Public Audit and Post-legislative Scrutiny Committee

Meeting date: Thursday, April 19, 2018

Official Report 570KB pdf

---

“Managing the implementation of the Scotland Acts”

Agenda item 3 is consideration of the Audit Scotland report, “Managing the implementation of the Scotland Acts”. I welcome back to the table Caroline Gardner, who is joined by her Audit Scotland colleagues Mark Taylor, assistant director; Michael Oliphant, senior audit manager; and Morag Campsie, audit manager.

Auditor General, I believe that you have a statement to make.

Thank you, convener—I will be brief.

The report that I bring to the committee today is the fourth in a series of reports examining how the Scottish Government is implementing the new powers arising from the Scotland Act 2012 and the Scotland Act 2016. My report assesses progress up to the end of January and provides an update since I last reported in March 2017.

As the committee knows, the 2012 and 2016 acts devolved a range of responsibilities for taxes, borrowing and social security. Implementing those powers is a huge and complex programme of work. About 40 per cent of the Scottish Government’s planned spending in 2018-19 is expected to come from Scottish taxation and borrowing; that will increase to about 50 per cent by 2020. As a result, managing Scotland’s public finances is fundamentally changing. The Scottish budget is becoming increasingly complex, with greater uncertainty and volatility compared with when the budget was relatively fixed through the block grant from the UK Government. How the Scottish economy performs relative to the UK economy will have a greater influence on the Scottish Government’s choices over tax and spending than ever before.

Implementing and managing the new powers alongside the Scottish Government’s current responsibilities and responding to the UK’s withdrawal from the European Union has significant staffing implications. Over the past year, the Government has been modelling its workforce arrangements and refining its processes for collecting workforce information to help to inform its recruitment plans. That starts the process of workforce planning at all levels of the organisation, but there is lots still to do. It will be difficult for the Government to recruit the staff numbers and skills that are needed to deliver the powers in time.

I am pleased to report that the Government’s social security programme has made good early progress. However, a significant amount of work is required this year if planned timescales are to be met. That includes launching a new agency—social security Scotland—to deliver the carers allowance supplement in summer 2018, and putting in place the foundations for the IT infrastructure that is required to deliver the devolved benefits. That will require effective working with other organisations, such as the Department for Work and Pensions.

The programme is not without risk, and I highlight a number of the risks in my report, along with areas to prioritise. Ensuring that enough time is built into plans for assurance activities, procurement, recruitment and succession planning will be key to managing those risks.

Finally, the cost of implementing the new powers will be significant. The Government estimates that the social security powers alone will cost around £308 million to implement. By 31 March this year, it had drawn down the full £200 million UK Government contribution towards the cost of the new powers, with the excess to be funded from the wider Scottish budget.

There is a need for greater transparency and a better understanding of the overall costs of implementing the new powers to support financial planning. Having a clear picture of how much it is costing to implement the powers of the 2012 and 2016 acts and how that is being managed will help the Parliament’s scrutiny and decision making in the years ahead. My report also highlights the need for the Scottish Government to finalise and embed the governance and organisational arrangements for the new Scottish exchequer to oversee the continued implementation of the powers of the 2012 and 2016 acts and the management of Scotland’s public finances.

As always, we will do our best to answer your questions.

Thank you, Auditor General.

As ever, Auditor General, I am grateful for the report, which is detailed and comes across as fair and balanced. It highlights the good things but is not afraid to highlight the risks. Some of the risks on the IT system are highlighted at page 32 of the report. The committee has considered IT systems extensively over the past wee while. On that page, you highlight a number of risks for the delivery of the social security IT platform. The third one down relates to the initial design.

The Scottish Government has sent us a letter, which I presume you have seen, that rather robustly challenges that risk. It says:

“These statements are factually inaccurate … My officials discussed the detail of the CMS with Audit Scotland on a number of occasions and requested these inaccuracies be corrected … Unfortunately they were not.”

I was struck by the robustness of that language and would like to hear your thoughts on it.

You will not be surprised to hear that I disagree with the description of that risk as factually inaccurate. We take seriously the need to agree the contents of our reports with the people on whom we are reporting—in this case, the Scottish Government—precisely to avoid the committee having to get into arbitrating between my reports and those people and so that you have a professional evidence base on which to found your work.

We engaged well with Scottish Government colleagues throughout the process. It is correct that that issue was raised in clearance, and we were happy to add to the report the second bullet point in the third column of that risk, which recognises that the new case management system

“is based on an existing multi-benefit system that delivers complex benefits in other countries”,

as the Minister for Social Security says. Nonetheless, in finalising the report, I concluded that the risk that is set out on the left-hand side of that row remains. The Government is managing the risks reasonably well at this stage, but it is factually correct to say that that risk remains.

For the avoidance of doubt, is it correct to say that you disagree with the statement in the minister’s letter?

Yes. It is not at all factually inaccurate to say that that risk remains while reflecting the action that the Government is taking to mitigate it.

My question is on the same area, Auditor General. What is the basis for saying what you have said? Has some kind of technical assessment been carried out to enable you to come to that conclusion?

As you know, we have reported extensively on IT systems over the past few years. We have built up our expertise and experience in doing that. I ask Morag Campsie, who has been involved in a lot of that work, to talk you through the evidence base for the conclusion that I have drawn.

As the Auditor General said, in the report, we are just trying to highlight some of the risks. As we have set out, the Scottish Government has chosen to create the platform on a component basis. We have tried to summarise that in exhibit 8.

To deliver the first wave of benefits, the Government has procured an existing multibenefit case management system that delivers benefits elsewhere. However, it will have to be developed to meet the needs of the benefits system that the Scottish Government chooses and the rules around it. Therefore, we feel that it is still a risk.

The project is still at an early stage. The contract was issued in November and the first series of sprints took place in January and February, just as we were finalising the report. At this early stage, we are just highlighting the issue as one on which an eye needs to be kept. The fact that the system is used in other countries helps to some extent, but it is at an early stage and it still needs further development, which is why we are highlighting the issue.

Given your comment about the CMS being able to support the wave 1 benefits, are you saying, from your technical assessment, that you consider that it will not be able to support post-wave 1 developments without another piece of software being procured? I think that that is the issue at stake. The minister is saying quite clearly that it will be able to do that.

As we have set out, the system already delivers some complex benefits in other countries. The later benefits—the disability benefits—are quite complex, and it will not be until the Social Security (Scotland) Bill is passed that decisions are made on some of the rules and assessments. The test system will then need to be built around that. The initial contract is just for the wave 1 benefits, which are less complex. In our view, there will still be quite a lot of work to do in further contracts to develop the system further.

Have you seen the software?

We have not. As I said, the first few sprints took place in January and February, which was when we were finalising the report. We had not undertaken any work in the area at that time.

I should say in relation to the procurement process and the system that, as you will be aware, there are assurance frameworks in place through the Scottish Government, and there is technical assurance. The tender had gone through that technical assessment and it was given the green light to go to the next stage.

Have you spoken to IBM, which is the contractor, to find out its view? There is clearly a requirement for it to deliver the system in such a manner.

That did not form part of the audit. As I said, it is at an early stage. The contract was just awarded as we were going through the process, so we did not undertake that. It might be something that we consider doing as we continue to look at the area in the future.

Mr Coffey, Mark Taylor wishes to add some evidence.

Sorry, Mark.

I will just add a little to what Morag Campsie said. It will probably be helpful if I clarify the purpose of exhibit 9. It is not a list of things that have gone wrong; I would characterise it as a list of things that the Government needs to get right. As Morag said, the system has not been built yet, so we are not in a position to undertake a technical assessment of it. However, from our perspective and our experience of working on similar systems, this is something that the Government really needs to get right so that, as the system is built, it has the ability to have the other components plugged into it.

That is the risk that we are looking to flag up at this stage. As the Auditor General said, our judgment is that it is a live risk. It is something that the Government is alert to, given the cabinet secretary’s response, and something that it is managing. We flag it up for the committee’s purposes and for the wider purpose of Parliament being aware that it is an issue that needs to be managed and worked through.

I understand that. However, you say that the CMS might only be able to process wave 1 benefits, while the Government—and perhaps the contractor, if we asked it—would say the exact opposite. That is a fundamental difference. In the years for which I have been a member of this committee, I have never picked up something in an Audit Scotland report that says the polar opposite to what the Government is saying and, perhaps, what a contractor would say.

The other bit of evidence that I would play in is exhibit 5, which breaks down for you in a bit more detail the wave 1 benefits and the post-wave 1 benefits, as the Government describes them. It is clear from that that, in terms of complexity, the numbers of people who are affected and the amounts of money that are involved, they are very different things. Wave 1 is very small compared with the post-wave 1 benefits, and that plays into our judgment as well.

I echo strongly what Mark Taylor has said. We are not saying that this is something that has gone wrong; we are saying that it is something that the Government needs to stay on top of, given the importance of a smooth delivery of the benefits to the people who rely on them, who are some of the most vulnerable in Scotland.

Of course, but you have not carried out a technical assessment, you have not spoken to IBM and you have not seen the software, so how can you conclude that this is a possibility when you are being told the opposite—that it is not the case?

Our judgment was that the risk is inherent in the way in which the system has been pieced together. Clearly, where there is one component that is a small but important part of a platform on which everything else is built, that component needs to be designed and built in a way that allows other components to be plugged in. That is the point that we are making and, from our perspective, it is a significant thing that the Government needs to get right in future.

10:30  

From memory, more than half of the cost of transition for the social security system is down to IT systems. How are we monitoring the cost estimate for the delivery of the programme? I do not see a general overview of the overall cost estimate.

Exhibit 7 on page 26 sets out the breakdown of the figure in the bill’s financial memorandum of IT costs of £190 million. The contract that we are talking about is in the order of £8 million of that full package, so although we are talking about a core part of the system, that gives you a sense of how much extra has to be built on to it. In the report, we comment on the nature of the costing of the IT system and the stage that it is at. A lot still has to be built and decided on. As we say in the report, we expect to see greater clarity and precision on the amount of IT costs as those decisions are made. We will be alert to those and will continue to monitor them as we go forward.

Are they on track at the moment, as far as we can tell?

Morag Campsie might want to add to this, but I can say that we have made comments elsewhere in the document about the visibility of the overall cost of much of the work and the refinement of that. At the moment, the money that has been committed is within the budgets that are available.

Thank you for that.

One of the biggest concerns is about having people to staff the process, as about 1,500 staff will be needed. According to your report, a fair number of them have come from other parts of the Scottish Government. In paragraph 19, you comment:

“This has put pressure on other directorates’ ability to deliver business-as-usual activities, other new powers, and plan for the impact of the UK’s withdrawal from the EU”.

Can you quantify that in any way? Is it just an assumption or is it based on something that you have seen?

I will ask Michael Oliphant to come in, in a moment, but first I will say that there is a straightforward sense that we get from our engagement with Government, as its auditors, that people are under pressure. There is business as usual, which is demanding in itself, the new financial powers are coming through and there are preparations for the UK’s withdrawal from the European Union—whatever that may mean for Scotland, which is a very live question at the moment. From our engagement, we know that people are under pressure. We also know that people being transferred from other parts of the organisation into the social security team is having an impact in terms of pressures elsewhere.

Michael, do you want to put a bit more flesh on the bones of that?

Sure. The report points out that the Scottish Government has taken some important steps in identifying its workforce requirements, particularly over the past year. We would like to see it extend that over five years, and it has started on plans to do so.

A lot of that comes down to the movement from generalist skills to more specialist ones, particularly in matters such as long-term financial planning, financial modelling, economic forecasting and, as we have touched on already, IT and digital skills, an element of which is about the need for cybersecurity specialists. A lot of what is going on is about current needs, but we are keen that the Scottish Government map out its longer-term needs and that it factor in, as best it can, things that are unknown at the moment. Colin Beattie mentioned the UK’s planned withdrawal from the EU being one of those.

The committee has talked about IT skills shortages quite a number of times in the past, and Willie Coffey has raised them again today. However, you are talking about a wider spread of skills shortages. Is there a skills shortage other than the IT skills shortage, of which we are already well aware?

Yes, there is, and that is part of the challenge that the Scottish Government faces. It is dealing not just with getting the numbers of staff in, but with the availability of the required skills in the market, and it is trying to compete externally, too. That is also a risk that the Scottish Government needs to manage in relation to retaining the staff that it has now: it must not lose them and their skills to external providers, whether in relation to IT or finance, which is why it has undertaken some work to develop its talent management programme with a view to retaining key skills, as well as looking for additional support.

I suppose that it would be far too simplistic to say that if a body of work were taken from one area of the civil service to another, some of the skills would follow it as there would be less work in the original area.

Are you referring to skills in the Department for Work and Pensions?

Yes.

In principle, that is probably right. In practice, the scale of DWP activity that is transferring is very small relative to its overall work, but the work is still very significant for the Scottish Government, which has not had to do it before. It is unlikely that there will be surplus people in the DWP on any significant scale to help to fill the gap. I know that the team has been looking at that. Perhaps Michael Oliphant will add to that.

There is not much to add. However, one of the key things that we have flagged up to the Scottish Government in our discussions on that specific topic, which the Scottish Government is keen to include in its longer-term workforce planning, is that when a member of staff leaves one directorate to move into another part of the Government, it must be ensured that a transfer of knowledge takes place. That is also important when short-term contractors are used or when people come in on secondment. Although that might provide a short-term fix with regard to skills, it is important that, as part of their work for the Government, people pass on their knowledge and expertise to others.

Are you satisfied that there are fairly robust processes in place for that to happen?

From the work and analysis that we did over 2017, we can see that the situation is improving, but more needs to be done to identify the number of people, the type of roles and the skills that will be required over the longer term.

I am pleased to hear that the Scottish Government has put in place a good workforce plan, because that is certainly the first step, but does it have a robust recruitment process? I realise that it is limited by what is available in the market, but is the process constructed in such a way that it will get the best out of the market?

It is perhaps too early for us to say, because a lot of the substantial recruitment—the 1,500 members of staff for the social security agency that Colin Beattie mentioned—is still to take place. That is certainly one of the biggest challenges that the Scottish Government faces in relation to social security. It is not just the skills, but the numbers that are needed in place, particularly with the external competition that is faced.

Clearly, not all 1,500 will be highly skilled IT or financial experts. A lot of them will be counter staff and so on who will deal with people. Is there more that the Scottish Government can do in that regard, or is it doing all that it can, given the limitations of the market?

As we say in the report, some important early steps have been made in identifying immediate need. Some steps have been taken to integrate the workforce requirements in terms of recruitment processes, which were previously done in isolation, with each directorate identifying its own recruitment needs and undertaking recruitment campaigns on its own. A better process is now in place to co-ordinate and integrate the workforce planning requirements and the recruitment strategies that come out of that. It is just too early to say yet whether that will be effective.

Auditor General, you mentioned at the outset the £200 million budget being drawn down. To put that in context, key message 4 of the report says:

“Under the fiscal framework, the UK Government will contribute £200 million to the costs of implementing the new powers. The Scottish Government will have drawn down all of this by 31 March 2018”

and we assume that it has. Key message 4 continues:

“The Scottish Government has not estimated the total overall cost of implementation.”

That statement rather concerns me. I think that I am right in saying—you will correct me if I am wrong—that you raised exactly the same point in your report in March 2017, and said that the Scottish Government really ought to be working out how much money it will need to do this. Is it true that nothing has been done in that regard and, if so, does that concern you?

First of all, the sum of £200 million was agreed in the fiscal framework as the UK Government’s contribution to Scotland’s implementation costs; it was never intended to be an estimate of the costs of doing it all.

The sum was negotiated and agreed between the UK and Scottish Governments. Beyond that, and for that very reason, it is important that the Scottish Government develops its own estimates and makes them more transparently available to Parliament and others with an interest, in order to support Parliament’s decision making on, for example, the Social Security (Scotland) Bill and the proposals on the new tax powers.

It is not fair to say that nothing has been done, but it is becoming increasingly urgent that the work be completed and made transparent. Mark Taylor will tell you a bit more about what we have seen in the past year.

To pick up on the premise of Mr Kerr’s question, we made that recommendation last year. We emphasise in our “Managing the Implementation of the Scotland Acts” report that that has yet to be done. It is important that it is done, so that Parliament and the public have a sense of how much the package of new powers will cost. There is information available on the costs, including the £308 million estimate on social security that we have talked about, and we were able to pull together figures for the report—you will see them in exhibit 4—from various sources that are available in the public domain.

Our essential point is that the Government has not done an overall assessment. To illustrate the point, I highlight that we had to work hard to pull together the numbers in exhibit 4 from lots of different places. There needs to be greater clarity about the total expected cost. That cost will need to be refined as decisions are made and work develops, but it is important that it is clear to Parliament to what figure the Government is working.

In the report, you go on to say that the excess—that is, the amount above the £200 million contribution; you mention a cost of £308 million to implement the new social security powers, for example—will need to be funded

“from the wider Scottish budget.”

Will you put that into context for me? I presume that that is cash that could or should be spent on the Scottish Government’s other spending commitments. Is that correct? Will the money have to be pulled from one place and spent somewhere else?

As the Auditor General explained, the £200 million is a contribution from the UK Government that was agreed through a political process. The expectation was always that the package of powers would cost more than that. Therefore, by definition, the balance needs to be funded from the Scottish budget, so the Scottish Government and the Scottish Parliament will have to make a choice about how that will be done and how much will be allocated in order to achieve those aims. Our point is that there needs to be greater clarity on the extent to which that is likely to be the case. We also make points about how those costs are treated in the budget, so that there is greater clarity for Parliament about the money that has been allocated and the timetable for that.

The lack of clarity in planning gives me cause for concern. Mark Taylor mentioned the £308 million implementation costs related to social security. Paragraph 30 of the report says:

“At the time of publishing its 2017/18 draft budget the Scottish Government had not prepared detailed spending estimates for the social security programme”.

Where will the £308 million come from? Is that a finger-in-the-air estimate? How accurate is the figure?

The £308 million is the initial assessment from the Social Security (Scotland) Bill’s financial memorandum, and Government has given evidence elsewhere on its make-up. Inevitably, it includes a fair number of estimates and assumptions about decisions that are yet to be made and what the financial consequences of those will be.

The figure is the Government’s current estimate. In our report, we describe how the Government needs to continue to refine that estimate as it takes decisions.

One big part of that, which we touched on earlier, is the IT element of the cost and the extent to which there is a fair amount built into the estimate for uncertainties—“optimism bias” is the technical phrase—and we are clear in the report about the need for the Government to bring that figure down as it makes decisions, and to provide more certainty about the expected cost in that area.

10:45  

Given that, in March 2017, you recommended similar things to what you recommend now, do you get any sense that the next year will be different and that you will produce a different report this time next year?

We are always optimistic. This time, the basis for that optimism is that we understand from discussions with the Government that it intends to give more indication of the overall cost in the section 33 progress report that it will prepare over the next month. If that happens, we will welcome it.

I want to ask about the new powers on borrowing and reserves. I confess that I do not entirely understand paragraph 130 of the report and I wonder whether you could clarify it, Auditor General. It says that the Scottish Government has not agreed the overall principles and policies for borrowing and the use of reserves, but that the powers are now available. It is not clear to me from the subsequent paragraphs whether that means that the Government is not able to use the powers yet, or whether it is using them under some temporary agreement with the Treasury.

I refer you to exhibit 1 on page 8 of the report, which sets out the timeline for the new financial powers. The block for 2017 sets out the overall and annual limits for the increased borrowing and reserve powers. Those powers are now in effect and the Government has access to the overall limit, subject to the annual limits for borrowing and for moving money in and out of the reserves.

The point that I was trying to make—obviously not very clearly—in paragraph 130 is that it would be a real contribution to financial transparency and Parliament’s decision making if the Government were to publish the principles that it plans to apply in using the borrowing powers, such as the extent to which it intends to draw down money to invest in capital infrastructure; the extent to which it intends to hold back some allowance in the borrowing powers or the reserves to allow for the unexpected that might come out in the foreseeable medium-term future; and the policy decisions that it needs to make about the way that those things will be used, rather than provide Parliament with proposals for decision in isolation each time.

Paragraph 131 refers to a memorandum of understanding that was expected at the end of March, which has now passed. Did that materialise?

I am afraid that we have no immediate information, but we can get back to the committee on that.

I want to go back to software. In paragraph 76, you alert us to the potential risk in our dependency

“on the DWP to modify ... systems”

so that we can make them fully compatible with ours. Do you know of any agreement in place in the project for the DWP to modify its systems in time? We have no control over the ultimate delivery of that particular aspect of the system, unless it is by an agreement that is written into the contract. Will you tell us a wee bit more about that?

In the report’s key messages on page 10, we conclude that the Scottish Government has

“effective working relationships at an official level”

with the UK bodies involved, which are the DWP and Her Majesty’s Revenue and Customs, primarily. I ask Mark Taylor to talk in a little bit more detail about that.

The complexity of the programme means that there are discussions on a range of systems and interfaces across the activities that are set out in exhibit 5, and those are at different stages. We have evidence, and we say in the report, that, at an official level, the DWP and the Scottish Government are working well together on those. We also set out in the report some of the governance arrangements at official and ministerial levels through which those discussions take place.

As a result of that, there is a degree of shared project planning and a degree of Scottish Government project planning. The risk there is around making sure that those two things are co-ordinated and work together. In paragraph 76, which you mentioned, we are clear that that is a fundamental part of making sure that things progress on time.

It is important for the Scottish Government to manage its relationship with the DWP and that both parties continue to work well together if the whole package of change is going to be delivered to the timetable that has been set out.

If everyone is working well together, why do you say in paragraph 76 that

“There is a risk that Scottish Government requirements are not given enough attention due to the DWP’s other priorities”?

Why would you say that, if everybody is working well together and getting on fine? Is there a contractual agreement in place to deliver this or is it a “getting on fine” arrangement?

The project is at an early stage. We can point to what is being delivered and the individual agreements between the DWP and the Scottish Government in relation to things such as Scottish universal credit choices, for example. Particular arrangements and agreements are being put in place around some of those areas and around the wave 1 benefits.

The reason for flagging up that risk at an early stage in the project is to make it clear that, from our perspective, it is an absolutely fundamental thing that the Government needs to get right, and both parties have a part to play in that. We have no direct visibility over the operations of the DWP—we talked at a previous session about some of the limitations in the audit arrangements. At the moment, there are no immediate signs of concern, but that is an inherent risk in relation to the project, and the Scottish Government and the DWP absolutely need to pay attention to it.

Just to be clear, is it the case that there is no contractual obligation on the part of the DWP to deliver what is required on time for the project?

It is worth being clear that, in contrast to the arrangements for the devolution of income tax, which the Scottish Government is required to collect and administer through HMRC, the Scottish Government has chosen to deliver its social security powers with the DWP. That changes slightly the dynamics and the set of things that need to happen. As Mark Taylor said, the evidence that we have suggests that, so far, it is working well. There is still a long way to go and it will depend on good joint working from both parties—here in Scotland and in the DWP.

The Scottish Government has promised half of the 1,500 jobs to Dundee, and the first wave of benefits have to be administrated and given next summer, but the Government has still not identified a premises for the new agency in our city. I understand that the minister might be making an announcement on that next week. Are you concerned that it is indicative of where the Scottish Government is in its planning process that, to date, it has not identified a premises for the operation?

The overall message of the report in relation to social security is probably that the early progress that has been made is good but that 2018 is absolutely critical in terms of establishing the social security agency and being able to deliver that first wave of benefits next summer.

We have talked about the range of things that need to happen for that to be achieved successfully. It is about premises, staffing and the IT system. Although the early progress has been good, there is a huge amount to be done over the remainder of this calendar year to make things happen in practice.

Would you have expected something as fundamental as where the agency will operate from to have been identified by now?

The question is less about whether that particular announcement or decision should have been made by this stage and more about the overall ambition of looking to deliver the first wave of benefits by the summer of 2019. We think that it is achievable but, as we say in the report, it will be challenging to get all those things in place. Naturally with that timescale, decisions will be announced in relatively short order. There is no room for delay or slippage in that.

I understand that nearly 600 people applied for the first 80 jobs that were advertised, so there is certainly a lot of interest in the community regarding the jobs.

I thank you all for your evidence this morning. We will now move into private session.

10:54 Meeting continued in private until 11:30.