Fifty-Third Report - The performance of UK Security Vetting

The Cabinet Office is over reliant on customer demand forecasts and failed to predict changes in demand for security vetting. UKSV’s customers provide demand forecasts each October to enable it to assess what level of resources it will need for the following financial year. UKSV relies on customers to provide accurate forecasts but these vary in quality, and it is aiming to work more closely with customers to help them improve their forecasts through better use of data. While it is unsurprising that forecasts for 2020–21 did not anticipate the reduced demand that COVID-19 lockdowns caused, UKSV and its customers failed to anticipate a resurgence of demand once COVID-19 restrictions were lifted. UKSV argues that the changing threat environment and wider societal changes in the employment market added to demand in a way that was not anticipated beforehand. This is not the first time UKSV has been impacted by a sudden increase in demand, for example it saw a similar trend following the Brexit vote in 2016. Recommendation 2: The Cabinet Office should set out what steps it is taking to help its customers improve their forecasting and to make UKSV more resilient to changes in demand.

We are concerned about the level of risk created by the Cabinet Office’s decision to repeatedly defer renewals for DV clearances. Existing DV clearances are 6 The performance of UK Security Vetting normally reviewed after seven years to ensure that individual’s circumstances have not materially changed and that the initial clearance remains valid. Scheduled and unscheduled aftercare checks in the period between renewals should capture any changes in circumstance that might impact on the clearance. However, UKSV has failed to meet its target for aftercare checks since the start of 2018–19; and to manage demand, the Cabinet Office Government Security Board decided to extend most DV renewal clearances in 2018, 2019, and 2020. In 2021–22, the consequent backlog of renewals overwhelmed UKSV and in April 2022 the Government Security Steering Group directed UKSV to extend renewals yet again, so UKSV could focus on reducing the backlog of new DV clearances that had developed. UKSV and its customers acknowledge that continually deferring renewals creates risks that are uncomfortable. UKSV claims that, as it has always adopted a risk-based approach to deferrals, that any renewals with known red flags were still thoroughly reviewed. It also argues that prioritising new DV clearances rather than renewals was a sensible risk-based decision. Focusing on new DV clearances, however, also placed further pressure on UKSV’s processing of CTC/SC clearances, which saw clearance times increase and backlogs grow even higher in 2022. Recommendation 3: The Cabinet Office should develop a plan for how it intends to avoid repeatedly extending DV renewals going forward, and set out the key elements of this plan in its Treasury Minute response. The plan should include, for example: • when it expects to be able to renew all DV clearances rather than automatically extending low-risk cases • how it intends to provide the additional staff resources required to renew all DV clearances • what steps i

UKSV cannot deliver timely security vetting across government with its current staff levels. Despite its essential role in protecting national security, UKSV has been under-staffed to meet customer demand forecasts since its inception in 2017. In April 2021, when faced with an upsurge in demand for its services following the relaxation of COVID-19 restrictions, UKSV had a 32% shortfall in staff resources. In November 2022 it was still 23% short of estimated need, including digital staff required for the vetting transformation programme, despite securing additional contingent labour and temporary staff from other departments. UKSV says its resourcing levels meant it had to make difficult decisions as to which service areas it prioritised, with aftercare checks one area that suffered as a consequence. The Cabinet Office expects some of the slack to be addressed through higher pay for digital staff and increased automation as part of its vetting transformation programme, although it accepts that the completion of transformation is some way off. To compound matters, survey results show low levels of engagement among UKSV staff. UKSV’s Chief Executive says that her staff have an immense pride in the organisation but also acknowledges they are suffering from ‘change fatigue’. The performance of UK Security Vetting 7 Recommendation 4: The Cabinet Office should set out: • what resourcing levels UKSV needs to make progress with its transformation programme and to achieve its service level agreements for customers’ forecast demand in 2023–24 • what the agreed level of resourcing is for 2023–24, and • if there is a shortfall, how UKSV is expected to close that gap

The governance structure of UKSV within Cabinet Office is a barrier to transformation. UKSV’s chief executive and the government chief security officer have low levels of delegated spending authority which means they require approval from the Cabinet Office Approvals Board for any spending over £500,000. That Board has repeatedly refused to give spending approval for the £40 million vetting transformation business case. UKSV’s Chief Executive cited governance around investment and the change agenda as problematic in replacing the legacy system, and three reviews of the transformation programme included governance in their array of concerns about the deliverability of the programme. The Cabinet Office acknowledges that its cautious approach is delaying the much needed and widely supported transformation programme but says that it is better to be cautious than to spend unwisely. Recommendation 5: The Cabinet Office should urgently review UKSV’s governance structures to assess whether they provide the correct balance of challenge and support to enable UKSV to achieve the much-needed security vetting transformation programme. It should summarise the findings of this review in its Treasury Minute response.

We are not convinced that current plans for the transformation of security vetting are any more likely to succeed than previous failed attempts. The Cabinet Office’s first attempt at modernising the IT infrastructure for national security vetting failed, after unknowingly running almost 50% over budget and resulting in a £2.5 million write off in the Cabinet Office’s 2021–22 annual accounts. Despite broad consensus on the need for the transformation programme across government, which customers have already funded, subsequent attempts at vetting reform have been stymied by the lack of spending approval and the priority given to the stabilisation programme over the transformation programme. After multiple failed attempts to get Cabinet Office spending approval for the whole Vetting Transformation programme, in December 2022 UKSV changed its approach and finally got spending approval for the development of just the first of three new vetting levels. As a result of the delays, UKSV anticipates it will have to refund around £5 million to customers. UKSV’s Chief Executive says she is confident that adopting a more iterative approach will be more successful. We would like to share her confidence but the track record for transformation to date does not bode well for the future. In our view, until such time as the Cabinet Office starts to take its responsibility for national security vetting more seriously, shows more confidence in UKSV and provides more support, it is unlikely that transformation will be fully achieved. 8 The performance of UK Security Vetting Recommendation 6: The Cabinet Office should set out a clear implementation plan for vetting transformation, with interim milestones for each of the new vetting levels and a realistic completion date. It should set out the key elements of this plan in its Treasury Minute response to this report. The performance of UK Security Vetting 9 1 UK Security Vetting’s poor performance and remedial actions

On the basis of a report by the Comptroller and Auditor General, we took evidence from the Cabinet Office about the performance of UK Security Vetting (UKSV).1 UKSV, which sits within the Cabinet Office, is the main government provider of national security vetting. Security vetting provides assurance on individuals working with government assets and classified information. There are several different types of vetting levels with the most common being Counter Terrorist Checks (CTC), Security Checks (SC) and Developed Vetting (DV). DV clearance is the most complex and allows individuals access to more sensitive government information and assets than CTC or SC clearance.2

The Cabinet Office could not provide us with any information on how many people were abandoning jobs due to vetting delays. The NAO reported that cancellations of clearance requests were 19% higher from April to November 2022 compared with the same period in 2021–22, and that requests were most likely cancelled because the individual being vetted secured an alternative job. The Cabinet Office said at our February session that it had done further research following the NAO report and expanded on the list of reasons why individuals may no longer need a clearance, such as retirement, moving to a job with lower security status or simply failing to provide the information in time and therefore being timed out. It claimed that “the cancellations are not people pulling out of the process” and that “for the moment at least, there does not seem to be any evidence that, even in a very competitive job market, the vetting process is losing good candidates”. The Cabinet Office also considered that the increase in cancellations was proportionate to the overall increase in the number of cases received.16 Poor demand forecasting and lack of resilience

UKSV relies on customer demand forecasts in October ahead of each financial year, to enable it to plan for the resources it will need. For 2020–21, customers over-forecast how many clearances they were likely to need, unaware of the coming COVID-19 pandemic, which caused a drop in demand for clearances. Conversely, during 2021–22 customers under-forecast their demand in 11 out of 12 months as the employment market changed as COVID-19 restrictions eased. Overall, in 2021–22, demand for DV clearances increased by 57% and demand for CTC/SC clearances increased by 60%.17 UKSV struggled to cope with this increased demand, in much the same way that it did when there was an increase in demand after the Brexit referendum which required increased resources to plan the UK’s exit from the EU.18

The Cabinet Office told us that while some departments are very good at forecasting, others struggle. UKSV has therefore put a lot of effort into improving its management information to help it work with customers on predictive analytics, to improve the accuracy of their forecasts. The Cabinet Office said UKSV now has a better understanding of the policies and programmes that drive customer demand.19 The government chief security officer attributed the significant level of customers’ under-forecasts in 2021–22 to three factors: underestimating the supressed demand post-COVID; a failure to take account of the changing threat environment; and underestimating societal and employment changes in 2021–22, such as the doubling of moves within the Civil Service after COVID-19.20

When we asked what was being done to make UKSV more resilient and better able to deal with future upsurges in demand, the Cabinet Office offered us three solutions: 15 Q 26 16 Qq 22, 23; C&AG’s 2023 Report, Figures 10 and 11 17 C&AG’s 2023 Report, paras 2.3, 2.4 and Figure 7 18 C&AG’s Report, Investigation into national security vetting, Session 2017–2019, HC 1500, 7 September 2018, para 3.4 19 Q 27 20 Q 28 12 The performance of UK Security Vetting i) improvements in forecasting (see above). ii) increased automation: it said around 20% of the overall operation is currently digitised, and there are plans to increase that up to 30% and then 40% “over the next few years”, although the Cabinet Office expressed disappointment that its progress on this front was slower than hoped.21 To date the focus has been on automating the lower-level, more transactional, security clearances including the new accreditation checks for the aviation industry.22 iii) a more flexible resourcing model which offers extra capacity through the use of temporary contractors:23 The Cabinet Office referred to its use of staff from other departments including HMRC and military police as well as contractors (see below).24 It explained that it had also secured increases in productivity through changes to process and policy and by setting staff individual targets.25 Risks from deferred vetting renewals

Each DV clearance is normally reviewed after seven years to ensure that individuals’ circumstances have not materially changed and that the initial clearance remains valid. In 2018 the Cabinet Office Government Security Board first took the decision to implement a 12-month extension to some renewals to help UKSV recover performance at that time. It repeated the decision in 2019, and then again in April 2020 to help cope with the impact of the COVID-19 pandemic on operations. In 2021–22, however, all DV renewals that had previously been extended came back up for renewal and were not extended again, meaning that a backlog of cases needed processing.26 In April 2022, the Government Security Steering Group directed UKSV to extend renewals again to focus on reducing the backlog of new DV clearances that had developed. The NAO reported that both UKSV and its customers acknowledge that another extension of renewals carries security risks that are uncomfortable.27

The Cabinet Office defended the repeated policy decision to defer renewals on the grounds that it was “risk-based and a decision taken with our customers”. It acknowledged that the cumulative impact of deferring renewals for several years created additional challenges but also said that “if you have a choice between waiting nine months for someone to come in and do a critical job, or extending a renewal that has been in place for seven years and no risks have been identified with the individual, all the customers around the table agreed that that was the preferable way to go”. It said the decision to defer renewals and to prioritise new clearance applications meant that it was able to reduce the processing time for new applications to 177 days at its worst, to the current 98 days.28 However, with limited resources, prioritising one area has inevitably led to deteriorating 21 Qq 6, 35 22 Qq 36, 37 23 Q 37 24 Qq 40,41; C&AG’s 2023 Report, paras 2.9, 2.10 and Figure 9 25 Qq 43, 44, 45 26 Q 29; C&AG’s 2023 Report, para 2.5 27 C&AG’s 2023 Report, paras 2.6, 2.7 28 Qq 9, 10, 29 The performance of UK Security Vetting 13 service levels in other areas; as new DV clearances were prioritised at the start of 2022, the percentage of CTC/SC clearances that were being processed within target times slipped further.29

The Cabinet Office sought to reassure us that UKSV did not stop processing renewals altogether, but that it had continued to process renewals at a lower rate, adopting a risk- based, data-driven approach. “Should an adverse indicator arise [from newly introduced automated data checks], we absolutely then moved forward with the full process”.30 One such means of detecting such an indicator is an aftercare check, which should occur between the initial clearance and a full renewal with the aim of capturing any changes in circumstances that might impact on the clearance. UKSV aims to complete 85% of scheduled aftercare checks within 95 days but has failed to meet that target once since the start of 2018–19.31 The Cabinet Office defended this risk-based approach saying that UKSV would rather take time to work with individuals to mitigate risks and achieve the right outcome even if it meant failing to achieve a KPI,32 and that it had introduced a triage approach across national security vetting to ensure a focus on high-risk cases.33 Staff resourcing constraints

UKSV has been under-staffed to meet customer demand forecasts since its inception in 2017, which has had negative impacts on its performance. In April 2021, when demand surged following the relaxation of COVID-19 restrictions, UKSV had 669 full-time equivalent (FTE) staff against the 985 FTE it expected to need to meet forecast demand during 2021–22, a shortfall of 316 FTE (32%). Despite seeking to recruit throughout the financial year, by March 2022 UKSV still had a 237 FTE shortfall against its requirement for that year. Based on customer demand forecasts for 2022–23, UKSV estimated it would require 1,145 staff for that year but by November 2022, UKSV had increased its FTE headcount number to only 877 (23% short of estimated need).34 The gap between actual staff and the forecast need for staff is shown at Figure 1. 29 C&AG’s Report, Figure 2 30 Q 12 31 C&AG’s Report, para 1.9 and Figure 6 32 Q 30 33 Q 34 34 C&AG’s Report, paras 2.9, 2.10 and Figure 9 14 The performance of UK Security Vetting Figure 1 – UK Security Vetting’s actual headcount (FTEs) vs forecast required headcount, April 2021 to November 2022 Source: C&AG’s Report, Figure 9 on Page 32

Under-staffing has led UKSV to make trade-offs in what service areas it focuses on. For example, the UKSV chief executive told us that by focusing on new DV clearances it was unable to resource aftercare checks to the levels needed.35 Likewise, the focus on new DV clearances saw average clearance times drop for those cases but for DV renewals, average clearance times increased from 190 days in April 2022 to 255 days in November 2022.36

The Cabinet Office was keen to point to UKSV’s use of surge staff from other departments,37 although there were just 13 such staff between January and November 2022 alongside about 50 contingent labour staff (see also Figure 1).38 It said the use of more contingent labour solved the need to fit within wider Civil Service aspirations around headcount numbers, although “by the time you recruit, you vet and you train, it takes a long time.”39 The Cabinet Office expects UKSV to maintain its own headcount number at no higher than 832 FTEs at March 2023. It has, however, authorised an additional 163 contingent labour and temporary staff from other government departments, bringing the total to 995, still 160 short of the estimated requirement of 1,145. UKSV aims to bridge that gap through efficiencies and automation of processes coming out of its delivery stabilisation plan.40 As well as internal changes to increase productivity, the Cabinet Office told us UKSV was working with departments to improve the accuracy and completeness of applications, to reduce the amount of remedial action required from UKSV staff, which restricts their productivity.41 35 Q30 36 C&AG Report, Figure 8 37 Qq 40, 41 38 C&AG’s Report, Figure 9 39 Q 43 40 C&AG’s Report, para 2.10 41 Q 50 The performance of UK Security Vetting 15

When asked about the mismatch between UKSV’s claims of increased productivity and staff survey results showing a high level of disengagement, UKSV’s chief executive pointed to the innate pride of its staff in the work they do to protect national security but admitted that many are suffering from change fatigue. Staff have had to contend with the move of vetting services from the former Foreign & Commonwealth Office and MOD to the Cabinet Office, changing systems, processes and policies and most recently, changes to some of the skills and tools staff use for vetting because of digitisation and automation.42 UKSV’s chief executive suggested that staff “would like a bit of stability and some investment” as “they have not had a period of stability for a very long time”.43

Recruitment challenges have also hampered progress on the vetting transformation programme. In November 2021, UKSV only managed to fill five out of 44 digital roles despite multiple costly, labour-intensive campaigns, with uncompetitive salaries seen as a key factor. In September 2022, despite a partial exemption for digital roles from the Cabinet Office recruitment freeze, UKSV’s resource modelling still showed a shortfall of 68 full-time equivalents (FTE) for digital roles against a total requirement of 108.44 The Cabinet Office downplayed the issue saying “trying to get the right number of permanent and temporary staff and then to train those up, took a bit longer, so we were a bit below our optimum resourcing level”.45 It told us it had recently moved to strengthen the pay scales across digital, data and technology across the Civil Service, but accepted that progress with the vetting transformation programme had been slower than it would have liked and that transformation was still some way off.46 42 Qq 52, 53; C&AG’s Report, para 2.12, Figure 12 43 Q 55 44 C&AG’s Report, para 3.13 45 Q 72 46 Qq 35, 89 16 The performance of UK Security Vetting 2 Transforming national security vetting Governance

The Cabinet Office took on responsibility for both security vetting policy and operational delivery in April 2020, when UKSV transitioned from the Ministry of Defence to the Government Security Group within the Cabinet Office.47 The Cabinet Office controls UKSV’s headcount, and while UKSV’s funding costs (around £43 million per year) are covered by its customers, it nonetheless requires spending approval from the Cabinet Office Approvals Board (COAB) for any programme spend over £500,000.48 In January 2021, the Cabinet Office appointed a chief executive to run UKSV, who reports to the government chief security officer. Other than COAB, UKSV is also accountable to the Government Security Board, the Vetting Board, and the Vetting Modernisation Portfolio Board for its operations and programmes.49

UKSV has been trying, largely unsuccessfully, to modernise the vetting system since it launched a Vetting Reform programme in 2019.50 UKSV’s Chief Executive said, “if we had a magic wand and we could build a new system tomorrow, we absolutely would”.51 Whenever it has taken full business cases for its £40 million transformation programme to COAB, however, these have been rejected. Three reviews of the programme in 2022 raised concerns across multiple areas of programme management, including the governance arrangements with one noting the need for greater support within the Cabinet Office.52 The Cabinet Office defended its cautious approach to the transformation programme, which it attributed to concerns around its deliverability and the need to prioritise performance recovery over transformation, saying it was better to be cautious than to spend unwisely.53

When asked about her past experiences, UKSV’s chief executive cited governance as the main difference between her experience of running a government change programme compared with running a private sector change programme.54 She said that there was a lot of governance around investment and the change agenda, as UKSV had to ensure that “every customer is comfortable with everything we are planning to change”.55 This was endorsed by the government chief security officer who said the transformation programme had been “agreed at every step with customers in the security world, through the government security board, but also with chief operating officers and Perm Secs”.56 Achieving transformation of security vetting

As part of the Vetting Reform programme, the Cabinet Office planned to replace UKSV’s legacy IT system, the National Security Vetting System, through the Future Vetting System programme, by February 2020 at a cost of £19 million. Failures in project management meant that the programme ran £9 million over budget and resulted in a 47 C&AG’s Report, para 3.5 48 C&AG’s Report, paras 1.2, 2.10 and Footnote 8 49 C&AG’s Report, para 3.15 50 C&AG’s Report, para 3.3 and paras 3.7 to 3.12 51 Q 62 52 C&AG’s Report, para 3.11 and Figure 15 53 Qq 74, 80; C&AG’s Report, paras 3.11 and 3.12 54 Q 78 55 Q 63 56 Q 82 The performance of UK Security Vetting 17 £2.5 million write off in the Cabinet Office’s 2021–22 accounts.57 The IT modernisation programme was subsequently rolled into the wider Vetting Transformation programme. After several failed attempts to get business case approval for the whole transformation programme, in December 2022 UKSV successfully submitted a less ambitious business case for the development of just the first of three new levels of vetting.58 UKSV is expecting to seek approval for the next level of transformation in summer 2023 and agreed that it is unlikely to be completed until 2025.59 When asked what had gone wrong previously and what she would do differently next time, UKSV’s chief executive said that they would replace the previous “big bang approach” with a “very agile, iterative and low-risk rollout approach” and that she had high expectations that the next version of the business case would be approved.60

The Cabinet Office told us that following its bad experience with its first attempt to modernise IT, it was now adopting a more cautious approach to transformation, and that it rejected the business plan for the Vetting Transformation programme on a few occasions because it was “not totally happy with the plan” and wanted to “be sure that this one was going to work”. It accepted that it had been a little optimistic about the achievable rate of transformation, but also pointed out that the need to focus on catching up with the level of demand for the day-to-day business, meant that it had had to push the transformation programme to the right, with customers’ agreement.61

The Cabinet Office was keen to confirm that it has full customer support for vetting transformation.62 For example, centralised decision making is an important component of the transformation plan whereby UKSV takes the whole decision on clearance rather than allowing departments to make the final decision based on UKSV’s advice.63 The Cabinet Office told us that 70% of all decision are now centralised with customers signed up to this approach.64 It did, however, acknowledge that UKSV may have to offer additional checks to all customers to assuage the concerns of others who consider their business has special requirements and to drive transferability of checks between departments.65 UKSV’s customers are frustrated with the lack of progress on the transformation programme. They fund the programme but have no say in how that funding is used. UKSV was forecasting an underspend of £6.5 million on the programme in 2022–23 due to delays in getting Cabinet Office approval for the business case, delays to progress on the plan and delays in resourcing. With an overspend of £1.5 million elsewhere across the business it was anticipating refunding around £5 million to customers in 2022–23.66 57 C&AG’s Report, para 3.7 58 C&AG’s Report, para 3.10 and Figure 14 59 Q63; C&AG’s Report, para 3.10 and Figure 14 60 Q 75 61 Qq 74, 80, 82 62 Q 82 63 C&AG’s Report, para 3.8 64 Qq 35, 66 65 Q 67 66 Q 72; C&AG’s Report, paras 3.14 and 3.15 18 The performance of UK Security Vetting