Public Audit and Post-legislative Scrutiny Committee 05 September 2019
The agenda for the day:
Decision on Taking Business in Private, Section 23 Report, Section 23 Report.
Decision on Taking Business in Private
Decision on Taking Business in Private
Good morning and welcome to the 18th meeting of the Public Audit and Post-legislative Scrutiny Committee in 2019. I ask everyone in the public gallery to make sure that their devices are turned to silent or switched off, so that they do not affect the committee’s work this morning.
Item 1 is a decision on taking business in private. Do members agree to take items 4, 5 and 6 in private?
Members indicated agreement.
Section 23 Report
Section 23 Report
“Social security: Implementing the devolved powers”
Item 2 is on the section 23 report, “Social security: implementing the devolved powers”. I welcome our witnesses to the meeting. From the Scottish Government we have Lesley Fraser, interim director general for organisational development and operations; Stephen Kerr, social security director; Alison Byrne, social security deputy programme director; Kevin Stevens, head of strategic and programme finance; and Andy McClintock, chief digital officer. I also welcome David Wallace, chief executive of Social Security Scotland.
I invite Lesley Fraser to make an opening statement.
Lesley Fraser (Scottish Government)
Thank you very much, convener.
I am pleased to give evidence in my new role. Although I took up post only recently, I was a long-standing member of the social security programme board in my previous role as director for housing and social justice. I have seen first hand the substantial progress that the Scottish Government has made in relation to the safe and secure devolution of social security powers.
From the start of the programme in 2016, we now have fully devolved discretionary housing payments and have introduced five new payments—carers allowance supplement, three best start grants and best start foods. A sixth, the funeral support payment, is to be introduced later this month.
The new agency, which just celebrated its first birthday, has provided financial support to more than 91,000 people and has received excellent feedback. The latest figures show that 97 per cent of online clients rated the application service as “good” or “very good”, and telephone application services received even better feedback. I know that the team is proud of those achievements and pleased that Audit Scotland recognises that we have done well so far. However, neither I nor they are complacent about what lies ahead.
I come into the post at a time when, as Audit Scotland emphasises, there remains much to do. Next year, working to a demanding timetable, we move into the delivery of complex disability benefits and the Scottish child payment. Inevitably, more complex benefits will bring different and harder challenges. I am grateful for the work that Audit Scotland has done in supporting and reporting on the programme of social security devolution, which is one of the largest programmes of new powers of the past two decades.
As the committee would expect, our programme of work continually learns from experience. As the Auditor General told the committee, programme staff are self-aware; they know what needs to be done and they could not work faster or more conscientiously in doing it.
Audit Scotland’s recommendations, which we accept, sit well with the programme’s direction of travel, and they help to reinforce activity that is already under way or that we have planned. Audit Scotland has indicated areas that we can strengthen, which is useful, and work is already under way to do that. Six months on from when Audit Scotland completed its evidence gathering, we have made significant progress, which I look forward to discussing with the committee.
In meeting the challenges that the next phase of delivery will bring, risk management will be absolutely crucial. I am glad that the report agrees with previous Audit Scotland recommendations that there are good-quality processes in place for that. I will focus particularly on that area, and I hope to add significant value in that regard.
I am grateful to the committee for your interest. My colleagues and I are happy to answer your questions.
Thank you for that opening statement.
You are all welcome here this morning, but it is unusual for us to have so many witnesses on one report. I understand that you were keen to have all six of the personnel who are here this morning. Will you give a brief outline of what everyone does and how that fits together in your management structure?
Of course. Stephen Kerr is the programme director in the Scottish Government and is responsible for the overall programme for the devolution of the powers and for its successful implementation. He is supported in that by Alison Byrne, who is the deputy programme director.
David Wallace picks up at the agency—he is the chief executive there. The agency is responsible for the front-line management of the benefits and their delivery. Andy McClintock is the chief technology adviser, as chief digital officer. He works for the programme and the agency on technology. Kevin Stevens is head of strategic finance in the programme and is responsible for pulling together the short, medium and long-term financial plans for the programme.
So the programme is different from the agency.
The programme is the Scottish Government’s management of the process.
That is right. The programme is the Scottish Government’s implementation of the devolution of the powers. As we implement the powers, we hand over to the agency to run that as a front-line public service in Scotland.
Thank you. We just want to be clear for the public who are watching.
Stephen Kerr (Scottish Government)
Just to be clear, I am the director in the Scottish Government. The Scottish Government has a number of directors with different responsibilities, and I am the director for social security. It was my decision to set up a programme to deliver the social security powers. That programme is run by Lisa Baron-Broadhurst, who is my programme director; Alison Byrne, who is her deputy, is here today.
So we have plenty of people to make sure that this goes right.
Colin Beattie will lead our questioning.
I want to look at long-term planning, particularly around costs. The Auditor General’s report refers to the initial cost of £308 million, which at that stage clearly had to be a ballpark figure. Decisions are being taken along the way that commit funding, and one would hope that the figure is getting rather more honed down. There is concern that there has been limited evidence of estimating or reporting on long-term implementation costs. We have a letter from the Cabinet Secretary for Social Security and Older People indicating that a new finance team has been put in place. Will that development address some of the concerns that the report raises in relation to long-term cost estimates and, if so, how?
Yes. Considerable work has been done on three aspects of the programme in preparation for wave 2, and finance is one of those aspects. A review of the programme finances has been undertaken, and not just by those involved in the programme—peers were brought in from the Scottish Government. That work is now complete and has resulted in our augmenting senior financial capability both within the programme, where Kevin Stevens is the head of strategic finance—
I am sorry to interrupt, but can I clarify the point about the finance team that the cabinet secretary referred to? Was that a one-off intervention, with that team now having moved on, having passed on whatever skills were required? How did that work?
It has been part of the planned evolution of the programme. The programme is built from the wave 1 benefits, which, by and large, have been more straightforward and simpler, although still quite complex; we have also built the infrastructure, the agency and all the processes through wave 1.
As we move to wave 2, where the benefits are more complex and the sums are much larger, we need to evolve and develop aspects of the programme to meet those new requirements. Finance is one of the areas where we have had to do that work, which is now reaching a conclusion. That includes the full assessment of the impact of the Scottish child payment.
We have augmented our capability in the programme team within the Scottish Government and within the agency, recognising that the agency is now delivering benefits to the people of Scotland and needs its own capability and capacity in that area.
You touched on a point that I was going to raise about the £10 benefit. The implementation schedule for that is quite short.
Social Security Scotland will, presumably, be responsible for implementing and delivering that. It is a tight schedule, so I assume that it will bump some of your other long-term plans further into the future. Do you have an estimate of how much delay there will be for other aspects of implementing the social security programme as a result, and what the likely additional costs will be?
The safe and secure delivery of the benefits has been the watchword for the programme overall. As the Cabinet Secretary for Communities and Local Government announced in June, the decision to bring forward the Scottish child payment has meant that we need to make room within the programme. We expect that there will be delays to attendance allowance, Scottish carers allowance and the completion of case transfer. The work on reprogramming the finance, the work programme and the planning and governance for that is now concluding. That is all being fed into a revised programme business case.
Has the long-term financial planning taken the new payment into account?
It has. That is the work that is being completed just now.
Do we have a ballpark figure for the cost of that?
I cannot give you a ballpark figure now, but that work is being finalised and checked for discussion with ministers. I understand that the cabinet secretary plans to bring it to Parliament during the autumn.
Autumn is when you expect—
I understand that that is correct. Am I right, Stephen?
Yes—work to refresh the programme business case is on-going and the intention is to make that available when the Scottish budget is published later this year.
How significant will the delay be for the other parts of the implementation? Are we talking about a year or two years?
I will bring Alison Byrne in to talk about the feasibility work that goes on when you slot something like that into a large programme of activity. The initial analysis that the Cabinet Secretary for Communities and Local Government shared in June was that the introduction of disability assistance for older people would move from winter 2020 into 2021, and that Scottish carers allowance would be introduced in early 2022, rather than late 2021. We are still working through the process to understand whether we can hold to the dates that the cabinet secretary shared, whether we can bring anything forward or whether anything will take a bit longer than we anticipated when the cabinet secretary made her statement to Parliament in June. Alison Byrne may have something to add.09:15
Alison Byrne (Scottish Government)
I think that that is right. We work in an agile way. As Lesley Fraser and Stephen Boyle have said, taking the safe-and-secure approach to the building and delivery of our benefits, we made some assumptions in the statement in June about what the implications of the Scottish child payment might be for the rest of the programme and its delivery. Stephen Boyle has just set out the assumptions that the cabinet secretary made in June around attendance allowance, carers allowance and case transfer.
Over the summer, we have been doing quite detailed feasibility work in order to properly get beneath the impact of the Scottish child payment, and the cabinet secretary intends to update Parliament on those findings. That work has been looking at, for example, the fact that, with regard to our ability to deliver on the timetable that ministers have set out, we have a key dependency on the UK Government, in the form of the Department for Work and Pensions. We have been considering the infrastructure and systems that we will need to have to do that, building on what we already have in place in relation to the best start grant. We have also been working closely with David Wallace at the agency around some of the staffing implications on his side.
I have one last question. It is important that Parliament be kept informed of the progress on this issue. You have already indicated that the cabinet secretary will make a statement in autumn—we are almost there. How will you report back to Parliament on an on-going basis?
The implementation of the devolved powers will form an important element of the Scottish Government’s budget setting. I would expect that social security will be seen clearly within the usual reporting of that. Over and above that, the work that we have been doing to prepare for wave 2 is feeding into a refreshed programme business case that will bring together the planning, the workforce assumptions and the finances, and we are working towards making that available around the time of the Scottish budget. I hope that that will give Parliament considerable information and assurance about the plans that are under way.
My concern is to do with the fact that this is a major project and the success of its implementation is extremely important. I want Parliament to be kept aware as the milestones are achieved in the coming years.
We publish a considerable amount of information about the impact of the work that we are doing. David Wallace might want to say a bit about the information that is regularly available from the agency on that.
To clarify an earlier point, I am responsible for the agency, and my shorthand for describing that is to say that we look after live services. Once things come from the programme and are delivered as live services to the client, they essentially become a more business-as-usual operation. That involves our team working closely together, which is why there is a large number of people in the public gallery today. Once we get into that cycle of business as usual in terms of benefit expenditure, we will be into our normal reporting, as an executive agency, of the expenditure that is going through the agency’s books. We are already working with Audit Scotland on a first set of partial year accounts, which we are finalising at the moment. That is what we would report back on in terms of the agency’s financial expenditure, in relation to which I am the accountable officer.
I would like you to clarify a couple of things in relation to the timing of benefits.
Alison Byrne said that work is being done on the child poverty payment, following Aileen Campbell’s statement to the chamber in June. Am I right in thinking that you said that there might be a possible delay to that once you work out the potential timescale for implementation?
No; I was referring to the impact on the rest of the social security programme. As Aileen Campbell outlined in her statement, it is likely that, for example, the dates for attendance allowance and carers allowance and for finalising case transfer will change.
So you anticipate that the child poverty payment will be delivered to the timescale that Aileen Campbell set out.
Yes, that is our working assumption and is what all of the feasibility and impact assessments have been suggesting.
In her programme for government statement, the First Minister said that the first payments would be made by Christmas 2020, and that is the timetable that we are working to.
You are confident that you can hold to that timescale.
That is what we are working to, yes.
You said that the timescale for the carers allowance has slipped. Is it likely to slip further?
In her statement, Aileen Campbell said that the timescale would move from the end of 2021 to the beginning of 2022. That is the position that we are holding to until the feasibility work has been done and the assumptions have been tested. If there is any update to that, the cabinet secretary will inform Parliament.
Further to that, I seek a bit more clarification. Only a couple of days ago, the FM announced that the introduction of the Scottish child payment is being brought forward to Christmas 2020, which is very welcome. Alison Byrne said that the introduction of the new benefit will result in a delay to the introduction of the attendance allowance and the carers allowance and a delay in the transfer of cases. I think that it was suggested that each would be subject to a delay of a year. As the child benefit will be introduced earlier than was originally planned, can we be sure that those delays will not be longer than the timeframe that was outlined?
In other words, until two days ago, it was my understanding that the child payment would be paid from 2021. Will the delays to the payment of the other benefits that Alison Byrne mentioned be adversely affected by the Government deciding—rightly, in my view—to bring forward the implementation date for the child payment?
No. There is no change to the assumptions that Aileen Campbell set out in her June statement on the impacts on the remainder of the wave 2 benefits—that is, the introduction of attendance allowance moving to 2021, the slight delay in the introduction of carers allowance from the end of 2021 to the beginning of 2022 and the slight increase in the length of time to complete case transfers from the end of 2024 into 2025.
It would be helpful for the committee—and probably for the Parliament as a whole—if you could provide, in one table, a programme summary overview of each benefit that sets out which ones have been implemented and those that are due to be implemented and by when. That would allow us to quickly see where the programme is at.
Is the programme plan over a five-year period or a three-year period? What period does it cover?
I think that there will be a five-year plan for the programme.
Alison Byrne might want to talk about programme planning, but the plan will be for the lifetime of the programme. When we started the programme, we did not have things such as the Scottish child payment in our minds. Of course, we now do, so we have had a discussion about changes to the programme. Because the child payment has come into the programme and will have an impact on some of the other deliverables, the programme plan will be extended to cover the lifetime of the devolution activity that we are working on. As Alison Byrne outlined, that will take us into 2025.
I know that there needs to be flexibility, but could the summary that you provide go up until 2025, so that we can get the overall picture?
Yes. If that information is not already publicly available, we can ensure that it is provided.
If you could send it to the committee after the meeting, that would be superb.
We would be happy to do that.
I have a more strategic question. The Government has done extremely well to get the whole social security infrastructure up and running so efficiently and quickly. However, certainly when I was a minister, one of the key issues that we had from day 1 was the problems with the DWP, particularly with its information technology systems, which, by the DWP’s own admission, are antiquated. We are talking about a multitude of IT systems, and all the different programmes do not speak to one another.
I presume that we are building an IT system and capacity that will eventually be totally independent of the DWP and will not rely on its systems for our bit of social security. If an agreement was reached next year between the United Kingdom and Scottish Governments to transfer additional social security responsibilities to Scotland, do we have the IT, workforce and finance capacity to take on those responsibilities?
There was quite a lot in that question. Under the planned devolution of powers, we will run about 14 or 15 per cent of all benefits. We will reach and touch many Scottish people through the payment of devolved benefits under the current programme of work. Those people will still rely on the UK Government for other benefits and pensions. The importance of the systems working together, so that users and clients have a seamless experience, will remain critical. That is at the heart of the working relationship that we have with our DWP colleagues.
We are building systems and infrastructure that will be flexible and capable of responding to changes. Andy McClintock will talk about how we are doing that, for example, in the world of IT.
Andy McClintock (Scottish Government)
It is important to recognise that, for as long as there are two Governments in this country with shared responsibility for benefits, there will always be a relationship with the DWP with regard to how we exchange information about clients in order that they experience a single, joined-up benefits system.
From the outset, our aim was to build scaleable technology able to take on more benefits, should they come to the Scottish Government.
Our work over the past two years has been progressive. We have built technology that is scaleable. We have a multibenefit platform, whereas the DWP, from its decades of operation, has multiple systems for multiple benefits. We have tried to take a different, more scaleable approach. The technology sits in the cloud, which I am happy to talk about for hours, if you have time.
No, thanks. [Laughter.]
I did not think so.
We set out on a journey to build technology that is set for current needs but has the capacity to expand. Obviously, time and resource constraints go with that, but it is important to know that we cannot do it on our own. When I appeared before the committee 23 months ago, I set out the importance of working with the DWP. It is an essential part of our journey. We have a good relationship and good exchange of information with the DWP. It is in both our interests that we share information carefully, so that citizens and clients get the best possible experience.
My next questions are about something completely different. Child poverty is a major challenge for all of us. I welcome the introduction of the child payment. It is essential. As the First Minister indicated, that should take 30,000 children out of poverty. What take-up rate does that figure assume? Will the overall figure come down by 30,000? After 30,000 children come out of poverty, will child poverty continue to increase as a result of universal credit? Might the level continue to rise? Could Lesley Fraser further define that figure, please?
Yes. We anticipate a 3 percentage point reduction of children in poverty as a result of the child payment. We anticipate that the take-up rate of the benefit will be about 80 per cent.
When the payment was announced, I think that modelling work was provided to the Parliament. We can make sure that that information is available.
You are right to highlight the challenge of absolute poverty and relative poverty. There could be significant headwinds that increase child poverty. The benefits will help to alleviate those but they will not necessarily tackle them absolutely. Therefore, when the child payment is rolled out, ministers will want to review it and discuss its impact with the Parliament.
There are other things that we could do to tackle child poverty. Is there on-going analysis of the additional measures that could be taken to reduce child poverty? Obviously, childcare facilities are a contributing factor to reducing the levels of child poverty, because of the knock-on impact on the ability to increase earned income for the family.
Yes. An action plan on tackling child poverty has been published, which is underpinned by significant analytical work looking at the key drivers of child poverty, including the income that comes to people through work and benefits. There are different aspects to tackling child poverty.09:30
I have seen that action plan. Are we likely to see additional policy initiatives resulting from that analysis?
That would be a matter for ministers and the Parliament to discuss, but, as you know, there are statutory targets and ministers are clear that they want those targets to be met. Ministers are—rightly—continuing to look to all parts of Government to deliver on work to tackle child poverty. That includes the areas of fair work, early years, education and social security.
Colin Beattie mentioned the overall programme cost of about £300 million. From memory, I recall that the IT cost is about £200 million, which is pretty substantial. I want to drill down a little into that and ask for some assurance about the various software components that are delivering the entire system. Are they on track, on time and on budget? Will you give us a perspective on that?
Under the £308 million block figure, the outline estimate for technology was £190 million. We are still working well inside that £190 million financial envelope. All the systems that we are building are on track; all the technology that we are deploying is on track.
We have a plethora of systems and technologies that underpin the whole programme and the agency. My job is to make sure that the technology supports the programme and the agency. At this stage, everything from all the suppliers—including all the suppliers that we are appointing—is on track to deliver.
When I sat here 23 months ago, we had only just awarded one contract. You may well remember the conversation that we had at the time. Since then, we have moved on. We now have several major suppliers in the programme, as predicted.
We set out on a journey to have a multisupplier environment, and that is what we are doing—from the core technology to do with case management through to the digital portal, the cloud infrastructure and all the stuff that we use to underpin those systems and, indeed, all the infrastructure that we now have in two significant agency buildings in Glasgow and Dundee. At the moment, everything is on track.
I am glad to hear that. Where there are dependencies on the DWP to deliver software components, do we have its agreement to deliver what we need in order to keep us on track?
As I said, our relationship with the DWP is good. Our relationship is multilevel—it exists at my level, above and below my level, at the programme level and at the technology level. We have good agreements on the information that we need from it and what it needs from us. As we design our systems, we share the assumptions that we make about the information that we will get from the DWP and we work with it. We have regular contacts and working groups with the DWP in Scotland and in England to make sure that all our assumptions align.
To date, everything that we have expected from the DWP, we have got. Technology-wise, where we expected to send information to it—for example, on payments—that has worked perfectly well from day 1. As Lesley Fraser mentioned, the number of payments that we are making to citizens in Scotland is increasing; everybody has been paid on time, every time, which has been the most important part of this journey so far.
Of course, as Lesley Fraser pointed out, the next wave is probably the most challenging of all. In terms of systems development, are we repurposing the software systems to deliver it or are we writing new software from scratch? Who is doing what?
When I was here 23 months ago, we had just awarded a contract for a case management system, which was targeted at low-income benefits. Those benefits have been delivered and, in wave 2, we are expanding the use of that system to cope with multiple benefits.
As I said, we are putting in a multibenefits platform, and the plan is to continue expanding the use of that single system to pay multiple benefits, whereas the DWP has predominantly had a benefits platform for each benefit. So far, we have built a foundation and we are looking to extend the use of that.
When I was here previously, we talked about making sure that we bought a product that was scalable and highly reusable. That is what we did. The software licence that we bought will be used throughout the life of the programme and by the agency.
We are looking to maximise the use of the technology. We are not looking to customise it, but to configure it and keep it as a mainstream product, so that, as future enhancements are released and passed to us, we can use them as an upgrade.
How do you test that those systems are working without doing live testing?
Given that the committee does not want me to sit here for two hours and talk about cloud environments, I will just say that we have multiple environments. We have development and test environments, and we go through a number of releases before anything goes into a live environment. As we develop more functionality, we do it in isolation in a number of environments. Each time, we test it and then move it to the next stage of the environment. Ultimately, it goes into a final release, goes live and integrates with what has been delivered previously.
So when it goes live, it is working.
We all have stories from constituents who, when trying to access benefits, were confronted by endless IT hurdles—whether that be access to IT at home or access to software—and were unable to get past those barriers. How are we solving those problems? Can people still access the benefits without being required to go online?
Again, when I was here previously, I talked about the need for us to build a multichannel platform, because we should never assume that the citizens of Scotland will be forced to use a digital channel.
We should encourage updates to digital technology where that is appropriate for citizens, but there will always be an alternative method. Traditionally, that is the telephone channel, but there is also a post channel for people to send in information on paper. Ultimately, our desire is for more people to have a digital experience and interaction.
Our systems are being built with citizens through user experience panels. There has been lots of work on user research and engagement, so that when we expose a digital channel, it is built on citizens’ expectations, using terminology, wording and phrasing that means something to them, rather than using information that is confusing.
A multichannel platform gives citizens the option to choose the route and method through which they want to engage the agency.
The agency is also building up the local delivery capability. Once we are fully operational, we will have our Dundee headquarters and a big base in Glasgow; we will also have people scattered around all the constituencies of Scotland. That is because, from the very early stages, we have been absolutely clear that face-to-face delivery is a key aspect of ensuring that people get exactly what Willie Coffey described: access to service.
We did not bring that on for the wave 1 benefits—we did not feel that that was required in order to negotiate the benefits. The data has proven that to be correct. About 90 per cent of our clients have been able to go straight to the digital channel as a preference and the telephony service has worked in the background to support them. As Lesley Fraser said in her opening statement, the feedback on the digital channel has been phenomenally positive, which is a testament to the work that has gone in up front to put the user at the heart of the experience. The feedback from people calling the agency to get more direct personal support has been incredibly positive, too.
On the overall infrastructure, it is probably worth emphasising that people access the benefits through the www.mygov.scot portal. Again, that is something on which the chief digital office team of the programme worked really closely with their digital directorate colleagues, to ensure that it is built into the wider Scottish Government strategy.
I want to return to the convener’s opening comments, in which she talked about governance.
The report is broadly positive about the governance and organisational arrangements, but it suggests that the pace of decision making to support delivery timelines has challenged the governance at times. That has led to some decisions being taken outwith the appropriate processes or formal governance arrangements that are in place. At the previous meeting, I made the point that the committee often sees negative results when that starts to happen, and we heard that a review into that is taking place and into the governance arrangements more generally. Where are you on that? What steps are being taken to ensure that governance arrangements are appropriate for the pace of delivery?
The review of governance has been part of the review of planning, finances and workforce requirements. As we move from the relatively straightforward work of wave 1 to the more complex work of wave 2, it is absolutely critical that we have in place proper decision making, governance and risk-management arrangements.
Continuous learning and improvement are at the core of the agile process in the programme. In order to ensure that we prioritise the right lessons from all that we are learning—not just from this programme, but across other programmes in public services—we have formalised a continuous improvement programme and we have a team that is helping all aspects of the programme with continuous improvement. For example, we are augmenting the resources and skills in the programme board and ensuring that all subsequent layers of governance are appropriate and can make decisions properly and robustly in the timescales that are required, in what can be a fast-moving environment.
I ask Stephen Kerr to say a little bit more about the governance arrangements.
On Liam Kerr’s point about the speed of decision making, our friends and colleagues in Audit Scotland know that we take a slightly different view on the example that they provided in the report, whereby our delivery board within the overall programme infrastructure looked at a matter on at least two—maybe three—occasions, and could not come to a view. The matter came to me, as the senior responsible owner, to make a decision. I view that as working within, not outwith, the governance arrangements. Had it been a significant decision, I—as SRO—would not have taken it, but would have moved it on to our programme board for it to consider. However, as the matter related to an invitation to tender to advertise a contract, I was happy, as SRO, to make that decision, knowing that the full decision on award of the contract would come back to the programme board. I do not necessarily agree that it was the best example for Audit Scotland to have used to illustrate the point.
However, I accept the point about the speed of decision making in the programme. We will focus on that through the review to make sure that decisions are made at the right levels of the programme, as we move into wave 2 and deliver the Scottish child payment.
I have a small extra question. Can you provide a timeline for when that review will report?
On a more substantive point, a big list of things is being reviewed. I asked Audit Scotland about that at a previous meeting of the committee, and it told us:
“One of our concerns ... is about the range of activities that the Government is undertaking on governance and how it is organised ... There is a big list of all the things that are being done, but we think that too much is being done ... it will be really hard to do all that alongside continuing to deliver wave 1 and delivering wave 2.” —[Official Report, Public Audit and Post-legislative Scrutiny Committee, 16 May 2019; c 24.]
Along with your response on the timeline, what comment do you have on that?
Audit Scotland is right that this is a pivotal moment for the programme. That is why the work has been under way over the past 6 months and is now concluding, with the full investigation into the impact of the Scottish child payment. That will help us to bring together the governance, planning, resourcing and finance work, all of which is feeding into the refreshed programme business case that we will take to ministers over the next few weeks. We anticipate that it will be made public around the time of the Scottish budget, so that Parliament will be able to look at it alongside the financial and other plans of the Government.
It is absolutely critical that we get this right and that we learn from wave 1 and other programmes and activities outwith the programme. That is why we invested in the continuous improvement programme and the team to support it. The team has a critical role in helping us to do exactly what Liam Kerr described; that is, to prioritise what will be most useful and critical as we move from wave 1 to wave 2.
I was delighted that our campaign to base the headquarters of the benefits agency in Dundee was met by the Scottish Government. I take it that David Wallace is based in Dundee and running the operation from Dundee house at the moment?
For the purposes of integrating with policy, I split my time between Glasgow and Dundee—and frequently Edinburgh and elsewhere—so I am slightly nomadic. However, when we were launching our first benefits we were keen that it be done from Dundee because that is where our headquarters are.09:45
As to where we are with staffing, Dundee is now our most significant centre of operation: we have more people based there than we have in Glasgow. The Scottish Government’s presence in the city has been building up from a zero base. We have had a small footprint of Scottish Government civil servants, but we have had to build it up from a standing start. We were phenomenally proud to be able to do so. As the committee will appreciate, our work with the local authority in the Dundee area has allowed us to work at quite a rapid pace. Some members have been to see our operation in the city, which we are keen to ensure has a sense of openness and transparency. I share the convener’s delight that we are there.
Is it correct that you have 250 staff in your Dundee operation at the moment?
That is probably the figure that has been in the public domain for how things stood at the end of March.
Is it correct?
It was correct at the time that it went out, but the agency continues to grow almost daily.
Am I right that the plan is to have 750 people working for Social Security Scotland in the city of Dundee?
I understand that, at the moment, you are in Dundee house, which is the local authority’s headquarters in Lindsay Street, and that there is an 18-month lease from the council on the accommodation that you are using. When does it end?
I do not have the date in front of me, but I can say that our relationship with the council is such that we are working with it daily to see whether we could roll the date forward, if need be. We are working on a more permanent solution for our accommodation in Dundee. Discussions are at a fairly advanced stage, but they are commercially restricted so I do not want to put any more detail than that in the public domain, at the moment. We are working very closely with both the council and Government property colleagues to ensure that we will have a more permanent site in Dundee.
Would you prefer to have your own building for your 750 staff in the city, and for that to be secured at the end of the 18-month lease period?
Yes—that would be our preference. For local culture reasons we are keen to try to keep all our people in Dundee in the same building. As members will know, the significance of running such an operation attaches not just to delivering the benefits—although that is clearly important—but to the way in which we do that and the culture behind it. It is our belief that doing so from a single site would be beneficial.
The convener will probably know the Dundee property market better than I do, but my view is that the city has a relatively restricted amount of commercial buildings. However, having our own building would still be our preference. It is worth saying that we would also prefer to have a building that feels connected to communities. We have been very clear that we are going to be a new public service, so we do not want to have a building in which our people are simply locked away somewhere and do not see the clients whom they serve. We are keen to ensure that the site will be accessible and will feel like part of the community and the city.
By that, do you mean a city-centre location rather than a more outlying one? Is that how I should interpret what you have said?
That would be our ideal. We want a place from which people can move around, so that when they leave our building they are able to engage with the city, to use local facilities and businesses, and to access good public transport links, which are also important for environmental reasons.
My interpretation of the commercial property and office accommodation situation is different from yours. There is in the city plentiful office accommodation that is empty at the moment, so I am sure that Social Security Scotland will be able to obtain a lease quite swiftly. I wish you all the best with that. I am delighted that the 750 jobs will be in the city.
Anas Sarwar has questions on the recruitment process for the remaining staff.
Mr Wallace, if you cannot a find a building in Dundee, we in Glasgow would be happy to look for one there for you. [Laughter.]
I do not think that that will be necessary, Mr Sarwar.
Of course, I said that as a joke; I do not want to incur the convener’s wrath.
Or in Airdrie.
I want to pick up on the point about workforce challenges, which we have consistently heard about from all parts of the public sector, so they must exist in the social security field, too. Before we deal with those, will you clarify the number of staff on the programme side of the social security system, which was outlined at the start, and for Social Security Scotland itself? What are the workforce challenges in both those parts?
Within the programme, the resourcing is being well managed. We are looking at the specific skills that we require. We have augmented our skills and capability to find the appropriate skills with a new workforce planning group and a dedicated programme resourcing team. Stephen Kerr will be able to say more about that. I know that the agency has ambitious plans for recruitment, not least around the Scottish child payment. David Wallace will be able to say more about that.
I will also bring Alison Byrne in to touch on the activity that is under way.
As you heard from Andy McClintock, there is a digital component across the programme, so there is a huge push to recruit people from the public and private sectors in Scotland, and sometimes from the rest of the UK, to work on the programme. The Scottish Government is an attractive place for people to work because of the challenge that we offer people and the environment that we ask them to work in, so we are doing quite well by putting an offer on the table that people think is comparable to other opportunities that they might have.
Andy McClintock has also done a lot of work on growing the base of digital skills in the organisation—he can talk a bit more about that. Again, we have done a huge amount of work within the Government to increase our capability in programme planning, risk assurance, and finance. Those skills are not plentiful, but we have been working closely with our colleagues in the people directorate, using recruitment processes that attract people to the organisation.
So far, we have found that we have the right blend and mix of permanent members of staff and civil servants who will be in the programme and the directorate for this period, and who can then take their careers further, within the Scottish Government. That is a temporary resource that is a much-needed part of overall resourcing. We do not want to stuff the Scottish Government with people who have a specific skill set that we need only for one moment in time, and to whom we might then have trouble offering opportunities in the future.
That is broadly how things look from the programme and directorate points of view. David Wallace might want to say something about the recruitment method in the agency, and Andy McClintock might want to develop some of the points about digital.
From an agency perspective, we are pulling in more of the generalist skills that we need to service clients. That is our main growth activity. As the Audit Scotland report points out, we have found quite a good market for those skills.
To go back to my earlier point, we are keen to ensure that the way we recruit people is important. We are reaching out to people who might be further from the employment market. As long as people have the right attributes and attitude, we can pull people in and skill them up to do the jobs that we need them to do. We have therefore been working closely with employment services in Dundee and Glasgow in order to make sure that our workforce represents Scotland. We have focused on protected characteristics and various socioeconomic backgrounds in order to get a blend of skills into the organisation.
Our recruitment has focused very much on how we go about doing that through making recruitment feel open. Andy McClintock will say a bit more about the digital and CDO skills, but as Lesley Fraser said, Andy services both the agency and the programme, so he is recruiting on the basis that some of those whom he is recruiting might be permanent resources who will, in time, migrate across to the agency.
I will pick up on the digital footprint. When I was before the committee 23 months ago, I had a headcount of 15 people in post. As of today, I have 141 in post, 67 of whom are permanent staff.
The digital skills shortage in the UK is no secret. It is amplified in Scotland and it is polarised in Glasgow and Edinburgh. In the past 23 months, we have put a lot of effort into bringing a lot of new people into the organisation from across the UK Government, the Scottish public sector and the private sector. I have people in my division from financial services, travel, the retail industry and various other sectors. We have brought into the division a cross-section of people who have good skills and form a rich field of talent.
As David Wallace said, my job is to build capability for the programme now and for the future of the agency. My division will eventually move into the agency and become its digital division.
Although I will never fill my entire headcount with permanent staff, because we will always have a small contingent workforce, we are building a good mix of people from a range of backgrounds. We have gone from having 15 people 23 months ago to having 141 people now in post, which is significant. In those 23 months, we have run nearly 40 separate recruitment campaigns. For every single post in my division, we can evidence that we have gone out to the market to look for talent in Scotland and across the United Kingdom using a variety of channels.
The Auditor General’s report says that the programme is expected to need a core workforce of 345, and that it runs routinely with 30 per cent of those posts unfilled. Does that include those 149, or are they separate from the 345?
I will let Alison Byrne speak about the programme headcount in a moment. On my headcount, the figures that I have given you are just for the digital division, which supports the programme and the agency. The figures evidence how far we have come in 23 months in trying to build a sustainable digital command.
We have figures on the total number of programme posts and the number of unfilled posts, and there will probably be similar figures for Social Security Scotland.
We currently have approximately 350 staff working in the programme to design and build the services that David Wallace and his team go on to deliver. The—
I am sorry to interrupt, but does that include the 149? Are the 149 on top of the 345 or are they included in it?
It is 141.
I apologise. Are there 345 plus those 141, or are the 141 included in the 345?
The figure of approximately 350 staff that we have at the moment is just for the programme. Andy McClintock’s resources are over and above that.
The vacancy rate that is referred to in the Audit Scotland report was a snapshot at a time when the programme was reporting an annual vacancy rate. Previously, we set out where we wanted to get to with the recruitment plan over the course of a year. We have changed the way that we report against our recruitment and how we profile our staff. We now try to bring in the staff at the right time to do the jobs that are needed at that point in time. For example, we would not take in somebody in April to do work that was not needed until November. We now report monthly on the month by month recruitment targets against the profile that we have over the course of the year.
In the programme, we recognise the recruitment challenges that Audit Scotland has set out. As Andy McClintock and others have said, those challenges are not unique to the Scottish Government: they affect the wider public sector. However, we are taking a number of measures to try to ensure that we have the right people with the right skills in post to deliver the benefits that we are developing.
For example, we are doing quite a lot of work to recruit and train our own staff with the skills that are needed in the programme. User-centred design is a key role that we need—it is about user research and business analysis in a digital environment. We are training our staff in that so that we can leave a legacy for the Scottish Government, and so that we do not rely on external recruitment all the time.
We take a resource-pool approach. The workforce planning group looks at how we allocate specialist skills across the programme, so that they are not aligned just to one particular project, and so that we can flex and change the resource to meet delivery priorities as they arise. We try to retain and redeploy resources within the programme. The workforce planning group takes a strategic view about what happens when people roll off one project, where they go on to, and how we move the skills around the programme.
A key issue is how we work with contractors. With some of our key delivery posts, for which we perhaps would not get the necessary skills in the Scottish Government, we have key contractors who are upskilling Scottish Government staff and passing on expertise from the wider public and private sectors.
I want to go back to the discussion about governance and structure. I have a question for Lesley Fraser. Once, when we had Paul Gray at the committee talking about the national health service, I asked him whether the buck stopped with him, and he confirmed that it did. Are you Paul Gray in terms of social security?
I am Paul Gray in terms of social security. Yes.
What? Are you retired? [Laughter.]
No, I am not retired.
That is good to know.
You said that you agree with the recommendations in the Auditor General’s report. I had assumed that you agree with the messages, but I want to confirm that, because I think that Stephen Kerr said that he had a disagreement with Audit Scotland.
I took a different view on a particular example that Audit Scotland cited on how the governance worked, but I agreed with the general point about the need to make decisions as quickly as possible in the programme.
What about the key messages in the report?
It has been incredibly useful for me, coming into post, to have a high-quality report from Audit Scotland. The key messages that Audit Scotland picked up are exactly the ones that I am finding that the programme and the agency are already seeing. There is a strong alignment between the work of the programme and the agency and the Audit Scotland report. As an accountable officer, I find that reassuring at this point.10:00
Key message 4 in the report is:
“The Scottish Government does not yet have a clear understanding of the key things needed to deliver all remaining benefits in the way it intends. This includes not monitoring and reporting on how much it will cost to fully implement all the benefits.”
How could that happen? Have you fixed that?
That was what Audit Scotland reflected when it was doing the investigative work.
I think that we got the report in May.
That was in May. I think that the work was undertaken earlier in the year. Since February, the programme has made significant investment in workforce planning, planning and governance, and financial reviews, and all of those are feeding into the refresh of the programme business case. That will set out all the work that is required for wave 2, how that will be financed and resourced, and how the governance around that will work. That work needed to happen in the past six months. I am sure that, with the quality of the processes that I am seeing and the pace and focus of that work, it will conclude shortly and we will be able to discuss it with ministers.
So it is what it is, as we might say. However, are you saying that you will have that “clear understanding” in the next six months and that Audit Scotland will not make that comment again?
I am optimistic that, when Audit Scotland comes back to the programme, which I think will be in a month’s time, it will see significant progress in those areas.
That does not sound like a yes, exactly.
The agile process that we are following means that we are able to flex and iterate, depending on the circumstances and events that the programme encounters. It has meant, for example, that we were able to bring the Scottish child payment into the programme by adjusting other planned activity to enable that to happen. That required all the different elements—the workforce planning, the planning of activities and finances, and the governance—to be adjusted and made robust for that programme of work. That is exactly what is coming together in the refresh of the programme business case.
Do you have further questions, Mr Bowman?
It would be helpful if you could make them brief.
Does the programme plan that you mentioned, which we will see, run for the next five or six years?
It runs for the rest of the programme, which is through to the end of 2025.
How much detail does it go into on planning for people’s work? Do you know what you will be doing on, say, 5 September 2023?
It will not work exactly like that. We will need to keep learning and iterating as the work rolls forward, but the programme will set out the critical path of activities so that we understand all the interdependencies not just within the programme that you see represented around this table but in our relationships with the DWP, for example. We will understand where significant risks sit and have plans in place to mitigate them, and that we have choices and options about ways to manage those risks as the programme of work unfolds.
It is part of the programme that it has to work in that agile way. If you had asked two years ago whether we would know what we would be doing today, we could not have imagined the Scottish child payment, for example. Therefore, we need to work in a programme that has the room and flexibility to bring components in or move them out.
We absolutely understand what we have to deliver by 2021, 2022 and so on. How the plans develop over time will depend on whether any further ministerial commitments are made and the delivery schedules that we are working on for the benefits.
Would you have known where you would have been had you not had the extra payment to make?
Yes, because we had a plan in place to deliver benefits to a certain timetable. The plan has been adjusted to accommodate the Scottish child payment.
Alison Byrne talked about what Audit Scotland has said about staff numbers, and she said that the Government is changing the way that it measures those numbers. Is changing the methodology a way of trying to dodge what Audit Scotland found?
No—absolutely not. The new system provides a more nuanced and granular way of understanding how we bring together our resource, delivery and finance plans in order to understand what workforce we need at a particular time to deliver. For example, if suppliers come on site a bit later than had been originally planned, we do not need staff on the ground to interface and work with them at that point. The system gives us a much more nuanced understanding of the staff we need at a given point in the programme, given the work that is under way and what needs to be delivered, as opposed to looking at an annual target that lumps in all the work for a year and does not tell us what staff we would need on the ground at any point in time to deliver, according to the delivery plans. It is about getting a much more granular understanding of the alignment between our resource, finance and delivery plans.
I have a follow-up question on the digital staff footprint, which was raised earlier. I think that Andy McClintock said that the proportion of permanent staff to contract staff is roughly 50:50.
It is 52 per cent to 48 per cent.
That is good. It is not unusual to have such a high component of contract workers. Those workers tend not to stay particularly long on projects—usually about six months or so. Will you give an assurance that the codes that such workers leave behind for others will be well documented, so that others can pick up the software that they leave behind and we can add to it, adapt it or repurpose it, if required?
The short answer is yes. Everything that we code and document is stored centrally in the range of tools that we have. We go through a process of continual learning and knowledge and skills transfer from our interim contractors to our permanent staff. The pace at which we produce technology, artefacts, designs, drawings and codes helps us to create rich assets of information, and we are now looking to share some of the digital assets that we have produced in the wider public sector.
As members have no further questions, I thank our witnesses very much for their evidence.10:07 Meeting suspended.
10:12 On resuming—
Section 23 Report
Section 23 Report
“Scottish Public Pensions Agency: Update on management of PS Pensions project”
Item 3 is the section 23 report, “Scottish Public Pensions Agency: Update on management of PS Pensions project”. I welcome our witnesses from Audit Scotland: Caroline Gardner, the Auditor General for Scotland; Stephen Boyle, audit director; and Tom Reid, senior audit manager.
I understand that the Auditor General would like to make an opening statement.
Caroline Gardner (Auditor General for Scotland)
Thank you, convener. I will be very brief.
The purpose of the report is to set out the problems that the Scottish Public Pensions Agency has experienced in implementing a major new IT system, and the financial implications of those problems. The agency’s principal role is to administer and pay pensions for members, deferred members and pensioners of national health service, teachers, police and firefighters pension schemes in Scotland.
In October 2015, the agency awarded a £5.6 million contract to Capita Employee Solutions to deliver a unified pensions administration and payment system. The new system—PS pensions—was to be operational by March 2017. In February 2018, the agency’s new chief executive decided to close the project. The agency spent £6.3 million on the project and has written off £1.6 million in capitalised assets that will no longer be used.
The closure of the project means that the agency has not been able to progress its strategic, business and workforce plans as originally intended. As a result, it expects to need an additional revenue budget of £9.8 million between 2019-20 and 2022-23. It also needs capital allocations of £13.6 million over the next five years. The agency has extended contracts with its existing suppliers to ensure that payment of pensions is not affected by the closure of the project.
In October 2018, I published a section 22 report on the matter but, at that time, I was unable to report on the reasons for the project’s failure, due to an on-going legal process between the agency and Capita. I prepared the section 23 report following the conclusion of the legal process. The settlement included a payment of £700,000 from Capita to the agency.
Responsibility for the failure of the project was shared between Capita and the agency. Capita failed to meet any of the agreed milestones for the project and was unable to provide a working system. Changes in the SPPA leadership and in the management of the project made it more difficult for the agency to manage the supplier effectively and properly hold it to account. The situation was compounded by inadequate governance and project-assurance arrangements. In my report, I concluded that the SPPA failed to achieve value for money for the project.
The team and I will do our best to answer the committee’s questions.
Thank you very much.10:15
A key issue that jumps out is something that you touched on about governance. The turnover of key members of staff seems to have had a significant impact on the project. You said in the report that “the lack of continuity” in those roles made it difficult for proper scrutiny of and challenge to Capita. What was the reason for that high turnover? Were those members of staff pushed?
You are right that there were significant changes in the roles of chief executive and senior responsible officer for the project. We aimed to summarise that in exhibit 1 on page 10 of the report. There is not a single reason for it. A number of things are going on. With Tom Reid’s help, Stephen Boyle will take you through that.
Stephen Boyle (Audit Scotland)
Exhibit 1 outlines the volume of changes in the project that Colin Beattie mentioned, both in the accountable officer/chief executive position and that of the senior responsible officer who was leading the project. That volume was much more than we typically see over the life of a project, and that was a key contributory factor in the project’s lack of success.
There were a number of reasons. We are not aware that any individuals were pushed out of the organisation as a consequence of the unsuccessful nature of the project. There was a range of factors, which we capture in the exhibit, such as secondments to the Scottish Government, retirements and people changing jobs. There was no one reason. We are not aware that anyone was asked to move on from any position that they held during the course of the project.
That was a key project for the SPPA. Surely, someone would have noticed that, due to the extraordinary turnover, there was instability in the governance of the project. Did anybody query it?
You are right. People who worked in the agency would have noticed and the management advisory board would have been aware that there were changes in the leadership of the project and the agency. We are not certain whether any conversations took place that sought to intervene or address those changes in leadership.
The other thing is that, from what you are saying, the project board members seem to have been kept in the dark. According to your report, they specifically asked for
“budget and cost information”
“reporting on the progress of the project.”
Is there any reason why they did not get that? It seems like déjà vu from other projects that we have looked at.
You are right. In paragraph 22 of the report, we comment on the circumstances that you outlined about the lack of information provided to the project board. As the project developed, that was raised by members of the project board.
We also made a wider point about governance and the role of the management advisory board, which is there to support the accountable officer in their decision making. At the key early stages of the project, the board members were not provided with enough information to support its implementation and then take it through the delivery phase.
When they did not get that information, what did they do about it?
The governance arrangements were changed during the course of the project. Near the beginning of 2017, the SPPA sought to bring in extraordinary audit and risk committee meetings and extraordinary management advisory boards to consider how well the project was being implemented. In our view, that happened too late. There needed to be stronger governance right at the infancy of the project.
That brings me back to the original question that I asked. Why were those requests not met? Was any reason given?
We are not sighted on the reason why. The SPPA would be better placed to answer that.
As a result of previous reports from the Auditor General, we have raised the question of governance and, time and again, we have come across instances of information not being passed on to the people who are responsible for governance, whether that is the board or others. We have another example of that here.
What did the individuals do? Did they make a noise about it? They were obviously unhappy at not getting correct information. This is basic stuff: budget and cost information and a report on the progress of the project. They could not possibly do their jobs without that basic information, so what did they do about it?
We agree, Mr Beattie. Basic information about the project was missing.
Do I take it that they did nothing?
As I said, it might be a case to be explored more closely with the SPPA. From the conversations that we had with board members, we understand that they made attempts to ask for more information. Belatedly, they got that, probably with the creation of more substantial governance for the project at the beginning of 2017. However, that was quite a long time lapse, and there ought to have been stronger representations insisting on more information being provided, essentially so that non-executive members of the management advisory board could better fulfil their responsibilities of supporting the accountable officer.
It would appear that the efforts to get more information were pretty feeble. Who was responsible for providing the information to the project board? You said that they asked people, so who did they ask?
Responsibility rests with the senior responsible officer for the project, who is tasked with supporting the project board in their consideration. Ultimately, the senior management team is responsible, through its support of the accountable officer, as is the management advisory board in discharging its responsibilities of advising the accountable officer.
So the senior management team did not respond to requests from the project board for that basic information.
That is certainly our understanding. As I suggested, we saw improvements as the project evolved.
It is worth adding that one of the issues in this instance, as in others, is a confusion of roles. The chief exec of the agency is the accountable officer and also a member of the management advisory board—as it is an agency, it has a management advisory board and not a standard board. That individual also chaired the programme board. That confusion of roles makes it harder to hold to account those who should provide the information.
We have seen something similar in other cases, where the chief exec has been very involved in the hands-on detail of a programme, making it much harder to spot and react when problems start to emerge. That is some of the context for what Stephen described.
As a result of your report and everything that has come out, is there now a proper structure in place?
We think that lessons are being learned. At the end of the report, we talk about the actions that the new chief executive has taken since she took up her post, including closing the old project and carrying out a lessons-learned review that used our publication, “Principles for a digital future”, to look at what was missing the previous time and what needs to be in place now.
They are also planning to take a more incremental approach to the replacement—which still needs to happen—than was intended this time.
It is too early for us to give you assurance that all those lessons have been learned and put into practice.
I want to focus on the Scottish Government’s interaction with and role in all of this. At the start, who was the responsible individual at the Scottish Government for oversight of the project?
There is a sponsor department in the Scottish Government, and the team will confirm for you who the sponsor is. There is also a less direct accountability relationship with the digital directorate and internal audit, which play a role of support and challenge—you will see that coming through in the report. I ask Stephen Boyle to confirm who the sponsor relationship is with, to ensure that we get that straight.
The Scottish Government sponsor is Gordon Wales, the chief financial officer. The sponsor has changed a number of times since the conception of the project. It was the director general for finance, Alyson Stafford, at one stage, and one of her colleagues had the role at various points during the project.
The report has clearly flagged up failures of the SPPA. What failures has it identified in the Scottish Government’s interactions with the SPPA and in its oversight of the project?
We set out in the report a number of interactions between the SPPA and the Scottish Government at various stages. There were some instances where concerns were raised by Government—including right at the beginning, around procurement—but they were not acted on by the agency. In response to your direct question, I note that there was a point at which the office of the chief information officer carried out a review, which gave assurance about procurement and the contract that had been put in place. We have not seen evidence to support that assessment. Our view is that there were problems that were not properly recognised at that stage.
An example of the interaction is when the SPPA said to the Scottish Government’s legal department that it did not have the skills that it required to enable it to negotiate. You rightly highlight in the report that the SPPA did not take the necessary steps to find those skills, but surely there was a point at which the Scottish Government should have asked what further support it could give, whether that involved imposing something or directing the SPPA to do something. Why did the Scottish Government not do that?
We refer to those events in paragraph 15 of the report. In that instance, I think that the responsibility lies with the SPPA. It was given a clear steer that the tender fell into the category of being abnormally low. That raised questions about whether the supplier would be able to deliver, and the SPPA was advised that additional inquiries should take place. The SPPA said that it did not have the resources to do that, and it took no further action. I think that the responsibility in that regard sits with the agency.
I accept that, but is there a lesson to be learned—not just for the agency, but for others—that, if an agency that is an arm of the public sector recognises that it does not have the necessary skills or looks as if it is failing to take appropriate action when it is told to do so, the Scottish Government should step in or at least interact with it more to minimise the risk of a mistake taking place?
I think that that is the wider lesson. Since those events took place, there have been changes in the way in which the Government aims to provide challenge and support to public bodies that are undertaking big IT system projects. We have also talked a lot in this committee about the need to prioritise that and ensure that the support is provided in the right places. That involves difficult decisions about how the people involved recognise the warning signs and respond to them, given the scale of digital development that is going on. You got a sense of that in the earlier session this morning in relation to the scale of the social security programme and the amount of attention that it is taking up in a field of limited people and skills.
You mentioned the review. I will quote one sentence from it. It says:
“careful attention needs to be paid to the procurement process, which faces a number of challenges around requirement definition, resources and its timeline”.
That review of the SPPA’s activities was undertaken by a Scottish Government officer—is that right?
Will you give me the paragraph number that you are referring to?
It is paragraph 18.
Yes. That quote comes from the Scottish Government’s programme and project management centre of expertise.
The SPPA did not act on that recommendation in the Scottish Government’s review.
That was not a review of the SPPA specifically. What you are referring to is the traffic-light rating system that was used at that time by the centre of expertise. The review gave an overall rating of “Amber/Green”, which is the second bullet point in the list in paragraph 17.
What lesson will the Scottish Government and others learn from that paragraph in relation to other things that we do around agencies in future?
It is fair to say that things have moved on significantly since 2014 and 2015, when these things happened. We reported to the committee before the summer recess on progress with enabling digital government and on some of the improvements that have been made, as well as some of the risks that remain. I think that the biggest risk is exactly the one that you are trying to probe. Given the range of digital programmes that are under way and the scale of the investment, it is important that it is clear how Government prioritises which programmes it wants to get involved in and that it has in place a good risk monitoring system to spot the early warning signs and respond to them.
Given that we have had a number of issues around IT projects and how agencies procure support, is there a role for the Scottish Government to set up an expert group that considers procurement and IT, rather than leaving it to the agencies to engage in negotiations and put the teams together?10:30
That is one of the issues that we explore in the report that I just mentioned. I think that the committee is planning to take evidence on it in due course, and that is a question to explore with the Government.
Given the scarcity of IT skills across the country and their cost, there is clearly a real challenge around how the Government makes sure that it has the right IT skills and expertise in place, and then how it makes sure that it has a clear line of sight of when they are needed so that the rolling-on and learning from one project to another can happen well. How it does that is a matter for the Government, but we have clearly identified the need for it to have much clearer sight of what is needed, where and when so that it can make sure that those skills are in place.
Liam Kerr has a brief supplementary question.
I might be completely missing something, but how does it work in terms of the finances? Did the SPPA have £5.6 million sitting in the bank that it could spend, or was it incumbent on it to go to the Scottish Government and say, “We’ve procured the system and this is how it’s going to work, so we need to have £5.6 million signed off and in our bank account at some point in the near future”? Who made the decision to go ahead?
I will bring in Stephen Boyle in a moment. However, a key finding of the report—as of others—is that the SPPA did not have a clear business case that set out what it wanted to achieve, the scope and what it was likely to cost. It is certainly not the case that it knew that it needed £5.6 million and went and asked for that funding. Stephen Boyle will flesh that out.
Like other agencies, the SPPA participates in the annual budget-setting process. Broadly speaking, it submits budget bids that are considered among other priorities and are subject to approval by the Parliament before the start of the financial year through the budget act.
The total of £5.6 million was phased over the lifetime of the project. Although the Government would have been aware of the totality of the sum that would be requested or that was anticipated to be needed, it would not be factored in, in totality, as a transfer of cash to the SPPA.
No, but your report says that the SPPA came forward with an inadequate set of propositions. Someone in the Scottish Government looked at that, said that it was clear to go and gave it the green light when, based on the conclusions that you have drawn, they should perhaps not have done so. Am I drawing a fair conclusion?
We would suggest that the project was not sufficiently joined up between the agency and the Government—not just on finance, but more generally in relation to the assurance reviews that the agency was supported to do with the Government and the procurement advice that it received. As the Auditor General suggests, matters are improving. However, at the time, the project was not sufficiently well co-ordinated or challenged.
Good morning, everyone. We have had reports such as this one before. It seems to me that, at the heart of some of these software projects, we do not have a clear understanding of the requirements, and the case that we are discussing is a perfect example of that. Will the Auditor General tell us a wee bit more about that? It seems to me that there was no clear specification of the requirements. In the past, I have used the analogy that building a piece of software is—in principle—the same as building a house, in that people have to specify what they want. They do not just ask a builder to build them a house and take what the builder gives them. They specify what they want, and it is the same with software.
Caroline, you said that, ultimately, Capita was unable to provide a working system. What was the reason for that? Did we not get clear specification of what the requirements were, or was there just a complete lack of skills in the mix to deliver what was supposed to be done?
To start with, you are absolutely right about the foundations. In this case, as in other cases that I have reported on, the foundations were not there. I say in paragraphs 7 to 9 that there was no clear business case that set out what the SPPA wanted to achieve, the scope, the likely costs, the governance arrangements and so on.
There was a paper for the senior management team in September 2014 that outlined three options. There was the option that it went for—the highest risk one—of a fully integrated, bespoke system; the option of separate solutions for pensions administration and member services; and the option of separate systems for all the things that the SPPA wanted to do. That paper set out the advantages and disadvantages of each option, but it did not go through a proper options appraisal, which we would expect to see, and I imagine that you would as well. The paper was not presented to the management advisory board for consideration. Like you, my sense is that people were making decisions without fully understanding what they were signing up for and what risks were involved.
As we said at the beginning of this session, there were significant changes at both the chief executive level and the senior responsible officer level, which made it harder to keep the oversight and challenge of what was going on. When alarm bells were sounded, for example around the procurement process and the abnormally low bid from Capita, those warnings were not acted on, and that carried on all the way through.
As we explained to Mr Beattie, the chief executive at that point was on the management advisory board, the senior management team and the programme board. That is important because it meant that there was not the degree of distance and separation that we might expect, which would have made it easier to challenge what was happening. It was not until the new chief executive came along, took a step back and looked at the progress—or lack of it—that decisive action was taken.
I cannot comment on the reasons for Capita’s inability to deliver on what it promised, beyond what we know about the abnormally low tender. However, the fact that the settlement that was reached with it after the legal process included a payment of £700,000 from Capita to the agency tells me that there was some admission of liability in there.
Your timeline of events in appendix 1 on page 16 shows that the whole project started in December 2013 and that the software started to throw up errors in June 2016. It was three years before it was discovered that user acceptance testing was identifying a high level of errors. That is quite a long time for errors to be discovered in a project that was due to be delivered the following March. That is a ridiculously late point in the project lifecycle to discover that there were errors with the delivery of the software. Am I reading the timeline correctly?
I think that you are reading it slightly wrong. You are right that the process started in December 2013, but work did not start on the project until December 2015—the box just above the timeline points that out. Problems started to emerge quickly after that. There was a long gap between recognising the need for the project and starting work, because the SPPA did not have the people it needed to do the procurement well, so there were delays, which we outline in the report.
Those delays did not lead to a rethinking of the timeline for the project as a whole, because the expiry of the SPPA’s contracts with its existing providers meant that it had a ridiculously short time to deliver the whole thing—I think that it was planning to go from agreeing the contract to having the project up and working in 18 months, which, as we say in the report, was never going to be realistic. It was the front-end problems that led to the back-end failure of user acceptance testing.
That is a common message that this committee has heard before; if you do not get it right at the front end and the preparation and planning are not done correctly, you will pay the price at the tail end of a project. The principles for a digital future have been pretty well established for a wee while now. You are saying that the SPPA did not really embrace those principles; did it even know about them? It seemed to have the Prince2 development methodology in place but, from what I read in the report, it did not apply it. Is there a sense that the SPPA was unaware of the whole approach to delivering digital solutions?
When the SPPA started the process, it was before we had published our “Principles for a digital future” document, but you are right—that document was not original work; it pulled together existing good practice. In my view, the SPPA did not recognise the scale of what it was trying to do and the risks involved, and it did not have the skills to manage it. Stephen Boyle can tell you more about that.
One of the conclusions of the internal audit that reviewed and reported on the progress of the project in September 2017 was that although there was an awareness of good project management methodology—the Prince2 methodology—it was not followed effectively. The Auditor General mentioned the “Principles for a digital future” document, which came out in 2017. By that stage, the project had got to a point where the seeds of what contributed to why it was unsuccessful had been sown many years before.
Mr Coffey made a point, which we also make in our report, about the absence of an effective business case setting out right at the project’s infancy what the agency hoped to achieve from it, and the lack of a clear and detailed scope or methodology for what the agency expected the contractor to deliver. All those factors, along with Capita’s unsuccessful attempts to meet project milestones, were key contributors to the project’s failure.
Good morning. The questions that Colin Beattie asked at the outset were good ones, and I want to go right back to the start. In paragraph 8 of your report, you say that there was no clear business case for the new system, but an options paper was prepared and presented to the senior management team. However, that options paper contained no costs, benefits or financial information. Do you know why that was the case?
I will ask the team to answer the why question, but it is worth noting that the options paper was presented later than it should have been; some key decisions had already been taken by then.
We are not entirely clear as to why a detailed cost benefit analysis was not set out in the options paper. As we say in the report, the fact that governance decisions were taken without the availability of complete detailed analysis and scrutiny right at the start of the project was a key factor in why, ultimately, the project did not succeed.
The members of the senior management team are undoubtedly paid a decent amount of money and have qualifications to be on the team. Is there any evidence that any of them, at any point, said, “Look, this options paper has no financial information and no information about costs or benefits, so shouldn’t we be getting some more information?”?
We do not think that they did. As we say in paragraph 9 of our report, we know that the options paper was not taken to the management advisory board and we think that it should have been. The board should have had the chance to scrutinise it for exactly that reason. If the senior management team was not asking those questions, somebody a bit further removed should have been.
That is exactly the point. Do you have any evidence as to why it never went to the management advisory board?
We do not understand the rationale for that, which is why we have reported in the terms that we have.
I will finish by asking you to speculate, if I may. If that process had taken place and the SMT had referred the options paper to the management advisory board, is it possible that things would have played out differently?
Speculation is always dangerous. One of the reasons why people do not make that sort of referral upwards is because they not understand the risks that they are managing. My hunch is that that is what happened in this case. One of the particular features of executive agencies is that the management advisory board does not have the same status and clout as the board of a non-departmental public body or a health board, for example, and it is harder for its members to insist on getting the sort of information that they require. That goes back to Mr Beattie’s question. I said to him that one of the challenges was that the chief executive was the accountable officer, a member of the management advisory board and the chair of the project board. Such blurring of roles does not help at all.
Following on from that, paragraph 22 of your report says:
“The project board was chaired by the Chief Executive”
“there was a lack of finance information ... We note that members of the project board requested more budget and cost information.”
If the chief executive was chairing that meeting, why was he not able to provide that information to the board members?
As the wording makes clear, rather than the chief executive—the accountable officer—insisting on it, it was members who wanted clearer reporting. I suspect that that goes back to the point about the blurring of roles. Stephen Boyle and Tom Reid might be able to add to that, but I think that that blurring is a key factor.10:45
That is exactly right. There was also the change in leadership. The chief executive, in chairing the project board and the management advisory board, had that awareness, but there was an issue about whether that awareness and understanding of the progress of the project and its costs were shared across the project board and the management advisory board. That was a key factor. There was insufficient scrutiny and understanding of the initiation of the project and how well it was progressing over its life.
We may decide to take up that issue. Last week, we released our thematic report highlighting themes that keep coming up in reports, which include IT issues, leadership and governance. In a way, this is a classic report from you, Auditor General, because it highlights all those problems.
At the very least, it is a good example of the concerns that we and you have raised a number of times about major IT projects and of why good governance matters and what happens when it is not in place.
I agree with all the points that members have made. This is almost a case study of how things can go wrong and people can know about it but that knowledge does not work through.
I might have missed this somewhere, but was there an audit committee in the organisation?
Yes. The audit and risk committee is part of the governance structure of the SPPA.
What was it doing?
Similarly to what we said in earlier answers, the consideration and oversight of the audit and risk committee strengthened during the life of the project, particularly as extraordinary meetings of that committee and the management advisory board were brought in. There was awareness of the issue, but we think that the audit committee could have had a role at an earlier stage to support the accountable officer.
Did the audit committee’s knowledge or involvement actually mitigate anything?
In the report, we make a point about the role of the internal audit function, which made suggestions about how it could help the audit and risk committee and the agency more generally in relation to the progress of the project, but that offer was not taken up by the management or pushed through by the audit and risk committee. The offer was made in 2016, but the internal audit reporting did not happen until much later, in 2017. Some of the findings from internal audit about the unsuccessful nature of the project are quite significant.
I know that you do not like to speculate or to name names but, from your knowledge of the audit committee, should its members have had the skills or competences to make more of the issue?
The audit and risk committee membership has changed over time, but its members have included experienced accountants and auditors. Therefore, the issue was not necessarily a skills deficiency in the committee; it was perhaps more about the information and the sense that the members of that committee, as part of the executive agency model, discharged their role differently from what we would see in a non-departmental public body or a health board.
I have a brief question on an issue that the committee has been concerned about in relation to many of the reports that we have looked at. The report identifies various failings by individuals, including senior individuals who are no longer at the agency and who have, I presume, gone elsewhere to progress their careers. I am not seeking specifics at this stage, but if I were to ask a general question about whether you know where those individuals have gone in their careers, would you be able to answer me?
I can go a bit further than that. Again, I refer you to exhibit 1, where you will see that, in the key period that we are talking about, a long-standing chief executive left through retirement in April 2015. A chief executive was then appointed in July 2015 and left in March 2017, with a secondment to the Scottish Government in between during a key part of the process. That chief executive resigned and there was no settlement involved in that. Then, after an interim chief executive, a new permanent chief executive was appointed in July 2017, and it was that new chief executive who decided to close the project based on the concerns that were apparent at that stage.
The office of the chief information officer concluded that the procurement process of the project was conducted in
“a robust and professional manner, consistent with due process”.
Do you know whether that office was aware of the advice provided by the Scottish Government’s legal department that more in-depth questioning of Capita’s bid was required and that the bid was accepted without that advice being actioned?
I do not think that we know whether that is the case. However, in paragraph 28, I say that we have not seen evidence to support that conclusion from the office of the chief information officer.
Do you know whether that office was aware that the Scottish Government programme and project management centre of expertise had highlighted that
“careful attention needs to be paid to the procurement process, which faces a number of challenges around requirement definition, resources and its timeline”?
As I said, I am not sure whether we can answer the specifics about what the office was aware of; I can only repeat what we say in the report, which is that we have not seen evidence to support the office’s conclusion.
Stephen Boyle might want to add to that.
In paragraph 28, we query the conclusion that the process was robust, particularly given the evidence that we saw about the exchange between the agency and the Scottish Government legal department. That calls into question the conclusion that was reached about the quality of the procurement process.
Is it Audit Scotland’s opinion that the procurement process was not robust?
As we touch on a couple of times in the report, an abnormally low bid was accepted and that was not subject to full scrutiny and challenge, which suggests that there were deficiencies in the procurement process.
We have a lot of figures on capital allocations that have been written off and additional revenue that has been required. Is it possible to provide an overall cost to the public?
I am afraid that that is not straightforward, which is why we have not done it in the report. That is mainly because, as we have seen elsewhere, the most significant cost is the opportunity cost. The SPPA intended to use the programme to change the way it operates and to generate future savings as well as improvements in the services that it provides to the pension scheme members, and those benefits have been lost. We have set out what the costs were, what has been written off and what has been recovered. We know that there will be future requirements to achieve those benefits, but it is not possible to put a single figure on what has been lost.
That is a pity.
Thank you very much for your evidence. We will now move into private session, so I close the public part of the meeting.10:52 Meeting continued in private until 11:30.