 234 audit evidence automation goes further.
What this means for you: The question is not whether your systems matter. It is whether they are connected, governed and understood well enough to support the decisions and obligations ahead.
What Does an Integration Service Include?
Scope matters, because "integration" can mean very different things. In practice, an integration service spans six areas.
| Area |
Plain-English meaning |
| Payments |
Connecting your application to payment providers and gateways for cards and bank debits |
| Accounting and ERP |
Passing orders, invoices and ledger data between your platform and finance or ERP systems |
| Healthcare and partner messaging |
Exchanging structured messages (for example HL7) between clinical or partner systems |
| Communications and storage |
Connecting SMS, email and cloud storage services |
| Security |
Adding authentication, including two-factor and multi-factor sign-in |
| Bespoke bridges |
Middleware or adapters that link existing or legacy systems to newer ones |
Which integration approach suits which job?
Most projects combine three patterns. The right choice depends on data volume, timing and what happens when something fails.
- Direct API connections. One system calls another's interface in real time. They suit payments and lookups where an immediate answer matters.
- Message queues and middleware. A queue holds messages until the receiving system is ready, which protects against outages. They suit healthcare messaging and high-volume event flows.
- Scheduled (batch) transfer. Data moves at set times, for example nightly. It suits reporting and reconciliation where a short delay is acceptable.
If you are choosing between interface styles, our guide to MCP vs API vs direct integration compares them.
Integration Case Studies at a Glance
The projects below come from C9's published case studies. Details are taken from each case study page and are self-reported by C9.
| Industry |
Case study |
What the published page says |
| Medical & Health Care |
RHealth (ReferHealth) |
Middleware between ReferHealth and GP systems, using HL7 messaging, RabbitMQ queues and Duo multi-factor authentication, with links to Best Practice, Medical Director and Medical Objects |
| Financial Services |
You Lend |
A lending SaaS platform with payment gateway integration, Twilio SMS, AWS S3 storage and two-factor authentication |
| SaaS |
HuddlePoint |
Subscription, trial and billing enablement using Stripe (cards and bank debit) and PayPal, with CRM lifecycle integration |
| Legal Services |
GKS Law |
Law Master and DocuSign APIs connected through a Windows middleware agent for digital signing |
| Food supply |
Manubread |
A customer ordering portal connected to Able Baker, Xero and bank-hosted payment gateways |
| SAP consulting |
K2 Partnering |
A custom SAP Business One integration using the DI API, OData, UI5 and HANA |
Integration Case Studies by Outcome
Outcome 1: Moving money without manual handling
You Lend is a lending SaaS platform. The published page describes extensive payment gateway integration alongside Twilio for SMS, AWS S3 for storage and two-factor authentication using Google Authenticator. The page reports more than 1,600 hours of work.
HuddlePoint needed subscription, trial and billing flows to run without staff intervention. The page describes Stripe for card and bank debit payments, PayPal as an alternative and a billing engine decoupled from the main application, with lifecycle events passed to a CRM.
Manubread, a wholesale bakery and food supplier, gave customers an ordering and account portal. The page describes integration with the production system (Able Baker), Xero for invoicing and bank-hosted payment gateways.
Takeaway: Payments are rarely a single integration. They touch the customer interface, the ledger and the reconciliation process. Designing those links together prevents the end-of-month scramble.
Outcome 2: Keeping ERP and finance systems in step
K2 Partnering extended SAP Business One using the DI API and OData, with UI5 front ends and HANA behind them. The published page reports reduced period close cycles by 5 days and 50+ hours of work. That figure is C9-reported, and the page does not give a baseline or method.
Manubread also appears here. Invoices raised in the ordering portal flow into Xero, so finance does not re-key orders.
Takeaway: ERP integration is as much about timing and ownership as technology. Decide which system is the source of truth for each record before you build.
Outcome 3: Exchanging sensitive healthcare messages reliably
RHealth built middleware connecting the ReferHealth platform to widely used general practice systems, including Best Practice, Medical Director and Medical Objects. The page describes HL7 messaging, RabbitMQ queues for reliable delivery, .NET Core services and Duo multi-factor authentication. The page reports more than 600 hours of work.
Takeaway: In regulated settings, integration is also a security and resilience decision. Queues protect against downtime, and authentication protects against misuse.
Outcome 4: Linking existing tools instead of replacing them
GKS Law needed documents from its practice management system (Law Master) to reach clients for signing through DocuSign. The page describes API connections to both, linked through a Windows middleware agent and supported by email notifications.
Takeaway: You do not always need a new platform. A well-built bridge can extend the tools your team already knows, which also helps with change resistance.
Outcome 5: Securing access across connected systems
Several of the projects above add authentication to the integration itself: Duo multi-factor authentication in RHealth and two-factor authentication in You Lend. Connecting systems creates new doors, and those doors need locks.
A Six-Step Integration Framework You Can Use Now
The case studies share a common sequence. This is general good practice, not a description of any one project.
- Map the systems and handovers. List every system, the data that moves between them, who owns each and how often it changes. Include spreadsheets and email.
- Agree the data rules. Define what each field and status means, so "paid", "active" or "overdue" is the same everywhere.
- Choose the pattern. Use direct API calls for immediate answers, queues for reliability and scheduled transfers for reporting.
- Secure the connection. Apply authentication, least-privilege access, encryption and logging. Avoid shared credentials.
- Test failure, not only success. Plan for retries, duplicate messages, bad data and downtime at the other end.
- Reconcile and monitor. Confirm record counts and totals match across systems after each exchange, and alert a named person when they do not.
For a deeper look at evidence and reconciliation, see our guide to audit-ready data integration across ERP, CRM and GRC. If your integration feeds a database or reporting layer, our database development case studies show related projects.
Five Questions to Ask Before You Start an Integration Project
- Which handover between two systems costs the most time or risk today? Start there, not with a platform preference.
- Does the other system have a supported API or interface, and who controls it? Vendor limits and licensing shape the design.
- How fresh does the data need to be? Nightly, every few minutes or live.
- What happens when the other side is down or sends bad data? Ask how failures are detected, retried and reported.
- Who will maintain it after the build? Agree documentation, monitoring and handover at the start.
If you plan to connect AI tools to the same systems, read MCP security questions before connecting AI to your systems first.
Frequently Asked Questions
What does an integration service include?
It covers designing, building and maintaining the connections between your systems, such as payment providers, ERP and accounting software, messaging services and cloud storage, including security and monitoring.
What is the difference between an API and middleware?
An API is the interface a system exposes so others can talk to it. Middleware sits between systems to translate, queue and route data, which helps when systems speak different formats or may be offline.
Can legacy systems be integrated?
Often, depending on what interface the legacy system offers. Published examples include bridges built with middleware agents. Feasibility depends on your system, so start with an assessment of one handover.
How long does a custom integration take?
It depends on the systems and rules involved. The published pages cite roughly 50 hours to more than 1,600 hours for the projects described, so scope one integration before committing to a larger program.
Do these case studies prove cost savings?
No. They describe what was built, and results are mostly qualitative or self-reported. Define your own success measures at the start.
Does the 10 December 2026 privacy rule affect integrations?
It affects your privacy policy, not your integrations directly. But accurate disclosure depends on knowing which programs use personal information in decisions, and documented integrations make that mapping easier. This is general information, not legal advice.
Conclusion
Integration is easier to judge when you can see what others have built. These projects show payments connected to billing, accounting and ERP systems kept in step, healthcare messages queued and secured, and documents signed without leaving the core platform.
The pattern is practical. Start from one costly handover, connect it properly, secure it, monitor it and make sure your own people understand the result. With record breach notifications, a new privacy transparency rule and tighter service-provider expectations in regulated sectors, the way your systems connect deserves attention now.
What's next?
Choose your single costliest system handover and document both systems, the data that moves and how often. Use the five questions above to test it. If you want to test one critical workflow end-to-end before committing to a broader program, our team at C9 can assist with scoping.
Sources and References
Case studies and service page (C9, self-reported)
Australian statistics and regulation
This article is general information, not legal, security or financial advice. Check current legislation and guidance for your circumstances.
AI Transparency Notice
This article was produced with the assistance of artificial intelligence tools for research and content drafting. All content has been reviewed and approved by C9 prior to publication.