So how precisely has Paladin, a thinly capitalised security contractor, spent the hundreds of millions of dollars it received from taxpayers?

The past fortnight has shed light on how the firm got the Manus contract in the first place, largely due to the sustained reporting of the Australian Financial Review.

The contract was awarded in a questionable, substandard government procurement process.

For all intents and purposes, it could have been perceived to be a closed tender, not opened up to other potential bidders.

The home affairs department said it faced urgent circumstances. The Papua New Guinea government in mid-2017 pulled out of a commitment made months earlier to run Manus services.

The situation was made all the more difficult by an apparent reluctance of companies to be associated with Australia’s widely condemned offshore processing regime.

“There was very little time,” the department deputy secretary, Cheryl-Anne Moy, told a Senate estimates committee this week.

“Primarily the people who expressed some interest early on and then decided that they wouldn’t tender gave us the reason that there was too much noise for their organisations – they were international companies – around regional processing.”

Paladin, which has operated since 2007, and on Manus since 2013, appears to have been an easy way out of the hole.

The firm’s name raised barely a flicker of recognition for many. Headed up by the former Australian soldier Craig Thrupp and his partner Ian Stewart, Paladin wasn’t working in Australia.

Its Australian subsidiary, Paladin Aus Pty Ltd, was, until recently, registered to a beach shack on Kangaroo Island.

The focus of Paladin’s work in PNG had been on security, rather than the provision of garrison and welfare for which it had been contracted. A federal court case involving its former chief executive, Craig Coleman, reportedly made several damning allegations about its preparedness for the job.

But the department was in a bind. So it used special measures within the rules of governing procurement to approach Paladin and offer it the work, using letters of intent, rather than a finalised contract, to provide quicker access to $89m in funding.

Guardian Australia has identified at least two other comparable firms – Tactical Solutions International and Loda Security – that offer similar services to Paladin and operate in PNG. The firms did not respond to questions about whether they were interested in the work before the contract went to Paladin.

The handling of the Paladin contract appears to be part of a broader pattern. Two of Australia’s other major offshore processing contracts were awarded in much the same manner.

Canstruct was directly approached for an even bigger deal, worth $591m, to run the Nauru detention centre. Canstruct was the only bidder in an effectively closed tender process. It was a construction firm with limited experience running the garrison or welfare services it was now tasked with providing.

“One day they were building tunnels and the next they were managing welfare services for a group of highly vulnerable and traumatised people,” the Human Rights Legal Centre’s legal advocacy director, Keren Adams, said.

Canstruct’s last annual return, filed with the corporate regulator, revealed a $43m profit in seven months running the centre.

The department’s explanation for directly approaching Canstruct and giving it the contract? Again, it could identify no one else interested in the work.

And so it was again with Pacific International Hospital, the local PNG provider asked to run healthcare services on Manus from a small clinic at the East Lorengau camp.

PIH, which runs Port Moresby hospital, was selected in a limited tender despite a shocking record treating asylum seekers. A Queensland coroner was scathing of its care of Iranian asylum seeker Hamid Kehazaei, who died from a treatable leg infection in 2014.

PIH staff sat without acting as Kehazaei lay in a critical condition, failing to comprehend that he was dying, even as alarms sounded from the life-saving machines he was attached to.

Further, PIH’s chairman, PNG’s former deputy prime minister Sir Moi Avei, was found guilty of misconduct involving his handling of public funds while in office. The concerns did not appear to dissuade the Australian government.

It has handed PIH $21.5 million over 10 months to provide healthcare on Manus, without a contract having yet been finalised.

Limited tenders by their very nature pose risks. There are risks to the integrity of the process, and to the effective use of taxpayers’ money.

Transparency International Australia’s chief executive, Serena Lillywhite, said simply running out of time to find a contractor was not an acceptable excuse to run limited tenders.

“It’s not a legitimate reason especially when you’re talking about the provision of services for a traumatised and vulnerable group of people,” she said.

“But there’s no reason why the government should be finding itself in the position where it supposedly doesn’t have a lot of time and doesn’t have a lot of choice.”

When the concerns began to emerge about the $423 million Paladin deal this month, the news quickly spread through PNG.

Paul Flanagan, a former Treasury official and adviser to the PNG government, said he quickly forwarded the news to a local PNG parliamentarian.

“He immediately distributed it around to all of his parliamentary contacts,” Flanagan said. “It’s a hot issue for them.”

It didn’t take long for PNG’s political leadership to raise concerns. The prime minister, Peter O’Neill, called for a “full briefing” and encouraged Australian authorities to mount a transparent investigation.

Former prime minister Mekere Morauta went further, issuing a relatively explosive statement.

“At the very least it should explain why its usual procurement systems and processes have been abused or bypassed and why all the secrecy and spin,” Morauta said.