Benham Satah knows Manus better than most. A Kurdish refugee, Satah has been there six years, stuck on an island prison despite having committed no crime.

He was there when Paladin, a little-known security outfit, took over a $423m deal to provide services to asylum seekers. Satah has met with Paladin’s leaders and heard the promises they made. From the outset, the arrangement seemed strange.

“With $1m you could run Manus,” he tells Guardian Australia, speaking down a scratchy phone line. “You could run Manus security for 19 months [with $1m]. What Paladin did in 19 months to get this money?”

It’s the question that still hangs about the Paladin affair. One that’s yet to be properly answered. Two sources on the island have now complained that Paladin “does nothing” of substance on the island, aside from check IDs and maintain a general presence.

So how precisely has Paladin, a thinly capitalised security contractor, spent the hundreds of millions of dollars it received from taxpayers?

The past fortnight has shed light on how the firm got the Manus contract in the first place, largely due to the sustained reporting of the Australian Financial Review.

The contract was awarded in a questionable, substandard government procurement process.

For all intents and purposes, it could have been perceived to be a closed tender, not opened up to other potential bidders.

The home affairs department said it faced urgent circumstances. The Papua New Guinea government in mid-2017 pulled out of a commitment made months earlier to run Manus services. The situation was made all the more difficult by an apparent reluctance of companies to be associated with Australia’s widely condemned offshore processing regime.

“There was very little time,” the department deputy secretary, Cheryl-Anne Moy, told estimates this week. “Primarily the people who expressed some interest early on and then decided that they wouldn’t tender gave us the reason that there was too much noise for their organisations – they were international companies – around regional processing.”

Paladin, which has operated since 2007, and on Manus since 2013, appears to have been an easy way out of the hole.

The firm’s name raised barely a flicker of recognition for many. Headed up by the former Australian soldier Craig Thrupp and his partner Ian Stewart, Paladin wasn’t working in Australia. Its Australian subsidiary, Paladin Aus Pty Ltd, was, until recently, registered to a beach shack on Kangaroo Island.

The focus of Paladin’s work in PNG had been on security, rather than the provision of garrison and welfare for which it had been contracted. A federal court case involving its former chief executive, Craig Coleman, reportedly made several damning allegations about its preparedness for the job.

But the department was in a bind. So it used special measures within the rules of governing procurement to approach Paladin and offer it the work, using letters of intent, rather than a finalised contract, to provide quicker access to $89m in funding.

Guardian Australia has identified at least two other comparable firms – Tactical Solutions International and Loda Security – that offer similar services to Paladin and operate in PNG. The firms did not respond to questions about whether they were interested in the work before the contract went to Paladin.

The handling of the Paladin contract appears to be part of a broader pattern. Two of Australia’s other major offshore processing contracts were awarded in much the same manner.

Canstruct was directly approached for an even bigger deal, worth $591m, to run the Nauru detention centre. Canstruct was the only bidder in an effectively closed tender process. It was a construction firm with limited experience running the garrison or welfare services it was now tasked with providing.

“One day they were building tunnels and the next they were managing welfare services for a group of highly vulnerable and traumatised people,” the Human Rights Legal Centre’s legal advocacy director, Keren Adams, said.

Canstruct’s last annual return, filed with the corporate regulator, revealed a $43m profit in seven months running the centre.

The department’s explanation for directly approaching Canstruct and giving it the contract? Again, it could identify no one else interested in the work.

And so it was again with Pacific International Hospital, the local PNG provider asked to run healthcare services on Manus from a small clinic at the East Lorengau camp.

PIH, which runs Port Moresby hospital, was selected in a limited tender despite a shocking record treating asylum seekers. A Queensland coroner was scathing of its care of Iranian asylum seeker Hamid Kehazaei, who died from a treatable leg infection in 2014.

PIH staff sat without acting as Kehazaei lay in a critical condition, failing to comprehend that he was dying, even as alarms sounded from the life-saving machines he was attached to.

Further, PIH’s chairman, PNG’s former deputy prime minister Sir Moi Avei, was found guilty of misconduct involving his handling of public funds while in office. The concerns did not appear to dissuade the Australian government.

It has handed PIH $21.5m over 10 months to provide healthcare on Manus, without a contract having yet been finalised.

Limited tenders by their very nature pose risks. There are risks to the integrity of the process, and to the effective use of taxpayers’ money. Transparency International Australia’s chief executive, Serena Lillywhite, said simply running out of time to find a contractor was not an acceptable excuse to run limited tenders.

“It’s not a legitimate reason especially when you’re talking about the provision of services for a traumatised and vulnerable group of people,” she said.

“But there’s no reason why the government should be finding itself in the position where it supposedly doesn’t have a lot of time and doesn’t have a lot of choice.”

When the concerns began to emerge about the $423m Paladin deal this month, the news quickly spread through PNG.

Paul Flanagan, a former Treasury official and adviser to the PNG government, said he quickly forwarded the news to a local PNG parliamentarian.

“He immediately distributed it around to all of his parliamentary contacts,” Flanagan said. “It’s a hot issue for them.”

It didn’t take long for PNG’s political leadership to raise concerns. The prime minister, Peter O’Neill, called for a “full briefing” and encouraged Australian authorities to mount a transparent investigation. The former prime minister Mekere Morauta went further, issuing a relatively explosive statement.

“At the very least it should explain why its usual procurement systems and processes have been abused or bypassed and why all the secrecy and spin,” Morauta said.

Paladin, for the most part, has remained silent as the media storm swirled around it. Questions to its generic email address either went unanswered or were responded to with a “no comment” and a referral to home affairs.

It wasn’t until Thurdsay that Stewart, a Paladin director, issued a statement defending his firm and its work, and dismissing any suggestion of corruption as “offensive”.

Stewart rejected as erroneous reporting that suggested Paladin and its leadership were associated with “bad debts” and failed contracts in Asia before being awarded the Manus contracts. He also said reporting on the “beach shack” was unfair. The firm doesn’t operate services in Australia, he said, so its subsidiary there was registered to a personal address.

“We take our responsibility in providing services incredibly seriously and our number one priority at all times is the safety, security and wellbeing of our staff, the local community and those in our care,” Stewart said.

Meanwhile, pressure on the government has continued to build. Labor asked the auditor general to scrutinise the contract, a request currently under active consideration.

The shadow immigration minister, Shayne Neumann, said the audit was warranted due to “the level of expenditure associated with these contracts, the government’s poor track record, and the concerning reports and allegations related to the entities involved”.

Peter Dutton, the home affairs minister, said he had no involvement in the awarding of the contract, a position backed by the most senior home affairs bureaucrat, Michael Pezzullo.

The attorney general, Christian Porter, said he had no sight of the deal.

The whole affair has been tough to watch for those still on Manus. They’ve been calling attention to government contractors on the island for years.

“In Australia, people ask this question now,” the award-winning writer and journalist Behrouz Boochani, an Iranian refugee currently held on Manus Island, said. “But this question for us is for years, not only for Paladin, but all of the companies. How do they spend this money?”