New Zealand Treasury’s Debt Management Office is a risk-management agency, but for years it relied on a risky IT environment.