Auditors have highlighted a series of failures in the delivery of a new ICT system for Scotland’s criminal records checks agency, which was 18 months late and twice the original budget.
Disclosure Scotland, which provides vital background checks for employers, had to revise its initial forecast of £34.1m for the bespoke Protecting and Safeguarding Scotland (PASS) system to £78.5m as costs spiralled out of control.
Governance failings, internal ‘ambiguity’ over who was responsible for what elements of project delivery and management, and a lack of oversight of the finances all led to the agency seeking additional cash from the Scottish Government.
The first phase of the PASS system, provided by the supplier BJSS, was due to go live in March 2018 when the existing contract with BT – which was the incumbent system provider – expired. However, that deadline was missed and even now – more than 18 months later – a series of further delays and costly contract extensions with BT have meant that the system is still not operating at the level intended when the project was first scoped out.
Instead, a ‘minimum viable service’ (MVS) is currently in place requiring manual workarounds delivered by temporary staff, at an additional cost, estimated at £2.70 million in 2019/20 and reducing to £2.14 million in 2020/2. Ministers are expected to be asked in spring next year for a further £16.1m to cover an estimated shortfall in the agency’s 2019/20 budget.
The Auditor General said over-optimistic assumptions were compounded by lack of financial reporting and governance of the project.
Caroline Gardner, Auditor General for Scotland, said: “I have reported on the failures of many ICT projects in recent years and set out clear principles public bodies should follow. There are lessons to be learned from Disclosure Scotland’s experience with the PASS system. While the rollout in September was a significant milestone, there have been real weaknesses in control and oversight of the project.
“The system was delivered late, over budget, and with less functionality than had been originally intended. There remains more work to be done before its full ambition, and wider transformation, is realised.”
Disclosure Scotland succesfully completed the transfer of all of its activities from BT to the PASS system in September this year; it is the first time, the report notes, that police data has been held in the cloud and the first time that ‘agile methodology’ was used by the agency. The report makes clear that Disclosure Scotland had ‘limited’ experience of working under an agile approach.
The report adds: “Ultimately, the PASS system was delivered. But it was late, over budget, and with less functionality than originally intended. There remains more work to be done before the full ambition for the PASS system, and the wider transformation of the disclosure system, is realised. I have asked the auditor to review progress as part of the 2019/20 audit.”
Disclosure Scotland Chief Executive Lorna Gibbs said: “I welcome this Audit Scotland report, which demonstrates Disclosure Scotland reached a ‘significant milestone in the transformation of the disclosure system’ by ‘completing the transfer of all its activities to a new system’ in September 2019. However, the report highlights a number of challenges faced during the transformation period, which give clear indications of lessons that must be learned going forward.
“The old IT system used by Disclosure Scotland was getting to the end of its useful life and in order to allow us to continue safeguarding vulnerable groups, we had to replace it. Our aim was not only to create a system which would provide a better service for our customers but also allow us to reduce costs, in turn saving taxpayers’ money. Putting police data in the cloud had never been done before anywhere in Europe and as the programme developed, a number of challenges more difficult than originally expected, came to light, resulting in us spending more money and taking longer than we had anticipated.”
She added: “Disclosure Scotland has taken the greatest care to spend public money wisely and will continue to do so. However, that doesn’t mean there are not learning points from the Auditor General’s report. We have already made some changes to our governance structures and we will, of course, make any further changes needed so we can improve.
“The upfront multi-million pound investment has allowed us to replace an obsolete IT system and create a completely new system which we will continue to develop to provide a constantly improving experience for the customer and reduce overall operational costs. This will ensure better value for the public purse in the longer term as well as ensuring Disclosure Scotland can carry out its essential safeguarding service.”