Contents
- Attendance
- Decisions on Taking Business in Private
- Audit Scotland Report
Audit Scotland Report
“Social security: Implementing the devolved powers”
Under item 2, the committee will take evidence on Audit Scotland’s report “Social security: Implementing the devolved powers”. I welcome Caroline Gardner, the Auditor General for Scotland, and her team from Audit Scotland: Mark Taylor, audit director; Gemma Diamond, senior manager; and Kirsty Ridd, senior auditor. You are all welcome this morning and thank you for coming to the committee.
I invite Ms Gardner to make an opening statement before we move to questions.
Thank you, convener. I am pleased to bring to the committee today my latest report on how the Scottish Government is managing the delivery of the new social security powers. The report looks at progress up to the end of February this year, while taking account of the activity that is under way.
The Scottish Government has done well to deliver the commitments that it made for the past year. They include launching Social Security Scotland, which is responsible for delivering the benefits as they are devolved. As you know, the agency became operational in September 2018 and now employs more than 320 staff.
The Government has also launched its first two benefits: the carers allowance supplement and the best start grant pregnancy and baby payment.
The social security programme has also undertaken important groundwork to support the delivery of future benefits and promote its aims of fairness, dignity and respect. That includes publishing the social security charter, and establishing the Scottish Commission on Social Security. The programme has also continued to engage people who will use the new systems in the design process.
However, delivery of the first benefits has been harder than expected. The programme has been working flat out, and the scale and complexity of the work involved has become clearer as teams plan the delivery of individual benefits.
The programme has continued to find it difficult to recruit the skills and experience that it needs in its staff, leading to greater than expected reliance on temporary and contractor staff, and pressure on the staff it does have. The programme has done well to respond to the challenges to date, but the processes and systems that it is currently using to plan and support implementation will not be enough to support the next stages.
The programme’s financial reporting has improved, but it has not been monitoring or reporting how much it will cost to fully implement all the benefits.
Delivering the second wave of benefits will be a significant challenge. Wave 2 benefits involve more complex assessments and regular payments that affect people’s day-to-day income. The programme is carrying out a wide range of work to prepare for the next stage of delivery, including revising the overarching business case, reviewing the governance and planning processes, and working to address resourcing challenges. The programme is doing the right things and is committed to learning lessons, but there is a risk that the pace of work and constant delivery pressures might not allow the team the time and space to make change quickly enough.
Finally, the Scottish Government does not yet have a clear understanding of the key things that are needed to deliver all the remaining benefits in the way that it intends. It now needs to develop its critical path of planned actions for the rest of the programme.
I am joined by colleagues who worked on the report, and we are happy to answer the committee’s questions.
Thank you for that opening statement. We will move to questions.
Good morning, and thank you for the report.
The challenges to date have obviously not been insignificant, but it is fair to say that they have been met. However, you are clearly expressing concerns about the increased challenge in delivering the next wave of benefits, some of which are more complex. The three forms of disability assistance will easily be the biggest part of the new system, accounting for well over half of current spending. Disability assistance for children and young people is launching next summer, and the report refers a lot to the Scottish Government needing to do more to be ready for the wave 2 payments.
I would like to know more about the level of preparation for those disability assistance benefits in particular. Could you expand on what has been done particularly well so far? Do you believe that everything can be in place to successfully deliver those important benefits next year?
I will kick off and then ask members of the team to give you a bit more detail.
We think that the groundwork that the programme has put in place is exactly right. There is the ability to put in place the staff in the programme and the agency, ways of working and some of the key systems and processes that will be needed for all the benefits—that is all in hand.
As the committee knows, the Government has prioritised safe and secure delivery throughout the programme and, for that reason, the benefits in the first wave are deliberately the ones that are easier to manage. They tend to have smaller case loads, they are easier to risk assess and the payments are one-off payments rather than regular payments. You are quite right that, as we move on to the disability benefits, those things start to revert. There will be much bigger case loads and it will be harder to assess people’s eligibility. There will also be the need to make regular payments that might change from week to week and month to month.
I will ask the team to pick up what we think are the particular challenges and where the focus needs to be as we move into that next phase of work.
The report essentially sets out where the planning horizon is at the moment. A lot of detailed work is being put into what is coming next with the completion of wave 1 benefits and the early work on wave 2 benefits.
We are clear that there needs to be more of an overall sense of the plan in order to deliver the whole range of benefits, including disability benefits, as we go forward. There needs to be a clearer idea of what the main milestones are, where the critical decision points are and how all that fits together to enable more of the detailed planning.
The Government’s approach is to learn as it goes, and to take an agile approach to building systems incrementally as it goes on. We are clear that, as well as that, there needs to be a greater view of the key things that need to happen and in what order, so that the benefits, including disability benefits, can be delivered within the timescales that have been set out.
I will build on Mark Taylor’s point about being agile in what will be an iterative process. There should be a clear understanding of the key dependencies, what systems will be required for certain benefits and what parts of the system will be developed over time, which will affect the procurement timescales. It is important that the critical path sets out the key dependencies. If a procurement decision is not made in the right timeframe, we should understand the knock-on impacts that that will have on all the different benefits. As Mark Taylor said, we should also think about the order in which decisions need to be made, because certain things such as the digital systems will affect multiple benefits. The critical path is key to helping our understanding over a longer timeframe. The programme has a lot of planning in place. Lots of individual project plans set things out, but we are looking for something that sits above that work and focuses on the critical path over a longer timeframe.
It is key that we have in place a sufficient number of staff and so on, and my colleagues will pick up that line of questioning.
However, if we have a system that is not working as smoothly as it might be, it is more likely that errors will arise. Such errors could lead to overpayment or underpayment; that can be particularly devastating, and neither of those is welcome. Statistics from the Department for Work and Pensions tell us that, across the United Kingdom in 2018-19, there was £600 million of payment error for personal independence payments, which are just one of the payments that are being devolved. That included more than £340 million of underpayment, so there might have been roughly £34 million of underpayment in Scotland, and that is for just one form of assistance. What can the Scottish Government do to reduce that level of error?
You are absolutely right to say that that is one of the challenges that the Scottish Government will need to face as it takes on the responsibility for benefits that have, historically, been administered by the DWP. Across the whole UK social security system, there have been very high levels of error and fraud, which have led to the DWP’s accounts being qualified over a number of years. As the benefits come across and as existing claimants are taken on, the Scottish Government will need to plan for how it will tackle that challenge.
As the committee knows, the Scottish Government is taking on the responsibility for new claims, and it has the opportunity to put in place not only its own eligibility criteria but its own assessment processes. It is focusing more on face-to-face and assisted processes for people to make their claims, so that people do not get more or less than they are entitled to. As we say in the report, the Government will need to consider how well that system works, as it moves on to take responsibility for the new benefits that involve more claimants and more money. That is where the principles of dignity, fairness and respect become so important. The audit team, which is led by Mark Taylor, will look at how well that work has been done for the first wave of benefits, and at the preparations for the much bigger and more complex benefits, as it begins its audit of Social Security Scotland’s first year.
I know that this is understood, but it is worth stating that, given the nature of benefits, the system is complex. It is difficult for claimants and officials to navigate the system, particularly as more and more benefits are included and given the interplay between reserved and devolved benefits. There is an inherent risk of fraud and error in such a system. When we did our work earlier this year, we found that the understanding by the Government and Social Security Scotland of what that means in practice for the benefits that have been devolved is at an early stage, and more work needs to be done. As the Auditor General said, that will very much be the focus of our on-going work, as we look at the agency’s accounts for its first year. We will look both at what the agency can do with the new benefits for which it is taking responsibility and at the continuing impacts from the underlying systems that the DWP provides but which the agency will continue to use in some areas.
09:15
I have a couple of questions on this matter, the first of which relates to the risks that the Auditor General has highlighted with regard to the more complex and demanding nature of wave 2 benefits. I note that the report says:
“There is a significant amount of work under way to prepare for the next stage of delivery. This will need to be implemented quickly.”
Moreover, the following paragraph—paragraph 95—says:
“The programme and its staff show a good level of self-awareness and willingness to reflect and challenge themselves on progress. But, given the ongoing challenge and demand of delivering the rest of the wave one benefits along with the work to design and implement the wave two benefits, there is a significant risk that the programme doesn’t have the time and capacity to learn from experience to date and make the changes necessary to successfully deliver on wave two timescales.”
That comment seems to contradict itself: it suggests that, although things are going well and staff are aware of the risks and are taking steps to deal with them, significant risk still remains.
I also note that paragraph 102 talks about changing management structures, redesignating the job specifications of some senior management posts and recruiting those with the additional skill levels required to deliver wave 2, so there seems to be a dynamic in the organisation to identify these significant risks and to take appropriate action to mitigate them. I do not doubt that there are significant risks—indeed, that must be de facto the situation with something of this level of complexity—but do you think that the actions that Social Security Scotland and the Scottish Government are taking are adequate to identify and mitigate the risks outlined in the report?
At this stage, we think that they are probably doing all that they can, but that cannot eliminate the risks altogether. For example, we know that the Scottish Government will need to continue to work very closely with the DWP not just until 2024 but into the continuing future, because of the extent to which some UK-wide benefits are qualifying eligibility criteria for Scottish benefits. That relationship will continue, and some of the problems that Mark Taylor has outlined about levels of error and fraud in the DWP are things that the Scottish Government will have to manage and respond to.
At the top of page 31 of the report, we say that getting the right staff in place will be key to addressing some of the risks that we have identified, and we know that the agency and the programme are struggling to do that in some areas. Digital and business analyst skills, in particular, are in short supply across Scotland, and there is a risk that, no matter how hard the programme works to recruit those skills, there will still be gaps that will get in the way.
One last point that I should make is that some of the work that is having to be done to deal with the complexity that is being uncovered and understood means that the work that still requires to be done is increasing. In the report, we mention the workaround that was needed to check eligibility for the pregnancy and baby payment of the best start grant. That was a good thing to do to ensure that people got their money on time and to cut down levels of error, but equally the work to get the proper interface in place between the two systems still remains to be done. There is a sort of snowplough effect, with work being moved forward as workarounds to solve immediate problems are put in place.
I recognise your sense that we are having our cake and eating it by saying in the report that the staff have done very well but risks remain, but that is genuinely our assessment of the programme at the moment. Really good progress has been made, but there is a lot of significant and complex work to come.
That is a completely reasonable view, but I am just trying to get a sense of whether the Government and Social Security Scotland are sighted on, are aware of and are seeking to mitigate and manage those risks appropriately. I am not trying to put words into your mouth, but I think that that is what you are saying. Is it reasonable to suggest that what you are saying is that you did not identify any risks that the organisation was not aware of and which it was not taking any steps to deal with?
We say very clearly in the report that the programme is self-aware and is doing the right things, but we have also said that it is essential that it has that critical path for delivering all the devolved benefits and that, as Gemma Diamond has just described, it understands the key decision points, the interactions and the effects of some of those things slipping or encountering unexpected problems.
That is helpful. We will move on.
I am interested in what the report has to say in paragraphs 78 and 79 or thereabouts about the digital arrangements for the new benefits, and I am curious as to how they relate to some of the more antiquated systems that exist not just for certain reserved benefits but for communication between the new agency and the DWP. I believe that there are some parts of the DWP that still operate on paper-based systems that date back to 1948. I am curious to learn a bit more about what you found out about the digital side of the new arrangements.
I will ask Gemma Diamond to pick that up, as she is our expert on digital.
It was evident to us that, as far as the programme is concerned, there are good relationships with the DWP when it comes to understanding the DWP’s systems and how the new system that Social Security Scotland is building will interact with those DWP systems. It is fair to say that the DWP’s systems are very complex—it has individual systems for individual benefits that need to talk to one another. The approach that the Scottish Government has taken has been to build one system for all benefits to avoid the need for different systems to have to talk to one another. There will need to be a long-term relationship with the DWP so that the Scottish Government’s system will be able to get information from the DWP’s systems and to talk to those systems.
The Scottish Government has made some decisions for the short term to make use of some of the DWP’s systems. For example, the Scottish Government does not currently have a payment platform that would be able to cope with the volume of payments that go out through the social security system, so it has an interim agreement with the DWP to use its payment platform to make payments. The Scottish Government’s digital directorate has an on-going project to look at a payment platform for Scotland.
In addition, the new agency is making use of the DWP’s customer information system, which allows it to check whether a claimant has the passported benefits that make them eligible. For example, there are some underlying benefits that people need to be on to be eligible for the best start grant, and the new agency can use the DWP’s system to check that. There will need to be many different interactions with the DWP’s various systems over time, but the Scottish Government has taken a different approach to building the new benefits system.
I am interested in what the report says about some of the technical issues, although I do not claim to understand them. It says:
“when the contract was agreed, the programme understood that the DWP owned a key piece of coding that would be required. This was not the case and required the programme to negotiate purchase of the coding from a third party”.
Do such issues present obstacles that create difficulties or costs for the Scottish Government?
We make it clear in the report on several occasions that it is a complex situation and that, as the Scottish Government and the DWP get further into the process of looking at how the different systems will interact, further complexities will arise. The code example that you mentioned is one of those; another is the need to use different arrangements when the best start grant went live because the relevant component was not ready. There will probably be further such examples in the future as more complexities arise.
The Scottish Government had good contingency arrangements in place to manage the situation. Because it saw what was going to happen and put contingencies in place, delivery went ahead as per the timescale. The Scottish Government has good enough relationships to ensure that it has the right contingencies in place.
The relationships are there, but in the case that I mentioned, the suggestion is—if I read what the report says correctly—that there were costs involved for the Scottish Government because of an action at the DWP’s end. When I say “costs”, I mean costs that were incurred in fixing a problem that appears to have been created at the DWP’s end. Is that a pattern?
Costs arose in that case because the Scottish Government had to purchase the code. At the moment, that is an isolated example—we do not have any more examples of that nature.
You say in the report that the timeline for delivery of entitlements is clear, but that the workforce and financial planning to support the meeting of that timeline are not yet in place. Can you tell us about the gaps that exist in the workforce and financial planning? What are the blockages to putting those plans in place?
Exhibit 1 sets out the Scottish Government’s plans for delivering the devolved benefits to new claimants, and for transferring across all existing claimants by 2024. That timeline is in place. As Gemma Diamond said, there are project plans for the individual benefits that sit underneath that timeline.
However, we do not yet see the overarching plan that would pull all that together to make it clear what the key decision points are, what needs to be in place to make sure that everything else can follow, and what the dependencies are if one benefit will rely on a system that needs to be in place for another benefit. We think that such an overarching programme is now urgently needed. Once that is in place, it will be possible to put in place the more detailed plans for finance so that we know what needs to be spent in each of the years between now and 2024 to get systems up and running and for the staff that are required for each of those key bits of work as it happens.
In response to Mr Allan’s question, digital skills are one of the things that are lacking at the moment, and that is not just for this programme: it is Scotland-wide. It means that the Government needs a clear picture of when people will be required to develop and deliver a particular solution to make sure that we have the right skills, and can then move on to work on another benefit at the right point, rather than risking people being tied up elsewhere in the programme or the Government when their presence is key.
That critical path is really important. The delivery timescales need to work with the workforce plan and the finance plan so that the three things sit together and support each other.
That is also being done under a revision of the overall business case that is under way, which is allowing the programme to reset its overall case and priorities. Delivery is not just about timescales; it is also about what is being delivered, which is called the minimum viable product—it is enough to enable delivery but it will be built on over time, as part of the iterative approach. It is essential to be able to say what the minimum viable product has to look like each time and how it will be built on over time. That forms part of the critical path.
Is it possible to develop a detailed financial plan before things like the level of payments and eligibility criteria are fully defined?
It is possible to revise the initial estimate in a way that is informed by everything that has been achieved so far. The financial memorandum sets out a set-up cost of £308 million for the programme and the agency. So far, the Government has spent about £87 million—the team will keep me straight on that.
Some of the decisions that have been taken to date will change that estimate of £308 million. The Government recognises that that estimate was made without knowing some key things, and in advance of some decisions that would have long-term consequences. Two years in, it is timely to revise it. I am sure that it will need to be revised again: doing so means that the programme, the Government as a whole and the committee can monitor how much is being spent. They can make sure that the overall costs are affordable within the total Scottish budget, and get a sense of what is costing more than expected and what is costing less, and what will be required for the remaining period. The figure will never be absolutely accurate, so it is important that the one that was in the initial financial memorandum be revised now to take account of where we have reached.
Alison Johnstone talked about it being expected that the first disability payment will be in place for next summer. Have the necessary decisions been made to allow that to happen? Is there any risk to that timescale?
Kirsty Ridd might want to come in on that.
Yes, and Gemma Diamond might want to come in on the digital side.
A lot of groundwork is being done on that benefit. Planning is in place, and comments have been made about the higher-level planning. One of the key things that will need to move forward in the next year is the digital infrastructure for that benefit to be launched. We know that work is being done to appoint the contractor to make the necessary changes or developments in the existing systems. That will be a key element of progressing the benefit.
09:30
For each individual benefit, regulations must be laid and will have to go through Parliament. Moreover, it is necessary to make changes not just to the digital infrastructure, as Kirsty Ridd has pointed out, but to the wider infrastructure, in order to get the system ready to deliver a benefit that has different eligibility criteria and a different approach to assessment.
Those decisions have to be made and—as we have seen—planning has been done to allow that to happen. What we call the critical path sits above all that and has a longer-term timeframe; individual project plans pick up individual items.
I have two questions; the first is about a kind of overview and the second is about delivering the new dignity and respect approach.
When I read your report, I was alarmed by the number of times that you talked about serious challenges, significant challenges, significant resource challenges and so on, which caused me concern about deliverability of the agency and the benefits programme. However, when we spoke to the Scottish Government last week, I felt less alarm: indeed, I felt quite reassured by what we heard when we raised the matter. Do you have any serious concerns about the Scottish Government not delivering according to the timescales, or are you just reminding it of what it might have to deal with along the way and saying, “You just need to get there”?
We genuinely think that strong foundations have been laid for the next stage, as you can see from the way in which the wave 1 benefits have been delivered and from some of the building blocks that have been put in place. I hope that what the team has said has given you a sense of how the programme has done that.
We know that the wave 2 benefits are a really significant step up. The benefits that have been delivered so far will account for about 2 per cent of the total £3.5 billion that will be spent on social security benefits by 2024, and they have much smaller case loads, assessment of eligibility is much more straightforward and, on the whole, they involve one-off payments rather than regular payments that comprise the bulk of people’s day-to-day living income.
I think that the Government recognises the scale of the challenge that it faces. It has made it very clear that it is prioritising safe and secure delivery, which I think is the right choice: as we have said in the report and as the team has pointed out, people are aware of what needs to happen. Moreover, a lot of work is going on in terms of learning from experience. For example, after the launch of the pregnancy and baby grant, there was a review of what had worked well and what could be done better next time so that lessons were learned. That is all really good stuff.
However, there is a risk that the people who were needed to deliver those benefits might not be available. When our report was being finalised, there was a vacancy rate of about 30 per cent, with vacancies particularly in digital and programme management. The other thing that would help to manage the risks would be a clear timeline from here to 2024 of all the things that need to happen for the programme as a whole, rather than for delivery of the individual benefits, as set out in exhibit 1 of the report.
We genuinely hope that it all works well, but there is a risk that it might not, so the Government will need to think through its contingency planning for how to respond to such a situation and the workarounds that might be possible. It has done that sort of thing in the past—the report contains an exhibit on the pregnancy and baby grant, for which, because the interface was not available, a manual workaround was put in place—but, where that happens, it has a knock-on effect. Understanding the whole programme and managing it actively is, I think, the best response to the risk that we genuinely think exists.
I apologise if this is a very basic question, but what is Audit Scotland’s role in all this? When will we hear from you again on the progress that you think the Government is making?
As of now, we are auditing Social Security Scotland’s accounts; Mark Taylor will lead that audit, and I will report on it in the usual way in the autumn. Our performance audit programme also has a continuing stream of work that will follow up on the report that we are discussing today more widely throughout 2020, given the scale of money that is being spent and—more important—the impact on people’s lives. We will continue to monitor the situation.
So, we will hear what you are thinking in the autumn and again next year.
Indeed.
The aim is to deliver a system that is based on dignity and respect. You will know from the legislation that has been passed that there are several differences between the system here and the DWP’s, one of which relates to the redetermination process. Crucially, if the applicant is not successful in that process, they have the right of appeal, and the legislation also contains a commitment that the paperwork will follow the person, should the matter be taken to tribunal. It is all about accessibility to the appeals system, and so on. Do you look at that level of detail—whether the agency can deliver on those commitments within the principles of the Social Security (Scotland) Act 2018?
We can look at how well that is being delivered as part of the future performance audit work. The general principle is that it is for Government to set policy. The Government has been clear about its commitment to dignity, fairness and respect, and is now setting out its plans for what that means in practice.
Clearly, there is an important role in this for the Scottish Commission on Social Security and for the social security charter. We recognise the progress that has been made in setting those up, but we can, as part of our wider look at how the policy is being delivered, look at how well those elements of the process are working.
That is helpful to know, because it will require a different system from that of the DWP—it will require your staff and systems to do something different. You have said that you will look at that.
That is another example of where real achievements have been made so far. The next wave of benefits will be more complex and it will be more resource intensive to do them well. We will look at how that is set up.
The deputy convener mentioned evidence that we got from the Scottish Government. It is worth putting on the record that, on 2 May, the Scottish Government wrote to the committee with its response to the Audit Scotland report, much of which it welcomed. If anyone who is following committee proceedings wants to look at the letter, it is in the public domain, on our website.
The deputy convener asked whether the process was being rushed. In section 43 of the report you give an example of a decision that was discussed at three delivery board meetings. Your conclusion was to suggest that “more time” was required. I would have thought that a decision should have been taken sooner. Is it your view that delivery is being rushed and requires more time?
I do not have the exact reference of that paragraph, but we say later in the report that it is hard, particularly given the Government’s commitment to prioritising safe and secure delivery, to see how a programme of this scale could be delivered more quickly. That was one example of a decision that took longer than expected and had to be taken outwith the normal governance processes to make sure that there was not a knock-on effect on other parts of the programme.
Good programme governance arrangements are in place; there are the right governance boards and flows of information. Over the past year, some of the boards—particularly the delivery board, which is one of the key boards—have, because of the pace at which the programme moves, found it increasingly difficult to manage the volume of information coming through. The example that Keith Brown mentioned is one of big decisions that would, because it was on a key system, affect the rest of the programme.
The right support and enough time and space within the governance boards would allow the senior responsible officer to make a fully informed decision. We felt that, although that was within the SRO’s role and within governance, a little more time might have enabled the SRO to make a more fully supported decision.
The programme acknowledges that some of the governance mechanisms will not be right for wave 2. That is being looked at to ensure that the delivery board can manage the information that comes through, and so that the programme board, which is the most senior board within the programme, is getting the right level of information about significant procurement decisions and business cases, so that it has a greater role in some of those key decisions. The programme board is aware of those issues: it is taking them on board and trying to rework some governance arrangements so that it can cope with the pace and, as we move on to wave 2, with more complex information.
I will just add an overview. From what we have seen, we are clear that there is much to do. At the time of our report, there was completion of wave 1 and there was the further task of getting the wave 2 activity up and running, as we have discussed.
However, the committee will see reference throughout the report to there also being ambition for changes to governance arrangements and how things are done. Improved planning and financial management will be required, and there is the job of getting the agency’s staff from 320 people to where it needs to be. At the heart of our concern, looking forward, is the question about how do-able the volume of activity is. As has been said, a timeline has been set out: the challenge that we are laying down is about how the detail in that timeline can be delivered, given the significant volume of activity that is under way that needs to be completed if we are to deliver according to the timeline.
Thank you very much. In compiling the report did you talk to service users?
We did not do that for this report, because of the timing. We were completing the work in February, just as the first benefits were being dealt with. In future work, we certainly will do that; it is something that we do routinely in our work, when it is appropriate. For example, on early learning and childcare, or on self-directed support matters, talking to service recipients is a key part of our work.
That leads on to my other concern, which is whether the report is timely, given that you have not been able to talk to service recipients. Knowing what they feel about the service must surely be a fundamental factor in being able to judge whether it gives value for money. I have heard accusations that Audit Scotland inquiries are onerous for organisations. At the start of the meeting, you mentioned that the agency is working “flat out”, and you have told the committee about all the work that it has to do, yet it is also having to respond to what seems to be a fairly intrusive inquiry.
I do not know—it would be interesting to find out—the cost of your inquiry and whether it is in addition to the cost of any internal audit functions that the agency has, which will be on top of the cost of external audit functions. It would be interesting to know whether the concerns that people have expressed about Audit Scotland’s role—especially at this stage, in the early part of the development of the process—are appropriate and proportionate.
That is the judgment call that we always have to make. Auditors are sometimes accused of coming along after the battle and bayoneting the wounded. There is clearly a limit to how useful we could be if we were to wait until 2024 and then look back at what had happened over the previous six or seven years. I also think that this is such a significant part of the new devolved powers of the Scottish Government and the Scottish Parliament—it involves £3.5 million-worth of benefits and it has an impact on the lives of the most vulnerable people in Scotland—that providing assurance to the Parliament that it is being delivered well is worth while.
I am pleased that we have been able to give that assurance now, and the letter from the cabinet secretary recognises that there are some useful pointers from us—over and above what the programme is already aware of—on the things that need to be prioritised in order to get the next wave right. However, it is always a judgment call.
What are the costs of the inquiry that you have conducted and the other audit costs for the public bodies involved?
The costs of all our work in central Government are funded by the Parliament through the Scottish Commission for Public Audit. The cost of this piece of work was about £300,000. When the annual audit is up and running, a nominal fee for that will also come through. Against the scale of the set-up costs and the continuing delivery costs, it is a very small element and one that I hope will provide useful assurance to the Parliament on the progress of this significant policy.
My last point is one to which it might be useful to get an answer after the meeting, in writing. You mentioned the importance of the policy and said that it is appropriate to get into an audit early on but also to come back to it subsequently, which is the pattern of your work. For example, I know that you have been involved in a number of transport projects as they have been going on. My concern is that the work that you do and the demands that you place on the bodies that you are investigating, at a time when they are trying to get such projects running, can be very onerous and counterproductive to delivering their services.
We work hard to ensure that the audit process is not onerous and that it is proportionate to the scale of the programmes that we are looking at and the risks that are associated with them. It is always a challenge to ensure that we do not come in too late for our work to be of value both to the organisations that we are auditing and to the Parliament.
It is not uncommon for us to look at a piece of work as it is under way. We have done that with the major transport projects that you talked about and things such as the Commonwealth games, as well as Social Security Scotland. The aim is twofold—to give assurance to Parliament, but also to highlight things that can be put right before some of the very significant risks materialise. If it would be helpful to the committee, I am happy to write to you afterwards setting out how we go about that decision making.
09:45
It would be interesting to know that, because, from what you have just said, there seem to be an awful lot of times when you get involved during the early stages of projects or initiatives rather than waiting to see what has happened and then looking at value for money. It would be useful to know exactly what criteria you use when you decide that and whether it is part of a set of priorities that you have at the start and apply consistently or whether you take the decision as things arise.
It is very much part of our programme development activity. As I say, the aim is to make sure that, where we think it is appropriate, we can ensure that the building blocks for success are in place at an early stage to avoid our having to come along later and report on something that has gone wrong. I am very happy to follow up on that with the committee.
I have a couple of lines of questioning. The first concerns the fact that the Scottish Government’s original plan was for everything to be taken over by the agency by 2021. It is clear from your report that that was never likely to be possible. I suppose that the risk now lies in the relationship with the DWP, including with regard to the financial cost. My understanding is that the contract was negotiated for a certain period of time, so it will have to be extended. Did you look at the cost for the Government to renegotiate a fresh contract with the DWP for it to deliver what the agency was meant to be delivering?
At this stage, we have not done that. The announcement about the timeline for transferring existing claimants was made just as the report was being finalised. We will seek to look at the issue in future audit work.
I come back to our recognition of the Government’s commitment to safe and secure delivery of the programme and our finding in the report about the extent to which the complexity that is involved is becoming apparent to everybody—to the social security programme in Scotland and the DWP—as the work progresses. We will look at that issue in future.
That is helpful. Auditing seems to be a dark art that goes beyond my intelligence. However, with regard to the auditing of the accounts, which you will report on in the autumn, as you said, will there be some reference to on-going costs beyond that, or will that be in a separate report?
It will almost certainly come in the future work. The audit report that will be published in the autumn will look at the 2018-19 accounts for Social Security Scotland. It will look at what is within the agency rather what is in the wider programme to set it up.
That is helpful. My second area of questioning is quite specific. One of the Scottish Government’s commitments is to have two or three staff in each place, which I think will be very helpful. From your audit work, do you think that that can be achieved within the hoped-for timescales or is it another area of concern with regard to recruitment? Are we struggling to find people to do that or is it easier than for some of the information technology stuff?
My understanding is that the Government is still looking at its options for how to do that. Kirsty Ridd can tell you more.
As we set out in the report, the planning for that local delivery element is under way. It is at an early stage, but we know that recruitment is on-going for some of the staff that will be required. The aim is to have about 100 members of staff in place by the end of this year. Recruitment is under way and progress is being made.
What we reported about the challenges with recruitment is really about the programme side and the implementation team within the Government directorate. We have not seen the same recruitment issues for the agency. It has had a high level of interest, particularly in relation to the client-facing roles. I draw that distinction for the committee.
That leads me on to my final point. The Scottish Government is doing a lot of the IT work and procurement while the agency is delivering the programme. From conversations that we have had in committee, there seems to be a good relationship between the agency and the Scottish Government. In the longer term, do you see everything being merged into the agency or will some of the bigger pieces of work always have to be done by the Scottish Government? At some point, probably beyond 2024, will the agency be able to do everything? Is that where we should be looking to end up?
My expectation is that, as you say, the agency will take on all the day-to-day operations of the social security system. The programme team will certainly reduce in size as the set-up and transfer work is completed, and then there will be a decision to be taken about where the Government’s social security policy team should sit to continue the development of any new benefits or changes to eligibility for the existing benefits in the settlement. There will still be a need for that capacity.
Although I appreciate that the report is focused on the implementation of the devolved powers and Social Security Scotland, it also recognises the interface with the DWP, which has been mentioned in the questioning this morning. Paragraphs 125 to 128 contain a number of references to the
“ongoing delivery relationship”
that
“will need to be carefully managed”.
There is reference to the fact that
“the transfer of people from DWP systems and benefits to Scottish ones will continue for several years”.
The concluding sentence of paragraph 128 is:
“The Scottish Government will therefore need a long-term arrangement to verify this information with the DWP”.
My question is: who audits whether the DWP is doing its job well in relation to delivering devolved benefits? Clearly, the National Audit Office audits the DWP, but the methodology in appendix 1 shows that you did not review or consider any information from the DWP or the UK Government and you did not speak to representatives from the DWP or the National Audit Office. Is there not a need for some auditing of that interface? Will you consider that in the future?
Ms Robison is absolutely right that this is a new area for everybody involved. Until very recently, the devolution settlement was clear that, if something was not reserved, it was devolved, and we audited it. With social security and taxation, we are now in a position where large UK Government agencies—the DWP and Her Majesty’s Revenue and Customs—are closely involved in delivering things that are devolved to the Scottish Government through the tax and social security powers.
There has been a conversation between the two Governments about the audit and accountability arrangements for that, and a new framework has been agreed in just the past couple of months. Under that framework, I do not have direct rights of access to DWP, or indeed HMRC. However, arrangements are in place for my teams to work closely with the teams in the NAO to ensure that, between us, we can cover what is needed, and to provide the assurance that both of our Parliaments need. Mark Taylor can give the committee more of a flavour of how we have done that in relation to this work.
The committee commented on an earlier draft of the audit and accountability framework that the Auditor General referred to, which has only recently been developed and agreed. It gives us the potential to work with colleagues in the National Audit Office to see the other side of the fence and look at what is happening in the DWP, and we will explore how best to do that as we do future reporting in the area. However, given that the arrangement was not in place, we were unable to do that for the report that we are discussing. For want of a better phrase, we were able to look only from this side of the fence.
As we have referred to a number of times, we have some experience through the annual audit, where we have done some initial work with National Audit Office colleagues to give us access to the information and evidence that we need to form an opinion on the accounts and what we will do around the audit of the agency this year. We will look to build on that in the years ahead to ensure that, as we do the work that we have set out, we have a balanced view of what is happening at the Scottish end and how the DWP is contributing to that.
To be clear, you are saying that, now that the new framework is in place, we can expect the methodology for future reports to show that discussions have taken place with the NAO, and the body of the report to reflect those discussions.
I hope so. The framework gives me the ability to carry out direct audit work of the DWP with the agreement of the DWP and the NAO. As Mark Taylor said, we are still testing out what that means. There is a commitment from all parties to make it work, but we have not yet had a chance to do it in practice. I share your concern that we need to be able to consider that directly in order to draw conclusions about how well things are working in Scotland and where things need to improve.
I will explore a couple of things and I will ask first about staff vacancies. Your report says that 30 per cent of the posts in the programme have been vacant—you mentioned that earlier. When we heard from the cabinet secretary, she said that you had taken a figure as at December and that that was misleading, because the total number of people who are required were to be recruited by the end of the year and, at that point, some posts were not needed and the agency had not finished recruiting. She did suggest that the agency had not made the total figure. Is her understanding that you had misunderstood the numbers correct?
Our report was finalised at the end of February, and obviously the figures on vacancy rates are taken at a point in time. We know that recruitment is on-going.
Before I ask Kirsty Ridd to provide an update, I will say that the other thing that we are concerned about is the high level of turnover in some key posts. We refer specifically to the three different people who have held the position of programme manager over a period of time, and there was an interim appointment when we finalised the report. However, we recognise that work is going on to fill the vacancies and that that has not been straightforward.
As the Auditor General said, we are aware—as we were at the time of reporting—that an enormous amount of recruitment is on-going within the programme. The report reflects our position at that time, and I am sure that vacancy rates will fluctuate. Our position also reflects the wider picture, which includes the recruitment challenges and how the people whom we spoke to were having to manage vacancies in the programme. That gives a wider picture about the figure in the report.
The agency gave quite credible evidence that it would backstop the difficulties in recruiting people who have the necessary skills by training people in-house. Did you see any evidence of that development? Is that a viable approach, given the current strains?
We saw evidence of that. The programme is trying to take a pragmatic approach to filling the vacancies. There is an appreciation of the issues in the wider market, particularly on the digital side. People have taken a realistic approach by understanding that, given the external market conditions, it is very unlikely that the agency will always be able to fill all its vacancies.
One of the other ways that the agency can bring in skills is by training its own people. A programme the size of a social security programme offers great opportunities to do that, which allows people to get skills and then work on other Scottish Government projects. The agency is looking at that possibility and is working closely with colleagues in the digital directorate who are creating new professional communities with such skills as a way of growing that resource. It is also working with the digital academy to ensure that skills are being developed. That will not be a short-term fix; it is very much a longer-term game, but the work is going on.
There is also an issue with retention. Obviously, when an organisation is developing its own skills, it is key that it has the skills in the first place to share and develop. Were there any signs that the agency will recruit for specific jobs in which people will be allocated that work, or will it be done by osmosis from the people who are in post?
Are you asking about having people in the agency to manage the recruitment?
No. For an organisation to develop its own skills, it needs to have people who can give the benefit of their experience and who can provide the training and empower people to learn and develop on the job. If the agency is already under pressure, as your report indicates, how is capacity being built in the system to allow that work to happen? It is laudable and the right approach to take, but how will it sit alongside the strains with workforce capacity?
There are a couple of elements to that. We know that the agency is working very closely with the digital directorate to make use of its capacity and some of its programmes, which will help to ensure that the wider Government has the people whom it needs.
We talk about the agile approach, which involves each of the multidisciplinary teams bringing together all the different people with different skills. That allows for learning on the job, and regular lessons-learned sessions are held.
10:00The issue comes back to the discussion that we had earlier about the critical path and the need for the programme to be supported by a workforce plan that predicts what key skills will be needed, when they will be needed and when people with various skills will be able to move between the different projects. Such longer-term planning is necessary to understand what skills will be critical and what action can be taken now to make sure that those people are in place when they are needed. Some of that work is being done, but it forms part of the wider critical path on workforce planning that is so crucial.
That leads me nicely on to the second area that I want to ask about—that of risk management. Although you talk about risk throughout the report, I did not come away with a real sense of how risk is being managed. Is there a risk management system in place? Is there some sort of red, amber, green system? If so, does your analysis concur with the analysis of risk that is made within the digital directorate?
If we look at the financial analysis of the cost and the budget flexibility, we can see that, as time goes on, the recruitment is progressing, but if the timeframe is stretched, the budget will be stretched, too. When it comes to the multidisciplinary working and the working across the digital directorate, how is that cost and risk managed? When you are pulling resources from a variety of sources, the budget might pick from other budgets. How is that being managed? Are you able to follow that?
I do not think that we have ever been asked directly about risk management arrangements, so thank you for the question. We are looking at risk management closely and it is a good example of the finding that we make in the report: the governance arrangements that have been in place so far have been good and fit for purpose, but that they are not sufficient for what will be needed for wave 2, as the scale and pace ramp up.
Gemma Diamond has direct experience in this area, so she might be able to give a sense of her perspective on risk management.
In the report, we say that the programme is well managed from the point of view of the programme documentation and some of the systems that are in place, which are among the best that we have seen in large-scale Government programmes. The same is true of the risk management approach. A thorough approach is being taken to risk management. All the documentation and systems that we would expect to be in place to enable regular consideration of the risks are in place. When we look at the risk register, we see that one of the top risks is vacancies and staff turnover. We recognise some of the risks on the register, which gives us assurance that the risk management processes are looking at the right issues.
As the Auditor General said, the risk management system will need to be looked at and refined for wave 2 to make sure that the interdependencies and the complex nature of some of the risks are picked up on, but the building blocks—the documentation, the systems and the serious attitude to risk—are well in place.
I was interested in that last exchange, in which Caroline Gardner mentioned that, looking forward, what the Government has is insufficient for what is about to come. As I understand it, it is stretching Audit Scotland’s remit to look at what the Government is going to do in future and to comment on that.
Earlier, you mentioned that you saw Audit Scotland’s role as being to ensure that the building blocks are in place. To what extent do you feel that that is your responsibility? What is the responsibility of the elected Government of the day, which will be held accountable for the new system? Is the Government’s responsibility subordinate to Audit Scotland’s?
Of course not. It is the Government’s responsibility to set the policy and to implement and deliver it. My responsibility is to report to the Parliament on how well it does that. Sometimes, as you said, we do that after the fact, but sometimes—when there are really big and complex programmes like the one that we are discussing—we will do it during the process to provide assurance that the building blocks are in place when there is still room for improvement.
I am really pleased that in this case we have been able to say that the foundations have been set well in place and the first wave commitments have been delivered. We also give this committee, and the Parliament more widely, an indication that the next wave will be much more challenging. The Government is aware of that and it is doing the right things, but there are still significant risks that need to be managed. That is my job.
I will follow on from the previous question. I note for the record that I lived through the tram debacle in Edinburgh as a local councillor. On a number of occasions, the Auditor General’s predecessors made reports, which were all very positive, saying that it was going well. Then, obviously, it did not go well. How robust can you be in highlighting things, both positive and negative, at an early stage? One of the things that frustrated me as a local councillor was that we received all those reports telling us that everything was fine and then it went wrong. Politicians and, more to the point, the public would rather know at an earlier stage if things are not on time or are not going right, so that we can respond to that. Are you confident that you can be robust enough to do that?
I will add to that fair and fascinating question regarding the tram debacle. I note for anyone listening that it is worth checking out the speech made by the then Cabinet Secretary for Finance, Employment and Sustainable Growth, John Swinney, in relation to the £0.5 billion for the trams and the Scottish Government’s position in relation to the business plan for that, given that we are, today, scrutinising the Scottish Government’s delivery of a service, rather than a local authority. Any comparisons would be very welcome.
That is very helpful, convener. For the record, I should be clear that I have been Auditor General since 2012, so those reports predated my responsibility in this area, and I do not audit local authorities.
The answer to Mr Balfour’s question comes back in some ways to the questions that Ms Ballantyne asked. We cannot give a guarantee that something will succeed or fail. Nobody can do that when they are looking forward. However, we can look at the risks that are involved, the way that those are being managed and the extent to which people are understanding the whole picture.
We say clearly in the report that we think that the foundations are in place and that the first wave has been delivered well. We are giving the committee an indication that wave 2 becomes much more complex very quickly and that there are risks that need to be managed. You have my assurance that we think that the risk management is good and the programme is self-aware. There are some really big and complex things about the availability of the right people, the complexity of the digital solutions that are needed and the interaction with the DWP, which would not be easy in anybody’s management of the programme. That is the information that we are here to give to the committee.
I am very pleased that we are scrutinising the delivery of wave 1 and wave 2 benefits of the new Scottish social security system and not carrying out an inquiry into the Edinburgh trams project. This may be a lot more straightforward, despite its complex nature.
I thank the Auditor General and her team for providing evidence. We very much appreciate your time, expertise and information.
10:08 Meeting continued in private until 11:26.