The IT risks facing Universal Credit

Skills shortages

The most immediate risk faced by the Department for Work and Pensions (DWP) is the lack of readily available skills in digital and agile development.

The Pathfinder system was developed using the old principles that have led to so many government IT disasters – bring in a few big IT suppliers, give them a big outsourcing contract, and hope they know what they are doing.

The success of that approach can be demonstrated by the fact that those four suppliers – HP, Accenture, IBM and BT – will play little or no part in developing the “end-state” system that will support the nationwide roll-out.

That new system will be developed mostly using in-house resources – but those resources do not exist at this time.

The DWP’s new director general for digital transformation, Kevin Cunnington, has been tasked with building the department’s digital skills – effectively rebuilding an in-house developer capability that had long-since been outsourced.

That task has been made all the more urgent by the withdrawal of the Government Digital Service (GDS) – the Cabinet Office’s central pool of digital skills – from Universal Credit (UC). As minister Francis Maude said, it was always the intention that GDS would step back and DWP would complete the development for Universal Credit.

But disagreements over the approach taken – sources say GDS wanted to scrap the Pathfinder IT and start again – led to GDS pulling out sooner than expected. And that has left a hole that urgently needs to be filled.

Computer Weekly learned from reliable sources last week that Cunnington is already struggling to find suitable skills on the recruitment market, raising concerns about the first major milestone for the end-state system, which is due to be tested with 100 benefit claimants from May.

Recruitment experts say this is no surprise. The demand for developers with agile and digital skills far outstrips supply, according to Harry Gooding, head of client engagement at recruitment consultancy Mortimer Spinks.

“There are, simply, more jobs available in digital and software development than people to do them,” he said.

DWP has to compete against retailers, banks, internet companies and tech startups to attract skilled developers, offering only a public sector wage to potential staff used to hopping from one project to another, with little need to reap the long-term benefits of a well-pensioned civil service career.

Already, sources suggest that Cunnington will be forced to bring in external suppliers to fill the DWP skills gap – at least in the short term.

Software integration

The twin-track approach being adopted is unlikely to be one that experienced software project managers would choose. DWP has decided to pursue two separate projects, with two separate teams, using different methodologies, and then hope that it can combine one with the other further down the track.

“To extend the current IT solution we will be using a standard waterfall delivery approach, largely using existing suppliers and commercial frameworks... The end-state digital solution will be delivered using an agile, and therefore iterative, approach,” said the draft business case for Universal Credit.

The idea is that much of the functionality in the current system, used for the Pathfinder trials, will be re-used as part of the end-state system. Agile experts have doubts about the credibility of such an approach – which “seems to be based on hope rather than logic”, according to Gus Power, chief technology officer of EnergizedWork, a specialist software development firm with extensive experience in agile and digital systems.

“The twin-track approach has at its core the myth of software reuse – that it's free, or at least cheap and cost-effective. This is rarely true, especially in large-scale systems,” said Power.

“Given that the pilot project was started at a different time with different requirements, it is highly likely that the components in that project will prove to be unfit for purpose in the context of the new system,” he said.

“This will result in either additional integration overhead to work around these incompatibilities or further changes being made to the pilot system. Either course of action will most probably result in delay, sub-optimal design and/or the addition of unnecessary delivery constraints.”

DWP staff "audibly gasped" when they heard the figure of 212,000 average monthly migrations first mentioned at an internal meeting in October

This twin-track approach already means that £90m worth of IT work on the Pathfinder system will be thrown away once the end-state system is completed. There must still be a genuine risk that far more may yet prove to be unusable – or at the very least, present a highly complex software integration challenge at a very late stage of the programme.

Data migration

The DWP estimates that during the 14 months leading up to the Universal Credit deadline of the end of 2017, more than 200,000 people will be migrated from the current (non-Universal Credit) benefits system to Universal Credit every month.

That figure came from DWP insiders, but was validated by estimates from the independent Office of Budgetary Responsibility to accompany chancellor George Osborne’s Autumn Statement last month.

That mass migration is entirely back-ended on the project, and its scale is such that it can only represent an enormous risk to the 2017 deadline. Sources say DWP staff "audibly gasped" when they heard the figure of 212,000 average monthly migrations first mentioned at an internal meeting in October.

As the problems at Universal Credit have come to light, the DWP has shifted back interim milestones and missed early promises for the number of claimants that would be on the new benefits system by now. But the department has always insisted that the final deadline of the end of 2017 for national roll-out would still be achieved.

“Our current plans will see all new benefit claimants claiming Universal Credit by 2016, with most existing benefit claimants moving on to Universal Credit during 2016 and 2017,” DWP said in a recent statement.

Even if everything goes perfectly in the next three years, and every interim deadline is met, the system will still not be tested at scale until those first mass migrations from old to new schemes take place.

“Software is not simply about what functions it can perform, but about how it operates in the field and at scale,” said Power.

“To verify that the components and their deployment configuration can meet acceptable performance levels with acceptable resources you need to be able to prove it in a running environment.”

And it is not just data that has to be transferred. According to the draft business case, DWP estimated that it will need to increase the number of staff on Universal Credit by more than 47,000 employees in less than 18 months. That includes a leap from 7,800 workers to more than 35,000 in the first six months of 2016 alone, with nearly 55,000 needed by mid-2017.

It is not clear how many of those will be existing staff that are retrained, but it is possible that several thousand people may need to be recruited to help with processing the changes.

Between the middle of 2015 and the end of 2017, the draft business case also suggested that the caseload will increase from 366,000 at the end of 2015 to more than seven million by the end of 2017 – a mass migration on a scale the UK government has simply never had to manage before.

IT security

Like much of the IT in Universal Credit, the security aspects of the programme have something of a chequered history.

From a security point of view to have everything digital is not sensible or appropriate

Howard Shiplee, Universal Credit

In December 2011, DWP issued a public tender worth over £200m for suppliers to build an Identity Assurance (IDA) system to support the new benefit scheme.

By March 2012, that initiative had been withdrawn after GDS said it should never cost that much. A new tender was issued, worth just £25m, which would develop a marketplace of IDA providers for use across the whole of government. Universal Credit would be one of its first users.

The GDS IDA project continues – although slower than expected. The March 2012 tender stated systems would be operational by spring 2013 to support Universal Credit, but a beta test version of IDA only went live in October last year.

By that time, it was already apparent that Universal Credit was no longer relying on the progress of IDA. The lack of security in the Pathfinder systems was highlighted as one of the major failings by the highly critical National Audit Office report in September 2013 that finally confirmed the full extent of the IT problems on Universal Credit.

A new “conceptual model” for security has now been adopted, and while IDA will still play a part, Universal Credit director general Howard Shiplee made it clear to the Work and Pensions Committee last month that the IDA approach was not considered suitable for the security needs of benefits claimants.

“From a security point of view, to have everything digital is not sensible or appropriate,” he told MPs. “It will take some time to get to a completely online system. You have to prove who you are and what you are doing when you change circumstance.”

Shiplee suggested that a system more akin to opening a bank account would be appropriate, with significant face-to-face interaction at the start, rather than the predominantly online approach adopted by IDA.

As a result, a completely new security system is being developed at a cost of £32m.

You wouldn't start here

There is an old joke whereby a traveller asks a local how to get to their destination. The local replies: “Well, if you’re going there, I wouldn’t start from here.”

If you were going to completely rewrite the UK benefits system, you surely wouldn’t start from the position that DWP finds itself in today. GDS and the Cabinet Office said as much, preferring to start the IT all over again, according to sources. But DWP insisted on the twin-track approach it now has in place.

It is an approach that brings inherent risks thanks to strategic – and political – decisions that experts in recruitment and software development say present a huge challenge.

It may, therefore, not be the last time we see Iain Duncan Smith having to justify such an approach in front of critical MPs.