Justice Sub-Committee on Policing

Meeting date: Thursday, October 4, 2018

Official Report 696KB pdf

---

Pre-Budget Scrutiny 2019-20

Feasgar math, a h-uile duine, agus fàilte. Good afternoon, everyone, and welcome to the 10th meeting in 2018 of the Justice Sub-Committee on Policing. We have no apologies.

The first agenda item is an evidence-taking session as part of this year’s pre-budget scrutiny. Our focus will be on the financial aspects of Police Scotland’s planned spending on information and communication technology, and on spending on policing more generally. I refer members to paper 1, which is a note by the clerk, and paper 2, which is a private paper.

I welcome to the meeting James Gray, chief financial officer, Police Scotland; Martin Low, acting director of ICT, Police Scotland; and Kenneth Hogg, interim chief officer, the Scottish Police Authority. Thank you for your written submissions; as ever, they were very helpful to the committee.

Mr Hogg, I understand that this is likely to be your last attendance at a Justice Sub-Committee on Policing meeting, as you will be moving on from your role. I thank you for your work with and assistance to the committee and wish you well in your new post.

I declare an interest. I am the recipient of a police pension. Pensions are mentioned in the financial statements that we have.

As we are talking about ICT, I want to ask about the general lessons that have been learned from the i6 project. How will those lessons be used to shape what we will go on to discuss?

That is one of the questions that the SPA has been asking in relation to the proposals that Police Scotland has brought forward to reform its digital, data and ICT capacity. Several lessons were learned from the i6 programme, one of which was about the risks in taking a big-bang approach to change in the ICT area. The proposals that are now in front of us—the outline business case for the new digital, data and ICT programme was discussed and approved at the SPA board meeting last week—take an incremental, phased approach instead of a big-bang approach in order to deliver the benefits sequentially and not put all the eggs in one basket.

There are other differences between the i6 programme and where we are now. One issue that the SPA has taken an interest in has been Police Scotland’s capability to deliver change. We are content that, over the past year and a half in particular, Police Scotland has significantly increased its change management capacity to deliver a variety of changes. The team that Martin Low, as director of ICT in Police Scotland, leads is used to running a baseline of ICT services for the organisation but, in the past, it has not been asked to deliver anything of the scale and complexity of the new programme, so additional support has been brought in. That is a difference from i6.

The final point to highlight is that i6 was an ICT solution that tried to build on the best from the eight legacy forces and apply that across Scotland. The new proposals take a broader approach to develop an integrated digital, data and ICT programme to let policing perform well in the 21st century with 21st century technology. Everything from the way in which police officers engage with communities and with each other to the way in which they are able to tackle cyberthreats is different from what the i6 programme would have delivered.

I want to follow up on an aspect that you have not referred to. Our briefing refers to

“the decision not to seek to implement novel technological solutions”

and the fact that

“each of the elements sought in the”

outline business case

“is already in place in one of the other UK police forces.”

If that is the case, is there any danger that the time for which the equipment will have currency will be affected? I know that you have to go on it at some time and that there will always be new solutions, but was existing use factored into your decision making?

I will make an initial comment on behalf of the SPA; perhaps Martin Low could then comment from a Police Scotland perspective.

Unlike the position on i6, the business case does not seek to develop new and untested technology. Instead, it represents a step change from where Scotland’s capability currently is to where it needs to be in order to engage in a digital world. It is existing TESTA—trans European services for telematics between administrations—technology that is in place in other police forces elsewhere in the United Kingdom, but it is not old technology. There is currently 20th century technology that dates back to the old legacy forces and which suffered from a lack of investment, particularly in the run-up to the creation of Police Scotland in 2013.

Does Mr Low want to make a brief comment before I bring in Mr Stevenson?

Yes, please, convener.

I support what Kenneth Hogg said. We have made the point that nothing that we are looking to implement is bleeding edge. Almost everything that we have included in the ICT strategy is already being used in the wider public sector or somewhere in UK law enforcement. There is not a single force in the UK that has done everything that we propose to do, but everything that we propose to do has probably been done in one of the other 42 forces.

Again, to support what Kenneth Hogg said, we make that statement as a general principle in relation to technology sets. The convener is, of course, correct to say that technology will move on. We are looking to implement mobility for police officers. Most other forces in the UK have already done so. However, the technology in terms of the types of devices and approaches is moving, so our position is more of a general principle. We believe that it gives an element of confidence and mitigates some of the risk around such programmes, on the basis that the technology has been implemented and we are more than keen and willing to learn lessons from others who have gone before us.

Mr Hogg, in your introductory remarks, you made it clear that we have an ICT project, but it is running in parallel with a project that changes the way in which Police Scotland and the people who are employed in it work. In other words, it is about changing processes for human beings. I am relatively clear on who is in charge of the ICT project, but who is in charge of the project of change that relates to it, in so far as it affects people at Police Scotland and the structures therein?

The short answer to that question is the chief constable and, beneath him, the deputy chief officer with the support of his executive team colleagues.

Perhaps I could set that in context. In 2017, a 10-year policing strategy in “Serving a Changing Scotland: Creating capacity to improve” was agreed for Police Scotland. Mr Stevenson is quite right to point out that part of the ICT improvements are required not only to upgrade outdated core ICT capability for officers and police staff, but to enable a far wider set of reforms and changes in policing. To act as a key enabler of change, we need those ICT developments. That is being developed as a portfolio of change. It is managed in Police Scotland in the first instance, and it reports to a change board that, until recently, has been chaired by Deputy Chief Officer David Page; it is now chaired by Deputy Chief Constable Fiona Taylor. Those are the organisational arrangements for leading that in Police Scotland.

It is clear that the chief constable is responsible for everything—that is a given. You referred to Fiona Taylor, who has appeared in front of this committee. Who would get fired if that part of what is to be done was not done? It is clear that it would not be the chief constable, and it probably would not be Fiona Taylor. My attitude is that, if the matter does not rest at a single desk, it will not get done.

If you are referring specifically to the digital, data and ICT programme—

No, I am not, because I think that it is Mr Low who would get fired on that.

Thank you.

Forgive me, Mr Low. I hope and believe that that is a distant prospect.

As do I.

To be serious—I am trying to pursue quite a serious point—ICT projects can succeed as ICT projects, but the project as a whole can fail if the organisation does not respond to the changed ICT environment. The benefits are delivered in what people do, not by the ICT system. I want to be clear about who the committee and everyone else should hold accountable as the single person whose job it is to drive the change through. That ain’t easy, and I want to know who that is. I am asking about the function rather than necessarily the name of an individual.

Accepting that the chief constable delegates within his structure, the individual who is leading the wider programme of change is Assistant Chief Constable Angela McLaren, who is supported by a business change manager.

Is she doing that in the role of chair of the board that you referred to?

The chair of the change board is DCC Fiona Taylor, but she has specific responsibility for the broader programme of cultural change to support the ICT change.

Right. I do not want to spend any more time on that question, convener, but that was a good start.

I am sure that there is collective responsibility for driving the programme forward. For the avoidance of doubt, we want everyone to maintain their positions and work industriously on the public’s behalf.

Mr Hogg has said that he is relatively happy that Police Scotland has taken on board new capacity and capability around the technology space. Obviously, we are talking about a very big programme. Resource will be needed for it, but not thereafter, so there will be third parties contracted to deliver it. Can Mr Hogg or another witness outline how that will be approached? Will work packages be put out for tender to specific systems integration firms? How will it be ensured that there is not mission creep? I know that Ernst & Young is already engaged. Is there a broad approach to engaging third parties to deliver the work and to the commercial structures that will sit around them?

We have talked about the uplift in the existing Police Scotland change capacity and capability, but we recognise that, as you have suggested, that will not be sufficient to deliver a programme of that scale, so commercial engagement will also be needed. We have done some pre-procurement market engagement, and we are working through options for how that will look.

As members have probably gathered, there are several options that we could explore. We could have a single vendor that could partner with us to help to deliver the programme, or we could divide it up. You have identified the fact that a systems integration partner will be key. We will definitely need that type of support. The available options for how that will look and feel are being worked through.

The overall OBC was approved last week by the SPA and is being submitted for consideration at Government level, but we are not just sitting around waiting for the answer. We are doing further work to support the programme, including on the make-up and shape of the commercial engagement.

We all use a lot of abbreviations, but they make it very challenging for those who are listening. Could you explain “OBC”?

Sorry. The OBC is the outline business case.

I was about to ask when you would issue RFPs, but I had better not.

I am interested in the structure of the work packages—how they are put together and how they fit with one another at critical points. You have an outline business case. What is the timeline for putting work out to tender or for identifying the number of work packages in the overall work programme, which I understand is £300 million?

It is clear that some elements of that will be subject to funding decisions that have yet to be made, but I expect our plans and model to be fairly well advanced before the tail end of the year.

13:15  

The programme will be one of the UK’s largest IT programmes, so there is deep public interest in seeing it rolled out effectively. Obviously, there will be commercial sensitivities, but what level of insight will you be able to provide for us so that we can have confidence that the programme is progressing as we would expect it to?

If the committee wishes us to come back and share some of that information, I would be perfectly happy to do so.

Before I bring in Liam McArthur, may I ask Mr Hogg how the SPA will scrutinise third-party contracts, particularly those below the £500,000 threshold?

The process from now on is that, before contracts are entered into, an individual full business case will be developed for each component part of the programme. It will be in line with the available funding, once the Scottish Government has considered it and once the Parliament has approved a budget for next year. To pick up on Mr Johnson’s point, the individual components will come forward separately for SPA scrutiny and consideration before the contracts are let.

The thresholds will remain in place, but the SPA has taken a range of actions to assure itself of the robustness of this work. We have taken some of those actions at our own hand, through the engagement of officers and members with Police Scotland; some of it is about ensuring that Police Scotland’s own assurance systems are up to scratch and working appropriately; and some of it is about third-party scrutiny. For example, as part of the quality testing for the outline business case, our internal auditor, Scott-Moncrieff, was asked to review whether the OBC was fully compliant with Treasury green book guidance, which is part of the Scottish public finance manual. Its conclusion was that it did materially comply.

We also commissioned a Scottish Government-led technical review of the proposals, to give the programme a red, amber or green rating—at this point, it has rated it “amber/green”. Through a range of activities, we will be looking for detail and testing what comes forward, but it will be at individual component level and in addition to the global outline business case.

Good afternoon. I will follow up on your point about learning lessons from i6 and moving away from a big-bang approach and towards more of an integration with digital and data strategy. That suggests that this programme has more components. It would be interesting to know whether and in what way the approach to governance and assurance has changed as a result, both in the SPA and in the challenge and oversight function that you are looking for in Police Scotland.

This is a more complex and broad-ranging set of proposals than i6 was, and it has a far wider scope of aspiration and impact on capability. The SPA is actively considering that at the moment, particularly for the reform programme but also more generally. We are seeing a ramping up of policing reform activity in other areas to deliver the 10-year policing strategy; one example is the corporate services transformation, which is coming down the tracks at around the same time.

You may know that the SPA is undertaking a review of its corporate governance structures in this area. We are reviewing whether our committee structures are optimal for dealing with a change programme of this size and scale. The digital, data and ICT programme is a very good example of an area in which we need to ensure that we have the necessary capability to fulfil our statutory functions in the governance and scrutiny of these proposals, not only at board and committee level but within our executive team.

By “capability”, do you mean capacity or understanding, or a combination of both?

For the SPA executive team, it is a combination of both. In practice, that means recruiting additional people with additional skills, and we are part of the way along that journey. As interim chief officer, my assessment has been that the SPA executive team has not been at the level of capability necessary to carry out our core statutory functions. That led to the improvement plan that we put in place at the start of this financial year and have been working to deliver since then, on which I report to the SPA board monthly and, in more detail, quarterly.

In the Police Scotland governance arrangements for management of this process, presumably you are taking the lead, Mr Low, but strands of the programme will have their own project leads. How will governance and assurance be secured over such a broad-ranging set of proposals?

First, the transformation is being led by senior police officers, supported closely by senior police staff and professional advisers such as me—-that is another difference from i6. We have senior responsible officers for each individual constituent project, and we also have internal Police Scotland governance, which includes the corporate finance and investment board and the change board that you heard about.

We are also establishing some additional elements of governance and assurance. Work is being done to set up a design authority, which will be essential given the component nature of elements of the programme. Under that design authority will be a technical design authority, which I will lead and which will ensure that the individual technology components are being meshed together in a sensible way. A whole range of new elements of governance will be put together to support the programme alongside existing governance arrangements.

So the process of designing what the programme will look like has identified solutions that are already operational in other parts of the UK, and you will not be testing the market to see what suggestions come back within an assigned budget; it will be far more prescriptive and will be driven from within Police Scotland. Is that right?

Well, clearly we will still be testing the market, because there will be an open procurement process for the technologies. I am not sure whether that is the point that you were making, but there will still be that process.

You would expect to say, “This is the baseline—if anybody thinks that they can go beyond that, it is up to them to make that case.”

We will be very clear about the business and technical requirements for individual projects. We will still engage with the market, even though we have good information about and good awareness and knowledge of the existing solutions that are out there. I see that as a benefit.

Will Police Scotland’s internal governance and assurance processes be able to robustly challenge anything that comes back?

Absolutely. From a procurement perspective, there will still be a full assessment of submissions from vendors, as normal.

Good afternoon, panel. Could you outline your top-line priorities for this ICT project? How much input did trade unions and staff associations have in leading those priorities?

I probably talked about this last time I was here. Although i6 did not deliver, the requirement still exists for the type of capability that it would have delivered, so the programme includes a project on core operational policing systems. In my opinion, that is one of the key priorities, both from a technological perspective and, more importantly, from an operational policing perspective.

We have been fairly clear that providing mobility and mobile access to officers also remains a key priority.

Tackling our organisational data issues, which I mentioned last time, is no small challenge; we need to rationalise and consolidate our data sets and data flows.

Those are three priorities that I would immediately mention, but we also need to develop some core infrastructure elements that are very much in my own domain. Those technologies will underpin everything that we seek to do—for example, refreshing the network and ensuring that we have the right level of connectivity and bandwidth in all our locations around the country. That is another essential priority; I would almost describe it as a foundation, a building block or a pillar.

My reading of the situation with the unions and staff associations is that they are broadly supportive of what we are trying to do in the DDICT strategy. They understand and agree with the need to provide better technology solutions for our officers and staff. There has been consultation with them, although we can probably always do more in that space. I have presented several times at the Police Scotland bimonthly engagement forum, to which all the unions and staff associations are invited. We have had discussions with the Scottish Police Federation, which was able to provide storyboarding and officer case examples for inclusion in the OBC. As I am sure many of you do, I follow the social media contributions of certain members of the federation; recent tweets have indicated that they are broadly supportive of the direction of travel.

I am sure that they are supportive, but have they actively been asked for input? Have they put forward suggestions to you?

Yes. For two of the pieces of work that I highlighted as priorities—the core operational systems and the mobility project—I am aware that the federation is involved in the decision-making bodies. Federation members are on boards and in steering groups, actively contributing to and influencing the direction of travel. That is a good benchmark for how we involve associations and unions in the projects that will be stood up as part of the programme.

Is there any one aspect of the strategy that has proved problematic so far? What is the toughest challenge for you?

I think that the biggest challenge will be securing the funding that we need to deliver the programme.

The submission that we received from Unison states:

“We ... have concerns that there is a tendency in Police Scotland to fetishise the cutting edge of technology at the expense of the systems which should enable the organisation to function.”

Do you know what is behind that comment? I would ordinarily direct that question to the source, but do you recognise the sentiment or understand what would have prompted such a comment?

In short, no. As we have already discussed, the technology that we are looking to implement in the programme has been tried and tested in most other public sector bodies or UK law enforcement agencies, so I do not particularly recognise the sentiment behind that comment.

13:30  

I know that the submission also refers to drones. Would you like me to touch on that issue, convener? This is not about unproven technology or space-age solutions but about fundamental, basic technology for front-line operational policing.

May I follow up on that point? You referred to part of what Unison is driving at in its submission, but let me complete the quotation:

“We need investment and a strategy for improvement which does not prioritise drones or retinal ID tech at the expense of getting the basic ICT infrastructure right. This is long overdue.”

I take it that you can offer some reassurance that that is what lies at the heart of this process.

Absolutely. In the vast majority of constituent projects, the funding that we are seeking is for core technology that is aimed at core operational policing. There has been some discussion of retinal systems and so on, but I am not aware of any technological project that has been set up to look at that. The organisation has purchased unmanned aerial vehicles—drones, under another guise—but they are not operational; they are currently being tested.

Mr Hogg, I do not know whether anybody in the SPA fetishises IT, but perhaps you could reassure us.

The related point that I wanted to touch on was the one about priorities. Why are we doing this in the first place? From the SPA’s perspective, one of our absolute priorities is that whatever is done in this space must deliver benefits for front-line officers and staff. In plain English, that has to mean an end to officers taking notes with pens and paper and then going back to an office to type them up several times on several different systems, instead of spending more time in communities. That is a benefit that we are very keen for the programme to deliver, and that is what sits beneath the jargon of mobility or mobile working.

Staff associations and trade unions are both very clear that there are some very basic things that need to be fixed just to get to a basic level of functionality, long before we ever get to some of the higher-end cybercrime capability that is also part of the mix. That focus on benefit is one of the tests that the SPA has applied and will continue to apply as the programme progresses: are we convinced that it will deliver the real-world changes that are necessary in areas in which the efforts of Police Scotland officers and staff to do their jobs properly are currently being frustrated?

I wonder whether Unison was on to something quite important with its reference to fetishisation and so on. Do we expect the software that we are looking at to migrate over a range of hardware platforms over time? Software is the bigger investment because it relates to how people do the job, and changing people is more difficult than changing hardware. I ask that question because in the past two months I have discovered that software that I wrote in 1974 is still running. Indeed, a pal of mine wrote the first algorithm for printing in Braille in 1969, and it is still in use. Unison raises an important point: might the software have a longer life than the hardware, and is that part of the plan?

As Mr Hogg suggests, the software will be modern but, as you will know, Mr Stevenson, software and hardware platforms need to be refreshed, patched and upgraded over time—that goes with the territory. I am not sure whether that answers your question, but the hardware platforms, the hosting platforms and the software will all be current.

Thank you. We will come on to some specific financial questions soon—I am conscious that Mr Gray is sitting here patiently—but first let me turn to Fulton MacGregor.

I have just a couple of quick questions that follow on from Rona Mackay’s line of questioning. Will the technology be rolled out Scotland-wide or division by division?

I can answer that—or at least attempt to. The answer is both. Deployment and implementation might happen at divisional level for some projects and at national level for others. The model will be determined by the nature and specifics of the project. For example, the mobile working project will initially be trialled in one division so that we can learn lessons from it; we will use officer feedback on deployment, training, implementation and early look and feel to shape the rest of the project, which is likely to be rolled out at divisional level.

You have just answered my supplementary question about how you will learn lessons if you are not planning an initial trial roll-out. Can you comment briefly on the nature of the information about updates that will be placed in the public domain during further planning and implementation?

As you will expect, we will publish regular updates on our progress, as we do at the moment, and report them to various levels of the existing SPA governance. By definition, those reports tend to be placed in the public domain. We hope that you will find that there has already been a high degree of transparency in the core documentation for the programme so far: the strategic outline business case, the strategy and some of the supporting documents and covering papers are all in the public domain and available on the SPA website.

Are the updates likely to include things such as expenditure updates, results of testing and risk plans?

I see that Mr Hogg wants to come in but, in my opinion, the answer is absolutely yes.

I just want to confirm that the SPA’s intention is very much to do what we did last week, which was to consider the whole outline business case and publish the papers associated with it. The only exception was an annex to the outline business case, which the SPA took in private as it dealt with matters of counterterrorism and serious organised crime that were classified as confidential. Everything else was discussed in public, as it should and will continue to be.

Good afternoon, gentlemen. Can you explain the increase in cost to £298 million from the previously reported figure of £200 million?

The strategic outline business case that was produced a number of months ago looked at a cost profile over a five-year period. We have since worked through the numbers for the outline business case that was approved by the SPA board last week, and the cost profile now stretches out over a 10-year period. From a capital requirement perspective, the numbers for the first five years have not changed significantly, but we have built in the replacement costs that would be required over years 6 to 10. That is the reason for the increase.

Can you be more specific about the replacement costs? Are they for ICT in particular?

Yes, they are for ICT hardware. It is something that we have done every year in Police Scotland; as IT hardware reaches the end of its life, it gets replaced. It is about building in a replacement programme for ICT hardware.

Does that account for the whole £98 million increase?

In the outline business case that was produced this month, the capital requirement over 10 years was £244 million, whereas in the previous strategic outline business case, it was £206 million. The difference between those figures represents the replacement costs for hardware in years 6 to 10.

Are there any revenue costs?

Yes. The figure of approximately £300 million that you cited takes into account capital costs of £244 million and the revenue expenditure associated with the outline business case, which is largely linked to the corporate services transformation part of the DDICT business case. That is because it is a cloud-based solution, which is a revenue-based model, whereas most of the rest is capital. The investment part of the revenue element is £53.8 million over the 10 years.

Are there any costs associated with using consultants?

Yes. They are included as part of the revenue costs of having professional services support for the corporate services transformation, but they are also built into the capital costs for the rest of the DDICT outline business case. Those numbers are not in the 200-page document that you were sent, but if you would find it helpful, I can give you a breakdown of our estimates for the professional services component of each of the work packages that make up the overall programme.

We will most certainly want to see that breakdown, especially in the light of the submission that we have received from the Scottish Institute for Policing Research, which states:

“It is important to learn lessons from the failures of i6. As plans are made and budgets are allocated it is essential that the value of academic researchers, rather than just private consultants, is harnessed.”

Unison’s discontent is obvious. Its submission states:

“Some of the cost of all this can be seen in how much of the budget has been spent on external consultants and contractors.”

I think that the whole committee would like much more detail about how much has been spent. Could you tell us why you have not looked at the SIPR’s academic expertise?

With regard to the professional services spend, we will absolutely share with you what we have at the moment, but I ask you to bear in mind that this is still an outline business case, so it is based on our best estimate. As the accountable officer has said, a number of full business cases will come through with the actual costs for each component.

The reason for building a professional services cost into the outline business case is linked to the earlier point about surge capacity. Rather than employing people permanently, we bring them in to do a piece of work, and then they move out. We have strengthened Police Scotland’s internal capability, but it is not enough to deliver what we need, hence the use of professional services.

Can you give us even a ballpark figure for what has been spent to date on external consultants?

I can give you the figure for the first five years of Police Scotland, from 2013-14 to the end of 2017-18: it is £11.3 million. The proposed expenditure in the current financial year is £7.7 million, so there has been a fairly significant uplift this year. That will continue over a number of years if we continue to make progress with digital, data and ICT, because of the scale of the programme, which exceeds the capacity within the organisation, and because of the expertise required. We would not want to commit to taking on full-time employees for a time-limited piece of work. That is why professional services costs are included in the business case.

Were the consultancy costs for i6 reimbursed?

To the best of my knowledge, yes, but I will confirm that to you.

13:45  

What about the point made by Dr Megan O’Neill, the associate director of the SIPR?

I can respond to that. The SPA has good links with the SIPR; indeed, I met the director recently, as did the SPA chair, separately. The SIPR comprises a network of 14 academic institutions and carries out extremely valuable research on all policing matters. However, it is different from the sort of technical support that Police Scotland is bringing in to deliver the DDICT programme—in other words, people who have built similar DDICT systems in other police forces—and which is more at the applied end.

I would also like to clarify something. The figures that James Gray has cited apply to professional services not just for DDICT but for all purposes over the past five years. The sum spent on the ICT component will be very much smaller than those figures, which are for a broader range.

I think that a general point was made about the use of professional services, as well as ICT specifically. You mentioned that further financial teams and back-up had been brought in to provide quite a lot of additional support. I presume that that was to deliver ICT as well as for more general things. Can you tell us the cost of that and outline the extent of the support provided? I know that there is a new chief finance officer—I take it that that is you, Mr Gray—and a team of seven strategic leads and management. That is quite an investment. Can you quantify the spending on that, in addition to the spending on consultants?

In the finance service specifically?

I am talking about the new team that has been brought in to take the lead on finance, including delivering the ICT. Do you have an overall figure?

The seven new leads brought in to strengthen the finance service were part of a restructure of Police Scotland’s senior finance team. They will help to support not only DDICT but financial management and planning more broadly. I can check, but to the best of my knowledge, the seven posts represent an investment of approximately £400,000 a year.

That said, within the restructure, others have left the organisation, so there has been a saving there. As you will be aware, we had previously brought in quite a bit of additional support from professional services to bolster the finance function, but that is now tailing off and has been replaced with a new senior team.

As part of the corporate services transformation, which is included within DDICT, the entire finance service will be restructured. We have made progress; we have a new senior team in place, and we have been working through a payroll project. My objective is for the finance service in Police Scotland to cost lower overall than it did two years ago, but to be of sufficient quality to address the issues that have been raised by Audit Scotland and internal auditors. For example, the payroll project will deliver on-going annual savings equivalent to nearly £1 million, which more than pays for the additional senior people whom I have brought into the team. I strengthened the team to seven because having only two direct reports to manage the organisation’s entire £1.1 billion budget was just completely unmanageable.

I think we now have far more control over finances. There is still a lot of work to be done, but I hope that future audit reports will demonstrate the value of the investment that we have made.

You will understand that as part of our pre-budget scrutiny we are looking at things such as staff costs. I would have thought that as the new chief finance officer, you would understand the value of the committee having figures before us today for the cost of the consultants and the new structure. I am a bit concerned that it seems that the SIPR’s offer is being dismissed, when we have already talked about lessons being learned from other public sector projects. If there is value, it will come at a fraction of the cost of some of these other services. I merely leave that thought with you and look forward to the additional information that you have undertaken to provide.

I want to briefly explore the revenue costs versus the capital costs for the ICT project, particularly for the software. We have heard that a lot of the software is coming from other police forces on these islands. Who owns the associated intellectual property? Are you allocating it to revenue or to capital?

I should point out for clarification that the software that we are looking to use will not come from other police forces. It is being used in other police forces, but we are talking about commercially available software products from commercial vendors and suppliers.

So you will have no ownership of the software—you will merely be licensed to use it.

There will be a range of licensing options, including perpetual licensing. As you will be aware, vendors offer a number of software licensing models.

So how will you treat the allocation to revenue or capital? There is always a debate about which side of the line to put, for example, perpetual licences on.

I might ask James Gray to come in here, but I will say that in the profiles for capital and reform, there is a provision for capital to cover software purchased with a perpetual licence, and a smaller set of provisions within revenue for renewable licences, depending on the model.

So if most of the software is to be licensed, are you making arrangements to escrow all the materials necessary for someone else to take over the maintenance of that software in the event of supplier default?

Yes. Escrow provision would be a standard provision in our documentation for tenders and contracts.

That is fine. I think that Mr Gray wanted to supplement that point.

Perhaps I can give you a bit more background on how we have developed the financial model in the outline business case and on the split between capital, reform and revenue costs. What we are saying is that by the time the whole programme is fully delivered, there will be recurring revenue costs of about £28 million per annum. Obviously there will be significantly more benefits—in fact, nearly £53 million-worth.

You are right that it is quite a tricky judgment whether to treat an intangible asset as capital, but we have tried to do so wherever we can, because we know that there will be significant revenue challenges in the years ahead. We have certainly applied accounting standards to what is capital and what is revenue, and we have built the business case on that basis; that is why we have an element of investment that is capital and an element that is revenue. Obviously there are on-going revenue costs associated with licences and maintenance.

What depreciation figures are you using for software that you are capitalising and for hardware?

We typically use five years, but we would need to do some more detailed work on that. We have captured the investment requirement based on a capital requirement of £244 million; that is the cost, and then there is a non-cash depreciation element that feeds into and through the budget.

As I have said, our working assumption is five years. We need to get into more detail behind that, because different types of hardware might have different lifespans, but that is our standard accounting policy.

I have some brief supplementaries to the lines of questioning from Margaret Mitchell and Fulton MacGregor.

First, you said that the outline business case was an estimate. At this stage, it must involve quite large estimating factors and margins of error. Is the number in front of us your expected cost or your maximum cost? What contingency factors have been applied to the outline business case?

That is a good question. We have considered optimism bias for each module in the outline business case. In some modules—those in which we have certainty over cost—it is 0 per cent; for example, mobile working is a component of the DDICT OBC, but is itself also a full business case that is moving ahead and that we have a contract for, so we know the actual value. In other modules, you are right that a lot more clarity is required to be certain about cost, so we have applied up to 50 per cent optimism bias.

The average optimism bias across the OBC is 20 per cent, which is fairly common for outline business cases. Our expectation is that the overall costs will not exceed what is in the OBC.

Okay. I was just wondering whether you might have any more detail to share with us after the meeting.

My second question, which is for Martin Low, is about milestones and the level of information that you can provide. When we last discussed this, I had some concern that the information that we had was very technical and technology-driven. My view is that any programme like yours needs strong, functional design and strong outline application architecture. Could you publish that information or share it with the committee once it becomes available?

Some of it is already available. A project road map is available as part of the products that I mentioned earlier. The technical reference architecture at the highest level is a relatively straightforward model with an awful lot of detail sitting underneath it. That material is already in the public domain, but I am happy to provide that information for the committee if necessary.

I am hoping that our last hour or so has not been academic. What discussions have there been with Scottish Government ministers or officials about funding for the programme?

I can respond to that. The SPA has certainly discussed with Scottish Government officials the on-going development of the work on the outline business case. In advance of the SPA board meeting last week at which the OBC was approved, I also met the Cabinet Secretary for Justice to brief him on the expected costs.

May I briefly make a related point?

Yes, but first can you tell me whether the cabinet secretary said, “No problem—£300 million”?

Certainly not. The cabinet secretary thanked us for the briefing and said that he would need to consider the matter as part of the Government’s on-going spending review.

That relates to the extra point that I wanted to make: one question that I have asked as accountable officer is about the cost of doing nothing. That working was built into the OBC; the answer that it produced was that, over the same nine or 10-year period for which the £244 million capital cost is cited for the preferred option, the cost of simply maintaining the existing systems without adding any additional functionality or modernisation would be more than £95 million. That is an important context, as I pointed out to the Scottish Government.

None of us has the option to do nothing, because the current level of functionality is not acceptable in policing. The key question is what should be done, and that needs to be a conversation with Government. In the event that full capital funding—or, indeed, revenue funding—was not available from Government, the intention would be to phase our approach. We would progress towards the same goals set by the OBC and the same option that performed best in terms of value for money; we would simply take longer to get there, cutting our cloth according to the funding available.

14:00  

Further to Daniel Johnson’s point about contingency funding, I see that Police Scotland’s submission includes a table that shows exactly the same figures, in three columns, from 2018-19 to 2025-26. How does that tally with the 20 per cent optimism bias?

Which page of the submission is that on?

It is table 1 on page 3 of paper 1.

That table is actually unrelated to DDICT. The financial memorandum associated with the bill for Police Scotland’s coming into being made an assumption that £1.1 billion of cumulative savings would be achieved by 2025-26, but the table demonstrates that, based on the cost savings made in the first five years of Police Scotland and excluding the reform funding that has been provided, the cumulative savings will be in the region of £1.852 billion, which is rounded up to £1.9 billion.

The table was included to provide a bit of context. My understanding was that this session would look at the wider finance aspects of our work as well as DDICT, and I wanted to highlight that since Police Scotland has come into being it has delivered annual savings of almost £200 million. Cumulatively, up to 2025-26, that represents £1.9 billion against a target of £1.1 billion. That demonstrates that significant savings have been achieved and that the organisation is on course to exceed the original savings target in the business case.

Yet you are still considerably in deficit. Could you tell us where the savings have come from? The submission refers to removing

“£200m of costs from the annual cost base”.

There have been significant savings in the police staff headcount: nearly 2,000 posts in total, as a result either of packages such as voluntary redundancy and voluntary early retirement, or of deletion of posts—I can get those figures verified. In addition, there have been significant estate savings in the non-pay budgets as a result of a reduction in the number of buildings that Police Scotland has.

There have also been general efficiencies. Although the number of police officers has been retained, the rank ratios and promotion structures have been reviewed, and senior posts have been rationalised. Instead of eight chief constables, for example, there is now one, and that approach has filtered down through all ranks. That is how the savings have been achieved.

Will the cumulative efficiency savings be in the same areas?

The way in which the £1.1 billion saving had to be achieved is cumulative, in the sense that the £200 million in costs being taken out this year is counted every year until we get to the end. The calculation of £1.852 billion in cumulative savings is based on rolling forward the savings that have been achieved to date.

The SPA submission states:

“It is proving increasingly challenging to support the ongoing requirements of a national service which must maintain a physical estate, fleet of vehicles, ICT and other necessary operational equipment at this level of expenditure.”

If those areas are protected, where will the additional savings towards the £1.1 billion come from? It sounds totally unsustainable. We are closing more police stations, but the estate needs to be upgraded and vehicles still need to be replaced.

The table that we discussed is about savings coming out of the revenue budget. As I noted on page 4 of the Police Scotland submission, we are operating at a revenue deficit, so we have budgeted for an operating deficit of £35.6 million. That is down from an underlying revenue deficit of £63 million in 2016-17 and we are on track to get it to zero by 2020-21, but to achieve that, we require the investment in reform that we set out in our three-year financial plan.

You make a really good point. The table on page 10 is about our capital investment; this year we have a capital grant of £23 million, supplemented by receipts from disposal of buildings, of which the single largest this year was Pitt Street in Glasgow. As you can imagine, in the early years of Police Scotland we had significant disposals of property, from which we could use the sales receipts to supplement our capital plan. However, we are now at the point where very few large sales will come through in the future, so we will not be able to supplement our capital plan with significant receipts. For example, our capital plan this year has £14 million of asset disposals to support the spend, but in future years it will be more like £2 million to £3 million.

If our capital grant continues at its past level of £23 million, it will not be sufficient to maintain our existing asset base, let alone enhance it. We know that we have backlog maintenance issues on the estate, as everybody does, and we also need to bear in mind the age profile of the fleet. If we continue with a capital grant of £23 million, there will be a significant reduction in the quality of the asset base, even without considering the significant uplift from DDICT investment. The figures that we are talking about are just to maintain what we have.

To be honest, the reason why the £23 million figure is so small is that in its early years, Police Scotland was not particularly good at developing business cases that made a compelling case for capital investment. This DDICT programme is an example of an area in which we have come forward and said, “This is how we fix this part of the organisation—and this is the bill”, but we have not done it for other areas yet.

Could I interrupt you there? Maintaining the physical estate and replacing vehicles both come under capital, but they have revenue costs as well. Whether we are looking at the revenue budget or the capital budget, if this is the area that we are targeting, significant expenditure will be needed in the next few years. I do not see that recognised in the projections.

Our three-year financial plan recognises the revenue costs associated with our asset base. One point that we have made is that without sufficient funding in the estate or the fleet, cost pressures will come through in our revenue budgets. For example, just to stand still, we need £11.5 million a year for our existing fleet of roughly 3,500 vehicles, but this year we are spending £5.5 million. That causes a revenue pressure, because the fleet’s age profile increases, so the average maintenance costs go up. You are quite correct that an absence of investment in the capital estate puts a cost pressure on our revenue.

I want to come in on that very point. I recently had a discussion with some local Scottish Police Federation reps, who raised the same point about vehicle maintenance budgets. They suggested that local divisions were having to use their budgets to prop up vehicle maintenance, just in order to maintain sufficient vehicles for their local policing duties. You said that £5.5 million was being spent on maintenance instead of the £11.5 million that ought to be spent. Do you recognise that picture of local divisions flexing and manipulating budgets to supplement that deficit?

I do not recognise the picture of a local division using its budget to buy a vehicle, because capital purchases are all controlled centrally by the fleet department. Local divisions have an element of flexibility in their revenue budgets, so with a sufficient budget they might be able to look at doing something with vehicles, but I do not know the detail of that; I would have to look into the specifics.

The suggestion made to me was not that the divisions were buying new vehicles, but that they were maintaining older vehicles beyond their expected service life because not enough was coming from the central pot. The numbers of vehicles were not there, and frankly the divisions were having to use their local budgets to patch up, make do and mend. They also told me that if I went into any police yard, I would find vehicles that could not move because no money had been spent on them. Is that something that you recognise?

It is not something that I recognise at a local division level. Nationally, I recognise that maintenance cost pressures are coming through because of an ageing fleet.

How many vehicles, or what proportion of vehicles, are unable to be used at any given time because of a lack of maintenance?

I do not have that information.

Would you be able to provide it?

Yes.

Your submission states:

“Given the size of Police Scotland and our asset base, this level of funding results in under-investment and is not sustainable”.

That suggests that even if my characterisation is not one that you immediately recognise, there is an immediate impact on the state of your estate, your vehicles and your other physical assets. What cost, or hindrance, are the current capital levels imposing on the police force?

Again, detailed work has been done on that question; I do not have it to hand, but I could provide it.

As I said, in the past Police Scotland has not made a particularly strong case that we need a new estate that is more cost-efficient and so on, but an estate strategy is on its way. We are conscious that we need to start developing our approach and come forward with robust business cases to seek the funding, because otherwise we will not receive it.

To give you some context, our capital grant for the national police service this year is £23 million. If that run rate continued over the next five years, our capital programme would be smaller than that of Shetland Islands Council, based on its published capital plan for the next five years.

That is a useful benchmark—thank you.

May I add to that point? I am conscious that the context for this discussion is pre-budget scrutiny. As the organisation’s incoming accountable officer, I have reviewed the overall financial structure of policing in Scotland, and I endorse the chief financial officer’s point about the size of our capital budget. Given that we are an organisation that spends £1.1 billion, and given that the character of policing means using equipment and cars, the size of our capital budget is a particular issue, as is the balance between the revenue and capital budgets.

For a public service of our type and size, £23 million is a disproportionately small capital budget. Almost irrespective of what we do with DDICT, I would be very grateful if the sub-committee considered that point when making representations about the policing budget, because it has significant systemic consequences, including impact on revenue, which is a point that members have picked up.

I assure you that that will be reflected in our representations.

For the avoidance of doubt, let us make it clear that Shetland Islands Council does not have an excessive or exorbitant capital budget; I feel honour-bound to say that on behalf of my Shetland colleague.

Mr Hogg, in your representations to the Government about DDICT you set out the do-nothing cost. Have you mapped out the cost of continuing with a capital budget in the region of £23 million: the implications for the fabric of the estate and the revenue cost pressures that Mr Gray identified as resulting from inadequate maintenance in a number of areas? Can you quantify what that would look like?

14:15  

Only to an extent. Earlier this year, the Scottish Police Authority approved for the first time a three-year financial plan for Police Scotland, which underpinned the three-year implementation plan, along with a 10-year financial strategy. Those documents profiled future capital expenditure, so I have reasonable confidence and certainty about the next three-year period, including the current year as year 1. For example, at this point in the three-year period, we are on track to eliminate our deficit on schedule by 2021.

To return to an earlier comment about investment in the finance team, I think that the proof of the pudding is in the eating. It is a positive thing that we now have a grip on the finances and are on track to return to financial balance. However, I have not undertaken a specific capital forward look along the lines that I think that you are suggesting, to project the practical consequences beyond the three-year period—in years 4 to 10, for example—of having a capital budget of this size.

I have one final question. Has any assessment been done of the risk of a police pensions shortfall?

I might make a brief comment and then invite James Gray to comment. Although the pension costs appear in the annual accounts for the Scottish Police Authority, the financial risk for police pensions is borne by the Scottish Government. An overall pensions deficit is mentioned in the accounts, but it is accepted as a going concern because it is underwritten by the Scottish Government. I do not know whether Mr Gray has any more detail on that.

No, that is the position. The point that we raised in our submission was that, as you will be aware, there is significant and growing pressure on the justice portfolio budget, which funds police pensions. That has indirect consequences for the public bodies in the portfolio: the more money that goes into pensions, the less is available to be distributed to the public bodies. That was the only point that I was making.

I suppose that you will want us to ask the cabinet secretary about that when he comes in.

May I ask a final question? A recurring issue that we have come across is the tension between two things. First, recruiting the additional 1,000 officers needed to reach the figure of 17,234 had implications in the shape of the loss of valued police staff who were laid off, which led to backfilling issues. More recently, on 2 May we were told in the draft three-year financial plan that capacity creation would result in a reduction of 300 officers. Unison is understandably concerned about the former and its continuing implications, whereas the SPF is understandably concerned about the latter. What discussions have taken place about those competing demands? How will the budget reflect them?

Perhaps I could start. First, police staff, not officers, were undoubtedly the group who bore the brunt of the cost savings in the early years of Police Scotland’s life. As James Gray mentioned, there are up to 2,000 fewer police staff roles now than there were at the time of Police Scotland’s creation. That has partly been driven through efficiency, which is a good thing, but nevertheless there are particular concerns.

A linked point, which Unison’s submission makes, is that there is on-going inequity in the legacy terms and conditions of service of police staff, depending on which legacy force they served in—they are paid different rates for doing the same job. One of our priorities has therefore been to harmonise terms and conditions of service. A programme of work has been going on for some years, and we hope that it will culminate this month in positive progress towards a final proposition to all members of staff that would implement that harmonisation. The costs of that have also been built into our budget planning.

In answer to your question about police officers, year 2 of the three-year plan—next financial year—assumes a reduction of 300 in the total complement in order to deliver the financial savings outlined. That was part of the plan and Police Scotland is taking action towards it. Those assumptions can be revisited and changed, but other offsetting savings would have to be found in order to maintain the positive progress towards balancing the books by 2021.

I suspect that that is just how I heard it, but will you confirm that you are not suggesting revisiting the very good news that terms and conditions of police staff are being harmonised? You are talking about revisiting police officer numbers.

Yes. There is absolutely no intention of revisiting the harmonisation of terms and conditions of police staff. All I am pointing out is that the three-year plan for police officers assumes a total reduction in 2019-20 of 300 officers.

Thank you. At the end of our very helpful session on firearms licensing, in which a lot of concern was raised about the same issue of police officers replacing support staff, we were given a very reassuring breakdown of the figures. I accept that there will be areas of confidentiality for some departments, but would it be possible to get a layout of establishments, both for police and for support staff, and a comparator with the position when Police Scotland was established? That would be helpful.

Certainly.

There being no further questions, I thank our witnesses very much indeed for their contributions. They have been extremely helpful, not only for this committee but for the Justice Committee, which is scrutinising the Police and Fire Reform (Scotland) Act 2012 and will meet the cabinet secretary over the coming weeks.