NS&I’s transformation programme

NS&I’s positive news culture has meant it has not learned lessons, which has affected its ability to deliver the programme. NS&I told us that that it promotes a “can do” attitude and culture; while this has benefits in encouraging commitment to NS&I and to transformation, NS&I acknowledges that it has been over-confident about its ability to deliver 3 the Programme. The Government Internal Audit Agency’s December 2024 review of NS&I’s culture found that its leaders were not taking responsibility for taking action to address issues raised. NS&I says it understands that its transformation will require a change in mindset and accountability, but it was not able to tell us how it would do this. Instead, when asked about a “positive news culture” which can result in decisions not made and disagreements not resolved, NS&I’s leadership continued to emphasize positive scores from staff engagement surveys. As these surveys only capture employees’ views, it does not give it an external perspective. The external organisations that have reviewed the programme told the NAO that NS&I was often slow to act on advice, or did not act. recommendation NS&I should seek positive attestation from NS&I non-executive directors and from the Treasury, that: • NS&I has implemented recommendations from the culture review and other recent reviews; and that • NS&I’s leadership has demonstrably learned lessons as the Programme has progressed

It has taken NS&I far too long to develop a risk management framework, which has left the taxpayer exposed to unacceptable risks. NS&I launched multiple procurements and planned to deliver four transitions in parallel with no understanding of the risks this was exposing the organisation and its customers to. The programme was rated high- risk by external reviews on several occasions, but NS&I has not shown it can manage the risks effectively. In 2025, NS&I implemented a new Risk Management Framework, but it is not yet fully embedded. There are still many risks for the Programme to manage, for example the replacement of core banking engine is extremely high risk, but the main work has yet to start. NS&I is bringing in skills through its new System Integrator (CapGemini), but it is not yet clear that NS&I is listening to what it has to say about the realism of the timetable and the delivery risks. Programme governance has been strengthened, with the Treasury instigating the main changes by appointing new non-executive directors to NS&I, establishing a new committee to scrutinise the programme and by appointing David Goldstone in an advisory capacity. recommendation a. NS&I should ask Mr Goldstone to review how the Programme is applying the new risk management framework, and identify what additional support is needed. 4 b. By June 2026, NS&I should write to the Committee setting out the progress implementing its risk management framework, and how NS&I will strengthen and fully embed the framework in its operations.

NS&I has failed to support the Programme with the skills and expertise it needs to deliver successfully. As an organisation with most of its operations contracted out to Atos, it is not surprising that NS&I had limited experience of digital transformation when starting the Programme. NS&I told us it has found it difficult to recruit the additional skills and capability the Programme needs. Since 2024, NS&I has added capability at senior levels, for example, by appointing a new commercial director, but it still relies on consultants to fill skills gaps. NS&I has made very substantial (£43 million) use of consultants in the Programme, but was vague about how it holds consultants to account. NS&I said it has more staff now, but it still does not have a resource management strategy in place. NS&I will continue to rely on Atos, which suffered financial distress in 2024, until at least 2028. NS&I told us it now has a contract management framework to manage Atos and the contracts with new suppliers, but it will need to be much better at managing supplier contracts to maximise the benefits of transformation. recommendation Within six months, NS&I should write to the Committee setting out its resource management strategy, including use of consultants, and how it will ensure that it manages consultants effectively. NS&I should also set out more clearly how it will manage suppliers and contracts, to manage risks in moving to the multi-supplier model.

NS&I’s governance structures still do not have the performance metrics and information needed to hold the Programme to account. It is difficult to establish the cost of the Programme from the information provided by NS&I. The Treasury told us that, outside the times where it was being asked to approve a formal business case, it found it challenging to understand the cost and progress being made by the Programme. The NS&I witnesses could not tell us how much had been spent on the Programme to date, which is deeply concerning. NS&I said it had improved its financial reporting and had ‘the right data’, but was finding it challenging to take the data from its system and to ‘present’ it. NS&I’s annual report and accounts state that it is meeting its overarching corporate metrics, including the important measure of how much finance it raises for government; but those metrics do not cover Programme progress. There are risks to NS&I’s whole business—and especially to customers—if the Programme is unsuccessful, and NS&I needs to show greater transparency in how the Programme is progressing. 5 recommendation NS&I should set out how it will amend its overall reporting, both internally and externally, to include additional metrics around the Programme including its cost and progress.

The programme had suffered several serious setbacks before the Treasury gave it the attention it deserved. While NS&I is responsible for the Programme, the Treasury is NS&I’s sponsor department and, given its wider role in promoting good practice in managing major programmes and the high risk that the Programme delivery carried, we would have expected the Treasury to have been more heavily involved from the start. The Treasury had applied its usual scrutiny to the Programme’s Outline Business Case in 2020 and Full Business Case in 2023, approving each subject to conditions, but there were no consequences for not delivering. The Treasury that has been more interventionist since 2024, and told us it acknowledged that it should have intervened much earlier in the Programme. The Treasury expects NS&I to say whether it can deliver within budget when it has an agreed integrated plan, but was vague on how it would assess requests for more funding. We are concerned if further funding were to be approved without real assurance that NS&I can demonstrate it has a realistic plan. recommendation a. The Treasury should report to the Committee setting out more clearly how it will assess NS&I agreed integrated plan, including the sufficiency of its budget for the Programme. b. The Treasury should set out what it has learned from its oversight of NS&I’s Programme, and examples of what it has changed in how it looks at government activities more generally. 6 1 Causes of failure to deliver the Programme Introduction

On the basis of a report by the Comptroller and Auditor General, we took evidence from National Savings & Investments (NS&I) and from HM Treasury (the Treasury) on NS&I’s Business Transformation Programme.1

We asked NS&I why it had been trying to do such a complex Programme, splitting operations undertaken by a single supplier into a multi-supplier model, in such a risky way. The NAO report shows that NS&I original planned expected four transition stages to happen largely at the same time, and NS&I accepted that it was originally trying to do too much at once, and that it should have recognised this before 2024, taken a step back and re-evaluated, and made sure that it had a viable implementation plan. NS&I said it originally wanted to do things in a more sequential way, and suggested it had been forced to change approach when it had been unable to award a contract (for the second phase, customer experience) as planned.11 5 C&AG’s Report, para 13 6 Committee of Public Accounts, Government’s relationship with digital technology suppliers, Twenty-Seventh Report of Session 2024–25, HC 640, 6 June 2025, para 2; C&AG’s Report, Government’s approach to technology suppliers: addressing the challenges, Session 2024–25, HC 543, 16 January 2025, para 3 7 C&AG’s Report, para 10 8 Q 1 9 C&AG’s Report, para 10 10 Qq 5, 15 11 Q 11; C&AG’s Report, Figure 6 8

In December 2025, after five years, NS&I still has no agreed and approved integrated plan to indicate a Programme end date and milestones. NS&I has repeatedly failed to deliver such a plan.12 At our session in December 2025, NS&I said its system integrator Capgemini had now developed a draft plan, which showed that the Programme would run beyond March 2028. NS&I is now doing a re-planning exercise to try and compress the work and bring this end date forward. NS&I said it would take advice from David Goldstone on this work.13 NS&I could not tell us how much the plan would need to be adjusted, but claimed this would add months not years, and said it was aiming to finish its replanning by March 2026.14 This would leave just two years to complete the Programme before the Atos contract is due to end in March 2028.15 When pressed for whether it could deliver before the Atos contract ends, NS&I acknowledged it would look at extending the Atos contract, potentially to 2031, which would imply a further delay of 3 years and additional cost from the longer timeframe.16

In the absence of a complete and approved integrated plan, NS&I was unable to provide us with an updated estimate of Programme costs. It had spent £111 million on the Programme by March 2024, but could not give us a newer spend-to-date figure in our December 2025 evidence session, despite telling us it had the financial data to “make the right decisions at the right point”.17 It claimed to have the “routes, mechanisms and people” to deliver the Programme to the plan that it has not yet finalised, but also told us that it had not yet completed a “reset” of the commercial contracts so there is not yet “real solidity” of the milestones and deliverables; this means costs could increase further.18 NS&I agreed that the Programme cost would likely exceed the available budget, and expects to discuss this with the Treasury.19 The Treasury was clear that there would need to be further discussions with Ministers should NS&I require additional budget to that agreed in the spending review.20 This means NS&I could not give us any confidence that it yet has reliable estimates of how much the programme would cost. It could only point to the work in progress on the integrated plan, that might allow it to do so by March 2026.21 12 C&AG’s Report, paras 14 and 3.15 13 Qq 19-20 14 Qq 12, 74-75 15 Qq 12-13; C&AG Report para 10 16 Qq 76-77 17 Qq 18, 56, 79 18 Qq 23-25 19 Qq 13, 25 20 Q 27 21 Q 12 9

Despite the lack of information on timetable and cost, NS&I claimed it was confident that it could find a way to deliver the Programme by 2028, by “deprioritising” some aspects of the Programme.22 When asked how it could be confident without an agreed integrated plan, NS&I could only say this was a “good question”.23 NS&I acknowledged it should have appointed a “big, heavyweight” systems integrator earlier, and said this could have improved its planning process.24 When asked what evidence or assessment had led it to conclude that the Programme’s approach of introducing multiple contracts to manage would be easier than managing one large contract, it had no answer, other than there were benefits of being able to switch suppliers in future.25

When we asked if decisions were being taken based on evidence, NS&I said that “there is always a chance that assumptions are incorrect”.26 The National Infrastructure and Service Transformation Authority had found that NS&I’s understanding of the alternative approaches had not been robust, and NS&I said its understanding had improved since the Programme started. However, it also sought to blame Atos’s financial difficulties, saying it had needed to spend time, energy and resources developing continuity plans instead of on the Programme.27 NS&I dismissed suggestions that it should have done more work at the start, saying “you can always do more analysis”, and appeared to blame suppliers for not bidding for Programme contracts.28 A good news culture can prevent lessons being learnt

The external organisations that have reviewed the programme told the NAO that NS&I was sometimes or often slow to act, or did not act at all, on advice.29 We asked whether NS&I’s leadership had learned from the issues with the Programme. NS&I offered two lessons: it acknowledged that it had over-estimated the complexity of the Programme; but then claimed there was a positive lesson because it had continued to operate the organisation as a whole despite the delays.30 When asked if it regretted that more money 22 Q 21 23 Q 23 24 Qq 1-2 25 Q 6 26 Qq 7-8 27 Q 9 28 Qq 10-11 29 C&AG’s Report, para 19 30 Q 1 10 was being spent on the Programme instead of being available for improving public services, it could only reiterate how much funding NS&I had raised for government through its activities.31

We asked the chief executive if he was creating a ‘good news’ culture, which the NAO has identified as a factor in why programmes resets may not work, and which can lead to a situation where decisions are not made and disagreements between stakeholders are not resolved. He told us that having a “can-do” attitude meant NS&I staff were committed to its objectives and transformation, which was “invaluable”, and he was pleased to see higher scores on NS&I’s recent annual staff engagement survey.32 But these scores do not give a full view of the lack of progress on the Programme because the survey only covers NS&I employees and not the large number of suppliers working on the Programme, meaning NS&I is missing an external perspective.33 We questioned whether NS&I had taken action to ensure a “good news culture” did not prevail, but NS&I gave us no details, and could only acknowledge the importance of the tone set from the top.34 NS&I conceded there had been occasions when its culture led to staff being overly optimistic about the delivery of the Programme.35

The Government Internal Audit Agency’s review of NS&I’s culture in December 2024, found that staff felt decision-making was slow and hierarchical, decision-making processes were not understood, and there was a lack of transparency within Programme processes.36 NS&I introduced a leadership development programme as a response to the review, and NS&I said that from this it had found that where issues were raised, “there was not always recognition that those leaders in the room were going to address those issues and drive it forward”. NS&I noted that moving to a multi-supplier model takes a shift in mindset and accountability, and that strategic workforce planning and management is a key part of how it continues to develop that capacity to get the change.37 31 Q 4 32 Q 45; C&AG’s Report, para 3.5 33 Qq 50-51, 60-61 34 Qq 47-48 35 Q 46 36 C&AG’s Report, para 3.5 37 Q 49; C&AG’s Report 11 2 Conditions for success Improving understanding and management of risk

In taking forward the Programme, NS&I launched multiple procurements and planned to deliver four transitions in parallel, with no understanding of the risks that this was exposing the organisation and its customers to. NS&I said it had identified supply chain risk as a key area of focus.38 However, NS&I focused more on how it had handled past issues, telling the Committee how it had developed contingency plans when Atos had financial difficulties in 2023; it did not provide evidence that it had considered how to manage the current contracts.39 When asked if it was confident that it had resolved the issues with procurements, NS&I could only say that it had awarded contracts. NS&I acknowledged that these still contain the original milestone dates, which would need to be changed to take account of delays in NS&I’s Programme implementation.40

There are still many risks for the Programme to manage, for example the replacement of the ‘core banking engine’ is extremely high risk, but the main work has yet to start.41 NS&I agreed that when it replaced its banking engine, data migration would be a “huge consideration”, and said it knew this would need to be managed “in minute detail”, but gave no details of how it would do this. NS&I’s contract with Atos to run the banking engine expires in 2028, and it will need a new contract after then to ensure continuity.42

In 2025, NS&I implemented a new Risk Management Framework, but has not yet fully embedded the framework throughout its organisation.43 We wanted assurance that this framework is good enough to ensure that risks to customer data could be managed, and NS&I claimed it was “comprehensive”.44 NS&I did say that it had improved its risk management processes through greater involvement of its risk directorate, but also 38 Qq 6, 11; C&AG Report, para 2.4 and Figure 6 39 Q 65 40 Q 22 41 C&AG’s Report, paras 20 and 24 42 Q 78 43 C&AG’s Report, para 3.23 44 Q 66 12 said that it was relying on GIAA, as “we accept that we do not have all the expertise in these areas”.45 GIAA is intended to be an internal audit function which should be assuring risk management, rather than doing the work. Having the right skills and capability to deliver the Programme

NS&I had most of its operations contracted out when starting the Programme, and it had limited capability to deliver a digital transformation.46 NS&I told us it has found it difficult to recruit the additional skills and capability the Programme needs. It has made substantial use of consultants in the Programme, spending £43 million on advice.47 NS&I has found it particularly difficult to recruit technical roles, and is using secondments and temporary staff from other departments and the private sector, saying “it would not have made sense” to recruit into permanent roles.48 Since 2024, NS&I has added capability at senior levels, for example, by appointing a new commercial director, but it still relies on consultants to fill skills gaps.49

We pushed NS&I to tell us if it now had the skills and capability it needed. NS&I acknowledged that it had needed to bring in more capability, including in systems integration and at senior levels.50 It also, eventually, recognised that for a Programme “this big and complex, we will not have all the skills”. NS&I said it now has non-executive directors with private sector experience of digital transformation. The Treasury added that appointing non-executive directors (NEDs) was giving it more confidence that costs were being managed by NS&I.51 The Treasury also noted that as this was a complex programme, a systems integrator is “very necessary”.52 This had not been in place from the start, and we noted that not managing systems integration is the cause of problems on other programmes.53

NS&I said it was now developing a plan for workforce management in a more structured way, but did not provide details.54 It had identified the need to transfer knowledge from consultants to permanent staff.55 Its recruitment 45 Q 63 46 C&AG’s Report, paras 8, 13 47 Q 67; C&AG’s Report, para 3.10 48 Qq 67, 69 49 C&AG’s Report, paras 3.10 and 3.11 50 Qq 22, 35 51 Qq 37-38 52 Q 70 53 Q 73; C&AG’s Report, paras 15 and 21 54 Q 22 55 Q 36 13 increased the NS&I headcount from around 200 to over 350 people.56 This includes increasing its commercial team fourfold.57 It said this increase was temporary, and that its target was 270 people.58 NS&I tried to claim that the additional costs of these extra people were built into the budget, but we were sceptical of this given that NS&I’s latest cost estimate is from 2024.59 We noted that adding more skilled capability would increase costs; while NS&I initially claimed this was accounted for in its estimates, it later acknowledged that the longer timeframe would mean that costs would increase.60

NS&I will continue to rely on Atos, which suffered financial distress in 2024, until at least 2028. NS&I told us it now has a contract management framework to manage Atos and the contracts with new suppliers. NS&I will need to be much better at managing supplier contracts to maximise the benefits of transformation.61 NS&I told us it now had an additional 75 to 80 people with technical skills from the system integrator.62 When asked how it was judging supplier performance, it said it was paying based on interim milestones, which were being met although it also knows that these will need to be reset in future.63 56 Qq 3, 22 57 Q 7 58 Qq 22-33 59 Qq 36, 79 60 Qq 23-24 61 C&AG’s Report, paras 11, 17 62 Q 22 63 Qq 23, 58-59 14 3 Governance Improving Programme governance and financial reporting

NS&I has its own accounting officer and its own Board, and is responsible for the Programme, while the Treasury is NS&I’s sponsor in government and also has a role overseeing major programmes across government.64 The Treasury told us that it has to judge how it provides this oversight, operating an “earned autonomy model”, so that “If everything is going well, we will leave it more alone, and if not, we will intervene”.65

The NAO found that the Treasury has increased its scrutiny of the Programme since 2024, and had instigated changes to governance, including appointing new NEDs.66 The Treasury noted that it has now moved to a “quite interventionist” approach, but agreed that this could have happened earlier.67 Although the Treasury knew that the programme was already rated “red” in Infrastructure and Projects Authority’s 2022–23 annual report, it took until 2024 to get a grip on the programme and appoint new NEDs, a new chair of the transformation board and, in November 2025, asking Mr Goldstone to look at the programme.68

NS&I said its governance structures had evolved, and it would add more NEDs. It said these changes were improving delivery, but gave no substantive answer to how its governance would ensure problems did not happen again. It also acknowledged that there was still a lack of clarity over the role of governance boards, and said it was again reviewing governance, as a result of the NAO report, to help the programme “deliver at pace”.69 NS&I said that it had only now started reporting programme costs to its transformation and audit committee, which was generating useful insight.70 NS&I said it now added 6 more people in its finance function, an increase of 20%.71 64 C&AG’s Report, para 2 65 Q 69 66 C&AG’s Report, paras 21, 3.18 67 Qq 69, 16 68 Q 16; Infrastructure and Projects Authority Annual Report 2022–23, July 2024 69 Qq 52-53 70 Q 18 71 Q 55 15

The NAO reported that it was challenging to establish the cost of the Programme from the information NS&I provided. NS&I said it was working on improvements to its cost data for its next business case this.72 The Treasury said it had been satisfied by the spend data in each business case it approved, but there was a lack of clarity at other times.73 When challenged on its understanding of cost data, NS&I said it had “access to the information”, but that legacy systems meant it still has “”some more work to do in terms of how we how we present that information”, and that it was “working through” these issues as it developed the new Programme plan.74 It considered that it had made “significant changes” over the last six to eight months, and said it was “good” that GIAA had rated its financial controls as “moderate”.75 GIAA defines “moderate” as meaning “some improvements are required to enhance the adequacy and effectiveness of the framework of governance, risk management and control”.76

The Treasury told us that the lack of transparency from NS&I had made it difficult for the Treasury to understand the reasons for the cost increases, saying it was not always clear whether the funding NS&I received was being used on the Programme or running NS&I. It also said NS&I had been “sluggish” to respond to conditions that the Treasury had set as part of the business case approval.77 NS&I told us that the transformation programme affects its whole business, including all its IT, operations, customer services and products. It claimed it was able to give the information on cost to the NAO, but the NAO report says it had proved “challenging to identify spend to date, and forecast spend for the remainder of the Programme”, and the cost estimates should be “treated with caution”.78

NS&I’s annual report and accounts state that it is meeting its overarching corporate metrics, including the important measure of how much finance it raises for government. There are risks to NS&I’s whole business and to its customers if the Programme is unsuccessful. NS&I agreed that its overall corporate metrics did not measure progress on the Programme. This is despite the risks to customer data and NS&I operations. It accepted that disruption from the Programme could impact NS&I’s operations, but claimed that measuring progress might not “add anything”, despite the Programme taking a lot of senior management time, and suggested delays only impact the “perception” of performance.79 72 Q 57; C&AG’s Report, para 9 73 Q 17 74 Qq 56-57 75 Qq 18, 54-55 76 C&AG’s Report, Figure 9 77 Q 16 78 Q 18; C&AG’s Report, para 9 79 Qq 62-64 16 The role of the Treasury

The Treasury had applied its usual scrutiny to the Programme’s Outline Business Case in 2020 and Full Business Case in 2023, approving each subject to conditions.80 The Treasury said it had been satisfied by the spend data in the business case it approved, but the NAO found that there were errors in the spend reported.81 The Treasury told us it had thought it had clarity on the programme spend when approving the business case, but between business case approvals it had less clarity over spend, the Treasury agreed that money spent on the Programme is not available for other public service.82 The Treasury noted that determining whether the programme is within budget depends on the plan being developed by NS&I.83

The Treasury said its spending review controls require the lead NED on the transformation committee to assure Ministers that the finances of the programme are under control.84, and it now seeks quarterly affirmation from NS&I NEDs on progress before releasing funds.85 We asked the Treasury how NS&I could deliver the programme if the budget had been fixed before the outcome was determined. The Treasury reiterated that the programme needed a plan first, and denied that if NS&I asked for more funding beyond agreed amounts it would automatically get it.86 It acknowledged that Ministers would need ultimately decide whether to increase the budget later, and would expect NS&I to present options for meeting the budget set at the spending review.87 80 Q 18; C&AG’s Report, Figure 9 81 Q 17; C&AG’s Report, para 9 82 Qq 18, 39, 42 83 Q 44 84 Q 16 85 Q 42 86 Q 26 87 Qq 27-31 17