Toll Back Office Software Problems: The 7 That Cost Real Money, and How to Avoid Them

Why does a back office replacement get scoped as one cutover?

Because the vendor platform is one contract, so it looks like one thing. Operationally it is at least five: transaction ingest from the roadside, plate to account resolution, image review, invoicing and payment, and the violation escalation chain, with interoperability settlement running across all of them. Each has its own failure signature and each is measured differently by finance.

The reason this matters more in tolling than elsewhere is attribution. Traffic varies. Read quality varies with weather and resurfacing. Interoperability volumes vary with a neighbouring agency's own problems. If all of that changes at once because you moved platforms on a Sunday night, a revenue variance in the following month has six candidate causes and no way to isolate one. Meanwhile bond covenant reporting does not pause while you investigate.

The sequencing that works runs ingest and matching first, in shadow. The new system receives the same transaction stream, resolves plates and accounts independently, and its results are compared daily against the incumbent for a full month before it becomes the system of record. Image review moves next, because it is the largest variable operating cost and the easiest to measure. Violations and interoperability settlement move last, because both carry legal and counterparty consequences that a shadow period cannot fully rehearse.

What goes wrong when you migrate transactions and open violations?

Transaction history is the easy half. It is large, it is append only, and it can sit in a warehouse where the accuracy test is that a customer statement reproduces exactly.

Open violations are the hard half, and they are where projects get hurt. A violation is not a record, it is a position in a statutory sequence with a clock already running. A notice was sent on a date, a second notice is due within a window defined by your state, a penalty attaches at a defined point, and the evidence supporting each step has to be reproducible at a hearing. Migrating a partial escalation means importing the state, the dates, the notice content that was actually sent and the delivery evidence, not just an outstanding balance.

Two specific traps. The first is notice content versioning. If your notice wording changed in the period covered by the migration, the new system needs to know which version each account received, because producing the current template at a hearing for a notice sent under the old wording is indefensible. The second is address history. A stale address is the ordinary cause of a failed pay by plate invoice, and if migration flattens address history to the current address you lose the record of where the notice actually went.

The safe pattern is to stop creating new escalations in the incumbent from a fixed date, let the in flight ones run to completion there, and start the new chain clean. It costs you a period of running two consoles. It saves you a class of unenforceable penalties.

Why do roadside, motor vehicle and interoperability interfaces break?

Because none of them are ordinary application programming interfaces, and each fails in its own way. Lane controllers speak protocols designed for reliability rather than for integration, and a firmware update at a gantry can change a field with no notice reaching anybody in your organisation who writes software. The failure is quiet: transactions keep arriving, one attribute goes null, and matching quality degrades by a few percent.

Registered owner lookups fail differently. In state motor vehicle interfaces have their own availability windows and rate limits, and out of state requests through the NLETS network fail on leases, rentals, recent transfers and surrendered plates. A build that treats a failed lookup as an error rather than as a state loses the transaction. It should be a status with a retry policy and an age, so a lookup that has failed three times over two weeks appears in a queue with the statutory notice deadline attached.

Interoperability is the quietest of the three. Away and home transactions move daily in agreed formats such as the E-ZPass Group interagency communications definition, with reject and correction cycles behind them. A one line variance in a settlement file is invisible in a monthly summary and entirely visible in a line level match. The fix is not clever: match settlement files line by line, raise a same day exception on any variance, and give the exception an owner.

What happens when statutory clocks live in code rather than configuration?

Your legislature shortens a notice window by ten days, and the change becomes a development ticket, a release and a regression test cycle. If any of that slips, notices go out on the old schedule and the penalties they support are unenforceable. Do that at volume and the programme becomes a news story rather than a revenue line.

This is the single most common structural mistake we see in violation processing. The notice sequence, the interval between steps, the required content of each notice and the conditions that trigger a registration hold or a collections referral are all law. Law changes on a calendar you do not control and has to be reviewable by counsel who do not read code.

The fix is to hold all of it as effective dated configuration. A sequence version has a start date, a set of steps, an interval and a content template per step. Counsel reviews the new version, it is approved with a named approver, and it applies from its effective date while accounts already in flight either continue under the version they started or transition according to a rule counsel chose. Every notice ever produced stores the version it came from. That single design decision is what lets you defend a three year old notice without archaeology.

The mirror image is dispute handling. If assembling an evidence packet takes a representative twenty minutes across three screens, your dispute cost exceeds most tolls by two orders of magnitude and staff quietly start waiving instead of defending. The packet, meaning the image, the read and its confidence, the reviewer decision, the lookup result with its timestamp, the full notice history and the rate schedule in force at the trip, should be one action.

Should you build custom or push harder on the platform you already have?

Stay with the platform if you run a single facility under roughly 15 million transactions a year, with a stable rate schedule and no reciprocity obligations. Conduent, TransCore, Kapsch TrafficCom and Emovis run real back offices at scale and know tolling better than a generalist firm. At that size your leakage is more likely a camera alignment or a lane geometry problem than a software problem, and the money belongs in roadside maintenance.

Before commissioning anything, do one measurement. Take a week of gantry counts and follow them all the way to posted revenue, counting the drop at each link: read, review, lookup, invoice, payment. If the answer is a single dominant leak, you have an operations project, not a software project, and it is cheaper.

Build when the pattern is contractual rather than technical. Every fee or rate change is a change order with a multi month lead time. Image review cost per transaction has never gone down because thresholds are not yours to tune. You cannot answer a leakage question without raising a vendor ticket. Your violation programme has lost hearings on evidence production. Your interoperability variances are found by auditors rather than by your team. Two or more of those and the coordination logic between reads, owners, notices and settlements is your business and should not sit inside a product configured for someone else's statute.

How do hidden costs get into a toll back office quote?

Interoperability partner count is first. Every hub and every agency pair has its own quirks in practice regardless of what the specification says, and each one carries file handling, reject cycles and a reconciliation relationship. A quote scoped against one hub and delivered against three neighbouring agencies is a different project.

Motor vehicle interface count is second. Each state you look plates up in is its own effort with its own access agreement, its own availability behaviour and its own data quirks. This is not configuration and it should never be quoted as a single line called owner lookup.

Payment scope is third, and it is the one most often assumed. Card present kiosks, walk up service centres and stored value accounts each pull compliance scope toward you, and the scope shapes hosting, logging and access control across the whole system rather than sitting in a payments module. Decide early whether you are taking card data at all, because the answer changes the architecture.

The roadside interface is fourth. Older lane controllers need a genuine integration rather than an interface call. Ask any developer what they will do when the only available test window for a gantry is a Sunday at 2am, and listen for whether they have done it before.

What separates a back office build that works from one that fails?

Observability, which sounds like an engineering concern and is actually the business case. In builds that work, every transaction carries its own resolution history: the read, the confidence, the reviewer decision, the lookup request and response, the invoice, each notice. When finance asks where 300,000 transactions went last quarter, the answer is a filter. In builds that fail, the transaction has a status column and the answer is a vendor ticket by another name.

The second separator is whether the ledger is append only. A back office that permits in place edits cannot reconstruct a position on a past date, which is exactly what a hearing, an audit and a bond covenant test all require. Corrections should be postings, not overwrites.

The third is whether image review is treated as an engineering target rather than a fixed cost. Per lane and per camera confidence thresholds you own, duplicate read retirement where a second camera already produced a high confidence result, and a same week feedback loop between threshold changes, review volume and dispute rate.

The fourth is ownership, and it matters more here than in most sectors. You should hold the repository, the cloud accounts and the unrestricted right to hire another firm, agreed before kickoff. The reason most authorities are having this conversation at all is a dependency they cannot exit, and replacing it with a different one is not progress.