Source · Select Committees · Public Accounts Committee
Recommendation 21
21
As HMRC moves towards a fully digital tax system, the capability of its IT systems,...
Conclusion
As HMRC moves towards a fully digital tax system, the capability of its IT systems, including in terms of cyber security, will become increasingly important to HMRC’s ability to operate effectively. HMRC has recognised that, due to the need in the past to forgo operational maintenance and upgrades to its systems to secure cost savings, its IT systems now constitute a significant risk to the Department.58 We asked HMRC about the impact of the relatively poor state of its IT infrastructure on the cost-effectiveness of its administration of the tax system. HMRC told us that it is important that it has sufficient investment to modernise its IT estate as well as continue to maintain its legacy systems to ensure they are kept up to date and are safe from cyber-attacks and catastrophic losses. In the case of its legacy systems, ‘patching’ is a never-ending process.59
Government Response
Acknowledged
HM Government
Acknowledged
5.1 The government agrees with the Committee’s recommendation. Recommendation implemented 5.2 The department has been addressing its legacy technical debt since 2019 and received funding of £268 million at the 2020 Spending Review to continue the work to improve the agility, resilience and security of its IT estate. The estate comprises over 6,000 servers and over 550 associated IT systems so is an extremely complex and inter-dependent one. The plan to tackle legacy technical debt has focused on a number of areas: • Rationalise/Streamline: Rationalising the department’s IT estate – to date 20% of the department’s total services have been de-commissioned or retired; • Remediate: Addressing high priority technical debt to replace out of support and old components, so that the core system security is enhanced, together with strengthening perimeter controls protecting the department’s IT systems. The department has spent £36.3 million on this activity in Financial Year 20-21; • Migrate: The next step in this programme of work is to migrate these systems to the Cloud. Hosting savings will be delivered, thus reducing baseline IT spend. These systems can then be further transformed as part of full service transformation (multiple IT systems grouped together form a service such as Personal Tax or VAT), which is agreed industry-standard practice; and • Transform: Focusing on defining and consolidating system delivery centred around strategic components, reducing operating cost and concentrating management activities around a reduced set of components which support HMRC operations. This both reduces the operating cost and the security attack surface area, which helps HMRC defend its systems. 5.3 The ODP details the plans on how the department is remediating technical debt and the work HMRC have done to develop core foundational structure elements for HMRC.