 Good morning, and welcome to the 13th meeting of the Public Audit and Post Legislative Scrutiny Committee in 2019. We have apologies this morning from our convener, Jenny Marra MSP, and so as deputy convener I shall convene the meeting in her absence. I would like to ask everyone in the public gallery to switch off their electronic devices or switch them to silent mode please so that they do not affect the committee's work. Item 1 on the agenda is a decision on taking business in private. Do our members agree to take items 3 and 4 in private? Yes. Thank you. Item 2 is consideration of a section 23 report, which is the social security implementing the devolved powers report. I welcome our witnesses to the meeting this morning. We have Caroline Gardner, the Auditor General for Scotland, Mark Taylor, Audit Director, Gemma Diamond, Senior Manager and Kirsty Rydd, Senior Auditor, all from Audit Scotland. I would like to invite the Auditor General to make a brief opening statement at this stage. Thank you. Today's report is the latest, examining how the Scottish Government is implementing the new powers arising from the 2012 and 2016 Scotland acts. It focuses on the social security powers being devolved and assesses progress up to the end of February this year, takes account of the activity that is still under way and provides an update since I last reported in March 2018. The Government has done well to deliver the commitments that it made for last year, including launching a new agency, Social Security Scotland, which will be responsible for the delivery of the benefits once they have evolved. The agency became operational in September 2018 and employs over 320 staff so far. The Government has also put in place the systems and processes needed to allow it to launch the first two benefits, the carers allowance supplement in September 2018 and the pregnancy and baby payment of the best start grant in December. The social security programme has laid the foundations to support the delivery of future benefits and promote its aims of fairness, dignity and respect. Publishing the first social security charter and establishing the Scottish Commission on Social Security are important parts of that. Against this background, however, delivering the first benefits has been harder than expected. The programme has been working flat out and the scale and complexity of the work involved has become clearer as teams plan for the delivery of individual benefits. The programme has continued to find it hard to recruit the range of skills and experience that it needs, and that has put pressure on staff and led to a greater than expected reliance on temporary and contractor staff. The programme's financial reporting has improved, but it still focuses on spending against annual budgets, and the programme does not clearly monitor or report how much it will cost to fully implement all of the benefits. Delivering the second wave of benefits will be a significant challenge. Wave 2 includes the most complex and highest-risk benefits, with larger caseloads, much more complex eligibility assessments and regular payments that will affect people's day-to-day incomes. There is a wide range of work under way to prepare for the next stage of delivery, revising the overarching business case, reviewing governance and planning processes and work to put the necessary resources, particularly staff, in place. The programme is doing the right things, but there is a risk that the pace of work and the constant delivery pressures may not allow the team time and space to make changes quickly enough. Critically, the Scottish Government does not yet have a clear understanding of the key things it needs to do to deliver all the remaining benefits in the way it intends. My report highlights the need for the Government to develop its critical path of the actions that are needed. That should include a clear estimate of the overall cost to implement the social security system, reflecting the decisions and commitments that have already been made. As always, we are happy to answer the committee's questions. I am very grateful for that. We will move straight to questions with Colin Beattie. O'r general, it is good to see a positive report. What I am concerned is the recurring theme about the lack of skills available in the market. Presumably, that is particularly IT, although, if there are other areas where there are skills lacking, it might be good to draw that out and get a bit more information on that. Of course. You are right that there are skills that are in short supply across the Government, as well as across Scotland as a whole. Digital skills are a key part of that, and so are programme management skills, particularly the agile skills, that are needed with the approach that the programme is taking. Gemma, do you want to say a bit more about that? That is a recurring problem that we have seen across many areas of Government over the past couple of years, particularly on major programmes. The programme is working really hard to get the staff that it needs, and that involves working really closely with initiatives such as Digital Academy, where they are trying to grow their own skills, to bring them into the programme and working with initiatives such as CodeClan to try and develop those skills, but it is a challenge for them. It features very heavily on the programme's risk register as one of their major challenges. Given the scale of the work and the number of people coming in, and the types of work that they are undertaking, it is a large agile programme, so some of those agile skills are not regularly found in Government, and they absolutely have an approach of growing their own, but they are also bringing in contractors to try and help them to learn throughout the programme as well. It is highlighted that the number of contractors is about 107, and the number of full-time staff is about 356. The number of contract staff is quite high. Of those contract staff, how many of them are IT? In our exhibit on page 19, the chief digital office has got 51 contractors against 46.4 per staff. The chief digital office has got the highest ratio of contractors. Given the difficulties in the market, that is not a surprising position for the chief digital office to be in. It is absolutely trying very hard to address those challenges. One of the things that it is doing at the moment is trying to find a strategic partner so that it can bring in contractors in a more managed and strategic way rather than having individual contractors from different places. The chief digital office has got a more strategic partner approach to that, so that is something that it is trying to do to address some of the challenges there. If we look at primarily on the IT side, that is a recurring problem throughout the public sector, as our general stated. We are implementing a programme here, so additional staff are needed to allow that to happen, and additional techies are needed to allow that to happen. How many of the interim staff that they have got, the contract staff that they have got, would replace the equivalent of permanent staff? How many are there just to implement the programme and would go away at the end of the programme? I am trying to get a grip of how big a shortage it actually is when the programme is up and running and where it would reach some sort of balance. That is something that the programme is looking at at the moment in terms of what might the future needs of the agency be for running the system when it is fully operational. They are looking at that at the moment, and certainly what the digital office is doing is looking to see how they can recruit into permanent posts those positions that will move across into the agency. That work is on going at the moment and will be more developed over this year as part of the full workforce planning approach at the moment. There is no firm position on that, but if we are talking to them we know that that is an approach that they are looking towards. Paragraph 48 of the report highlights the lack of staff continuity, particularly it is highlighted here that there has been three programme managers and the process has been vacant for three months. What are the implications of that? Is it again a skill that is in short supply? Mark, you asked at the start of your question about the other skill areas. That experience of programme management and particularly the experience of managing programmes of this size scale and complexity is one of the things that have been really challenging for the programme to get hold of. The implications of that are that it is a contributory factor very much to the things that we say about planning more generally without having that key capacity and that key role of being able to co-ordinate and plan and look ahead and no doubt an area will come back to. It makes that much more challenging to do without the skills in place. It means that, as new people come in, there is that additional on-cost of getting people back up to speed and understanding and plugging into the paragraph. The other area where there has been skill shortages particularly is around finance and it might be an area that we will come back to later to. The programme manager is very much within that overall sense of capacity for programme management and that is a critical role. The programme management is a key post and although it took a while to fill that, it is now being filled but there is a whole range of people who go around that in terms of the programme and project management function. They have already been through three programme managers, according to the report. Isn't that exceptionally high? I think that that illustrates a wee bit the challenges here and also the fact that this programme sits in the wider set of challenges that the Scottish Government faces and we say elsewhere in the report that in many areas there is a competition for our squares resources in those areas. Within the resources available to the Scottish Government, there are obviously lots of projects that come and go of varying sizes within the Government. Is there any transfer of skills from other areas to try and help here? In other words, we have people who have been through this, who have the skills within the Government, can we move them across to support? For the social security programme, the largest programme of this scale and complexity within the Scottish Government. In terms of learning from experience, what the programme has been able to do is to get people who have experience from across the UK into the programme. There are lots of people working on the programme who have worked at DWP, for example, or on other big change programmes across the UK, so they are able to bring that experience into the Scottish Government. What the programme director is looking to do in that approach of growing their own skills is very much that it is not just for the social security programme, but that it will benefit them for the wider Scottish Government, for the people who have worked on social security and had some experience, can then go out and use that experience on other programmes. It is more work in the other way in terms of the social security programme being able to give people that skills and experience and then be able to go out and work on other programmes across the Scottish Government. Presumably at the point that the project was getting ballpark costings, they took into account the fact that there were skills shortage and that they would have to go out and get contractors in. Has that side of it come in within budget? Is it what they anticipated? It is fair to say that the initial £308 million within the financial memorandum alongside the bill when it was introduced had to be a ballpark figure. At that point, there were many decisions that had not been made about the approach to delivering benefits, about the eligibility criteria, about the way in which it would be delivered and therefore the costs of developing IT and so on. We say in the report that the number of temporary and contract staff and their cost was higher than was expected initially. That has been managed within the annual budget so far for the programme as a whole, but one of the key recommendations in the report is that the Government has not updated the overall cost of implementing the programme since that initial £308 million that accompanied the bill. Given that there have been some significant decisions and more commitments for the future, it is important that that £308 million is now updated so that the programme can manage to it and so that Parliament can scrutinise it. If I might just follow on, Colin Rays is a very interesting point about people being transferred in. At paragraph 57, there is a line that says that staff are transferring between directorates, which I think that you will correct me if I am wrong, but I think that that means that there is internal transferring going on between Scottish Government departments. If I am right on that, is what you are saying that in an apparently short-staffed operation anyway, there are internal transfers going on where other Government departments are cannibalising the people that we have in the first place? You are right that there are pressures on the Scottish Government as a whole for the sorts of skills that we are talking about here. As well as what I have reported on in relation to social security in last year's report on the Scottish Government, that sense of stretch and of people being moved to respond to the most immediate pressure is one of the things that I am concerned that the Government is needing to manage with all of the other pressures that it faces. General Kirstie might be able to tell you a little more about what is going on in paragraph 57. As the Auditor General mentioned, what we are referencing in that paragraph is that move between directorates, where there are skill areas that are needed across the different programmes that are on-going within the Scottish Government, particularly around the project or programme management type skills. It is something that is not unique to this programme. We see people moving between different programmes and it is not necessarily unique to the Scottish Government either. It is something within civil service that we see as people being moved where skills are needed and people see indeed opportunities to develop in their own career and develop their own skill sets. That is definitely what we are relating to there. Willie Coffey Thank you very much, convener, and good morning. I wonder if I could pick up on the IT development methodology that has been deployed here. From what you are saying, the initial phase of this has been pretty successful. It uses the agile methodology, which is relatively new. As I understand it, for the Scottish Government to deploy, it is based on a shorter, faster turnaround iterative developments building only, what needs to be done in the short term and progressing in that manner. That has been pretty successful so far, but it has even become to Wave 2, Auditor General. You were saying in your opening remarks that things will become a bit more critical and a bit more complex there. Do you think that the continued application of that methodology and that practice will be sufficient to deliver the Wave 2 implementation? I am sure that Gemma or Kirsty will want to come in at a moment, but you are right. We think that it has been pretty successful so far. People often tell us that they are using an agile methodology when they are not planning well enough what it is that they are trying to do. That is not true in this case. People understand it. They are putting the resources, the training, the management time into doing agile well. We can see it in the way that they have responded to unexpected things that have happened, such as the failure to have in place the interface needed for the pregnancy and baby grant. People were able to respond to that and put in place contingency plans that meant that they met the commitments that had been made. That is a good thing. However, doing that has taken up a lot of time. People are working hard. There is very little time on top of what people are doing to manage the immediate demands to be planning ahead. Particularly in the context where the Wave 2 benefits are going to be much more significant in terms of money, about 98 per cent of the total spend involved is still to be delivered through the Wave 2 benefits. It is much more complex in terms of the assessment of people's entitlement, assessing people as a one-off entitlement to a pregnancy and baby grants, very different to assessing their eligibility for something like the disability living allowance and regular payments rather than one-off payments. All of that means that it will be much more complex. My concern is that with the current short-term planning timescale and the pressure on resources, it will be very challenging to meet the commitments that have been made without getting that overarching timescale in place and the detailed financial and workforce plans needed to make sure that the programme understands what resources will be needed and when to deliver them. You say also in paragraph 122 that you are thinking about partnering up rather than continually bringing in contractors. You think that we are thinking about partnering up with another company or agency. That delivers more stability to the whole programme rather than continually swapping in and out contractors. Is that correct? I am understanding on that. Yes, absolutely. For the chief digital office, it is a way of addressing the reality of the situation is that they are probably never going to be able to fully fill all the permanent posts that they would like to fill given the shortages in the market, so trying to find a more strategic way of doing that rather than just bringing in individual contractors one at a time that to have a more strategic partnership gives them slightly more control over that. Do you know where we are with that? Is it done or is it... That is still under way at the moment, as far as we are aware. It is definitely going to happen. That is one of the options that they were considering at the time of the report. One of the things that I learned about Agile is that it is perhaps when you have contractors coming and going so rapidly in previous examples that provided a difficult take for new staff joining the programme to understand what had been done and it is all about writing software and producing proper documentation so that people can pick up easily. My understanding is that Agile does not lend itself particularly well to detailed, lengthy documentation as you go. I may be wrong there, but that was my understanding in previous examples at this committee. My concern may be that if you continually shift in and out contractors on a six-monthly basis and you do not have the substantive documentation within the system and you are facing increasing complexities that the auditor general has outlined, that is going to increase the risk for delivery. Is anyone concerned about that? Are they managing that process successfully enough at the moment? What we have seen is that they have very good governance arrangements over the programme. In terms of technical architecture, they have particular boards in place to consider those issues to make sure that across the system everybody does understand what the technical criteria are. We know that, as the programme moves into wave 2, things become much more complex. For this system, there will be one core system that deals with all benefits, unlike at the DWP, where there are different systems for different benefits. This one system will cover all benefits. That creates a very challenging technical environment where you have a system that is already delivering payments and making payments and one that you are also trying to expand to do new things. They are currently considering the current governance, the right governance, to be able to manage in that more complex environment. How do you have governance in place where there may be two or more agile teams working in one particular area? To date, they have been able to have one agile team per benefit, which is much easier to manage. What they are starting to think about is how do you manage agile at scale? Essentially, they are looking at what other programmes have been able to do, particularly across the UK, and how that works to see if their governance is at the moment and that has worked for them at the moment for the wave 1 benefits will be right when they move into that much more complex technical environment into wave 2. That is, again, one of those reviews that is on-going at the moment. When would you see the next appropriate point to give us some kind of update on the wave 2 implementation, how early or soon might that be? This programme is one in a series of reports. The team will be scoping up what we will do next quite soon, but it is worth noting that now the social security agency is up and running. We have also got the annual audit report coming through and that might be an opportunity to provide an update to the committee on progress with the overall programme, so we will keep you posted as that thinking develops. Quick matter arises—I may have misunderstood this, but Willie Coffey asked about partnerships with agencies in order to get in talent, if I can put it that way. That sounds like a good idea, but is that not the problem that we have seen with some of the Scottish NHS, where we have a very small and finite number of agencies providing a small and finite number of specialists and therefore the costs go up and the churn also goes up? Is that a concern? There are some similarities in that whenever you have got a shortage of staff, there is a risk that costs increase. We see that across digital skills as well as in the NHS. There is also a difference in that it tends to take much longer to train doctors as a cohort than anybody else, from the time that the school either enters medical school to the time at which they are a fully-fledged consultant, for example. It is much longer than the time needed to produce somebody with some of the skills that we are talking about here. That is why the sorts of initiatives that Gemma talked about around training staff, making partnerships with code-based CivTech and some of those initiatives that we mentioned in the report are so important. They can help in the short term rather than simply having to think about a 10-year timescale, and I think that Mark is going to add something to that as well. The other example that a number of us around the table have had experience of is the agricultural payment system, farm payments, where that was part of the solution that was developed. I think that it illustrates that this is not a silver bullet. There is a need for a range of things to be done to make sure that the capacities are there. Underlying all of that is that there is limits in capacity in the market for those sorts of skills. Governments competing with private sector and other parts of government for those skills is the underlying issue that it needs to deal with. Good morning. I want to change the focus a little bit on decision making and then on costings. In the report, you say that continuous short-term pressures mean that it is difficult for the team to pause and refocus activity, presenting risks to overall delivery. Many decisions about future benefits and how they will be delivered in the long-term are still to be made. What decisions are outstanding and what are the implications of the delay, and what decisions should have been made by now that have not been made by now? It is important to start by saying that the Government's overall approach to this has been a commitment to safe and secure transfer of the new powers, delivery of the new benefits from the existing DWP responsibilities. That has underpinned the approach that it has taken so far. It chose to prioritise the wave 1 benefits that were simpler to administer, easy assessment of eligibility, generally one-off payments, generally quite small numbers and quite small money involved. It has been successful in doing that and learning from it. It has now set out the timescale that it plans to adopt for full transfer of responsibility for the remaining benefits that are set out in Exhibit 1. For new claimants, that will be complete by the end of 2021. The transfer of existing claimants will take until 2024. Within that, there are a lot of decisions to be taken about, first of all, how the benefits might be changed as they become Scottish benefits rather than UK-wide benefits, what that means in terms of eligibility, in terms of assessment, in terms of assurance that the right people are getting what they are entitled to and that other people aren't. All of those decisions will need to feed through to decisions about the work that the programme needs to undertake, the staff required in the agency, the IT systems that need to be in place. There are some really important decisions that are still to be taken under that overarching timeline that is there. My concern isn't that those decisions should have been taken by now. I think that that's a policy decision and safe and secure is what's driving it. Until those decisions are taken, it's very hard for the programme and the agency to be planning what needs to happen next, which is why I'd like to see that critical path covering the next three years. How many of those decisions are time-sensitive? From what you're saying, if they are identical benefits to the current regime, then it's perhaps less time-sensitive, but if there is to be a change in terms of the value, the eligibility, that decision needs to be taken quite quickly, so the infrastructure can be built underneath it? That's broadly true, and I'm sure that Gemma will want to say a bit more in a moment. The other thing that's worth stressing at this stage is that whatever decision the Government takes, it will continue to have a lot of interdependence with reliance on DWP systems for the foreseeable future. Making sure that the Government's planning can interact with what the DWP is planning to do, that systems are in place, that information is available, all of those things in time should be affecting the decisions that the Government's taking as well as being affected by it. Gemma, do you want to elaborate? We mentioned a lot that the programme is working in an agile way, which means that it's developing as it goes. A key part of that is bringing in the experience of users into that, so that it's making sure that, as it develops the benefits, it's consulting with users about what the most appropriate thing to do is. There's a lot of legislative steps within that in terms of setting out new regulations for new benefits as well. What we're looking for at this point from the programme in terms of a critical path is showing where some of those interdependencies are, in which order do some of these decisions need to be made and which will affect all parts of the programme, which will affect certain parts of the programme, so that we can understand where some of those key decision points are and where the timing really matters on some of those, for example, if it affects a procurement and where there's some flexibility within other decision points and if, for example, if one decision point was to be missed, what would the knock-on impact of that be? So what are we looking for? Is that a level of critical path to understand where some of those time sensitive decision points are and what impact that has across the programme? Just to clarify, what you're not saying is what quite often happens in organisations is that there is dithering on a decision and you sleepwalk towards a problem. That's not what you're suggesting. You're suggesting that there's policy, decision and implementation decisions that need to be made as we move towards the phasing and other benefits. Is that correct? It's absolutely correct and I think that the thing that I'd like to stress is that it's important A, because it's so complex and those decisions won't be simple decisions and B, because they're decisions that will affect some of the most vulnerable people in Scotland, so having that overarching timeline, as Gemma says, with the key decisions that need to be made and understanding what the effect of delays or bringing things forward might be feels to us to be critical now. Moving on to the costing, the report says that the Scottish Government does not yet have a clear understanding of the key things needed to deliver all remaining benefits in the way it intends. That includes not monitoring and reporting how much it will cost to fully implement all benefits. Just to clarify, are you really saying that the Scottish Government isn't monitoring on the cost of delivering benefits at once devolved? Not quite, I wouldn't put it that starkly. We have got the £308 million financial memorandum cost and the Government has now improved its annual financial planning and monitoring, so we show in the report in Exhibit 4 the amount that's been spent up until the end of 2018-19 financial year. The £308 million that we know will have changed because of decisions that have already been made, contracts that have been let for IT, the staffing that's in place for the programme and the agency decisions about benefits. The Government needs also to be thinking about the likely cost of the policy commitments that's made so far for the remaining delivery to update that £308 million, break it down over the time phasing that Gemma's been talking about, underpin it with particularly digital and workforce plans, and then start looking at the overall cost. That will enable the programme to make sure that the plans that it's making are within the overall budget, to monitor spend as it goes and obviously for Parliament to be able to scrutinise that in the way that it should be able to. We'll come back to the £308 million in the financial memorandum in just a second, but just focusing on the monitoring and reporting of the cost, can you set out what the implications of that could be for the taxpayer, for the cost-effectiveness of the policy on the overall Scottish Government budget or indeed the value of the benefit itself, if there isn't a adequate level of monitoring and reporting on the cost of implementing the benefit? You won't be surprised to hear me say that it's important for any significant project that's spending public money that there should be as clear an idea as possible of what that's going to cost and what people expect to achieve from it. It's inevitable that the initial estimate is going to change, particularly with something that is as complex and fluid as social security is, but at the stage now we're simply monitoring and reporting what's happening on an annual basis isn't adequate for the programme itself or for parliamentary scrutiny. Mark, I think, can give you a bit more of a picture of what we would expect to see and why it matters. Thank you, Auditor General. I think that the heart of this is that the longer-term costs of this need to be funded and the Government needs to understand how to manage that through time and in an overall sense. There's a real need for transparency about what that total cost is. The other thing I'd add is that the focus of the monitoring activity within the programme has been on those annual budgets and, as we've set out in the report, there's been very little focus on what are the implications of this particular decision on that overall cost envelope and what that's likely to mean in overall terms. We're clear that that needs to improve and that needs to shift on. We set it in the report some of the things that have changed. That's the £308 million estimate and we've not seen evidence that those things have been factored into that essence of what the overall estimate is. We're not saying that necessarily means that it's gone up, we're not saying that it's necessarily gone down but it's changed and things have changed since that estimate was prepared and there's a real need for more systematically the programme to be able to factor those things in and more systematically the programme to report to Parliament around that. The last thing that I'd say is that that, of course, is linked to the planning point that that is easier to do when you're clear of what needs to happen in what order. From that, is it okay to say that there exists risks to the overall Scottish Government budget around the implementation and monitoring and reporting of the costings? There are always risks to the budget with the project of this scale and complexity. We think that it would be easier to manage those risks well if there was greater clarity about what it's likely to cost. Just to give you one specific example, we talked around paragraph 115 in the report about the budget for 2019-20, where the programme estimated that it required a budget of £118 million, the budget that was allocated was £78 million. We think that it will be challenging to manage within that and it's not clear whether the £40 million difference is being transferred to future years or is something that the programme expects to be able to manage out. That's the sort of clarity that's needed overall, particularly since we know that there's much more volatility built into the Government's budget because of the new tax-raising powers. So, there is risk to the Scottish budget, and it would be for a project of the size. Does that also mean that there's a risk to the financial exposure for the taxpayer? Absolutely. I don't want to overstate the risk because, as we say in the report, this has been managed well so far, but it is a very complex project and something that is brand new for Scotland as a whole. It's clear that not only the costs of administering the programme but also the costs of benefit need to be met from within the Scottish budget, and we're moving to a position where we are not solely relying on the block grant from Westminster, about 40 per cent of the budget is now raised from Scottish taxes, which can go down as well as up. So, having that clarity about what it's likely to spend and how that's changing will sit within the Government's overall approach to financial planning, its fiscal outlook, and we think that this is a key component to get right. So, there is obviously risk to the budget, risk to the taxpayer. Is there also then risk to the financial value of the benefit? The Government will have to make sure that whatever decisions it makes about benefits as it takes someone are affordable, as well as having the impact that it wants to have on people's lives, and there's uncertainty in that by their nature, social security benefits, tend to be volatile in hard times, demand is higher, and we've seen in relation to the pregnancy and baby grant uptake was higher than expected and therefore the costs were higher than forecast. That sort of volatility is baked into a social security system and it's why I think it's so important that the financial management and planning is longer term and more transparent than it has been so far. I'm finding the part on the risk around risk on the budget, risk on the taxpayer, risk of the benefit value. Is there also risk in terms of the scale and the scope of the number of people that could benefit from any benefit if there are those failures to do adequate reporting and monitoring of the costs? I've mentioned the experience of the pregnancy and baby grant already. The uptake was higher than was expected by the Scottish Fiscal Commission when it produced the forecast for that benefit. In some ways, that's a good thing. It reflects more people coming forward to claim what they're entitled to, but, as we've said, the costs have to be managed within the overall Scottish budget, and the Government needs to be as clear as it can be about who it expects to benefit, what the likely uptake is and how any differences will be managed within the overall budget that's available. You said earlier on around the £308 million figure and that being an out-of-date figure. Can you just say a little bit about how your own word ballpark figure would come to and what that figure is more likely to need to look at if we're going to go by the current policy commitments made by the Government? The £308 million figure is the figure that accompanied the legislation in the financial memorandum. Those figures are always broad estimates because a number of decisions have yet to be taken, and that's the cost of the implementation, not the cost of benefits themselves. We now know some of the decisions that have been taken about the agency, its location, likely size, some of the things that Gem has been talking about—precurement of IT systems, continuing relationship with DWP, arrangements for bringing in the staff that are needed—all of those things will have affected the number. We're not in a position to update it for you, but it's very important that the Government is able to do that and to account for any differences that are involved. That would be a significant difference? It's very hard for us to say at this time. I'm not sure if Mark O'Gem will want to add to that, but it's really a question for Government. Just to give a sense of the things that have been going on and a sense of scale around that. Paragraph 65 sets out some of the things that have changed since the Government came up with the original estimate. We've talked elsewhere about how the staffing needs to grow and has grown, and that staffing in the programme is larger now than was anticipated initially. We've talked about some of the decisions that have been made to date around digital infrastructure, which were just simply assumptions when the initial cost was made. We've talked about in the report about some higher than expected costs of administration with DWP. Also, there are some areas where the scope of the programme is increased, with new benefits identified and scoping around other areas that are included in the scope of the programme. There's a range of things there. What we can't see is what numbers are associated with those and how those are interplayed with one another in terms of that overall sense. The key point that we're making is that 308 needs to be updated and there needs to be clarity about what's behind it. We're not saying that that will be a final answer. That's something that needs to continue to be reviewed and updated as we go along, but I think that there's a real need for greater focus on that in the programme and greater transparency around it. Thank you. Thank you. Alex Neil. Thank you, convener. Can I just first of all declare an interest because I overall Cabinet responsibility for social security between 2014 and 2016? Can I begin just by probing a wee bit more on the skills people shortage because it's quite a significant, I mean 30 per cent of staff short is a very significant level of vacancy. Can I first of all ask a related matter to vacancy rates? Is there a high turnover rate of staff in the social security agency? It's important before I bring the team in to say that the 30 per cent vacancy rate we're referred to is in the programme staff rather than in the agency. As we understand it, the agency is finding it easier to recruit the staff it needs and its vacancy levels are lower. That's partly a matter of the sorts of skills involved. I'll ask Gemma to pick up the question about skills more generally. Yeah, so we've kind of mentioned already around about the issue of trying to bring in the skills that are needed when they are needed within the programme, and that's certainly something that came through very strongly to us when we were undertaking interviews for this. For example, it was a constant theme that was talked about in interviews in terms of the time and effort that it takes to try and find those skills, the number of recruitment rounds that some people have to go through, so it's one unsuccessful round, two unsuccessful rounds, and the time that that takes, and the toll it takes on people in terms of trying to keep that going, so it's a very much the kind of, I suppose, our finest for this. We're not just about the vacancy rate but actually from talking to people and kind of understanding the challenges that that brings, and also some of the examples of the impact of that. So, for example, on the programme management office, for example, and that turnover of staff in there, what that meant in terms of them not being able to undertake all of the planning work that they might have wanted to do, and also for finance staff and, for example, inputting into business cases, that was an area where, due to lack of resources, they were not able to input into business cases much as they had planned to. So, we could really see across the programme not just in terms of the actual numbers of vacancy rate but actually how it felt to people who were working on that programme. So, just looking at this, according to the report, there are 320 people currently employed by the Social Security Agency. The complement should be 556 according to your report. So, there's a shortage, obviously, of about 136 of people. So, of that 136, how many of those are short in terms of the operation of the social security system in Scotland that we've got under our control? And what proportion say for the IT, now you referred to the programme staff, is that the IT programme staff or is that, you know, who are the programme staff? Are they part of the social security agency or is that a separate entity? Sorry, I probably should clarify the language a wee bit around about that. So, the programme are the people within the directorate who are managing the implementation of the programme. It's a simple service, if you like. Yes, absolutely. That's where the big shortage is. And with the chief digital office, which sits alongside that, which is the largest IT staff. Within the agency itself, the people in the agency are largely responsible for the operational delivery of the benefits once they have passed. So, essentially, the programme manages the kind of up to the implementation, and when it goes live, it passes over to the agency, and the agency is then responsible for the ongoing delivery of that. And in terms of the agency numbers, they have found it much easier to recruit operational staff. They have had some difficulties around about some finance, experienced finance staff, but largely they have not found the same challenges as the programme. Right, okay. And the programme staff shortages, are they very much focused on IT skills? So, not just IT skills, we talked earlier about the kind of importance of programme management skills, and that being an area of difficulty, particularly in agile skills as well, and posts such as business analysts as well, that's been an area of concern. What's an agile skill? So, somebody who has worked on an agile programme, so somebody who has worked in an agile environment and understands the agile methodology as opposed to the kind of waterfall methodology that used to be used on programmes. Right, okay. So, presumably most of the programme shortages related job vacancies in Edinburgh, as opposed to Dundee. Across Edinburgh and Glasgow. Edinburgh and Glasgow, right, okay. And that's part, particularly with IT, there's a general shortage. I think we're short every year of about seven and a half thousand IT graduates compared to what we need in Scotland in the private and public sector. Okay, so that's a big challenge obviously. Can I just ask, you know, obviously the programme staff have a responsibility for planning the capacity to be able to hand over to the social security agency capacity in terms of procedures, policies, you know, all the different way things that are required in order to deliver the programme. Is there likely to be, I mean, the target date for completion of the transfer of the existing benefits that are being transferred is 2024? Is that likely to be met that deadline? Is it likely to be brought forward or could it be brought forward? What's your kind of sense at the moment of where we are in terms of the achievability of 2024? We say in the report that it will be a significant challenge. We can't, we're absolutely not saying it won't be done. I think personally it's unlikely it can be brought forward. But given the experience so far and the effort and commitment that it's required from staff to achieve successful delivery of the wave one benefits, given the ramping up of wave two in the ways we've discussed around the number of people involved, the complexity of assessments, the need to start making regular payments, all of that will be a challenge. That's for the benefits already being transferred? That's for the wave two benefits, which are things like disability living allowance, personal independence payments that are of quite a different nature to the one off grants we're seeing in relation to carers allowance supplement, baby and pregnancy grants and the carers allowance supplement. When I was jointly chairing the committee with David Mundell to arrange the transfer and plan the transfer, one of the things we agreed was that if you look to the DWP IT systems there were two problems. Number one, a lot of them were pretty antiquated and they themselves were struggling with their systems. Secondly, it wasn't one system. I mean there was a multitude of systems. They didn't even at the beginning know how many systems they had and we would have to transfer. It wasn't in a fit state for us to just take over the Scottish bit of the IT systems because, quite frankly, in their own admission it wasn't fit for purpose anyway and they among themselves are planning major changes in their IT structure. As a result of that, we agreed to make a distinction between the date of transfer of policy decisions and the date of transfer of where we would take control of our own computer or design our own computer systems. For example, in relation to universal credit housing benefit we wanted to introduce a weekly payment option instead of a monthly payment option and the computer systems they had couldn't do that so we settled for a fortnightly payment option. I'm not absolutely sure where that currently stands but the issue was the policy. So my question is the policy change could take place even though it was still being administered by the DWP. Is that still the case and are there more policy changes that could be made and brought forward from 2024 even though the implementation and the operation of the policy might need to reside with DWP in a contractual basis? There's lots in that question and between us we'll do our best to answer it. We say in the report at paragraph 125 that the Scottish Government will take over executive competence for all the developed devolved benefits no later than 1 April 2020 next year. Now that's the power which lets them make those sorts of choices that you're talking about and it has made some changes to the administration of universal credit, the Scottish choices element of that as part of wave 1. Now the ability to make more of those changes will depend on both the capacity within the programme and the agency to make that sort of change alongside all of the other work that needs to happen and as you say on the ability of the DWP system to actually deliver things that the Scottish Government may want to do and there's a lot of complexity in that which I think people are still coming to fully understand as they delve into something like the baby and pregnancy grant, pregnancy and baby grant that's been delivered. Particular information becomes clear in that case about the software module that was required to do what was wanted, people had to do manual workarounds to be able to deliver it on time, that was done successfully but it's a good example of the sorts of complexity that gets uncovered once people start to do the detailed work. Gemma, I'm sure that you'll want to add to that. Yes, we mentioned in the report as well about the good relationships that the programme has with DWP and how long those relationships will be required for in terms of that really close working with the DWP. The DWP in terms of IT and technical is a very complicated system with lots of different systems holding lots of different information so there is no real simple answer in terms of being able to get some of that Scottish information from those systems. Again, that incremental way of working in terms of bringing benefits on board when the programme is ready for them allows them to investigate each one of those at a time to make sure that they have an approach that can be managed and they can manage the risks around that and there are any kind of manual interventions that are required in that process but it is clear that there's going to be need to be very close working between the programme and DWP for quite a long time ahead. The final question is, by 2024 Scotland will have its own independent social security system covering those benefits with its own IT systems and so on and so forth. Supposing additional benefits are then devolved to Scotland, is the design of the IT and other operational structures designed in such a way that it could much more easily accommodate the transfer of additional benefits that are not currently legislated for being devolved? What they're trying to do with the design of the system is to make it as flexible as possible so that it can essentially accommodate whatever changes to benefits that they would like to make, for example. As the programme and government— That's a different question. Changes to the benefits that we've got control of, obviously, are going to be built into the design, but my question was a different question about capacity. If we get significant additional devolution of other benefits not currently being devolved, the systems that are being built in Scotland—the independent systems, if I can call them that—would they have the capacity to administer additional benefits if additional benefits are devolved? At the moment, what we only see at the moment is the system as it's built to deliver wave 1 benefits, and it will be built on to deliver wave 2 benefits. At the moment, we don't know what the full capacity of that system would be as it's only been built at the moment to deliver wave 1. The Government might be in a better position to talk about exactly what the scale of the system might be in the future as it's built on for each benefit. At the moment, there are no plans to build on the additional benefits if we get additional devolved benefits. That's not the plan, is it? I think that what we can say is that the approach that's being taken is one that is flexible and iterative, so it can be built on because we haven't got that critical part of where the Government expects to be at all the key steps between now and 2024. It's not possible for us to say that that degree of capacity flexibility will be available and that may be a question that the committee wants to put to the Government. Mark Scott has just a little bit more information to add for you. Just one example that might help. We say in the report that at the moment DWP undertakes the payment system and the reliance on that is because of the shared number of volume of payments and the payments that are anticipated and the initial solution that the Government has decided is to continue to use that system. It may make another decision down the line and it intends to bring its own payment system in to be able to cope with that level, but at this stage of the programme, the current solution is to continue to use DWP systems for that. Those are the sort of choices that, as we've illustrated throughout, still need to be taken and still need to be planned for. Very brief supplementary from Willie Coffey, please. Thanks, convener. Just on that point that I raised, it's a bit like you're sitting out to build a house and you build a house and then later on you want a garage, which is new. So, as long as you've got the skills and the capacity to build the thing, all you need is a little bit of budget and a little bit of time to deliver it. Is it what we're talking about? It's not little bit of skill or time or money, but the principle applies. We do think that the foundations are designed to be flexible and to be built on, but, as Mark Scott said, some of those key decisions haven't been made yet. Bill Bowman. Thank you, convener. I've heard what my colleagues have asked about, and I'll try and keep out of the detail. I tend to look at your summary, which usually tells you what you need to know. We've spoken about key message 4 a little bit, which, if I can paraphrase for the moment, says, the Government knows where it wants to go. I'm not sure how it's going to get there, how long it will take or how much it will cost. In the same day that your report was issued, the cabinet secretary issued a letter. I presume that you've seen that as part of the papers. Three pages, maybe up to three quarters, were picked up on the perceived plaudits in your report. I didn't get a feeling from it that, as she realised, the seriousness of item 4 of your key messages. Do you believe that the cabinet secretary really understands how serious that matter is? I think that it's very hard for me to interpret what the cabinet secretary's view of the report is in that way. I think that the team's very firm conclusion from working with people in the programme and the agency is that they absolutely understand the scale of the challenge, they're very self-aware, they are good at both lessons learned once the benefits have been delivered and also having plans and contingency in place for when unexpected things emerge. What we're saying is that the next wave will be a real step up in terms of complexity and pace of what's required, and that's why it's important for the Government not only to have its own confidence about what it's doing but to make those plans available for parliamentary scrutiny. I've maybe asked you this before, but do you discuss your report with the cabinet secretary? All of our reports are cleared for factual accuracy with the Government. That normally happens through the accountable officer rather than with the cabinet secretary direct, and I haven't discussed it with the cabinet secretary, although, for full disclosure, she and I were in the same BBC studio on the morning that this was published. Having read the letter, maybe you or your team, do you take from that that there are serious measures of food to solve this? I think that it's hard for us to comment on the letter in isolation from everything else that we know. The letters to the committee and the committee may want to take evidence from the cabinet secretary about it. I think that we can only give you the assurance from the work that we've done over and above what's in the report that there is a good degree of self-awareness and that the challenge will be significant. Gemma, do you want to add anything to that? I think that what we can see as well is that the programme is doing a lot of the right things to try to address those challenges. As we have mentioned in the report, there's a lot of review under finance and review of governance. It's building the plans at the moment for that critical path and for finance. It is starting that work. I think that one of the risks that we draw out in the report is that the pace of delivery at the moment makes it very difficult for the programme to be able to stand back and implement all those changes in time for Wave 2. We certainly took assurance from some of the work that was already starting to try to address some of those challenges. It didn't take too much comfort from the letter, and it's all about in progress. If I can just change to a slightly different topic, I think that in Parer 77 you talk about fraud issues. Again, it talks about a fraud team being established and procedures being established. You've been paying out benefits and claiming benefits for some time now. Should this not have all been in place from before day 1? The benefits started being paid in September last year and, obviously, that's continuing to be rolled out. We make the point in the report that this is a really important area. First of all, it's important that people receive the money that they're entitled to and, at the same time, it's important that public money is protected. There's a risk of fraud inherent in this. I think that we are satisfied with the work that's under way, but, again, it's part of this pace of work that needs to take place to make sure that all of that remains fit for purpose. The short answer to that is that we're looking at the detail of that throughout our current annual audit process and looking at, as the agency pulls the accounts together, what the detailed arrangements around that are. I think that you're right in your suggestion that those sort of controls are not things that you can add in downstream. There are a number of things that we're aware that the agency has been doing and we're looking at the detail of that, and in time we would expect to be able to share some of that detail with the committee. So that would come out of your annual audit. Thank you. A few questions from me if I may. Mark Taylor referred earlier on to concerns about the capacity of the finance team. In fact, in the report of paragraph 68, you make that point. In the minister's letter that Bill Bowman was just referring to, she talks about that there's a new finance team in place. Are you just able to elaborate for us what impact has that looking back, what impact has the finance concerns had, and do you think that the new finance team is going to be able to take that forward in a safe and secure manner? In terms of looking back, I think that one of the contributory factors to some of the concerns that we express around monitoring of overall costs has been the capacity of the finance team. We also highlight that, in terms of looking at some of the bigger decisions, some of the individual project teams, there's not really been enough scrutiny around the longer-term financial implications of some of those decisions. Again, I think that the finance capacity has been really stretched around that. We touched earlier on the skills challenges around that. At the same time, there has been improvements on annual budget monitoring and improvements on the annual budget figures. There's that kind of balance of some things that we've moved forward, but really the capacity has played its part. I think that it's not all a capacity question, there's something about where attention is paid, and I think that we've been clear that there needs to be more attention paid to the financial side. It's both having the skills and capacity to do the work that are required to support governance but also the attention that governance arrangements play to that. You mentioned governance there, rightly. Your report, by and large, is pretty positive about the governance and organisational arrangements, but it does say, and I'm referring to paragraphs 43 and 44 here, that every so often, because of the pace that things have gone at, every so often there has been a decision taken to just go outside the standard processes. You've talked throughout this session at length about the challenges that are coming up, and of course, one of the things that this committee sees all too often is where decisions are taken outside the normal processes to try and meet demand, to try and make sure that everything goes to plan, and then we end up in a situation where we've witnesses in front of this committee trying to pick up the pieces. Given that the pace of delivery, the pace of change is going to continue at the same or even greater speed, how confident are you that the Scottish Government is on top of this issue and that these deviations will not continue and happen in the future? We also say in the report in part 3 that there is a review under way of the governance arrangements, some of those decision making processes and the finance function being strengthened. I welcome that. I think that it is a recognition that the problems that we've identified as having an effect so far are risky given the increase in pace and scale that you've referred to, and I think that it's too early for us to assess whether they're having the effect they need to have. It's certainly something that we'll be monitoring again through the audit of the agency and bringing back to this committee in due course. Mark, do you want to add any detail to that? In terms of detail, one of our concerns is that, if you look on page 34 paragraphs 117 through 122—no, apologies— I just find the right bit of the report—page 30 on paragraphs 96 onwards is the range of activities that the Government is under way around governance and how it's organised. We recognise that they're doing the right things, but there's so much of it being done around financial capacity that we talked about. There's so much of it being done around how we speed up decision making. There's so much of it being done around the IT side, and there's a big list there of all those things that are being done. We're not saying that they're not doing the right things. It's going to be really hard to do that alongside continuing to deliver wave 1, could deliver wave 2 and the whole list of things that are there. That's the root of our concern is that there's so much to manage and do in terms of those reviews. Well, that's precisely the point. I might ask a wrap-up question unless anyone else has anything to come in on. We've said quite a lot throughout this session that wave 2 is going to be hard, I think, was the word used at the start. There's work under way, there's advice in the business case, there's a need for resources. I think that Gemma Diamond you talked about was much more complex. Right back at the start, Auditor General, you said that the Scottish Government doesn't necessarily know what needs to happen, let alone be in a position to make it happen. So it rather begs the question, going back to Alex Neil's point about 2024, if this doesn't happen, if those processes can't be put in place, if the IT resources aren't in place, if staffing isn't in place, what happens then? Do the benefits devolve and get put in place anyway, or is there another pause? If I may convene our attempt to wrap up answer rather than just picking up that, you're right. We say in the report that the Government has done well to get this far. It's laid some important foundations and that it will be a significant challenge to deliver the wave 2 benefits as planned given the scale and complexity involved. We know that it's aware of the challenges and there are a number of things under way to respond to them. We also know that, as Marcus said, there's a lot of things that need to happen at the same time and the Government doesn't yet have that detailed understanding of what actions need to happen when to be able to deliver the timeline that's set out in the report. We know that the Government has prioritised safe and secure transfer of the new responsibilities. I think that that's a reasonable approach to take given the amount of money involved and the impact on people's lives. It would be for Government to be thinking about what its contingency plans are if it can't deliver the timescale that's required. We think that the planning will maximise its chances as well as making sure that Parliament can scrutinise this very important process in an appropriate way over the next few years. I'm very grateful. Do members have any other further questions? Just one very final one. In terms of payments and so, a local government pays out quite a lot, obviously ministers, council tax and housing benefit, as well as benefits of their own in terms of uniform grants and so on. Is there scope to use local councils more as delivery face-to-face-type agencies and, from a policy point of view, get closer in the long term, get closer co-ordination between the kind of support that local government provides integrated more with the kind of support that we're going to provide through the social security system? As I think you're known, Mr Neil, the Government is committed to linking closely with local governments face-to-face support staff and services to help claimants to access the benefits that they need. I think that they've ruled out the possibility for now of using councils' payment systems partly because of the challenges of complexity that we've talked about, but obviously once the devolution of this set of benefits is complete, the Scotland Act 2016 did include a power for introducing new benefits in Scotland where they can be afforded, and it would be entirely a matter for any Government to think about how they were delivered and who they were targeted at. I'd like to thank the Auditor General and your team for your evidence this morning, and I now close the public part of this meeting as the committee moves into private session.