Conclusions and recommendations
1.GPES is late, over-budget and still does not deliver all that was intended. The original business case expected the service to start in 2009–10, but it took until April 2014 for HSCIC to provide the first GPES data extract to an NHS organisation. So far only two of the eight organisations identified as users of the service have received data from GPES. The expected cost of the project increased from £14 million to £40 million during the planning and procurement stage. Further cost increases have been smaller, but there have been at least £5.5 million of write offs, additional settlements and delay costs. The Department admits that it is not getting value for money from GPES; that the service is only delivering about half of what was specified and paid for; and that the fixed-price contract approach which was used had been inappropriate. HSCIC is currently considering options to improve or replace GPES.
Recommendation: The Department and HSCIC need to develop a clear plan for the future of GPES that sets out the functionality and capacity required and how it will be delivered. We expect the Department to report back once a decision on the future of GPES has been made, or within 6 months, whichever is sooner.
2.The original project team did not have the right skills or experience to build GPES and the governance structure was not fit for purpose. The Department accepts that NHS IC did not have the expertise or capability required to run this project and that the governance arrangements were not fit for purpose. There was an exceptionally high level of staff turnover in key roles with ten project managers over a five year period and three Project Board Chairs over three years. The Department did nothing about this despite concerns raised by their own gateway review team. The Department also raised concerns about the adequacy of the testing, but NHS IC did not act on them but instead chose to accept the risk and sign off the system. Only after HSCIC took receipt of the system were fundamental design flaws found, which meant that it was impossible to extract data from all GP practices. Fixing the problems required six months of remedial work. Because NHS IC had signed off the Atos element of the system and made public announcements about the success of GPES, HSCIC had no practical legal recourse when the system turned out not to work. No one in the Department or HSCIC has been held responsible or disciplined for the failure of the programme and loss of taxpayers’ funds. The Accounting Officer for NHS IC when it accepted GPES from Atos was NHS IC’s Chief Executive, who was awarded total emoluments of £470,000 for the financial year 2012–2013 including a redundancy payment of £330,000. This project is a failure of both Departmental stewardship of the NHS IC and of the governance of the project by NHS IC and the Department.
Recommendation: The Department must:
i)ensure its IT projects are managed by people with the appropriate skills and experience;
ii)appoint a named individual (the SRO or someone nominated by the SRO) who is personally responsible for signing off each stage of the system, so that accountability is clear;
iii)establish clear lines of accountability between the Department and the bodies delivering IT projects and proper oversight mechanisms to monitor projects and take timely remedial action when necessary; and
iv)make certain that systems are tested properly before they are accepted.
3.In their approach to this project Atos did not show an appropriate duty of care to the taxpayer. We are not satisfied Atos provided proper professional support to an inexpert client and are very concerned that it appears to have acted solely with its own short term best interests in mind. Atos admitted that end-to-end testing should always be undertaken and that it was supposed to have happened in this case. However, NHS IC and Atos agreed a more limited test of the Atos component due to delays in completing other parts of the system. The Atos software passed this test, but after NHS IC accepted the system—and to Atos’s professed surprise—the system as a whole was found not to work. Atos claims it fixed the issues relating to its software at its own expense and that the additional £1.9 million it received while doing so was for additional work related to 15 new features. We found that Atos’s chief executive, Mr Adrian Gregory—the company’s witness in our enquiry—appeared rather indifferent to the plight of the client; we expect more from those contracting with government and receiving funds from the taxpayer. The Government agreed to a recommendation by the previous committee on the need to work with industry to define what obligations on contractors a duty of care to the taxpayer would entail, and what sanctions would apply. In our recent report on strategic financial management in the Ministry of Defence and military flying training we recommended that consideration be given to adding clauses to contracts placing a duty on contractors to give early warnings of problems with contracts—even if this could be financially disadvantageous to the contractor.
Recommendation: The Cabinet Office should undertake a full review of Atos’s relationships as a supplier to the Crown. We expect the Cabinet Office to note carefully this example of sharp practice when determining what obligations a duty of care on contractors should entail and what sanctions would apply when performance falls short.
4.Whitehall is not learning from past failures in IT projects, and is still repeating the same mistakes. This project exhibits many weaknesses common to other high profile IT failures such as the National Programme for IT in the NHS, the Single Payment Scheme and Tax Credits. These include; lack of staff continuity, inadequate testing, the wrong contracting approach and a governance structure which was not fit for purpose. Whitehall has to start learning from these failures and make real changes to how IT projects are managed and delivered.
Recommendation: The Cabinet Office should ensure that the failings in this project and the reasons for them are disseminated widely to reinforce the steps that need to be taken to avoid such mistakes being repeated again.
© Parliamentary copyright 2015
Prepared 21 December 2015