Category Archives: oversight

Whitehall to relent on secrecy over mega projects – after 10-year campaign?

By Tony Collins

The Cabinet Office may be about to change its decade-old policy of not publishing reports on  the progress or otherwise of its large, costly and risky IT-based projects.

A change of policy from secrecy to openness would give MPs and the public warning of when a major project is in trouble and needs rescuing or cancelling.

Parliament last to know

For more than a decade campaigners have sought to persuade successive governments to publish “Gateway” reviews, which are short independent audits on the state of big projects.  The secrecy has meant that Parliament is usually the last to know when new national schemes go wrong. IT-related failures have hit many public services including those related to tax, benefits, immigration, passports, the fire service, prisons, schools examinations, student loans, the police and health services.

Now Sir Bob Kerslake, head of the civil service, has hinted to campaigning Conservative MP Richard Bacon that the Cabinet Office may change its policy and publish the “red, amber, green” status of large projects as they are routinely assessed.

Kerslake was replying to Bacon at a hearing of the Public Accounts Committee meeting on transparency. Bacon pointed out at the hearing that the Public Accounts Committee had, years ago, called for Gateway reviews to be published.

Not learning from mistakes

“Something I have always been puzzled by is why government does not learn from its mistakes particularly but not only in the area of IT where things go wrong again and again, again and again,” said Bacon. “I have come to the conclusion government does not learn from its mistakes because it does not have a learning curve. If you don’t have a learning curve you are not going to learn.”

He cited the example of how Ian Watmore, Permanent Secretary at the Cabinet Office, had, at Bacon’s request, arranged for an “Opening Gate” report on Universal Credit to be published in the House of Commons library.

But, said Bacon, when an IT journalist applied to the Department for Work and Pensions, under the FOI Act, for the release of all Gateway reports on Universal Credit, the DWP would not publish any of them  – and even refused an FOI request to release the report Watmore had arranged to be placed in the House of Commons library, which Bacon obtained.  “So there is still a culture of intuitive, instinctive secrecy,”  Bacon said. Kerslake replied:

“Yes, actually we are looking at this specific issue as part of the Civil Service Reform Plan….I cannot say exactly what will be in the plan because we have not finalised it yet, but it is due in June and my expectation is that I am very sympathetic to publication of the RAG [red, amber, green] ratings.”

Bacon pointed out that the Cabinet Office Structural Reform Plan Monthly Implementation Updates had said Gateway reviews would be published.  But the commitment was removed for no apparent reason. When the Cabinet Office was asked why,  it said the Structural Reform Plans were only ever “drafts”.

Bacon asked Kerslake if the Government now plans to publish the Gateway reports.  “The Cabinet Office Structural Reform Plan Monthly Implementation Updates originally said Gateway reviews would be published  and then it somehow got downgraded into a draft; and from what’s publicly available at the moment the position of the government is not to publish Gateway reviews.  You sound as if you’re saying that’s going to change. Is that right?” asked Bacon.

“Watch this space,” replied Kerslake. “I am sympathetic. I generally broadly welcome, in principle, the idea of publishing information but there are lots of risks …”

Peter Gershon introduced Gateway reviews when he was Chief Executive of the Office of Government Commerce, which is now part of the Cabinet Office’s Efficiency and Reform Group. The reviews are carried out at key decision times in a project and are sometimes repeated:

  • Gateway Review 0 – Strategic assessment
  • Gateway Review 1 – Business justification
  • Gateway Review 2 – Procurement strategy
  • Gateway Review 3 – Investment decision
  • Gateway Review 4 – Readiness for service
  • Gateway Review 5 – Benefits realisation

Are Gateway reviews a success?

Gateway reviews are now supplemented by regular assurance audits carried out for the Cabinet Office’s Major Projects Authority. None of the reports is published.

Gateway reviews have not stopped costly failures such as Firecontrol or the NPfIT.  One permanent secretary told an MP that the reviews in his department were considered unimportant by senior responsible owners, for whom the reports are written. This may be because SROs often have charge of many projects; and even their SRO responsibilities are often in addition to their main jobs.

But Gershon had high hopes of Gateway reviews when they were introduced in February 2001. This is evident from the number of times he referred to Gateway reviews at one hearing of the Public Accounts Committee in December 2001.

 “… as the Gateway review process cuts in, which I have referred to on a number of occasions when I have appeared at this Committee …”

“… Through things like the Gateway process we are helping to sharpen the focus on the whole life aspects of these and other forms of complex projects in public sector procurement…”

“ …First, we have the introduction of the Gateway review process…”

“ … The Gateway process is a demonstrable example of how we have introduced a technique to support that whole life approach…”

“… If you look at the guidelines around the Gateway review process that is one of the things that is tested by these independent reviews …”

“… we recognised that that was a problem some time ago, which is why in the Gateway review one of the things that is explicitly tested is things like the skills and capabilities of the team at the design and build stage and that the skills and capabilities of the team at the procurement stage …”

“… in this area with the Gateway review process, from when we first launched it last February, we have been helping the department take a whole life approach to these forms of complex projects …”

“… Part of the Gateway Review process is to get a much sharper insight on to where we see good things happening where we can encourage other clients to replicate them…”

“… Now, with the Gateway Review process, my experience has been because of where we have deliberately focused the attention on the early life of projects where there is the greater scope for management to take corrective action, the accounting officers are paying a lot of attention to the recommendations that are emerging because, much to my surprise, most of them do not seem to like coming here defending what has gone wrong in the past. They seem to welcome the recommendations that we are providing to them to help try to get projects on to much stronger foundations in the future…”

“… With the Gateway Review, my experience has been that the Accounting Officers respond to the recommendations very positively…”

“…Gateway Reviews explicitly test how the department is planning in the pre-contract phase to secure ongoing value for money in the post-contract phase…”

“… Take, firstly, the Gateway Review process. That is testing various points in the life cycle of the project, from the very earliest stage…”

“… I would certainly expect in Gateway Reviews that the review team would be testing what methods were in place to facilitate the ongoing management of the contract…”

“… I think it is encouraging that Sir Ian Byatt thought the Gateway Review process had sufficient value to recommend it in his own review…”

And so forth.

Comment:

We applaud Richard Bacon MP for his persistent call for Gateway reports to be published.

Gateway reviews have defeated expectations that they would stop failures; and the National Audit Office tells us that central departments don’t even request Gateway reviews on some big and risky projects although they are supposed to be mandatory.

But Gateway and other project assurance reports could prove invaluable if they are published. In the public domain the reports would enable Parliament and Francis Maude’s “armchair auditors” to hold officials and SROs to account for projects that are in danger of failing. That would be an incentive for officialdom to fail early and fail cheaply; and Gateway reviewers may take greater care to be neutral in their findings – not too lenient, or too harsh – on the basis that the reports would be open to public scrutiny. SROs would also have to take the review reports seriously – not just put them in a draw because nobody knows about them anyway.

We welcome Kerslake’s comments but hope that he and his colleagues plan to publish more than the RAG (Red/Amber/Green) status of projects. Otherwise they will be missing an opportunity.  Gateway reports and other assurance reviews are expensive. Reviewers can earn up to £1,000 a day. This money  could be well spent if the reviews are to be published; but it will add to public waste if the reports are kept secret and continue to be deemed pointless or unimportant by departments.

It is ironic, incidentally, that the Ministry of Justice, which introduced the FOI Act, gives advice to departments to keep the RAG status of Gateway reviews confidential. In its advice on Gateway reviews and the FOI, the MoJ tells departments that the “working assumption” is that the substance of the Gateway reports should be kept confidential until at least two years have elapsed.

It’s time for a culture change. Maybe the Civil Service Reform Plan next month will be worth reading.

Cerner project over budget by 100 times amount of local heart monitor donations

By Tony Collins

When the Lord Mayor of Bristol presented a cheque for £20,000 to buy 10 cardiac monitors for local hospitals he could not have known that NHS officials were quietly spending more than 100 times that amount on an over-budget Cerner project.

A charity, the Frenchay Cardiac Support Group, raised the £20,000 through a shop and fund-raising events. It was 100th the amount  of the overspent element on a project to install an NPfIT Cerner patient administration system at the North Bristol NHS Trust.

Officials at NHS Connecting for Health and the Trust may consider it unfair of Campaign4Change to compare a charity donation with the unplanned extra costs of an IT-enabled change programme. But whereas North Bristol is accountable to local patients and fund-raisers for the £20,000 donation, it has no duty to explain to its patients (or anyone) how or why it has spent £5m on a Cerner project that was expected to cost the Trust about £3m.

The figures are buried deep in the Trust’s latest board papers. There has been no discussion of the overspend during the public part of the Board’s March meeting. Nor was it mentioned on the Board’s agenda for the meeting.

What the Trust says

The Trust declined our invitation to explain the overspend saying that it has commissioned a review of the Cerner project by PWC. Its statement to us said:

“North Bristol NHS Trust has commissioned an independent review into the issues surrounding the implementation of its new electronic patient record system. This will be carried out by PricewaterhouseCoopers LLP.  The outcome of the review will be published in due course.  We do not feel it is appropriate to comment further until the conclusion of the review, which is expected to take several weeks.”

The Trust’s papers say that the majority of capital spending in January and February was on the Cerner project. The anticipated spending on the project will be more than £5m which would see the Trust considerably overspent because of the difficulties encountered, say the papers.

The same Board papers put the Trust’s IM&T overspending at about £2.3m. This is on top of the hundreds of millions of pounds that NHS Connecting for Health is paying BT to install Cerner at sites in the south of England, including north Bristol.

Comment:

NHS Trusts across London and the south of England are expected to install new Cerner systems in the coming years. London is in the midst of a major procurement, as is the south. If the disruption is as serious as in some earlier implementations thousands of patients will be affected. So what?

At North Bristol the NPfIT implementation of Cerner has gone seriously awry. Besides the duplication of medical records, disruption to appointments, and, for the first time, the missing of a two-week wait target for cancer patients, there have been at least 16 clinical incidents; and the Trust’s papers say there has been a “significant increase in DNA [Did Not Attend an appointment] rates since the implementation of Cerner”.

Time heals?

Does it matter? It will all settle down in time say NHS officials.

Indeed some in the NHS and the scientific community in general have a view that taking known risks are part and parcel of achieving Progress. If lives are lost pushing back frontiers of knowledge it is for the greater good. Hence the justification for risks taken in launches of the Space Shuttle and building new designs of bridges, tunnels and aircraft.

The greater good

It’s a philosophy not lost on officials at NHS Connecting for Health. Go-lives of electronic patient record systems will be disruptive and may even affect the care and treatment of patients. But it’s for the greater good and the damage won’t last too long. Besides, if the health of any individual patients is affected, this will be supposition: no official evidence will exist.

So should patients fear the implementation of new hospital-wide systems? It’s a little like the early flights of commercial aircraft. Most flights will go without incident but now and again a passenger jet will crash.

One difference between aircraft crashes and hospital IT implementations is that crashes are usually investigated by law, and lessons applied by regulatory authorities to make flying safer. The NHS has no duty to investigate or apply lessons from its IT-related mistakes. Which is one reason that the lessons from the Cerner implementation at Nuffield Orthopedic Centre in Oxford in 2005 have still not been learned. For example there were important differences in the way the Nuffield’s staff and doctors worked, and the way the system was designed to work.

Who would want to fly in an aircraft that hasn’t been certified as safe? So should patients experience an NHS that has uncertified patient record systems?

In aircraft crashes deaths are obvious. There is often a clear cause and effect. In the NHS there is no certification of IT systems. A hospital can go live with whatever systems it wants, whatever the effect on patients. Indeed the reporting of any damage to patients is down to the Trusts. That’s a clear conflict of interest – like relying on the builders of a supertanker to report the effects on wildlife and fish of an oil spillage.

It’s time for a change.

It’s time for the NHS – and the Department of Health and particularly NHS Connecting for Health – to get professional about hospital-wide IT implementations.

It’s time for regulation and certification, minimum standards of safety and independent reporting of disasters.

Links:

Does Hospital IT need airline-style certification?

Halt NPfIT Cerner projects says MP

NPfIT Cerner installation at Bristol as “more problems than anticipated”

Why is North Bristol Cerner project so expensive?

An ongoing IT crisis case study – North Bristol NHS Trust

Lessons from Cerner go-live at Nuffield in 2005.

Universal Credit: who’ll be responsible if it goes wrong?

By Tony Collins

When asked whether Universal Credit will work, be on budget and on time, Ian Watmore, Permanent Secretary, Cabinet Office, gave a deft reply. He told Conservative MP Charlie Elphicke on 13 March 2012:

“From where I sit today, I think all the signs are very positive. I am never going to predict that something is going to be on time and on budget until it is.”

If the plans do not fall into place who, if anyone, will be responsible? In theory it’ll be Iain Duncan Smith, the Secretary of State for Work and Pensions. But as Watmore told the Public Administration Committee, there are several other organisations involved. Although the DWP and HMRC are building the IT systems, the success of Universal Credit also relies on local authorities, which are overseen by the Department for Communities and Local Government.

There are also the Cabinet Office and the Treasury whose officials seek to “ensure that what is going on is appropriate” said Watmore.

If Univeral Credit goes awry all the departments may be able to blame the private sector: the employers that must pass PAYE information to HMRC so that the Revenue’s Real-Time Information element of Universal Credit can work.

David Gauke is the minister responsible for HMRC so would he take some of the blame if Real-Time Information didn’t work, or was not on budget, or was delayed?

Or would the main IT suppliers Accenture and IBM take any of the blame? Highly unlikely, whatever the circumstances.

There is also a dependency on the banks.

But nothing is wrong … is it?

All those putatively responsible for Universal Credit continue to say that all is going well.

Duncan Smith told the House of Commons on 5 March 2012:

“We are making good progress towards the delivery of universal credit in 2013, and I have fortnightly progress meetings with officials and weekly reports from my office. I also chair the universal credit senior sponsorship group, which brings together all Government Departments and agencies that are relevant to the delivery of universal credit.

“Design work is well under way and is being continually tested with staff and claimants, and the development of the necessary IT systems will continue in parallel.”

He said that universal credit will reduce complexity by putting together all the benefits that are relevant to people going back to work – though benefit systems that are not relevant to the coalition’s “Work programme” will not be included in the DWP’s Universal Credit IT consolidation.

To reduce risks Universal Credit will be phased in over four years from October 2013, each stage bringing in a different group of claimants.

But …

Campaign4Change has asked the DWP to publish its various reports on the progress of Universal Credit and it has refused, even under the Freedom of Information Act. It seems the DWP’s secretiveness is partly because all of the risks related to Universal Credit have not been mitigated. We will report more on this in the next few days.

Meanwhile to try and answer the question in our headline: who’ll be responsible if Universal Credit goes wrong? The answer is: the private sector probably. Or rather nobody in the public sector.

Can hundreds of millions be spent on Universal Credit in an agile way?

Universal Credit suppliers Accenture and IBM look to India for skills.

Is Universal Credit a brilliant idea that’s bound to fail?

Universal Credit latest

Universal Credit and the banks.

US Government opens its books on IT projects

By David Bicknell

The Office of Management and Budget in the US has gone some way to opening up the books on IT investments to public scrutiny with the updating of the Agency’s IT Dashboard.

The move,  announced by Federal Chief Information Officer Steven VanRoekel, makes publicly available detailed IT investment information in support of the President Obama’s FY 2013 Budget.

The Obama Administration launched the IT Dashboard in 2009 to create  more transparent and open government.

As VanRoekel says in his blog,  “By publicly posting data on more than 700 IT investments across the Federal government, we armed agencies with the tools needed to reduce duplication in IT spending, strengthen the accountability of agency CIOs, and provide more accurate and detailed information on projects and activities. We also gave Americans an unprecedented window into how their tax dollars were being spent.”

VanRoekel says the latest dashboard will provide greater transparency of IT investment performance and empower CIOs to intervene in troubled projects sooner. Changes include:

Making the Dashboard more accessible: the Dashboard will now provide access to individual projects and activities associated with an investment, link investments to funding sources, and include visualisations to track investment performance from year-to-year.

Identifying duplication: New data on what kind of services each investment provides will help US agencies identify and address duplication in their IT portfolios.

Improving data quality: Improved validations and warnings will prevent erroneous data from coming into the system,  while new data quality reports will help agencies identify improvements they can make to their existing data

More data and tools: More datasets are now being made available, as well as additional tools to enable the public to participate by downloading and building their own applications.

According to VanRoekel, the  transparency enhancements will improve the way US taxpayers’ dollars are spent. He argues that by using the IT Dashboard and Techstat accountability developments to focus on the most challenged critical projects, agencies and the Office of Management and Budget have driven reforms that have saved taxpayers upwards of $4 billion since the initial launch.

Auditor criticises agency over IT contracts and oversight for California high speed rail project

By David Bicknell

Let’s hope that when the HS2 high speed rail link gets underway – assuming it gets the final go-ahead in 2014 – it doesn’t have the same problems over IT contracts and oversight that have recently come to light over a high speed rail project in California.

A new report by the California State Auditor on a planned high speed system between San Francisco and Los Angeles found that the $98.5bn project has suffered from a number of critical, ongoing oversight problems.

In particular, the auditor found that the High Speed Rail Authority responsible for the project has struggled to provide an appropriate level of contract oversight, because it is significantly understaffed.

As Palo Alto Online reports, “The audit paints a picture of a severely understaffed state agency that is struggling to keep track of its contractors, who outnumber the rail authority’s staff by a factor of about 25 to 1. As of last August, the authority had only 21.5 filled positions and more than 500 contractors.”

The State Auditor also found that the Authority poorly managed its IT contracts and engaged in ‘inappropriate contracting practices involving IT services.’

In addition to the initial contract, the audit report says, the Authority used 13 individual contracts for IT services over a 15-month period that ranged from $105,655 to $249,999.99 for similar services with one vendor.

Instead of multiple contracts generally having aggregate values of just under $250,000 with one vendor for similar services, the Auditor said, the Authority should have combined the services into one contract and solicited competitive bids or obtained approval to noncompetitively bid the contract.