Disclosure and Barring Service: progress review inquiry

Efforts to modernise the DBS are a further example of contracting failure within the Home Office. The DBS still has not delivered its modernisation programme seven years after the programme started in 2012. The DBS took the decision in March 2018 to abandon the development of disclosure certificates and recognised a loss of some £9.4 million in its 2017–18 annual accounts by doing so. Now, it will be forced to use existing infrastructure to issue Disclosures certificates, which means relying on a 17-year old system and shouldering all the associated risks of supporting and maintaining ageing infrastructure. It is not clear to us that DBS has a clear strategy for delivering modernisation. Also, it is now reliant on, and seemingly over-optimistic about, assurances from its prospective new contractors and a discredited old one that handover arrangements between suppliers will be effective so there is no disruption of services during and after the transition period. It is hugely disappointing that, a year after we first took evidence about the programme, negotiations with TCS are still on-going to determine fault for the delays in delivering modernisation. The DBS could not give us any clear indication of when these negotiations would be concluded. The Home Office and DBS made the decision in September 2018 not to extend the TCS contract beyond 31st March 2019 except for a 6 to 12-month extension to facilitate the handover of services to a new contractor. There are clearly risks involved with this timetable given that the DBS are still to appoint a successor contractor and given the DBS’ past track record when handing over such services. Recommendations: The Home Office should write to us before Parliament’s summer recess with an update on progress in transitioning between suppliers, the details of the new supplier and contract arrangements, expectations of deliverables and costs, the TCS exit strategy at the end of the transition period, and the outcomes of the negotiations with TCS over commercial disputes with the DBS. In the same letter, the Home Office should also assess the strength of the DBS’s confidence expressed at the evidence session that the new supplier will be able to pick up TCS’s role quickly and effectively.

DBS is not yet in a position to set out a convincing longer-term vision for its services, and is no further forward with modernisation than it was at the beginning of the process in 2012. It is unclear what “modernisation” now means for the DBS given part of the programme will now be delivered using existing structures and by a new supplier without being modernised. While DBS confirmed that the take up of the Update Service had increased to some 1.8 million subscribers by the end of 2018, it does not expect the number to increase much beyond this level and there does not appear to be a strategy to grow the digital part of the service. In our eyes, this is does not represent either modernisation, or an ambitious longer-term vision: the DBS is not able to convey a clear strategy on how its business will develop and grow. DBS told us that while it owns the intellectual property rights to material developed by the TCS, it does not appear that these rights will be marketable to third parties to generate additional revenue for the UK. This is because custom-made aspects of the system do not, in its view, function effectively It remains unclear what benefits 6 Disclosure and Barring Service: progress review the DBS is expecting to achieve against original expectations for the programme and the lack of an update of the expected benefits further highlights the absence of a coherent strategy. Recommendation: By the end of 2019, DBS should write to us with details of its achievements against benefits promised in the 2012 business case, the strategy it will have in place for further service improvements, and actions it will take to achieve them.

We are concerned about the extent to which the Home Office will take responsibility for turning round the DBS modernisation programme. The Home Office is the parent department, ultimately responsible for improvements and for effective oversight of the DBS. As we reported in May 2018, the Department agreed the original contract in 2012 despite the flaws that have now become evident. Sir Mark Sedwill, former Permanent Secretary at the Home Office (2013–15) and now Head of the UK Civil Service, recognised that “the original business case was highly ambitious and … the institutional capabilities of the agency were over-stretched”. He told us that the programme “was off track and needed action taking” when he joined the Department and described how, in summer 2014, the Department “reset that business case and the entire programme” by changing the scope and timing of the programme. While he acknowledged that “there were some further problems that took it off track” subsequent to the overhaul of the programme, he attributed this to an upgrade of online systems and commercial problems with the providers. The Home Office still has not written to us with the outcomes of its review of lessons learnt from the management of this programme and the failure to deliver intended benefits, as it committed to do following our previous report.

As a result of our May 2018 evidence session and report, the Home Office has now taken action to review the fees charged to the public and employers by the DBS given the surpluses the DBS had amassed over a number of years. It now expects to reduce the fees to be charged across the range of products offered by the DBS, subject to legislation. The DBS has confirmed that unit costs for its products have fallen significantly since we last reported and that this will drive a reduction in fees by the autumn of 2019. Recommendations: The Department should write to us before Parliament’s summer recess setting out what it has done to oversee, monitor and challenge the ongoing work at DBS to improve services and transition to the new contractor. The Home Office should provide the Committtee with its lessons learned review as soon as possible after the transition between contractors has been completed. Although it was the Department’s intention after our last inquiry to provide a review once the DBS modernisation project has been delivered, given the length of time it is taking the Department should review and update the Committee sooner. This exercise should be clear as to how lessons will be applied to other projects managed by the Home Office – particularly given our concerns over the Emergency Services Network programme. In the same letter, the Home Office should also provide the Committee with an update on the progress it is making to reduce the fees to the users of the DBS’s services. Disclosure and Barring Service: progress review 7 1 Progress with the modernisation programme

The DBS told us that, out of a total of some 7.6 million certificates delivered in total, only 1.8 million of these are issued from the modernised system for Basics which represents less than one third of DBS’ total activity. This means that two thirds of DBS’ activities will now not be modernised.7

The DBS told us that the decision to abandon the completion of the modernisation programme stemmed from productivity problems with the Basics function – the Chief Executive of the DBS accepted that DBS agents were not able to complete enough “matching decisions” per day per person8 - and the risk this created if the same problems were replicated in future disclosures functionality. In response to our questions on why the design of the system was not challenged at the planning stage of the programme, the DBS wrote to us after the session to confirm that the initial Business Design Documents were approved by the DBS in 2014 and that the DBS was not satisfied with the quality of these design documents despite a number of iterations being delivered throughout 2015. TCS insisted that further work on the architectural design was unnecessary and that the solution would be delivered in November 2015. The DBS reported that it reluctantly accepted the designs and TCS’ reassurances rather than stop work on the programme at that stage.9

The DBS also wrote to us after the session to confirm that the DBS owns the Intellectual Property Rights to materials that have been specifically developed by TCS for the project, such as codes, interfaces, portals, firewall rules, documents and training materials.10 The DBS has further informed us that custom-made aspects of the system are not, in its view, marketable to third parties as they do not function effectively. This provides further evidence of the contractual failures in this project leading to the acceptance of systems not meeting the DBS’s needs.11

The DBS now intends to continue using the original system for this critical part of its business and is currently assessing the need to upgrade this system as it no longer plans to modernise enhanced and standard disclosures. The DBS told us that the original system is seventeen years old. Whilst it continues to run reliably, we expressed our concern that, having made a business case to modernise its systems architecture at great cost and with long delays, the DBS has now decided to stay with an ageing platform with the risks of obsolescence and a provider not being able to support the system much longer. The DBS set out that it was considering the way forward but could not tell us when or how this might be done, nor the costs involved.12

The DBS told us that while it decided not to extend its contract with TCS, it granted a short extension of some six to twelve months so there would be an effective transition of services from TCS to a new contractor.13 As at the end of March 2019, the new contractor had yet to be appointed and there was no clear timescale for when one would be in place. This makes the TCS contract extension beyond six months more likely with all the 7 Q 46 8 Q55 9 Letter from the Disclosure and Barring Service to the Committee of Public Accounts, 22 March 2019 10 Letter from the Disclosure and Barring Service to the Committee of Public Accounts, 22 March 2019 11 Qq 65–71, 86–88 12 Qq 146–150 13 Q29, 112, 113 Disclosure and Barring Service: progress review 9 resultant costs and risks involved with this failed contract.14 The Committee established that the dispute with TCS remains ongoing and that the DBS did not know when this may be resolved.15

There are also risks that the DBS and its new contractor may not be able to access systems information.16 TCS designed the architecture supporting the programme and holds the documentation and codes which the new contractor will need to be able to deliver the services it will inherit. The DBS does not have this knowledge as it was not involved in the detail of the design of the system and failed to act as an ‘intelligent customer’ in its oversight and challenge of TCS as the new system was being delivered.17 The DBS twice characterised TCS as having been “less than co-operative” when asked to share documentation and information.18 The DBS said that any risks would be mitigated because its discussions with potential contractors to date had indicated that they would have the experience to be able to pick up these services during the transition period.19

We are concerned that the DBS is overly confident in the assurances it has received from prospective contractors over their ability to deliver the services they inherit from TCS given the tight timescales involved for the transition, and its reliance on TCS to work constructively in handing over systems documentation to the new contractor given the DBS’s own lack of knowledge over the design and code for its systems. The DBS will need to carefully manage this risk during the transition period.20 The DBS also could not provide the Committee with clarity on what it is tendering for from the new suppliers and what the likely costs involved in transitioning to a new supplier could be.21 14 Q 93 15 Q105 16 Q105 17 Q 107 18 Qq 94, 113 19 Qq110, 111 20 Qq 108–116 21 Q 117 10 Disclosure and Barring Service: progress review 2 The Strategy for Modernisation and Fees Charged

The DBS was not able to set out for us a convincing longer-term vision for what a modernised service would look like. It also reported that productivity in both basics and disclosures services was lower than expected.22 We are therefore unclear on what modernisation now means and are concerned that the DBS has not been able to define its current vision of what a completed modernised service would look like.

The DBS told us that the replacement contract will take existing systems as they are and continue to deliver its services using these systems. The DBS confirmed that there is no further ‘big bang’ development planned for its disclosures function. However, its new contractor will look at smaller incremental changes to systems to improve accessibility to information for DBS staff once it has taken over the service and is able to identify where improvements can be made.23

We remain unclear as to how the original 2012 business case setting out expected benefits as a result of the modernisation programme will be achieved. In our evidence session on Cyber Security in April 2019, Sir Mark Sedwill, Permanent Secretary at the Home Office from 2013 to 2015, admitted that programme went “off track”. He told us that the “original business case was highly ambitious and, together with the creation at the same time of the new service … the institutional capabilities of the agency were overstretched.”24 He told us that the programme “was off track and needed action taking” when he joined the Department and described how, in summer 2014, the Department “reset that business case and the entire programme” by changing the scope and timing of the programme.25 While he acknowledged that “there were some further problems that took it off track” subsequent to his overhaul of the programme, he attributed this to an upgrade of online systems and commercial problems with the providers.26

We were also concerned about whether the DBS remained committed to achieving that plan or whether it now seeks to reset the objectives to redefine modernisation. We pointed to the risks in the DBS relying on a decade-old system that would require replacement, and its desire to go into a multi-year process of agility, flexibility and piecemeal break-up. We see a clear difference between the original modernisation programme and the DBS’s more recent thinking. The DBS is either replacing outdated systems, which is a high-impact, high-intensity replacement activity that takes a number of years, or it is not, leading to the need to accept additional risks, particularly of relying on existing infrastructure and a 17-year old system.27

Further to the recommendation made in our report of May 2018, we asked about the progress made by the DBS to review the fees charged to employers and the public by the DBS.28 The Home Office confirmed that it had committed to reviewing the entire 22 Qq 130, 144 23 Q 11 24 Committee of Public Accounts, Oral Evidence Session – Cyber Security, 1 April, Qq 34, 35 25 Committee of Public Accounts, Oral Evidence Session – Cyber Security, 1 April, Qq 26, 37 26 Committee of Public Accounts, Oral Evidence Session – Cyber Security, 1 April, Qq 27, 34 27 Q 150 28 Committee of Public Accounts, Modernising the Disclosure and Barring Service, Forty-Second Report of Session 2017–19, HC 695, 25 May 2018 Disclosure and Barring Service: progress review 11 fee structure with DBS and that this review has been completed. The Home Office has developed proposals to reduce fees which it is currently discussing with HM Treasury to gain its approval for fee changes, in accordance with “Managing Public Money”. The Home Office’s expectation is that DBS will be able to reduce its fees later this year across most of the DBS’ products range.29

The DBS also confirmed that the unit cost for the Update Service has fallen below £22, the level reported to the Committee last March.30 The DBS has written to the Committee in confidence to outline the planned changes to fees and, subject to agreement with HM Treasury and secondary legislation it expects to implement the changes in October 2019.31

DBS appointed the new Chair of its Board in December 2018 and will appoint a new Chief Excutive Officer in the summer of 2019. These senior leadership changes will provide the opportunity to set out a clear vision for the organisation and the services it offers, together with its exploitation of the systems by placing them in a wider market. However, the Home Office repeatedly referred to DBS having a new Chair who will develop the DBS’s next strategy. It runsthe risk of placing too much reliance on the appointment of one (part-time) individual to oversee all these changes and address DBS’ organisational drift.32 29 Qq 150–152 30 Committee of Public Accounts, Oral Evidence Session – Modernising the Disclosure and Barring Service, 19 March 2018 31 Q 153 32 Qq156–158 12 Disclosure and Barring Service: progress review