“Managing ICT contracts in central government: an update”
Item 2 is evidence taking on the section 23 report “Managing ICT contracts in central government: an update.” I welcome our panel of witnesses from the Scottish Government: Sarah Davidson, director general, communities; Mike Neilson, director of digital; and Maxine Reid, head of office of chief information officer. Sarah Davidson would like to make an opening statement.
Thank you. I welcome the opportunity to give evidence on this Audit Scotland report. The convener has already introduced my colleagues, and we hope to be able to assist the committee this morning in its consideration of the Auditor General for Scotland’s findings.
I should say at the outset that the Scottish Government welcomes the report, and accepts the recommendations that are addressed to us. I am here today to talk about those that relate to the Scottish Government and not about the specifics of individual cases, where there is a separate line of accountability. My comments will therefore relate primarily to the first two sections of the report, on strategic oversight and skills.
The issues are complex and interrelated and, as the report indicates, our approach to each has been to put in place new arrangements, and then to review and improve upon them in light of experience. Indeed, in the five months since the audit work was completed, we have made more progress with the process of continuous improvement. I will update the committee on that in my brief remarks.
Dealing first with the strategic oversight, it is important to be clear about what the assurance framework is intended to achieve and, crucially, what it cannot achieve. Clearly, the central Government sector is taking forward a wide range of information technology-dependent business change projects, and the IT assurance framework cannot provide specific assurance on each project; rather, it is intended to ensure that appropriate assurance arrangements are in place and being used for each project. The crucial point is that responsibility for the effective governance and delivery of individual projects lies with the senior responsible owner and accountable officer, and it is essential that the oversight arrangements do not cut across the clarity of that responsibility. Nonetheless, we absolutely accept the leadership and support role of central Government, and wish to ensure that it adds the maximum possible value to our sector colleagues in their planning and delivery of programmes and projects.
As the report confirms, we responded directly to the recommendations of the original report in 2012 to introduce new assurance and oversight arrangements and we have already made significant improvements to them in light of experience, including creating the office of the chief information officer, which reflects the need to devote more resources to the implementation of the framework. At the heart of that development is a more proactive, relationship-based approach, and feedback from colleagues suggests that, along with the simplification of guidance, structured sharing of lessons learned and investment in networks, that has been welcomed.
It is important, however, that we continue to monitor the effectiveness of the enhanced arrangements. As chair of the strategic corporate services board, I have asked the chief information officer to provide the board with an update report in the spring that includes an assessment of the quality of relationships across the sector. That will be informed and supplemented by some random checking of individual projects that have not otherwise come to our attention via gateway reviews. We will also conduct a gateway review of the assurance framework itself during the next year.
Part 2 of the report deals with digital skills, which, as the committee knows, is a big and complex issue that involves a range of players across all sectors. We know that a lack of relevant skills is a recurring and major issue for public bodies and for Scotland’s businesses, and the market for those scarce skills is highly competitive. The digital skills investment plan produced by Skills Development Scotland is tackling that for Scotland as a whole. Key priorities include the establishment of a digital skills academy called CodeClan to rapidly increase available skills and a multichannel marketing campaign to target school pupils, among others, to create a more positive perception of technology as a career choice.
Our work on public sector skills sits in that Scotland-wide context and we are taking a number of actions, including more creative approaches to recruitment, to meet our own skills needs.
In light of our work on a public sector skills bank and the intelligence gleaned from our skills gap survey, we have established the central Government digital transformation service. It was formally launched last month to provide a source of digital skills to support information and communications technology and digital projects, particularly in the crucial scoping phase. Good progress has been made in establishing that team, with 13 of 25 posts already filled and a pipeline of work identified, and we are just about to invoice for our first chargeable item of work. We agree with the Auditor General that it is an ambitious bit of work, but we are not deterred by that. The central Government sector has strongly welcomed the development, and we will keep a close eye on the extent to which it meets need as it grows.
Bringing those two strategic issues back together, we have revised our governance arrangements since the Auditor General’s report was published, and the central Government digital transformation and assurance board is now responsible for strategic oversight of central Government ICT programmes and for the digital transformation service. That brings together responsibility for assurance and support. In other words, the assurance role of the information systems investment board—ISIB, which is referred to in the report—has now been vested in the new body.
I hope that my comments serve to underscore the extent to which we are actively committed to the process of continuous improvement. I assure the committee that we will continue to iterate in light of feedback, including any advice that comes out of our discussions today.
Thank you. The committee will now ask questions.
Good morning. My question is about skills shortages. I know that the public and private sectors are struggling to get people into IT. What progress has the digital transformation service made?
The digital transformation service is intended to address the skills gaps that we identified in the central Government sector. In particular, it identifies the need for people who have skills to support central Government bodies in the initial scoping phase of projects—people who are able to help to analyse business plans and people who able to ensure that the right skills are being put in place at an early stage in a project.
As I said a moment ago, we have already filled 13 posts, and we are talking to bodies about 35 projects that might present opportunities for our support. Along with that, we are developing case studies of the ways in which we have supported bodies that we can use to explain the value that we think the service can add.
We are also developing the range of services that the service can offer. Initially, we will review and develop an organisation’s whole digital strategy as well as business cases for services. Critically, there will be access to actual bodies that can go into organisations and help them to develop an individual project in either the short term or the longer term. That will sometimes involve in-house staff and sometimes the digital transformation service will be able to source contractors with particular skills that can be applied to projects and programmes.
It is early days, and it is key that we help the service to prioritise where it puts its resources. However, so far, we believe that it is the best possible answer to the skills gaps that have been identified and the difficulties that smaller bodies, in particular, have in skilling up to deliver programmes and projects that may be outside their normal flow of work.
Can we have more succinct answers to our questions, please?
Of course; I am sorry.
How many public bodies are you supporting just now?
We are initially having discussions about 35 opportunities but I am not certain whether they are within 35 bodies or whether some bodies have more than one project.
It is between 20 and 25 bodies.
Thank you.
I am quite shocked at the pitch that you have given today. I wonder whether you have read a different Audit Scotland report from the one that I have read.
In October 2012, Paul Gray promised:
“We are working towards an action plan for the Central Government ICT Workforce to be available for consultation across the sector by March 2013.”
That was to look at the skills gap survey.
The Auditor General’s report from this year says:
“The Information Systems Investment Board’s (ISIB) role was to oversee the implementation of the framework but it did not have sufficient information or capacity to perform this role effectively. It did not receive all the ICT investment and assurance information required from central government”.
You have come along and given us a pitch as if nothing is wrong. The skills gap survey was promised to the committee in October 2012 but you did not get round to it until August 2014. Why did you encounter difficulties? Why did you not perform the survey until 2014 when it was promised in 2012?
There are two separate issues in your comments: one is about skills and the other is about assurance and oversight. As Mr Gray indicated when he came to the committee in 2012, we were already putting in place arrangements to examine both issues in the spirit of learning as we go.
As we acknowledged, we did not get the oversight and assurance perfect first time. Indeed, when he was before the committee, Mr Gray said that we would have to keep revisiting the matter and learning from feedback. Although we put new oversight arrangements in place, including learning from the Audit Scotland checklist that was included in the 2012 report, from the outset we gathered feedback from bodies about the extent to which those arrangements delivered what they needed and were clear and comprehensible to them. On the basis of that experience, after allowing a year or so to learn from those arrangements being deployed in practice, we revisited and improved the framework.
I do not want to create the impression that nothing happened during that time, because it did. We absolutely acknowledge that the framework was not perfect first time and we had to improve on it.
It was far from perfect. You took two years to perform a skills gap survey.
I was just going to come on to pick up the point about skills.
You need the skills to do everything. If the skills are not there, it cannot happen.
Absolutely, and we accepted the Auditor General’s finding in 2012 that skills were critical.
You did nothing for two years.
In its 2012 recommendations, Audit Scotland recommended that we undertake a strategic review of current ICT skills availability. When he came to the committee in 2012, Mr Gray said that we had already started work on that by building on the benchmarking work that we had been doing in the context of shared services.
Again, that was an iterative process. We looked at what information that gave us about existing skills, put it together with the information that we had gained through continuous professional development for the IT profession and concluded that, although the information that we had told us quite a lot about our current skills, it did not tell us everything.
Ultimately, through that work and the assessment of the feasibility of a skills bank, we concluded that assessing our existing skills would not give us all the information that we required. That was when Skills Development Scotland commissioned the public sector-wide skills survey.
You have had three years to assess your skills. It is not true that you responded directly to the 2012 report. In your incredibly confident opening pitch, you mentioned a positive perception of technology. Yesterday, we on the Education and Culture Committee took evidence that, in the past two years there has been a 29 per cent drop in presentations for computing courses at national 4 and national 5. You talk about doing a skills survey and having a positive perception of technology but, if pupils do not get their national 4s and national 5s, they will not get their highers, higher national diplomas or degrees.
You sit here with a big, confident pitch, but we are getting almost a third fewer presentations for computing courses. Do you understand why I am a bit aghast and shocked at that confident pitch? As if a 29 per cent fall in national 4s and national 5s in the past two years was not bad enough—that evidence came from the learned societies, and I would certainly not question them—there are also 24,000 fewer places in further education colleges. That is not degree courses at FE colleges; it is just higher national certificates and HNDs.
I find it difficult to believe anything that you have said. If you are doing a skills gap survey and have had three years to develop a positive perception of technology, why has there been such a fall in the number of computing teachers and ICT teachers, why has there been a 29 per cent fall in national 4s and 5s and why are there 24,000 fewer college places? I could go on; that is just a little snapshot. Why is all that happening if you have a positive perception?
You are, of course, absolutely correct—
I am correct. I would not say it if I was not correct.
—about the complex, interlinked nature of the issue. The education components are an illustration that we have to look at skills as a whole and cannot consider the public sector skills separately from the need to get the whole system right.
You have had three years.
09:45
Colleagues in Education Scotland and the Scottish Further and Higher Education Funding Council are doing a lot of work at the moment to address the issues that the Education and Culture Committee was considering. Education Scotland has a plan for digital education that considers learning and teaching computer science, the curriculum and qualifications in computer science, and teaching opportunities in relation to it.
I made the point about the perception of technology to show that we recognise that there is a problem with young people’s perception of careers and courses in information technology and computer science. One of the early actions that is being taken under the national skills improvement programme is a multichannel marketing campaign that is aimed at young people who are thinking about career choices to change their perception of computer science as a school choice and, ultimately, a career choice.
All those things are part of the mix in the thinking about skills for Scotland and public sector skills within that.
I know that the area is difficult and that finding solutions is not easy, but there has been an undue delay in establishing the superstructure—we have already considered the skills gap—between the original report in August 2012 and now. You said that that structure did not work and that you will now change it. Is the information services investment board now to be dissolved? We heard that you were just trying to sort out the roles of the office of the chief information officer, who was to support the ISIB, but we read in the update report that
“the split of roles and responsibilities”
had not yet been finalised. That relates to paragraph 35 and exhibit 5 on page 15 of the report. Now you tell us that you will change the structure completely again.
I understand why the system that you set up was not given the information—Mary Scanlon has already alluded to that—but it still will not work if you do not have the skills. I do not understand why you have come before us and said, “Well, that didn’t work. We’re going to have a completely new set-up.” That does not seem to be a solution.
At the end of the day, the proof of the pudding will be in what happens in the projects, because the oversight and supervision of that at the highest level tell us whether the problems are picked up; Tavish Scott will refer to that in detail. If we go through the NHS 24 programme, the common agricultural policy futures programme and the police programme—there are also 200 programmes of between £1 million and £5 million, but we do not know anything about them—we find that the whole sector seems to be filled with time overruns. Talking about the medical side, it is also, to be frank, filled with IT that comes out the other end not fit for purpose. The national health service clinicians on the front line tell me that it is important.
Could you ask a question, please?
Will you tell us why the oversight arrangements have been changed? What happened to the original arrangements? Why did the ISIB not work?
I do not want to overstate the changes in governance. The ISIB will continue to operate but it will focus on the management of programmes in central Government that it has commissioned and funded. The creation of the central Government digital transformation assurance board was partly intended to address the issue that the Auditor General identified of the importance of getting the balance right between the scrutiny function and the support function by bringing them together in one place.
Is it intended to deal with non-governmental programmes?
No. It will deal with central Government sector programmes—in other words, not Scottish Government core programmes, although the Scottish Government core will report on that.
Health boards, for example.
No, not health.
The Scottish Prison Service.
Yes, non-departmental public bodies and associated bodies. Part of the value of bringing them together in that new form of governance is so that there can be a close and symbiotic relationship between the oversight and the digital transformation service. They will be governed together because we will expect the digital transformation service to provide support to bodies that might be less experienced in taking on projects or are taking on bigger and more complex projects.
By bringing together the assurance mechanism and a bit of work that supports individual bodies to deliver programmes and projects, we hope to get a far better governance process. It is also more efficient, because otherwise you would have two separate bodies asking for exactly the same information from the same projects.
That is the thinking behind the plans. Again, we will keep it under review, but it reflects the establishment of the digital transformation service, which did not exist previously.
Is the new role going to be able to direct health boards, for example? To give a specific example, the contract for the most important patient services in Glasgow allows for the system to go down for up to 24 hours in order to have a routine update. Six other health boards have not gone through with it.
That sort of issue is a matter of principle. The health service requires that its clinical IT services should be up 24/7, 365 days a year. I am assured by IT advisers that it is perfectly possible to have contracts that make sure that that happens. The banks’ systems would not go down for 24 hours without receiving a major fine, but clinicians are faced with not having their services for up to 24 hours, for a routine upgrade. Convener, it staggers me that we are 12 or 15 years into the digital revolution and we cannot get the basics of contracts right in the way that the banks have done for 10 years, including imposing fines when things go wrong.
Will those principles be directed to the digital transformation and assurance board? Can your new body direct the health boards and penalise them if they get contracts wrong?
I should be clear that the health sector is governed completely separately from the arrangements that I am talking about. Having said that, the principles that Dr Simpson set out are absolutely the principles that I would expect the board to apply to the central Government sector.
The public sector IT service as a whole is one in which bodies learn lessons from one another. We expect to learn from good practice and also from poor practice. There is a wider information exchange, but the arrangements that I am talking about apply specifically to the central Government sector.
Will you then supply us with a list of the bodies that will be overseen by the new body and those that will not? You have just told us that health will not be.
Presumably, convener, we will have to get the equivalent health body in front of us to explain why NHS 24 has doubled its costs and is still not available two years after it was supposed to come in. I appreciate that that was for patient safety reasons but nevertheless the contract has gone wrong. We will now have to think who in central Government is going to supervise every contract, and it will be a different unit.
We can of course supply the information about the bodies.
Before I bring Colin Beattie in, I want to go back to skills shortages and some of the challenges faced. The report mentions some of the challenges in competing with the private sector. Will we ever be able to resolve that?
As long as the private sector is willing to pay a large amount and we are only able to pay much less, can it ever be resolved, no matter how many strategies we put in place? Are we training individuals to go off into the private sector? Where can we go with this?
You are right that the public sector is almost certainly never going to be able to compete on money with the private sector but we do think that the public sector can compete on some things. People who have joined us recently speak very favourably about the offer that we can make. For example, they say that they are motivated by what they see as the ability to make a difference.
Why do we have a shortage, then, if all these people are keen to join the public sector, despite the private sector offering much more money? It is not happening, is it?
There are not yet enough people who are motivated by the offer. We have to use marketing and the word of mouth of those who are working for us to communicate the message that there is a great job here.
Could we take another approach of looking at the strategies and devising a way of letting the private sector deliver some of the projects? The private sector might see you as the middle man in this and ask what the point is in having all those frameworks and civil servants. Why do we not just contract direct?
That is happening already, anyway. What is the point in having boards, strategies and development strategies if the private sector is clearly picking off the cream of the crop to ensure that they have the right individuals to deliver services? They spend a lot of money on this.
You are right. There are a lot of skills and activities for which we would expect to go on using private sector resources, either because it does not make economic sense for us to keep those people on our books or because we do not need them very often.
Whatever the private sector does for us, we are still accountable for delivery of the project in good order; we can never completely absolve ourselves of that. There will always be a spectrum of private sector involvement; it is a question of getting the balance right. There are very good arguments for developing skills in house, because people who understand the nature of our business and what we are trying to achieve, and the inherent public value of that, will always be useful to the scoping and delivery of projects.
So why do you not just take a strategic overview and let the private sector train people and pay to put students through college? Do civil servants want to do that regularly? Let us consider how we could manage these projects. Why do we not say to the private sector, “Why don’t you do this?”? The private sector could provide the training, but you could have a strategic overview. You appear to want to manage projects and to provide all the training, but it is clear that you cannot do that. You have already proved that.
In the current market, the cost of what you are describing would be prohibitive, given the gap between what we pay to bring in contractors or consultants and what we pay to grow and train our own staff. Although, ultimately, they might go and work in another part of Scotland, that is a double-edged sword, because there is value in our offering skills that we have developed to business in Scotland. At the moment, that is what makes more economic sense. It is a balance.
I am a wee bit confused. In my previous life, I had high-level oversight of the IT divisions of the company that I worked for. There seems to be a lot of complexity in the way in which the arrangements have been set up. Perhaps you can clarify the relationships for me. We have the digital transformation service, which I presume is overseen by the digital transformation board. How does that relate to the gateway review, the ICT assurance framework, ICT technical assurance, the office of the chief information officer and the information systems investment board? It seems to be a very complex structure, and complexity usually slows everything down. How is it going to work efficiently? How is it going to deliver better?
I will ask Mike Neilson to deal with some of the detail, but I make the point that we recognise that communication and engagement with bodies about their respective roles in the different parts of oversight is absolutely fundamental. There is clear reasoning behind the different parts of the architecture of governance and the support roles, whether it is the office of the chief information officer or the digital transformation service. It is critical that the various bodies understand clearly what their roles are and that the people whom they support understand that, too.
Mike might want to add something on the theory behind the governance changes.
There are three core tasks. The first relates to the digital transformation service, the second is oversight of the whole central Government sector and the third is effective management of projects within the Scottish Government. We have decided that rather than have the ISIB cover the Scottish Government’s core programmes and central Government sector programmes, we should restrict its role to what it was historically, which is oversight and management of Scottish Government projects, and have the digital transformation and assurance board covering the digital transformation service and the overall assurance process.
Below that board, we have the assurance framework for the central Government sector, which is managed by the office of the chief information officer. There are many acronyms, but I think that there is a clear line whereby the chief information officer’s office is managing the assurance framework and is reporting to the digital transformation service and assurance board.
This is just a back-of-an-envelope calculation, but I have counted eight different bodies within the Government that are dealing with various aspects. In the private sector, if someone came to me with such a structure, they would soon be told where to go. That system cannot be efficient. I look forward with interest to seeing how it develops, but I just do not see how it can work.
To come back to the constraints on public sector pay, are we still largely plugging gaps with short-term contracts?
10:00
Partly we are trying, through the digital transformation service, to move away from doing that. There are still skills that we do not immediately have in-house, so we are using short-term contracts there, but we are increasingly trying to shift the balance through knowledge transfer and growing our own so that we have stronger and more robust in-house skills.
What are the percentages of short-term contracts and agency staff who are filling gaps? It is probably difficult to say.
It is hard to make a generalisation about that, but it is fair to say that we have a smaller proportion of permanent staff than we would wish. The figure will tend to be between a third and two thirds permanent or fixed-term staff. We would have to give you that information later.
That is quite a wide margin.
Can you clarify that and provide follow-up information to the committee?
Yes.
What I am trying to get at is that there is a premium for bringing in people for the short term and from agencies. As my colleague Dr Simpson knows, it is quite expensive to bring agency nurses and so on into the health service, for example—the NHS pays way over the odds. Are you paying way over the odds? Is it the case that the public sector pay scales may be constraining, but we are paying more out the back door by bringing people in on contracts and agency work?
You are absolutely right in identifying the balance that we are trying to strike. Wherever possible, we go to the market quickly to find people whom we can bring in on our own terms and conditions. Sometimes that is not successful, and sometimes it is not as successful as we would like it to be. We are trying to strike a balance between providing the resources to a programme and project in a timely way, which is important, and not paying more than we have to in order to do that. We are trying to shift the balance in the way that I have described, over time. However, you are absolutely correct that there will still be times when we will have to plug gaps at greater cost.
Let us put aside the public sector pay scales and simply look at the costs. Which of the bundled costs would be cheaper—the payment of private sector salaries or the costs of short-term contracts and agencies?
You are right that one thing that constrains us is that there are frameworks that we have to operate within for what we can pay through the civil service.
Put the frameworks aside. Which approach is cheaper?
I will come at the issue from the point of view of what we are trying to do, which is to get the best overall value for money. We need to operate within a consistent framework of civil service pay, and the approach that we have taken with the digital transformation service is an example of trying to provide an overall offer to potential employees in a way that is enough to bring them in. We are having some success in that. There are some areas in which we are having more difficulty recruiting, and we are looking at what more we can do in them.
To go back to what the convener said, we recognise that we will never want to have everybody in-house, partly because having a lot of specialists is not good value for money, so there will always be a balance involving permanent staff, contractors and contracts with external companies.
That is perfectly understood, but the question is very simple. Is it cheaper to pay private sector salaries or to pay for short-term contracts and agency staff?
Do you mean paying the equivalent of private sector salaries?
Yes. I am not saying that you can do that; I am just asking whether it would be cheaper.
I do not know the answer to that.
We would like to pay for a higher proportion of permanent staff because we need a stronger core, but we need to look at the extent to which we would use a number of them for the long term. We want to have a number of people in for three months, six months or whatever. It depends on the role.
If you looked at your budget for short-term contracts and agency staff, you would know how much they are costing you, and you know how much the private sector salaries are. Leaving aside the fact that, as you have said, there will always be a proportion of people whom you will bring in for specialist contracts and so on—although that should be a relatively small proportion—would the cost be less of paying the equivalent of private sector salaries rather than paying agency fees and short-term contracts?
Sitting here, I do not know the answer to your question, but I know that that is not an avenue that is open to us. In looking at the responses that we get to the recruitment exercises that we have done, one of the things that we are always testing is the extent to which we can push the boundaries on the existing civil service pay scales to take account of the market and the particular skills that are out there. However, we are limited in our ability to do that.
I would have thought that you would have all the figures and that you would have made proposals that could save the Government money.
We have discussions in Government about, for example, supplements that can be paid, and we pay supplements to existing civil service rates in order to bring people in. That starts to address the balance between what we pay in add-ons to agencies and contractors and what we pay in-house. Again, we are doing that within a framework that is not particularly flexible.
Could we ask for more information on that?
That would be helpful. Could you follow that up with the clerk?
Of course.
In the current financial year, how many contracts have there been with external ICT companies?
Do you mean across the central Government sector?
Yes.
I do not have that figure to hand, but we can certainly follow up on that.
Do you have any idea of the value of the contracts as a proportion of the total spend on ICT?
I do not know that off the top of my head, but we are happy to follow up on that.
My example is the common agricultural policy futures programme. The Auditor General points out that an IT delivery partner is being used for that. Is that common practice?
Yes.
I am trying to get some idea of the numbers that are involved. This is the Public Audit Committee, so we are quite big on numbers—we need numbers to understand what is going on. Can you provide us with the number of contracts that are being provided by an IT delivery partner?
Absolutely.
Are those IT delivery partners on a list of providers that are used regularly?
We have a number of Scottish and UK frameworks that are used, some of which have those lists. We can send you that information.
Would we get all the numbers for that, and numbers that would show the trends around how much it has gone up or down over, say, the past three years?
In terms of the use of those companies over—
I want to try and understand the numbers in the context of the questions that my colleagues have been asking about skills. If you are using more and more IT delivery partners, that rather obviates the need to worry about skills, because you are hiring in external help to deliver the contracts. That is my presumption. Am I right or wrong?
As Mike Neilson was saying a moment ago, we want to strike a balance with regard to bringing in at greater cost the skills that either we cannot source in core Government staff or which it would not make economic sense for us to hold permanently. We want to reduce that as far as possible and have that process sitting alongside a bank of core skills that we use all the time and deploy in different places across the central Government sector, while we build up our own knowledge and experience.
We hope that, as the digital transformation service and the core staff of individual bodies become more expert, the need to bring in that external resource will reduce. However, there will always be a balance.
I understand. That is fair.
In the current financial year, is the Government on budget or over budget in spend on ICT?
Again, do you mean the whole of the core central Government sector?
Yes.
Do we hold those figures, Mike?
For the Scottish Government, we are on budget. We do not look at the budget from the point of view of IT spend in individual organisations, aggregated. We look at it from the point of view of the total spend of an organisation being managed effectively.
Do you mean the total spend in general, and not just the spend on ICT?
Yes.
With regard to the accountability of individual bodies, that would be an issue for them.
Your core staff do not routinely monitor IT spend across all the NDPBs and other agencies that are part of Government in the round.
We do not do so in flight, as it were, during the year—not in such a way that we can answer, at any point in time, whether IT spend is on budget.
You are able to do that at the end of the year.
We will be able to look across the spend at the end of the year.
I am sorry; I am not being very clear in my questions. As a routine matter of policy and of financial assessment, at the end of the year, does the Government assess what has happened in terms of IT spend across the whole public sector for which, ultimately, we are all responsible?
We collect data on the trends in public sector IT spend, which we can provide.
Does that mean that you look at whether spending is over budget? For example, if NHS Shetland spends £10 million on a new computer system and it is 50 per cent over budget, does that ping up in your system? Do you have any way of assessing what is going on across the whole public sector? You are not just responsible for core Scottish Government IT spend, are you? We are talking about the whole public sector here. Am I right?
No, I do not think so. Well, it depends on the angle. The Auditor General’s report is talking about central Government, so it does not pick up, for example, the NHS. My accountability is for core Scottish Government IT spend.
I take the point that you are looking at trends. We have an idea of what is being spent, but as a routine matter of financial assessment across the whole public sector, is no one looking at how much money is being spent and whether it is over or under budget?
That is not being done from the particular perspective that you describe, although of course sponsorship teams that are responsible for, and have a relationship with, individual public bodies would take an interest in their spend, in the same way as colleagues in the health service would take an interest in the spend of individual health bodies.
Okay. That is fine.
Richard Simpson has a short supplementary question.
My question follows on from what Tavish Scott was just talking about and concerns projects that are not core Government projects. Can we get a list of those? Does anyone compile such a list? There are 200 projects of between £1 million and £5 million, according to the Auditor General. I would like to know where they are, what the original cost was, what the outturn was and whether they were over budget, and who from the Government scrutinised that as opposed to who from an individual board looked at it. For example, NHS 24 has been brokeraged and given extra money that it will have to repay; it is its responsibility to manage that within its overall budget, but we know that it has doubled costs. It would be helpful to look at such matters.
You might want to look at the City of Edinburgh Council model. It is a Scottish National Party-Labour council, which had real problems with its ICT that were not dissimilar to those that we are talking about today. However, the council brought in a consultant on a contract over three or four years and in the past three months it announced that it would save £35 million—or perhaps it was £45 million—over the next few years, so it has been very successful. You might want to talk to the council about how it did that. There was clearly councillor oversight and the process has worked extremely well in making sure that the contracts for the council are cost effective, which is saving the council a lot of money. Something happened there that is worth looking at.
Thank you. We will certainly follow up on that.
I hope, convener, that the council will agree to provide information on all the projects.
How widely do you advertise and promote vacancies?
As part of our increasingly thoughtful approach to recruitment, we are advertising our posts in the places where we think people will be looking for them. We have therefore been using social media a lot and advertising in IT journals and so on. That is something that we continually review. I do not know whether Mike Neilson wants to add anything about how we did that in our most recent advertising campaign. If you follow @digiscot on Twitter, you will see our advertising popping up quite a lot. We have done video case studies and so on in order to try to convey to people what is involved in working in the Government. We are trying to get better all the time at doing that.
I posed the question because when the economy crashed many people were laid off by companies, including many who had IT positions. The economy has obviously improved somewhat since then and I am sure that a number of people with IT qualifications who managed to get back into employment are not doing what they did previously and might therefore be underemployed. I cannot understand why such people would not see vacancies within the Scottish Government as opportunities. The money that is offered might not be as good as what they currently earn, but other elements in addition to salary might be better than what they currently get.
10:15
You are right to point to the broader package of benefits. We have been trying to explain that in more detail in our most recent recruitment approaches. We identify the type of work that people will be doing in Government from a technical point of view and from the public service point of view. We also identify the benefits of working for the Scottish Government as an organisation and an employer.
As well as formal advertising, it is important to recognise how influential our existing staff can be as advocates for working in the Government. In the past few months, I have been really struck when meeting people who, as you describe, have exited private sector jobs either by choice or not by choice, who have come to work in the Government and who say, unprompted, that they are getting better technical skills than they had access to elsewhere and are involved at scale in projects. People are involved in things Scotland-wide in a way that they would not often be in the private sector.
We need to understand the motivating factors and keep building on them, and to learn from the people who come to work for us about why they came. If members of the committee or anyone else has suggestions about how we can do that better, we would be delighted to hear them.
I suggest that it is probably not just a matter of understanding better; it is also about promoting better and telling the wider world about the opportunities that exist.
Absolutely—there must be understanding with a purpose.
Hundreds of people graduate every year from universities in Scotland and elsewhere in the United Kingdom and many people might want to come to Scotland to work and get involved in the opportunities. There is certainly a role for better promotion of what is going on.
Within Government, we have been developing our own ICT modern apprenticeship stream. To attract people into that, we have been working with the modern apprenticeship promotion programmes, which is proving to be very successful. I agree that we need to use all such opportunities to identify our target interest groups and to persuade them to come and work for us.
After today’s discussion, I assume that you and your colleagues will review what has been discussed. After that, will you provide the committee with points on further action that you will take so that we understand a bit more about what you intend to do to promote the vacancies more widely?
I am very happy to do that.
Earlier, you spoke a lot about assurance. Colin Beattie asked about the structure, and I tend to share his concern about that management tree. In the context of individual projects, assurance means a lot of things, but at the very least it must mean your knowing who is responsible for a project, whether the project is properly defined, whether it is being properly managed and whether the money is being paid to the right people at the right time for the right work. If I go to the top of my list, the person who is responsible for the project will, in your terms, be the accountable officer. I suspect that that causes no problem. At the very bottom of my list, the issue of whether the money goes to the right place is essentially to do with auditing, and I am not worried about that at the moment. In the context of ICT projects, I suspect that knowing whether a project is properly defined is one of the things that you spoke about in the context of scoping.
The issue that I would like to pursue is that of whether a project is being properly managed. I have a background in engineering, and one of the things that we learned a long time ago but occasionally forget is that, if you want to build a building, it is straightforward as long as you put together a decent set of drawings and then never change them. We are sitting in a building where people forgot that. It seems to me that most of the issues with ICT projects overrunning probably arise because people change things as they go along. Is that perception correct? In the run of projects that have been done in Government for the past while, many of them have overrun and been late. Generally speaking, is that because people have changed the scope of the project, which inevitably changes the costs, or are there other factors?
I do not feel confident to generalise in response to that. I know that, later, the committee will speak to my colleagues who have been involved in the CAP futures programme. Clearly, changes that were outwith their control were a significant factor in the experience of the project.
As the Audit Scotland report notes, increasingly, agile project management techniques are being applied to projects. Agile is an approach that is designed to be iterative and therefore to enable a project to be taken forward while the requirements are still being identified, but to do so in a way that is managed and controlled. One of the things that we have identified, and which the Auditor General has identified in both reports on the issue, is the need to ensure that people who adopt an agile form of project management understand how that works and have the necessary skills to do it properly and in a controlled manner. Therefore, whether something is being done with the traditional PRINCE 2—projects in controlled environments—methodology or with an agile methodology, the correct cost and time controls are applied.
I am guessing what you mean by the term “agile”, but I can see the concept. Is it possible to cost those projects honestly? In the development of anything, if you really do not know where you are going to finish but you know what you are trying to do, is it possible to cost it from the beginning in any reasonable way?
Particularly in the digital transformation service and in my wider team, we are building up, through our knowledge of projects that work through agile, the expertise to make as good an estimate of costs of those projects as needs to be made at the outset. It will never be sensible or appropriate for the public sector to embark on projects when it has no idea of what the cost envelope is. We have to be able to make sensible predictions of cost so that we can plan for projects and have them signed off properly. However, the process is clearly different from the traditional one.
Forgive me, but you have just used the word “envelope”, which we never hear. I entirely understand what you are saying, but that is like saying, “The costs are somewhere between two points and I honestly do not know where, although of course I hope that it is at the low end.” Do we ever say that in public? I do not think that we do. We come up with a number, which might be the mean or the median. If what you say is the case—I understand that it might be the reality in pretty much every project—would it not be wiser if we quoted a spread of figures rather than a single figure, as that might save us all a lot of grief?
I am certainly all in favour of transparency and realism about the nature of projects.
I will make an observation and ask a question at the same time. Obviously, our three witnesses have significant experience in the civil service. I know that Sarah Davidson worked in the Parliament at one point, as she was a clerk in the first Audit Committee in 1999 when I was a member. The three of you come with significant civil service experience and are respected in that area. However, that raises the issue of whether Google, Apple or Microsoft would employ civil servants. I say that with respect for the role that you are looking to carry out. Is that one of the challenges that we face here? I ask you to detach yourselves from your current roles. Is that not what we should be looking at and how ambitious we should be? If the Government wants to run an ambitious ICT project, does it not just have to pay for the Apple and Microsoft people of the world—the people who have done nothing else from the age of 16?
I say that with respect, and I hope that you will take it in that way.
Absolutely. To run any Government project or programme, particularly the really big-value ones that are of huge importance to the reputation of the organisation and the quality of service delivery to the public, which of course is what it is all about, we would hope to have the very best people that we can find. Sometimes, that will be in-house people such as Maxine Reid who have the skills and who have chosen to make their IT development career in Government for all sorts of reasons. Sometimes, that will mean sourcing the very best people from the Googles, the Apples and other places. They might want to come to the Government for a while for personal reasons and to do that type of work or, to get their skills, we might have to pay what the market demands. We are certainly ambitious and aspirational in this context. We want to be a world-class digital nation, which means having world-class skills.
As we have identified today, we constantly manage the tension between our financial accountabilities and our delivery accountabilities to try to get the balance right. We need to recognise that there are times when we need a technical specialist and, when that is needed, that is what we have to apply.
Do you recognise that if we were running a commercial enterprise such as Google or whatever, the people who are at the very top and who are managing would be IT specialists? That is the case in Microsoft and all those companies. The Government is making a significant investment. I am not saying that we are in the same league as Apple, but we are spending significant sums of money, so we could attract people who are significant players in the IT market.
It would be interesting to know how much time the most senior managers of Google, Microsoft and other organisations actually spend on IT solutions. I suspect that the leadership and governance role predominantly preoccupies them. In the same way, I do not personally deal with IT solutions. There is clearly a leadership and management role in relation to all this, but I take seriously my responsibility for ensuring that those who are in technical positions have the skills that they need.
I thank our three witnesses for their time.
I suspend the meeting for five minutes.
10:25 Meeting suspended.Next
Section 22 Report