Public Audit and Post-legislative Scrutiny Committee

Meeting date: Thursday, May 16, 2019

Official Report 546KB pdf

---

Section 23 Report

---

“Social security: Implementing the devolved powers”

Agenda item 2 is consideration of a section 23 report, “Social security: Implementing the devolved powers”. I welcome to the meeting Caroline Gardner, Auditor General for Scotland. I also welcome, from Audit Scotland, Mark Taylor, audit director; Gemma Diamond, senior manager; and Kirsty Ridd, senior auditor.

I invite the Auditor General to make a brief opening statement.

Thank you. The report before the committee today is the latest examination of how the Scottish Government is implementing the new powers arising from the 2012 and 2016 Scotland Acts. Focusing on the social security powers that are being devolved, the report assesses progress up to the end of February, takes account of the activity that is under way and provides an update since I last reported in March 2018.

The Government has done well to deliver the commitments that it made for last year, including launching a new agency, Social Security Scotland, which will be responsible for delivery of the benefits once they are devolved. The agency, which became operational in September 2018, employs more than 320 staff so far.

The Government has also put in place the necessary systems and processes to allow it to launch the first two benefits: the carers allowance supplement, which was launched last September; and the pregnancy and baby payment of the best start grant, which was launched in December. The social security programme has laid the foundations to support the delivery of future benefits and to promote its aims of fairness, dignity and respect, and the publication of the first social security charter and the establishment of the Scottish Commission on Social Security are important parts of that.

Against that background, however, delivering the first benefits has been harder than expected. The programme has been working flat out, and the scale and complexity of the work involved have become clearer as teams plan for the delivery of individual benefits. The programme has continued to find it hard to recruit the range of skills and experience that it needs, and that has put pressure on staff and led to a greater-than-expected reliance on temporary and contractor staff.

Although the programme’s financial reporting has improved, it still focuses on spending against annual budgets, and it does not clearly monitor or report how much it will cost to fully implement all the benefits.

Delivering the second wave of benefits will be a significant challenge. Wave 2 includes the most complex and highest-risk benefits, with larger caseloads, much more complex eligibility assessments and regular payments affecting people’s day-to-day incomes. A wide range of work is under way to prepare for the next stage of delivery, including a revision of the overarching business case, a review of the governance and planning processes, and work to put in place the necessary resources, particularly staff. The programme is doing the right things, but there is a risk that the pace of work and constant delivery pressures might not allow the team the time and space to make changes quickly enough.

Critically, the Scottish Government does not yet have a clear understanding of the key things that it needs to do to deliver all the remaining benefits in the way that it intends, and my report highlights the need for the Government to develop its critical path of the actions that are needed, including a clear estimate of the overall cost to implement the social security system that reflects the decisions and commitments that have already been made.

As always, we are happy to answer the committee’s questions.

Thank you, Auditor General. I am very grateful for those remarks.

We will move straight to questions, beginning with Colin Beattie.

It is good to see a positive report, but I am concerned by the recurring theme of the lack of available skills in the market. Presumably, we are talking about information technology, but if skills are lacking in other areas, it might be good to draw out that issue and get more information on it.

You are right—those skills are in short supply across not only Government but Scotland as a whole. Digital skills are a key aspect, as are programme management skills, particularly the agile skills that are needed with the kind of approach that the programme is taking. Gemma Diamond will say a bit more about that.

This is a recurring problem that we have seen in many areas of Government in the past couple of years, particularly in major programmes. The programme is working really hard to get the staff that it needs, and that includes working closely with initiatives such as the digital academy, CodeClan, growing and developing skills and bringing them into the programme. That is a major challenge for the programme, and it features heavily on its risk register.

There is a challenge, too, with the scale of the work, the number of people who are coming in and the types of work that they are undertaking. It is a large agile programme, and some agile skills are not regularly found in Government. The programme is therefore taking the approach of growing its own and bringing in contractors to help with learning throughout.

The report highlights that there are about 107 contractors and 356 full-time staff or thereabouts. The number of contractors is quite high. How many of them are IT staff?

Exhibit 3 on page 19 shows that the chief digital office has 51 contractors against 46.4 permanent staff, so that office has the highest ratio of contractors. Given that there are difficulties in the market, that is not a surprising position for the chief digital office to be in, although it is trying hard to address those challenges. It is trying to find a strategic partner so that it can bring in contractors in a more managed and strategic way, rather than bringing in individual contractors from different places.

IT is a problem throughout the public sector. In this case, a programme is being implemented, so additional techie staff are needed to allow that to happen. How many of the interim contract staff are replacing permanent staff? How many are there to implement the programme who will go away when it has been implemented? I am trying to get a grip of how big a shortage there will be when the programme is up and running and we have reached some sort of balance.

At the moment, the programme is looking at what the agency’s future needs might be in running the system when it is fully operational. The chief digital office is looking at how it can recruit into permanent posts people who will move across into the agency. That work is on-going and will be developed further this year, as part of a full workforce planning approach. There is no firm position on that, but we know that the chief digital office is looking at it.

Paragraph 48 of the report highlights the “lack of staff continuity”; in particular, it says that there have been three programme managers and that the post has been vacant for three months. What are the implications of that? Is that skill also in short supply?

Mark Taylor might want to come in on that.

Thank you, Auditor General. In his first question, Mr Beattie asked about other skills areas. Finding experience of programme management—particularly experience of managing programmes of such a size, scale and complexity—has been really challenging for the programme. The implications are that that challenge makes a big contribution to the things that we say about planning more generally. Planning is more challenging if the skills and capacity in the key role of co-ordinating, planning and looking ahead are not in place. Also, as new people come in, there is an additional cost in getting them up to speed so that they can understand and plug into the role.

The other area where there have been skills shortages is finance—we might come back to that later.

What about the programme manager?

The programme manager is a critical role in programme management. That key post has been filled, although it took a while to do so. However, a whole range of people involved have a programme and project management function.

According to the report, there have already been three programme managers. Is that not an exceptionally high number?

I think that that illustrates the challenges a wee bit. For example, the programme sits in the wider set of challenges that the Government faces, and we say in the report that many areas are competing for scarce resources.

Within the resources that are available to the Scottish Government, there are lots of projects of varying sizes coming and going. Is there any transfer of skills from other areas, which might help? In other words, we have people in Government who have programme management skills, so can we move them across to provide support?

The social security programme is the largest programme of this scale and complexity in the Scottish Government. On learning from experience, the programme has been able to get people with experience from across the United Kingdom. There are lots of people working in the programme who have worked at the Department for Work and Pensions or in other big change programmes across the UK, and they bring that experience into the Scottish Government.

Through that approach, the programme director is looking to grow the agency’s own skills, but there will be benefits, not just for the social security programme but for wider Government, because people who have gained experience working on the social security programme can use it in other programmes. It works the other way—the social security programme gives skills and experience to people who can then work on other programmes across Government.

Presumably at the point when the project was getting ballpark costings, the fact that there were skill shortages and that the agency would have to bring in contractors was taken into account. Has that side of things come in on budget? Are the costs as they were anticipated to be?

I think that it is fair to say that the initial cost of £308 million, which was the figure that was included in the financial memorandum to the Social Security (Scotland) Bill, had to be a ballpark figure. At that point, many decisions had still not been made about the approach to delivering benefits, the eligibility criteria and how the system would be delivered, so the costs of developing IT and so on were not known.

We say in the report that the number and cost of temporary and contract staff were higher than initially expected. So far, that is being managed within the programme’s annual budget as a whole, but one of the report’s key recommendations relates to the figure of £308 million. The Government has not updated the overall cost of implementing the programme since that figure was provided, and given that significant decisions have been taken and more commitments have been made, I think that it is important that the figure is updated, so that the programme can manage to the updated figure and Parliament can scrutinise it.

Colin Beattie raised an interesting point about people being transferred in. Paragraph 57 of the report says that staff are transferring “between directorates”. You will correct me if I am wrong, but I think that that means that internal transfers are taking place between Scottish Government departments. If I am right about that, are you saying that, in an operation that is apparently short staffed anyway, internal transfers are going on, with other Government departments cannibalising the people we have in there in the first place?

You are right that there are pressures on the Government as a whole in relation to the skills that we are talking about. In addition to what I reported on in relation to social security in last year’s Scottish Government audit report, I am concerned about the Government needing to manage that sense of stretch and of people being moved to respond to the most immediate pressure alongside all the other pressures that it faces.

Gemma Diamond or Kirsty Ridd may be able to tell you a little more about what is behind paragraph 57.

As the Auditor General mentioned, in that paragraph we reference moves between directorates, where skills—particularly project or programme management skills—are needed across the different on-going Government programmes.

Such moves are not unique to the social security programme—people move between different programmes—or to the Government. In the civil service, people are moved to where the skills are needed; people also see opportunities to develop their own skill sets and careers.

10:15  

I will pick up on the IT development methodology that has been deployed. From what you are saying, the initial phase has been pretty successful. It uses the agile methodology, the deployment of which is relatively new to the Scottish Government. It is based on shorter, faster turnaround and iterative developments, progressing by building only what needs to be done in the short term. That approach has been pretty successful so far, but you said in your opening remarks, Auditor General, that things will become a bit more critical and complex when we come to wave 2. Will the continued application of that methodology be sufficient to deliver the implementation of wave 2?

I am sure that Gemma Diamond or Kirsty Ridd will want to comment on that in a moment, but you are right—we think that the approach has been pretty successful so far. People often tell us that they are using agile methodology when they are not; they are just not planning well enough for what they are trying to do. That is not true in this case; people understand the methodology and they are putting the resources, training and management time into doing agile methodology well.

We can see that in how people have responded to unexpected events, such as the failure to have in place the interface that is needed for the pregnancy and baby grant. They were able to respond and put in place contingency plans, which meant that they met the commitments that had been made. That is a good thing. However, doing that has taken up a lot of time. People are working hard; there is very little time to plan ahead on top of what they are doing to manage immediate demands, particularly in the context of the wave 2 benefits being much more significant in terms of money—about 98 per cent of the total spend involved is still to be delivered through the wave 2 benefits.

Wave 2 is also much more complex when it comes to the assessment of people’s entitlements. Assessing people for a one-off entitlement to a pregnancy and baby grant is very different from assessing someone’s eligibility for regular payments—for disability living allowance, for example.

Given the current short-term planning timescale and the pressure on resources, I am concerned that it will be challenging to meet the commitments that have been made without putting in place an overarching timescale and detailed financial and workforce plans to make sure that people understand what resources will be needed and when to deliver them.

You say in paragraph 122 that the chief digital office is looking at partnering up with a company or agency rather than continually bringing in contractors. Would that deliver more stability to the whole programme than the current approach of continually swapping contractors in and out? Is my understanding of that correct?

Yes, absolutely. For the CDO, that is a way of addressing the reality of the situation, which is that it is probably never going to be able to fully fill all the permanent posts that it would like to fill, given the shortages in the market. It is trying to find a more strategic way of managing that than just bringing in individual contractors one at a time. A more strategic partner arrangement would give the CDO slightly more control over that.

Do you know where we are with that? Is it done or not?

It is still under way, as far as we are aware.

Is it definitely going to happen?

It was one of the options that the CDO was considering at the time of the report.

One of the things that I learned about the agile methodology from previous examples is that contractors coming and going so rapidly can make it difficult for new staff joining the programme to understand what has already been done. It is all about writing software and producing proper documentation so that people can pick things up easily. My understanding is that the agile methodology does not lend itself particularly well to providing detailed, lengthy documentation as you go. I might be wrong, but that is my understanding from previous examples presented to the committee.

My concern is that if a programme continually shifts contractors in and out every six months, it will not have substantive documentation in the system and it will face increasing complexities, as the Auditor General has outlined. That is bound to increase the risk to delivery. Is anyone concerned about that, or is the CDO managing that process successfully enough at the moment?

The CDO has good governance arrangements for the programme. It has boards in place to consider technical architecture issues and to make sure that, across the system, everybody understands the technical criteria.

As the programme moves into wave 2, things become much more complex. There will be one core system that deals with all benefits, unlike at the DWP, where there are different systems for different benefits. That creates a very challenging technical environment in which there is a system that already delivers payments and which people are trying to expand to do new things.

Whether the current governance arrangements are the right ones to manage that more complex environment is currently being considered, alongside the governance arrangements to be put in place if two or more agile teams are working in one particular area. To date, it has been possible to have one agile team per benefit, which is much easier to manage. However, people are starting to think about how to manage being agile at scale. They are looking at what other programmes have been able to do and how they work to achieve that across the UK, in order to see whether the current governance arrangements, which have worked for the wave 1 benefits, will be right when the programme moves on to the wave 2 benefits and a much more complex technical environment. That review is on-going.

Finally, when will be the appropriate point to give us an update on wave 2 implementation? How early or soon might that be?

The programme report is one in a series of reports, and the team will scope out what we will do next quite soon. It is worth noting that, now that the social security agency is up and running, the annual audit report will also come through. That might be an opportunity to provide an update to the committee on progress with the overall programme. We will keep the committee posted as that thinking develops.

I may have misunderstood what was said regarding Willie Coffey’s question about partnerships with agencies to get talent in. That sounds like a good idea, but is that not the problem that we have seen with some of the Scottish national health service’s work? A very small and finite number of agencies provide a small and finite number of specialists, so the costs go up and the churn also goes up. Is that a concern?

There are some similarities, in that there is a risk that costs will increase whenever there is a shortage of staff. We see that across digital skills as well as in the NHS. However, there is a difference, in that it tends to take much longer to train doctors as a cohort than it takes to train anybody else. The time from when a school leaver enters medical school to when they become a fully fledged consultant, for example, is much longer than the time that is needed to produce a person with some of the skills that we are talking about.

That is why the initiatives that Gemma Diamond talked about in relation to training staff—making partnerships with CodeBase and CivTech and the other initiatives that we mention in the report—are so important. Rather than people having to think about a 10-year timescale, those things can help in the short term.

The agricultural or farm payments system is the other example that a number of us around the table have had experience of. The approach was part of the solution that was developed there. That illustrates that it is not a silver bullet: a range of things need to be done to ensure that there is capacity. Underlying all of that is the fact that there are capacity limits in the market for such skills, and the Government is competing for those skills with the private sector and with other parts of Government. That is the underlying issue that needs to be dealt with.

Good morning. I want to change the focus a little and to consider decision making and costings. The report says:

“Continuous short-term pressures mean that it is difficult for the team to pause and refocus activity, presenting risks to overall delivery. Many decisions about future benefits and how they will be delivered in the long term are still to be made.”

What decisions are outstanding? What are the implications of the delays? What decisions should have been made by now that have not been made?

It is important to start by saying that the Government’s overall approach has involved a commitment to safe and secure transfer from the DWP’s existing responsibilities of the new powers and delivery of the new benefits. That has underpinned the approach that it has taken so far.

The Government chose to prioritise the wave 1 benefits, which are simpler to administer, involve easy assessment of eligibility and are generally one-off payments. Generally, quite small numbers and quite small amounts of money have been involved. The Government has been successful in doing that and learning from it.

The Government has now set out the timescale that it plans to adopt for full transfer of responsibility for the remaining benefits. That is set out in exhibit 1 of the report. For new claimants, that transfer will be complete by the end of the 2021. Transfer of existing claimants will take until 2024. However, there are a lot of decisions to be taken about how the benefits might be changed as they become Scottish benefits rather than UK benefits, and what that means for eligibility, assessment and assurance that the right people get what they are entitled to, and that other people do not get what they are not entitled to.

All those decisions will need to feed through to decisions about the work that the programme needs to undertake, the staff that will be required in the agency, and the IT systems that will need to be in place.

Some important decisions still need to be taken within the overarching timeline. My concern is not that the decisions should have been taken by now—that is a policy decision, and the “safe and secure” approach is driving it—but that until those decisions have been taken, it will be hard to plan what needs to happen next in the programme and with regard to the agency, which is why I would like to see a critical path for the next three years.

How many of the decisions are time sensitive? Is it the case that, if the new benefits are identical to benefits in the current regime, the decision is less time sensitive, but if the value of, or the eligibility for, the benefits is to change, the decision needs to be taken quite quickly so that infrastructure can be built underneath it?

I think that that is broadly true, but it is worth stressing that, whatever decision the Government takes, it will continue to have a lot of interdependence with and reliance on DWP systems for the foreseeable future. Considerations such as making sure that the Government’s planning can interact with DWP planning, that systems are in place and that information is available on time, should affect the decisions that the Government takes as well as being affected by them. Gemma Diamond can elaborate on that.

We mention in the report that the programme is working in an agile way, which means that it is developing as it goes. A key part of that process is that it is bringing in the experience of users: as the benefits are developed, users are consulted about what the most appropriate thing to do is. That requires a lot of legislative steps to set out new regulations for new benefits.

At this point, we are looking for a critical path that shows where interdependencies are, in what order decisions need to be made and which decisions will affect all parts of the programme and which will affect only certain parts of it. That is so that we can understand where some of the key decision points are, where the timing really matters—for example, if there will be an effect on procurement—where there is flexibility and what the knock-on impact would be of a decision point being missed. Through the critical path, we can understand where the time-sensitive decision points are and their impacts across the programme.

I would like clarification. You are not saying that the situation here is what often happens in organisations when there is dithering on decisions and the organisation sleepwalks towards a problem. You are, rather, suggesting that there are policy decisions and implementation decisions that need to be made as we move towards phasing in of the benefits. Is that correct?

That is absolutely correct. I stress that that is important, first, because the process is so complex and the decisions will not be simple decisions and, secondly, because the decisions will affect some of the most vulnerable people. As Gemma Diamond said, it is critical that the Government have an overarching timeline for the key decisions that need to be made and an understanding of what effect delays or bringing things forward might have.

I will move on to costing. The report says:

“The Scottish Government does not yet have a clear understanding of the key things needed to deliver all remaining benefits in the way it intends. This includes not monitoring and reporting on how much it will cost to fully implement all the benefits.”

Are you really saying that the Scottish Government is not monitoring the cost of delivering the devolved benefits?

Not quite; I would not put it that starkly.

We have the £308 million financial memorandum cost, but the Government has now improved its annual financial planning and monitoring. In exhibit 4, we show the amount that was spent up to the end of the 2018-19 financial year, but we know that the £308 million figure will have changed because of decisions that have already been made, including decisions to do with contracts that have been let for IT and the staffing that is in place for the programme, as well as agency decisions about benefits.

The Government also needs to think about the likely cost of the policy commitments that it has made so far for the remaining delivery in order that it can update the £308 million figure, break it down over the time phasing that Gemma Diamond mentioned and underpin it with digital and workforce plans. It can then start to consider the overall cost. That will enable it to ensure that the programme plans that it makes are within the overall budget and to monitor spend as it goes, and it will mean that Parliament will be able to scrutinise that as it should.

I will come back to the £308 million in the financial memorandum, but for now I want to focus on monitoring and reporting of the cost. What could be the implications of there not being adequate monitoring and reporting on implementation costs for the taxpayer, for the cost-effectiveness of the policy, for the overall budget of the Scottish Government and, indeed, for the value of the benefits?

10:30  

You will not be surprised to hear me say that it is important that there be as clear an idea as possible of the costs of, and of what people expect to achieve from, any significant project on which public money is being spent. It is inevitable that the initial estimate will change, particularly in an area that is as complex and fluid as social security. However, we are at the stage at which simply monitoring and reporting on what is happening annually is not adequate for the programme or for parliamentary scrutiny.

Mark Taylor can give a clearer picture of what we expect to see and why that matters.

At the heart of the matter is the fact that the longer-term costs of the programme need to be funded. The Government needs to understand how to manage those costs through time and in an overall sense, so there is a real need for transparency on the total cost.

The focus of the programme’s monitoring activities has been on annual budgets. As we set out in the report, there has been very little focus on the likely implications of particular decisions on the overall cost envelope and in general terms. We are clear that there needs to be improvement and a shift in approach.

The report sets out some of the things that have changed since the £308 million estimate was made, but we have not seen evidence that those things have been factored into the overall estimate. We are not necessarily saying that the costs have gone up or down, but things have changed since the estimate was prepared, so there is a real need for the programme to take a more systematic approach in order to allow such changes to be factored in, and to allow reporting to Parliament. That links to the point on planning, because taking that approach is easier to do when people are clear about what needs to happen and in what order.

Is it okay to say that risks exist in relation to funding from the overall Scottish Government budget of implementation of, and of monitoring of and reporting on, the costings?

There are always risks to the budget with a project of such scale and complexity. It would be easier to manage those risks if there was greater clarity about the likely costs. A specific example is shown in paragraph 116 of the report, which says:

“For 2019/20, the programme estimated that it would need a budget of £118 million. The programme was allocated an initial budget of £78 million.”

It will be challenging to manage the programme within that budget, and it is not clear whether the difference of £40 million will be transferred to future years or the programme expects to manage without it. That clarity is needed, particularly given that much more volatility is built into the Government’s budget because of the new tax-raising powers.

There are risks relating to the Scottish budget, as there would be for any project of this size. Does that also mean that there is a risk to the taxpayer in relation to their financial exposure?

Absolutely—but I do not want to overstate the risk because, as we say in the report, the programme has been managed well so far. However, the project is very complex and is brand new for Scotland. It is clear that the costs not only of administering the programme but of the benefits need to be met from the Scottish budget. We are moving to a position in which we will not rely solely on the block grant from Westminster; about 40 per cent of the budget is now raised from Scottish taxes, which can go down as well as up. Clarity about what the Government is likely to spend on the programme and how that will change will fit within the Government’s overall approach to financial planning and its fiscal outlook. That is a key component to get right.

There are risks associated with the Scottish budget and there are risks to the taxpayer. Are there also risks in relation to the financial value of the benefits?

As it takes on the responsibilities, the Government will need to ensure that whatever decisions it makes about benefits are affordable and have the intended impact on people’s lives. There is uncertainty around that. Social security benefits tend by their nature to be volatile; in hard times, demand is higher. For example, the take-up of the pregnancy and baby grant was higher than expected, so its costs were higher than had been forecast. Such volatility is baked into any social security system, which is why it is so important that financial management and planning are more long term and transparent than has been the case so far.

As well as the risks relating to the budget, to the taxpayer and to the value of the benefits, there are risks in relation to the number of people who could benefit from the benefits, if there are failures to adequately report on and monitor the costs.

I gave the example of the pregnancy and baby grant. Uptake of the benefit was higher than had been forecast by the Scottish Fiscal Commission. In some ways, that is a good thing: it reflects the fact that more people came forward to claim what they are entitled to claim.

However, as we said, the cost must be managed within the overall Scottish budget, and the Government needs to be as clear as it can be about whom it expects to benefit, what the likely uptake will be and how differences will be managed within the overall budget that is available.

You said that the figure of £308 million is out of date. Will you say a little about how that “ballpark”—that was your word—figure was reached? Based on the Government’s current policy commitments, what is the figure likely to become?

As you know, the figure of £308 million was in the financial memorandum that accompanied the Social Security (Scotland) Bill. Such figures are always broad estimates, because a number of decisions have yet to be taken. The £308 million was the cost of implementation—not of the benefits.

Decisions have been made about the agency, its location and its likely size. Gemma Diamond talked about the procurement of IT systems, the continuing relationship with the DWP and arrangements for bringing in the staff who will be needed. All those things will affect the number. We are not in a position to update the figure for the committee, but it is important for the Government to do that and to account for any differences.

Will the figure be significantly different?

It is hard for us to say—I am not sure whether Mark Taylor or Gemma Diamond wants to add to that—because the question is really for the Government.

I will give a sense of what has been going on and of the scale. Paragraph 65 of our report sets out things that have changed since the Government came up with the original estimate. We have talked about how the number of staff needs to grow and has grown; the programme has more staff than had been expected. We have talked about decisions that have been made about digital infrastructure. Assumptions were made about that when the initial cost was estimated. The report talks about higher-than-expected costs of administration that are associated with the DWP. The programme’s scope has also increased through identification of new benefits and inclusion of other matters.

We cannot say what numbers are associated with that range of things and how they interplay with one another, but the key point is that the £308 million needs to be updated and that clarity about what is behind it is needed. We are not saying that it will be a final answer, because the figure needs to continue to be reviewed and updated as we go along, but the programme needs greater focus on and greater transparency about that.

I declare an interest in that I had overall Cabinet responsibility for social security between 2014 and 2016.

I will probe a wee bit more about the shortage of people with the necessary skills. To be short of 30 per cent of staff is a significant vacancy level. Is the staff turnover rate high in the agency?

It is important to say that the 30 per cent vacancy rate is in programme staff rather than agency staff. We understand that the agency is finding it easier to recruit the staff it needs and that its vacancy levels are lower. That relates partly to the skills that are involved. Gemma Diamond will talk about skills more generally.

We have mentioned that bringing into the programme the skills that are needed, when they are needed, is an issue. That came through strongly to us when we undertook interviews, in which a constant theme was the time and effort that are needed to find the skills, and the number of recruitment rounds that some people had to go through. There might be one or two unsuccessful rounds, which take time and take a toll on people. Our findings are about not just the vacancy rate, but our understanding, from talking to people, of the challenges that that brings.

We heard about examples of the impacts. For example, staff turnover in the programme management office meant that it could not undertake all the planning work that it wanted to do. Lack of resources meant that finance staff could not give as much input into business cases as they had planned to give. We saw not just the vacancy rates across the programme but how the situation felt to people who worked on the programme.

According to the report, 320 people are employed by the social security agency and the complement should be 556, so there is a shortage of 236. Of that 236 shortage, how many are in the operation of the social security system that we have under our control? You referred to programme staff. Are they IT programme staff? Who are the programme staff? Are they part of Social Security Scotland or part of a separate entity?

I should probably clarify the language. The people in the directorate who manage implementation of the programme—

The civil service.

Yes.

That is where the big shortage is.

Yes, and the chief digital office, which sits alongside that, is largely IT staff.

The people in the agency are largely responsible for operational delivery of the benefits. Essentially, the programme will manage things up to implementation; when that goes live, it will pass over to the agency, which will be responsible for on-going delivery.

The agency has found it much easier to recruit operational staff. It has had some difficulties finding experienced finance staff, but it has not had the same staffing challenges as the programme.

Are the programme staff shortages focused in IT skills?

The shortages are not just in IT skills. We talked earlier about the importance of programme management skills and that being an area of difficulty, particularly with agile skills. Posts such as business analysts—

What is an “agile skill”?

Agile skills are what people who have worked on agile programmes have. They have worked in an agile environment and understand the agile methodology, as opposed to the waterfall methodology that used to be used on programmes.

Okay. I presume that most of the programme shortages relate to job vacancies in Edinburgh, and not Dundee.

The shortages are in Edinburgh and Glasgow.

Okay. There is a general shortage in IT. I think that, every year, we are about 7,500 IT graduates short of what we need in the private and public sectors. There is a big challenge.

The programme staff have responsibility for planning capacity so that when it hands over to the agency it can carry out procedures, implement policies and do all the things that will be required to deliver the programme. The target date for completion of transfer of the existing benefits is 2024. Is that deadline likely to be met? Could it be brought forward? What is your sense of where we are in terms of achievability by 2024?

We say in the report that that will be a significant challenge, but we are not saying that it will not be done. It is unlikely that the date can be brought forward. It will be a challenge, given the experience so far and the effort and commitment that have been required of staff to achieve successful delivery of the wave 1 benefits, and given the ramping up of the number of people in relation to wave 2, the complexity of assessments, and the need to start making regular payments.

That is for the benefits that are already being transferred.

That is for the wave 2 benefits, which include disability living allowance and personal independence payments, which are quite different in nature to the one-off grants for carers allowance supplements and the pregnancy and baby grants.

10:45  

When I was jointly chairing with David Mundell the committee to plan and arrange the transfer, one of the things that we agreed on was the fact that there were two problems with the DWP’s IT systems. First, a lot of them were pretty antiquated and the DWP was struggling with them; and, secondly, there was not one system but a multitude of them. In the beginning, the DWP did not even know how many systems we would have to transfer because it did not know how many it had. The IT systems were not in a fit enough state for us to simply be able to take over the Scottish bit of them. By the DWP’s own admission, the systems were not fit for purpose. I believe that it is planning major changes to its IT infrastructure.

As a result of those issues, we agreed to make a distinction between the date of the transfer of policy decisions and the date on which we take control of our own computer systems that we have designed. For example, in relation to universal credit housing benefit, we ideally wanted to introduce a weekly payment option instead of a monthly one, but the computer systems that the DWP had could not do that, so we settled for a fortnightly payment option. I am not absolutely sure where that currently stands. However, the issue was that the policy—

Could you ask your question, Alex?

My question is, is it still the case that a policy change could take place after 2024, even though the administration and operation of the policy might need to reside with the DWP on a contractual basis?

There is a lot in that question; between us, we will do our best to answer it.

In paragraph 125, we say that the Scottish Government will take over executive competence for all the devolved benefits no later than 1 April 2020, next year. That is the power that lets it make the sort of choices that you are talking about. As part of wave 1, the Scottish Government has made some changes to the administration of universal credit with regard to the Scottish choices element.

The ability to make more of those changes will depend on the capacity in the programme and the agency to make that sort of change alongside all the other work that needs to be done. It will also depend on the ability of the DWP’s system to deliver things that the Scottish Government wants to do. There is a lot of complexity in that, which people are still coming to fully understand as they delve into issues such as the pregnancy and baby grant. In that case, because of issues with the software module that was required to do what was wanted, people had to do manual workarounds in order to deliver the policy in time. That was done successfully, but it is a good example of the kind of complexity that gets uncovered once people start to do the detailed work. Gemma Diamond can add to that.

The report mentions the good relationships that the programme has with the DWP, which are useful in terms of the close working that is required, and how long those relationships will be required for.

The DWP’s IT set-up is extremely complicated. As you say, it involves a lot of different systems that hold lots of different information. That means that there is no simple way of being able to get some of that Scottish information from those systems. The incremental way of working, which involves bringing benefits on board when the programme is ready for them, allows each of them to be investigated in turn so that people can be sure that there is an approach that can be managed, that the risks can be dealt with and that any manual interventions that are required can be done. It is clear that there will have to be close working between the programme and the DWP for quite a long time.

By 2024, Scotland will have its own independent social security system covering those benefits, with its own IT systems and so on. If additional benefits are then devolved to Scotland, are the IT and other operational structures designed in such a way that they could easily accommodate that transfer?

The system is being designed to be as flexible as possible, so that it can accommodate whatever changes to benefits are made.

That is a different issue. Obviously, changes to the benefits that we have control of will be built into the design of the system. My question was about capacity, which is a different issue. If there is significant additional devolution of benefits that are not currently being devolved, would the independent systems that are being built in Scotland have the capacity to administer those additional benefits?

We can currently see only the system built to deliver wave 1 benefits. That system will be built on to deliver wave 2 benefits. At the moment, we do not know what the full capacity of the system will be, as it has been built to deliver only wave 1 benefits. The Government might be in a better position to talk about what the scale of the system might be in the future, as it is built on for each benefit.

Right. The Government has no plans at the moment to build on additional devolved benefits. That is not in the plan, is it?

The approach that is being taken is flexible and iterative, so that the system can be built on. Because we do not have the critical path of where the Government expects to be and all the key steps between now and 2024, it is not possible for us to say that that degree of capacity flexibility will be available. The committee may want to put that question to the Government.

I think that Mark Taylor has a little more information to add for the committee.

I have an example that might help. We said in the report that, at the moment, the DWP is responsible for the payment system, and the reliance on that is because of the sheer volume of payments that are anticipated. The Government has decided that the initial solution is to use that system, although it may make another decision down the line. It intends to bring in its own payment system to be able to cope with that level of payments but, at this stage of the programme, the current solution is to continue to use DWP systems. As we have illustrated, such choices still need to be taken and planned for.

Willie Coffey has a brief supplementary question.

On the point that Alex Neil raised, it is a bit like building a house and wanting a new garage later on. As long as there are the skills and the capacity to build the thing, all that is needed is a little bit of budget and time to deliver it.

The only caveat that I would add is that we are not talking about little bits of skill, time or money. However, the principle applies. We think that the foundations are designed to be flexible and to be built on but, as Mark Taylor said, some of the key decisions have not yet been made.

I have heard what my colleagues have asked about and will try to keep out of the detail. I tend to look at your summaries, which usually tell us what we need to know.

We have spoken a little about key message 4 in the summary. To paraphrase, it says that the Government knows where it wants to go, but it is not sure how it will get there, how long it will take, or how much it will cost.

On the same day that the report was issued, the Cabinet Secretary for Social Security and Older People issued a letter, which is in the committee’s papers—I presume that you have seen it. Perhaps up to three quarters of the three pages of that letter pick up on the perceived plaudits in your report. I did not get a feeling from it that the cabinet secretary realised the seriousness of key message 4. Do you believe that she really understands how serious that matter is?

It is very hard for me to interpret what the cabinet secretary’s view of the report is in that way. The team’s very firm conclusion from working with people in the programme and the agency is that they absolutely understand the scale of the challenge. They are very self-aware and they are good at learning lessons once a benefit has been delivered and at having plans and contingency in place for when unexpected things emerge. However, we are saying that the next wave will be a real step up in the complexity and the pace of what is required. That is why it is important for the Government not only to have confidence in what it is doing, but to make the plans available for parliamentary scrutiny.

Do you discuss your reports with the cabinet secretary? Perhaps I have asked you that question before.

All our reports are cleared for factual accuracy with the Government. That normally happens through the accountable officer, rather than directly with the cabinet secretary. I have not discussed the report with the cabinet secretary although, for full disclosure, she and I were in the same BBC studio on the morning that it was published.

Do you or your team take from the letter that there are serious measures afoot to solve the issue?

It is hard for us to comment on the letter in isolation from everything else that we know. The letter was to the committee, and the committee might want to take evidence about it from the cabinet secretary. We can only give the committee the assurance from the work that we have done over and above what is in the report that there is a good degree of self-awareness and that the challenge will be significant.

Gemma Diamond may want to add to that.

As we say in the report, the Government is doing a lot of the right things to address the challenges in the programme. We mention that a lot of reviews are under way, including reviews of finance and governance. The Government is starting that work—it is building the plans for a critical path and for finance. One of the risks that we draw out in the report is that the pace of delivery is such that it makes it very difficult for the Government to stand back and implement all those changes in time for wave 2, but we certainly took assurance from some of the work that the Government is starting to do to address some of those challenges.

I did not take too much comfort from the letter—it is all about this being work in progress.

Turning to a slightly different topic, paragraph 77 of the report talks about fraud. It mentions that a fraud team and procedures for dealing with fraud are being established, but given that the Government has been paying out benefits for some time, should those procedures not all have been in place before day 1?

The benefits started being paid in September last year and that is continuing to be rolled out. In the report, we make the point that dealing with fraud is really important. It is important that people receive the money that they are entitled to; at the same time, it is important that public money is protected. A risk of fraud is inherent in the payment of benefits.

We are satisfied with the work that is under way, but work needs to continue to be done at sufficient pace to make sure that everything remains fit for purpose.

Was there a period when no fraud procedures were in place?

The short answer is that we are looking at the detail of that through our current annual audit process. As the agency pulls the accounts together, we are looking at what the detailed arrangements in that area are.

You are right in your suggestion that such controls cannot be added in downstream. We are aware of a number of things that the agency has been doing, and we are looking at the detail of that. In time, we expect to be able to share some of that detail with the committee.

So that will come out in your annual audit.

Yes.

Yes.

Mark Taylor mentioned concerns about the capacity of the finance team. That point is made in paragraph 68 of the report. In the letter from the cabinet secretary that Bill Bowman referred to, she said that there is a new finance team in place. What impact have the finance concerns had? Will the new finance team be able to take the programme forward in a safe and secure manner?

The capacity of the finance team was one of the factors that contributed to some of the concerns that we expressed about the monitoring of the overall costs. We also highlighted that there had not been enough scrutiny of the longer-term financial implications of some of the bigger decisions that individual project teams had been involved in. The finance capacity has been really stretched in that respect. Earlier, we touched on the skills challenges in that area.

At the same time, there have been improvements in annual budget monitoring and in the annual budget figures, but although there has been progress in some areas, capacity has been an issue. However, it is not all a question of capacity. There is an issue to do with where attention is paid. We have made it clear that more attention needs to be paid to the financial side. It is a case of not only having the skills and the capacity to do the work that is required to support good governance, but paying sufficient attention to the governance arrangements in that area.

You rightly mentioned governance. By and large, your report is pretty positive about the governance and organisational arrangements. However, it says in paragraphs 43 and 44 that, because of the pace that things have gone at, every so often a decision has been taken to go outside the standard processes.

You have talked at length about the challenges that are coming up. All too often, the committee comes across situations in which decisions are taken outside the normal processes in an effort to meet demand and to make sure that everything goes to plan. The result is that we end up trying to pick up the pieces with the witnesses who appear before us. Given that the pace of delivery and change will continue at the same or even greater speed, how confident are you that the Scottish Government is on top of the issue and that the deviations will not continue in the future?

11:00  

We also say in part 3 of the report that there is a review under way of the governance arrangements, some of the decision-making processes and the strengthening of the finance function. I welcome that; it recognises that the issues that we have identified as having an effect so far are risky, given the increase in pace and scale that you refer to. It is too early for us to assess whether the reviews are having the effect that they need to have. We will monitor that again through the audit of the agency and will bring that back to the committee in due course. Perhaps Mark Taylor will add some detail to that.

One of our concerns, which is outlined on page 30 of the report from paragraph 96 onwards, is about the range of activities that the Government is undertaking on governance and how it is organised. We recognise that the right things are being done, including on financial capacity—we talked about that—on how to speed up decision making and on the IT side. There is a big list of all the things that are being done, but we think that too much is being done. We are not saying that the Government is not doing the right things, but it will be really hard to do all that alongside continuing to deliver wave 1 and delivering wave 2. The root of our concern is that there is so much to manage in those reviews.

That is precisely the point. I will ask a wrap-up question, as no other members have questions.

Throughout today’s session, it has been said, quite a lot, that wave 2 will be hard—I think that that was the word that was used at the start. There is work under way, the business case is being revised and there is a need for resources. I think that it was Gemma Diamond who said that wave 2 is much more complex.

Right back at the start of the meeting, Auditor General, you said that the Scottish Government does not necessarily know what needs to happen, let alone whether it will be in a position to make it happen. Returning to Alex Neil’s point about 2024, if the processes, IT resources and staffing are not in place, that begs the question of what would then happen? Would the benefits be devolved and put in place anyway, or would there be another pause?

I will attempt a wrap-up answer, convener, rather than just picking that up.

You are right—we say in the report that the Government “has done well” to get this far and has laid some important foundations, and that it will be a significant challenge to deliver the wave 2 benefits as planned, given the scale and complexity that will be involved. We know that it is aware of the challenges and that a number of things are under way to respond to them. We also know that, as Mark said, a lot of things need to happen at the same time and the Government does not yet have a detailed understanding of what actions need to happen, or when, to be able to deliver the timeline that is set out in the report. We know that the Government has prioritised safe and secure transfer of the new responsibilities, which is a reasonable approach to take, given the amount of money that is involved and the impact on people’s lives.

It is for Government to think about its contingency plans if it cannot deliver to the timescale that is required. We think that planning will maximise the Government’s chance of delivering, as well as making sure that the Parliament can scrutinise this important process in an appropriate way over the next few years.

I am grateful. Do members have any further questions?

I have a final question, which is about payments.

Local government pays out quite a lot, as it administers council tax and housing benefit, as well as its own benefits such as school uniform grants. Is there scope to use local councils more as face-to-face delivery agencies? From a policy point of view, is there scope in the long term to get closer co-ordination between, or to integrate, the support that local government provides and the support that we will provide through the social security system?

As I think you will know, Mr Neil, the Government is committed to linking closely with local government’s face-to-face support staff and services to help claimants access the benefits that they need. I think that, for now, the Government has ruled out the possibility of using councils’ payment systems, partly because of the complexity challenges that we have talked about.

The Scotland Act 2016 includes a power for introducing new benefits in Scotland, where they can be afforded, and, once the devolution of this set of benefits is complete, it would be a matter for this or any future Government to think about how those benefits were delivered and who they would target.

I thank the Auditor General and her team for their evidence.

11:05 Meeting continued in private until 11:26.