Public Audit Committee

Meeting date: Thursday, December 9, 2021

Official Report 519KB pdf

---

Section 22 Report: “The 2020/21 audit of National Records of Scotland”

The second item on our agenda is consideration of an Audit Scotland section 22 report on the National Records of Scotland. We have a number of witnesses with us this morning. First of all, I welcome the Auditor General for Scotland, Stephen Boyle, who joins us in the committee room. Also from Audit Scotland, we are joined remotely by Graeme Samson, senior auditor, Asif Haseeb, senior manager, audit services, and Dharshi Santhakumaran, correspondence manager, performance audit and best value. You are all very welcome.

The Auditor General usually invites his colleagues in at the appropriate juncture. However, if any of you want to come in but have not been spotted, please put an R in the chat room function. I also extend that invitation to Willie Coffey, who also joins us remotely. I will bring him in as we go through the meeting.

Before we move to questions, I invite the Auditor General to make an opening statement.

Good morning. I present this report on the 2020-21 audit of the National Records of Scotland under section 22 of the Public Finance and Accountability (Scotland) Act 2000.

NRS is a non-ministerial department of the Scottish Government and is responsible for Scotland’s census. The census is a vital source of information about Scotland’s people and households. It is a large and complex programme, covering all of Scotland’s estimated 2.51 million households and 5,500 communal establishments. As a result of the Covid-19 pandemic, ministers decided to defer the planned 2021 census until 2022.

I have prepared this section 22 report to highlight some of the challenges that NRS has faced in delivering the census programme, including disruption to the original rehearsal timetable. I also report on the programme’s use of project assurance reviews. In February 2020, one of those reviews assessed that NRS would have been ready to go with the original census in March 2021.

Shortly thereafter, however, at the start of the pandemic, NRS carried out a detailed options appraisal to assess whether the census could go ahead as planned in March 2021. It considered the risks, particularly to data quality in Scotland, and it assessed that those risks were too high. Unlike the Office for National Statistics, which manages the census in England and Wales, NRS does not have access to additional sources of administrative data, which would have enabled it to fill in gaps in census returns caused by a low response rate.

The auditor has highlighted that the decision to delay the census will cost an additional £21.6 million on top of the original £117 million budget. The Scottish Government is funding those extra costs. However, it is important that NRS continues to closely monitor and manage programme spend. Scottish Government assurance reviews report that NRS improved its project management and delivery over the project, and that it is now on track to deliver the revised date of March 2022. As with any major information and communications technology project, NRS will need to maintain momentum and closely manage and monitor risks over the final stages of the project.

As ever, my colleagues and I would be delighted to answer the committee’s questions.

Thank you, Auditor General. We want to put several questions to you and your team, based on our reading of the report and the wider context in which it sits, part of which touches on our concern that ICT projects are not necessarily delivered on time and on budget, as you mentioned in your opening statement.

The section 22 report mentions almost as a passing reference that the census is one of the biggest ICT projects in Scotland. Could you tell us a bit more about the shape that the project takes? Is it an in-house ICT project or a new capital project, or are you just talking about the operational side of it?

I will do my best to answer and I invite colleagues to supplement my response.

We refer to the census delivery programme as one of the largest ICT projects, and the committee, in the reports that it from the Scottish Government on major ICT project updates, has identified it as one of the significant projects.

All ICT projects take different shapes. The overall cost envelope of £117 million to which we refer in the report is analysed against a range of factors, some of which are ICT components. As with many ICT programmes, much of that sum covers staff costs—development activity, coding and so on—and typical aspects of ICT programmes such as the licensing of software. A range of different components makes up a project.

In the report, we cite the project’s significance, but we also say that it differs from projects that previous reports on successful ICT programmes mention. We have seen how the programme has interacted in particular with the assurance reviews, which have helped to steer it back on course when it has encountered challenges. However, the programme is hugely significant and complex.

Are you saying that you are satisfied about where things are with the ICT programme in relation to the skill sets that are required to oversee and run it, and its operational implementation?

The census that England and Wales carried out was, for the first time, a digital-first census. In Scotland, are we at a stage at which we could carry out that digital-first assessment, or are there still deficiencies or inadequacies?

The intention was that the 2021 census should be predominantly digital. Colleagues can keep me right on the statistics, but in previous censuses, Scotland deployed a field workforce—we are all familiar with people who go door to door, supporting completion rates and the accuracy of responses—and, historically, around 7,000 people have been deployed to deliver that part of the census programme. The intention for the 2021 census was to halve that number to 3,500 people, which is still significant, but gives an indication of a much broader digital-first aspect with regard to the delivery of the census.

We are not saying that there are deficiencies. The programme was undoubtedly large and complex. In the report, we refer to challenging aspects in relation to the delivery of the original planned rehearsal, but changes in leadership took place during the lifetime of the programme. Our 2017 report identified significant aspects around the successful factors in the delivery of ICT programmes. The wider picture of the report is that the programme had challenges, as do all large and complex programmes, but that those challenges were addressed during its course.

It might be worth coming back to some of the differences between Scotland’s arrangements and those elsewhere in the rest of the United Kingdom.

However, the audit report from 2018-19 refers to a census recovery plan, and that was two or three years before the expected date for carrying out the census. Is it not fair to say that there were underlying problems, even before the pandemic struck?

There is no doubt that there have been challenges in the delivery of the project. There is some mitigation for a large and complex project. Challenges would not be entirely unexpected. What matters is how they were dealt with. The example that we used in the report was the delay of the census rehearsal. I will ask Asif Haseeb, the appointed auditor, to say a few words about that. It aligned with one of the project assurance reviews that gave a red rating. The recovery plan that you referred to, convener, was implemented and a delayed rehearsal subsequently took place and was evaluated. That, alongside on-going project assurance arrangements, led to the judgment that the census could be delivered. I will pause and allow Asif to say more about the circumstances.

The rehearsal was delayed. It was then successfully carried out, digitally, in three local authorities. The go-ahead to carry out the census was based on that and the assurance framework.

That is helpful. I will move on. We will return to some of the themes of staffing and support, and some of the implications of the delay.

The delay has meant that data will be delayed in reaching public sector planners—the people responsible for delivering services. The census is in no small measure designed to inform decision making about those services. Have you assessed the impact of the delay on the planning decisions that public authorities will need to make?

No, we have not done any detailed work on the longer-term implications. A 12-month delay will no doubt have implications for budgets, resourcing and the delivery of public services. It is for NRS and the Scottish Government to determine what the implications are. If the committee is interested in that, it should pursue the matter directly with those organisations.

We may well have the accountable officer from NRS at a future evidence session. This question may fall into the same category, but do you or your team have a view about the implications of any further delay to the census? It is planned for March 2022, but we could speculate about reasons why it might not go ahead.

You are right that, with the circumstances that we are all witnessing, we do not have the predictability that we used to have. It is not beyond the realms of possibility that there could be a further delay. The Scottish model still relies on a field workforce component. In arriving at the decision to defer the census when the pandemic struck, NRS discussed with Scottish ministers a range of options for how it might deliver an alternative census. As you imply, whether there should be another delay or whether there are alternative options allowing it to proceed will again be a matter for discussion between NRS and the Scottish Government. A further 12-month delay would clearly not be desirable, but NRS’s contingency planning might look at how it would deal with that and what it would mean for future planning of the delivery of public services.

You mentioned the options appraisal. All that I have seen in the public domain is two sides of A4. Has Audit Scotland had access to what would presumably be a much more detailed analysis that was put to the census programme board or the board of NRS? Have you had access to a more detailed report and would the committee be able to get access to that?

09:15  

I will ask the team to come in and explain what we have seen. Dharshi Santhakumaran can comment on the NRS programme board, which is responsible for the management of the programme. If the committee would like to see the detail of what lay behind the programme board’s decision, and the associated advice, it would be appropriate for the committee to pursue that directly with NRS. If we have any of those details, we can discuss how best to share those with the committee. Dharshi can comment on what we have seen.

We do not have the detailed options appraisal report, but we have seen numerous reports to the census programme board and to the Scottish Government’s economy department, reporting on the decision-making process and its implications. We have seen more detail than is in the summary that is published on the website. That includes detail of the financial implications of the delay and more about the reasons behind the decision to delay, which was based on data quality and the impact on that if they had gone ahead in 2021.

It would be useful for us to have access to that more detailed work.

I would like to explore the management of the census programme. We have had section 22 reports about NRS in the past. A lot of the issues were caused by ICT problems; a lot were about management. Given that we are talking about one of the Scottish Government’s biggest ICT programmes and given our memory of what has happened previously, have any steps been taken to provide additional support? A lot of the section 22 reports that we have seen have been for similar organisations. Some departments seem to be too remote from any control. This is one of the biggest ICT projects. What was done to provide extra support?

Additional support was provided by the Scottish Government in terms of expertise. There was additional support through the assurance reviews, which was undoubtedly helpful. There was a range of findings from those assurance reviews. The rehearsal was given a red rating and recommendations were made. Later, there were amber ratings, and the ratings are now amber/green. That is a key component of the delivery of a complex project.

There have also been appropriate leadership interventions by NRS itself at the right points. One of the assurance reviews found that there was a need for additional leadership for the programme. At that point, the chief executive of NRS stepped in to become the senior responsible officer for the project.

Could it not have recruited someone to take up that position?

That is the third point that I was going to make. There was a change in the director who was leading the project. In light of difficulties with retention and recruitment to that post, the chief executive took direct responsibility. That was an appropriate step for the leader of the organisation to take. The organisation also supplemented that with additional skills, particularly by bringing in expertise from external providers to support the running and delivery of the project.

All of that tells a story of a programme that has faced challenges over its lifetime, but in the greater scheme of things, with regard to the judgments around it, we think that the right decisions were made at points of challenge.

I want to move on to an issue that the convener has already touched on. We were talking about the substantial impact of Covid-19 on the census programme, but as you have said, challenges to the programme had been identified before the pandemic. Can you give us some detail on those specific challenges and the steps that were taken to address them?

Before I bring in colleagues, I will highlight two particular issues. First, the initial red flag—or, I should say, the first issue for a red assurance review—was the rehearsal for the census, and the second issue, which we have just touched on, was the changes in leadership.

I will start with Dharshi Santhakumaran, but Asif Haseeb and Graeme Samson might want to give the committee a bit more detail, too.

A number of issues were flagged up when the programme was initially marked red, one of which was preparedness for the rehearsal. Not all the components that were required for testing the field workforce had been procured at that point, and there were risks to the delivery of the rehearsal as planned in 2019. Deficiencies had also been identified in programme governance; there were problems with resourcing and accessing the right level of skilled resource, particularly around programme management and some of the operational skills that were required in that respect; and there were also some finance risks.

Subsequent to that, the recovery plan was implemented and a number of steps were taken, some of which the Auditor General has already mentioned. The chief executive took on responsibility as senior responsible officer, and an external programme and project management consultant was commissioned to review programme governance. Following that, a number of changes were implemented.

In addition, the chief executive took over as chair of the census programme board, and a wider range of people, including people from Scottish Government finance and Office for National Statistics and Northern Ireland Statistics and Research Agency staff, were brought in for their expertise. A new head of commercial and contract management and a new finance lead were put in place, there were additional programme management resources and further security expertise was brought in. A number of changes were made to try to address the deficiencies, and by February 2020, the rating of the programme was changed and it was judged that the census would have been able to proceed in 2021 as planned, had it not been for the Covid-19 pandemic.

The deficiencies that were identified in the programme sound remarkably familiar to those in other ICT programmes—they do not sound new to me. You would have thought, therefore, that they would have been addressed from the beginning instead of coming out in the rehearsal. Are they not the same problems that come up again and again?

It is hard to argue against that. There are parallels between the findings in the Audit Scotland report of 2017 and some of the early circumstances that we are reporting now.

I point out that there is something of an overlap in timescales. In exhibit 1, we set out the timescale for the programme, which, I should add, has been running from its infancy in 2015 to the present day. That is not to say that there were no opportunities to learn or to anticipate some of the issues right at the start—there probably were.

The difference that we have seen with this project, as opposed to some of the more recent examples of deficiencies in ICT projects that the committee has seen, is that the organisation has learned and has intervened. That has meant that, although there have been challenges, it has been able to steer a complex programme back on course. Essentially, there is nothing for us to see here—had it not been for the pandemic, the project would have been delivered on time and on budget.

That brings me to the Scottish Government’s technology assurance framework. The reviews under that framework are intended to improve the delivery of such programmes. Can you tell us more about the assessments that were made and how the results were considered?

I will start, but Dharshi Santhakumaran might want to say a bit more about how such reviews operate. Reviews under the technology assurance framework are overseen by the Scottish Government’s directorate of internal audit and assurance. They were previously carried out by the office of the chief information officer of the Scottish Government, before it merged with internal audit.

The reviews are intended to review progress against the key milestones for a project and to flag up any risks. The committee will be familiar with gateway reviews, which seek to assess delivery against key milestones and risks. Review has been a feature—a welcome feature, I would say—of the project that we are discussing. Arguably, the response has been reactive in parts, with intervention coming when aspects of the programme have veered off course. Overall, however, the gateway process under the technology assurance framework has been a really positive feature of the programme.

Dharshi Santhakumaran may wish to say something about the specifics of the rating system and what that means, and any recommendations that have flowed out of the gateway reviews.

The TAF reviews involve a mixture of different kinds of reviews. There are what are referred to as “go-live gates” later in the process, and there are health check reviews, but all of them essentially assess where the programme is against planned milestones.

Since the original rating of red back in 2019, as the subsequent reviews have come around, we have seen constant progress with each review. The most recent review was carried out at the end of November—we have seen the findings from that, and the programme is now rated as amber/green. That is consistent with what would be expected of a project of this complexity at this stage. The review team has said that it now has a high level of confidence that the programme will be able to go ahead as planned.

As we have also seen, the reviews have been used as the basis for assessing progress with the programme by the census programme board and the audit and risk committee. NRS has taken the reviews seriously and has used them to implement changes where necessary and to make good progress on the recommendations.

I want to take that a step further. The report states that the NRS

“appraisal concluded that any options to deliver the census in 2021 would represent a significant risk to data quality”.

What options were considered? Were all the options decided against only because of the anticipated “drop in response rate”? Does the reference to

“potential bias in the data”

refer to the distortion that would be caused by a drop in the response rate?

I will do my best to answer that. We are simply drawing on material that we have seen from NRS; it may be that NRS itself may be better placed to go into the thinking behind its statistical analysis and methodology in detail.

At paragraph 9 of the report, we set out the various options that were covered in the appraisal. For the record, I note that those options were

“to continue with the census as originally planned ... to allow completion online and on paper but with no field force ... to use online completion only with no field force ... to use paper forms only with no field force”

or

“to delay”.

The point was that the presence of the field force was key to giving NRS assurance on the data quality issues, and NRS therefore deemed that there was not sufficient mitigation in place around data quality without the presence of the field force.

09:30  

The issue was not only overall data quality, but completion rates. As Asif Haseeb mentioned, the rehearsal was undertaken in three local authority areas: Western Isles, Glasgow and Dumfries and Galloway. The completion rate was—if memory serves me correctly—just over 20 per cent, for an online-only rehearsal exercise. It would appear that concerns around data quality and the overall completion rate informed the judgment that NRS and ministers took.

With regard to the specifics of how the methodology might have been disrupted, NRS would probably be better placed to give you that detail.

Okay. I will move on to a couple of final questions. England went ahead with its census, and part of the justification for that appears to be that, in England and Wales, administrative data from other public bodies was used to supplement data gaps. However, the report says that such information

“was not available for Scotland”.

Was NRS unable to access the data? Does it not have the necessary data for Scotland? What was the reasoning behind that?

Dharshi Santhakumaran may want to say a word or two about that. The circumstances for the delivery of the census through the census-taking bodies across the United Kingdom are such that the ONS is responsible for England and Wales; the Northern Ireland Statistics and Research Agency is responsible for Northern Ireland; and NRS is responsible for Scotland. The methodologies that are used in England and Wales—and, by extension, for aspects in Northern Ireland—allow for the use of data that are held by other public bodies, such as HM Revenue and Customs and the Department for Work and Pensions.

NRS has shared with us that it did not have those options. With regard to the reasons behind that, we are aware that aspects such as data-sharing arrangements and the quality of data held by other public bodies for Scotland were such that they presented barriers to the ability of NRS to access administrative data.

That is clearly significant. It is part of the crux of the matter, and of the report, along with the divergence in the approaches that were undertaken in Scotland and in the rest of the UK, and the additional cost as a consequence of that.

I would like some clarification. Was NRS refused that information, for data protection purposes or whatever, or is it that the data for Scotland does not exist as a separate database?

I am not sure that we heard that there was a refusal—rather, the data was deemed not to be accessible. Either it did not exist or data-sharing arrangements prevented its wider sharing. Again, Dharshi Santhakumaran may be able to answer that in more detail.

Our understanding is that, prior to the pandemic—quite a number of years previously, I think—ONS had started a long-term project to put in place the data-sharing arrangements and agreements that were necessary to enable it to access other sources of administrative data, for example from the DWP and HMRC. That has been a long-term project, and at the point when ONS made the decision about whether the census in England could go ahead, the project, although it had not been completed, had reached a stage at which ONS felt that it had enough access to enable it to supplement any gaps in the census data if it needed to do so. Scotland does not currently have those arrangements in place.

My understanding is that NRS is in the process of trying to get access to the other sources of data but, as I have said, it is a long-term project that is still in its early stages. You would need to confirm with NRS itself exactly where it is in the process. Lack of access to the data meant that NRS had no options with regard to other sources to supplement any gaps in the census data that might have arisen.

I have one last question. The cost of the delay is not inconsiderable, but is Scotland being disadvantaged in any other way by the one-year delay?

As the convener has suggested, there will be a delay in providing the rich data that comes from the census to help with the delivery of public services, but that is something of a theoretical risk.

A longer-term issue that will come into the thinking of the Government and Parliament is when to undertake the next census and whether there should be a nine-year gap, which would revert things to a 2021 to 2031 timescale, or whether the period should still be 10 years. The question—this is really a question for statisticians—is whether the census should be brought back into sync with other parts of the United Kingdom or whether the 10-year cycle of public engagement should be sustained.

I would offer those as potential considerations as far as risk is concerned. The finances will undoubtedly still be managed through to the delivery of the census and the evaluation period thereafter.

I invite Craig Hoy to ask some questions.

Good morning. I want to probe a little bit deeper into the additional costs of delaying the census, to ensure that the costs have arisen because of the delay and not because the project was going off kilter prior to that. Your report says that moving the census from March 2021 to 2022 will cost an additional £21.6 million, which is about 20 per cent of the programme’s overall costs, and that £14.4 million of that increase is due to

“an increase in the cost of goods”

and

“extending supplier contracts”.

Can you provide more detail on the costs? Are you concerned that, perhaps because of the way in which the contracts were framed, people are being paid for doing nothing as a result of the delay instead of producing more?

I will ask Graeme Samson to come in, because he has some of the detail and analysis on the additional £21.6 million, but you are right to say that, as has been communicated by NRS, it is contracts, goods and services that lie behind the additional costs.

As we have discussed, NRS has accessed external support such as ICT project management expertise to deliver the project, and those contracts will have an anticipated conclusion date that will have had to be extended. The question is whether such things ought to have been anticipated—indeed, the committee will be familiar with the fact that many public contracts have an anticipated original term and allow for a plus-one or a plus-two extension in some circumstances. Factors influencing the extension of the contracts will have been part of the discussions that will have led, in turn, to the additional costs.

As for the detail behind that, there will be a staff cost component, but I invite Graeme Samson to take the committee through some of the detail of the cost increases. [Interruption.]

We cannot hear you at the moment, Mr Samson. We will try to fix that. I am afraid that you might have to start again. [Interruption.] No, we are still not able to hear you.

Craig, do you want to press on with a supplementary, or do you want to move to your next question? Perhaps the Auditor General wants to come back in.

I will try to give Mr Hoy a bit more detail. We have seen some analysis; NRS is tracking those costs and is reporting them, subject to its own governance arrangements, through its own audit and risk committee. The most recent assessment refers to costs for the online collection instrument, for the data collection operational management system and for some of the printing and paper, but it refers predominantly to the costs for extending contracts for project management support and to internal staff costs. There is a range of factors. We can write to the committee with more specific analysis of those costs if that would be helpful.

In our report, we mention the need for careful management of some of those additional costs. At the time of publication, we reported that there had been a £1.5 million further cost pressure earlier in the year but that that had been managed down to £0.5 million of additional costs. We understand that that is still the case. There are remaining challenges with cost pressures, but those costs fit broadly within the overall £21.6 million frame that was mentioned.

If the census had gone ahead in 2021, there would have been costs for Covid-19 mitigations. Do you have a view on what those additional expenses might have been? Would you have expected NRS to have quantified those costs?

Our section 22 report says that NRS has not quantified the additional costs of delivering a census during a pandemic. It is not a case of an additional £21.6 million or nothing. There would have been additional costs regardless of the pandemic. It is difficult to say whether those costs could have been calculated with any degree of reliability that would inform decision making, or whether NRS could have expressed a view on that. We have the options appraisal and the analysis, but we have not seen any estimate of what it might have cost to deliver the census in 2021 during the pandemic. The committee might wish to pursue that line of inquiry with NRS.

You referred to £1.5 million-worth of financial pressures, which you said had been reduced to £0.5 million by mitigating actions. What were those actions? Are they continuing? Are you certain that those actions will bring balance in the coming financial year?

Graeme Samson may be able to give some detail about what NRS has done to get that figure down from £1.5 million to £0.5 million.

I would not expect NRS to be able to give you a categorical assurance at this stage that the census can be delivered on budget. There are too many variables. I know that we have said this already, but the census is a large and complex project. It is positive news that the latest assurance review suggests that the project is at amber/green status, but that does not detract from the fact that it will still require careful management until census day and beyond.

Graeme can give more detail about what NRS has done to manage cost pressures in-year. [Interruption.]

I apologise to Graeme Samson. We are not sure whether the problem is at our end or at his, but we cannot hear him.

The Auditor General’s undertaking to provide us with written evidence, which I suspect Mr Samson might be asked to write, is useful. I apologise to Mr Samson for being unable to hear him.

You alluded to another possible delay to the census. Do you know whether anything has been done since the first delay to look again at the contracts and to make provision for a delay that might not impact the finances of NRS quite so extremely as the first delay seems to have done?

09:45  

That feels like a potentially significant risk. We have seen the additional costs that have been incurred by having to extend some of the contracts because of the first delay. If the census does not happen in March 2022, whether because of Covid or other circumstances—and, indeed, if we bear in mind what Dharshi Santhakumaran has said about the routes that were taken by other census-taking bodies to access other administrative data sources to deliver the census not being available just yet in Scotland—I would suggest that NRS will find itself in the same position of having to extend contracts at additional financial cost. Any detail on or confirmation of that will have to come from the organisation itself, but if that were to come to pass, it would clearly be a significant financial risk.

I have a couple of questions that go back to several points that have been made in passing. First, Auditor General, you mentioned the census programme board, but is that the programme board for Scotland only?

That is correct. There is some detail on it in the report, but it is chaired by the chief executive of NRS with representation not just from its non-executives and the Scottish Government but from other UK census-taking bodies such as the Office for National Statistics. However, it is a Scotland-only census-taking body.

I think that you also said that, because of the need to recover the census exercise, management consultants were brought in. I do not know whether it is cause or effect, but a decision was also taken around that time to widen the membership of the census programme board to include the ONS and NISRA, which oversees the census in Northern Ireland. Were they not already on the programme board?

Dharshi Santhakumaran can give you a bit more detail about the timeline with regard to the membership of the programme board, but you are right to mention the important role played by consultants in delivering the project. Their support to the leadership and the chief executive was key to bringing in some of the expertise that NRS had not been able to access. I will just check with Dharshi whether she can tell you how that then translated to the membership of the programme board.

I think that I am right in saying that the ONS and NISRA were added to the membership of the programme board around 2019. That was certainly when the membership was expanded not just to include representation from Scottish Government finance but to cover the wider programme and project management expertise that had been brought into NRS. However, I do not have any details of the membership prior to that, and we would need to check with NRS to confirm that.

We can come back to the committee with that detail in writing, convener.

That would be helpful. A word that we have, quite understandably and rightly, heard an awful lot over the past few years is “unprecedented”, but in a sense the census is not unprecedented. You would therefore have thought that, as a result of previous exercises, people would have known it to be good practice to include representatives from the ONS, most obviously, but also NISRA on any kind of programme oversight board.

As has been mentioned this morning, this was the first census that NRS was responsible for delivering following its creation from the merger of the National Archives of Scotland and the General Register Office for Scotland. However, as you have rightly said, censuses are not new events in Scotland. Perhaps the biggest change with this census was the presence of a much more significant digital footprint in its delivery, and it was therefore important for NRS to assure itself that it had the right level of digital skills to deliver the project. We would suggest that, at points, it did not have those skills, but it made the necessary interventions in order to do so.

I want to go back to the significant line of questioning that Mr Beattie pursued about whether NRS was refused access to HMRC or DWP data and whether that was requested. Dharshi Santhakumaran said that the ONS had such access because it started earlier to put together data-sharing agreements with those bodies, and she said that NRS is starting to do that. The question arises of why NRS did not start to make such agreements at the same time as the ONS, as a matter of good practice. Will we have in place, in time for the census in March 2022, data-sharing agreements that will allow the enrichment of the data that is collected through digital and other means as a result of the exercise that will take place in March?

I will take those questions in reverse order. As Dharshi Santhakumaran suggested, we assume that NRS will not have the data-sharing agreements in place, because the process is in the early stages. However, NRS will be able to confirm that to the committee if members wish to pursue that.

Similarly, the question is for NRS about why its arrangements for the contingency of accessing alternative sources of data through administrative data did not operate to the same timescales as those in other parts of the UK. To build on Dharshi Santhakumaran’s point, it looks as if NRS started the exercise earlier or made that a more central component of its statistics collection methodology than was the case in Scotland. NRS is better placed to advise the committee on the merits or demerits of that.

Dharshi Santhakumaran wants to give us a bit more detail.

I understand that the ONS project to access the other sources of data is a larger project that does not relate just to the census. The ONS did not initiate that project with the main aim of accessing such data to supplement census data; it was a wider statistical data collection project that had the advantage of providing access to such data for the census. I do not know exactly when Scotland got involved in the discussions about taking a similar route, but NRS can provide more detail on that.

We will put the points to NRS when it comes before us. Willie Coffey joins us remotely and has a number of questions to put.

I hope that everyone can hear me. I ask the Auditor General whether we still intend the census to be mostly online, which was the intention. There is a legal obligation to complete the census. How can that obligation be fulfilled if people have no access to information technology to complete the census online?

NRS’s intention is that most of Scotland’s population will complete the census online. Given the obligation that is on all of us as citizens to complete it, the census will not be exclusively online. Provision will still be made for people to complete the census on paper. There will be sufficient support, because it remains part of NRS’s plan to have a field force of 3,500 people to support households that need support to complete the census on paper or on alternative devices. There is a range of ways to allow everybody who can participate to do so.

Will the deadline be extended if people cannot complete the census online? How will they get a paper version? Will the deadline be extended to accommodate that?

I am not sure that I know the answer to that. I do not know whether there will be provision in the arrangements for March 2022 to extend the completion dates to allow for people’s circumstances. I will turn to my colleagues, and Asif Haseeb might be able to say more about how NRS intends to manage events around census day.

The census is taken at a point in time on a certain date. Households are expected to record who was in that particular household at that point in time. I am not aware of any deadline for when they would have to complete the census. People are not expected to complete the form at that point. It can be done the following day or week. The field force will be available to go back to households that have not completed the census and find out whether they need additional help. I do not think that there is a deadline, other than the usual time that has been allowed in previous censuses to complete the documentation.

We are always concerned that people who are not in the digital arena can still participate and that they do not feel that there is a barrier. We will have to see how that progresses.

I have other questions about the technology assurance framework that Colin Beattie asked about. Dharshi Santhakumaran said that the latest review gave the project amber/green status. What are the amber parts of that? Do we have any concerns?

An amber/green assessment at this stage of the project suggests very high levels of assurance for a project as complex as this one. We say in our report that, when the ONS went live with its census earlier this year, its assurance framework review had given it an amber rating. Scotland has been offered higher levels of assurance.

The most recent technology assurance framework review prior to the one that came out in the past few days gave an amber rating and included recommendations for NRS to follow. Dharshi Santhakumaran can say more about the detail of those recommendations. The latest TAF review has said that almost all those recommendations have now been implemented. Any judgment about the different scales of assurance from red to red/amber, amber and amber/green—whatever permutation the review decides—is typically accompanied by specific recommendations about what has to happen to move to the next stage of the assurance framework.

I will ask Dharshi to say more about the recommendations and about what we know has been implemented in the time between the two most recent reviews.

An amber/green rating means that successful delivery now appears probable but that NRS will have to pay constant attention to ensure that risks do not materialise as major issues that threaten delivery. That is what we would expect from the programme at this stage. It would be unusual for a programme of this scale and complexity to have a green rating at this stage, when we are still some months off the census going live.

10:00  

The most recent review made some recommendations, two of which will be on-going until the census goes live. One recommendation concerns a focus on contingency planning for the go-live stage; another is about increasing the focus on messaging and communication with stakeholders, which partly relates to your previous question about how people can respond if they do not have digital access. NRS’s approach will partly be to ensure that it communicates effectively with stakeholders and the public so that people are aware of the options for completing the census as well as why it is important. Finally, there is a recommendation for preparing a delivery plan and operational readiness checklist and ensuring that those are maintained in the run-up to go-live.

At this point, no significant risks that would threaten delivery have been identified. It is a case of carefully managing and monitoring the situation, in particular with regard to finance and resources, where issues were previously identified, to ensure that everything is managed and nothing escalates prior to delivery.

Finally, I turn to the IT side. Members have talked about that aspect, and it has come before the committee a number of times over the years. Are you satisfied that NRS has the required skills, experience and leadership in IT to enable the project to be successfully delivered?

Drawing on the work of the other assurance reviews and the judgments that Asif Haseeb and colleagues have made in the annual audit, we think that, broadly, NRS has the necessary skills to deliver such a large, complex project. It has access to many of those skills through external sources; that is not unusual in and of itself, but it attracts a price premium. Going through consultants, rather than NRS deploying or employing its own staff, will be one of the factors behind the cost of delivering the census.

One of our findings in the 2017 report was that, as ever, it is important that, in paying that premium, sufficient knowledge transfer exists so that public bodies see a longer-term benefit from access to those skills. We are not yet able to make a clear judgment on that aspect; NRS would be better placed to say what it means for the future. If there is a hybrid-style census for 2022, as there would have been in 2021, what does that mean for the next census? Will it be purely digital? Will the knowledge transfer remain in Scottish public bodies from the experience that they have gone through in delivering this census? That will be an important part of NRS’s thinking about what comes next.

Sharon Dowey has a number of questions that follow up on the lines of questioning that Willie Coffey pursued.

I want to look at some of the recruitment challenges that NRS has faced. The report states that the recruitment challenges resulted from the impact of the Covid-19 pandemic, which created longer lead times for the Scottish Government’s recruitment process. However, our session 5 predecessor committee heard that there were already issues with lead times, in particular for digital staff. For example, the lead time was two or three months in comparison with around two weeks in the private sector. To what extent did Covid-19 impact on recruitment times?

We probably do not have some of the most up-to-date statistics to share with the committee. The team might know that detail, but it might be something that either we can write to the committee on or the Scottish Government can provide.

I do not think that that detracts from your overall point, though. To deliver services during the pandemic, the Scottish Government has had to bring a high volume of people into both it and its public bodies, and it has not had the resources to deal with that sort of throughput with the real pace that has been needed. As a result, some of the delays in the timescales that we refer to in the report have been seen in other Scottish public bodies.

That is particularly the case in, as you say, digital skills. It is a really fast-moving market, and those skills are in demand not just in public bodies but across the private sector. As a result, things might move even quicker than the two or three weeks that your predecessor committee referred to.

Of course, all of that brings risk, because you will lose talent: if people get caught up in delays as a result of public bodies’ arrangements, they will inevitably take offers elsewhere. It is important not just for NRS but for all such bodies that the Scottish Government’s arrangements reflect market circumstances.

Just to be clear, I am not advocating that public bodies do away with necessary checks. After all, we all want to be satisfied that, for those who come into these bodies, the provision of sensitive private information is dealt with properly, but there seems to be a misalignment between the pace at which the market is moving and the rate at which public bodies can bring people into post under Scottish Government arrangements.

As you say, at the moment, the process is so long that by the time the Scottish Government actually gets around to offering someone a job, they have already taken a job elsewhere, which adds to the issue.

During the committee round table on Scotland’s colleges, we heard that the national health service in Edinburgh also had a long recruitment lead time of around 12 weeks. However, we also heard that it had managed to reduce the process to four weeks because of the pandemic and the need to recruit staff at pace. Do you know whether the Scottish Government is actively seeking to adapt and change its recruitment processes?

We know that the Scottish Government is reviewing its arrangements and is looking to accelerate the process of bringing people into the organisation. We have not undertaken any audit work on those arrangements yet. Given that the pace at which public bodies can get people in presents a clear business risk at the moment, the learning and experience that the NHS has gone through in Edinburgh—and in other parts of Scotland—must be shared and translated into other parts of the public sector. It needs to be a clear priority.

Finally, the report tells us that National Records of Scotland is aware of the on-going risks around resourcing and is undertaking exercises to explore other routes to bring in the necessary skills, including discussions with other UK census-taking bodies. Are you aware of the outcomes of the discussions that have been held with those bodies?

I am not sure that I have the latest position on that. I turn to Dharshi Santhakumaran to update the committee.

I know that NRS has brought in several staff from the ONS and NISRA on secondment. I do not have the exact numbers, but I know that there are some staff who were involved in the delivery of the 2021 census who are now working on secondment in NRS.

Thank you.

I want to pick up on that last point. Over the past couple of days, I have been looking at the ONS’s summary of how things went in the March 2021 census. The document, which was published in October, says under “Main points”:

“Census 2021 exceeded expectations, with 97% of households across England and Wales taking part”.

The document also says:

“Use of cloud architecture allowed us to scale up to meet the very high demand experienced on Census Day”.

It was the first digital-first census to be held in England and Wales. The ONS says that the system did not crash, even though

“we were receiving just under half a million census submissions per hour at the peak.”

It also says:

“The success of the Census 2021 digital service shows that large government digital services can be securely delivered in-house using cloud architecture and Agile development.”

Do you have any reflections on that?

That all suggests the delivery, on time, of a very successful project. In particular, it is very impressive that the service was able to cope with such volumes on a single day.

As well as having knowledge transfer from consultants, it is important that National Records of Scotland continues to benefit from experiences in other parts of the UK. It is a positive development that there have been secondees from NISRA and the ONS to NRS. It clearly matters that NRS benefits from those connections and sharing across other census-taking bodies.

Yes, that point is well made.

I will conclude by quoting the final paragraph of the section 22 report that came out 10 days ago and which we are discussing this morning. It says:

“significant risks remain”

in the delivery of the 2022 census

“and it is of the utmost importance that NRS continues to monitor and manage them. NRS should also ensure that it continues to act on the outstanding TAF/Gateway review recommendations. I expect the auditor to continue to monitor NRS’s progress with delivering the census programme and its management of ongoing financial pressures.”

The committee would welcome an update on that monitoring work. Is it your intention to produce a follow-up report for Parliament so that we can return to the issue in the future?

Yes. Asif Haseeb and Graeme Samson, through their annual audit of NRS, will be reporting publicly on the judgments that they reach over the summer of 2022, and, hopefully, after the census has taken place.

I have not yet reached a definitive position on whether I will undertake a further section 22 report. I will be informed by the judgments reached by Asif Haseeb and any further considerations or evidence that the committee takes on the topic.

Thank you very much.

I thank Graeme Samson—I am sorry that we were unable to hear you—Asif Haseeb and Dharshi Santhakumaran for joining us online. We very much appreciate your time and contributions this morning. I also thank, as always, the Auditor General, who joined us in person.

10:13 Meeting continued in private until 11:35.