 Ti babies whim. The committee has welcomed the 15th meeting of 2019 of the Social Security Committee. It is important to turn everyone's mobile phones off on other devices to be silent so that they do not disulfur our meeting. We received no apologies and received fullening on the agenda item 1—a decision on business in private. The committee is asked to agree to agenda item 3, consideration of evidence four consideration of a draft report are taken in private, is the committee agreed to this? The committee has also asked to agree that consideration of his work programme is taken in private at our next meeting, and to take future considerations of the draft report that we are looking at this morning in private is the committee agreed to this. When I move to agenda item two, Audit Scotland reports, the committee will take evidence on the Auditor General for Scotland report, Social Security implementing the devolved powers, and I welcome Caroline Gardner, Auditor General for Scotland, and her team, Mark Taylor, Audit Director, Audit Scotland, Gemma Diamond, Senior Manager, Audit Scotland, and Kirsty Redd, Senior Auditor, Audit Scotland. You are all very welcome this morning, thank you for coming along to the committee and can invite Ms Gardner to make an opening statement before we move to questions. Thank you convener, I am pleased to bring my latest report on how the Scottish Government is managing the delivery of the new social security powers to the committee today. The report looks at progress up to the end of February this year, while taking account of the activity that is still under way. The Scottish Government has done well to deliver the commitments that it made for the last year. This includes launching the Social Security Scotland agency, which is responsible for delivering the benefits as they are devolved. As you know, the agency became operational in September 2018, and it now employs over 320 staff. The Government has launched the first two benefits, the carers allowance supplement, and the best start grant pregnancy and baby payment. The social security programme has also undertaken important groundwork to support the delivery of future benefits and promote its aims of fairness, dignity and respect. That includes publishing the first social security charter and establishing the Scottish commission on social security. The programme has also continued to engage people who will use the new systems in the design process. However, delivery of the new benefits has been harder than expected. The programme has been working flat out, and the scale and complexity of the work involved has become clearer as teams plan the delivery of individual benefits. The programme has continued to find it difficult to recruit the skills and experience that it needs among its staff, leading to greater than expected reliance on temporary and contractor staff and pressure on the staff that it does have. The programme has done well to respond to the challenges to date, but the processes and systems that it is currently using to plan and support implementation will not be enough to support the next stages. The programme's financial reporting has improved, but it has not been monitoring or reporting how much it will cost to fully implement all the benefits. Delivering the second wave of benefits will be a significant challenge. Wave 2 benefits involve more complex assessments and regular payments that affect people's day-to-day income. The programme is carrying out a wide range of work to prepare for the next stage of delivery, including revising the overarching business case, reviewing the governance and planning processes and work to address the resourcing challenges. The programme is doing the right things and it is committed to learning lessons, but there is a risk that the pace of work and the constant delivery pressures may not allow the team the time and space that they need to make change quickly enough. Finally, the Scottish Government does not yet have a clear understanding of the key things that are needed to deliver all the remaining benefits in the way that it intends, and it now needs to develop its critical path of planned actions for the rest of the programme. I am joined by colleagues who worked on the report, and we are happy to answer the committee's questions. I thank you for that opening statement, and we will move to questions now. Alison Johnstone Thank you, convener, and good morning. I thank you for the report. The challenges to date have not been insignificant, but it is fair to say that those challenges have been met. You are clearly expressing concerns about the increased challenge in delivering the next wave of benefits, some of which are more complex. The three forms of disability assistance will easily be the biggest part of the new system, accounting for well over half of current spending, and disability assistance for children and young people will be launching next summer. The report makes a lot of reference to the Scottish Government needing to do more to be ready for these wave 2 payments, but I would like to know more about the level of preparation for those disability assistance benefits in particular. Could you expand on what has been done particularly well so far and whether you believe that everything can be in place to successfully deliver those really important benefits next year? I will kick off, Ms Johnstone, and then ask members of the team to give you a bit more detail if that is okay. The groundwork that the programme has put in place is exactly the right groundwork. The ability to put in place the programme staff and the agency, ways of working, some of the key systems and processes that will be needed for all of the benefits that are in hand. As the committee knows, the Government has prioritised safe and secure delivery throughout this. For that reason, the first wave of benefits are the ones that are deliberately easier to manage. They tend to have smaller caseloads that are easier to assess and they are one-off payments rather than regular payments. You are quite right as we move into the disability benefits. Those things start to reverse. Much bigger caseloads are harder to assess people's eligibility and the need to make regular payments that may change from week to week and month to month. I will ask the team to pick up what we think of the particular challenges and where the focus needs to be as we move into that next phase of work. I think that we are set out in the report where the planning horizon is at the moment and that there is a lot of detailed work put into what is coming next. At the moment, completion of wave 1 benefits and early work for wave 2 benefits. One of the things that we are clear about is that there needs to be more of an overall sense of what that overall plan is in order to deliver the whole range of benefits, including disability benefits, as we go forward. I have a clearer idea of what the main milestones are, where the critical decision points are and how all that fits together to enable some more of that detailed planning. The approach that the Government is taking is one to learn as it goes and to take an agile approach in terms of building systems incrementally as they go on. What we are clear about is that there needs to be a greater view of what are the key things that need to happen and what order to get the delivery of the benefits, including disability benefits and the timescales that have been set out. I suppose that it is just to build on the agile point that Mark was just making in terms of that iterative process. For us, it is clear to understand and includes what some of those key dependencies are to, for certain benefits, what are some of the systems that will be required and what parts of the system will be developed over time. That affects the procurement timescales as well. For us, it is about that critical path that shows what some of those dependencies are. If one procurement decision is not made in the right timeframe, what knock-on impact that might have across all the different benefits and what order those decisions need to be made, because there are certain things such as some of the digital systems that will affect multiple different benefits. For us, that critical path is key to understanding that over a longer time frame. The programme has a lot of planning in place. It has lots of individual project plans that set things out, but what we are looking at is something that sits above that over a longer time frame in terms of a critical path. I suppose that it is key that we have sufficient staff in place. I know that colleagues are going to pick up that line of questioning, but if we have a system that is not working as smoothly as it might be, we are more likely to see errors arise in that system. Those errors can lead to overpayment and, indeed, underpayment, which can be particularly devastating—neither of which you are welcome—and DWP statistics tell us that just one of the payments being devolved to PIP had, across the UK, £600 million worth of payment error in 2018-19, including over £340 million of underpayment. If we take a rough Scottish share, we might be looking at £34 million of underpayment, and that is just for one form of assistance. I would like to understand what the Scottish Government might do to reduce that level of error. You are absolutely right that that is one of the challenges that the Scottish Government is having to work with. It is taking on responsibility at the moment for benefits that have been historically administered by DWP, and across the whole social security system in the UK, there have been very high levels of error and fraud that have led to the DWP's accounts being qualified over a number of years. As benefits are coming across and as existing claimants are being taken on, the Government will need to have plans for how it will tackle that challenge. As the committee knows, at the moment, what the Government is doing is taking on new claims, and it has the opportunity to put in place its own, not just eligibility criteria but assessment processes. It is focusing more on face-to-face and assisted processes for people to make their claims, to make sure that they are getting what they are entitled to and not more or less than that. As we say in the report, it will have to consider how well that is going as it moves on to the new benefits that have more claimants and more money involved. I think that it is where the principles of dignity, fairness and respect become so important, but it is absolutely part of what the audit team led by Mark Taylor will be looking at as they move into the first year's audit of the agency itself to look at how well that has been done for the first waves of benefits and what the preparations are as we move into these much bigger and more complex ones in future. Mark Taylor, do you want to add to that? I think that it is worth stating—I know that that is understood—that the nature of benefits, given their complexity, given that for claimants and for officials it is difficult to navigate, particularly as more and more benefits come in and you have the interplay between reserve benefits and devolved benefits going forward, makes it a very complex system to navigate. There is an inherent risk of fraud and error in that system. We found when we did our work earlier this year that the agency and Government's understanding of what it means in practice for the benefits that are being devolved now is at an early stage, and there is more work that needs to be done around that. As the Auditor General says, that will be very much a focus of our work that is on going at the moment, looking at the agency's accounts for the first year. That combination of what can the agency do for new benefits that it is taking on responsibility for and what are the continuing impacts of the underlying systems that DWP provides, and that the agency will continue to use in some areas. Can I ask a couple of questions on that? The question revolves around the risks that the Auditor General is highlighting in terms of the more complex and demanding nature of wave 2 benefits. In section 95 of the report, I see that there is a significant amount of work under way to prepare for the next stage of delivery, but we need to be implemented quickly. I will briefly say that the programme and its staff show a good level of self-awareness and wellness to reflect and challenge themselves in progress. Given the on-going challenge and demand of delivering the rest of the wave 1 benefits alongside the work to design and implement wave 2 benefits, there is a significant risk. It is a significant risk when it comes back that the programme does not have the time and capacity to learn from experience to date and make the changes necessary to successfully deliver on wave 2 timescales. That is almost like a self-contradictory statement. It says that things are going well, they are aware of the risks, they are taking steps but there are still significant risks. I was looking on further in the report that talks about the 102 stage. It talks about changing the management structures and re-designating job specifications of some senior management and recruiting additional skill levels that are required at this stage to deliver stage 2. There seems to be a dynamic within the organisation that is identifying the significant risks and taking appropriate action to mitigate them. I do not doubt that there will be a significant risk. There must be when you are dealing with that level of complexity, that is de facto the situation. I suppose what I am looking for is your views and whether you think that the actions that Social Security Scotland and the Scottish Government are taking are adequate to identify and mitigate the risks that this report outlines. I think that we would say at this stage that we think that they are probably doing all that they can and that what they can do cannot eliminate those risks altogether. For example, we know that the Scottish Government will need to continue to work very closely with DWP not just until 2024 but for the continuing future, because, for example, of the extent to which some UK-wide benefits are qualifying eligibility criteria for Scottish benefits, that relationship will continue to be there. Some of the problems that Mark was outlining about levels of error and fraud in DWP are something that the Scottish Government will have to manage and respond to. We say at the top of page 31 that getting the right staff in place will be absolutely key to addressing some of the risks that we have identified here. We know that the agency and the programme are struggling to do that in some areas, particularly digital skills and business analyst skills. They are in short supply across Scotland, so there is a risk that no matter how hard the programme works to look to recruit those skills, they will still have gaps that will get in the way. One last thing just to mention is that some of the work that is having to be done to deal with the complexity that is being uncovered and understood has the consequence of increasing the work that still requires to be done. We are talking here about the work around that was needed to check eligibility for the pregnancy and baby payment of the best start grant. That was a good thing to do to make sure that people got their money on time and that it cut down levels of error. Equally, the work to get the proper interface between the two systems in place still remains to be done, so there is that sort of snow plow effect of work moving forward as work-arounds are put in place to solve immediate problems. I recognise your sense that we are having our cake and eating it by saying that they have done very well and there is the remain, but that is genuinely our assessment at the moment of where the programme is. Really good progress to date and a lot of significant and complex work to come. That is completely reasonable. I suppose that I was just trying to get a sense of whether the Government and Social Security Scotland are sighted on those risks. They are aware of them and they are seeking to mitigate and manage them appropriately. I am not trying to put words into your mouth, but I think that that is what you are saying. You did not identify risks that the organisation was not aware of and are seeking to take steps to deal with. Would that be a reasonable position to take? We say in the report very clearly that the programme is self-aware and is doing the right things. The thing that we also say is that it is really essential now that they have that critical path for delivering all of the devolved benefits, as Gemma was describing, to understand what the key decision points are, what the interactions are and what the effect will be if some of those things slip or encounter unexpected problems. That is helpful. I was interested in some of what the report had to say about the digital arrangements for the new benefits. I was curious to know how that relates to some of the more antiquated systems that exist for certain reserved benefits, not only for reserved benefits, but for communication that exists between the new agency and the DWP. I believe that there are some parts of the DWP that still operate on paper-based systems from 1948. I am curious to know a little bit more about what you found about the digital side of the new arrangements. What we have seen is that the programme has really good relationships with DWP in terms of understanding what those systems are and where DWP can work and how some of the new system that they are building will interact with those DWP systems. It is fair to say that the DWP systems are very complex. They have individual systems for individual benefits that then have to talk to each other. The approach that the Scottish Government has taken is to build one system for all benefits, to avoid that kind of having to talk to each other. It is also fair to say that there will need to be a kind of long-term relationship with DWP in terms of the Scottish Government system being able to get information from the DWP systems and being able to talk to each other. The Scottish Government has also made some decisions for this short term to make use of some of the systems that DWP has. For example, the Scottish Government does not currently have a payments platform that would be able to cope with the volume of payments that go out through the social security system, so they have an interim agreement with the DWP to use their payments platform to make those payments, whilst the Scottish Government, centrally within the digital directorate, has an on-going project to look at a payments platform for Scotland. It also is making use of the customer information system within DWP that allows them to check whether a claimant has the kind of passported benefits for eligibility. For best start grant, there are some underlying benefits that people need to be on to be eligible and they can use a DWP system to check that. There are lots of different interactions and ways that the systems will need to interact over time, but the Scottish Government has taken a different approach to building the new benefits system. I am interested in what you are saying about some of the technical issues that you pointed out. I do not claim any understanding of the technical issues, but it is interesting that you said that when the contract was agreed, the programme understood that the DWP owned a key piece of coding that would be required. That was not the case and required the programme to negotiate the purchase of the coding from a third party. Do you think that there are obstacles in the way that create difficulties or costs for the Scottish Government arising from issues like that? I think that we have made it clear in the report and I get quite a few times that this is a really complex situation. As the Scottish Government and the DWP get further into looking at how those things will interact, further complexities will arise. That code is one of those, the best start grant and the need to use different arrangements as the component was not ready for the go live or examples of that. There will probably be further examples of that in the future as those complexities arise. The Scottish Government had good contingency arrangements in place to manage that, so it saw that that was going to happen. It put contingencies in place and delivery still went ahead per the timescale. There are good enough relationships there that have the right contingency in place. Clearly, the relationships are there, but the example that I have given would, if I read it correctly, tend to suggest that there were costs involved for the Scottish Government because of an action that the DWP end. Is that a pattern? When I say costs, I mean costs arising from trying to fix a problem that appeared to be created there? The were cost arising in that case in terms of them needing to kind of purchase the code. That is what is an isolated example at the moment. We do not have any further examples of that nature at the moment. The timeline of delivery for entitlements is clear, but the workforce and financial planning to support that timeline is not yet in place. Do you want to see what some of the gaps are on that workforce and financial planning are at the moment? What are the blockages on having those plans in place? Exhibit 1 sets out the Scottish Government's plans for delivering the new benefits, the devolved benefits to new claimants, and then by 2024 transferring across all existing claimants. That timeline is in place. As GEM has said, there are project plans for the individual benefits that sit underneath that. What we are not seeing yet is the overarching plan that would pull all of that together to be really clear what the key decision points are, what needs to be in place to make sure that everything else can follow, and what the dependencies are if one benefit is planning to rely on a system that needs to be in place for another benefit. Having that overarching programme is one of the things that we think is now urgently needed. Once that is there, it is possible to put in place some more detailed plans for finance, to know what needs to be spent in each of the years between now and 2024 to get it up and running and to look at which staff are required for each of those key bits of work as it happens. I said in response to Mr Island's question that digital skills were one of the things that is lacking at the moment, and that is not just for this programme, it is Scotland-wide, but it means that the Government needs to have a clear picture of when people will be required to develop and deliver a particular solution to make sure that they are there and can then move on to work on another benefit at the right point rather than risking people being tied up elsewhere in the programme or in the Government at a point where their presence is key here. Gemma, do you want to build on that a bit? Absolutely. That critical path is really important. What we see is the need for both the kind of delivery timescales to work very much with the workforce plan and also with the finance plan, so that the three kind of sit together and support each other. That is also being done under a kind of revision of the overall business case that is under way at the moment, which again is kind of just allowing the programme to reset in terms of its overall case and its overall priorities. Essentially, delivery is not just about the timescales, it is about what is being delivered at each case and what that minimum, they call it a minimum viable product, so it is something that is enough to enable delivery, but that will be further built on over time. It is part of that iterative approach and it is really key to kind of say, what does that minimum viable product need to look like at each time, how will we build on that over time, and that forms part of that critical path as well. On the financial plan in particular, is it possible to develop a detailed financial plan at this point before things like level of payments, eligibility criteria, and things like that are fully defined? Is it possible to have a financial plan? I think that it is possible to revise the initial estimate in a way that is informed by everything that has been achieved so far. The bill was the financial memorandum set out a set up cost of £308 million for the programme and the agency. So far, the Government has spent about £87 million, I think that the team will keep me straight. Some of the decisions that have been taken to date will change that £308 million estimate. The Government always recognised that that was taken without knowing some key things and in advance of some decisions that would have long-term consequences, but two years in, it is very timely to revise it. It will need to be revised again, I am sure, but to do that means that both the programme, the Government as a whole and this committee can be monitoring how much is being spent, making sure that the overall costs are affordable within the total Scottish budget, and getting a sense of what is costing more or less than was expected and therefore what will be required for the remaining period. It is never going to be an absolutely accurate figure, but it is important that it is now revised from the initial financial memorandum figure to take account of where we have reached at this point. Finally, can we now, as Alison Johnstone touched on the first disability payment being expected to be in place for next summer, have the necessary decisions been taken to allow that to happen? Is there any risk to that timescale, that timetable of that first entitlement being delivered next summer? I do not know if you want to come in on the digital side of it, but we have seen a lot of groundwork going on for that benefit. There is planning in place, albeit with the comments that have already been made about the higher level planning, but one of the key things that we will need to see move forward over the next year is the digital infrastructure for that benefit to be launched. We know that there is work going on to appoint the contractor to make the necessary changes or developments on to the systems that are already there, and that will be a key element of progressing that benefit. I do not know if you want to add anything. For each of the individual benefits, the regulations have to be set and laid through Parliament. The necessary infrastructure changes to be made in terms of getting that system ready. There is also not just the digital infrastructure, but the wider infrastructure for delivering a benefit that is of a different nature, in terms of having a different eligibility criteria and moving into that assessment nature. There are those decisions to be made. We can see that there is planning in place to allow those decisions to be made. What we are talking about when we are talking about the critical path is something that sits above that over a longer time frame, but the individual project plans pick up on those individual items. I have two lines of questioning. The first is an overview, and the second is about delivering the new approach to dignity and respect. When I first read your report, I was alarmed at the number of times that you used the word series challenge, significant resource challenge. That has concerned me about the deliverability of the agency and the benefits programme. We heard from the Scottish Government last week that I felt less alarmed. I felt quite reassured by what they had to say when we put that to them. My question is, do you have any serious concerns that the Scottish Government cannot deliver in those timescales, or are you just reminding them along the way that you just need to get there? We think that they genuinely laid strong foundations for the next stage. You can see that in the way that the wave 1 benefits have been delivered and some of the building blocks have been put in place, and I hope that you have a sense from what the team has described about how the programme has done that. We know that the wave 2 benefits are a significant step up. The benefits that have been delivered so far will account for about 2 per cent of the total spend on social security benefits by 2024, the £3.5 billion. We are talking about 2 per cent of that, much smaller caseloads, much more straightforward to assess people's eligibility and on the whole one-off payments rather than regular payments that are the bulk of people's day-to-day living income. The Government itself recognises the scale of the challenge that it faces. It has been very clear that it is prioritising safe and secure delivery. I think that that is the right choice. As we say in the report and as the team has described, people are self-aware about what needs to happen. There is a lot of work going on to learn from experience. After the pregnancy and baby grant launch, there was a review of what worked well, what can be done better next time and lessons learned. That is all really good stuff. There is a risk that, first of all, the people who are needed to deliver it may not be available. We are talking about a vacancy rate of about 30 per cent at the time that our report was finalised, particularly in relation to digital skills and programme management skills. The other thing that would really help to manage those risks is that clear timeline from here through to 2024 of all the things that need to happen for the programme as a whole, rather than delivering the individual benefits that we set out on Exhibit 1. We really hope that that all works well and that there is a risk that it may not. The Government would then have to think through its own contingency planning for how it responded to that and what work-arounds may be possible. We know that it has done that in the past. We have got an Exhibit around the pregnancy and baby grant where the interface was not available and a manual work-around was put in place where that happens again. It has a knock-on effect, so it is understanding the programme as a whole and managing it very actively. I think that it is the best response to the risk that we genuinely think exists. I apologise that this is a very basic question, but so Audit Scotland is rolling all of this. When will we hear from you again about what progress you think the Government is making in this? As of now, we are auditing Social Security Scotland's accounts as an agency, and Mark will be leading that audit. I will be reporting it in the usual way in the autumn. We then have a continuing stream of work in the performance audit programme, which will follow up on this report in a wider way during 2020, given its scale in terms of the money that is spent and, more importantly, the impact on people's lives. We will continue to monitor it. We will now move on to the question of delivering a system with dignity and respect. You will know through the passage of the bill now that there will be several differences from the DWP system. One of those is that the redetermination process will be different, and, crucially, where the applicant is not being successful in the redetermination, they have the right of appeal, but we have a commitment in the act that the paperwork will follow to the tribunal should the person. This is all about accessibility, the appeal system and so on. Do you look at that level of detail or whether or not the agency can deliver on those commitments within the principles of the Social Security Act? We can look at that as part of the future performance audit work. The general principle is that it is for Government to set policy, and it has been very clear about its commitment to dignity, fairness and respect. It is now setting out its plans for what that means in practice, and in future audit work we can come back and look at how well that is being delivered. There is clearly a very important role for the Social Security Commission and for the Social Security Charter in all of this, and we recognise the progress that has been made in setting those up here, but we can look at how well those elements of the process are working as part of our wider look at the way that this policy is being delivered. You will know because you would require a different system than the DWP, because you are requiring your staff, your systems within your staff to do something different, but you will be looking at that. That is what you are using. I think that it is another example at where there have been real achievements so far and the next wave of benefits becomes more complex and more resource-intensive to do well, so we will be looking at how that is being set up. It is just worth putting on record, because the deputy convener mentioned evidence that we got from the Scottish Government that, on the 2nd of May, the Scottish Government also wrote to the committee in relation to its response to your report, much of which it welcomed. That is in the public domain on our website if anyone following committee proceedings wants to have a look at that. We will move to Keith Brown to be followed by Jeremy Balfour. Thank you very much. I am just looking at the issue that was raised by the deputy convener about whether this is a process that is being rushed or not. I notice that section 43 has given the example of a decision that was discussed at three board meetings of the delivery board, and your conclusion is to suggest that more time is required. Is that your view at that point that the benefits and implementation of them, the delivery of them, are being rushed and it requires more time in general? On the general point, Mr Brown, I cannot see the exact reference, but we will say a bit later in the report that it is hard to see how a programme of this scale could be delivered more quickly than it is being, particularly given the Government's commitment to prioritising safe and secure delivery. That was one example of a decision that took longer than expected and had to be taken out with the normal governance processes to make sure that there was not a knock-on effect on other parts of the programme. Gemma, do you want to say a bit more about it? Absolutely. What we have seen is that the programme has really good programme governance arrangements in place in terms of having the right governance in boards and the flow of information through. What we have seen over the past year is that, increasingly, that pace that the programme moves at is finding that some of those boards are finding it increasingly difficult to manage the volume of information that was going through, particularly one of the keyboards called the delivery board. That was getting a lot of information through and it was finding it quite hard to manage that volume of information. That was one of the examples that we saw, where there was a really big decision and a big decision that was key to how the rest of the programme would effect, because it was on a key system that was able to give enough time and space for it within the governance boards and have the right support to be able to allow the SRO to make a fully informed decision. We felt that, although that was within the SRO's role and within governance, allowing a little bit more time might have enabled the SRO to have a more fully supported decision on that. What we know is that the programme itself acknowledges that some of those governance mechanisms will not be right for wave 2 and is looking at that to make sure that the delivery board can manage the information that comes through, that the programme board, which is, I suppose, the most senior board within the programme, is getting the right level of information about some of the significant decisions that are being made in terms of significant procurement decisions and business cases, so that it has a greater role in some of those very key decisions. We know that, again, the programme is aware of some of those issues and are taking them on board and trying to rework some of the governance arrangements, so that it can cope with that pace and more complex information moving into wave 2. A kind of overview. I think that one of the things that we are clear about and from what we have seen is that there is so much to do. At the moment and at the time of our report, there was completion of wave 1, there was getting the wave 2 activity up and running the way that we have talked about, but we have also seen real ambition throughout the report about all the changes to governance arrangements, to ways in which things are done, but also that improved planning that is required, that improved financial management that is required, and the job of getting the agency from 320 people to where it needs to be. I think that at the heart of our concern that we have expressed about looking forward is that sheer volume of activity and how doable that is. As you have said, there is a timeline set out for that. The questions that we are asking, the challenge that we are putting, is how the detail of how that timeline is going to be delivered, given the significant volume of activity. Yes, it is under way, but it needs to be achieved to deliver on those timelines. Can I just ask, in the compilation of the report, if you talk to any recipients of the service, any service users? In relation to this one, we did not, because of the timing of it, we were completing the work in February, which was really just as the first benefits were being done. In future work, we certainly will. It is one of the things that we do routinely in our work, where that is appropriate. On early learning and childcare, self-directed support, talking to recipients is a key part of our work, and we will do that. That probably leads into another concern, which is whether the report is timely, given that you have not been able to talk to any service recipients, which must be surely a fundamental fact in trying to judge whether it is value for money, what the people that are receiving the service feel. I have heard accusations that the inquiries that are done by the Oric Commission are onerous. You have mentioned at the very start that the agency is working flat out. You have just said about all the work that they have to do, and yet they are also having to respond to what seems to be a fairly intrusive inquiry. It is also the case—I do not know what it would be interesting to know—what the cost of your inquiry is, whether that is in addition to any internal audit functions that the agency has? It would be interesting to know whether those concerns that are expressed by people about the role of the commission, especially at this stage, in the early part of the development of the process, are appropriate and proportionate. It is a judgment call that we always have to make. Auditors are sometimes accused of coming along after the battle and bayonetting the wounded. There is clearly a limit to how useful we can be if we wait until 2024 and then look back at what had happened over the previous six or seven years. I also think that this is such a significant part of the new devolved powers of the Scottish Government and the Parliament—£3.5 billion a year of benefits and an impact on the lives of the most vulnerable people in Scotland. Providing assurance to Parliament that it is being delivered well is a worthwhile thing to do. I am pleased that we have been able to give that assurance now. I think that the letter from the cabinet secretary recognises that there are some useful pointers from us over and above what the programme is already aware of for the things that need to be prioritised to get the next wave right, but it is always a judgment call. In terms of the costs of the inquiry that you have conducted and other audit costs for the public bodies involved? Costs of all of our work in central government are funded by Parliament through the SCPA. The cost of this piece of work was about £300,000, and when the annual audit is up and running, there will be an annual nominal fee for that, which comes through as well. Against the scale of the set-up costs and particularly the continuing delivery costs, it is a very small element that I hope provides useful assurance to Parliament about the progress of that significant policy. At my last point, it would be useful to get, if possible, in writing afterwards at the point that was made about this being a very important policy, and that is why it is important to get in early on, but also come back to it subsequently. It is the pattern of your work that you have, for example, a number of transport projects, on-going transport projects that you have been involved in as they have been going on. My concern is that the work that you do and the demands that you place on the bodies that you are investigating at the time when they are trying to get those things running can be very onerous and counterproductive to delivering the service. We work hard to make sure that it is not onerous and that it is proportionate to the scale of the programmes that we are looking at and the risks associated with them. It always is a challenge to make sure that we are not coming in too late for our work to be of value, both to the organisations that we are auditing and to Parliament. It is not uncommon for us to look at a piece of work as it is under way. We have done that with the major transport projects that you have talked about, things like the Commonwealth Games and Social Security Scotland, and the aim is twofold, both to give assurance to Parliament and to highlight things that can be put right before some of the very significant risk materialised but, if it would be helpful to the committee, I am very happy to write to you afterwards, setting out how we go about that decision making. Just at my last point, it would be interesting to know, because from what you have just said, there seems to be an awful lot of times when you get involved during the early parts of projects or initiatives rather than waiting to see what has happened and then looking at voting for money. It would be useful to know exactly what criteria are used when you decide that. If this is part of a set of priorities that you have at the start, which you apply consistently or whether it is just taken as things arise, it would be useful to have that information. It is very much part of our programme development activity, and the aim is, as I said, to make sure that, where we think that it is appropriate, we can make sure that building blocks for success are in at an early stage to avoid having to come along later and report on something that has gone wrong, but I am very happy to follow up with the committee. Thank you. Jeremy Balfour. A couple of questions, or a couple of lines of questions, are actually okay. The first one is, obviously, the Scottish Government's original plan was to have everything over by the agency by 2021. Clearly, from your report, that was probably never going to be likely and possible. I suppose the risk now is the relationship with the DWP both in regard to the financial cost, because my understanding is that the contract had been negotiated for a certain period of time, and that's obviously going to have to be extended. Did you look at what costs it's going to be for the Government to then renegotiate with DWP a fresh contract for them to deliver what the agency was meant to be delivering? At this stage, we haven't. The announcement about the timeline for transferring existing complainants' claimants was made right as this report was being finalised. It's something that we will seek to look at in future audit work that we carry out, and I'd come back to recognising the Government's commitment to safe and secure delivery of the programme and the finding that we make in the report about the extent to which the complexity of what's involved is becoming apparent to everybody, to the social security programme here in Scotland and to DWP as the work progresses, so we'll look at that in future. Auditon seems to be a very dark art, which goes beyond my intelligence, but in regard to the auditon of your counts, which will be reported in the autumn, as you said, would there be some kind of reference to on-going cost beyond that, or would that be a separate report that you would have to do to audit something that's going forward? It would almost certainly come in the future work. The audit report that will be published in the autumn will look at the 2018-19 accounts for Social Security Scotland, and it will look at what's within the agency rather than what's within the wider programme to set this up. My secondary is quite specific. One of the commitments that the Scottish Government has given, which I think is very helpful, is to have two or three staff in each place. Do you think that, from your auditon, that that can be met within the timescales that they'd hoped to have met? Is this another area of concern in regard to the treatment that we're just struggling to find people to do this, or is that an easier one than perhaps some of the IT staff? My understanding is that the Government is still looking at its options for how it will do that. I think that Kirsty can tell you a bit more about that. As we set out in the report, the planning for that local delivery element is under way at the moment. It's at an early stage, but we do know that there is recruitment on-going for some of the staff that will be required with an aim to have about 100 members of staff in place by the end of this year. I think that recruitment is still under way, but there is progress being made on that. As we report in hear about the challenges about recruitment, that is really about the programme side, so the implementation team within the Government directorate, because we really haven't seen the same recruitment issues for the agency itself. It's had a really high level of interest, in particular its client-facing roles, so it's just to draw that distinction for you. I suppose that that just leads me to my final viewpoint. Is it in regard to, obviously, we've got the Scottish Government doing a lot of the IT work procurement stuff, and we've got the agency delivering it? Again, from the conversations that we've had here at the committee, there seems to be a good relationship between the agency and the Scottish Government. Longer term, would you see them being merged together all into the agency, or do you think that there will always have to be some kind of work done by the Scottish Government in regard to the bigger pieces of work and the agency delivering it, or do you think that the agency at some point beyond 2024, probably, will then be able to do everything, and is that where we should be looking to end up? My expectation is that the agency will, as you say, be taking on all of the day-to-day operation of the social security system. I think that the programme team will certainly reduce insights as all of that is set up work and the transfer is completed, and then there will be a decision to be taken about whether the Government's social security policy team should sit to continue the development of any new benefits or changes to the eligibility of the existing benefits within the current settlement, so there will still be a need for that capacity. I appreciate that the report is very much focused on the implementation of the devolve powers and the focus on social security Scotland. However, in your report, you recognise yourself with the interface with the DWP, and that has been part of the questioning so far this morning. If you look at paragraphs 125 to 128, there are a number of references to the ongoing delivery relationship that will need to be carefully managed. The transfer of people from the DWP systems and benefits to Scottish ones will continue for several years. The concluding sentence of that section, the Scottish Government will therefore need a long-term arrangement to verify this information with the DWP. My questions are around who audits whether the DWP is doing its job in delivering devolved benefits well. Clearly, the national audit office audits the DWP, but in your methodology and appendix 1, you have not reviewed or looked at any information from the DWP or the UK Government. You have not spoken to representatives from the DWP or indeed the national audit office, so is not there a need for some form of auditing of that interface? Is that something that you are going to be looking at in the future? You are absolutely right, Ms Robertson. This is a new area for everybody involved. Until very recently, the devolution settlement was quite clear. If something was not reserved, it was devolved and we audited it. We are now with social security and taxation in a position where large UK Government agencies, DWP and HMRC are closely involved in delivering things that are devolved to Government through the tax and social security powers. There has been a conversation between the two Governments about the audit and accountability arrangements for that, and a new framework has been agreed just in the last couple of months. Under that framework, I do not have direct rights of access to DWP or indeed HMRC, but there are arrangements in place for my teams to work very closely with the teams in the NAO to make sure that, between us, we are able to cover what is needed and to give the assurance that both of our parliaments need. Mark can give you more of a flavour of how we have done that in relation to that work? The framework of the Auditor General first, through the Audit and Accountability Framework, was a framework that the committee gave comment on an earlier draft, and it has only recently been developed and agreed. That gives us the potential to work with colleagues in the national audit office to see the other side of defence, to see what is happening in DWP, and we will look to explore how best to do that as we do some of the future reporting in this area. That arrangement was not in place for this report, so we were unable to do that for this report. What we are unable to do is look from this side of defence for the better phrase. We have some experience with that through the annual audit, which we have referred to a number of times, where we have done some initial work with national audit office colleagues to give us the access to the information and the evidence that we need to form an opinion on the accounts and what we do around the audit of the agency in this year. We will look to build on that as we go forward to make sure that, as we do the work in the years ahead that we have set out, that we are able to have a balanced view of what is happening at the Scottish end but also how DWP are contributing to that. So, just to be clear, what you are saying is that now the new framework is in place, future reports like this, we would expect to see in the methodology discussions having taken place in a O and that that would be reflected within the body of the report. I hope so. The framework gives me the ability to carry out direct audit work of DWP with the agreement of DWP and the NAO. It has marked that we are still testing out what that means. There is a commitment from all parties to make this work, but we have not yet had the chance to do it in practice. I share your concern that we need to be able to look at some of this directly to be able to draw conclusions for how well things are working in Scotland and where things need to improve. Michelle Ballantyne. I want to explore a couple of things, but I would like to start firstly to revisit some of the staff vacancy side. You talked about a 30 per cent staff vacancy in here and you have mentioned it again today in your evidence. When we heard from the cabinet secretary, she said that you had taken a figure at December and that that actually was misleading because the total figure required was for the full year and that they hadn't finished recruiting because they didn't need them up until December and they were going to have them all in by the sort of end of the year. She did suggest that they hadn't made the total figure, but I just wanted to put that to you. Is that a correct understanding that she gave us that you had misunderstood the numbers? Our report was finalised at the end of February and obviously with vacancy rates, the figures that I point in time. We know there is continuing recruitment going on and I'm not sure if Kirsty can provide us an update with that, but before I ask Kirsty to add a bit more, I'd say that the other thing that we're concerned about has been high levels of turnover and some key posts. You'll see that we refer particularly to the programme manager, three different post holders over a period of time and an interim person at the time that we finalised it, so we recognise the work that's going on to fill the vacancies and it hasn't been straight forward to do that. Kirsty, can you add a bit more detail? As the order general has mentioned, at the time of reporting and indeed now we're aware that there is an enormous amount of recruitment on-going within the programme, so the position that we've reflected in the report is, as it was when we were looking at it, that will indeed, I'm sure, move in rates like this, we'd fluctuate, but it's also the position that we're reflecting conflicts are wider picture that we saw when we were out speaking to people within the programme that of the recruitment challenges and how they were having to manage vacancies, so that gives them a wider picture about that number. They gave quite credible evidence about the fact that they would, if you like, backstop the difficulty in recruiting the skills needed by training them in-house. Did you see any evidence of that development? Do you think that that is viable within the current strains? Yes, so we did see evidence of that. I mean, I think what the programmes really tend to take quite a kind of pragmatic approach to filling the vacancies, it kind of appreciates, particularly on the digital side, the issues within the wider market and that kind of, I suppose, that very realistic approach that it's very unlikely that it will always be able to fill all the vacancies that it has given that external market condition, so looking at other ways to be able to bring in those skills, one of those is exactly that, growing their own. The social security programme, being a programme of its size, offers great opportunities being able to do that and for those people to get those skills and then to work on other projects around the Scottish Government as well, so they are looking at that and working with colleagues within the digital directorate who are just creating essentially new professional communities around some of those skills as a way of being able to grow that, so they're working very closely with the digital directorate and also places like the digital academy to make sure that those skills are being bought through. Obviously, that's not a short-term fix, that's very much a kind of longer term gain, but that is something that they are working on at the moment. Will they be able to, because obviously with the retention issue, the key thing for developing your own skills is having the skills in the first place to actually share and develop, so are they going to be recruiting specifically? Is there any science that they're allocating that as a job or is it just by osmosis from the people in post? In terms of having people there who manage the recruitment, is that the question? No, to develop your own, you've got to have people doing the training, giving benefit of their experience and enabling people to empower people to learn and develop on the job. If they're under pressure already, which your report indicates they are, I'm just wondering how the capacity is being built in the system to actually allow that to happen. I mean, I think it is the right way to go and it's laudable, but I'm just wondering how that will sit alongside that strain of workforce capacity. I suppose there's a couple of elements to that. I suppose some of the things that we saw was one, them working very closely with digital directorate to make use of the capacity within the digital directorate and some of the programmes that they have on-going in terms of bringing in that wider Government position, in terms of making sure that wider Government has got the people that it needs. The way of working within the programme in terms of we talk about multidisciplinary teams within the agile approach, which is where each team brings in all the different people with different skills together, and that allows for some of that learning on the job and lessons learned. We've seen, again, them having regular lessons learned sessions. What I would say is that it comes back to some of the points that we were talking about earlier, around that critical path, about that need and then to be supported by a workforce plan, which clearly shows and predicts what are some of the key skills that are going to be needed, when will they be needed, when will the skills move between the different projects, so that there is that longer term planning to understand what are some of those critical skills going to be and what actions can we do now to make sure that when we need those people they are in place. They are absolutely doing some things at the moment, but it forms part of that wider critical path and workforce planning, which is so crucial. That leads me very nicely into the second part of things that I want to ask about, and that's around risk management. Although you talk about a lot of risk through the report, I didn't come away from it with the real sense of how is risk managed. Is there a risk management system in place? Is there some sort of RAG system? If so, does your analysis concur with the analysis of risk that is made within the directorate? Aligning to that, when you look at the financial analysis of what it is costing and the budget flexibility, the time goes out, but the recruitment is in place or coming into place, but the time frame is stretched clearly, and then the budget will be stretched too. The multidisciplinary working and the cross-working across the digital directorate, how, again, is that cost and risk managed? Obviously, when you're pulling from all places, the budget may be picking from other budgets as well, so I'm just wondering how that's been managed and whether you can follow that. I don't think that we've ever been asked directly about risk management origins before, so thank you for the question. It's clearly something that we are looking at closely. I think that that's a good example of the finding that we make in the report, that the governance arrangements that have been in place so far have been good and fit for purpose and aren't sufficient for what will be needed for Wave 2 as the scale and pace ramps up. Gemma, you've seen it directly. Do you want to give a sense of your perspective on risk management? Absolutely. What we say in the report is that this is a well-managed programme in terms of the programme documentation and some of the systems that it has in place. There's certainly among some of the best that we've seen across large-scale programmes in government. That's the same with its risk management approach. It's got quite a thorough approach to risk management and certainly all the kind of documentation and systems that we would expect them to have in place and regular consideration of those risks. What we see when we look at the risk register is that one of the top risks, for example, is vacancies, staff turnover. We recognise when we look at the risk register some of the risks that we see ourselves on there, which again gives us assurances that risk management processes are looking at the right issues. As the other general said, it will be one of those things that we'll need to be looked at and refined as going into Wave 2 to make sure that they're picking up on the interdependencies and the complex nature of some of those risks, but absolutely the terms of the documentation, the systems and building block. Also, I suppose, the attitude to risk and how seriously they take looking at that, those building blocks are well in place within the programme. I've got a final question from Keith Brown. I was interested in that last exchange where you mentioned you're looking forward and said that what the government has is insufficient for what's about to come, which again stretches my understanding of the remit of the commission, which is now looking forward to what the government's going to do in making comment on that. However, you mentioned earlier on that you saw the role as being so that we, the commission, can ensure that building blocks are in place. I just wondered the extent to which you felt that was your responsibility and what, if it is, the responsibility of the Government of the day, the elected Government, which is going to be held accountable for what is their responsibility in relation to that. Is it subordinate to yours or who is at work? Of course not. It is the Government's responsibility both to set the policy and to implement and deliver it. My responsibility is to report to this Parliament on how well they do that. Sometimes, as you say, we do that after the fact. Sometimes when there are really big and complex programmes and projects like this, we'll do it during the process to provide assurance that those building blocks are in place when there's still room for improvement. I'm really pleased that we've been able to say in this case that the foundations have been set well in place and the first wave commitments have been delivered. To give this committee and the Parliament more widely an indication that the next wave will be much more challenging, the Government is aware of that and is doing the right things, but there are still significant risks that need to be managed. That's my job. Okay. Unless there's a final question, so that wasn't the final question. I mean, again, it's going to be a bit back to the previous question. I suppose, and I put it on record that I lived through the tram to Barco here in Edinburgh as a local councillor. On a number of occasions, your predecessors did reports and they were all very positive. It's all going well, it's all going well and then obviously it didn't go well. I mean, I suppose my question, my missus, is how robust can you be and are you able, in a both positive and negative way, to highlight things at an early stage in regard to that? Because I think one of the things I was frustrated about as a local councillor was we got all these reports telling everything was fine and then it went wrong and I think as politicians and more of a point of the public, we'd much rather know it at an earlier stage if things aren't going on time and aren't going right so we can then respond to that. Are you confident that you can be robust enough to do that? It's fair in terms of what I thought was a really fascinating question to the tram to Barco. It's worth noting for everyone listening that it might be worth checking out the speech from the Cabinet Secretary for Finance, John Swinney at the time in relation to the £0.5 billion for trams and what the Scottish Government position was in relation to the business plan for that, given the fact that what we're doing here today is scrutinising the Scottish Government's delivery of a service rather than a particular local authority, but any comparisons would be very welcome. That's really helpful, convener, thank you. I should just so the record be clear that I've been Auditor General since 2012, so those reports predated my responsibility in this area. I don't audit local authorities just for the record, but I think in some ways the answer to your question, Mr Balfour, comes back to the questions that Ms Ballantyne was asking. We can't give a guarantee that something is going to succeed or fail. Nobody can do that if we're looking forward. What we can do is look at the risks that are involved, the way those risks are being managed and the extent to which people are understanding the whole picture. We say clearly in this report that the foundations are in place and that the first wave has been delivered well. We're giving this committee an indication that wave 2 becomes much more complex very quickly and there are risks that need to be managed. You've got my assurance that we think risk management is good if the programme is self-aware. There are some really big and complex things in here around the availability of the right people, the complexity of the digital solutions that are needed and the interaction with DWP that would not be easy in anybody's management of the programme. That's what we're here to give you. I'm very pleased that we're scrutinising the delivery of wave 1 and wave 2 various of the new Scottish social security system and not doing an inquiry into the Edinburgh Thrams project. I think that this might be a lot more straightforward despite its complex nature. Thank you to our general and your entire team for coming along and providing evidence this morning. We very much appreciate your time and your expertise and your information. That concludes this particular evidence session. We now move to the next item that we need to take in private.