Universal Credit: more IT uncertainties

By Tony Collins

Shortly after IDS was in the House of Commons yesterday defending his handling of the Universal Credit project – taking an all is well approach – the National Audit Office issued a report that drew attention to the scheme’s uncertainties, write-offs on IT so far of £41.3m, and the five-year depreciation of a further £91m spend on IT that may not be used after the migration from legacy, or transitional, UC systems to in a new “digital” solution.

The legacy Universal Credit  IT infrastructure is a blend of existing DWP IT and technology adapted to UC.

The DWP had originally expected to depreciate the £91m over 15 years but, suggests the NAO, the legacy Universal Credit IT infrastructure may be of little use after 2017/2018.   

Says the NAO:

“…  the underlying issue [is] that the Department has spent £91.0 million on assets that will only support a limited service for 5 years, with clear consequences for public value.”

On what the NAO report calls the “longer-term programme uncertainties” it says that the “overall cost of developing assets to support Universal Credit is subject to considerable uncertainty”.

It adds:

“The Department acknowledges  … that there is uncertainty over the useful economic life of the existing Universal Credit software pending the development of the alternative digital solution and uncertainty over whether Universal Credit claimants will be able to migrate from the current IT infrastructure to the new digital solution by December 2017.”

The NAO’s report on the DWP’s 2012/2013 accounts also notes the uncertainties with the new digital solution. Says the NAO:

“At this early stage in its development, there are uncertainties over the exact nature of the digital solution, and in particular:

– How it will work;

– When it will be ready;

– How much it will cost; and

– Who will do the work to develop and build it.

A Ministerial Oversight Group has approved a spend of between £25m and £32m on the new digital UC solution up to November 2014. DWP officials and suppliers plan to build a core digital service that will deliver to 100 people by then, after which it will assess the results of that work and consider whether to extend the service to increasing numbers.

The NAO suggests that some of the money spent on the new digital solution may also end up being written off.  Says its report:

“As the Department develops the digital solution, so it will start to recognise some of the costs incurred as assets. Without clear and effective management, in the future the Department may also find it needs to impair some of these new digital assets.”

At a hearing of the Work and Pensions Committee on Monday Iain Duncan Smith depicted the write-off of £40m on UC software code so far as normal for any large organisation in the private or public sector that embarks on a major software-based programme.  IDS said that private sector organisations typically write off a third of the money spent on software on a large project. About £120m has been spent on writing UC software code so far.

Amyas Morse, head of the NAO,refers in his report to the “considerable sums that the Department is proposing to invest in a programme where there are significant levels of technical, cost and timetable uncertainty”.

He adds:

“I reiterate both the conclusion and recommendations from my report in September. The Department has to date not achieved value for the money it has incurred in the development of Universal Credit, and to do so in future it will need to learn the lessons of past failures …”

In a short debate on UC in the House of Commons yesterday Rachel Reeves, Shadow Work and Pensions secretary, suggested Iain Duncan Smith was in denial about being in denial.  She put points to him he did not answer directly.

She said that IDS had told the House of Commons on 5 September 2013 that UC will be delivered in time and on budget. On 14 October IDS made the same claim. Reeves said:

“How on earth can this be on time when in November 2011 he [IDS] said:  ‘All new applications for existing benefits and credits will be entirely phased out by April 2014.’

“We have now learned that this milestone will only be reached in 2016. Will the secretary of state confirm that this is a delay of 2 years? … How can the secretary of state say that Universal Credit will be on budget when even by his own admission £40.1m is being written off on IT [software code]? What budget heading was that under?”

Reeves said IDS also revealed on Monday that another £90m will be written off by 2018. She added:

“ …The underlying problem is surely that the secretary of state has not resolved key policy decisions before spending hundreds of millions of pounds on an IT system… the secretary of state is in denial. Doubtless he’ll deny he is in denial….

IDS replied:

“ I said all along and I repeat: this programme essentially [jeers] is going to be on time. By 2017 some 6.5m people will be on the programme receiving benefits.”

He added that UC will roll out without damaging a single person. “The waste we inherited was the waste of people who didn’t listen, rushed programmes and implementing them badly.”

Dame Anne Begg, chair of the Work and Pensions Committee, said that IDS promised UC would be digital by default. “It isn’t,” she said.

“He promised that all new claims would be on UC by May 2014. They won’t…  So why should anyone believe him when he says that delivery of UC is now on track?”

IDS replied: “The proof of this will be as we roll it out…”

Comment

IDS is doing what he has to do: defend the UC project at all costs; and the NAO is doing what it needs to do: highlight the uncertainties and wasted spending.  If IDS admits to his doubts and concerns the opposition will jump on him. At least he is not being kept in the dark any longer by his senior civil servants.  He has his own reliable information – via Howard Shiplee – and from the NAO.  In 2011 he commissioned his own independent “red team” review which led to the pilot Pathfinder projects.

But the uncertainties highlighted by the NAO’s report today could be said to tacitly confirm that the transfer of all relevant claimants to UC project is unlikely to be complete before 2019/2020 at the earliest.  That’s probably not something anyone in government could own up to before the 2015 general election.

And even his advisers may not tell IDS that big government IT projects can be defined by the exceptions. IDS told MPs yesterday that Pathfinder projects indicated that 90% of people are claiming universal credit online and 78% are confident about their ability to budget with monthly payments. That’s 10% who don’t claim online and 22% who may not be able to manage with monthly payments. Will the high number of exceptions prove a show-stopper?

There’s a long way to go before officials and ministers can have confidence in UC IT. But, unlike the NPfIT which had little support in the NHS, most of those involved in the UC project want it work. That could make all the difference. 

Universal Credit to be partly online

By Tony Collins

At yesterday’s Work and Pensions Committee hearing Howard Shiplee, Director General for Universal Credit, confirmed what many have been saying:  that UC will not be an entirely online process.

He said claimants will have to prove who they say they are. He didn’t say how but one suggestion is that claimants may have to produce documents at an interview, and may have to prove changes in circumstances.

This would make online security for UC – which has been a major sticking point –  easier to design.  

Shiplee told MPs yesterday:

“From a security point of view to have everything digital is not at this stage a sensible or appropriate solution.

“It will take some considerable time to get to a totally online system. In fact nobody is operating the types of system we are talking about which are disbursing large sums of money. Nobody is using a totally online approach. You have to prove who you are. You have to prove what you are doing when you change circumstance. If you want to open a bank account you have to go and present yourself.

“I have talked to a lot of financial institutions about this and that is exactly where they are coming from as well.”

Dame Anne Begg, chair of the committee, asked when it was decided that the original approach of “digital by default” was wrong – a “false promise that was never going to be delivered”.

Shiplee replied:

“It is very difficult to talk about promises. There is nothing wrong with having aspirations. If people don’t have aspirations to achieve things there will be no progress. Perhaps that was an aspiration a little too far at a stage in time.”

Another MP, Stephen Lloyd, Liberal Democrat, asked Shiplee about alleged interference of Universal Credit by the Cabinet Office (which is anxious to ensure that UC is not another government IT-related disaster). Lloyd asked if there is any truth in the suggestion that if the Cabinet Office doesn’t stop interfering Shiplee will quit.

Shiplee did not confirm or deny. He said:

“I cannot comment on tittle tattle that I haven’t heard. What I can comment on is that occasionally one has disagreements with people and one has to get on with things. I am charged with having a sense of urgency about these things. I make no excuse for that. There are no other issues that are holding me up…”

Asked by Lloyd on a scale of 1-10 how confident he is that UC will be delivered, and delivered in scale, with the huge volumes intended Shiplee replied:

“I have never been keen on one to tens so I will just give it to you straight. I believe UC can be delivered in the way that has been suggested.

“What we are talking about is automating a system in terms of technology but what in many ways is much more important is the culture change, the change in the way our business operates. All of these that tend to get completely ignored in these sorts of discussions.

“The technology is an enabler but many of the challenges we have not fully faced yet we will face as the business is reconfigured, as tens of thousands of our staff are retrained …there are a whole series of challenges. But can it be delivered? The answer is that there is no doubt in my mind.”

Will it be delivered?

“I believe it will be. It has to be delivered.”

Universal Credit project to abandon digital by default – Brian Wernham’s blog

Will Universal Credit be complete by 2020?

By Tony Collins

Comment

Much of what Iain Duncan Smith said at the Work and Pensions Committee yesterday made sense. In essence the DWP’s plan is to delay putting most of the  claimants onto the Universal Credit system until the technology is proven to work.

But there is little evidence it will work at scale, handling reliably and accurately millions of claimants and complex cases. It emerged yesterday that the DWP has still not yet agreed with suppliers a specification for the UC systems, and the latest business case has yet to be approved. How can anyone say on the basis of the limited work so far that the technology will work?

And Howard Shiplee,  Director General of Universal Credit, made the point yesterday that the technology is only part of the story. For UC to work there have to be changes in culture, operational procedures within the DWP and the retraining of tens of thousands of staff.

IDS is doing what various sets of ministers and officials did during the distended failure of the NHS’s £11bn computer programme, the National Programme for IT [NPfIT]: in assuring Parliament all was well they always used the future tense. The programme “will” give everyone in England an electronic patient record. But nothing was delivered that provided evidence the promises would be fulfilled. It took a new government to admit the NPfIT was a failure.

UC differs from the NPfIT in a crucial way. The NPfIT did not need to work. It was conceived at the top without support from the NHS. Many hospitals didn’t want centrally-bought IT foisted on them. The NPfIT was wanted, in the main, by a small number of politicians, officials and big suppliers. UC is needed and wanted. Simplifying the horrifying complex benefit systems has all-party support. Shiplee is right when he says UC has to work. But he didn’t yesterday commit himself to a timeframe.

The last major benefits computerisation project – called “Operational Strategy” – took about 10 years to finish. It did not achieve the promised financial benefits and benefit systems were not combined as originally intended but, in the end, the technology worked well for its time.

If UC does work there’s every reason to believe it will be in a similar timeframe to Operational Strategy: about 10 years. But could IDS keep his job while saying UC will be fully delivered in 2020 or beyond? I doubt it.

MP calls for candour after Cerner NPfIT go-live at Croydon

By Tony Collins

Richard Bacon, a long-standing member of the House of Commons’ Public Accounts Committee, has called on Croydon Health Services NHS Trust to be more open about problems it faces after deploying a Cerner Millennium patient records system at the end of September.

The installation was carried out by BT under the London Programme for IT – a branch of the NPfIT.  The Health and Social Care Information Centre, which has taken on BT and CSC contracts under the NPfIT, was the trust’s partner for the Cerner deployment.

Bacon has closely followed the NPfIT and written a chapter on it in his book, “Conundrum: Why every government gets things wrong and what we can do about it” which he co-wrote with Christopher Hope, the Telegraph’s senior political correspondent.

According to fragments of information in Croydon Health Services’ latest board papers, dated 25 November 2013, the trust has faced a series of problems after the NPfIT Cerner go-live.

They included:

–  N3 Network downtime and waiting time breaches.

 Excessive waits for patients in A&E

 Going over budget.

– Significant loss of income.

 A bid to recover Cerner costs.

– A need for HSCIC support for delays. 

-A need for extra investment in Cerner to “stabilise the operational position”

The trust has not published any specific report on the implementation’s problemsNow Bacon says it is “unacceptable for any trust not to disclose the problems it faces – and possibly patients face – after a major IT implementation such as Cerner”.

He adds:

“If these implementations go wrong they can affect the safety of patients.  We know this from some NPfIT deployments at other  trusts. For Croydon to say that board members have been kept informed of the potential risks of the Cerner implementation through the “Corporate Risk and Board Assurance Framework”  is not reassuring.

“This is putting a matter of importance in the small print. Indeed, for officials to brief board members on the potential risks, rather than actual events, is also of concern.

“Patients need to know that Croydon takes a duty of candour seriously. If the Trust cannot be open about its IT-related problems, how can we be sure it will be open about anything else to do with patient safety?”

Patient records go-live “success” – or a new NPfIT failure 

DWP’s Universal Credit PR line – all is now well

By Tony Collins

The Department for Work and Pensions has submitted a statement to the Work and Pensions Committee, ahead of its hearing this afternoon on Universal Credit, that indicates all is now well with the scheme.

At the hearing today MPs will put questions to Work and Pensions secretary Iain Duncan Smith, Lord Freud, Minister for Welfare Reform, Howard Shiplee, Universal Credit Director General, and Mike Driver, Finance Director General.

MPs on the committee tend to ask gentle questions of Duncan Smith who is expected to say little or nothing negative about the current state of the scheme. His department’s statement to the committee says that the National Audit Office and the Public Accounts produced reports on Universal Credit that were“entirely historical”. 

Under the  new leadership of Shiplee, the Department had “already taken comprehensive action to address issues subsequently cited in both the NAO and PAC reports, including strengthening governance, improving supplier management and tightening financial controls”.

About 6,000 “new” computers in Jobcentres are being installed so that claimants can look and apply for jobs online, as well as make online claims.

“From October we started implementing Digital Jobcentres, beginning in Hammersmith. The Department will continue to roll this out across the whole Jobcentre Plus network, with all sites converted by October 2014.”

The DWP says that in the trials so far 90% of claims were being made online, “with the majority of these completing their application at the first attempt”.

The DWP will “further develop the work started by the Government
Digital Services to test and implement an enhanced online digital service”.

It adds: “The current planning assumption is that the Universal Credit service will be fully available in each part of Great Britain during 2016, having closed down new claims to the legacy benefits it replaced; with the majority of the remaining legacy caseload moving to Universal Credit during 2016 and 2017.

“Final decisions on these elements of the programme will be informed by the
development of the enhanced digital solution.”

Comment:

The DWP and particularly IDS appear locked into the “good news” culture that the health secretary Jeremy Hunt warned about  in the light of the Francis report’s criticism of a “lack of candour” in the NHS.

Before most of the big IT-related disasters in central government, the NPfIT for instance, sets of ministers and senior civil servants praised progress of the projects and dismissed Parliamentary reports as historical.

It’s to IDS’s credit that he has conceded that the 2017 deadline for all claimants to be on Universal Credit will not be met. He didn’t have to admit this. By 2017 IDS may have retired from politics for all we know. But still his optimism may be grossly misplaced.

The signs are that all claimants will not on UC before 2019 at the earliest – and that is subject to the resolution of numerous IT and business practice issues. The NAO report “Universal Credit: early progress” hinted at some of them.

Indeed the NAO revealed that:

“The Department does not yet know to what extent its new IT systems will
support national roll-out.” The signs are the DWP still doesn’t know – and may not know for several years.

The last big benefits computerisation project – Operational Strategy – took about 10 years to complete. It did not achieve the promised financial benefits and benefit systems were not integrated as originally intended but the technology worked well in the end.

There is every reason to believe that the UC  project will have a similar roll-out timeframe. But will IDS ever discuss all the current uncertainties and shortcomings with UC technology?

Patient records go-live “success” – or a new NPfIT failure?

By Tony Collins

John Goulston says the go-live of a new patient records system at his trust is a “success”.

He should know. He’s Chief Executive of Croydon Health Services NHS Trust. He’s also chair of the trust’s Informatics Programme Board which has taken charge of bringing Cerner Millennium to Croydon’s community health services and the local University Hospital, formerly the Mayday.

He was formerly Programme Director of the London Programme for IT at NHS London – a branch of the NPfIT.

In a report two weeks ago Goulston said the trust deployed the “largest number of clinical applications in a single implementation in the NHS”. Croydon went live with Cerner Millennium on 30 September and 1 October 2013.

Said Goulston in his report:

“Administrative functions do not engage clinicians; providing them with a suite of clinical functionality has been justified as each weekday approx. 1,000 staff are logged on and using the system. CHS [Croydon Health Services] has in Phase 1 deployed, in addition to patient administration, the largest number of clinical applications in a single implementation in the NHS England.”

BT helped install Millennium at Croydon under the National Programme for IT.  The trust’s spokesman says the Department of Health provided central funding, and the trust paid for implementation “overheads”.  The Health and Social Care Information Centre was the trust’s partner for the go-live.

The Centre is the successor for Connecting for Health. It has taken on CfH’s officials who continue to help run the NPfIT contracts with BT and  CSC.

Goulston said that Cerner and BT have paid tribute to the trust which installed Millennium in A&E, outpatients, secretarial support and cancer services, and elsewhere.

“Our partners Cerner, BT and Ideal have commented that the Trust has undertaken one of the most efficient roll-outs of the system they have worked on, with more users adopting the system more quickly and efficiently than other trusts … the success we have achieved to date is the result of the efforts of every single system user and all staff members,” said Goulston.

Best Cerner implementation yet?

Optimistic remarks about their launch of Cerner Millennium were also made in 2012 by executives at the Royal Berkshire NHS Foundation Trust.  Their optimism proved ill-judged.

Of the Millennium go-live at Royal Berkshire, trust executives said that it “had been considered to be the best implementation of Cerner Millennium yet and that despite staff misgivings, the project was progressing well”.   This positive message should be disseminated, they said.

Months later they told the Reading Chronicle of patient safety issues and a financial crisis arising from the Millennium implementation.

A Royal Berkshire governors Rebecca Corre was quoted as saying: “There is a patient safety issue when staff write down observations and then there is an hour before they can get it onto the computer. If it is an experienced nurse, they may pick up a problem, but others may not.”

Ed Donald, Chief Executive of Royal Berkshire was quoted as saying:

“Unfortunately, implementing the EPR [electronic patient record] system has at times been a difficult process and we acknowledge that we did not fully appreciate the challenges and resources required in a number of areas.”

Are executives and managers at Croydon Health Services NHS Trust  now similarly afflicted with an unjustified optimism about the success of their Cerner go-live?  

Past consequences of NPfIT go-lives hidden?

The Department of Health has claimed benefits for the NPfIT of £3.7bn to March 2012 but there have been trust-wide failures: thousands of patients have had their appointments, care or treatment delayed by difficulties arising from past implementations of patient record systems under the NPfIT.  For thousands of patients waiting time standards have been exceeded or “breached” because of disruption arising from troubled go-lives.

In nearly every case trusts made it difficult for the facts to come out publicly. Vague or unexplained fragments of information about the consequences of the NPfIT implementation appeared  in different board papers over several months. The facts only emerged after a journalistic investigation that required scrutiny of many board papers and follow-up questions to the trust’s press office.

So Campaign4Change investigated Croydon Health’s implementation of Cerner Millennium to see if the Francis report’s call for a “duty of candour” over mistakes and problems in the NHS have made any difference to the traditional fragmentation of facts after NPfIT go-lives of patient record systems.

The Francis report called for “openness, transparency and candour“.  Trusts were told not to hide sub-standard practices under the carpet. The health secretary Jeremy Hunt said it can be “disastrous” when bad news does not emerge quickly and the public are kept in the dark about poor care.

To my questions about the Cerner Millennium implementation Croydon trust’s spokesman always responded promptly and tried to be helpful. But it appears that trust executives have given him limited information about consequences of the go-live, and have preferred to indulge the “good news” NHS culture that Jeremy Hunt warned about.

On being asked what problems the trust has faced since the go-live the spokesman gave various answers that made no mention of the problems.

“All of our staff received training on the system, and we are continuing to offer our teams support as it is embedded.”

What of the problems arising from the implementation, and has the board been fully informed?

“Millennium has featured regularly on the Corporate Risk Register presented to each Part 1 Board meeting.   In addition, implementation has received detailed confidential consideration at Part 2 of Board meetings, (which is why you won’t find it in our public board papers).”

Given Francis’s call for duty of candour,  should the trust be more open about its problems?

“The initial roll out for CRS Millennium was introduced over three days at the Trust, with a phased approach.  We did this to ensure the system was working in each department, before introducing it in another area.

“We are monitoring waiting time performance and records management so we can identify any issues if they emerge. The system is still being introduced in some services and when this is completed we will be able to assess the overall programme,” said the spokesman.

Does Croydon’s unwillingness to give in its statements to me any details of problems indicate that the culture of a lack of transparency in the NHS will be hard to change, no matter how many times Jeremy Hunt talks about the need for candour when things go wrong?

The spokesman:

“I’d like to be clear about the Trust’s approach:

  • The Trust board has been cited on the roll out of CRS Millennium and any potential risks throughout the process.  As I previously noted, the board received an update in September.  The board meeting, which will take place on Monday of next week, will receive a further update from the Chief Executive.  The papers from this meeting will be published on our website and the meeting takes place in public;
  • A meeting chaired by the Chief Operating Officer has reviewed any operational matters arising on a daily basis.  This is an internal meeting for clinicians and managers which has informed the implementation process;
  • Patients and visitors to the hospital have been kept fully appraised of the introduction of the system and were made aware that they may experience some delays to the check-in process while staff became familiar with the new computer system;

“These actions would suggest that the Trust has been transparent in its approach.  You are welcome to review the board papers when they are published.”

Serious problems now emerge

Croydon did indeed publish its board papers on 25 November 2013 – which is to its credit because not all NHS trusts publish timely board papers.

But it’s mostly in the small print of various board papers that details emerge of Millennium-related problems. The shortcomings are mentioned as individual items rather than in a single, detailed Cerner Millennium deployment report.  This leaves one to question whether trust directors have an overview of the seriousness of the difficulties arising from its implementation of a new patient records system.

These are some excerpts from deep inside Croydon’s latest board papers:

Breaches in waiting time standards

– “CRS Millennium (Cerner) Deployment -Network downtime – Week 1.  In particular, the significant network downtime in week 1 (BT N3 problem) led to no electronic access to Pathology and Radiology which resulted in longer waits for patients in the Emergency Department (ED) leading to a large number of breaches. This was a BT N3 problem which has been rectified with BT providing CHS with the required scale of N3 access (>600 concurrent users and >1,600 users on any day – which is the largest network usage of any trust in England).”

– • “Hospital Based Pathways: The deployment of CRS Millennium was a particular challenge in the month across the multiple service areas within the Directorate of A&E, Surgery and Maternity.

• “Cancer & Core Functions: With the implementation of CRS Millennium, the open pathways part of RTT [referral to treatment – patient waiting times) may fail the standard – validation will be completed after the narrative for this report… “

Excessive waits in A&E

– “The main drivers adversely affecting the performance in the month [October 2013) for A&E were the deployment of CRS Millennium and the commencement of winter pressures due to the seasonality change.  A&E  4-Hour Total Time in Department Target: 95.00%. Actual: 91.57%.”

Over budget

“The Trust position as at October is an adverse variance of £4.1m. This is a significant deterioration on the Month 6 position. The movement is mainly due to a significant reduction in income mainly as a result of operating issues caused by the Cerner deployment (£0.9m)…  Actual £14.8 (£14.8)m; Budget £10.7m; Variance £4.1m.”

“Cerner Millennium: Plan YTD [year-to-date] £245,000; Actual YTD  £621,000;

Significant loss in income

“… A new patient administration system was deployed in the Trust on the 30th September and 1st October (Cerner Millennium). The deployment has resulted in significant loss in income in September and October £ 1.1m. Trust performance on Activity Planning Assumptions and Key Performance Indicators is substantially worse than plan …”

Extra costs

“Medical £412k and admin £148k agency levels continue to be high due to cover for vacancies, annual leave, sickness and release of staff for Cerner training. The Trust has also incurred additional costs associated with the Cerner deployment (£600k) including overtime payments to administration staff and training costs.”

Bid to recover Cerner costs?

“… The Trust is currently forecasting a deficit position of £17.8m, which is £3.3m off the plan submitted to the NHS Trust Development Authority. This is a £3m movement from the month 6 forecast and is as a result of operational issues caused by the Cerner deployment. The current projected impact is an additional costs £1.7m and a loss in activity £1.1m . An application is to be made to recover the additional cost/losses relating to the Cerner deployment [of £2.9m] …”

HSCIC support for delays

“Cerner Millennium – Revised implementation date to Sept 2013 (achieved) ,with resultant additional costs including additional PC requirements of £146k, specialist support services £300k, procurement costs £91k, data cleansing costs £200k.

“Health& Social Care Information Centre (HSCIC) has confirmed support for the delayed implementation will be provided, accounting treatment of support to be confirmed with Department of Health.”

More money to stabilise operational position?

“As a result of operational issues caused by the Cerner deployment , Income is significantly reduced in October. The forecast assumes that the Trust will resume normal operating levels from November and that an element of the income lost will be will be recovered in the latter part of the year. A business case is being submitted to the Trust Board for additional investment in Cerner to stabilise the operational position.

“If there are further operational issues due to the Cerner deployment then this will significantly impact on the year end forecast…”

Over-optimism?

Principal risk -reporting output from Cerner is not accurate or timely. Officer in charge: CEO. Before go-live risk scores: June 2013 – 16; July – 16; Aug  – 10; Sept – 10. After go-live risk score (for Oct): 20 [high risk of likelihood and consequences]

Principal risk – operational readiness following the implementation of Cerner. Officer in charge: COO.  Before go-live risk score 15. Post go-live: 20. Risk rating before go-live – Green. After go-live – Red.

Red risks

Corporate Risk Assurance Framework

Nine risks are reported as Red [two of which relate directly to Millennium]:

“… Reporting output from Cerner is not accurate or timely. Data migration was successful. However reliance on external provider as internal knowledge has not yet been fully gained. A data quality dashboard with exception reporting is in place.

“… Operational readiness following the implementation of Cerner CRS Millennium impact conveyed to Trust Development Authority e.g. ED [Emergency Department] reporting and cost overruns

Risk scores

– Failure of CRS millennium to deliver anticipated benefits – 12. Officer in charge: CEO

– Reporting output from Cerner is not accurate or timely – 20. Officer in charge: CEO

– Operational readiness following the implementation of Cerner – 20. Officer in charge: COO

Croydon’s trust’s response to problems

Said John Goulston, Croydon’s CEO, in his latest [November 2013] report to the board of directors:

“The issues being encountered now with CRS Millennium are not due to any lack of integration testing with legacy applications or testing of workflow. They can be attributed to changing from a 25 year old Patient Administration System (Patient Centre) which did not require working in real time, was simple and intuitive to use, easily configurable and flexible to our needs.

“CRS Millennium’s patient administration functions are almost the complete opposite and the language used is new for our staff i.e. conversations, encounters etc. For our staff it has been a big ask for them to step into and up to such a complex application.”

He added: “The benefits of the new system are that each patient will have a single accurate electronic record that can be viewed and kept up-to-date by hospital and community clinical staff. This will eventually mean less time searching for patient notes, missing documentation and duplicating patient information…

“As with any massive change, there are still some challenges to tackle in making the system work effectively for every single user, in a diverse and complex organisation.

“However the success we have achieved to date is the result of the efforts of every single system user and all staff members. I would like to thank all our staff for their hard work in getting the Trust to this important stage.”

The trust spokesman gave me this statement on the problems:

“The Trust board has been given regular reports on the roll out of CRS Millennium and any potential risks throughout the process, not least through its regular reviews of the Corporate Risk and Board Assurance Frameworks.  As I previously noted, the board received a specific update in September.

“As you already know, November’s board meeting received a further update from the Chief Executive.  The papers from this meeting were published and the meeting takes place in public;  Those attending are invited to put forward questions.

“A meeting chaired by the Chief Operating Officer continues to review operational matters.  This is an internal meeting for clinicians and managers which has informed the implementation process;

“Patients and visitors to the hospital have been kept fully appraised of the introduction of the system and were made aware that they may experience some delays to the check-in process while staff became familiar with the new computer system;

“As you highlight from the board report, Cerner & BT noted that ‘the Trust has undertaken one of the most efficient roll-outs of the system they have worked on’   The papers also note some operational challenges as the system was rolled out.  These have been addressed as part of the daily meetings I reference above – these are mainly concerned with users familiarising themselves with the system and have been addressed through the support and training staff received.

“In terms of the costs, the introduction of CRS Millennium has been supported by central funding from the Department of Health with the Trust paying the implementation overheads.   These costs are a matter of public record and the Trust publishes annual Accounts as part of its Annual Report.”

Comment

When you go into hospital it’s reassuring to know the directors will be well informed and open about problems that could affect you.

The approach of Croydon Health Services NHS Trust to openness about its problems is not reassuring. It is no better or worse than other trusts that have implemented Cerner’s Millennium. In fact the timely publication of its board papers means it is more open than some.

But it should not require a time-consuming journalistic investigation to establish the consequences for patients of an NPfIT go-live. It has required just such an investigation after the go-live of Millennium at Croydon.

Board directors will not have the time to dig for, and piece together, information about internal problems that could delay patient appointments, treatment and care. They need the unpalatable facts in one place. Croydon Health Services has failed to make it easy for patients or board directors to see what has gone wrong.

NPfIT deployments at other trusts have led, cumulatively, to thousands of patients having appointments that were disrupted, or who had to wait longer to be seen than necessary, or whose records were not available, or who were seen with another patient’s records.

In shying away from telling the whole truth trusts take their cue from the top: the Department of Health has always made it hard to establish facts about anything to do with the NPfIT.  Said the Public Accounts Committee in its report The National Programme for IT in the NHS: an update on the delivery of detailed care records systems in July 2011:

 “It is unacceptable that the Department [of Health] has neglected its duty to provide timely and reliable information to make possible Parliament’s scrutiny of this project.

“Basic information provided by the Department to the National Audit Office was late, inconsistent and contradictory.”

Unanswered questions

Croydon has questions to answer, such as how many breaches of waiting time standards it has had, and may still be having, due to problems arising from the go-live. Other unanswered questions:

– What does a “a large number of breaches” in the Emergency Department mean? Have each the patients affected been told?

– Why are the risks related to the implementation much higher after go-live than before, given that the trust has had years to prepare for the go-live, and the many lessons it could have learned from other trusts?

– Exactly what problems are still affecting patients?

In a post-Francis NHS, Jeremy Hunt has demanded openness about mistakes and problems. There is an agreed need for change – but how can Hunt change an NHS culture – indeed a public sector culture – in which senior executives, in troubled IT implementations, will always emphasise the good news over the bad, perhaps hoping the bad will always remain hidden?

DWP drops claim Universal Credit is on time

By Tony Collins

For  more than a year the DWP press office has countered articles on Universal Credit’s IT project problems with the claim that the scheme is on time and to budget. Spokespeople for the department have said each time that Universal Credit will be fully delivered by the end of 2017.

Now it has dropped the claim.  Today the DWP says in a press release that “most” of the existing benefit claimants will be moved over to Universal Credit during 2016 and 2017.  

On the advice of Universal Credit project lead Howard Shiplee the DWP is pressing ahead with the existing IT and “enhancing” it rather than starting anew. 

Says the DWP:

The next stage of delivery of Universal Credit will concentrate on the continued safe and secure roll out of the vital reform… 

As announced in July, the department has been working in conjunction with the Government Digital Service to explore an enhanced IT system for Universal Credit that uses the latest in technological advances.

“Today, ministers confirm that this system has proved viable and the department will further develop this work with a view to rolling it out once testing is complete.

“While this work is undertaken, Universal Credit will continue to expand. It is now live in 7 areas across the country, growing to 10 by spring 2014. From there, the roll out will expand beyond the existing single claimant group, to new claims from couples and families in all of these areas.

“By the end of next year, Universal Credit will start also to expand to cover more of the north-west. Universal Credit will therefore expand in scope and scale over the next 2 years.

“Pressing ahead with the existing system while the enhanced IT is being developed will allow for greater understanding of how individuals in different circumstances interact with Universal Credit. It also allows higher volumes of people to benefit from the better work incentives that come with the new benefit. Importantly, this approach will still allow the Universal Credit programme to roll out within the original budget.”

Work and Pensions Secretary Iain Duncan Smith said:

“This is a once in a generation reform. And we’re going to get it right by bringing it in carefully and responsibly.

“Our approach will ensure that while we continue to enhance the IT for Universal Credit, we will learn from and expand the existing service, so that we fully understand how people interact with it, and how we can best support them.
Early indications show that people are positive about the new benefit, and my department is working hard to ensure this good progress continues.

“Current plans will see new claims to existing benefits closed during 2016. This will mean that all new benefit claimants across the country will claim Universal Credit instead of the legacy benefits like Jobseeker’s Allowance or Housing Benefit…

“Decisions on the later stages of Universal Credit roll out will also be informed by the completion of the enhanced IT and these decisions will determine the final details for how people transition to the new benefit.

“The overriding priority throughout will be continued safe and smooth delivery and, as recommended by the Public Accounts Committee in their recent report on Universal Credit, this will take precedence over meeting specific timings.”

Comment 

Can the public and Parliament trust anything the DWP says about the progress on major IT-based projects? Those working on Universal Credit have known for 18 months that the project has been in trouble, but this has been repeatedly denied by DWP spokespeople who have insisted the scheme is on budget and on time to be fully completed by the end of 2017.

We know from the National Audit Office that the IT is not within budget and today we have the DWP’s admission that the programme will not be complete by the end of 2017 – something Campaign4Change and other sites have posted articles on for more than a year.

DWP’s over-optimism

“We will implement Universal Credit on time by 2017 and within budget – our plan is achievable.” – DWP in September 2013.

The DWP spokesperson added (September 2013) 

“We are committed to delivering Universal Credit on time by 2017 and within budget, and under new leadership we have a plan in place that is achievable.”

A DWP spokesperson told ComputerworldUK in September 2013:

“We are committed to delivering Universal Credit on time by 2017 and within budget, and under new leadership we have a plan in place that is achievable.”

It’s likely that Howard Shiplee has reported to IDS on what can and cannot be achieved by the end of 2017. He might have detailed the many IT-related uncertainties that still exist. But his report has not been published. The DWP doesn’t publish any reports on the progress or otherwise of its IT-related projects.

So will the DWP ever be open about its IT-enabled projects and programmes? Or will it continue to deny problems, write-offs and mistakes until they are only too obvious to be denied?  

Since the 1980s the DWP has been writing off tens of millions on failed IT projects. The Department may continue to have costly failures while its officials can easily keep the problems detailed in internal reports  hidden until they have moved on.

Will truth ever be told when things go wrong?

By Tony Collins

Cabinet Office minister Francis Maude has criticised civil servants who don’t always tell ministers what is going on in their departments. He used the Universal Credit project as an example.

He told the Financial Times: “There were a lot of failures in DWP and it isn’t good that it took a review commissioned . . . by the secretary of state to disclose what was going on.”

He added:

“You’ll find a lot of ministers don’t know a lot of things going on in the department because there’s no way you’ll find out.”

Maude’s comments touch on a common factor in IT-related project disasters in government – that ministers get mostly “good news” from their officials, and learn little or nothing about the seriousness of problems until a debacle is only too apparent to be denied.

But can ministers or the boards of large private companies ever expect their senior staff to be the bearers of bad news?

The Performing Right Society did not find out the truth about its failing IT-based project until it appointed a new head of IT who had no emotional equity in what had gone on before. [Crash – chapter 1)

The National Audit Office report “Universal Credit: early progress” referred to a “good news” culture at the Department for Work and Pensions that “limited open discussion of risks and stifled challenge”.

Ministers in charge of the Rural Payments Agency’s Single Payment Scheme said they were kept in the dark about the seriousness of IT-related problems. “When delays occurred, many stakeholders only found out at the last minute,” said a report of the Public Accounts Committee.

“Conspiracy of optimism”

The PAC report of March 2007 is worth a further mention:

“Lord Bach [minister in charge of the Single Payment Scheme] told us that he felt very let down by the advice he had received from the RPA [Rural Payments Agency], upon whom he said the Department relied very heavily in these circumstances, and the “conspiracy of optimism” on the part of the Agency.”

Lord Bach told MPs that he kept being told by officials that all was well.

“I frankly have to say that I do not think that that was satisfactory from senior civil servants whose job is to tell ministers the truth.”

Let down by civil servants – Universal Credit

Now the FT reports that Francis Maude has “entered the controversy over the implementation of the government’s universal credit scheme”. Maude told the FT he believed that Iain Duncan Smith, the work and pensions secretary, had been let down by his civil servants.

Maude said senior civil servants in charge of projects should tell ministers bluntly if they felt they were being misdirected and insist on a formal “letter of direction” to show that they had raised their objections. If they did not, they should be accountable for failings on their watch.

Maude did not comment directly on whether Robert Devereux, the top official in Mr Duncan Smith’s department, should take the rap for the much-criticised implementation of universal credit, but said: “I think everybody has to take responsibility for what they were part of”.

SROs accountable to MPs?

He suggested that civil servants who are in charge of big projects, known as senior responsible owners (SROs), should account directly to parliament, which would “toughen the relationship with ministers” and give officials a greater incentive to challenge developments they believed were wrong.

He said: “If you have an SRO who knows that he or she is going to be hauled up in front of select committees and interrogated . . . then I think you’re much more likely to have what is a very healthy thing in our system which is push-back. . . There’s a great phrase ‘speaking truth unto power’ and it’s very important – it doesn’t happen enough.

He added: “I’ve never had a civil servant come to me and say ‘Would you like us to stop doing this?’ The answer might easily be, ‘yes’.”

Comment:

Do ministers and boards of large private companies always have to commission their own independent reports to find out if their organisation’s biggest IT-based projects are failing? Probably.

The problem is not one of lying. Civil servants tend not to lie. Neither do senior executives when reporting to their boards. But the sin of omission – the art of not telling the truth while not lying – is well practiced in public life.

A succession of IT-based project disasters in the US, Australia and the UK show that truth is the first casualty of any large failing IT-based project.

Barnet Council and Capita

It’s isn’t just IT-based projects that bring out the sin of omission. Outsourcing deals do too. Barnet Council’s outsourcing deal to Capita is mired in controversy over truth.

Why did Barnet’s officials give Capita £16m after saying that the council had no spare cash, and that Capita would make the necessary upfront IT investments?

Officials have given a long-winded explanation which is a little like the drawn-out, incomprehensible explanation a six year-old may give in the playground when teacher asks why he took his friend’s bar of chocolate.

Liverpool LDL, BT and excessive mark-ups?

Liverpool Direct Ltd, a joint venture between Liverpool council and BT, is also mired in a controversy over truth. According to the Liverpool Daily Post, Local Government Minister Brandon Lewis has questioned whether LDL is proving value for money. There are allegations of excessive mark-ups on IT and services supplied by BT to the council.

It seems that BT makes a mark-up on what it supplies to LDL and LDL makes a further mark-up on what it supplies to the council.

But a council spokesperson said: ““The mark up incorporates a calculation of the cost of setting up a particular piece of hardware or software by LDL. The important figure is the profit after tax per item which is much lower, and on some items, LDL actually makes a loss.”

The minister said Liverpool Council needed to open up its books if it wants to insist it gets value for money from the BT deal. Will Liverpool Council open up?

Hardly.

Politicise parts of the civil service?

There is a strong argument for politicising the top echelons of the civil service so that ministers are not so reliant on officials who are thought to be neutral but evidence shows can be biased towards good news and suppressing the bad.

Ministers and boards of large companies do not need various versions of the truth when things go wrong. They need their own version.

As Richard Nixon said when accepting the presidential nomination in 1968 [pre-Watergate]:

“Let us begin by committing ourselves to the truth—to see it like it is, and tell it like it is—to find the truth, to speak the truth, and to live the truth.”

Doubtless Nixon believed it when he said it. Just as countless officials and executives in public and private life believe they are speaking the truth when they ministers and boards on their big IT-based projects. It may be the truth. But how much of it are they telling?

Update:

In a tweet BrianSJ3 makes a great suggestion: Genchi Genbutsu – “go and see for yourself” he says.

Police SAP system’s “significant” security weaknesses?

By Tony Collins

Auditors claim that weaknesses in security controls in a SAP system used by a police force and two councils could allow people who don’t work for the police to have  access to the force’s administrative database.

Grant Thornton also warns of risks that those with access to the system could create new programs, manipulate and change data, and view files they may not be authorised to see.

The risks are detailed by Grant Thornton in its report “Review of South West One (SWO) AP IT Controls”. Southwest One is an IBM-owned company that runs IT and other services for, Avon and Somerset Police, Taunton Deane Borough Council and Somerset County Council.

The three authorities, which are minority shareholders in Southwest One, share a SAP database that is run by the joint venture company. 

Grant Thornton concludes that there are risks of unauthorised access and changes to a SAP system shared by the three authorities. It says that “while we have identified this significant weakness in control we have no evidence of actual, inappropriate access or changes to data. However, our review was not intended to go into this level of detail and further testing would be required to establish if inappropriate access had been made.”

The SAP database is likely to contain sensitive information such as the home addresses of senior police officers and council officers.

“Significant issues”

Grant Thornton says that “two significant issues” require an “urgent” response and officials should also “clarify immediately” who has access to a SAP database and “whether there has been any unauthorised access to, or changes, made to the data”.

It appears that the security risks in control existed for years. Southwest One was set up in 2007 and the SAP system implemented gradually in the years after a signing of the deal. The contract has another four years to run.

The claimed flaws are because the SAP database is shared between the three authorities and its data is not always segregated, according to Grant Thornton.

The auditors suggest that the problem is not in the design of SAP but in the way the system has been implemented.

SAP separates “client” accounts in two ways, says Grant Thornton.

One way is for SAP to be implemented as a single system, with data kept separately for different legal entities. Data is segregated between the legal entities so there are no shared users.

SW1 adopts cheaper option?

A cheaper option, says Grant Thornton, is to have a single “SAP client”, which is the implementation used at Southwest One.

This type of deployment separates accounts by trial balance codes, known as company codes. It’s suitable for large companies that have several subsidiaries, and allows for consolidation of accounts at group level.

It uses a shared database that stores a shared set of configuration parameters and has a shared set of users. Each table in the database contains data from each of the trial balance codes. Access to data is restricted through the SAP security model and requires careful fine-grained access permissions to be created to ensure adequate restrictions to sensitive and personal information.

For administrators, this may be the easiest implementation as there is only a single database to manage, rather than one for each client.

“It is likely to be the lowest cost model because of this,” says Grant Thornton. “However, it is the least secure method to manage legal entities that have no relation to each other.”

Upgrades, system reports and database maintenance may need to be done only once. Licence costs are shared.

Auditors suggest that the weaknesses mean that people who access the shared database may work for the police, or either of the councils, or be posing as secondees for any of the three authorities. 

When Grant Thornton tried to find out the names of people who have access to the database they were told some could not be identified as they were police officers, Grant Thornton said in its report:

“As we are unable to identify these individuals we only have SWO’s [Southwest One’s] assurance that these are genuine seconded employees.”

Said Grant Thornton:

“We identified approximately 20 users who had access to SAP. We were informed by SWO that some of these users are seconded from the three users bodies to SWO and that because some of them are police officers we could not be given their names. Thus you have a complex situation where staff work for the respective legal entities but are seconded to SWOne.

Genuine employees?

“It is not clear if the respective entities are aware that data is not really segregated and that secondees could gain access to other entities data.

“Even if SWO reduces the number of staff that have access to sensitive data they will not be able to reduce this type of cross entity access to zero because of the single client they are using in SAP.

“In addition to the potential control risk, as SAP contains personally identifiable data that could be accessed by ‘inappropriate’ users there is the potential for a challenge under the Data Protection legislation and fines levied by the Information Commissioner can be significant.”

Under the Southwest One contract IBM has provided the SAP service under a single ‘software as a service licence’ (SAAS).

 Grant Thornton claims in its report other security weaknesses which include:

Excessive privileges in SAP

“It was noted that 26 users had access to the SA38 privilege. The use of the transaction code SA38 in the production environment should be highly restricted since it provides access to run custom programs that have not been secured with authorisation objects or authorisation groups, thereby allowing the user to access functionality and data not associated with their normal SAP role.

“This could expose the organisation’s data to users who do not work directly for the organisation. It should be noted that in many SAP implementations, custom programs may be inherited from legacy SAP installations and new custom programs may not have been programmed using authority checks. Access to SA38 provides full access to any program that does not contain an authority check and can therefore circumvent the standard SAP authorisation model.”

Programmers with access to the final working system.

Programmers should be able to make changes in development systems, and only transfer them to the production version after following suitable change controls, testing and authorisation.

“Direct access to programming editing tools in the production environment represents a high risk to the organisation as it allows unauthorised changes to be made to data and programs.”

Access to sensitive tables in SAP [SM30/SM31]

“The organisation has 22 users with access to sensitive table data editing transactions SM30 and SM31. A review of the organisations that these individuals work for identified a mixture of IBM, Somerset County Council, Taunton Deane Borough Council, Avon & Somerset Police and EPIUSE. All have been seconded to SW One, with the exception of IBM and the EPIUSE user. Access in all cases was authorised by SW One.

“Access to these transactions under certain conditions can allow customised data tables to be edited directly, potentially resulting in unauthorised entries or database integrity problems.”

Somerset’s response

Grant Thornton says that officers at Somerset County Council were aware already of the underlying database configuration and its inherent risks.

Southwest One has been approached to comment on, and provide the necessary assurance around, database controls. Somerset has also asked Southwest One to provide details about access levels to the SAP system and about the frequency of their use.

A report for the Council’s audit committee on 21 November 2013 says that at the start of Southwest One contract (in 2007), Somerset’s officers received assurances that sufficient access controls and permissions existed within the SAP system, and in particular the SAP security model, to permit a single database to be used.

IBM’s response

IBM says most of the problems mentioned by Grant Thornton are matters it has dealt with and regards as “closed”.  It has responded to Grant Thornton’s concerns with some changes, undertakings of further discussions and various assurances.

On the claimed lack of segregation between programming, operations and management that prevents adequate controls being exercised which could lead to unauthorised changes being made to the system, Southwest One says:

“Low risk – Grant Thornton has confirmed that this only applies to one user.
Grant Thornton were happy with the secondary controls (separation of duties) that were already in place to mitigate this, but SWOne agreed to amend this person’s access to ensure that they cannot move any transport they have created.”

It’s not certain that Somerset’s councillors will accept IBM’s assurances at face value; and Grant Thornton is likely to investigate further.

At its meeting on 21 November, the council’s audit committee will consider whether to accept IBM’s assurances.

“Members are asked to review the findings in the Grant Thornton report and to consider what level of assurance they can take from South West One’s response and mitigations,” says a report to Somerset’s audit committee.

 Comment

Details of Grant Thornton’s concerns were spotted by Dave Orr, a former Somerset County Council IT employee who campaigns for openness over the Southwest One deal.

He says:

“This state of affairs where SAP is not separately configured for each partner organisation’s security is very worrying.

“It is hard to believe that over 5 years after implementation of SAP by IBM/SW1, a basic configuration error of judgement of this magnitude has taken place – especially considering police security requirements.

“Are the HMIC [Her Majesty’s Inspectorate of Constabulary] & NAO aware of these security issues? How would this unsuitable configuration have supported the many new joiners envisaged in the original joint venture model for SW1?

“Without a rebuild of SAP ground up, it is hard to see how this can be properly rectified.”

Capita – an NAO insight.

By Tony Collins

Capita is a remarkable success story. Formed in 1984 with two people, as a division of the Chartered Institute of Public Finance and Accountancy, it grew rapidly to become a FTSE 100 member in 2006. In 2012 its turnover was £3.35bn, its pre-tax profits were £425.6m and it employed 52,500 people. It now has 62,000 staff across the UK, Europe, South Africa and India. It  acquired about 36,000 staff through TUPE.

In a survey, 71% of Capita staff agreed with the statement that “Overall I feel Capita is a good place to work” and 85% have an overall satisfaction with management.

The company’s  public sector turnover in the UK is about £1bn, divided roughly equally between local and central government. Two of its most recent UK contracts are at Barnet Council.

Yesterday the National Audit Office published an insight into four companies, Capita being one, after a request by the chair of the Public Accounts Committee, Margarget Hodge. She is not so impressed by Capita’s success.

“I asked the NAO to carry out this work after looking at case after case of contract failure- G4S and the Olympic security, Capita and court translation services, Atos and work capability assessments, Serco and out-of-hours GP services, to name a few.

“In each case we found poor service; poor value for money; and government departments completely out of their depth,” said Hodge.

Capita, however, comes out of the NAO investigation fairly well, better than the other three companies (G4S, Serco and Atos) but the NAO made some general points, unspecific to any of the four contractors, that indicate contracting arrangements between government and some of its major suppliers are far from ideal.

One of the NAO’s findings is that some suppliers may be “too big to fail” – and “difficult to live with, or without”.

The NAO memo provides information on Capita that would not otherwise be in the public domain. The audit office based its information on interviews with suppliers and civil servants, surveys, company reports, data from “open book” accounting and Cabinet Office files.

The four suppliers co-operated with the NAO but not completely. Where the contract did not have “open book” clauses Capita did not provide information on its costs or profit margins.

Below are some of the NAO’s findings in its “Memorandum on the role of major contractors in the delivery of public services”.

Capita has contracts with most major central government departments. In 2012/13 these contracts by value included:

Department for Work and Pensions: £146m.

Home Office: £99m

NHS: £71m

MoD: £40m

Department for Transport: £28m

Ministry of Justice: £23m

Cabinet Office: £19m

Department for Education: £17m

Department for Business Innovation and Skills: £11m

Department for Culture Media and Sports: £5m

DEFRA: £5m

Department for Energy and Climate Change: £3m

Department for International Development: £2m

HM Treasury: £2m

HMRC: £1m

Department for Health: £1m

Capita’s profits

The NAO says:

“Capita has been profitable for many years. Its accounts allocate its activities to 11 operating segments according to the nature of the services provided. All of these operate globally and contain at least one public sector contract as well as UK private sector and overseas work.

“The information that we saw at Capita indicates the following

• Public sector work generally has a margin, before both divisional and global overheads, of 6 to 18 per cent, falling to between 1 to 10 per cent once overheads are included. Capita told us that its other public sector contracts would be similar, but that they were ‘doing better’ in the private sector.

• Two contracts reported a loss. Capita said this was because costs such as investment were being incurred at the start of the contract. Capita told us they expected these contracts to achieve a whole-life gross margin of at least 15 per cent.

• Some contracts had higher margins. Capita told us these were older contracts, some of which had made losses early on.

“Capita only showed us information on contracts that had open-book clauses. They believed that most of their clients regularly use open-book access rights. It  [Capita] said: ‘We do not distinguish between public and private sector contracts in our internal management information systems and it would be additional work for us to make available the information in a comparable format.’”

Capita’s UK taxes

The NAO estimate Capita’s UK tax paid in 2012 was £50m-£56m.

Below are some of the NAO’s general points that are not specific to any one of the four companies.

Making money through contract changes

NAO: “Changing a contract and adding requirements allows a contract to evolve, but can be less competitive than fully tendering the new requirement.

“Because of such changes, the total revenue through contract tends to grow, as reflected in the four contractors’ portfolios. In our experience the contractors tend to make higher profit margins on these changes. Good practice aims to build flexibility to the contract and relies on transparent costs and profits…

“Generally contractors manage their profit across a portfolio, targeting an overall level of profit. Low margins are often established during the bidding process, but can increase during the contract lifetime.”

Easier to stick with existing suppliers?

“Incumbents can be seen by procurement and policy officials as the easier and safer option. Across the 15 applicable services we looked at as case studies for this memorandum, seven had been re-tendered at least once, with four of the most recent competitions for each service being won by existing providers and three by new providers.”

Open book accounting not always open

“The government only has access to information on the profits contractors make where ‘open-book arrangements’ are written into contracts. Open-book arrangements either require the contractor to update the client department regularly on their costs and profit, or allow the client to audit those costs and profit on an ad hoc basis.

“We found that use of open-book access rights varies. Some public bodies do not try to see data on contract profits. Comparing profit levels from the open-book arrangements we reviewed also posed challenges as contractors vary in how and when they allocate central overhead costs against profits from contracts…

“We do not have direct audit rights over government contractors. It is normal, however, for government contracts to require the contractor to give us information and help when we audit that public service and government entity. Where there are open‑book accounting arrangements with the government then this includes making those available to us.”

Suppliers pass risk back once contract start?

The original allocation of risk in the contract often changes once the contract starts. For instance:

• Contractors will often pass risk back to clients who do not fully enforce or carry out their part of the contract. The government department therefore needs the appropriate skills to manage the type of contract it is using.

• The original understanding of the risks in the contract may prove to be wrong. This can lead to the contract being terminated (Figure 18) and risks that the government thought the contractor would manage returning to the public sector.

• The government sometimes ignores the commercial terms and risk allocation in the contract when trying to settle a dispute or vary the requirement. Instead, it can put political pressure on the contractor and threaten their reputation

You can’t rely on contracts

The standards expected of all public services are honesty, impartiality, openness, accountability, accuracy, fairness, integrity, transparency, objectivity, and reliability, says the NAO. They should be carried out:

• in the spirit of, as well as to the letter of, the law;

• in the public interest;

• to high ethical standards; and

• achieving value for money.

In these respects public contracts are limited in what they can achieve. Says the NAO:

“Many of the standards expected of all public services do not easily translate into a contract specification. It is not possible, for instance, to contract for ‘integrity’ or the ‘spirit of the law’.

“Achieving the standards expected for public service depends largely on the corporate culture, control environment and ethics of the contractor. It is not easy, however, to use contract negotiations to meaningfully assess and set standards for the contractor overall.

“Government therefore needs to supplement traditional contractual mechanisms with other means of ensuring the expected standards are met. In particular, they need to ensure that the companies’ own corporate governance, management and control environment are aligned with taxpayers’ interests.

“This requires both transparency over performance and incentives to implement the rigorous control environment required including credible threat to profits and future business if problems are found.”

The NAO says officials need to better understand the general control environment that contractors use to manage government contracts, and how far senior executives in those companies should understand what is happening within their companies.

US is more open than UK

The NAO says that companies’ own public reporting and transparency to the public is important to facilitate public scrutiny and trust. Although the government publishes new public contracts on its website www.contractfinder this contains only recently awarded contracts and “very few of the four contractors’ contracts are on it”, says the NAO which adds:

“By contrast, the US government website www.USAspending.gov sets out the full contracts and spending on all government suppliers.”

On Freedom of information, contractors compile information to answer freedom of information requests when asked by their government clients, where they hold the information for the government, but the department answers the actual request.

Says the NAO: “Freedom of information does not apply to the contractor’s business and commercially sensitive information can be exempt.”

On the openness of suppliers in reporting profits the NAO says:

“Even where transparency exists, it is inevitably difficult to interpret profit information. It can be unclear what a reasonable margin looks like. In theory, the margin is meant to reflect risk, innovation and investment. But these are difficult to measure. Furthermore, profit is rarely presented consistently. It can be unclear how overheads are allocated. The profit margin changes, depending on the stage of the project. And different companies may target different rates depending on their business model.”

KPIs of limited value

The NAO says KPIs give a limited overview of performance and are normally focused on things that are easily measurable.

“The main way the government can gain quality assurance is through the contractual reporting. This normally includes a set of KPIs that track performance and that are often linked to financial incentives. Together these make up the service level agreement (SLA). These can be used effectively to manage performance. However, there are three major risks that mean that contractual reporting is not sufficient on its own to monitor performance.”

The NAO says there are risks of misreporting. “There have been instances of contractors misreporting performance, including the case of Serco’s Cornwall out-of-hours healthcare contract …”

Poorly calibrated KPIs.  

“All the contractors told us about instances where poor calibration has resulted in green SLA traffic lights where the client is unhappy or red traffic lights where the client is content with the service. This reduces the SLA’s relevance and can indicate that incentives are not working.”

Are some suppliers too big to fail?

“The current government, like the one before it, sees contracting out as a way to reform public services and improve value for money. Contracting out can significantly reduce costs and help to improve public services. However, there are several indications that better public scrutiny is needed across government contracting:

• There have been several high-profile allegations of poor performance, irregularities and misreporting over the past few months. These raise concerns about whether all contractors know what is going on in their business and are behaving appropriately; and how well the government manages contracts.

• The government believes that contractors generally have often not provided sufficient value, and can contribute more to the overall austerity programme.But the general level of transparency over contractors’ costs and profits is limited. The government needs a better understanding of what is a fair return for good performance for it to maintain the appropriate balance between risk and reward.

• Third, underlying both these issues is the concern that government is, to a certain degree, dependent upon its major providers. There is a sense that some may be ‘too big to fail’ – and difficult to live with or without.

Can we see whether contractors’ profits reflect a fair return?

The NAO’s answer to its own question appears to be “no”.

It says there is a need to explore further:

• Whether there is sufficient transparency over costs, profit and tax.

• Whether the balance of risk and reward is providing the right incentives

for contractors.

• Whether profits represent a fair return.

Shareholder v taxpayers’ interests

The NAO suggests that suppliers are likely to put their own interests before taxpayers’.

“Companies’ own control environments will likely concentrate on maintaining shareholder value. Government needs to ensure that it is in the contractors’ financial interests to focus their control environment more widely on meeting the standards expected of public service.

“This involves using contractual entitlements to information, audit and inspection to ensure standards are being met. And it is likely to involve financial penalties, banning from competitions and political fallout when problems are found.”

The NAO says that, to be a well-informed customer, the government needs to satisfy itself that contractors’ corporate governance structures work in taxpayers’ interests, and that the companies are not paying ‘lip service’ at the centre with little group-wide control to back it up.

“Companies that are large and have sprawling structures, involving a vast number of subsidiaries, may have to make particularly strenuous effort to demonstrate this.”

The NAO suggests further areas to explore:

• Whether contractors are meeting the standards of performance the public expects.

• What contractors consider themselves accountable for.

• Whether transparency is sufficient to ensure contractors work in the taxpayers’ interests.

• Whether contractors’ control environments focus on ensuring standards of public services are met.

Supplier information unverified

The NAO says: “We are grateful for the help and cooperation provided by Atos, Capita, G4S and Serco in the preparation of this memorandum. Most of the information in this report is based on information the companies provided.

“Much of this would not otherwise be in the public domain. The contractors also helped us to understand their business and talked frankly about the risks, challenges and incentives they face.

“However, we do not directly audit these companies and have not been able to verify all the information provided against underlying evidence. We have therefore presented the information in good faith, and attempted to compare different evidence sources wherever possible.”

NAO memorandum on the role of major contractors in the delivery of public services

Comment

Capita is not a bad government contractor.  Perhaps it is one of the best. But is that a ringing endorsement?

The NAO has carried out a thorough investigation but its inquiry suggests that much about public sector contracting remains hidden. On suppliers in general, it is not difficult, if both sides tacitly agree, to hide problems from Parliament, the media and even the Cabinet Office which asks the right questions of departmental officials but does not always get answers, let alone accurate answers.

The NAO did not always get answers to its questions. Indeed Amyas Morse, head of the NAO, said there is an impression that some officials are not in control of their suppliers.

“Contracting with private sector providers is a fast-growing and important part of delivering public services.  But there is a crisis of confidence at present, caused by some worrying examples of contractors not appearing to treat the public sector fairly, and of departments themselves not being on top of things.

“While some government departments have been admirably quick off the mark and transparent in investigating problems, there is a clear need to reset the ground rules for both contractors and their departmental customers,” said Morse.

My thanks to campaigner Dave Orr for drawing my attention to Morse’s comment.