Category Archives: Cloud

Aftermath of the cyber attack – will ministers learn the wrong lessons?

Posted on 16/05/2017 | 5 comments

By Tony Collins

At least 16 NHS trusts out of 47 that were hit by the ransomware attack continue to face problems, according to BBC research.

And, as some patients continued to have their cancer treatments postponed, Tory, Labour and Lib-dem politicians told of their plans to spend more money on NHS IT.

But will any new money promised by government focus on basic weaknesses – such as the lack of interoperability and the structural complexities that made the health service vulnerable to cyber attack?

Last year when the health secretary Jeremy Hunt announced £4bn for NHS IT, his focus was on new technologies such as smartphone apps to order repeat prescriptions rather than any urgent need to upgrade MRI, CT and other medical devices that rely on Windows XP.

Similarly the government-commissioned Wachter review “Making IT Work: Harnessing the Power of HealthInformation Technology to Improve Care in England“ made no mention of Windows XP or any operating system – perhaps because ministers were much more likely to welcome a review of NHS IT that focused on innovation and new technologies.

Cancer treatments postponed

The Government’s position is that the NHS was not specifically targeted in the cyber attack and that the Tories are putting £2bn into cyber security over the next year.

Theresa May said yesterday,

“It was clear warnings were given to hospital trusts but this is not something that was focused on attacking the NHS. 150 countries are affected. Europol says there are 200,000 victims across the world. Cyber security is an issue we need to address.

“That’s why the government, when we came into government in 2010, put money into cyber security. It’s why we are putting £2bn into cyber security over the coming year.”

Similarly Jeremy Hunt, health secretary, told the BBC that the attack affected international sites that have “some of the most modern IT systems”.

But the BBC’s World at One gave an example of how the NHS’s IT problems were affecting the lives of patients.

It cited the case of Claire Hobday whose radiography appointment for breast cancer at Lincoln County Hospital was cancelled on Friday (12 May 2017) and she still doesn’t know when she’ll receive treatment. Hobday said,

“I turned up by hospital transport for my second radiotherapy session, and I, along with many other patients – at least 20 other people were waiting – and they said the computers weren’t working.

“I do have to say the staff were very good and very quickly let us all know that they were having trouble with the computers. They didn’t want to misinform us, so they were going to come and talk to us all individually and hoped they would be able to rectify it.

“Within half an hour or so they came out and said, ‘We’re really sorry but it’s not going to get sorted. We’ll send you all home and give you a call on Sunday’ which didn’t happen.

“But they did ring me this morning (15 May 2017) to say it’s not happening today and if transport turns up please don’t get in it, and it’s very unlikely it will happen tomorrow.

“It is just a bit upsetting that other authorities have managed to sort it but Lincolnshire don’t seem to have been able to do that.”

United Lincolnshire Hospitals Trust told World at One it will be back in touch with patients once the IT system is restored.

Roy Grimshaw was in the middle of an MRI scan – after dye was injected into his blood stream –  when the scan was stopped and he was asked to go back into the waiting room in his gown, with tubes attached to him, while staff investigated a computer problem. After half an hour he was told the NHS couldn’t continue the scan.

Budgets “not an issue”?

GP practices continue to be affected. Keiran Sharrock, GP and medical director of Lincolnshire local medical committee, said yesterday (15 Mat 2017) that systems were switched off in “many” practices.

“We still have no access to medical records of our patients. We are asking patients to only contact the surgery if they have an urgent or emergency problem that needs dealing with today. We have had to cancel routine follow-up appointments for chronic illnesses or long-term conditions.”

Martha Kearney – BBC World at One presenter –  asked Sharrock about NHS Digital’s claim that trusts were sent details of a security patch that would have protected against the latest ransomware attack.

“I don’t think in general practice we received that information or warning. It would have been useful to have had it,” replied Sharrock.

Kearney – What about claims that budget is an aspect of this?

Sharrock: “Within general practice that doesn’t seem to be the reason this happened. Most general practices have people who can work on their IT and if we’d been given the patch and told it needed to be installed, most practices would have done that straight away.”

GCHQ

World at One also spoke to Ciaran Martin, Director General for Government and Industry Cyber Security.  He is a member of the GCHQ board and its senior information risk owner.  He used to be Constitution Director at the Cabinet Office and was lead negotiator for the Prime Minister in the run-up to the Edinburgh Agreement in 2012 on a referendum on independence for Scotland.

Kearney: Did your organisation issue any warnings to the health service?

Martin: “We issue warnings and advice on how to upgrade defences constantly. It’s generally public on our website and it’s made very widely available for all organisations. We are a national organisation protecting all critical sectors and indeed individuals and smaller organisations as well.”

Huge sums spent on paying ransoms?

Kearney asked Martin, “How much money are you able to estimate is being spent on ransoms as a result of these cyber attacks?” She added,

“I did hear one astonishing claim that in the first quarter of 2016 more money was spent in the USA on responding to ransomware than [was involved] in armed robberies for the whole of that year?”

Martin: “First let me make clear that we don’t condone the payment of ransoms and we strongly advise bodies not to pay and indeed in this case the Department of Health and the NHS have been very clear that affected bodies are not to pay ransoms. Across the globe there is, sadly, a market in ransomware. It is often the private sector in shapes and sizes that is targeted.”

Martha Kearney said the UK may be a target because it has a reputation for being willing to pay ransoms.

Martin, “We are no more or less a target for ransomware than anywhere else. It’s a global business; and it is a business. It is all about return on investment for the attacker.

“What’s important about that is that it’s all about upgrading defences because you can make the return on investment lower by making it harder to get in.”

If an attacker gets in the aim must be to make it harder to get anything useful, in which case the “margin on investment goes down”. He added,

“That’s absolutely vital to addressing this problem.”

Are governments at fault?

Martin,

“Vulnerabilities will always exist in software. Regardless of who finds the underlying software defect, it’s incumbent on the entire cyber security ecosystem – individual users, enterprises, governments or whoever – to work together to mitigate the harm.”

He added that there are “all sorts of vulnerabilities out there” including with open source software.

Windows XP

Computer Weekly reports – convincingly – that the government did not cancel an IT support contract for XP.

Officials decided to end a volume pricing deal with Microsoft which left NHS organisations to continue with XP support if they chose to do so. This was clearly communicated to affected departments.

Government technology specialists, reports Computer Weekly, did not want a volume pricing deal with Microsoft to be  “comfort blanket” for organisations that – for their own local reasons – were avoiding an upgrade from XP.

Computer Weekly also reported that civil servants at the Government Digital Service expressed concerns about the lack of technical standards in the NHS to the then health minister George Freeman.

Freeman was a Department of Health minister until July 2016. In their meeting with Freeman, GDS officials  emphasised the need for a central body to set technical standards across the NHS, with the authority to ensure trusts and other organisations followed best practice, and with the transparency to highlight those who chose not to.

A source told Computer Weekly that Jeremy Hunt was also briefed on the security risks that a lack of IT standards would create in a heavily-federated NHS but it was not considered a priority at that top political level.

“Hunt never grasped the problem,” said the source.

There are doubts, though, that Hunt could have forced trusts to implement national IT security standards even if he’d wanted to. NHS trusts are largely autonomous and GDS has no authority to mandate technical standards. It can only advise.

How our trust avoided being hit

A comment by an NHS IT lead on Digital Health’s website gives an insight into how his trust avoided being hit by the latest cyber attack.  He said his trust had a “focus on perimeter security” and then worked back to the desktop.

“This is then followed up by lots of IG security pop ups and finally upgrading (painfully) windows XP to windows 7…” He added,

“NHS Digital have to take a lead on this and enforce standards for us locally to be able to use.”

He also suggests that NHS Digital sign a Microsoft Enrollment for Windows Azure [EWA] agreement as it is costly arranging such a deal locally.

 “NHS Digital must for me, step in and provide another MS EWA as I am sure the disruption and political fall-out will cost more. Introduce an NHS MS EWA, introduce standards for software suppliers to comply with latest OS and then use CQC to rate organisations that do not upgrade.”

Another comment on the Digital Health website says that even those organisations that could afford the deployment costs of moving from XP to Windows 7 were left with the “professional” version, which “Microsoft has mercilessly withdrawn core management features from (e.g. group policy features)”.

The comment said,

“There are a lot of mercenary enterprises taking advantage of the NHS’s inability to mandate and coordinate the required policies on suppliers which would at least give the under-funded and under-appreciated IT functions the ability to provide the service they so desperately want to.”

A third comment said that security and configuration management in the NHS is “pretty poor”. He added, “I don’t know why some hospitals continue to invest in home-brew email systems when there is a national solution ready and paid for.

“In this recent attack most the organisations hit seem to use local email systems.”

He also criticised NHS organisations that:

  • Do not properly segment their networks
  • Allow workstations to openly and freely connect to each other in a trusted zone.
  • Do not have a proper patch / update management regime
  • Do not firewall legacy systems
  • Don’t have basic ACLs [access control lists)

Three lessons?

  • Give GDS the ability to mandate no matter how many Sir Humphreys would be upset at every challenge to their authority. Government would work better if consensus and complacency at the top of the civil service were regarded as vices, while constructive, effective and forceful criticism was regarded as a virtue.
  • Give the NHS money to spend on the basic essentials rather than nice-to-haves such as a paperless NHS, trust-wide wi-fi, smartphone apps, telehealth and new websites. The essentials include interoperability – so that, at the least, all trusts can send test results and other medical information electronically to GPs –  and the upgrading of medical devices that rely on old operating systems.
  •  Plan for making the NHS less dependent on monolithic Microsoft support charges.

On the first day of the attacks, Microsoft released an updated patch for older Windows systems “given the potential impact to customers and their businesses”.

Patches are available for: Windows Server 2003 SP2 x64, Windows Server 2003 SP2 x86, Windows XP SP2 x64, Windows XP SP3 x86, Windows XP Embedded SP3 x86, Windows 8 x86, and Windows 8 x64.

Reuters reported last night that the share prices of cyber security companies “surged as investors bet on governments and corporations spending to upgrade their defences”.

Network company Cisco Systems also closed up (2.3%), perhaps because of a belief that it would benefit from more network spending driven by security needs.

Security company Avast said the countries worst affected by WannaCry – also known as Wannacypt – were Russia, Taiwan, Ukraine and India.

Comment

In a small room on the periphery of an IT conference on board a cruise ship , nearly all of the senior security people talked openly about how their board directors had paid ransoms to release their systems after denial of service attacks.

Some of the companies – most of them household names – had paid ransoms more than once.

Until then, I’d thought that some software suppliers tended to exaggerate IT security threats to help market their solutions and services.

But I was surprised at the high percentage of large companies in that small room that had paid ransoms. I no longer doubted that the threats – and the damage – were real and pervasive.

The discussions were not “off-the-record” but I didn’t report their comments at the time because that would doubtless have had job, and possibly even career ramifications, if I had quoted the security specialists by name.

Clearly ransomware is, as the GCHQ expert Kieran Martin put it, a global business but, as ransoms are paid secretly – there’s not a whisper in corporate annual accounts – the threat has not been taken seriously enough in some parts of the NHS.

The government’s main defence is that the NHS was not targeted specifically and that many private organisations were also affected.

But the NHS has responsibility for lives.

There may be a silver lining if a new government focuses NHS IT priorities on the basics – particularly the structural defects that make the health service an easy target for attackers.

What the NHS doesn’t need is a new set of politicians and senior civil servants who can’t help massaging their egos and trying to immortalise their legacy by announcing a patchwork of technological marvels that are fun to work on, and spend money on, but which gloss over the fact that much of the NHS is, with some notable exceptions, technologically backward.

Microsoft stockpiled patches – The Register

UK government, NHS and Windows XP support – what really happened – Computer Weekly

NHS letter on patches to counter cyber attack

Multiple sites hit by ransomware attack – Digital Health (31 comments)

Lessons from the WannaCrypt – Wannacry – cyber attack according to Microsoft

 

5 Comments

Posted in Campaign4Change, change management, Cloud Computing, Department of Health, e-health, G-Cloud, GDS, GDS, Government IT, health, health records, IT-related failures, Legacy ICT, NHS, NHS England, open source

Tagged ,

Large suppliers still dominate government IT

Posted on 30/03/2017 | 6 comments

By Tony Collins

In 2012, the then Cabinet Office minister Francis Maude, lamented the high costs of government IT and spoke of an “oligopoly” of large suppliers. He suggested things would change.

“… contracts were consistently awarded to a limited number of very large suppliers on long-term exclusive contracts.

“As a result there was inadequate competition and an abdication of control. The concept of having one supplier, aggregated supply, increased project risk and removed competitive tension.

“The Government repeatedly found itself paying large amounts for systems that were delivered late, over budget and which often did not fully meet the original policy requirement.  If indeed, they were delivered at all. There are plenty of well-documented disasters – such as DH’s now terminated National programme for IT.

“Ultimately, the last Government lost control of IT – it outsourced not only delivery, but its entire strategy and ability to shape the future of our public services.

“At the same time smaller, more innovative and efficient suppliers were finding themselves locked out of the supply of services to Government because of what was described by Parliament as a powerful “oligopoly” of large suppliers.

“Procurements took so long only the big companies could absorb the cost – which they naturally passed on to us.

“All in all, we had an approach that was bad for users, bad for the taxpayer and bad for growth.”

Public sector IT spending was up to £20bn a year, he said, adding that “public sector productivity was actually declining”.  He outlined how things were changing.

What has happened since?

A report published today by the National Audit “Digital Transformation in Government” raises a question of how much has changed.

Efforts to boost the SME share of government IT business “have had some impact”, says the National Audit Office, but it adds that “most government procurement with digital and technology suppliers continues to be with large organisations”.

“In 2015-16, 94% of such spending was with large enterprises, a fall of less than one percentage point since 2012-13.”

Today’s NAO report is mainly about the Cabinet Office’s Government Digital Service – GDS. It points out GDS’s strengths and weaknesses but in general does not give any advice on the sensitive point of whether it should have more or less influence on government IT.

On digital transformation, it says that the work of the NAO shows that attempts to transform government have had mixed success.

“Many public services appear increasingly unsustainable. Those responsible for major programmes have continued to exhibit over-optimism and make slow progress towards their objectives.”

It adds,

“Digital transformation has a mixed track record across government. It has not yet provided a level of change that will allow government to further reduce costs while still meeting people’s needs.

“GDS has also struggled to demonstrate the value of its own flagship initiatives such as Verify, or to set out clear priorities between departmental and cross-government objectives.

“GDS’s renewed approach aims to address many of these concerns as it expands and develops into a more established part of government. But there continues to be a risk that GDS is trying to cover too broad a remit with unclear accountabilities.

“To achieve value for money and support transformation across government, GDS needs to be clear about its role and strike a balance between robust assurance and a more consultative approach.”

Comment

The National Audit Office report is strong on facts and quality of research but avoids the big question of how GDS can bring about change when the top brass in departments prefer autonomy to what they see as GDS’s interference.

GDS’s existence goes to the heart of how the civil service runs. It is one part of the civil service trying to bring about change in other parts of the civil service.

And the evidence so far is that the civil service doesn’t like change.

The NAO report disappoints because it doesn’t address how government IT is to change if departments are to continue to run empires unchallenged by GDS or the heads of the civil service. Sir Humphrey is still king.

GDS scrutinises departmental IT spending – spending applications are reviewed by a team of eight people within GDS’s Standards Assurance team – but, much to Sir Humphrey’s delight, GDS’s influence seems to be waning.

When Jack Straw was Justice secretary, he told MPs in 2007 that when he abandoned projects there was a fuss at first and soon nobody noticed the project did not exist.

“There is always the option to abandon things. I did that in the Foreign Office with much complaint that the world might end.

“What happened was that we saved a lot of money and no one ever noticed the fact that that scheme did not exist…it is very frustrating that so many people, including the private sector, are taken in by snake oil salesmen from IT contractor who are not necessarily very competent and make a lot of money out of these things. I am pretty intolerant of this.”

How much has changed? Outsiders including Jack Straw and Francis Maude, together with insiders such as Chris Chant have pointed to the need for major changes in the way departments manage huge IT budgets and there have been some improvements: HMRC’s is breaking up its monolithic “Aspire” contract, citizens may notice that it is possible now to renew passports and driving licences online and GDS has had an impact in making departments think hard about whether they really need to spend the amounts they do on major IT contracts.

But major change in the costs of government IT seems not just a long way off but unattainable while the dominance of Sir Humphrey remains unchallenged.

Digital Transformation in Government – NAO report

6 Comments

Posted in Campaign4Change, capacity building, G-Cloud, GDS, Government digital Service, Government IT, HMRC, Infrastructure and Projects Authority, Institute for Government, IT-enabled projects and waste, Major Projects Authority, National Audit Office, procurement

Tagged , , ,

Aspire: eight lessons from the UK’s biggest IT contract

Posted on 22/06/2016 | 1 comment

By Tony Collins

How do you quit a £10bn IT contract in which suppliers have become limbs of your organisation?

Thanks to reports by the National Audit Office, the questioning of HMRC civil servants by the Public Accounts Committee, answers to FOI requests, and job adverts for senior HMRC posts, it’s possible to gain a rare insight into some of the sensitive commercial matters that are usually hidden when the end of a huge IT contract draws closer.

Partly because of the footnotes, the latest National Audit Office memorandum on Aspire (June 2016) has insights that make it one of the most incisive reports it has produced on the department’s IT in more than 30 years.

Soaring costs?

Aspire is the government’s biggest IT-related contract. Inland Revenue, as it was then, signed a 10-year outsourcing deal with HP (then EDS) in 1994, and transferred about 2,000 civil servants to the company. The deal was expected to cost £2bn over 10 years.

After Customs and Excise, with its Fujitsu VME-based IT estate, was merged with Inland Revenue’s in 2005, the cost of the total outsourcing deal with HP rose to about £3bn.

In 2004 most of the IT staff and HMRC’s assets transferred to Capgemini under a contract known as Aspire – Acquiring Strategic Partners for Inland Revenue. Aspire’s main subcontractors were Accenture and Fujitsu.

In subsequent years the cost of the 10-year Aspire contract shot up from about £3bn to about £8bn, yielding combined profits to Capgemini and Fujitsu of £1.2bn – more than double the £500m originally modelled. The profit margin was 15.8% compared to 12.3% originally modelled.

The National Audit Office said in a report on Aspire in 2014 that HMRC had not handled costs well. The NAO now estimates the cost of the extended (13-year) Aspire contract from 2004 to 2017 to be about £10bn.

Between April 2006 and March 2014, Aspire accounted for about 84% of HMRC’s total spending on technology.

Servers that typically cost £30,000 a year to run under Aspire – and there are about 4,000 servers at HMRC today – cost between £6,000 when run internally or as low as £4,000 a year in the commodity market.

How could the Aspire spend continue – and without a modernisation of the IT estate?

A good service

HMRC has been generally pleased with the quality of service from Aspire’s suppliers.  Major systems have run with reducing amounts of downtime, and Capgemini has helped to build many new systems.

Where things have gone wrong, HMRC appears to have been as much to blame as the suppliers, partly because development work was hit routinely by a plethora of changes to the agreed specifications.

Arguably the two biggest problems with Aspire have been cost and lack of control.  In the 10 years between 2004 and 2014 HMRC paid an average of £813m a year to Aspire’s suppliers.  And it paid above market rates, according to the National Audit Office.

By the time the Cabinet Office’s Efficiency and Reform Group announced in 2014 that it was seeking to outlaw “bloated and wasteful” contracts, especially ones over £100m, HMRC had already taken steps to end Aspire.

It decided to break up its IT systems into chunks it could manage, control and, to some extent, commoditise.

HMRC’s senior managers expected an end to Aspire by 2017. But unexpected events at the Department for Work and Pensions put paid to HMRC’s plan …

Eight lessons from Aspire

1. Your IT may not be transformed by outsourcing.  That may be the intention at the outset. But it didn’t happen when Somerset County Council outsourced IT to IBM in 2007 and it hasn’t happened in the 12 years of the Aspire contract.

 “The Aspire contract has provided stable but expensive IT systems. The contract has contributed to HMRC’s technology becoming out of date,” said the National Audit Office in its June 2016 memorandum.

Mark DearnleyAnd Mark Dearnley, HMRC’s Chief Digital Information Officer and main board member, told the Public Accounts Committee last week,

“Some of the technology we use is definitely past its best-before date.”

2. You won’t realise how little you understand your outsourced IT until you look at ending a long-term deal.

Confidently and openly answering a series of trenchant questions from MP Richard Bacon at last week’s Public Accounts Committee hearing, Dearnley said,

“It’s inevitable in any large black box outsourcing deal that there are details when you get right into it that you don’t know what’s going on. So yes, that’s what we’re learning.”

3. Suppliers may seem almost philanthropic in the run-up to a large outsourcing deal because they accept losses in the early part of a contract and make up for them in later years.

Dearnley said,

“What we are finding is that it [the break-up of Aspire] is forcing us to have much cleaner commercial conversations, not getting into some of the traditional arrangements.

” If I go away from Aspire and talk about the typical outsourcing industry of the last ten years most contracts lost money in their first few years for the supplier, and the supplier relied on making money in the later years of the contract.

“What that tended to mean was that as time moved on and you wanted to change the contract the supplier was not particularly incented to want to change it because they wanted to make their money at the end.

“What we’re focusing on is making sure the deals are clean, simple, really easy to understand, and don’t mortgage the future and that we can change as the environment evolves and the world changes.”

4. If you want deeper-than-expected costs in the later years of the contract, expect suppliers to make up the money in contract extensions.

Aspire was due originally to end in 2004. Then it went to 2017 after suppliers negotiated a three-year extension in 2007. Now completion of the exit is not planned until 2020, though some services have already been insourced and more will be over the next four years.

The National Audit Office’s June 2016 memorandum reveals how the contract extension from 2017 to 2020 came about.

HMRC had a non-binding agreement with Capgemini to exit from all Aspire services by June 2017. But HMRC had little choice but to soften this approach when Capgemini’s negotiating position was unexpectedly strengthened by IT deals being struck by other departments, particularly the Department for Work and Pensions.

Cabinet Office “red lines” said that government would not extend existing contracts without a compelling case. But the DWP found that instead of being able to exit a large hosting contract with HP in February 2015 it would have to consider a variation to the contract to enable a controlled disaggregation of services from February 2015 to February 2018.

When the DWP announced it was planning to extend its IT contract with its prime supplier HP Enterprise, HMRC was already in the process of agreeing with Capgemini the contract changes necessary to formalise their agreement to exit the Aspire deal in 2017.

“Capgemini considered that this extension, combined with other public bodies planning to extend their IT contracts, meant that the government had changed its position on extensions…

“Capgemini therefore pushed for contract extensions for some Aspire services as a condition of agreeing to other services being transferred to HMRC before the end of the Aspire contract,” said the NAO’s June 2016 memo.

5. It’s naïve to expect a large IT contract to transfer risks to the supplier (s).

At last week’s Public Accounts Committee hearing, Richard Bacon wanted to know if HMRC was taking on more risk by replacing the Aspire contract with a mixture of insourced IT and smaller commoditised contracts of no more than three years. Asked by Bacon whether HMRC is taking on more risk Dearnley replied,

“Yes and no – the risk was always ours. We had some of it backed of it backed off in contract. You can debate just how valuable contract backing off is relative to £500bn (the annual amount of tax collected).　 We will never back all of that off. We are much closer and much more on top of the service, the delivery, the projects and the ownership (in the gradual replacement of Aspire).”

6. Few organisations seeking to end monolithic outsourcing deals will have the transition overseen by someone as clear-sighted as Mark Dearnley.

His plain speaking appeared to impress even the chairman of the Public Accounts Committee Meg Hillier who asked him at the end of last week’s hearing,

Meg Hillier

Meg Hillier

“And what are your plans? One of the problems we often see in this Committee is people in very senior positions such as yours moving on very quickly. You have had a stellar career in the private sector…

“We hope that those negotiations move apace, because I suspect – and it is perhaps unfair to ask Mr Dearnley to comment – that to lose someone senior at this point would not be good news, given the challenges outlined in the [NAO] Report,” asked Hillier.

Dearnley then gave a slightly embarrassed look to Jon Thomson, HMRC’s chief executive and first permanent secretary. Dearnley replied,

“Jon and I are looking at each other because you are right. Technically my contract finishes at the end of September because I was here for three years. As Jon has just arrived, it is a conversation we have just begun.”

Hiller said,

“I would hope that you are going to have that conversation.”

Richard Bacon added,

“Get your skates on, Mr Thompson; we want to keep him.”

Thompson said,

“We all share the same aspiration. We are in negotiations.”

7. Be prepared to set aside millions of pounds – in addition to the normal costs of the outsourcing – on exiting.

HMRC is setting aside a gigantic sum – £700m. Around a quarter of this, said the National Audit Office, is accounted for by optimism bias. The estimates also include costs that HMRC will only incur if certain risks materialise.

In particular, HMRC has allowed around £100m for the costs of transferring data from servers currently managed by Aspire suppliers to providers that will make use of cloud computing technology. This cost will only be incurred if a second HMRC programme – which focuses on how HMRC exploits cloud technology – is unsuccessful.

Other costs of the so-called Columbus programme to replace Aspire include the cost of buying back assets, plus staff, consultancy and legal costs.

8. Projected savings from quitting a large contract could dwarf the exit costs.

HMRC has estimated the possible minimum and possible maximum savings from replacing Aspire. Even the minimum estimated savings would more than justify the organisational time involved and the challenge of building up new corporate cultures and skills in-house while keeping new and existing services running smoothly.

By replacing Aspire and improving the way IT services are organised and delivered, HMRC expects to save – each year – about £200m net, after taking into account the possible exit costs of £700m.

The National Audit Office said most of the savings are calculated on the basis of removing supplier profit margins and overheads on services being brought in-house, and reducing margins on other services from contract changes.

Even if the savings don’t materialise as expected and costs equal savings the benefits of exiting are clear. The alternative is allowing costs to continue to soar while you allow the future of your IT to be determined by what your major suppliers can or will do within reasonable cost limits.

Comment

HMRC is leading the way for other government departments, councils, the police and other public bodies.

Dearnley’s approach of breaking IT into smaller manageable chunks that can be managed, controlled, optimised and to some extent commoditised is impressive.　 On the cloud alone he is setting up an internal team of 50.

In the past, IT empires were built and retained by senior officials arguing that their systems were unique – too bespoke and complex to be broken up and treated as a commodity to be put into the cloud.

Dearnley’s evidence to the Public Accounts Committee exposes pompous justifications for the status quo as Sir Humphrey-speak.

Both Richard Feynman and Einstein said something to the effect that the more you understand a subject, the simpler you can explain it.

What Dearnley doesn’t yet understand about the HMRC systems that are still run by Capgemini he will doubtless find out about – provided his contract is renewed before September this year.

No doubt HMRC will continue to have its Parliamentary and other critics who will say that the risks of breaking up HMRC’s proven IT systems are a step too far. But the risks to the public purse of keeping the IT largely as it is are, arguably, much greater.

The Department for Work and Pensions has proved that it’s possible to innovate with the so-called digital solution for Universal Credit, without risking payments to vulnerable people.

If the agile approach to Universal Credit fails, existing benefit systems will continue, or a much more expensive waterfall development by the DWP’s major suppliers will probably be used instead.

It is possible to innovate cheaply without endangering existing tax collection and benefit systems.

Imagine the billions that could be saved if every central government department had a Dearnley on the board. HMRC has had decades of largely negative National Audit Office reports on its IT.  Is that about to change?

Update:

This morning (22 June 2016) on LinkedIn, management troubleshooter and board adviser Colin Beveridge wrote,

“Good analysis of Aspire and outsourcing challenges. I have seen too many business cases in my career, be they a case for outsourcing, provider transition or insourcing.

“The common factor in all the proposals has been the absence of strategy end of life costs. In other words, the eventual transition costs that will be incurred when the sourcing strategy itself goes end of life. Such costs are never reflected in the original business case, even though their inevitability will have an important impact on the overall integrity of the sourcing strategy business case.

“My rule of thumb is to look for the end of strategy provision in the business case, prior to transition approval. If there is no provision for the eventual sourcing strategy change, then expect to pay dearly in the end.”

June 2016 memorandum on Aspire – National Audit Office

Dearney’s evidence to the Public Accounts Committee

1 Comment

Posted in Accenture, BT, Campaign4Change, Capgemini, change management, Cloud Computing, cost avoidance, DWP, efficiency savings, Freedom of Information, G-Cloud, Government IT, HMRC, HP, Institute for Government, IT successes, Legacy ICT, managing change, managing outsourced services, National Audit Office, project management, supplier relationships, Universal Credit

Tagged , , , , ,

Universal Credit: some highlights of today’s NAO report

Posted on 26/11/2014 | 2 comments

By Tony Collins

Excerpts from today’s National Audit Office report “Universal Credit: progress update” …

Not complete by 2020 

“Not all legacy benefit claimants will have moved to Universal Credit by the end of 2019.”

 Assumptions are changing massively

“Universal Credit impacts depend on policy assumptions. For example, there was a £30 billion movement between 2011 and 2012 in the Department’s estimate of benefit spending, which went from a £19.7 billion cost to a £10.8 billion saving. The Department changed its methodology over this time but the size of this movement was largely due to changes in benefit entitlement and conditionality.”

Spending on existing UC systems questionable?

“HM Treasury has expressed concerns about the value for money of further investment in live service systems.”

What if the digital system fails?

“ Following the Major Projects Authority’s review, HM Treasury requested, in April 2014, the Department provide it with contingency plans should the digital service be delayed or fail. The Department is due to update HM Treasury at the end of November 2014 on its progress in developing such plans.”

The small print

You can claim Universal Credit if you:

– fall into one of the accepted groups

– do not own or part own your home;

– have a bank or building society account;

– do not live in temporary accommodation;

– are not pregnant or given birth within the last 15 weeks;

– are not a carer;

– are not self-employed;

– are unemployed or have household earnings of less than £330 per month if over 25 or £270 if under 25;

– are not challenging or awaiting a decision on Jobseekers Allowance, Housing Benefit, Employment and Support Allowance, Income Support or tax credits;

– are not staying away from your main home;

– are not responsible for a child or young person who is: adopted, fostered, being looked after, registered blind or have a disability benefit.

UC security

“In June 2012, CESG [the IT security arm of GCHQ) found that security had not been properly considered from the start. The [UC] systems were developed by multiple suppliers without an overarching plan for how it would work as a whole.

“A Red Team review concluded that the programme lacked appropriate detail around the security measures it needed because of: ineffective links between design and security teams; invalid assumptions being made by technical teams about what was acceptable to the business; a lack of balance between usability and security; poor understanding of dependencies between components; and little consideration of the technical implications of business design activities. The Department was unable to address these concerns prior to the reset in February 2013.”

A good approach to agile

“Since the reset (in 2013), the Department has concentrated its use of agile on developing digital service using a co-located, mixed-skill team. In June 2014, consultants commissioned by the programme board reported that a good agile approach is in place, and that a strong agile culture and organisation has been found inside the digital service.

“The consultants also found that a focus on long-term planning and effective communication of progress is required to drive scale and delivery, and that adjustments to the team structure will be required to ensure scalability…

“To remain on track, the Department will have 18 months to increase functionality to create a fully integrated service eventually capable of handling up to 10 million claimants. It will use an agile approach to do this. The Department plans to trial new systems in spring 2015, when it intends to start testing efficiencies and delivery against policy intent. It then plans to test increased capacity from November 2015.”

Not so agile

“…The Department will continue to use traditional approaches for buying and maintaining systems supplied commercially, such as existing Department‑wide systems and cloud hosting…”

Inaccurate payments

In April 2014, a software update [from a major supplier] created new problems for [UC] calculations and inaccuracy increased again. Between April and June 2014, over 10% of payments made to claimants were incorrect. This damaged staff and stakeholder confidence in the system and the Department had to reintroduce 100% manual checking of payments in June 2014 …

“… At present the Department is undertaking 100% checking of all payments before they go out.”

Better leadership

Confidence in the leadership team has improved despite continuing difficulties and the heavy demands on the programme director through 2014 caused by the limited availability of the senior responsible owner. A follow-up survey found a large increase in the number of staff expressing confidence in the actions of senior leadership (from 30% in 2013 to 75% in 2014) and an increase in the number of staff who feel that senior management encourages challenge and welcomes their suggestions (from 30% in 2013 to 70% in 2014).

Do major suppliers have too much control of DWP IT?

“The Department’s management of suppliers has been tested by the problems that emerged following an IT update in April 2014 designed to enhance live service. A supplier made significant changes in addition to the work that had been commissioned by the Department. It did not fully inform the Department of this, therefore the update was not adequately tested before it went live.

“The release caused an increase in payment errors described in Part Three. The supplier agreed to rectify the coding at its own expense. This delayed the next release by 2 weeks because of constraints on departmental and supplier resources, and the need to implement further controls recommended in a review commissioned by the Department after the April release.

“In November 2014, the Department’s internal audit reported that the programme has built technical capability to challenge, monitor and review supplier performance, including challenge of the management information provided.”

Manual interventions

“As planned, many processes in live service and digital service areas currently remain dependent on manual interventions.”

Universal Credit: progress update

Universal Credit full business case “a long way from Treasury approval”

2 Comments

Posted in Accenture, Agile, BT, Cloud, Cloud Computing, DWP, G-Cloud, GDS, Government digital Service, Government IT, HP, IBM, Major Projects Authority, National Audit Office, Universal Credit

Universal Credit full business case “a long way from Treasury approval”

Posted on 26/11/2014 | 3 comments

By Tony Collins

Yesterday in Parliament Iain Duncan Smith gave a statement on Universal Credit – then MPs asked him questions.  Conservative MP Nigel Mills asked IDS a straightforward question:

“Can the secretary of state confirm that the Treasury has now signed off the whole business case and laid to rest that fear that they were not going to do that?”

IDS gave a clear reply: “That is exactly what was being asked before the summer break and the answer is they have …”

But the UC programme has not received Treasury approval for the full business case, nor even the outline business case. Today’s National Audit Office report “Universal Credit: progress update” says that the UC programme received approval in September 2014 for the “strategic outline business case” only.

An NAO official says this is a “long way from Treasury approval” of the full business case.

Until the full business case is approved, UC has no formal funding beyond the current spending review. Meanwhile the Treasury has been funding UC in “small increments” according to the NAO.

The Department of Work and Pensions is due to produce the outline business case next summer, before the next government’s spending review.

The “outline” business case is supposed to set out how the programme is affordable and will be successfully delivered. It summarises the results so far and sets out the case for proceeding to a formal procurement phase.

The “full” business case documents the contractual arrangements,
confirms funding and affordability and sets out the detailed management
arrangements and plans for successful delivery and post evaluation.

The absence of approval for the outline or full business case underlines the uncertainties still in the UC programme. Indeed the latest NAO report says it’s too early to tell whether UC will prove value for money.

But the DWP has reduced risks by extending the roll-out. The programme is now not expected to be completed before 2020. The original completion date was 2017.

The DWP has a twin-track approach to the UC IT programme. It is paying its existing main IT suppliers to support the introduction of UC – the so-called “live” service – while an agile team develops a fully-automated “digital” service that is designed to do all that the “live” service cannot do without manual intervention.

The agile system has yet to be tested – but it has cost only about £8m compared with more than £90m spent on the “live service”.

Porkies?

Labour MP Glenda Jackson, who is a member of the Work and Pensions committee, suggested to IDS yesterday that his promises to MPs on Universal Credit’s roll-out have all been broken and that he has told the House of Commons “porky pies”.

IDS replied that his intention is to ensure that UC is rolled out in a safe and secure way.

Comment:

You’d never know from IDS’s replies to MPs yesterday that the Universal Credit programme doesn’t yet have either outline business case approval or full business case approval.

In other words, the Treasury has yet to be convinced the UC programme is feasible or affordable. It is paying for the programme in increments.

IDS told MPs the programme has business case approval. He did not make it  clear that the programme has the early-stage strategic outline business case approval.

His comments reinforce the need for the National Audit Office to scrutinise the Universal Credit programme. Left to the Department for Work and Pensions, the facts about the programme’s progress, problems and challenges would probably not emerge, not in the House of Commons at least.

Some MPs have said for years that Parliament is the last place to look for the truth.

IDS also said yesterday that the original deadline for completion of UC by 2017 was “artificial” – though he has quoted the 2017 date to MPs on several occasions.

Will UC succeed?

UC as an IT-based programme is not doing too badly, to judge from today’s NAO report.

Indeed it seems that the Department for Work and Pensions, when under intense scrutiny, can start to get things right.

Though existing systems from major suppliers look increasingly unlikely to be able to handle the predicted volumes without a large and expensive amount of manual intervention, the agile digital system, though delayed by 6 months, looks promising, at a fraction of the cost of the conventional “live” system.

Scrutiny

The NAO is scrutinising the programme. The DWP’s own auditors seem to be doing a good job. The Cabinet Office’s Major Projects Authority is making useful recommendations. And the programme has an independently-chaired board. [The NAO says the programme board has been hampered by limited information and suggests this is because the DWP gives the board “good news” statements rather than facts.]

All this scrutiny is powering the programme in the right direction, though the uncertainties remain massive. As Campaign4Change predicted, the programme will not be complete before 2020. But who cares, if it works well in the end and losses are minimised?

DWP officials are learning lessons – and UC could end up as a template for big government IT-enabled programmes  The twin-track approach of using existing suppliers to deliver support for major business changes that yield problems and lessons  that then feed into an entirely new agile-based system is not a cheap way to develop government IT –  but it may work.

What DWP officials have yet to learn is how to be open and truthful to Parliament, the media – and even its own programme board.

Universal Credit: progress update

Some highlights of today’s NAO report

NAO warns over costs of further Universal Credit digital delay

Universal Credit: watchdog warns of costs of further delays

Government may have to write off more than £200m invested in IT on Universal Credit

3 Comments

Posted in Accenture, Agile, BT, Campaign4Change, Cloud, DWP, excessive secrecy, G-Cloud, Government digital Service, HMRC, HP, IBM, Legacy ICT, Major Projects Authority, National Audit Office, project management, public sector, public services, Real-Time Information, Universal Credit

Tagged , , , ,

Top 5 posts on this site in last 12 months

Posted on 02/01/2014 | 1 comment

Below are the top 5 most viewed posts of 2013.  Of other posts the most viewed includes “What exactly is HMRC paying Capgemini billions for?” and “Somerset County Council settles IBM dispute – who wins?“.

1) Big IT suppliers and their Whitehall “hostages”

Mark Thompson is a senior lecturer in information systems at Cambridge Judge Business School, ICT futures advisor to the Cabinet Office and strategy director at consultancy Methods.

Last month he said in a Guardian comment that central government departments are “increasingly being held hostage by a handful of huge, often overseas, suppliers of customised all-or-nothing IT systems”.

Some senior officials are happy to be held captive.

“Unfortunately, hostage and hostage taker have become closely aligned in Stockholm-syndrome fashion.

“Many people in the public sector now design, procure, manage and evaluate these IT systems and ignore the exploitative nature of the relationship,” said Thompson.

The Stockholm syndrome is a psychological phenomenon in which hostages bond with their captors, sometimes to the point of defending them.

This month the Foreign and Commonwealth Office issued  a pre-tender notice for Oracle ERP systems. Worth between £250m and £750m, the framework will be open to all central government departments, arms length bodies and agencies and will replace the current “Prism” contract with Capgemini.

It’s an old-style centralised framework that, says Chris Chant, former Executive Director at the Cabinet Office who was its head of G-Cloud, will have Oracle popping champagne corks.

2) Natwest/RBS – what went wrong?

Outsourcing to India and losing IBM mainframe skills in the process? The failure of CA-7 batch scheduling software which had a knock-on effect on multiple feeder systems?

As RBS continues to try and clear the backlog from last week’s crash during a software upgrade, many in the IT industry are asking how it could have happened.

3) Another Universal Credit leader stands down

Universal Credit’s Programme Director, Hilary Reynolds, has stood down after only four months in post. The Department for Work and Pensions says she has been replaced by the interim head of Universal Credit David Pitchford.

Last month the DWP said Pitchford was temporarily leading Universal Credit following the death of Philip Langsdale at Christmas. In November 2012 the DWP confirmed that the then Programme Director for UC, Malcolm Whitehouse, was stepping down – to be replaced by Hilary Reynolds. Steve Dover,  the DWP’s Corporate Director, Universal Credit Programme Business, has also been replaced.

4) The “best implementation of Cerner Millennium yet”?

Edward Donald, the chief executive of Reading-based Royal Berkshire NHS Foundation Trust, is reported in the trust’s latest published board papers as saying that a Cerner go-live has been relatively successful.

“The Chief Executive emphasised that, despite these challenges, the ‘go-live’ at the Trust had been more successful than in other Cerner Millennium sites.”

A similar, stronger message appeared was in a separate board paper which was released under FOI.  Royal Berkshire’s EPR [electronic patient record] Executive Governance Committee minutes said:

“… the Committee noted that the Trust’s launch had been considered to be the best implementation of Cerner Millennium yet and that despite staff misgivings, the project was progressing well. This positive message should also be disseminated…”

Royal Berkshire went live in June 2012 with an implementation of Cerner outside the NPfIT.  In mid-2009, the trust signed with University of Pittsburgh Medical Centre to deliver Millennium.

Not everything has gone well – which raises questions, if this was the best Cerner implementation yet,  of what others were like.

5) Universal Credit – the ace up Duncan Smith’s sleeve?

Some people, including those in the know, suspect  Universal Credit will be a failed IT-based project, among them Francis Maude. As Cabinet Office minister Maude is ultimately responsible for the Major Projects Authority which has the job, among other things, of averting major project failures.

But Iain Duncan Smith, the DWP secretary of state, has an ace up his sleeve: the initial go-live of Universal Credit is so limited in scope that claims could be managed by hand, at least in part.

The DWP’s FAQs suggest that Universal Credit will handle, in its first phase due to start in October 2013, only new claims  – and only those from the unemployed.  Under such a light load the system is unlikely to fail, as any particularly complicated claims could managed clerically.

 

1 Comment

Posted in Accenture, Agile, BT, Campaign4Change, Capgemini, Cerner, Cloud, Cloud Computing, CSC, DWP, excessive secrecy, FOI, Freedom of Information, G-Cloud, Government IT, health records, HP, IBM, IT projects, IT-related failures, legal disputes, local democracy, local government, LPfIT, Major Projects Authority, NHS, npfit, outsourcing, public-private partnerships, Real-Time Information, SAP, Universal Credit

Tagged , ,

Has 2 decades of outsourcing cut costs at HMRC?

Posted on 12/08/2013 | 2 comments

By Tony Collins

If HMRC’s experience is anything to go by, outsourcing can, in the long-term, at least triple an organisation’s IT costs.

When Inland Revenue contracted out its 2,000-strong IT department to EDS, now HP, in 1994 it was the first major outsourcing deal in central government.

Costing a projected £1.03bn over 10 years the outsourcing was a success, according to the National Audit Office in a report in March 2000. The deal  enabled Inland Revenue to bring about changes in tax policy to a tight timetable, said the NAO’s Inland Revenue/EDS Strategic Partnership – Award of New Work.

But costs soared for vague reasons. Something called “post-contract verification” added £203m to the £1.03bn projected cost over 10 years. A further increase of £533m was because of “workload increases including new work”. Another increase of £248m was put down to inflation.

By now the deal with HP had risen from £1.03bn to about £2bn.

When the contract expired in 2004, HM Revenue and Customs and HP successfully transferred the IT staff to Capgemini. The new 10-year contract from 2004 to 2014 (which was later extended 2017) had a winning bid price of £2.83bn over 10 years.

So by 2004 the costs of outsourcing had risen from £1.03bn to £2.83bn.

The new contract in 2004 was called ASPIRE – Acquiring Strategic Partners for Inland Revenue. HMRC then added £900m to the ASPIRE contract for Fujitsu’s running of Customs & Excise systems. By now there were about 3,800 staff working on the contract.

The NAO said in its report in July 2006  – ASPIRE, the re-competition of outsourced IT services – that Gateway reviews had identified the need for a range of improvements in the management of the contract and projects.

Now costing £7.7bn over 10 years

The latest outsourcing costs have been obtained by Computing. It found that annual fees paid to Capgemini under ASPIRE were:

  • 2008/09:  £777.1m
  • 2009/10:  £728.9m
  • 2010/11:  £757.8m
  • 2011/12:  £735.5m
  • 2012/13:  £773.5m

So IT outsourcing costs have soared again. The original 10-year costs of outsourcing in 1994 were put at £1.03bn. Then the figure became about £2bn, then £2.83bn, then £3.7bn when Fujitsu’s contract was added to ASPIRE. Now annual IT outsourcing costs are running at about £770m a year – £7.7bn over 10 years.

So the original IT running costs of Inland Revenue and Customs & Excise have, under outsourcing contracts, more than tripled in about two decades.

Comment:

What happened to the prevailing notion that IT costs fall over the long-term, and that outsourcing brings down costs even further?

Shouldn’t HMRC’s IT costs be falling anyway because of reduced reliance on costly Fujitsu VME mainframes, reductions in data centres, modernisation of PAYE, and the clearance of time-consuming unreconciled items on more than 10 million tax files?

HMRC knows how much profit Capgemini makes under “open book” accounting. It’s a margin of about 10-15% says the NAO. Lower margins are for value-added service lines and higher margins for riskier projects. If the overall target profit margin of 12.3% is exceeded, HMRC can obtain an equal share of the extra profits.

There were 10 failures costing £3.25m in the first 15 months. Capgemini refunded £2.67m in service credits in the first year of the contract.

It’s also worth mentioning that Capgemini doesn’t get all the ASPIRE fees. It is the lead supplier in which there are around 300 subcontractors – including Fujitsu and BT.  Capgemini pays 65% of its fees to its subcontractors.

The outsourcing has helped to enable HMRC to bring in self-assessment online and other changes in tax policy. But HMRC’s quality of service generally (and not exclusively IT) is mixed, to put it politely.

The adjudicator for HMRC who intervenes in particularly difficult complaints identifies as particular problems the giving out of inaccurate information and recording information incorrectly.

She says in her 2013 annual report:

“I am disappointed at the number of complaints HMRC customers feel they need to refer to me in order to get resolution. My role should be to consider the difficult exceptions, not handle routine matters that are well within the capability of departmental staff to resolve successfully. At a time of austerity it is also important to note that the cost of dealing with customer dissatisfaction increases exponentially with every additional level of handling.”

RTI

There are complaints among payroll companies and specialists that real-time information  is not working as well as HMRC has claimed. There seems to be growing irritation with, for example, HMRC’s saying that companies owe much more than they do actually owe. And HMRC has been sending out thousands of tax codes that are wrong or change frequently – or both.

HMRC says it has made improvements but the helpline is appalling. It’s not unusual for callers to wait 30 minutes or more for an answer – or to hang on through multifarious automated messages only to be cut off.

That said there are signs HMRC is, in general, improving slowly. Chief executive of HMRC since 2012 Lin Homer is more down-to-earth and slightly more willing to own up to HMRC’s mistakes than her predecessors, and the fact that RTI and the modernisation of PAYE has got as far as it has is creditable.

But is HMRC a shining example of outsourcing at its best, of outsourcing that cuts costs in the long term? No. A decade of HP and a decade of Capgemini has shown that with outsourcing HMRC can cope, just about, with major changes in tax policy to demanding timetables. But the costs of the outsourcing contracts in the two decades since 1994 have more than tripled.

What about G-Cloud? We look forward to a change in direction from the incoming head of IT Mark Dearnley (if he has much say).

**

A Deloitte survey “The trend of bringing IT back in-house” dated February 2013, said that 48% of respondents in its Global Outsourcing and Insourcing survey 2012 reported that they had terminated an outsourcing agreement early, or for cause, or convenience. Those that took IT services back in-house mentioned cost reduction as a factor. Deloitte said factors included:

– the need for additional internal quality control due to poor quality from the outsourcer

– an increase in the price of service delivery through scope creep and excessive change orders.

2 Comments

Posted in Accenture, BT, Campaign4Change, change management, CIO, Fujitsu, G-Cloud, Gateway reviews, Government IT, HMRC, IT projects, IT-related failures, managing outsourced services, operational issues, outsourcing, oversight, procurement, project management, public sector, public services, public-private partnerships, supplier relationships

Tagged

Whitehall to lose its best troubleshooter

Posted on 05/07/2013 | Leave a comment

By Tony Collins

David Pitchford, who is arguably the civil service’s most able troubleshooter, is to quit the civil service in September and return to his native Australia for undisclosed family reasons. The FT broke the story yesterday.

Pitchford is Executive Director at the understaffed Major Projects Authority. It aims to work in partnership with permanent secretaries and senior civil servants to improve the success rate of major departmental IT and other large projects. 

In practice some senior civil servants in central departments resent the intrusion of the Cabinet Office. They do not like having to present their big schemes to the Major Projects Authority, particularly as it has David Cameron’s mandate to stop or re-scope failing projects.

Fighting intransigence? 

One unanswered question about Pitchford’s quitting is: has his morale been beaten down by departmental intransigence and even ill-will? Has the system defeated Pitchford and the taxpayer – the same system that confronted other Cabinet Office reformers John Suffolk, Chris Chant and Andy Tait?

It is possible that Pitchford feels his work is done now that the Major Projects Authority has finally, and after some departmental resistance, produced its first annual report.

The report’s key feature is its “traffic light” status on the projects it is keeping an eye on. In a foreword to the report, Pitchford wrote:

“April 2013 marks two years of the Major Projects Authority… For the first time, the country’s biggest and most high-risk projects are scrutinised so problems are exposed before they spiral out of control. Over two-thirds of major projects are predicted to deliver their promises on time and on budget, more than double the historic success rate. However, the MPA has studied carefully what goes on in every department, and we have uncovered some weaknesses which we are continuing to address.

“The MPA was established following a landmark report by the National Audit Office in 2010, which recommended a wholesale shift in the administration of major projects. It works closely with individual departments’ project teams and Permanent Secretaries to monitor and improve the management of major projects…the MPA’s Government Major Projects Portfolio has improved the rate of successful project delivery from under 30% to over 70%.

“Our success has been achieved by focusing intensively on the three core elements of successful project management: improving leadership; improving the operating environment; and looking closely at the past lessons.”

Pitchford is a much-valued executive in part because he can see why projects are failing and is straight-talking. He joined the Cabinet Office in November 2009 and in 2010 told a conference what he had discovered so far about the reasons for the failure of UK government projects:

– Political pressure

– No business case

– No agreed budget

– 80% of projects launched before 1,2 & 3 have been resolved

– Sole solution approach (options not considered)

– Lack of Commercial capability – (contract / administration)

– No plan

– No timescale

– No defined benefits

Since then Pitchford has been a little more guarded now about what he says in public. Campaign4Change said in February 2013 that the longer he stays in the innately secretive civil service the more guarded he seems to become but he is still one the best assets the Cabinet Office has. His main advantage is his independence from government departments.

Francis Maude, Cabinet Office minister, said he would “much miss David’s sharp wit and impressive leadership”.

Is Pitchford’s departure a sign that the non-reformers in Whitehall departments are winning the battle against major change?

 

Leave a comment

Posted in Campaign4Change, capacity building, change management, cost reduction, G-Cloud, Government IT, IT projects, IT-related failures, Major Projects Authority, private sector lessons for the public sector, procurement, project management, public sector

Tagged , , ,

Francis Maude boasts of £10bn savings but …

Posted on 03/06/2013 | Leave a comment

By Tony Collins 

This morning Cabinet Office minister Francis Maude held a press conference with his senior officials to announce that civil servants have radically changed the way they work to save £10bn in 2012/13.

The savings are nearly £2bn higher than originally planned and, according to the Cabinet Office, have been “reviewed and verified” by independent auditors.

With a little journalistic licence Maude says: “…we are on the way to managing our finances like the best-run FTSE100 businesses.”

The breakdown of the £10bn savings:

Procurement   £3.8bn
Centralisation of procurement for common goods and services  £1.0bn
Centrally renegotiating large government contracts  £0.8bn
Limiting expenditure on marketing and advertising, consultants and temporary agency staff   £1.9bn
Transformation savings   £1.1bn
IT spend controls and moving government services and transactions onto digital platforms  £0.5bn
Optimising the government’s property portfolio  £0.6bn
Project savings   £1.7bn
Reviewing performance of major government projects  £1.2bn
Taking waste out of the construction process  £0.4bn
Workforce savings   £3.4bn
Reducing the size of the Civil Service   £2.2bn
Increasing contributions to public sector pensions   £1.1bn

Comment

It’s good news and the figures don’t seem plucked out of thin air which sometimes happens when central government announces savings.

The big question is whether the savings are sustainable. Maude has inspired the Cabinet Office’s Efficiency and Reform Group to be motivated and hard-working. But bringing about long-term change in Whitehall – as opposed to restricting consultancy contracts and cutting annual costs of supplier contracts by reducing what’s delivered – is like peddling uphill. How long can you do it without losing motivation and energy? It’s not just parts of the civil service that are resistant to the savings agenda – it is also some IT suppliers, according to Government Computing.

It’s likely that only profound changes in central government operations and working practices will outlast the next general election. At the moment the civil service is like a rubber band that has been stretched a little. It wants to return to its standard shape, which the next government may allow it to do.

The National Audit Office said in its report in April 2012 on the Efficiency and Reform Group in 2011/12:

“Savings to date have differing degrees of sustainability.”

The NAO also said this:

“It is not fully clear how ERG intends to make the reforms necessary to secure enough savings over the rest of the spending review. ERG has yet to translate its ambition for saving £20 billion by 2014-15 into more detailed plans.

“ERG has made progress in developing strategies across its wide range of responsibilities, and is focusing on core activities likely to produce savings. However, until recently ERG’s focus has mainly been on the savings themselves, with less emphasis on delivery of the longer-term changes and improvement in efficiency necessary to make them sustainable.”

And this:

“Departments have still tended to lack a clear strategic vision of what they are to do, what they are not, and the most cost-effective way of delivering it. Much of departments’ 2014-15 savings are likely to come from further reductions in staff. Sustainability of these savings will depend on developing skills and working in new ways while maintaining staff motivation and engagement.”

But the NAO was generally positive about the ERG’s contribution to savings.

“ERG’s actions to date, particularly its spending controls, have helped departments deliver substantial spending reductions.”

We hope the Cabinet Office’s diligent efforts continue  – sustainably.

Efficiency and Reform 2012/13 savings. Summary report.

Some suppliers still resistant to change? – Government Computing.

Leave a comment

Posted in Campaign4Change, capacity building, change, change management, Cloud, Cloud Computing, consultants, cost reduction, culture, G-Cloud, Government IT, Green IT, IT projects, Major Projects Authority, managing change, procurement, project management, public sector, public services, reducing cost strategically

Tagged , , , , ,

Francis Maude –“unacceptable” civil service practices

Posted on 21/03/2013 | Leave a comment

By Tony Collins

Francis Maude laments civil service inaction over a cabinet committee mandate for centralising procurement. It “corrodes trust in the system”.

Gus O’Donnell, the former head of the civil service,  confronted Francis Maude, the Cabinet Office minister in charge of civil service reform, on BBC R4’s In Defence of Bureaucracy last week.

The irreconcilable differences between O’Donnell and Maude were obvious and may be a sign of how difficult it will be for the minister to make lasting and deep cuts in IT-based spending, simplify overly complex processes, and reduce duplication.

O’Donnell spoke of the virtues of the civil service that have served the country for more than a century, particularly its impartiality.  But Maude said the “value of impartiality can sometimes turn into indifference”.

O’Donnell said: “We need to be proud and passionate about the public sector ethos…” and confronted Maude for saying things about the civil service “that are not always totally positive”.

Indeed Maude said,

“Most of the civil servants I deal with are terrific, work hard and do really good work.  It is not universal.”

O’Donnell then confronted Maude for saying that ministers in this and previous government have too often found that decisions they have made don’t get implemented. Is that the fault of ministers or civil servants, asked O’Donnell.

“I’d be astonished if it’s ministers,” said Maude who added,

“ I had a meeting the other day around this table …  where a decision was made by a cabinet committee, more than a year ago, on the centralising of procurement. It had happened to a very minimal extent.

“If there is a problem with it, that can be flagged up and tell us. Just to go away and not do it is unacceptable … it is protection of the system. This is the speaking truth unto power thing. What is unacceptable is not to challenge a ministerial position but then not to implement it. That is what corrodes trust in the system.”

About £230bn a year – nearly a third of everything government spends – is on public sector procurement.  In 2010, Nigel Smith, then CEO of the Office of Government Commerce, spoke to the “Smartgov” conference about the need for major reform in the way government buys things.

He spoke of the need for re-useable software, open source if possible, and said that suppliers regularly use fragmentation within government to maximise profits. “This has got to change,” says Smith.

He said there were 44,000 buying organisations in the public sector which buy “roughly the same things, or similar things, in basic commodity categories” such as IT and office supplies.

Massive duplication

He spoke of “massive duplication”, high tendering costs on suppliers, and a loss of value due to a lack of true aggregation. He said suppliers had little forward look of opportunities to tender and offer innovative solutions for required outcomes.

“Contract management with supplier relationship management is inconsistent, with too little attention paid to continuous improvement and benefits capture within contract.

“The opportunity to improve outcomes and efficiency gains should not be constrained by contract terms and innovations should not stop at the point of contract signature.

“If we miss this opportunity [to reform] we need shooting.”

So it is clear procurement [and much else] needs reforming. But in the R4 broadcast last week (which unfortunately is no longer available) O’Donnell portrays a civil service that is almost as good as it gets.

He speaks of its permanence in contrast to transient ministers. His broadcast attacks the US system of government in which public service leaders change every time there is a new government.  The suggestion is that the US system is like a ship that veers crazily from side to side, as one set of idealogues take the captain’s wheel from another. O’Donnell implies that in the UK civil service stability lasts for decades, even centuries.

The virtues he most admires in the UK civil service are what he calls the 4 “Ps” – Pace, Passion, Professionalism and Pride.  His broadcast speaks of the UK civil service as a responsible, effective, continual and reliable form of administration.  

Comment

O’Donnell’s most striking criticism of Maude’s intended reforms of central government goes to the heart of what Maude is trying to do: change what is happening in departments.

When, in the broadcast, Maude suggested that civil servants were not challenging ministerial decisions and were not implementing them either, O’Donnell replied that Maude was “overstating the issue”. But O’Donnell went much further and added a comment that implied Maude should leave departments alone.

O’Donnell said

“These sorts of problems mainly arise when ministers at the centre of government want to impose their will on secretaries of state who want to be left alone to run their departments as they see fit.”

Is O’Donnell giving permanent secretaries and departmental ministers his support if they continue to snub Cabinet Office reforms?

It is hardly surprising Maude is a bundle of frustrations. Central government administration cannot be reformed if departments have the autonomy to refuse to implement decisions of a cabinet committee.

It is ironic that cabinet committee decisions are binding on the entire Cabinet – but not, it seems, on departments.

Perhaps the gap between political and civil service leaders at the centre, and senior civil servants in departments, is as irreconcilable as ever. Today’s UK civil service is more than ever “Yes Minister” without the jokes.  Should this be the dysfunctional basis for coalition reforms of central government?

Perhaps this explains why Maude is trying to implement open standards, make government procurement friendly to SMEs and encourage the use of G-Cloud while the Department for Work and Pensions and the Foreign and Commonwealth Office are  agreeing new mega-contracts,  with the same handful of monolithic suppliers.

Sir Jeremy Heywood, the current Cabinet Secretary,  is perhaps a little more Maude-friendly than O’Donnell when he says in the R4 broadcast,

“There are lots of things we need to do better. Too many projects that we undertake are delayed, are over budget and don’t deliver on all the benefits that were promised. We are not as digital as the most effective private sector organisations are. We have been slow to embrace the digital revolution.”

Fine words. But if a cabinet committee’s decision on centralising procurement has little effect, how is Sir Jeremy going to convert his words into action? Or Francis Maude’s?

Leave a comment

Posted in Campaign4Change, Cloud, Cloud Computing, collaboration, compliance with spending review, cost reduction, EU procurement, G-Cloud, governance, government, Government digital Service, Government IT, IT-related failures, open source, open standards, Politics, procurement, project management, reducing cost strategically, SME, supplier relationships, US Government

Tagged , ,