The illusion of risk transfer
67. Ms Whittaker (EDS) told us that "when projects
do go wrong, usually it is attributable to two things. One is
the management of risk on the project and the other is the governance
structure. When we get those things right, we are successful.
" [120]
68. The Secretary of State told us that alongside
the IS/IT structures, DWP has put in place "robust risk management
processes."[121]
However, our evidence indicates that there is insufficient compliance
with good practice, suggesting that management of risk and governance,
especially project planning, are still under-developed. We are
unable to know the extent of the problem within DWP because of
non-publication of key documents, such as business cases and Gateway
Reviews, which we discuss later. But on the basis that adherence
to best practice by departments remains patchy, we remain concerned
that deals are being signed and projects are being managed that
do not follow best practice.
69. The Treasury has had a long-standing requirement
that PFI deals should involve a genuine transfer of risk.[122]
Identification of risk and its efficient management is something
that runs through much of the evidence. However, identifying and
transferring risk can create problems. A number of witnesses made
the point that in addition to identifying the political and normal
commercial risks, it was important that risks be transferred to
the partners with the capability and authority to manage it.[123]
But before this can happen, business requirements needed to be
fully understood, agreed and priced accordingly. Tom Warsop (EDS)
told us that departments cannot transfer all of the operational
risk; they can transfer a certain amount of financial risk and
certain other risk, but not operational risk.[124]
Clearly, some risks cannot be transferred to the IT supplier,
especially when systems involve social security benefits. According
to Professor Collins, it is only the financial risk that is typically
considered and transferred.[125]
PCS said that it was not aware of the details of the contractual
penalties that may be applied to EDS for the under-performance
of CS2, but "from the outside it would appear that any risk
transfer is purely financial. "[126]
Mr Michael Hartley told us that "in a lot of programmes
the expectation is that if you apply some financial inducement
to an organisation to take that risk on that they are also capable
of managing, and I do not think that is always the case. "[127]
In the event of a failure of an IT supplier contracted to provide
benefits, the DWP would have little alternative to intervening
directly to absorb the risk (cost) itself by providing the service
or bailing the supplier out. In this way, the transfer of such
operational risks to the supplier would prove as illusory as the
government seeking to transfer risk in, say, the civil nuclear
industry; if the business goes belly up, the government has to
intervene. Michael Hartley confirmed this when he told us that
in the event of a failed IT system, the IT supplier would not
be able to "get their calculators out and make decisions
on how much somebody was going to be paid, that is very much the
job of the CSA organisation and therefore there is a limit on
the amount of risk that can be transferred. "[128]
In short, by forcing an inappropriate transfer of risk onto a
supplier, DWP may find that business risks simply get bounced
back to be absorbed by the department.
70. Nick Kalisperas (Intellect) told us that his
members had indicated that the public sector is quite comfortable
transferring risk to suppliers but, because of the political risks
involved, is not as comfortable transferring control of projects
to suppliers. [129]
71. In written evidence, DWP identified key risks
that relate to a project and those that are appropriate to be
transferred to the supplier.[130]
For example, DWP told us that it seeks to achieve effective transfer
of appropriate risks by contracting for outputs, not inputs; agreeing
a firm/fixed price at the outset; linking payments to the quality
of service received and making payments only when service is received.
If delays have a material effect on the Department, then it may
seek compensation/damages from suppliers, including the right
to terminate for failure to deliver, or for continuously poor
performance. DWP described how in 2002 it applied a new model
of governance to its major IT projects to improve the management
of risk through more robust accountability and stewardship. According
to DWP, the governance model used encourages decision-making at
the most appropriate levels and a gated review process. DWP also
described the Departmental Change Board, chaired by the Permanent
Secretary of the Department with Senior Responsible Owners, which
has responsibility for reviewing the progress of the Department's
"mission critical" IT programmes and authorising key
milestones, such as the launch of new public services. EDS argued
that, "in all cases, DWP retains overall accountability for
business outcomes." Garter stated: "The risk transfer
statements we have seen are those associated with delivery and
operation of IT solutions and not the broader business solutions.
"[131] EDS also
pointed out that evaluation of risk was made more difficult when
fixed price contracts and risk transfer required before the business
specifications are understood and agreed.[132]
PCS expressed concern that, for the CSA reform, contractors faced
insufficient incentives to improve their performance.[133]
72. According to the Treasury, PFI was an unsuitable
vehicle for IT projects for a number of reasons. The Treasury
stated:
The concern raised by [...] research is that expectations
in the IT industry and among public sector procurers are set too
low. But more importantly it demonstrates that the qualitative
differences between PFI in IT and PFI in other sectors have a
significant impact on the way that IT PFI has been delivering.
The difficulties with achieving appropriate risk transfer in IT
PFI, because of the need for significantly greater flexibility
than in other sectors, the high degree of integration into the
other business operations of the procuring authority, and the
lack of third party finance, mean that it may not be the appropriate
value for money procurement route for IT.[134]
73. Currently, there are no PFI projects within Jobcentre
Plus.[135] We also
heard that Pension Credit, which adheres to best practice principles
throughout, is also not a PFI project. The Secretary of State
told us:
Clearly there are important lessons to be learned
from the earlier requirements that you should do everything by
PFI if at all possible. We have learned from the experience,
as indeed the Treasury guidance has informed us, that in IT cases
that may not be appropriate, it may not be the best or even the
most timely way, or the most cost-effective way of securing the
services we want. Those lessons have been learned and that is
why we are applying a new framework for procurement for the future.[136]
74. We welcome the Government's reversal of its policy,
but are concerned that it has taken it so long to recognise the
unsuitability of using PFI for IT projects, especially when it
was well known that PFI was generally disliked by the IT industry.
We are concerned that a number of important projects, such as
CS2 and the pension forecasting project, remain as PFI projects,
although in the latter case officials told us that it is now much
closer to best practice.[137]
In our view, the continuing existence of the remaining PFI IT
projects suggests that the Department has only partially learnt
the lessons about the unsuitability of PFI contracts. We are concerned
that the PFI nature of the contracts continues to create a number
of problems, including an ambiguous risk transfer and lack of
incentives for suppliers. We appreciate that in some cases, a
PFI deal can succeed. For example, we heard that the IT for Oyster
cards, which is a PFI deal, on Transport for London is working
very well.[138] However,
the overwhelming evidence is that PFI is generally unsuitable
for IT projects and that principle should apply to existing deals
as well as new deals. We recommend that the Government makes
an early statement of policy on how it proposes to proceed with
all IT projects that continue to operate under PFI rules.
How competitive is the market?
75. In our call for evidence, we asked if there was
an effective competitive process in the awarding of IT contracts
by DWP. This question arises in the light of the degree to which
Government IT business is concentrated in the hands of very few
IT suppliers, and in the case of DWP, one dominant supplier: EDS.
Although there is a large amount of sub-contracting of DWP contracts,
we established that EDS had been awarded contracts to the value
of some £4.5bn, or 85% of DWP IT business by value,[139]
over 40% of which comprises continuing operational and service
delivery functions.[140]
Across central Government as a whole, EDS, which is ranked as
the second largest IT supplier in the world, has captured 54%
of the share of the central civil government IT services market.
The following table provides the various rankings.
Table 1: Comparative ranking of major IT service
companies in global and UK markets 2002-03
