Contents
- Attendance
- “The 2015/16 audit of the Scottish Police Authority” and “i6: a review”
“The 2015/16 audit of the Scottish Police Authority” and “i6: a review”
Welcome to the 11th meeting of the Justice Sub-Committee on Policing in 2017. No apologies have been received.
Our business is an evidence session on two Audit Scotland reports: the review of Police Scotland’s i6 programme, and the 2015-16 audit of the Scottish Police Authority.
I welcome our witnesses: from the Scottish Police Authority we have Andrew Flanagan, chair, and John Foley, chief executive; and from Police Scotland we have David Page, deputy chief officer for corporate services, strategy and change, James Gray, chief financial officer, and Martin Leven, director of information and communication technology. I thank the witnesses for providing written evidence.
I refer members to paper 1, which is a note by the clerk, and paper 2, which is a private paper. We will move straight to questions from members.
I will start by giving a small flavour of what is in the Audit Scotland report. Audit Scotland says that it is “unacceptable” that it had to report to Parliament on “weak financial leadership” in all three years of the Scottish Police Authority’s existence. It reported a £1.2 million overspend, a £47 million deficit and a lack of public transparency. My question is for Mr Gray. The long-term financial strategy and the three-year strategy are to be developed and implemented once the policing 2026 strategy has been agreed. Can you give us information on the timescales for agreeing and publishing those strategies?
We plan to publish an outline high-level three-year financial plan in June, alongside the 10-year policing strategy and the three-year implementation plan.
Over the summer, we will work with the business to further develop the plans, so that we can come back in September with a more detailed three-year financial plan that will show how we will get into a financially sustainable position by the end of year 3. We will also bring in the 10-year financial strategy, which will address one of Audit Scotland’s points. That is very important, because it will set out clearly the direction of travel, show what the different options will mean financially and help to ensure that we maintain our financial sustainability after year 3.
Some changes have been made, and the chief financial officer now has a reporting line to the accountable officer. How is that working? How do you anticipate that it will work in the future?
My direct reporting line day to day is to the deputy chief officer. I also meet Mr Foley every Friday to go over issues. Between times, if anything comes up, I am on the phone to him with anything that he needs to know. I have worked closely with John Foley since I came in as an interim, so we have developed a good relationship and we understand what we are trying to do. As I said, I also work to David Page. That has been working well so far.
Are you confident that the strategies that you are developing will address what are quite significant financial problems?
I am. We know at a high level the areas where we will make the savings, and we know the projects that will deliver those savings. I do not have the details yet; we are still working on which projects will deliver which specific savings. However, taken in the round, the savings are enough to deliver what is required to address the current budget deficit.
Do any other panel members want to comment?
I support James Gray’s view of the relationship. I should make the committee aware that that relationship, with the chief financial officer having a reporting line to the accountable officer, did not exist before. It is working very well, and I consider it necessary. It was one of the measures that we identified when we first realised that we had financial leadership issues in both organisations.
I want to follow up on that and perhaps set out of the some concerns that were raised in the 2015-16 audit.
As I am sure the panel is aware, the Auditor General for Scotland appeared before the sub-committee on 16 March, when she said:
“I am concerned that the organisation does not yet have a fully worked through financial strategy, because that is a safeguard that would help it to mitigate the risk of the wrong decisions being taken for short-term reasons that make things harder in the long term.”—[Official Report, Justice Sub-Committee on Policing, 16 March 2017; c 13.]
I take on board what Mr Gray has said about his working relationship with Mr Foley and the interim measures that are in place pending development of a long-term strategy. Have there been discussions with either the Auditor General or her officials about interim measures that could perhaps offer reassurance to her and to Audit Scotland that, pending development of the longer-term strategy, safeguards are now in place?
Yes. We now meet Audit Scotland every month, to give it both an update on the work that we have been doing and the progress that we are making, and an outline of what we propose to do, so that we can make sure that it is comfortable with our approach. Having had discussions with the auditors, we can say that they know where we are and what we are trying to achieve. We are looking to develop a 10-year financial plan that will be in line with what they describe as best practice. We are using all the indicators that they think should be included to make sure that the plan meets that requirement. I am confident that, by the time we get to September, we will have a document that is fit for purpose.
Audit Scotland also talked about having confidence that the three-year deficit that has been built up can be addressed. In previous evidence sessions, I have expressed concern that, to some extent, we may be being told what Police Scotland and the SPA think that we want to hear. How realistic is it for you to say that you will address the deficit in such a short space of time, given the extent of the difficulty that has been faced until now?
The aim is to have a balanced position at the end of a three-year period, which is a realistic timescale. One issue around that is timing. We need to focus on getting this right and on ensuring that what we are committing to is deliverable. We must make sure that the recurring savings that come through in each of the three years are mapped appropriately and that we are not trying to front load the approach unrealistically or to take the foot off and push things too much to the back. That will be a key part of what we will do when we look at the timings and how we will deliver the savings over a three-year period.
I will ask another question, and then maybe Mr Foley and Mr Gray can come back and wrap it up together. We will come on to i6 shortly; I do not want to cover that ground now. Can you give us a flavour of how you will achieve the delivery of the savings, what that will mean as regards staffing levels and how you will make good the deficiencies, given the problems that have been experienced to date and the run-down of capital underspend almost to compensate for revenue deficit?
We do not yet have the detail on specifically where the savings will come from. We know the broad areas, and pay and non-pay are affected. Decisions have not yet been taken about what that might look like, so although we have a draft, it has not yet gone through our governance route—that will happen over the next couple of weeks. Again, that will be done at a high level, so it will give us an indication of the budget areas that will be affected in eradicating the deficit. What it will not do, at that point, is set out specifically where the savings will come from. Work on that will be done over the summer and we will come back in September with something that more clearly articulates it.
Mr Foley, do you want to add to that?
Yes. I want to offer some additional assurance. Mr Gray has a fully developed financial model that has been tried and tested. It has been developed over a longer period of time, so we are not starting from scratch and developing something over a period of months. It is the assumptions that go into the model that will be the subject of further discussion.
Thank you.
You say that it is a “tried and tested” model. Where has it been tried and tested?
Police Scotland accountants have run various scenarios through it. It is a good financial model; it is not particularly complicated. Various assumptions are put into the model, and the situation is looked at over the period. Some of that work has been done to support the policing 2026 strategy, which we are about to launch. To an extent, they go hand in hand. I just want to give the committee an assurance that we are not starting from the beginning—albeit that I recognise the comments that the Auditor General made in March, which I fully agree with and support.
Okay. Thank you.
The Auditor General has highlighted on-going and unacceptable weaknesses of financial leadership in the SPA and Police Scotland. David Page said in oral evidence:
“In future, we will devolve budget responsibility to the deputy chief constables, the assistant chief constables and, ultimately, the chief superintendents—in effect, to the business unit level—to give them both accountability and responsibility.”—[Official Report, Public Audit and Post-legislative Scrutiny Committee, 2 March 2017; c 33.]
A recent article in The Herald pointed out that training and support would be provided to those with responsibility for budgets. Could you elaborate on what has happened so far in that regard?
Absolutely. We are not devolving budget responsibility without providing support for that; we are providing a whole package of support around the devolved process. Finance partners in James Gray’s area are facing off to each of the different budget holders. We are providing training packages for them on what their responsibility looks like and what management information they will need. We are providing training on finance for non-financial managers. We have shared the approach that we will roll out to support everyone who is a budget holder with our internal auditor, Scott-Moncrieff, and Audit Scotland—they have visibility of that. We are developing a balanced scorecard approach, which will allow the people who receive the budgets to give us a score on how well we are supporting them from a finance and training perspective.
We will not just push budget responsibility down; in pushing it down, we will provide training and support, and we will provide management information regularly and much more quickly than it has been provided before. The people who are the recipients of those budgets will score us on whether they believe that they are getting the right information, the right data, the right training and the right support. Likewise, I will look at whether people are taking accountability from James Gray’s team and his finance partners’ team in the way that we need them to. We are developing a joint testing process in relation to those who are managing the budgets, which will be supported by a data set. That is all in place, and we will roll it out over the next few months.
Is it being piloted in certain areas? Has it started to operate in certain areas? If so, could you elaborate on where that has happened?
James Gray can give you the details on its roll-out.
Every budget holder has had a meeting with their business partner—we have attached a business partner to every budget holder. Previously, we had a fairly patchy arrangement. The first piece of work has been to go through each budget book. There is a budget book for each budget holder, which sets out what money they have against a budget line. That sounds fairly simple, but this is the first year that we have had that across the organisation.
Every budget holder has gone through their budget in detail to understand what they have. They have also had a session on what business partnering is about. We have been given some external help in rolling that out to budget holders. In addition, we have developed formal, written budget guidance, which we have taken every budget holder through to make sure that they understand it. That is the first piece of work that we have done.
We have worked across the organisation to understand who needs to get the external training on finance for non-finance professionals. We are collating that information, and we hope that that training will be delivered during the course of this month.
How many budget holders are we talking about?
I think that the figure is in the region of 70 or 80, but I can follow up on that and confirm what the figure is; I would not want to give that as a definitive answer.
When I met a group of superintendents recently, I asked them whether they welcomed the devolution of budget responsibility. They were incredibly enthusiastic about it. They were at pains to point out that it had previously been the practice in some of the legacy forces, so they were not starting from a position of being entirely unable to operate such a system, and that although things move on and some people need that support, they were not starting from scratch.
13:15
Another thing that we are doing around management information is providing flash reporting on the fifth working day. Previously, the data became available much later in the month, but we will now have two reporting cycles, with James Gray and his team reporting on the fifth working day. That will be done for the first time for the cycle that is coming up this month. A flash report will be provided that will let every budget holder know where they are against their budget. It will not be an in-depth analysis, but it will act as a trigger for budget holders so that they will be able to see very early in the month where they are in terms of being over or under budget and they will have about two weeks to work with their finance partner.
The corporate finance and investment board formally reviews the budget three weeks into the month and by that point every budget holder will know whether they are over or under budget and why that occurred, and they will have had conversations with their finance partner, which will have been cascaded up to the deputy chief constables and the assistant chief constables, who will have been briefed and who will understand the position. We will get to a point where we understand with a much better level of granularity the data that is available to the budget holders. As I said, we are just about to introduce that in the coming cycle.
The Scottish Government has commissioned, at a cost of £270,000 over four years, a consortium led by the Scottish Institute for Policing Research to evaluate police and fire service reform. I think that the first report was published last June. Can you give examples of the institute’s findings and say how they have helped to improve policing?
We recently received an updated report, so we now have two reports from the institute. Mr Foley will talk about the findings.
As Andrew Flanagan said, a more recent report has been presented to the Scottish Police Authority. The first report related to the first year and a half or so of reform. It found that there was progress, but identified areas where we would look to see improvement over the course of the next year. The second report suggested that there had been improvement in local engagement, which is important, and it found that there was more information available on access to national assets, and more understanding. Those were positive findings. There were also findings that some local police officers believed that there had been adverse effects from public sector bodies withdrawing funding that had been used for policing. That issue will be looked at in the forthcoming year.
In relation to policing 2026 in particular, that sort of information gathering is useful for gauging how much Police Scotland should engage with local authorities. The second report said that local authorities and local representatives have a positive view of the policing service that they receive. We take both the positives and the challenges and reflect them back to colleagues in Police Scotland, who work them into their forward strategy.
Given the Auditor General’s report and the Public Audit and Post-legislative Scrutiny Committee’s scrutiny, has there been any attempt to quantify the costs associated with employment tribunal cases and any findings against the SPA that have been reached?
I assume that I would know whether anything of significance might have been uncovered, but I am not aware of anything specific in that regard. However, I can double-check that and come back to the committee on it.
Will you check that up to the current date?
Yes, we could do it up to the current date.
That would be excellent.
Before we move on to talk in broader terms about i6, the finance function in Police Scotland is to be increased by the filling of 15 posts. It is my understanding that all those posts are temporary. Why is that?
We have brought in temporary posts at this stage because I wanted a bit longer to assess what the future function will look like and because we are about to embark on a transformation programme in corporate services that is likely to mean that the shape of the finance function will change quite significantly. The resources that we have brought in temporarily are to fill gaps in the existing way in which we work the finance function. However, I expect significant changes over the next 12 to 24 months in that function, which means that there will be different staffing requirements. For that reason, I did not want to commit to bringing in people permanently for posts that might not exist in the longer term.
Are you hopeful, though, that some of the 15 temporary posts may become permanent? It would be a shame to lose people’s experience.
You are absolutely right. We will always need somebody with that expertise in a number of those 15 posts. A number of really good individuals have come in and I would like to retain them, but obviously they would have to go through an open process when we have determined what posts we require to run the service.
Rona Mackay has a question about overspend and underspend.
I will continue the focus on the budget. The money saved from underspending the capital budget and reform money has previously been used to reduce the revenue overspend. Is that a sustainable financial management approach?
No, it is not sustainable. That approach has been taken up until now because there was a revenue deficit that needed to be addressed. We have to invest in fleets and in the estate, otherwise they deteriorate over time. That causes revenue pressures because the cost of maintaining the vehicles goes up and so on.
For 2017-18, we have set a budget where we are clearly planning to spend capital and reform money in full in order to make the investment required, which will then help to bring down the revenue deficit. That is why we are sitting with an operating deficit of £47 million instead of saying that we will look to use some of the reform and capital money—we have been absolutely clear that we are not doing that, because it is not sustainable in the longer term.
Will you clarify whether there will be a request to the Scottish Government to transfer capital underspend to offset revenue overspend again for this year’s budget?
We have no intention of doing that.
There is definitely no intention of doing that.
Absolutely not.
Last year, although we could appreciate that there was an underlying cost overrun, the issue about the capital and reform budgets was that, in the absence of a proper strategy for policing, there was a risk that we could have ended up spending money on forms of capital or reform that subsequently became inappropriate.
It was good sense, in a way, to not spend that money until we got the policing 2026 strategy delivered or at least far enough down the track to be able to make sensible choices. The capital and reform underspends were the simplest way of offsetting the overrun on the revenue budget.
So it was very much a temporary measure.
I think so, because I think that we have some pent-up demand for normal capital. James Gray mentioned the fleet—cars and so on, which run out. You cannot take the approach that we took for very long. It made sense last year, but it would not make sense now. If we have a properly understood forward plan and strategy for the organisation, we can make sensible choices about which bits of reform or capital we prioritise.
I am intrigued by that. Presumably, the Government’s allocation in relation to the reform funding and the capital funding would be based on a bid from Police Scotland—with a needs analysis—that was supported by the SPA.
I can understand to some extent how you might delay the capital spend—doing that is not ideal, but is perhaps a tolerable measure in the short term. I am struggling to understand how funding that was allocated for reform of the organisation cannot be spent because you might not necessarily want to go down that route of reform. Surely the basis for the reform funding was that you put proposals to ministers that they supported and therefore they were prepared to back the funding?
High-level projects and other things were identified; the question was whether they should still go ahead in the absence of a proper strategy.
In that case, it sounds as though the funding was allocated on the basis of a false premise. You must have made a case to the Scottish Government about reform in a particular direction. Whether it was high level or more granular, a case for funding to support reform will have been made. However, you are telling us that it was sufficiently vague, and it might not necessarily have involved the reforms that you wanted to introduce, which means that, therefore, certainly in the short term, you were happy to spend the money to plug the revenue gap.
It was prudent to suspend the suggestions that had been made about reform. The biggest part of the reform budget remains the VAT payment.
We do not control the reform budget; it sits with the Government, and we have to apply and call off against that budget. The issue probably concerns the absence of us asking for that to be called down, in terms of the uncertainty that is created by trying to identify the proper strategy for the organisation.
I have a question on ICT, particularly with regard to paragraph 7.2 of Police Scotland’s written submission. The Auditor General described the policing vision in the policing 2026 strategy as “ambitious”. I would be interested in hearing the view of panel members, particularly Martin Leven, on whether, in order to achieve the ICT vision, the recent approach that involves the underspend on capital budgets being transferred to reduce the overspend on resource budgets needs to end.
Thanks for giving me that question, but I will pass it over to my boss, the deputy chief officer, who can give you a substantive answer.
Far more thought is now put into what investment should come when and where, whereas historically ICT was dealt with almost separately from other issues. The i6 programme, which I am sure we are going to cover, was a separate operational division in Police Scotland, and there was not much co-ordination between money being invested in i6, money being invested in the contact, command and control system and money being invested in the intelligence system. David Page’s vision is that that should all be tied together, based on absolute operational requirements. That involves getting a long-term financial strategy based on what the operational requirement of policing is, and ICT will absolutely become an enabling requirement of that.
David, I am sorry to pass this question over to you but, in terms of policing 2026, the issue has a wider scope than simply ICT investment.
The different approach that we have taken this year flows partly from Audit Scotland’s consultation feedback on the 2026 strategy. We have acknowledged that we should not be utilising capital money that is needed to keep the organisation functioning in a business-as-usual environment to do anything other than serve its core purpose—fleet, ICT, estates and so on—so we are running quite a rigorous programme around our business cases for supporting capital investment in keeping the business going. The money that is spent on the areas of fleet, ICT and estates is quite separate from the transformation and reform money. We have a £47 million deficit. That is an identified problem that is separate from the capital that I need to keep the lights on in ICT, estates, procurement and the other areas that are involved in the normal running of our business.
Anything that involves transformation and reform will be clearly linked to something that has an outcome that supports the journey to 2026. There will be business cases that support each part of that spend. James Gray and my human resources team are tracking all the activity and the spend of reform money, and that will be linked to an outcome that supports 2026. That is separate from business-as-usual capital allocation, and we will use that fully to support fleet investment, estates maintenance and ICT infrastructure.
As I said, the Auditor General described the vision as “ambitious”. Are you confident that that ambitious vision can be achieved through the appropriate business planning that you have outlined?
Yes, with the approach that we are taking. There is work to be done. We are coming from quite a low base point in many areas. Audit Scotland’s criticisms of the organisation around things such as financial capability and some of our disciplines around business cases have to be addressed before we do anything overly ambitious.
A lot of what we are doing at the moment is putting in place robust processes and procedures, adopting different ways of looking at business cases and implementing different controls so that, if we build an ambitious plan, it will be built on rock. That will take some time. That means that we will have a draft implementation plan that will be published alongside the strategy at the end of June, and we will also have a draft financial plan. Is it a finished product? No. Could I have done it any quicker? Not with the resource that I have at the moment. We will build up that resource in the summer. However, I am currently confident that we have the opportunity to meet our ambitions by running the finances with better financial control.
13:30
Good afternoon to the panel. With your indulgence, convener, I will take a longer view rather than just look at the immediate situation because, as Mr Leven said, there was not as much co-ordination on information technology in the past.
Mr Flanagan has talked about there being no “son of i6”. I understand that the genesis for i6 lay in two reports by Her Majesty's inspectorate of constabulary in Scotland in 2004. I welcome any response from whoever feels appropriate from the panel. I am told that there was then a situation when “expensive consultants” were engaged at a cost of £1,500 a day in 2004. I am told that “things crawled along for years” with several new costly consultants engaged. In 2010, the programme, which was run primarily by Strathclyde Police, became called i6. At that point, the Auditor General picked up the inquiry. It was a seamless programme, albeit not a particularly efficient one, from 2004 to 2016. Is any panellist able to say whether that is a reasonable reflection on the genesis of the situation? I appreciate that witnesses may not be able to comment on specific figures.
I will try to keep the information at a higher level. I am not aware of all the history of i6, certainly not back to 2004. I am aware that, by 2008 to 2010, a lot of work was going on in the legacy forces on a joint project. The procurement process was quite extended thereafter. It is worth reflecting that it was a period when IT went through unprecedented accelerated change, so that any project that ran for that length of time was at risk of being overtaken by technology developments. The project began to accelerate once Police Scotland was established because there was single control of the project, but most of the main procurement decisions had been made by that time.
The common performance management platform was a collective decision across the eight forces and probably central services. The sub-committee and Mr Leven have discussed this on previous occasions. Are you able to say what the loss figure was for that project? I have heard various figures.
The total amount of money that was invested in the platform project was around £7.5 million—I am going from memory, as I do not have the information with me.
I thought that the amount was £12 million or £14 million; someone else told me that it was £20 million. It was a significant sum of money, nonetheless.
My understanding was that £7.5 million changed hands between the Association of Chief Police Officers of Scotland and the supplier of the platform. Please do not quote me—it was before I started here. I will get the information if you require it.
The platform never saw the light of day.
Agreements were put in place at the end for some of that money to be reinvested in other areas. One supplier provided other systems within policing, so an agreement for a refund was given as service credits and support costs for the existing systems. Ultimately, the write-off was £7.5 million.
Thank you. I am highlighting particular area within the confines of the Auditor General report. The project did not start then; there is a long genesis until we get to that point. Mr Flanagan is entirely right that the complexity changed in the interim. I am interested in what we can learn from it. The Auditor General has said that “overconfidence” was a contributing factor to the failure of i6. Can any of the panel comment on that?
There was a belief that the project could be delivered. It was very ambitious; to take a single-system approach to 80 per cent of operational needs is like putting all your eggs in one basket. The project did not have a modular approach; the structure could not be broken down into bite-size chunks and dealt with in a less risky manner.
Another element—aspects of this have been touched on in the Auditor General’s report—is whether the waterfall approach or the agile approach should have been used. Those are both development methodologies. At the time the project was given the green light, waterfall was the predominant development approach, and taking that approach was probably the right decision. However, when you consider that it was a beginning-to-end system covering 80 per cent of needs and that waterfall, by its nature, means that you get to see how effective it is only when you get to the user testing stage, all the eggs were, again, being put in the one basket.
In many aspects of the project, there was overconfidence that all would be right at the end, and the Auditor General is justified in calling that out.
I also agree with the Auditor General—there was overconfidence. That is a lesson learned—we need to avoid being overconfident in future. As Mr Leven has said, all ICT projects will follow a different path from what was done in 2012 and 2013.
Nonetheless, it has been widely viewed as being a successful procurement process in as much as when you tried to get something but did not get it, you got the money back.
It was a successful procurement process in that sense. However, to return to the lessons learned, which I welcome from the Auditor General’s report, we need to take those and look forward with them. We need to say that it was a successful procurement that we can build on. We also need to recognise that we should not be overconfident and that we should perhaps look to see better where the pitfalls might lie in future projects, albeit that we will not enter into a waterfall arrangement again.
We should commend the people who put together the contract. It was incredibly tight. It allowed us to negotiate successfully with the supplier to get our money back. However, some of the complexities were not fully understood at the outset and, because it was a fixed-price project, it is probable that the supplier applied lesser skills to the development process to try to make it a commercially effective contract from its point of view. Therefore, although it was great that we got our money back, the tightness of the contract meant that the development quality was not as good as it should have been.
I have asked this question before and been told that it was not appropriate to do. Although I expect to be rebutted again, it would be good if there was an answer. Do the reimbursements cover the period from 2010 only?
No, they would go back only to the point at which Accenture signed the contract.
That is 2013.
Are you saying that no costs that were incurred in putting together the bid up until that point have been reimbursed?
I will try to answer that as best I can. The settlement figure was an amount that was agreed between the Scottish Police Authority and Accenture. It covered a range of aspects, some of which would have related to procurement costs. However, it is not entirely feasible to break down the figure that was agreed into elements to which you might attach things that happened at a point in time. We were in a commercial negotiating position with another organisation. We were trying to get the best deal that we could. We got the best deal that we could and we got more than our money back.
Liam McArthur wants to ask a supplementary on that specific point. I will then return to John Finnie.
On John Finnie’s point about the procurement being in a sense a success, I note the more cautious response that was given to him. The concern is that the overoptimism was baked in. We have heard previously that, to some extent, there was overconfidence in the ability to roll out a tried and tested model from elsewhere in a Scottish context.
I think that the efficiencies that i6 was going to deliver then got baked into the proposals for the legislation that created Police Scotland. Their delivery is now hamstringing the organisation, and the reform funding is being used to plug shortfalls in revenue. Is it fair to say that it would not be accurate to characterise the procurement process as being successful given that it appears to have hamstrung the organisation from the outset?
I think that we could take that view only in relation to the strength of the contract in maintaining the fixed-price nature of the project.
For me, there are more question marks over the specification of the system. Ultimately, it became an almost entirely bespoke system. I think that the initial promise was that a Spanish system would be used as the basis of the system and would form 80 per cent of it, but that turned out not to be the case, and most of the development was bespoke. Again, that added risk to the project, because everything had to be started from scratch.
Certain elements of what i6 was intended to do probably did need to be bespoke. Because Scotland has a different criminal justice system from all other countries, the criminal justice end of the system would have had to be bespoke. However, there are questions as to whether, if a modular approach had been taken, some elements could have been bought off the shelf. In my mind, that is an open question.
The overoptimism that seems to have given rise to the problems that emerged later also gave rise to an expectation of savings of the order of magnitude of £200 million. There was not a eureka moment at a point when the solution was found not to be workable, but anxieties must have been raised before that. Were attempts made to downgrade the efficiencies that could be delivered through the programme? Was there any adjustment of the £200 million efficiency saving?
I am not aware that that was the case. There was a point when the contract was renegotiated—in 2014, I think—and there was an attempt to address some of the issues at that point. I arrived at the authority in September 2015, and at the first meeting that I attended where i6 was discussed, there was still a strong expectation that it would be delivered in December 2015. The confidence was still there that it was going to be delivered. I do not think that anyone was saying at that point, “These financial savings are not achievable,” because they believed that the system would be up and running, or at least would commence running, in December 2015.
I may be able to help. From memory, a part of the process was user acceptance testing, and that is when concern started to manifest itself. Martin Leven will correct me if I am wrong, but I think that that was in the summer of 2015. At that point, the consultants that we had from an organisation called Exception raised concerns over the user acceptance testing. That was discussed over about six to eight weeks, and then Accenture went away to look at what could be done to correct things or allay any fears. Until the summer of 2015, it was believed that the future benefits would be adequately taken in years to come.
I want to return to the success of the procurement process. For the avoidance of doubt, I note that it is good that we have got the money back. If you have identified a requirement to buy something and it costs £46.1 million and you get it back, that is good. However, there have been three lost years, and there was clearly an identified need for the system. I am talking about the perception. To what extent were people seduced by the fact that the Guardia Civil already had a system up and running that had been provided by the same company? That conflicts with Mr Flanagan’s reference to a “bespoke” model for Scotland.
13:45
The Spanish system is only one element. Our system would have to be bespoke because, as I said, the Scottish criminal justice system is different from all others. However, for other elements such as the vulnerable persons database, other police forces around the world would have similar systems, so conceptually we could take that approach. I referred to the system becoming bespoke because I was originally told that the Guardia Civil system would provide 80 per cent of the system, as the bedrock, with only 20 per cent being modified for use by Police Scotland, but that did not turn out to be the case in reality.
I have one final question. Is that being presented as a saving? The projected expenditure to get an IT system, which is an essential part of modern policing, is set against—as Mr McArthur described—the projected savings. What is the current position? Are you saying that we have saved money? If I go out to buy a car and then decide not to do so, I have not saved the cost of the car. How should the position be presented to the public?
Our project was unlike most of the comparable public sector IT contracts that I am aware of, in which people ended up not getting their money, or very much of it, back. That singles this project out as unusual. We are back at square 1—we need to start again—but we are able to finance the project.
You touched on the issue: there is now a three-year gap in which we are not getting the benefits that we expected to have. In one sense, we have not spent the money that was originally intended to be spent because we got it back, but the reality is that we still do not have a system and we are still not getting the savings that we expected to deliver. We are currently spending more money than we need to.
Thank you very much.
I have a few preliminary remarks. First, I am a member of the Institution of Engineering and Technology, and I spent 30 years from the 1960s onwards in IT, followed by three years lecturing to postgraduate students on the management of IT projects. That is my background.
The procurement process failed in this case—we cannot get away from that. It failed because it existed for one reason only, which was to deliver a computer system for Police Scotland, and it did not do so. Ipso facto, it failed.
The secondary objective of a contract, of course, is to protect the procurer when delivery is not achieved. In that sense, the contract was successfully written and delivered what was required of it. That is the good news, but the process failed, and we should not pretend otherwise.
I have heard it said that the project took place in a period of unprecedented change in IT. However, Moore’s law, which states that, every 18 months, the cost halves and the capability doubles, has been around for 30 years. In other words, we have always been in a period of unprecedented change and, if we cannot manage IT projects in a period of change, we are not in the business of managing IT projects top, bottom and middle. I simply make that observation.
I have heard four or five times that the Guardia Civil model was 80 per cent aligned with what we required. Where did that figure come from? Who went to look at the Guardia Civil model in operation—both from the user side and from the IT side, I presume—and concluded that it was 80 per cent aligned?
Martin Leven can perhaps feed more into that. When I asked that question, I was told that members of the police team—the user side—went to look at the Guardia Civil model with Exception as the technical consultant.
I want to press you on the specific figure of 80 per cent, which has been quoted four or five times in this meeting. Was that figure derived analytically or plucked out of the air?
It has been quoted to me only as part of the—
Let us try to work out where the figure came from, because it lies at the very heart of why the system did not meet Police Scotland’s needs.
Committee members should bear it in mind that what I am about to say happened before any of us sitting around the table joined Police Scotland. My understanding is that, during the procurement process, the programme team, which was headed by a senior police officer and included outsourced expertise from three different organisations—one looked after legal matters, one looked after contract management and one looked after technical authority—visited all the shortlisted bidders and asked them how good their bid was. Different scorings were put against a whole variety of things.
I have been told about the figure of 80 per cent, but I do not know where it came from. Ultimately, i6 consisted of six key component parts, and it would have done for us the vast majority of what the system in Spain does because, essentially, policing is policing around the world. Generically, we arrest people in the same way, and where the data flow has to go is exactly the same. However, Police Scotland differs in our unique approach to criminal justice and in particular in the very strict data standards that we have with our partners in the criminal justice sector. My understanding is that that is what made up the 20 per cent. Specific, bespoke work was required for that and other slight variances in how we handle things.
I genuinely cannot tell the committee where the split between 80 and 20 per cent came from. I do not think that the 80 per cent figure was derived analytically; I think that it was arrived at by putting a wet finger in the air and saying, “This is roughly how much of the system is ready for us and how much is not.” However, I do not see how that plays much into the issue.
I am going to take us there precisely. It was a wet finger that was also uncalibrated—but that is a different issue.
A rule of thumb that has been established for the best part of 50 years is that, if someone buys a system and has to change more than 10 per cent of it, they should write their own system or, alternatively, they should adapt their processes to those that are embedded in the system. As far as you are aware, was that choice consciously considered and made? If the amendment level were to be 20 per cent, that would be known to be invariably more expensive than starting with a clean sheet of paper.
I will quote directly from the Audit Scotland report, because Audit Scotland spoke to everyone who was involved in the process. Paragraph 14 of that report states:
“The i6 programme team and Accenture believed that the majority of the i6 system could be based on an existing IT system that Accenture had developed for Spain’s Guardia Civil police service, with the remainder being bespoke development work. The existence of this IT system, and its experience of working with police services across Europe, contributed to Accenture being awarded the contact.”
I am sorry to say that I would be speculating in giving any other information to the committee.
The important words in what the Auditor General said are “could be based”. It was recognised that there was functionality that would need a clean sheet of paper, which is understood. However, the problem seems to lie in the other part of the system. The words “could be based” do not tell us whether it was considered that Police Scotland would pick up the embedded processes that were implied by the way in which the Guardia Civil system was structured, or whether the team was going to tinker with the system, which is a most dangerous thing to contemplate doing, as any project manager will know. I am trying to get a sense of which road we tried to travel on. My difficulty, of course, is that the relevant people are not necessarily in the room or available to us, so I ask you to give it your best shot, please.
I am sorry; I lost the thread of the question when you were talking.
Are the words “could be based” about the part of the system that was thought to be just about what was needed?
I assume so. What i6 would have delivered would have been a combined data system—“data” is the key word—and not necessarily application flow. It would have provided searchable information across four different criteria: person, object, location and event. That is a POLE system, which is a type of system that is used in law enforcement globally. The Guardia Civil system was a POLE-based one so, logically, we would have assumed that such a system, which had been tried and tested in live operational policing, would have done quite a bit of what we wanted it to do, but we would have to make bespoke arrangements for factors around the side.
I am not sure what went wrong with the build of the system or about what assumptions were made by people who, as you say, no longer work for Police Scotland or the SPA.
I want to ask a final question before I allow others to come in. I have heard it said that problems emerged during user acceptance testing. What users were involved in the design of the user acceptance tests and when were those tests designed? If they were designed early in the process, the system would have been better aligned to pass the tests that it subsequently failed. Do we have a sense of either of those matters?
The i6 programme team included test analysts who helped design the user acceptance testing. They worked for me in the ICT department—they were seconded to the programme—and they worked in conjunction with the external consultants, who were the technical design authority of the programme, and who in turn worked in conjunction with Accenture to develop the testing scripts. It was very user focused and user based—
I am sorry to cut across you, but every one of the persons you have said was involved was not a user who would ultimately be sitting at a terminal—
And I am sorry to cut back across you but, as I have said, the process was very user focused and user based. Users were involved in the testing, as were operational policing personnel who know how operational policing works. In fairness, I must give absolute credit to the team involved in that area. Because its testing regime was incredibly robust, it was very fast in picking up the issues and escalating its concerns as soon as it had them.
I absolutely accept that, and I agree that the purpose of testing is to find problems early on. It seems that that happened, but I am trying to work out whether the end users were involved in the design of the testing and whether that happened early enough to influence what was delivered for testing.
End users were involved in the design of the testing. The vast majority of the members of the i6 programme team were live operational policing personnel who had been extracted from operational policing. They designed the testing; obviously, the technical people were significantly involved, but the testing was incredibly well handled and did the job that it was meant to do. It highlighted concerns and escalated them to the programme board.
Mr Flanagan touched on the cost of more than £1 million to maintain the 125 legacy systems that are still in place, and it has been stated that a programme has been commenced to update individual legacy systems just to ensure that they are viable. In other words, it is all about standing still instead of making improvements or enhancing functionality. How is the maintenance of the legacy systems being managed alongside the new systems to ensure that no more expense is incurred and there is no more reliance on those legacy systems than is absolutely necessary?
Martin Leven will be able to give you more detail but, once the decision to cancel i6 was taken and we got the money back, we ensured that the useful lives of existing systems could be extended to cover a period of redevelopment and putting replacement systems in place. A second part of the approach was to look at the systems that were already in development or in use in different parts of the organisation that could be rolled out nationally. The third piece of work is the creation of a new ICT strategy under the policing 2026 umbrella to make clear how we take the approach forward. That is how we sought to stabilise the situation once we knew that i6 was not going to come in.
Can you give some more detail on that? The SPA has stated that it still believes that a single national IT system for policing is viable. How is that working? Do you have timescales for it and any more detail on how things are progressing? Are you confident that it will deliver the benefits that were envisaged, but obviously did not materialise, from the i6 programme?
Your key question is about the single system and what that actually means. I think that the system would be a modular approach involving a combination of components being built up into a single system, rather than the approach that was taken for i6. As I said earlier, the i6 approach was a very risky approach to the development of systems on such a scale.
It is clearly the case that the different parts of operations that i6 was supposed to support are still there and still need systems, but we need a new approach to implementation. We must try to minimise the costs that we are currently incurring that we did not expect.
14:00
Those are good and valid questions.
Immediately on cessation of the i6 contract in July last year, we set up the digital transformation team, which is the experienced resource that was running the i6 programme. Under my direction, it passed across to the ICT directorate. We gave it some pretty urgent tasks, the first of which was to look at the legacy estate and what we needed to do to it to maintain its resilience and stability. Quite a lot of background work has been done on that.
One thing that we did was launch a new national custody solution. A key component of i6 was custody, which tied in with everything else. We had to make sure that our systems were prepared for the provisions of the Criminal Justice (Scotland) Act 2016, which we think will come in later this year: the legacy solutions were not prepared. We had a system in Strathclyde Police that ran on something called FoxPro. It was quite a legacy system, as Mr Stevenson will appreciate. We had no skilled personnel left who could maintain it, so I was keen that we upgrade it. We followed good practice in that process: in particular, we followed the Scottish Government’s recommended practice of reusing, then buying, then building, which is the order in which things should be done.
We reused one of the legacy custody systems for which we owned the intellectual property. It was the system that was used by V division—previously Dumfries and Galloway Constabulary. We upgraded it dramatically and rolled it out across the country. That was all done on time and within scale, and it is now live across every part of the country. For the first time, we are able to have a global view of every cell and custody facility in the country. We did that at the behest of the internal ICT development function. A user base from across the country was heavily involved, and all the work was co-ordinated by the skill set that we took out of the i6 programme.
We took that a little bit further. We did not have the ability anywhere in the country to use IT to cross-check information from different systems, because the systems were not compatible with one another. Now, under the new national custody solution, when a person is booked into custody, a search will automatically be performed on the criminal history system for any previous events in which the person might have been involved. That took a little bit of innovation and is part of what the digital transformation team did.
Another important part of what it did involved planning for the future. We do not have i6; we still have around the country 125 different systems that do not talk to one another. How are we going to make all that work? A lot of effort was put into the digital transformation team. Audit Scotland has just produced an excellent report, “Principles for a digital future: Lessons learned from public sector ICT projects”, which is about the lessons that have been learned not just from i6, but from a range of public sector projects that have not gone well. That report, which was published in May, set out certain principles:
“Clearly define the needs and benefits
Understand and appreciate the likely complexity
Identify people with the right skills and experience
Break the project down into manageable stages
Be aware of optimism bias
Consider the procurement options early”.
I am delighted to say that those principles were all brought into consideration in the work that the digital transformation team has been doing. That team has since transferred across to the 2026 team, so the technical expertise is now part of the general programme. The 2026 programme is pulling all those elements together. When it is launched, it will come with the IT strategy, the financial strategy and everything else that is required to do the work.
I hope that that comforts you. To answer your first point, our systems remain stable. With regard to your second point, we have quite a bit of planning going on.
The new national applications were intended to improve provision of information across the previous forces’ boundaries. Some of the new applications have been integrated with legacy systems in order to reuse or reference information in legacy systems. Perhaps the custody information that you mentioned is an example of that. However, it is not clear whether the legacy systems that are not integrated with the new applications could cause difficulties. For example, it is possible that they could stop further improvements being made and result in the loss of important information, such as the custody information that you managed to unearth.
That, too, is a good point. We have nearly 600 legacy applications operating in Police Scotland, and i6 was going to replace about 125 of those. However, we have been left with a bit of a hole in terms of systems talking to each other. How we do our day-to-day jobs differs across the country; a lot of that difference is, unfortunately, because of technology limitations in different areas. The cancellation of i6 was a blow in that regard, and we are struggling with the delay that has resulted.
However, we have sprinkled a bit of innovation around the situation that was caused by i6 not delivering. We created a programme called the integrated data access programme using our own technology and our technology guys. Working closely with operational policing around the country, we have developed a system that is being trialled at the moment, but which we hope will go live within the next couple of months, that allows us to cross-search a lot of the key legacy systems. If we put in the nominal detail of an individual who we want to look up, the system will automatically search all the legacy systems and bring back any hits. Again, the system is the result of clever innovation and it could be part of what we are planning to do going forward, depending on the requirements that come out. However, the system certainly helps us dramatically in the short term.
So, you are fairly confident that that will cover recovery from the old legacy systems of information that could otherwise potentially be lost.
Yes—but I doubt that we would lose anything from the legacy data. My concern would be, rather, that people might not be able to find stuff in the legacy systems, or not know where to look for it. Incidents in different boundary areas might be missed with the legacy systems, but the new system gives us more of a global view of all the information from the eight previous constabularies.
I have a final couple of questions. The Auditor General found that police officers and staff are continuing to struggle with out-of-date, inefficient and poorly integrated systems. I appreciate what Mr Leven has just said, but has the failure of i6 had an impact on the effectiveness of staff and officers in their roles?
I believe that it has.
Is it a significant impact?
Officers and staff around the country are operating in the way that they operated before i6 was due to come in, so there has been no detriment to what they do. However, there has been a loss of opportunity with i6 not going live that means that we now have a delay until we get a more centralised system for all the legacy applications. I will provide some examples of where we feel we can make improvements.
That would be helpful.
We still have officers entering the same data in multiple systems. When we have information that requires to be put into a crime system and which might also be required to be put into a vulnerable-persons system or an intelligence system, that is all done separately. The i6 system would have certainly collated two of those systems—intelligence was not part of i6—which would have made life easier for officers, who would have spent less time at keyboards and more time in communities.
The failure of i6 has also caused what I would describe as a delay in our ability to introduce mobility to officers. It is very difficult for me to roll out tablet devices and smart devices to officers around the country when I do not have a single data source for them to query, and the cost of doing that at the moment would be prohibitive. It would have been much simpler to do if we had a single data source.
Our use of analytics is not as good as it could be: we should be able to use predictive analytics to look at data. However, it is difficult to collate in one place all the information from 125 different data sources. Our lack of ability to work across boundaries means that officers who are registered to a computer network in one part of the country whose duties take them to another part of the country have to get quite a bit of IT support to enable them to access a different system, so there is a lack of general control. The i6 system was going to enable many such things. Certainly, our computer network optimisation programme was going to follow i6 around the country because we would have had just one main system to authenticate to. Currently, we still have all the legacy systems to authenticate to, which has caused a bit of delay in our main network programme.
Ultimately, those were the missed opportunities from the failure of i6. However, I think that we are doing things properly. We had a significant outbreak of common sense in respect of the vision that David Page brought into the organisation of tying everything together. We have a financial strategy that ties in to a whole IT strategy so that the contact, command and control programme—what was the i6 programme—and intelligence are all operating under one central strategy, which is something that we did not have before.
That has been very helpful. Thank you for that. The Auditor General stated:
“The failure of the i6 programme means that some of the benefits of police reform have been, at best, delayed ... There are also wider implications for the modernisation of the justice system.”—[Official Report, Justice Sub-Committee on Policing, 30 March 2017; c 3.]
Do you agree with that and are you working with the wider justice system to improve information sharing?
We have an on-going project with partners in the justice system. I think that we originally called it an “online vault” but the branding has been changed. It is a data repository that will allow Police Scotland to actively share information with the Crown Office and Procurator Fiscal Service, the court system, the Scottish Prison Service and members of the Law Society of Scotland—defence lawyers. It will mean that we can access evidence online and it will be passed through the system, which we think will ultimately bring incredible efficiencies across the board.
The i6 programme would have made that a little bit easier, but not having it does not stop that project at this stage. The proof of concept is likely to be carried out using closed-circuit television information and seeing how we can make that readily accessible, compared with the very onerous manual process that is in place at the moment. We are working with partners in criminal justice. In fact, a member of the Scottish Government who is co-ordinating that project was in our offices in Dalmarnock this morning. We gave her an overview of exactly where we are and where we think we will be in six months, 12 months and so on, in terms of making systems compatible.
When will that project be completely up and running?
I am wary of giving false information, but my understanding is that the proof of concept should be signed off to go in August this year.
I would appreciate your keeping us updated on that; it would be useful.
Absolutely.
As there are no more questions from the committee, I thank all the witnesses for coming along today and for the evidence that they have given us. The next Justice Sub-committee on Policing meeting will be on Thursday 15 June, when we will hold an evidence session on use of police body cameras.
Meeting closed at 14:11.Previous
Attendance