Public Audit and Post-legislative Scrutiny Committee

Meeting date: Thursday, June 29, 2017

Official Report 619KB pdf

---

“Common Agricultural Policy Futures programme: Further update”

Under item 3, we will take evidence from the Auditor General on her further update report on the common agricultural policy futures programme. I welcome her and her colleagues from Audit Scotland and I invite her to make an opening statement.

The report looks at the progress that the Scottish Government has made with delivering its common agricultural policy futures programme since I previously reported. It covers progress up to May 2017.

Before I outline my findings, it is important to note that the rural payments system is working, processing applications and making payments. However, it is not working as well as intended, and some parts of the system are still being developed and redesigned. I acknowledge the tremendous efforts that staff across the agriculture and rural economy directorate continue to make in delivering the programme and improving the system.

The Scottish Government has made significant changes to the leadership and governance of the programme to improve the transparency of decision making and increase the strategic capacity of senior management. However, it is clear that the difficulties that were experienced in previous years have had a detrimental impact on the programme over the past year. The report highlights that significant management time is still focused on short-term payment priorities. The changes to leadership will take time to embed, and the Government will need to ensure that senior management are able to focus on the directorate’s longer-term strategic needs.

I highlight in my report that the application process has improved, with the proportion of applications that are made online increasing, but the Government has not been able to make 2016 payments as quickly as it would have liked. The system required significant development to be able to make 2016 payments, and the Government undertook additional checks to make sure that there were no errors.

To make payments to farmers more quickly, the Government introduced another loan scheme. That made payments to farmers from November 2016, which was welcomed, but it put the Government’s budget under pressure, and the requirement to maximise the recovery of loans by the year end put pressure on payment timescales and staff.

The report also summarises the findings of our recent audit work on the European agricultural funds accounts. Through that audit, we identified a number of weaknesses in controls, which mean that there continues to be a risk of significant financial penalties. In my report last May, I recommended that the Government should complete a detailed assessment of the risk of financial penalties and, this year, I highlight that that assessment is not yet complete. In the absence of the Government’s assessment, and with acknowledgement of the uncertainties that are involved, we have updated our estimate and found that penalties of up to £60 million are possible.

The programme closed at the end of March this year, when programme activity moved into the business of the directorate. Three key systems are still being developed. The programme spent £166 million to the end of March, and the Government forecasts that it will deliver a CAP-compliant system within the budget of £178 million.

The Government will continue to incur costs that relate to the rural payments system. An independent technical assurance review found that, although the system’s design and infrastructure were fundamentally sound, significant investment will be needed to develop, rewrite and redesign parts of it. The review also noted the lack of a fully tested, comprehensive disaster recovery plan.

Overall, the report highlights that the programme has cost significantly more than expected, has delivered less than originally anticipated and will not deliver the full range of planned benefits. To date, it has not delivered value for money. My report makes a number of recommendations to help management to prioritise activity as the programme closes and moves into directorate activity.

Accompanying me is the team that worked on the report and on previous reports on the issue. We will do our best to answer the committee’s questions.

Before I invite members to ask questions, I have a question. You referred to the independent technical assurance review of the information technology system that the Scottish Government commissioned. You will be aware that we asked the Scottish Government to provide a full version of the review but that it had concerns about commercial confidentiality and the possibility of cyberattacks, so it did not want to publish the review. However, it has provided us with a summary of the key findings. Given that your report concerns an IT programme on which many millions of pounds of public money have been spent yet which has been beset by delays, I would like to be reassured that, as Auditor General, you had access to all the information and were not inhibited in producing your report.

I have had access to all the information that I required to produce the report. I have read the technical assurance review in full, and I know that my team has worked with it closely and that it has informed the conclusions in my report.

That is helpful to know.

The biggest concern is the potential for disallowance and the risks with that. You say that you did a detailed assessment. What did that entail?

I will ask the team to talk you through the detail in a moment. It is worth saying up front that my recommendation last year was that the Government should carry out the assessment itself in order to prioritise its investment and to decide which parts of the system should take priority, to minimise the risk of penalties and disallowance. That work continues and the Government does not have its own figure.

We used the information to which I referred in my answer to the convener’s question and our knowledge of the European Commission’s rules to carry out our assessment in relation to delayed payments and the controls that are required to be in place. Morag Campsie is probably best placed to talk you through how we did that.

The financial penalties that can be incurred relate not only to missing deadlines but to any weaknesses in controls that we identify, if they pose a risk to the European funding. In the European Commission regulations, there is an audit circular that sets out a table with the percentages that can be applied for disallowance, which go from about 2 per cent up to 25 per cent, and that depends on the number of control weaknesses that are identified. Paragraphs 57 to 64 of the report set out what we found in the European agricultural funds audit, which identified a number of weaknesses in controls. We used that information to refine our assessment from previous years. Our assessment also takes into consideration missing deadlines.

You adjusted the potential loss from £125 million to £60 million. Why was that adjustment made? Were there improvements in the system or better controls?

Last year, we gave a range—our estimate was between £40 million and £125 million. That assessment was prepared in advance of the publication of the report in May 2016. After that, the Government was granted an extension to the payment deadline, from the end of June to the middle of October, which affected the penalties, or disallowance, that were likely to come through.

It is fair to say—as we say in paragraphs 57 to 64 of today’s report—that in the audit of the European agricultural funds accounts we found that some of the weaknesses had increased since previous audit work. It is a complex calculus, which Morag Campsie talked you through. The combination of all that brings the upper limit down from £125 million to £60 million, with a recognition of the uncertainties involved and of the fact that if the European Commission decides to impose penalties the Government can negotiate with it on that.

I am not defending the system; it has clearly been a problem. However, last year, when I presume that things were even worse than they are this year, the penalties that were incurred were £5 million. I hope that they would be mitigated in some way.

We hope that they are being mitigated, too. That is reflected in the fact that the upper limit has come down in the estimate that we published in the report.

The £5 million relates only to payment delays. As the team said, there is also the potential for significant penalties that relate to control weaknesses, and we know from our audit of the European agricultural funds accounts that those weaknesses exist. It is for the European Commission to determine what penalties it wishes to impose, and the Government can negotiate, but there is a second stream of potential penalties, as well as those that relate to delayed payments.

From your experience and from what you have seen, are the control issues being addressed? Are things improving?

In paragraph 60, we give a flavour of the control difficulties that we encountered during the EAFA audit. That was a challenging audit, which we concluded at the end of February. The difficulties that need to be overcome are really about the availability of the audit trail that the system reports, to support the numbers in the EAFA. Although the potential disallowance has reduced, some of the challenges that we encountered in relation to the evidence to support the numbers made the audit a difficult experience. Although, for the overall account, we were able to verify the numbers that were produced for us to audit, we made recommendations, not findings, which are to be addressed. We will follow things up during the audit this year.

Auditor General, you said that the system is working—although perhaps not as well as it should be—and that it is delivering. You also said that the programme has not achieved value for money. On the face of it, I understand why you might go down that road. However, given the disallowance that might have been incurred had the system not been in place, the system must be delivering some value for money, if not as much as might have been hoped for. Is that correct?

I said that the system has not yet achieved value for money, in recognition of the fact that the Government still hopes that it can identify more areas in which to achieve benefits from the investments that it has made, such as the land mapping system and customer account information that are being developed and which we hope will be in place in the future.

The reason for my judgment that the programme has not yet achieved value for money is very much about the comparison between the expected costs and benefits and where we are now. The costs have risen from the original planned costs of about £102 million to the current estimate of £178 million, and we know that some of the planned benefits have not been achieved.

The risk that disallowance will not be minimised is still very much there. Some of the benefits to do with integrating pillar 1 and pillar 2 payments, an improved experience for users and customers of the system and improved reporting were taken out of scope deliberately when the system was rescoped in 2015. There are elements that will still need further investment to achieve future CAP compliance. All those elements together drew me to conclude that the system has not yet achieved value for money. I recognise that the Government is working to see what more value it can achieve from the system.

You made four recommendations in the previous report, but only one of them has been implemented. When does the Government say that the rest of them will be acknowledged and implemented?

10:30  

We can give you more detail on the Government’s plans for the implementation of the three recommendations that is not yet complete. My comments reflect those that I made in my opening statement. The focus on being able to open the applications process and make payments in 2017 has got in the way of the longer-term strategic changes that are needed to make the whole programme as robust and resilient as it can be. I ask Gemma Diamond to add more about progress.

The three other recommendations are very much work in progress. In the report, we recognise that, as well as the requirement for further efforts to be made. For example, as the Auditor General said, last year we recommended a detailed assessment of the risk of financial penalties to help the Scottish Government to make decisions on priorities. We note that the changes that have been made to governance have brought in some of those on the accreditation side to sit on committees, which helps the broader assessment of all the issues, but the more detailed assessment of what the built-up risk of financial penalties is across all the different schemes has not been done. Although changes have been made, the Government needs to look more broadly at the risk of disallowances; that work has not been done to the detailed level to which we would expect it to be.

In the report, we talk about knowledge transfer, which was the subject of another recommendation. That is very much a live issue, given that the programme is at an end and contractors are leaving. A transition plan has been put in place but, given that so much on-going activity concerns the need to make payments and to deliver developments to the system, the risk is that time will not be built in for knowledge transfer to take place. There is not adequate contingency to allow for that. We highlight the risk that the plan might not succeed.

The third recommendation was about a disaster recovery solution. We note—this issue came up in the independent technical assurance report, too—that the situation has not moved on much, but the Scottish Government is starting to consider it, given that the legacy systems have been in place for much longer than expected. That is where the problem lies with disaster recovery. The new system has a built-in disaster recovery system; it has not been tested, but it is there. Because the Government has had to rely on the legacy systems for much longer, it is, as we suggested, looking at what risk it is prepared to take at different parts of the process and therefore what disaster recovery arrangements would be appropriate to put in place in the short term and into the longer term.

You mentioned the knowledge transfer recommendation. Paragraph 94 mentions that there are

“around 20 contractors with a pivotal role”

and that

“A significant number of contractors are involved in developing the system”.

When you say “contractors”, are you talking about the classic IR35 one-man-band who is engaged to develop something? Is that correct?

No. The majority of contractors come through the main supplier, which is CGI. When we refer to contractors, we mean contractors who are employed by or through CGI.

You mean people who are engaged through CGI, not employed by CGI.

Yes—sorry.

I understand. That is interesting.

Now that a knowledge transfer system is in place, we are trying to capture all the knowledge to get it internalised for employees to use. Is that correct?

Yes. As the programme closes, fewer people will be working on system development, so it is essential to transfer the knowledge to the staff who will run the business as it moves into business-as-usual mode, to ensure that they know and understand how the system operates.

Have you been given any idea of when and how that process will conclude? As you rightly say, a finite number of staff are in place. Those staff, who are incredibly overworked, are about to have an enormous amount of knowledge transfer placed on them. Is that correct?

For some of the key roles, work shadowing has been put in place over the past few months to get the knowledge transfer in place. That issue is at the top of the Scottish Government’s priority list as something that it must do, and we know that arrangements are in place for that work to take place.

Should the Scottish Government engage or employ more people? Is that happening?

The directorate has been looking at the capacity that it has to manage the move into business as usual. In the report, we talk about leadership changes and increasing the leadership team to make sure that it has the capacity to deal with the business as usual, as the system comes out of development and into normal processes.

Convener, I have some further questions, but I think that I will come back in later with them.

Okay. Willie Coffey has a question.

Could we go back to the budgetary issues and try to steer away from the software ones that are usually focused on in discussion here? The second paragraph of the opening of the report says that the Scottish Government

“expects to deliver a system that complies with CAP regulations within the £178 million budget”

and you have discussed that in your responses to some of Colin Beattie’s questions. What is your perspective on that, if you have had a chance to consider it? You were also projecting and considering additional work that might be required in order to develop, test and deliver the system fully. Has there been an analysis of the extent of that and has Audit Scotland had a chance to scrutinise it?

First, I refer the committee to exhibit 7 on page 18 of the report, which shows the programme costs as at 31 March 2017. Of the total £178 million budget, £166.4 million had been spent by that point. The balance was committed to a range of other things that had to be achieved in order to ensure CAP compliance at that point. Most significantly, there are three additional parts of the system that still need to be put in place and that are budgeted for: the scheme accounting and customer account management system, the land parcel information system and pillar 2 capital claims. We think that the budgeting is reasonable, but until those parts of the system are up and running, there is clearly a risk that they may cost more than expected or that there may be unanticipated problems with them. That covers the £178 million programme budget.

A little further on in the report, we identify that in order not just to maintain the system but to develop and stabilise the elements that are already in place, the Scottish Government has entered into contracts with two suppliers. There is a contract with CGI that is worth £29 million over two years, which reflects its option to extend that payment, and a smaller contract that is worth £3.5 million to maintain and develop some of the legacy systems to keep it all together. We acknowledge in the report that there is always a need to invest in maintaining and continuing to develop an IT system in order to ensure that it stays fit for purpose and can meet changing needs. However, we also conclude that the scale of the investment that is required is more than would normally be anticipated. That reflects the findings in the technical assurance review.

Gemma Diamond may want to add detail on that.

At the moment, we know that the technical assurance review suggests that significant investment is required. We do not yet know what the costs will be. The Scottish Government is currently talking with the contractors about the costs and how significant they might be. It is clear that there will be a number of decisions for the Government to make about where it prioritises the investment. That is why we made a recommendation in the report about the Government’s having in place a framework to allow it to make such decisions and to ensure that it includes the technical requirements of the system, the requirements of European Commission audits, and how it will prioritise investment. What do the farmers want to be prioritised, and what do the area offices’ staff need? There has to be a framework that brings all those things together so that the Government can prioritise investment among them.

How regular will follow-up assessment and projection of continuing financial support to develop the system be? It is obvious that the package will need continuing maintenance and possibly some investment, as policies and demands change. How regularly will we see reforecasts of what additional funding will be required year on year, to support the package?

The directorate will need, as part of its budgeting process, to look annually at the actual needs for that year and the next, as it would in any year. The system is now no longer a programme but is part of business as usual, so that will form part of the Government’s overall assessment about what it needs, what investment might be required, where the priority areas are and how it might spread the funding over the years.

Paragraph 19 refers to “difficulties experienced across Europe”. Have other jurisdictions experienced similar difficulties in implementing the new CAP system? What experiences have they had to contend with?

We know that last year a number of member states had difficulties in meeting the end of June timescale for making payments. As a result, the Commission gave a wider extension to mid-October 2016 to a number of member states.

We do not know what the position is this year and we are not in a position to comment on practice elsewhere in the European community at the moment, but we know that difficulties were widespread last year.

I presume that after 2019, when the UK pulls out of the EU, the software will have to change radically again, because the compliance rules will be different.

None of us knows what the position will be in 2019. I assume that the Government will still want to develop a system for providing support to the rural economy. One area that the directorate is looking at is how the system could be used to provide wider support, with further development as required. Obviously, the situation is not a helpful development in terms of providing what is required for this CAP programme.

I presume that the system will stay in place until we know what it should be replaced by. The system should have a lifespan beyond the point at which the UK exits the EU.

Indeed. One would hope that, for the amount of money that we have put into it, it will not have just a limited shelf life.

I will bring in Liam Kerr for one final question.

Just one?

You might want to make it one in parts.

Okay. It is a very quick question.

Two contracts have been extended. The CGI contract has been extended, and at paragraph 43 you say that another one has been extended. Do you have any comment to make on the extension of contracts of people who appear to have failed to deliver the IT system that they were paid to deliver?

The second part of my question is on the loan scheme, which I am very pleased about, because we are talking about people’s lives. Money was pulled into the loan scheme. What has suffered as a result of that funding?

Finally, who is at fault for this?

At paragraphs 42 and 43 we talk in some detail about extension of the contracts. The option to extend the CGI contract for two years existed from the beginning. Given the problems that have been experienced, once the Government started to look at what would be required there was little choice but to extend the contract. In the report, we recognise that the Government has negotiated quite rigorously with CGI about the conditions of the extension, and that contract monitoring has improved. That gives me some comfort that the extension is being done in a way that is based on a proper appraisal of the options and which maximises the chance of getting good value for the additional money that is being spent.

The other contract is smaller and reflects the fact that, against expectations, the rural payments system overall is still relying on a number of legacy systems that need to be maintained in order to play their part. Set against the point that the system has reached, those decisions both seem to be reasonable.

I ask Stephen Boyle to pick up the question on loans.

I refer Mr Kerr to exhibit 4 in the report, where we set out in a bit more detail the progress and use of the loan schemes over the past few years, covering the various mechanisms that have been used, as well as recovery and the amounts outstanding. The Government funded the loan schemes from its financial transactions budget, which is designed to fund things outside public sector bodies. It is typically used for regeneration, infrastructure and housing initiatives.

There was an impetus to recover balances of loans by the year end. We note the balances that remained outstanding at the year end. The Government noted that it was able to support and deliver the programme through what is referred to as underspend in other areas, to arrive at the year-end position.

Right. Who is at fault?

The committee may recall that I concluded in my report last year that the problems in the system go right back to the beginnings of the programme in 2012 and the extent to which the complexity of the new common agricultural policy programme was underestimated. Beyond that, the changes that were agreed between the Scottish Government and farmers and rural businesses added to that complexity. We have seen significant changes in the civil servants and the ministers who have been accountable for the issue in recent months, but the question about underlying responsibility goes right back to 2012. We refer the committee back to the earlier report, which it might find helpful.

There will be a brief suspension to allow some of the witnesses to change.

10:45 Meeting suspended.  

10:46 On resuming—