Select committee inquiry
Performance of the UK Security Vetting service
Closed
What the inquiry looked at
“UK Security Vetting (UKSV) was established in January 2017 and since April 2020 has been part of the Cabinet Office’s Government Security Group. Prior to its move to the Cabinet Office it was part of the Ministry of Defence and UKSV is still managing legacy elements of the transition. Following publication by the National Audit Office of its investigation into performance of UKSV , the Committee will question senior officials at the Cabinet Office and UK Security Vetting Service on progress towards completing the move to the Cabinet Office and: UKSV’s performance levels; the causes of poor performance and what progress UKSV is making in addressing them; and how UKSV is seeking to modernise and reform security vetting. If you have evidence on these issues please submit it here by 6pm on Sunday 29 January 2022. Please have a look at the requirements for written evidence submissions and note the Committee cannot accept material as evidence that has been published elsewhere.”
The committee's words, from the inquiry page on parliament.uk ↗.
What it found
In the committee's words, from the summary of Fifty-Third Report - The performance of UK Security Vetting ↗
Since taking over responsibility for delivering national security vetting in April 2020, the Cabinet Office has failed to get a grip of this vital government service. United Kingdom Security Vetting (UKSV) aims to provide timely processing of clearances for staff employed across government but has failed to meet either of its main two performance targets since mid-2021. Nearly one-third of Developed Vetting (DV – the highest level)
clearances in 2022–23 have taken more than 180 days to process, almost double the 95-day target UKSV’s customers expect. While there have been modest improvements in some areas over the latter half of 2022, performance is still well below the standard that UKSV promises its customers, and backlogs of cases remain to be worked through.
Part of the reason for the increase in work relates to policy changes which required additional vetting – something the Cabinet Office was aware of and should have been able to predict would have an impact on the relatively new vetting service. These unacceptable delays in processing clearances could result in departments being unable to progress the work of government. The Cabinet Office, however, does not appear to have fully assessed the potential impact across government. It also seems content to repeatedly extend DV renewals as a means of managing demand, despite the increased risk associated with individuals going many years without a full review of their security clearance. It also has a woeful record on aftercare checks, which should occur between the initial clearance and a full review to confirm someone’s circumstances have not changed. Aftercare targets have not been met once since the start of 2018–19. All this is creating a risk environment that many customers across government are uncomfortable with.
UKSV has suffered from a staffing position that has rarely been sufficient to meet customer demand. In November 2022 its full-time staff complement was 23% below estimated requirement levels. The Cabinet Office sought to prop this up with a promise of an additional 163 contingent labour and temporary staff from other government departments by March 2023, but this is not a long-term solution for an organisation which has historically been under-resourced. UKSV is also desperately struggling to recruit digital staff and internal surveys show low levels of staff engagement.
Alongside failing to deliver an acceptable current level of service, the Cabinet Office and UKSV have failed so far in attempting to modernise and transform how security vetting is delivered. The Cabinet Office has repeatedly blocked transformation business cases from UKSV citing concerns over its deliverability whilst seemingly doing little to support the programme. As such, it is not clear that the current plans for transformation are any more likely to succeed than previous failed efforts, with the governance structure seemingly more of a hinderance than a help.
What the government said
The government responded on 21 July 2023. The deadline was 12 July 2023.
Summary written by Accountability Index from the government's response.
The government states that it "agrees with the Committee's recommendation" in each of the six areas covered, and sets out stabilisation milestones for vetting services and a plan for transformation.
- On backlogs, UKSV has set out milestones: Developed Vetting initials "fully stabilised by the end of June 2023", SC/CTC by the end of September 2023, and DV Reviews by the end of March 2024.
- On demand forecasting, UKSV is undertaking "a full review of current forecasting and demand planning processes" with customers, to deliver improvements for 2024/25.
- On governance, the government says an independent review has been completed and endorsed the Committee's findings; UKSV "will now implement an enhanced governance structure", with implementation commenced in June 2023.
- On transformation, external support has been contracted for a 10-week enhanced discovery, feeding an Outline Business Case to be considered in October 2023. The Cabinet Office "would be happy to share the key elements of the resulting plan in due course".
Read the government's response ↗ Read the report ↗ Report an error
How the inquiry ran
Each dot is a dated item listed on this page, from the inquiry's opening on 19 January 2023 to its close on 21 July 2023. The dashed mark is the deadline Parliament records for the government's response.
- Report 12 May 2023
- Government response 21 Jul 2023
- Correspondence 14 Mar 2023
What it recommended 4 recommendations · 20 conclusions
2Require Cabinet Office to improve customer forecasting and UKSV resilience to demand changes.
Recommended (the committee's words)
The Cabinet Office is over reliant on customer demand forecasts and failed to predict changes in demand for security vetting. UKSV’s customers provide demand forecasts each October to enable it to assess what level of resources it will need for the following financial year. UKSV relies on customers to provide accurate forecasts but these vary in quality, and it is aiming to work more closely with customers to help them improve their forecasts through better use of data. While it is unsurprising that forecasts for 2020–21 did not anticipate the reduced demand that COVID-19 lockdowns caused, UKSV and its customers failed to anticipate a resurgence of demand once COVID-19 restrictions were lifted. UKSV argues that the changing threat environment and wider societal changes in the employment market added to demand in a way that was not anticipated beforehand. This is not the first time UKSV has been impacted by a sudden increase in demand, for example it saw a similar trend following the Brexit vote in 2016. Recommendation 2: The Cabinet Office should set out what steps it is taking to help its customers improve their forecasting and to make UKSV more resilient to changes in demand.
3Develop Cabinet Office plan to avoid repeatedly extending DV security clearance renewals.
Concluded (the committee's words)
We are concerned about the level of risk created by the Cabinet Office’s decision to repeatedly defer renewals for DV clearances. Existing DV clearances are 6 The performance of UK Security Vetting normally reviewed after seven years to ensure that individual’s circumstances have not materially changed and that the initial clearance remains valid. Scheduled and unscheduled aftercare checks in the period between renewals should capture any changes in circumstance that might impact on the clearance. However, UKSV has failed to meet its target for aftercare checks since the start of 2018–19; and to manage demand, the Cabinet Office Government Security Board decided to extend most DV renewal clearances in 2018, 2019, and 2020. In 2021–22, the consequent backlog of renewals overwhelmed UKSV and in April 2022 the Government Security Steering Group directed UKSV to extend renewals yet again, so UKSV could focus on reducing the backlog of new DV clearances that had developed. UKSV and its customers acknowledge that continually deferring renewals creates risks that are uncomfortable. UKSV claims that, as it has always adopted a risk-based approach to deferrals, that any renewals with known red flags were still thoroughly reviewed. It also argues that prioritising new DV clearances rather than renewals was a sensible risk-based decision. Focusing on new DV clearances, however, also placed further pressure on UKSV’s processing of CTC/SC clearances, which saw clearance times increase and backlogs grow even higher in 2022. Recommendation 3: The Cabinet Office should develop a plan for how it intends to avoid repeatedly extending DV renewals going forward, and set out the key elements of this plan in its Treasury Minute response. The plan should include, for example: • when it expects to be able to renew all DV clearances rather than automatically extending low-risk cases • how it intends to provide the additional staff resources required to renew all DV clearances • what steps i
4Require Cabinet Office to detail UKSV's required resourcing and close staff shortfalls.
Recommended (the committee's words)
UKSV cannot deliver timely security vetting across government with its current staff levels. Despite its essential role in protecting national security, UKSV has been under-staffed to meet customer demand forecasts since its inception in 2017. In April 2021, when faced with an upsurge in demand for its services following the relaxation of COVID-19 restrictions, UKSV had a 32% shortfall in staff resources. In November 2022 it was still 23% short of estimated need, including digital staff required for the vetting transformation programme, despite securing additional contingent labour and temporary staff from other departments. UKSV says its resourcing levels meant it had to make difficult decisions as to which service areas it prioritised, with aftercare checks one area that suffered as a consequence. The Cabinet Office expects some of the slack to be addressed through higher pay for digital staff and increased automation as part of its vetting transformation programme, although it accepts that the completion of transformation is some way off. To compound matters, survey results show low levels of engagement among UKSV staff. UKSV’s Chief Executive says that her staff have an immense pride in the organisation but also acknowledges they are suffering from ‘change fatigue’. The performance of UK Security Vetting 7 Recommendation 4: The Cabinet Office should set out: • what resourcing levels UKSV needs to make progress with its transformation programme and to achieve its service level agreements for customers’ forecast demand in 2023–24 • what the agreed level of resourcing is for 2023–24, and • if there is a shortfall, how UKSV is expected to close that gap
5Review UKSV's governance structures to enable urgent security vetting transformation programme.
Concluded (the committee's words)
The governance structure of UKSV within Cabinet Office is a barrier to transformation. UKSV’s chief executive and the government chief security officer have low levels of delegated spending authority which means they require approval from the Cabinet Office Approvals Board for any spending over £500,000. That Board has repeatedly refused to give spending approval for the £40 million vetting transformation business case. UKSV’s Chief Executive cited governance around investment and the change agenda as problematic in replacing the legacy system, and three reviews of the transformation programme included governance in their array of concerns about the deliverability of the programme. The Cabinet Office acknowledges that its cautious approach is delaying the much needed and widely supported transformation programme but says that it is better to be cautious than to spend unwisely. Recommendation 5: The Cabinet Office should urgently review UKSV’s governance structures to assess whether they provide the correct balance of challenge and support to enable UKSV to achieve the much-needed security vetting transformation programme. It should summarise the findings of this review in its Treasury Minute response.
6Set out a clear implementation plan for security vetting transformation with realistic milestones.
Recommended (the committee's words)
We are not convinced that current plans for the transformation of security vetting are any more likely to succeed than previous failed attempts. The Cabinet Office’s first attempt at modernising the IT infrastructure for national security vetting failed, after unknowingly running almost 50% over budget and resulting in a £2.5 million write off in the Cabinet Office’s 2021–22 annual accounts. Despite broad consensus on the need for the transformation programme across government, which customers have already funded, subsequent attempts at vetting reform have been stymied by the lack of spending approval and the priority given to the stabilisation programme over the transformation programme. After multiple failed attempts to get Cabinet Office spending approval for the whole Vetting Transformation programme, in December 2022 UKSV changed its approach and finally got spending approval for the development of just the first of three new vetting levels. As a result of the delays, UKSV anticipates it will have to refund around £5 million to customers. UKSV’s Chief Executive says she is confident that adopting a more iterative approach will be more successful. We would like to share her confidence but the track record for transformation to date does not bode well for the future. In our view, until such time as the Cabinet Office starts to take its responsibility for national security vetting more seriously, shows more confidence in UKSV and provides more support, it is unlikely that transformation will be fully achieved. 8 The performance of UK Security Vetting Recommendation 6: The Cabinet Office should set out a clear implementation plan for vetting transformation, with interim milestones for each of the new vetting levels and a realistic completion date. It should set out the key elements of this plan in its Treasury Minute response to this report. The performance of UK Security Vetting 9 1 UK Security Vetting’s poor performance and remedial actions
1UK Security Vetting is the main government provider of national security clearances.
Concluded (the committee's words)
On the basis of a report by the Comptroller and Auditor General, we took evidence from the Cabinet Office about the performance of UK Security Vetting (UKSV).1 UKSV, which sits within the Cabinet Office, is the main government provider of national security vetting. Security vetting provides assurance on individuals working with government assets and classified information. There are several different types of vetting levels with the most common being Counter Terrorist Checks (CTC), Security Checks (SC) and Developed Vetting (DV). DV clearance is the most complex and allows individuals access to more sensitive government information and assets than CTC or SC clearance.2
7Cabinet Office lacks evidence on job abandonment caused by security vetting delays.
Recommended (the committee's words)
The Cabinet Office could not provide us with any information on how many people were abandoning jobs due to vetting delays. The NAO reported that cancellations of clearance requests were 19% higher from April to November 2022 compared with the same period in 2021–22, and that requests were most likely cancelled because the individual being vetted secured an alternative job. The Cabinet Office said at our February session that it had done further research following the NAO report and expanded on the list of reasons why individuals may no longer need a clearance, such as retirement, moving to a job with lower security status or simply failing to provide the information in time and therefore being timed out. It claimed that “the cancellations are not people pulling out of the process” and that “for the moment at least, there does not seem to be any evidence that, even in a very competitive job market, the vetting process is losing good candidates”. The Cabinet Office also considered that the increase in cancellations was proportionate to the overall increase in the number of cases received.16 Poor demand forecasting and lack of resilience
8UKSV struggled with fluctuating demand and significant increases for security clearances.
Concluded (the committee's words)
UKSV relies on customer demand forecasts in October ahead of each financial year, to enable it to plan for the resources it will need. For 2020–21, customers over-forecast how many clearances they were likely to need, unaware of the coming COVID-19 pandemic, which caused a drop in demand for clearances. Conversely, during 2021–22 customers under-forecast their demand in 11 out of 12 months as the employment market changed as COVID-19 restrictions eased. Overall, in 2021–22, demand for DV clearances increased by 57% and demand for CTC/SC clearances increased by 60%.17 UKSV struggled to cope with this increased demand, in much the same way that it did when there was an increase in demand after the Brexit referendum which required increased resources to plan the UK’s exit from the EU.18
9UKSV improves customer demand forecasting for security clearances using enhanced predictive analytics.
Concluded (the committee's words)
The Cabinet Office told us that while some departments are very good at forecasting, others struggle. UKSV has therefore put a lot of effort into improving its management information to help it work with customers on predictive analytics, to improve the accuracy of their forecasts. The Cabinet Office said UKSV now has a better understanding of the policies and programmes that drive customer demand.19 The government chief security officer attributed the significant level of customers’ under-forecasts in 2021–22 to three factors: underestimating the supressed demand post-COVID; a failure to take account of the changing threat environment; and underestimating societal and employment changes in 2021–22, such as the doubling of moves within the Civil Service after COVID-19.20
10UKSV improves resilience through enhanced forecasting, increased automation, and flexible resourcing models.
Concluded (the committee's words)
When we asked what was being done to make UKSV more resilient and better able to deal with future upsurges in demand, the Cabinet Office offered us three solutions: 15 Q 26 16 Qq 22, 23; C&AG’s 2023 Report, Figures 10 and 11 17 C&AG’s 2023 Report, paras 2.3, 2.4 and Figure 7 18 C&AG’s Report, Investigation into national security vetting, Session 2017–2019, HC 1500, 7 September 2018, para 3.4 19 Q 27 20 Q 28 12 The performance of UK Security Vetting i) improvements in forecasting (see above). ii) increased automation: it said around 20% of the overall operation is currently digitised, and there are plans to increase that up to 30% and then 40% “over the next few years”, although the Cabinet Office expressed disappointment that its progress on this front was slower than hoped.21 To date the focus has been on automating the lower-level, more transactional, security clearances including the new accreditation checks for the aviation industry.22 iii) a more flexible resourcing model which offers extra capacity through the use of temporary contractors:23 The Cabinet Office referred to its use of staff from other departments including HMRC and military police as well as contractors (see below).24 It explained that it had also secured increases in productivity through changes to process and policy and by setting staff individual targets.25 Risks from deferred vetting renewals
11Repeated deferrals of Developed Vetting renewals created backlogs and acknowledged security risks.
Concluded (the committee's words)
Each DV clearance is normally reviewed after seven years to ensure that individuals’ circumstances have not materially changed and that the initial clearance remains valid. In 2018 the Cabinet Office Government Security Board first took the decision to implement a 12-month extension to some renewals to help UKSV recover performance at that time. It repeated the decision in 2019, and then again in April 2020 to help cope with the impact of the COVID-19 pandemic on operations. In 2021–22, however, all DV renewals that had previously been extended came back up for renewal and were not extended again, meaning that a backlog of cases needed processing.26 In April 2022, the Government Security Steering Group directed UKSV to extend renewals again to focus on reducing the backlog of new DV clearances that had developed. The NAO reported that both UKSV and its customers acknowledge that another extension of renewals carries security risks that are uncomfortable.27
12Prioritising new Developed Vetting clearances causes service level deterioration for other clearance types.
Concluded (the committee's words)
The Cabinet Office defended the repeated policy decision to defer renewals on the grounds that it was “risk-based and a decision taken with our customers”. It acknowledged that the cumulative impact of deferring renewals for several years created additional challenges but also said that “if you have a choice between waiting nine months for someone to come in and do a critical job, or extending a renewal that has been in place for seven years and no risks have been identified with the individual, all the customers around the table agreed that that was the preferable way to go”. It said the decision to defer renewals and to prioritise new clearance applications meant that it was able to reduce the processing time for new applications to 177 days at its worst, to the current 98 days.28 However, with limited resources, prioritising one area has inevitably led to deteriorating 21 Qq 6, 35 22 Qq 36, 37 23 Q 37 24 Qq 40,41; C&AG’s 2023 Report, paras 2.9, 2.10 and Figure 9 25 Qq 43, 44, 45 26 Q 29; C&AG’s 2023 Report, para 2.5 27 C&AG’s 2023 Report, paras 2.6, 2.7 28 Qq 9, 10, 29 The performance of UK Security Vetting 13 service levels in other areas; as new DV clearances were prioritised at the start of 2022, the percentage of CTC/SC clearances that were being processed within target times slipped further.29
13UK Security Vetting consistently fails to meet targets for aftercare checks.
Concluded (the committee's words)
The Cabinet Office sought to reassure us that UKSV did not stop processing renewals altogether, but that it had continued to process renewals at a lower rate, adopting a risk- based, data-driven approach. “Should an adverse indicator arise [from newly introduced automated data checks], we absolutely then moved forward with the full process”.30 One such means of detecting such an indicator is an aftercare check, which should occur between the initial clearance and a full renewal with the aim of capturing any changes in circumstances that might impact on the clearance. UKSV aims to complete 85% of scheduled aftercare checks within 95 days but has failed to meet that target once since the start of 2018–19.31 The Cabinet Office defended this risk-based approach saying that UKSV would rather take time to work with individuals to mitigate risks and achieve the right outcome even if it meant failing to achieve a KPI,32 and that it had introduced a triage approach across national security vetting to ensure a focus on high-risk cases.33 Staff resourcing constraints
14UK Security Vetting has experienced persistent and significant understaffing since inception.
Concluded (the committee's words)
UKSV has been under-staffed to meet customer demand forecasts since its inception in 2017, which has had negative impacts on its performance. In April 2021, when demand surged following the relaxation of COVID-19 restrictions, UKSV had 669 full-time equivalent (FTE) staff against the 985 FTE it expected to need to meet forecast demand during 2021–22, a shortfall of 316 FTE (32%). Despite seeking to recruit throughout the financial year, by March 2022 UKSV still had a 237 FTE shortfall against its requirement for that year. Based on customer demand forecasts for 2022–23, UKSV estimated it would require 1,145 staff for that year but by November 2022, UKSV had increased its FTE headcount number to only 877 (23% short of estimated need).34 The gap between actual staff and the forecast need for staff is shown at Figure 1. 29 C&AG’s Report, Figure 2 30 Q 12 31 C&AG’s Report, para 1.9 and Figure 6 32 Q 30 33 Q 34 34 C&AG’s Report, paras 2.9, 2.10 and Figure 9 14 The performance of UK Security Vetting Figure 1 – UK Security Vetting’s actual headcount (FTEs) vs forecast required headcount, April 2021 to November 2022 Source: C&AG’s Report, Figure 9 on Page 32
15UKSV understaffing necessitates service trade-offs, impacting aftercare checks and DV renewals.
Concluded (the committee's words)
Under-staffing has led UKSV to make trade-offs in what service areas it focuses on. For example, the UKSV chief executive told us that by focusing on new DV clearances it was unable to resource aftercare checks to the levels needed.35 Likewise, the focus on new DV clearances saw average clearance times drop for those cases but for DV renewals, average clearance times increased from 190 days in April 2022 to 255 days in November 2022.36
16UK Security Vetting's current staffing remains significantly below estimated operational requirements.
Concluded (the committee's words)
The Cabinet Office was keen to point to UKSV’s use of surge staff from other departments,37 although there were just 13 such staff between January and November 2022 alongside about 50 contingent labour staff (see also Figure 1).38 It said the use of more contingent labour solved the need to fit within wider Civil Service aspirations around headcount numbers, although “by the time you recruit, you vet and you train, it takes a long time.”39 The Cabinet Office expects UKSV to maintain its own headcount number at no higher than 832 FTEs at March 2023. It has, however, authorised an additional 163 contingent labour and temporary staff from other government departments, bringing the total to 995, still 160 short of the estimated requirement of 1,145. UKSV aims to bridge that gap through efficiencies and automation of processes coming out of its delivery stabilisation plan.40 As well as internal changes to increase productivity, the Cabinet Office told us UKSV was working with departments to improve the accuracy and completeness of applications, to reduce the amount of remedial action required from UKSV staff, which restricts their productivity.41 35 Q30 36 C&AG Report, Figure 8 37 Qq 40, 41 38 C&AG’s Report, Figure 9 39 Q 43 40 C&AG’s Report, para 2.10 41 Q 50 The performance of UK Security Vetting 15
17UK Security Vetting staff suffer significant change fatigue from continuous organisational shifts.
Concluded (the committee's words)
When asked about the mismatch between UKSV’s claims of increased productivity and staff survey results showing a high level of disengagement, UKSV’s chief executive pointed to the innate pride of its staff in the work they do to protect national security but admitted that many are suffering from change fatigue. Staff have had to contend with the move of vetting services from the former Foreign & Commonwealth Office and MOD to the Cabinet Office, changing systems, processes and policies and most recently, changes to some of the skills and tools staff use for vetting because of digitisation and automation.42 UKSV’s chief executive suggested that staff “would like a bit of stability and some investment” as “they have not had a period of stability for a very long time”.43
18Recruitment challenges for digital roles severely impede the vetting transformation programme's progress.
Concluded (the committee's words)
Recruitment challenges have also hampered progress on the vetting transformation programme. In November 2021, UKSV only managed to fill five out of 44 digital roles despite multiple costly, labour-intensive campaigns, with uncompetitive salaries seen as a key factor. In September 2022, despite a partial exemption for digital roles from the Cabinet Office recruitment freeze, UKSV’s resource modelling still showed a shortfall of 68 full-time equivalents (FTE) for digital roles against a total requirement of 108.44 The Cabinet Office downplayed the issue saying “trying to get the right number of permanent and temporary staff and then to train those up, took a bit longer, so we were a bit below our optimum resourcing level”.45 It told us it had recently moved to strengthen the pay scales across digital, data and technology across the Civil Service, but accepted that progress with the vetting transformation programme had been slower than it would have liked and that transformation was still some way off.46 42 Qq 52, 53; C&AG’s Report, para 2.12, Figure 12 43 Q 55 44 C&AG’s Report, para 3.13 45 Q 72 46 Qq 35, 89 16 The performance of UK Security Vetting 2 Transforming national security vetting Governance
19Cabinet Office maintains tight control over UKSV headcount and major programme spending.
Concluded (the committee's words)
The Cabinet Office took on responsibility for both security vetting policy and operational delivery in April 2020, when UKSV transitioned from the Ministry of Defence to the Government Security Group within the Cabinet Office.47 The Cabinet Office controls UKSV’s headcount, and while UKSV’s funding costs (around £43 million per year) are covered by its customers, it nonetheless requires spending approval from the Cabinet Office Approvals Board (COAB) for any programme spend over £500,000.48 In January 2021, the Cabinet Office appointed a chief executive to run UKSV, who reports to the government chief security officer. Other than COAB, UKSV is also accountable to the Government Security Board, the Vetting Board, and the Vetting Modernisation Portfolio Board for its operations and programmes.49
20UKSV's £40 million transformation programme business cases have faced repeated rejection by COAB.
Concluded (the committee's words)
UKSV has been trying, largely unsuccessfully, to modernise the vetting system since it launched a Vetting Reform programme in 2019.50 UKSV’s Chief Executive said, “if we had a magic wand and we could build a new system tomorrow, we absolutely would”.51 Whenever it has taken full business cases for its £40 million transformation programme to COAB, however, these have been rejected. Three reviews of the programme in 2022 raised concerns across multiple areas of programme management, including the governance arrangements with one noting the need for greater support within the Cabinet Office.52 The Cabinet Office defended its cautious approach to the transformation programme, which it attributed to concerns around its deliverability and the need to prioritise performance recovery over transformation, saying it was better to be cautious than to spend unwisely.53
21Extensive governance and customer consensus requirements impede UK Security Vetting's change programmes.
Concluded (the committee's words)
When asked about her past experiences, UKSV’s chief executive cited governance as the main difference between her experience of running a government change programme compared with running a private sector change programme.54 She said that there was a lot of governance around investment and the change agenda, as UKSV had to ensure that “every customer is comfortable with everything we are planning to change”.55 This was endorsed by the government chief security officer who said the transformation programme had been “agreed at every step with customers in the security world, through the government security board, but also with chief operating officers and Perm Secs”.56 Achieving transformation of security vetting
22Previous IT modernisation efforts led to significant budget overruns and project failures for UKSV.
Concluded (the committee's words)
As part of the Vetting Reform programme, the Cabinet Office planned to replace UKSV’s legacy IT system, the National Security Vetting System, through the Future Vetting System programme, by February 2020 at a cost of £19 million. Failures in project management meant that the programme ran £9 million over budget and resulted in a 47 C&AG’s Report, para 3.5 48 C&AG’s Report, paras 1.2, 2.10 and Footnote 8 49 C&AG’s Report, para 3.15 50 C&AG’s Report, para 3.3 and paras 3.7 to 3.12 51 Q 62 52 C&AG’s Report, para 3.11 and Figure 15 53 Qq 74, 80; C&AG’s Report, paras 3.11 and 3.12 54 Q 78 55 Q 63 56 Q 82 The performance of UK Security Vetting 17 £2.5 million write off in the Cabinet Office’s 2021–22 accounts.57 The IT modernisation programme was subsequently rolled into the wider Vetting Transformation programme. After several failed attempts to get business case approval for the whole transformation programme, in December 2022 UKSV successfully submitted a less ambitious business case for the development of just the first of three new levels of vetting.58 UKSV is expecting to seek approval for the next level of transformation in summer 2023 and agreed that it is unlikely to be completed until 2025.59 When asked what had gone wrong previously and what she would do differently next time, UKSV’s chief executive said that they would replace the previous “big bang approach” with a “very agile, iterative and low-risk rollout approach” and that she had high expectations that the next version of the business case would be approved.60
23Cabinet Office's cautious approach delays Vetting Transformation programme following past IT modernisation failures.
Concluded (the committee's words)
The Cabinet Office told us that following its bad experience with its first attempt to modernise IT, it was now adopting a more cautious approach to transformation, and that it rejected the business plan for the Vetting Transformation programme on a few occasions because it was “not totally happy with the plan” and wanted to “be sure that this one was going to work”. It accepted that it had been a little optimistic about the achievable rate of transformation, but also pointed out that the need to focus on catching up with the level of demand for the day-to-day business, meant that it had had to push the transformation programme to the right, with customers’ agreement.61
24Vetting transformation customers frustrated by programme delays, lack of input, and substantial underspend.
Concluded (the committee's words)
The Cabinet Office was keen to confirm that it has full customer support for vetting transformation.62 For example, centralised decision making is an important component of the transformation plan whereby UKSV takes the whole decision on clearance rather than allowing departments to make the final decision based on UKSV’s advice.63 The Cabinet Office told us that 70% of all decision are now centralised with customers signed up to this approach.64 It did, however, acknowledge that UKSV may have to offer additional checks to all customers to assuage the concerns of others who consider their business has special requirements and to drive transferability of checks between departments.65 UKSV’s customers are frustrated with the lack of progress on the transformation programme. They fund the programme but have no say in how that funding is used. UKSV was forecasting an underspend of £6.5 million on the programme in 2022–23 due to delays in getting Cabinet Office approval for the business case, delays to progress on the plan and delays in resourcing. With an overspend of £1.5 million elsewhere across the business it was anticipating refunding around £5 million to customers in 2022–23.66 57 C&AG’s Report, para 3.7 58 C&AG’s Report, para 3.10 and Figure 14 59 Q63; C&AG’s Report, para 3.10 and Figure 14 60 Q 75 61 Qq 74, 80, 82 62 Q 82 63 C&AG’s Report, para 3.8 64 Qq 35, 66 65 Q 67 66 Q 72; C&AG’s Report, paras 3.14 and 3.15 18 The performance of UK Security Vetting