Whitehall’s legacy ICT here to stay?

By Tony Collins

Well done to the National Audit Office for reporting in detail on some of central government’s legacy ICT. It’s clear the NAO found the research difficult, in part because some of the system performance information it was seeking had to come from suppliers because it was not held by departments.

This gives a hint of the extent to which departments such as HMRC and the Department for Work and Pensions are in the hands of IT companies.

The NAO report Managing the risks of legacy ICT to public service delivery suggests, but doesn’t say explicitly, that legacy ICT contracts are here to stay.

Attempts by the Cabinet Office to make large cuts in the costs of central government IT will be thwarted to some extent by the reliance of departments on big suppliers and big systems. Says the NAO

“A particular risk is that departments dependent on legacy ICT will find it more challenging to achieve the business transformation envisaged by the Government in its digital strategy.”

[But there appears to be little anyone can do about it.]

The NAO report says that major change that involves underlying ICT will “create a new set of risks which will increase as the degree of system change increases”.

HMRC and the Department for Work and Pensions still rely on Fujitsu mainframes with the VME operating system, which was originally developed in the 1970s to run ICL mainframes.

These are some of the NAO’s other findings:

– “We estimate that in 2011-12 at least £480bn of the government’s operating revenues and at least £210bn of non-staff expenditure such as pensions and entitlements were reliant to some extent on legacy ICT.”

– “Managing the risk of legacy ICT has also prevented some government bodies from reducing their dependency on a few large ICT suppliers, reducing competition and increasing the risk to value for money.”

– “Departments with the largest legacy ICT estates have found it challenging to achieve value for money and improve customer service. For example:

• In 2009, HMRC described its 600 systems as “complex, ageing and costly”… By the end of 2011-12, HMRC had switched off 65 legacy applications…”

• Within DWP, we have previously found that administrative errors within the benefits system were, in part, caused by poor communication between its network of some 140 systems.  However, the Department is now rationalising its ICT estate with a view to reducing the number of ICT applications by 2017.

– “The administration cost involved in using legacy ICT can be considerable. The cost of operating HMRC’s VAT collection service is £430m per annum and the cost of the DWP pension payment service is £385m per annum.”

– Eight key legacy ICT risks are:

• Disruption to service continuity. Legacy ICT infrastructure or applications are prone to instability due to failing components, disrupting the overall service. Failure of the legacy ICT may be more difficult to rectify due to the complexity or shortage of components.

• Security vulnerabilities. Older systems may be unsupported by their suppliers, meaning the software no longer receives bug fixes or patches that address security weaknesses. The system may not therefore be able to adapt to cyber threats.

• Vendor lock-in. Legacy ICT systems are often bespoke and have developed more complexity over time to the extent that only the original supplier will have the knowledge to support them.

• Skills gaps. Specific skills in old programming languages may be required that are not widely available. Staff working with legacy ICT over a long period will have often developed a depth of understanding of the system that is difficult to replace.

• Manual workarounds. More manual processing can be required due to the lack of functionality within the system or its inability to interface with other systems. Examples of workarounds include performing detailed calculations outside the system on spreadsheets; re-entering data on to other systems or having to manually check for processing and input errors.

• Limited adaptability. New business requirements may not be supported by the legacy ICT. These may include requirements such as the provision of digital channels, the provision of real-time information and not being able to process transactions in a new way.

• Hidden costs. The true cost of operating the system may not be known. Workarounds to the system and the cost of the additional manual processes may not be recorded. By not having all the information available at the right time, legacy ICT may not be able to provide real-time performance information which could lead to poor decision-making.

• Business change. Due to the complexity or the limited availability of the skills required, change may be difficult, lengthy to implement and costly. This makes it difficult for the business to be responsive and changes may have to be prioritised.

–  “A potential ninth risk is that legacy ICT may be less energy efficient than modern systems.”

VME

-“ The legacy ICT we reviewed in DWP and HMRC both have origins that predate the internet and use technology based on Fujitsu’s Virtual Machine Environment (VME) operating system. Some of the applications using VME process the data in batches. Jobs are set serially such as checking the credibility of the amounts declared on VAT returns. Such a mode of operation would be incompatible with a fully digital service and so these applications may require replacement or modification. A fully digital service would then enable online end-to-end processes with systems that respond in real-time.

– “The current supplier of VME, Fujitsu, has announced that it will support the current version of VME until 2020. After this, organisations have the choice of moving to alternatives or extending VME applications by using Fujitsu’s planned managed service.”

Can legacy ICT be replaced?

–  “The scale and importance of both services, combined with the materiality of the public money they administer, have deterred both departments from replacing these systems. Neither department [HMRC or DWP] had considered replacing their legacy ICT with a completely new end-to-end service. Instead they built new functionality around existing processes or systems, replacing an existing paper-based system

“In both organisations we found that the ICT and business functions could have worked more closely together to develop a longer-term strategy for a complete end-to-end service. In addition, we found a lack of data that would enable management to assess the full cost of service and performance.”

Supplier lock-in?

– “HMRC has found it challenging achieving a ‘whole customer’ view, as its customer data is stored across a number of legacy ICT systems. Perpetuating the use of older systems creates challenges for sustaining the right technical skills, for improving customer service.”

–  “The scale, age and complexity of DWP and HMRC legacy ICT has meant that only a small number of large ICT suppliers are able to support them as they are far too complex for a small- or medium-sized business to maintain. This will be an important consideration when preparing for contract end points, even more than the age of the technology. The government has recognised the issue of vendor lock-in by announcing plans for the creation of common ICT infrastructure. Through greater separation of the business application from the physical hardware, the aim is to reduce reliance on individual vendors.”

Lack of data?

– The average number of major faults in the system is the number logged as severity 1 or 2 meaning that 10 per cent of users are unable to access the service or there is a failure of overnight processing or an inability to produce printed output for the public. DWP monitors the performance of its system on a four- or five-week period rather than calendar months. It was unable to provide us with detailed performance reports for the period under review but obtained the average quoted above from the supplier.

–  “Determining whether the management of legacy ICT within DWP and HMRC incurs hidden costs has proved challenging. DWP’s financial data was comprehensive but it lacked effective measures to assess overall service performance, quality of process activity and the reliability of its legacy ICT. This will make it difficult for DWP to robustly plan for the longer term.”

– “HMRC was still providing us with data in the very late stages of finalising this report and several months after it had originally been requested. For financial data, the late provision of data has prevented us from verifying that costs are on a consistent basis with other departments and forming clear conclusions. For performance information, we saw indications that HMRC has a good set of data that it uses in its day-to-day management. However, we were unable to fully confirm this finding or obtain sufficient data to allow us to conclude on the performance of the VAT service. The challenges we faced in obtaining data from HMRC suggest that it may face challenges in planning for the longer term robustly.”

NAO report: Managing the risks of ICT legacy to public service delivery