PAC: Cabinet Office has “failed to get grip” since taking responsibility for national security vetting, “creating risk environment many users across government are uncomfortable with”
|
- Unacceptable delays could hinder work of Government and increase
security risks - Committee especially concerned with Cabinet
Office complacency over clearance renewals - UKSV
“understaffed since 2017 inception” despite essential role in
national security In a report today the Public Accounts
Committee says the Cabinet Office has failed to get a grip on
delivering national security vetting since taking over
responsibility for this vital...Request free trial
- Unacceptable delays could hinder work of Government and increase security risks - Committee especially concerned with Cabinet Office complacency over clearance renewals - UKSV “understaffed since 2017 inception” despite essential role in national security In a report today the Public Accounts Committee says the Cabinet Office has failed to get a grip on delivering national security vetting since taking over responsibility for this vital government service in April 2020, with potential consequences running from losing the best candidates for essential roles to impeding the effective functioning of Government work to increased security risks.
The UK Security Vetting service has not met either of its key performance targets for timely CTC/SC and DV clearances since July 2021 and has also missed its targets for priority clearances in 23 out of 60 months for DV and 30 out of 60 months for CTC/SC clearances. Clearance backlogs have increased over the last two years.
It also has a woeful record on aftercare checks, which should occur between the initial clearance and a full review to confirm someone’s circumstances have not changed. Aftercare targets have not been met once since the start of 2018-19.
These unacceptable delays in processing clearances could result in departments being unable to progress the work of government, but the Cabinet Office does not appear to have fully assessed the potential impact across government. It seems content to repeatedly extend DV renewals as a means of managing demand, despite the increased risk associated with individuals going many years without a full review of their security clearance, and the risk environment all this is creating that many UKSV customers across government are uncomfortable with. The Committee calls on the Cabinet Office to set out how and when it will stop repeatedly extending DV renewals going forward.
The Cabinet Office and UKSV have also so far failed in attempts to modernise and transform how security vetting is delivered and the Cabinet Office has repeatedly blocked transformation business cases from UKSV.
Dame Meg Hillier MP, Chair of the Committee, said: “The Cabinet Office appears deaf to the discomfort that staff across Government have with the level of risk being created by its failure to get a grip on our national security vetting services. Though the current governance structure actually appears to be a barrier to the necessary change, the Cabinet Office is blocking all UKSV’s valiant attempts at reform. UKSV has been understaffed since its inception and the result is desperately uncomfortable compromise choices for existing staff about their essential functions. This is all totally unacceptable. We expect the Cabinet Office to set out and immediately get on with productive change in response to this report.”
PAC conclusions and recommendations
7. The Cabinet Office has failed to get a grip of vetting services since it took over responsibility in 2020. It has not assessed the impact across government that delays to vetting can have when staff are unable to progress work because they do not have the appropriate level of security clearance. UKSV has not meet either of its key performance targets for timely CTC/SC and DV clearances since July 2021 and has also missed its targets for priority clearances in 23 out of 60 months for DV and 30 out of 60 months for CTC/SC clearances. Backlogs have increased over the last two years and UKSV says that it aims to clear the CTC/SC backlog by summer 2023 and the DV renewals one by October 2023. The Cabinet Office could not provide us with information on the impact of UKSV’s poor performance on government, even though ministers have complained to UKSV about delays in clearances. There are also increasing numbers of individuals cancelling their DV applications which would seem unsurprising given that 30% of DV applications in 2022-23 were taking over 180 days to process, almost double the 95-day target. The Cabinet Office, however, had only looked in detail at these numbers after the NAO report came out, arguing that these cancellations did not suggest that the vetting process was responsible for government losing good candidates for roles. Recommendations 1: The Cabinet Office should set out: a. When and how UKSV expects to clear the backlogs of CTC/SC and DV clearances, and any changes it intends to make to its working practices to avoid backlogs building up again in the future. b. When it expects to meet its key performance indicators for CTC/SC and DV routine clearances and deliver the service government departments are paying for.
8. The Cabinet Office is over reliant on customer demand forecasts and failed to predict changes in demand for security vetting. UKSV’s customers provide demand forecasts each October to enable it to assess what level of resources it will need for the following financial year. UKSV relies on customers to provide accurate forecasts but these vary in quality, and it is aiming to work more closely with customers to help them improve their forecasts through better use of data. While it is unsurprising that forecasts for 2020-21 did not anticipate the reduced demand that COVID-19 lockdowns caused, UKSV and its customers failed to anticipate a resurgence of demand once COVID-19 restrictions were lifted. UKSV argues that the changing threat environment and wider societal changes in the employment market added to demand in a way that was not anticipated beforehand. This is not the first time UKSV has been impacted by a sudden increase in demand, for example it saw a similar trend following the Brexit vote in 2016. Recommendation 2: The Cabinet Office should set out what steps it is taking to help its customers improve their forecasting and to make UKSV more resilient to changes in demand.
9. We are concerned about the level of risk created by the Cabinet Office’s decision to repeatedly defer renewals for DV clearances. Existing DV clearances are normally reviewed after seven years to ensure that individual’s circumstances have not materially changed and that the initial clearance remains valid. Scheduled and unscheduled aftercare checks in the period between renewals should capture any changes in circumstance that might impact on the clearance. However, UKSV has failed to meet its target for aftercare checks since the start of 2018-19; and to manage demand, the Cabinet Office Government Security Board decided to extend most DV renewal clearances in 2018, 2019, and 2020. In 2021-22, the consequent backlog of renewals overwhelmed UKSV and in April 2022 the Government Security Steering Group directed UKSV to extend renewals yet again, so UKSV could focus on reducing the backlog of new DV clearances that had developed. UKSV and its customers acknowledge that continually deferring renewals creates risks that are uncomfortable. UKSV claims that, as it has always adopted a risk-based approach to deferrals, that any renewals with known red flags were still thoroughly reviewed. It also argues that prioritising new DV clearances rather than renewals was a sensible risk-based decision. Focusing on new DV clearances, however, also placed further pressure on UKSV’s processing of CTC/SC clearances, which saw clearance times increase and backlogs grow even higher in 2022.
Recommendation 3: The Cabinet Office should develop a plan
for how it intends to avoid repeatedly extending DV renewals
going forward, and set out the key elements of this plan in its
Treasury Minute response. The plan should include, for
example:
10. UKSV cannot deliver timely security vetting across government with its current staff levels. Despite its essential role in protecting national security, UKSV has been under-staffed to meet customer demand forecasts since its inception in 2017. In April 2021, when faced with an upsurge in demand for its services following the relaxation of COVID-19 restrictions, UKSV had a 32% shortfall in staff resources. In November 2022 it was still 23% short of estimated need, including digital staff required for the vetting transformation programme, despite securing additional contingent labour and temporary staff from other departments. UKSV says its resourcing levels meant it had to make difficult decisions as to which service areas it prioritised, with aftercare checks one area that suffered as a consequence. The Cabinet Office expects some of the slack to be addressed through higher pay for digital staff and increased automation as part of its vetting transformation programme, although it accepts that the completion of transformation is some way off. To compound matters, survey results show low levels of engagement among UKSV staff. UKSV’s Chief Executive says that her staff have an immense pride in the organisation but also acknowledges they are suffering from ‘change fatigue’.
Recommendation 4: The Cabinet Office should set
out:
11. The governance structure of UKSV within Cabinet Office is a barrier to transformation. UKSV’s chief executive and the government chief security officer have low levels of delegated spending authority which means they require approval from the Cabinet Office Approvals Board for any spending over £500,000. That Board has repeatedly refused to give spending approval for the £40 million vetting transformation business case. UKSV’s Chief Executive cited governance around investment and the change agenda as problematic in replacing the legacy system, and three reviews of the transformation programme included governance in their array of concerns about the deliverability of the programme. The Cabinet Office acknowledges that its cautious approach is delaying the much needed and widely supported transformation programme but says that it is better to be cautious than to spend unwisely. Recommendation 5: The Cabinet Office should urgently review UKSV’s governance structures to assess whether they provide the correct balance of challenge and support to enable UKSV to achieve the much-needed security vetting transformation programme. It should summarise the findings of this review in its Treasury Minute response.
12. We are not convinced that current plans for the transformation of security vetting are any more likely to succeed than previous failed attempts. The Cabinet Office’s first attempt at modernising the IT infrastructure for national security vetting failed, after unknowingly running almost 50% over budget and resulting in a £2.5 million write off in the Cabinet Office’s 2021-22 annual accounts. Despite broad consensus on the need for the transformation programme across government, which customers have already funded, subsequent attempts at vetting reform have been stymied by the lack of spending approval and the priority given to the stabilisation programme over the transformation programme. After multiple failed attempts to get Cabinet Office spending approval for the whole Vetting Transformation programme, in December 2022 UKSV changed its approach and finally got spending approval for the development of just the first of three new vetting levels. As a result of the delays, UKSV anticipates it will have to refund around £5 million to customers. UKSV’s Chief Executive says she is confident that adopting a more iterative approach will be more successful. We would like to share her confidence but the track record for transformation to date does not bode well for the future. In our view, until such time as the Cabinet Office starts to take its responsibility for national security vetting more seriously, shows more confidence in UKSV and provides more support, it is unlikely that transformation will be fully achieved. Recommendation 6: The Cabinet Office should set out a clear implementation plan for vetting transformation, with interim milestones for each of the new vetting levels and a realistic completion date. It should set out the key elements of this plan in its Treasury Minute response to this report |