CIO interview: Phil Pavitt, HM Revenue & Customs

Challenging times at the HMRC

To an outsider, you might think it's not easy being Phil Pavitt.

After all, the CIO at HM Revenue & Customs (HMRC) recalls how last year he was described by a national newspaper as "the most incompetent CIO in government", and found reporters in his front garden after millions of people were told they had paid the wrong tax due to a flawed computer system at HMRC.

When he took the role at HMRC in September 2009, the former Transport for London and NTL CIO joined an organisation with a poor reputation for IT - caused by failures such as tax credits, a controversial deal with EDS, and the scandal caused by the loss of CDs containing the child benefit records and other personal data of 25 million people.

And that's before you consider the subsequent instruction, from a new austerity government only months after Pavitt started, to reduce back-office running costs by 33%.

With all that in mind, you would not be blamed for seeing the job as something of a poisoned chalice. But perhaps that's why Pavitt might just have been the right man, in the right place, at the right time, for one of the biggest tasks in IT.

"I'm not known to be particularly shy or retiring, or even immodest, or not unwilling to take on a challenge. If you say no, that's where I want to start, because everything is deliverable," Pavitt says.

"I like being an IT leader when there's no money to spend because people want to listen to you."

Building HMRC's IT strategy

Pavitt has a dual role at HMRC, as CIO and director general of change, a reflection of the importance that IT will play in wider transformation across the department. He met Computer Weekly for an exclusive interview in his "hub" - a Whitehall meeting room with walls covered in graphs and charts detailing every aspect of HMRC's IT performance. And that is the first thing that strikes you about his task - the scale of the technology challenge the department faces.

"You walk in here with your eyes open. It is now deemed the largest job in government IT - in fact it's one of the largest, compared to the private sector as well. When you get here you begin to realise the sheer size of it," Pavitt says.

"You walk in with an expectation that either you're here because everything needs fixing, or everything is here and you just need to run it. Of course the reality is it's neither of those things and it's somewhere in between. When I walked in there was some of the most modern IT I'd ever seen, such as self-assessment online. But there were almost paper-based processes at the other end of the scale."

Rightly or wrongly - and Pavitt maintains the latter - HMRC had a poor reputation for IT, but he found an environment where people were "desperate to be successful, and to be led to be successful."

"I rushed in and demanded my list of all the IT failures I read about in the press, and my list was quite short. What is perceived to be a failure, IT-wise, often had problems, but they were not in IT. How technology lands in a business - that is so often the failure. What I did find was a lot of frustration here. IT had not been championed as well as it could have been," Pavitt says.

"You start with the numbers, get rid of the anecdotes and the history - ask what is the real cost, the real benchmark, why is it that and not this? What are the actual costs and what does the user want? It is all about the numbers - and that busts most of the myths I inherited."

His first task was to sort out the IT strategy.

"HMRC had not really got a business and IT strategy that says: technology is on a journey, and every piece of IT is on a separate journey. You have to ask, what is the journey that HMRC wants to take? When you understand that it's about how IT fulfils that," Pavitt says.

"In certain cases IT was answering a question the business wasn't asking; in certain cases the business wasn't asking a question and so IT wasn't answering. We had a mixture of that here on a vast scale.

"But I found the IT people very strong and very competent, and they wanted someone to say: I have a vision, I have a business strategy, let's go and do it. That's not an unusual thing for me to do."

Dealing with government spending cuts

Although the need for government spending cuts was apparent when Pavitt joined, the effect of the coalition government's budgets reductions were significant.

"The sheer size of it was shocking, exciting, surprising, challenging - all of those things. For HMRC we have a double challenge, in that we have both cost savings from making ourselves more efficient and we also have to increase our revenue," Pavitt says.

"It's about spending £1 once and getting £2 of value. It really brought us together, we knew we had to find that amount of money, we have to bring in automation, and we have to clear out some of the IT that hasn't done as well as it should."

HMRC's Aurora programme aims to save £161m per year in IT costs, by switching off, resizing and moving IT systems. Central to that aim is Pavitt's "13 machine strategy" - the 13 business critical applications - or "machines" - that support the department, each of which now has its own strategic roadmap for consolidation and optimisation. The 13 machines are supported by eight "technology engines" - the key elements of IT infrastructure (see diagrams, below).

"We have managed to buy at least one of most pieces of hardware and software ever sold. We don't need to buy much new stuff, so let's decide what to consolidate onto," Pavitt says.

"For example, we had seven or eight versions of SAP using different pricing structures, grown up through individually priced projects. So we asked: is SAP the right answer? And it is, so now if you want accounting or finance systems then SAP is the answer. We migrated all the versions of SAP onto one, and then every non-SAP accounting system is being migrated. The retirement of that old stuff has saved us almost £100m per year. Now if you want a business intelligence project, for example, you don't need a new one, you just need to use one of the ones we already have."

Part two of the strategy relates to future spending, where Pavitt introduced a scheme called "cost not to exceed" to ensure new systems do not add to the IT budget.

"A business case would say, this IT will help the business, and it was all costed out. But once it was out of the project process, the running costs would creep up and add to my costs, and that was never in the business case," Pavitt says.

"Now every new thing the business wants in IT they can have, as long as in the investment committee proposition they have found costs to come out. That means my baseline running costs will never exceed where they were six months ago. That leads to positive conversations, to stressful conversations and all those in between. That's been a big change."

HMRC's relationships with IT suppliers

But the pain of cost cutting has been more than shared with HMRC's IT suppliers, with some dramatic results.

"We took all our software and hardware vendors and sat down with them to understand their cost structure. We needed 25,000 new desktops that we probably would have paid £20m-£30m for in the past, and we got those for free. There were nearly 5,000 new multifunction printer devices probably worth about £11m-£12m, we have those for free. Money we were going to spend, we haven't spent in capital terms," says Pavitt.

How did he convince his suppliers - and in particular the Aspire consortium led by Capgemini that runs much of HMRC's systems in a deal worth £750m per year - to take such a hit?

"We had 25,000 desktops that were more than seven years old, with all the versions and variations you can imagine that have built up over time. The average desktop log-in time here when I arrived was about 12 minutes. Now it is under two minutes. What is the cost of that? I knew my business case. But the issue is the supplier," Pavitt says.

"Suppliers have models to work out that, as anything gets older, it gets more expensive to maintain. I sat down with them to work out when that reaches a point of inefficiency whereby they have to put more money in to maintain it than they get from me. We showed them on the desktop they had passed that time, so giving us 25,000 desktops with some of their own money actually reduced their running costs. We had 200-300 applications that have been retired and we have freed up the money and are re-investing that in other things. That's the secret."

As a result, in less than two years, IT has dropped from 24% of HMRC's running costs to 16%, and is aiming for 14% - you can check the charts in the hub for proof. What's more, the change is now being driven by budget holders, not IT.

"We introduced [a tool] that allows every finance director in each unit to see online the assets that they are paying for, be it applications, hardware, datacentre, desktops or phones. Now no longer does the IT department drive down costs, it's the users. They might say I don't need all those laptops, or those laptops were from a different era and our needs have changed. We can demonstrate when people have logged in to applications - so we can say if someone hasn't logged into an application in six months, why are we still paying for it, and that has driven down a lot of costs. We've automated that, it's not thousands of people analysing it, and that's really powerful."

Changing public sector IT strategy

But it's not only the impact of centrally driven cost cuts that has been a factor in HMRC's IT strategy. The departure of government CIO John Suffolk last year, his replacement by Department for Work and Pensions (DWP) CIO Joe Harley, and a new government ICT strategy led by the Cabinet Office have all played a part in defining how every major Whitehall department moves forward with technology.

Pavitt insists the new approach is a big improvement.

"I've been a mild critic of the government ICT strategy in the past, because I believed it was quite central and didn't fit where departments were. Two things have happened since. With Joe Harley's appointment as government CIO, he is a practitioner and an active CIO, and that's a powerful combination. And we have brand new governance in place, the CIO Delivery Board that sits on top of the CIO Council. Now I don't know if it is HMRC, health, defence, DWP, or anyone else driving the strategy or vice-versa, because it's been such a collaborative affair I can't work out where the join is," Pavitt says.

"Now HMRC finds itself right in the centre of delivering both the strategy and some really pragmatic things, and that's where we should have been and that's now where we are."

Responsibility for each of the different constituents of the government ICT strategy has been shared between departments, and Pavitt is responsible for several key initiatives, including: a cross-government desktop strategy; architecture and standards; identity assurance; and common cross-government HR systems.

On the desktop, a strategy is due to be announced in September or October and implementation will start next year. Pavitt promises a complete transformation of the government personal computing market, and is scathing about the role suppliers have played in the past.

"Government has bought what the vendors have sold, missing the whole point - we are the customer. I will never have another salesman talk to me about thin client; that is the IT sector selling me what it wants to sell," Pavitt says.

His solution suggests much greater flexibility for civil servants to choose what device they need.

"My job is to say I want this cost, this output, and the device must be divorced from the user. No matter what device I choose to use, then my work flows to that device. The vendors have sold us an answer, and we've bought that and ended up in the wrong place. This will be a user-led UK government strategy and vendors will have to catch where we want to go," Pavitt says.

"It won't be a single vendor doing this. Joe Harley is very much about users joining up and buying in to the strategy, one that drives greener, lower cost to the desktop with higher productivity. Why won't anybody want that? It will be a number of vendors building a stack of answers."

Open source, standards and agile development

On architecture and standards, loud voices from around the industry shout for open source, agile methodologies and open standards as a panacea for government IT problems, but Pavitt is more pragmatic.

"HMRC is the foremost government department on open standards, we give away our APIs to over 1,600 software vendors for example. On open source it's more complicated. For self-assessment online, of the bits that face the customer, the high-volume stuff, SMEs provide that for us, and 70%-80% of it is open source. But for a heavy-duty tax like PAYE - crunching 35 million people's tax details - people may be more worried if that's open source. We have to wrestle with what is appropriate. Certain things will never ever be open sourced. Our job is to make sure as much as possible that can be, is," Pavitt says.

There has been much debate about the use of agile development, with the DWP encouraging suppliers to use its key Universal Credit programme to use agile methods. Pavitt is more agnostic on the subject.

"You have to approach IT well, choose the right governance and right development mechanism. We use waterfall here - some people get very excited about that, I can't say I do - but that's primarily because we're building on existing systems. Greenfield sites lend themselves to agile, established systems don't. Plus we're pretty good at waterfall, that's how we run our stuff. DWP has chosen for a big chunk of their piece to use agile methodology, and I understand that's going pretty well. We may use different styles to get to the right answer, but we're bang on time and pretty comfortable."

Cloud computing - it's nothing new

Mention cloud computing though, and Pavitt returns to berating the IT industry.

"HMRC has a private cloud - two of them - one of them we didn't know we had. The terminology turned up, and we found we had one of those, so that's handy," says Pavitt.

"As a slightly jaundiced 25-year IT man, I'm tired of buying concepts sold by vendors. I've always wanted cloud since the day I walked into a datacentre - by which I mean always on, pay as you go, the day I don't need it as much I use less, the day I need more I can have it - all supplied by someone who has a 99.999% sense of quality and delivery. I wanted that as boy, I want it now as an old man. Call it what you like, I still want it," Pavitt says.

"For government, cloud is more complex. Community cloud - interesting, very tough; semi-private cloud - somewhat worrying; private clouds - then you're into issues of scale. Can we get the benefit of a public cloud like Amazon or Google, but use it in a big network like this? That's hard to work out. Meanwhile, it turns out we have a private cloud - we didn't call it that of course - but it's the same stuff we did 30 years ago. Let's stop buying clichés and sales brochures, and say it's the same stuff. If you can do it cheaper, faster and to a higher degree of accuracy, you can call it what you like."

Along the way Pavitt has contributed to the security overhaul at HMRC required to exorcise the flaws that led to the child benefit data loss, with security now "in the DNA" of the department. "It will be a brave CIO in HMRC who relaxes security, and I am not that brave CIO," Pavitt says.

But for an organisation that has taken its share of criticism in the past over IT failings, the current incumbent of one of the biggest jobs in public sector IT wants more than anything to convince the watching world that HMRC is now an exemplar for government technology.

"It's not about the technology at HMRC anymore, it's about the technology team that is delivering for the business," Pavitt says. "It is the pride the team takes in itself as one of the foremost technology shops in government and even compared to the private sector. I've been very impressed by what I've found, and that's very exciting."

HMRC IT statistics at a glance